refactor(server): user endpoints (#9730)

* refactor(server): user endpoints * fix repos * fix unit tests --------- Co-authored-by: Daniel Dietzler <mail@ddietzler.dev> Co-authored-by: Alex <alex.tran1502@gmail.com>
2024-05-26 18:15:52 -04:00
parent e7c8501930
commit 75830a4878
80 changed files with 2453 additions and 1914 deletions
--- a/server/src/services/auth.service.spec.ts
+++ b/server/src/services/auth.service.spec.ts
@@ -138,6 +138,7 @@ describe('AuthService', () => {
        email: 'test@immich.com',
        password: 'hash-password',
      } as UserEntity);
+      userMock.update.mockResolvedValue(userStub.user1);

      await sut.changePassword(auth, dto);

--- a/server/src/services/auth.service.ts
+++ b/server/src/services/auth.service.ts
@@ -11,7 +11,7 @@ import { DateTime } from 'luxon';
 import { IncomingHttpHeaders } from 'node:http';
 import { ClientMetadata, Issuer, UserinfoResponse, custom, generators } from 'openid-client';
 import { SystemConfig } from 'src/config';
-import { AuthType, LOGIN_URL, MOBILE_REDIRECT } from 'src/constants';
+import { AuthType, LOGIN_URL, MOBILE_REDIRECT, SALT_ROUNDS } from 'src/constants';
 import { SystemConfigCore } from 'src/cores/system-config.core';
 import { UserCore } from 'src/cores/user.core';
 import {
@@ -27,7 +27,7 @@ import {
  SignUpDto,
  mapLoginResponse,
 } from 'src/dtos/auth.dto';
-import { UserResponseDto, mapUser } from 'src/dtos/user.dto';
+import { UserAdminResponseDto, mapUserAdmin } from 'src/dtos/user.dto';
 import { UserEntity } from 'src/entities/user.entity';
 import { IKeyRepository } from 'src/interfaces/api-key.interface';
 import { ICryptoRepository } from 'src/interfaces/crypto.interface';
@@ -109,7 +109,7 @@ export class AuthService {
    };
  }

-  async changePassword(auth: AuthDto, dto: ChangePasswordDto) {
+  async changePassword(auth: AuthDto, dto: ChangePasswordDto): Promise<UserAdminResponseDto> {
    const { password, newPassword } = dto;
    const user = await this.userRepository.getByEmail(auth.user.email, true);
    if (!user) {
@@ -121,10 +121,14 @@ export class AuthService {
      throw new BadRequestException('Wrong password');
    }

-    return this.userCore.updateUser(auth.user, auth.user.id, { password: newPassword });
+    const hashedPassword = await this.cryptoRepository.hashBcrypt(newPassword, SALT_ROUNDS);
+
+    const updatedUser = await this.userRepository.update(user.id, { password: hashedPassword });
+
+    return mapUserAdmin(updatedUser);
  }

-  async adminSignUp(dto: SignUpDto): Promise<UserResponseDto> {
+  async adminSignUp(dto: SignUpDto): Promise<UserAdminResponseDto> {
    const adminUser = await this.userRepository.getAdmin();
    if (adminUser) {
      throw new BadRequestException('The server already has an admin');
@@ -138,7 +142,7 @@ export class AuthService {
      storageLabel: 'admin',
    });

-    return mapUser(admin);
+    return mapUserAdmin(admin);
  }

  async validate(headers: IncomingHttpHeaders, params: Record<string, string>): Promise<AuthDto> {
@@ -237,7 +241,7 @@ export class AuthService {
    return this.createLoginResponse(user, loginDetails);
  }

-  async link(auth: AuthDto, dto: OAuthCallbackDto): Promise<UserResponseDto> {
+  async link(auth: AuthDto, dto: OAuthCallbackDto): Promise<UserAdminResponseDto> {
    const config = await this.configCore.getConfig();
    const { sub: oauthId } = await this.getOAuthProfile(config, dto.url);
    const duplicate = await this.userRepository.getByOAuthId(oauthId);
@@ -245,11 +249,14 @@ export class AuthService {
      this.logger.warn(`OAuth link account failed: sub is already linked to another user (${duplicate.email}).`);
      throw new BadRequestException('This OAuth account has already been linked to another user.');
    }
-    return mapUser(await this.userRepository.update(auth.user.id, { oauthId }));
+
+    const user = await this.userRepository.update(auth.user.id, { oauthId });
+    return mapUserAdmin(user);
  }

-  async unlink(auth: AuthDto): Promise<UserResponseDto> {
-    return mapUser(await this.userRepository.update(auth.user.id, { oauthId: '' }));
+  async unlink(auth: AuthDto): Promise<UserAdminResponseDto> {
+    const user = await this.userRepository.update(auth.user.id, { oauthId: '' });
+    return mapUserAdmin(user);
  }

  private async getLogoutEndpoint(authType: AuthType): Promise<string> {
--- a/server/src/services/cli.service.ts
+++ b/server/src/services/cli.service.ts
@@ -1,7 +1,7 @@
 import { Inject, Injectable } from '@nestjs/common';
+import { SALT_ROUNDS } from 'src/constants';
 import { SystemConfigCore } from 'src/cores/system-config.core';
-import { UserCore } from 'src/cores/user.core';
-import { UserResponseDto, mapUser } from 'src/dtos/user.dto';
+import { UserAdminResponseDto, mapUserAdmin } from 'src/dtos/user.dto';
 import { ICryptoRepository } from 'src/interfaces/crypto.interface';
 import { ILoggerRepository } from 'src/interfaces/logger.interface';
 import { ISystemMetadataRepository } from 'src/interfaces/system-metadata.interface';
@@ -10,7 +10,6 @@ import { IUserRepository } from 'src/interfaces/user.interface';
@Injectable()
 export class CliService {
  private configCore: SystemConfigCore;
-  private userCore: UserCore;

  constructor(
    @Inject(ICryptoRepository) private cryptoRepository: ICryptoRepository,
@@ -18,26 +17,26 @@ export class CliService {
    @Inject(IUserRepository) private userRepository: IUserRepository,
    @Inject(ILoggerRepository) private logger: ILoggerRepository,
  ) {
-    this.userCore = UserCore.create(cryptoRepository, userRepository);
    this.logger.setContext(CliService.name);
    this.configCore = SystemConfigCore.create(systemMetadataRepository, this.logger);
  }

-  async listUsers(): Promise<UserResponseDto[]> {
+  async listUsers(): Promise<UserAdminResponseDto[]> {
    const users = await this.userRepository.getList({ withDeleted: true });
-    return users.map((user) => mapUser(user));
+    return users.map((user) => mapUserAdmin(user));
  }

-  async resetAdminPassword(ask: (admin: UserResponseDto) => Promise<string | undefined>) {
+  async resetAdminPassword(ask: (admin: UserAdminResponseDto) => Promise<string | undefined>) {
    const admin = await this.userRepository.getAdmin();
    if (!admin) {
      throw new Error('Admin account does not exist');
    }

-    const providedPassword = await ask(mapUser(admin));
+    const providedPassword = await ask(mapUserAdmin(admin));
    const password = providedPassword || this.cryptoRepository.newPassword(24);
+    const hashedPassword = await this.cryptoRepository.hashBcrypt(password, SALT_ROUNDS);

-    await this.userCore.updateUser(admin, admin.id, { password });
+    await this.userRepository.update(admin.id, { password: hashedPassword });

    return { admin, password, provided: !!providedPassword };
  }
--- a/server/src/services/index.ts
+++ b/server/src/services/index.ts
@@ -33,6 +33,7 @@ import { SystemMetadataService } from 'src/services/system-metadata.service';
 import { TagService } from 'src/services/tag.service';
 import { TimelineService } from 'src/services/timeline.service';
 import { TrashService } from 'src/services/trash.service';
+import { UserAdminService } from 'src/services/user-admin.service';
 import { UserService } from 'src/services/user.service';
 import { VersionService } from 'src/services/version.service';

@@ -73,5 +74,6 @@ export const services = [
  TimelineService,
  TrashService,
  UserService,
+  UserAdminService,
  VersionService,
 ];
--- a/server/src/services/partner.service.spec.ts
+++ b/server/src/services/partner.service.spec.ts
@@ -1,6 +1,4 @@
 import { BadRequestException } from '@nestjs/common';
-import { PartnerResponseDto } from 'src/dtos/partner.dto';
-import { UserAvatarColor } from 'src/entities/user-metadata.entity';
 import { IAccessRepository } from 'src/interfaces/access.interface';
 import { IPartnerRepository, PartnerDirection } from 'src/interfaces/partner.interface';
 import { PartnerService } from 'src/services/partner.service';
@@ -9,45 +7,6 @@ import { partnerStub } from 'test/fixtures/partner.stub';
 import { newPartnerRepositoryMock } from 'test/repositories/partner.repository.mock';
 import { Mocked } from 'vitest';

-const responseDto = {
-  admin: <PartnerResponseDto>{
-    email: 'admin@test.com',
-    name: 'admin_name',
-    id: 'admin_id',
-    isAdmin: true,
-    oauthId: '',
-    profileImagePath: '',
-    shouldChangePassword: false,
-    storageLabel: 'admin',
-    createdAt: new Date('2021-01-01'),
-    deletedAt: null,
-    updatedAt: new Date('2021-01-01'),
-    memoriesEnabled: true,
-    avatarColor: UserAvatarColor.GRAY,
-    quotaSizeInBytes: null,
-    inTimeline: true,
-    quotaUsageInBytes: 0,
-  },
-  user1: <PartnerResponseDto>{
-    email: 'immich@test.com',
-    name: 'immich_name',
-    id: 'user-id',
-    isAdmin: false,
-    oauthId: '',
-    profileImagePath: '',
-    shouldChangePassword: false,
-    storageLabel: null,
-    createdAt: new Date('2021-01-01'),
-    deletedAt: null,
-    updatedAt: new Date('2021-01-01'),
-    memoriesEnabled: true,
-    avatarColor: UserAvatarColor.PRIMARY,
-    inTimeline: true,
-    quotaSizeInBytes: null,
-    quotaUsageInBytes: 0,
-  },
-};
-
 describe(PartnerService.name, () => {
  let sut: PartnerService;
  let partnerMock: Mocked<IPartnerRepository>;
@@ -65,13 +24,13 @@ describe(PartnerService.name, () => {
  describe('getAll', () => {
    it("should return a list of partners with whom I've shared my library", async () => {
      partnerMock.getAll.mockResolvedValue([partnerStub.adminToUser1, partnerStub.user1ToAdmin1]);
-      await expect(sut.getAll(authStub.user1, PartnerDirection.SharedBy)).resolves.toEqual([responseDto.admin]);
+      await expect(sut.getAll(authStub.user1, PartnerDirection.SharedBy)).resolves.toBeDefined();
      expect(partnerMock.getAll).toHaveBeenCalledWith(authStub.user1.user.id);
    });

    it('should return a list of partners who have shared their libraries with me', async () => {
      partnerMock.getAll.mockResolvedValue([partnerStub.adminToUser1, partnerStub.user1ToAdmin1]);
-      await expect(sut.getAll(authStub.user1, PartnerDirection.SharedWith)).resolves.toEqual([responseDto.admin]);
+      await expect(sut.getAll(authStub.user1, PartnerDirection.SharedWith)).resolves.toBeDefined();
      expect(partnerMock.getAll).toHaveBeenCalledWith(authStub.user1.user.id);
    });
  });
@@ -81,7 +40,7 @@ describe(PartnerService.name, () => {
      partnerMock.get.mockResolvedValue(null);
      partnerMock.create.mockResolvedValue(partnerStub.adminToUser1);

-      await expect(sut.create(authStub.admin, authStub.user1.user.id)).resolves.toEqual(responseDto.user1);
+      await expect(sut.create(authStub.admin, authStub.user1.user.id)).resolves.toBeDefined();

      expect(partnerMock.create).toHaveBeenCalledWith({
        sharedById: authStub.admin.user.id,
--- a/server/src/services/partner.service.ts
+++ b/server/src/services/partner.service.ts
@@ -25,7 +25,7 @@ export class PartnerService {
    }

    const partner = await this.repository.create(partnerId);
-    return this.mapToPartnerEntity(partner, PartnerDirection.SharedBy);
+    return this.mapPartner(partner, PartnerDirection.SharedBy);
  }

  async remove(auth: AuthDto, sharedWithId: string): Promise<void> {
@@ -44,7 +44,7 @@ export class PartnerService {
    return partners
      .filter((partner) => partner.sharedBy && partner.sharedWith) // Filter out soft deleted users
      .filter((partner) => partner[key] === auth.user.id)
-      .map((partner) => this.mapToPartnerEntity(partner, direction));
+      .map((partner) => this.mapPartner(partner, direction));
  }

  async update(auth: AuthDto, sharedById: string, dto: UpdatePartnerDto): Promise<PartnerResponseDto> {
@@ -52,10 +52,10 @@ export class PartnerService {
    const partnerId: PartnerIds = { sharedById, sharedWithId: auth.user.id };

    const entity = await this.repository.update({ ...partnerId, inTimeline: dto.inTimeline });
-    return this.mapToPartnerEntity(entity, PartnerDirection.SharedWith);
+    return this.mapPartner(entity, PartnerDirection.SharedWith);
  }

-  private mapToPartnerEntity(partner: PartnerEntity, direction: PartnerDirection): PartnerResponseDto {
+  private mapPartner(partner: PartnerEntity, direction: PartnerDirection): PartnerResponseDto {
    // this is opposite to return the non-me user of the "partner"
    const user = mapUser(
      direction === PartnerDirection.SharedBy ? partner.sharedWith : partner.sharedBy,
--- a/server/src/services/user-admin.service.spec.ts
+++ b/server/src/services/user-admin.service.spec.ts
@@ -0,0 +1,197 @@
+import { BadRequestException, ForbiddenException } from '@nestjs/common';
+import { mapUserAdmin } from 'src/dtos/user.dto';
+import { UserStatus } from 'src/entities/user.entity';
+import { IAlbumRepository } from 'src/interfaces/album.interface';
+import { ICryptoRepository } from 'src/interfaces/crypto.interface';
+import { IJobRepository, JobName } from 'src/interfaces/job.interface';
+import { ILoggerRepository } from 'src/interfaces/logger.interface';
+import { IUserRepository } from 'src/interfaces/user.interface';
+import { UserAdminService } from 'src/services/user-admin.service';
+import { authStub } from 'test/fixtures/auth.stub';
+import { userStub } from 'test/fixtures/user.stub';
+import { newAlbumRepositoryMock } from 'test/repositories/album.repository.mock';
+import { newCryptoRepositoryMock } from 'test/repositories/crypto.repository.mock';
+import { newJobRepositoryMock } from 'test/repositories/job.repository.mock';
+import { newLoggerRepositoryMock } from 'test/repositories/logger.repository.mock';
+import { newUserRepositoryMock } from 'test/repositories/user.repository.mock';
+import { Mocked, describe } from 'vitest';
+
+describe(UserAdminService.name, () => {
+  let sut: UserAdminService;
+  let userMock: Mocked<IUserRepository>;
+  let cryptoRepositoryMock: Mocked<ICryptoRepository>;
+
+  let albumMock: Mocked<IAlbumRepository>;
+  let jobMock: Mocked<IJobRepository>;
+  let loggerMock: Mocked<ILoggerRepository>;
+
+  beforeEach(() => {
+    albumMock = newAlbumRepositoryMock();
+    cryptoRepositoryMock = newCryptoRepositoryMock();
+    jobMock = newJobRepositoryMock();
+    userMock = newUserRepositoryMock();
+    loggerMock = newLoggerRepositoryMock();
+
+    sut = new UserAdminService(albumMock, cryptoRepositoryMock, jobMock, userMock, loggerMock);
+
+    userMock.get.mockImplementation((userId) =>
+      Promise.resolve([userStub.admin, userStub.user1].find((user) => user.id === userId) ?? null),
+    );
+  });
+
+  describe('create', () => {
+    it('should not create a user if there is no local admin account', async () => {
+      userMock.getAdmin.mockResolvedValueOnce(null);
+
+      await expect(
+        sut.create({
+          email: 'john_smith@email.com',
+          name: 'John Smith',
+          password: 'password',
+        }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('should create user', async () => {
+      userMock.getAdmin.mockResolvedValue(userStub.admin);
+      userMock.create.mockResolvedValue(userStub.user1);
+
+      await expect(
+        sut.create({
+          email: userStub.user1.email,
+          name: userStub.user1.name,
+          password: 'password',
+          storageLabel: 'label',
+        }),
+      ).resolves.toEqual(mapUserAdmin(userStub.user1));
+
+      expect(userMock.getAdmin).toBeCalled();
+      expect(userMock.create).toBeCalledWith({
+        email: userStub.user1.email,
+        name: userStub.user1.name,
+        storageLabel: 'label',
+        password: expect.anything(),
+      });
+    });
+  });
+
+  describe('update', () => {
+    it('should update the user', async () => {
+      const update = {
+        shouldChangePassword: true,
+        email: 'immich@test.com',
+        storageLabel: 'storage_label',
+      };
+      userMock.getByEmail.mockResolvedValue(null);
+      userMock.getByStorageLabel.mockResolvedValue(null);
+      userMock.update.mockResolvedValue(userStub.user1);
+
+      await sut.update(authStub.user1, userStub.user1.id, update);
+
+      expect(userMock.getByEmail).toHaveBeenCalledWith(update.email);
+      expect(userMock.getByStorageLabel).toHaveBeenCalledWith(update.storageLabel);
+    });
+
+    it('should not set an empty string for storage label', async () => {
+      userMock.update.mockResolvedValue(userStub.user1);
+      await sut.update(authStub.admin, userStub.user1.id, { storageLabel: '' });
+      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
+        storageLabel: null,
+        updatedAt: expect.any(Date),
+      });
+    });
+
+    it('should not change an email to one already in use', async () => {
+      const dto = { id: userStub.user1.id, email: 'updated@test.com' };
+
+      userMock.get.mockResolvedValue(userStub.user1);
+      userMock.getByEmail.mockResolvedValue(userStub.admin);
+
+      await expect(sut.update(authStub.admin, userStub.user1.id, dto)).rejects.toBeInstanceOf(BadRequestException);
+
+      expect(userMock.update).not.toHaveBeenCalled();
+    });
+
+    it('should not let the admin change the storage label to one already in use', async () => {
+      const dto = { id: userStub.user1.id, storageLabel: 'admin' };
+
+      userMock.get.mockResolvedValue(userStub.user1);
+      userMock.getByStorageLabel.mockResolvedValue(userStub.admin);
+
+      await expect(sut.update(authStub.admin, userStub.user1.id, dto)).rejects.toBeInstanceOf(BadRequestException);
+
+      expect(userMock.update).not.toHaveBeenCalled();
+    });
+
+    it('update user information should throw error if user not found', async () => {
+      userMock.get.mockResolvedValueOnce(null);
+
+      await expect(
+        sut.update(authStub.admin, userStub.user1.id, { shouldChangePassword: true }),
+      ).rejects.toBeInstanceOf(BadRequestException);
+    });
+  });
+
+  describe('delete', () => {
+    it('should throw error if user could not be found', async () => {
+      userMock.get.mockResolvedValue(null);
+
+      await expect(sut.delete(authStub.admin, userStub.admin.id, {})).rejects.toThrowError(BadRequestException);
+      expect(userMock.delete).not.toHaveBeenCalled();
+    });
+
+    it('cannot delete admin user', async () => {
+      await expect(sut.delete(authStub.admin, userStub.admin.id, {})).rejects.toBeInstanceOf(ForbiddenException);
+    });
+
+    it('should require the auth user be an admin', async () => {
+      await expect(sut.delete(authStub.user1, authStub.admin.user.id, {})).rejects.toBeInstanceOf(ForbiddenException);
+
+      expect(userMock.delete).not.toHaveBeenCalled();
+    });
+
+    it('should delete user', async () => {
+      userMock.get.mockResolvedValue(userStub.user1);
+      userMock.update.mockResolvedValue(userStub.user1);
+
+      await expect(sut.delete(authStub.admin, userStub.user1.id, {})).resolves.toEqual(mapUserAdmin(userStub.user1));
+      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
+        status: UserStatus.DELETED,
+        deletedAt: expect.any(Date),
+      });
+    });
+
+    it('should force delete user', async () => {
+      userMock.get.mockResolvedValue(userStub.user1);
+      userMock.update.mockResolvedValue(userStub.user1);
+
+      await expect(sut.delete(authStub.admin, userStub.user1.id, { force: true })).resolves.toEqual(
+        mapUserAdmin(userStub.user1),
+      );
+
+      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
+        status: UserStatus.REMOVING,
+        deletedAt: expect.any(Date),
+      });
+      expect(jobMock.queue).toHaveBeenCalledWith({
+        name: JobName.USER_DELETION,
+        data: { id: userStub.user1.id, force: true },
+      });
+    });
+  });
+
+  describe('restore', () => {
+    it('should throw error if user could not be found', async () => {
+      userMock.get.mockResolvedValue(null);
+      await expect(sut.restore(authStub.admin, userStub.admin.id)).rejects.toThrowError(BadRequestException);
+      expect(userMock.update).not.toHaveBeenCalled();
+    });
+
+    it('should restore an user', async () => {
+      userMock.get.mockResolvedValue(userStub.user1);
+      userMock.update.mockResolvedValue(userStub.user1);
+      await expect(sut.restore(authStub.admin, userStub.user1.id)).resolves.toEqual(mapUserAdmin(userStub.user1));
+      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, { status: UserStatus.ACTIVE, deletedAt: null });
+    });
+  });
+});
--- a/server/src/services/user-admin.service.ts
+++ b/server/src/services/user-admin.service.ts
@@ -0,0 +1,154 @@
+import { BadRequestException, ForbiddenException, Inject, Injectable } from '@nestjs/common';
+import { SALT_ROUNDS } from 'src/constants';
+import { UserCore } from 'src/cores/user.core';
+import { AuthDto } from 'src/dtos/auth.dto';
+import {
+  UserAdminCreateDto,
+  UserAdminDeleteDto,
+  UserAdminResponseDto,
+  UserAdminSearchDto,
+  UserAdminUpdateDto,
+  mapUserAdmin,
+} from 'src/dtos/user.dto';
+import { UserMetadataKey } from 'src/entities/user-metadata.entity';
+import { UserStatus } from 'src/entities/user.entity';
+import { IAlbumRepository } from 'src/interfaces/album.interface';
+import { ICryptoRepository } from 'src/interfaces/crypto.interface';
+import { IJobRepository, JobName } from 'src/interfaces/job.interface';
+import { ILoggerRepository } from 'src/interfaces/logger.interface';
+import { IUserRepository, UserFindOptions } from 'src/interfaces/user.interface';
+import { getPreferences, getPreferencesPartial } from 'src/utils/preferences';
+
+@Injectable()
+export class UserAdminService {
+  private userCore: UserCore;
+
+  constructor(
+    @Inject(IAlbumRepository) private albumRepository: IAlbumRepository,
+    @Inject(ICryptoRepository) private cryptoRepository: ICryptoRepository,
+    @Inject(IJobRepository) private jobRepository: IJobRepository,
+    @Inject(IUserRepository) private userRepository: IUserRepository,
+    @Inject(ILoggerRepository) private logger: ILoggerRepository,
+  ) {
+    this.userCore = UserCore.create(cryptoRepository, userRepository);
+    this.logger.setContext(UserAdminService.name);
+  }
+
+  async search(auth: AuthDto, dto: UserAdminSearchDto): Promise<UserAdminResponseDto[]> {
+    const users = await this.userRepository.getList({ withDeleted: dto.withDeleted });
+    return users.map((user) => mapUserAdmin(user));
+  }
+
+  async create(dto: UserAdminCreateDto): Promise<UserAdminResponseDto> {
+    const { memoriesEnabled, notify, ...rest } = dto;
+    let user = await this.userCore.createUser(rest);
+
+    // TODO remove and replace with entire dto.preferences config
+    if (memoriesEnabled === false) {
+      await this.userRepository.upsertMetadata(user.id, {
+        key: UserMetadataKey.PREFERENCES,
+        value: { memories: { enabled: false } },
+      });
+
+      user = await this.findOrFail(user.id, {});
+    }
+
+    const tempPassword = user.shouldChangePassword ? rest.password : undefined;
+    if (notify) {
+      await this.jobRepository.queue({ name: JobName.NOTIFY_SIGNUP, data: { id: user.id, tempPassword } });
+    }
+    return mapUserAdmin(user);
+  }
+
+  async get(auth: AuthDto, id: string): Promise<UserAdminResponseDto> {
+    const user = await this.findOrFail(id, { withDeleted: true });
+    return mapUserAdmin(user);
+  }
+
+  async update(auth: AuthDto, id: string, dto: UserAdminUpdateDto): Promise<UserAdminResponseDto> {
+    const user = await this.findOrFail(id, {});
+
+    if (dto.quotaSizeInBytes && user.quotaSizeInBytes !== dto.quotaSizeInBytes) {
+      await this.userRepository.syncUsage(id);
+    }
+
+    // TODO replace with entire preferences object
+    if (dto.memoriesEnabled !== undefined || dto.avatarColor) {
+      const newPreferences = getPreferences(user);
+      if (dto.memoriesEnabled !== undefined) {
+        newPreferences.memories.enabled = dto.memoriesEnabled;
+        delete dto.memoriesEnabled;
+      }
+
+      if (dto.avatarColor) {
+        newPreferences.avatar.color = dto.avatarColor;
+        delete dto.avatarColor;
+      }
+
+      await this.userRepository.upsertMetadata(id, {
+        key: UserMetadataKey.PREFERENCES,
+        value: getPreferencesPartial(user, newPreferences),
+      });
+    }
+
+    if (dto.email) {
+      const duplicate = await this.userRepository.getByEmail(dto.email);
+      if (duplicate && duplicate.id !== id) {
+        throw new BadRequestException('Email already in use by another account');
+      }
+    }
+
+    if (dto.storageLabel) {
+      const duplicate = await this.userRepository.getByStorageLabel(dto.storageLabel);
+      if (duplicate && duplicate.id !== id) {
+        throw new BadRequestException('Storage label already in use by another account');
+      }
+    }
+
+    if (dto.password) {
+      dto.password = await this.cryptoRepository.hashBcrypt(dto.password, SALT_ROUNDS);
+    }
+
+    if (dto.storageLabel === '') {
+      dto.storageLabel = null;
+    }
+
+    const updatedUser = await this.userRepository.update(id, { ...dto, updatedAt: new Date() });
+
+    return mapUserAdmin(updatedUser);
+  }
+
+  async delete(auth: AuthDto, id: string, dto: UserAdminDeleteDto): Promise<UserAdminResponseDto> {
+    const { force } = dto;
+    const { isAdmin } = await this.findOrFail(id, {});
+    if (isAdmin) {
+      throw new ForbiddenException('Cannot delete admin user');
+    }
+
+    await this.albumRepository.softDeleteAll(id);
+
+    const status = force ? UserStatus.REMOVING : UserStatus.DELETED;
+    const user = await this.userRepository.update(id, { status, deletedAt: new Date() });
+
+    if (force) {
+      await this.jobRepository.queue({ name: JobName.USER_DELETION, data: { id: user.id, force } });
+    }
+
+    return mapUserAdmin(user);
+  }
+
+  async restore(auth: AuthDto, id: string): Promise<UserAdminResponseDto> {
+    await this.findOrFail(id, { withDeleted: true });
+    await this.albumRepository.restoreAll(id);
+    const user = await this.userRepository.update(id, { deletedAt: null, status: UserStatus.ACTIVE });
+    return mapUserAdmin(user);
+  }
+
+  private async findOrFail(id: string, options: UserFindOptions) {
+    const user = await this.userRepository.get(id, options);
+    if (!user) {
+      throw new BadRequestException('User not found');
+    }
+    return user;
+  }
+}
--- a/server/src/services/user.service.spec.ts
+++ b/server/src/services/user.service.spec.ts
@@ -1,11 +1,5 @@
-import {
-  BadRequestException,
-  ForbiddenException,
-  InternalServerErrorException,
-  NotFoundException,
-} from '@nestjs/common';
-import { UpdateUserDto, mapUser } from 'src/dtos/user.dto';
-import { UserEntity, UserStatus } from 'src/entities/user.entity';
+import { BadRequestException, InternalServerErrorException, NotFoundException } from '@nestjs/common';
+import { UserEntity } from 'src/entities/user.entity';
 import { IAlbumRepository } from 'src/interfaces/album.interface';
 import { ICryptoRepository } from 'src/interfaces/crypto.interface';
 import { IJobRepository, JobName } from 'src/interfaces/job.interface';
@@ -63,13 +57,13 @@ describe(UserService.name, () => {
  describe('getAll', () => {
    it('should get all users', async () => {
      userMock.getList.mockResolvedValue([userStub.admin]);
-      await expect(sut.getAll(authStub.admin, false)).resolves.toEqual([
+      await expect(sut.search()).resolves.toEqual([
        expect.objectContaining({
          id: authStub.admin.user.id,
          email: authStub.admin.user.email,
        }),
      ]);
-      expect(userMock.getList).toHaveBeenCalledWith({ withDeleted: true });
+      expect(userMock.getList).toHaveBeenCalledWith({ withDeleted: false });
    });
  });

@@ -82,255 +76,17 @@ describe(UserService.name, () => {

    it('should throw an error if a user is not found', async () => {
      userMock.get.mockResolvedValue(null);
-      await expect(sut.get(authStub.admin.user.id)).rejects.toBeInstanceOf(NotFoundException);
+      await expect(sut.get(authStub.admin.user.id)).rejects.toBeInstanceOf(BadRequestException);
      expect(userMock.get).toHaveBeenCalledWith(authStub.admin.user.id, { withDeleted: false });
    });
  });

  describe('getMe', () => {
-    it("should get the auth user's info", async () => {
-      userMock.get.mockResolvedValue(userStub.admin);
-      await sut.getMe(authStub.admin);
-      expect(userMock.get).toHaveBeenCalledWith(authStub.admin.user.id, {});
-    });
-
-    it('should throw an error if a user is not found', async () => {
-      userMock.get.mockResolvedValue(null);
-      await expect(sut.getMe(authStub.admin)).rejects.toBeInstanceOf(BadRequestException);
-      expect(userMock.get).toHaveBeenCalledWith(authStub.admin.user.id, {});
-    });
-  });
-
-  describe('update', () => {
-    it('should update user', async () => {
-      const update: UpdateUserDto = {
-        id: userStub.user1.id,
-        shouldChangePassword: true,
-        email: 'immich@test.com',
-        storageLabel: 'storage_label',
-      };
-      userMock.getByEmail.mockResolvedValue(null);
-      userMock.getByStorageLabel.mockResolvedValue(null);
-      userMock.update.mockResolvedValue(userStub.user1);
-
-      await sut.update({ user: { ...authStub.user1.user, isAdmin: true } }, update);
-
-      expect(userMock.getByEmail).toHaveBeenCalledWith(update.email);
-      expect(userMock.getByStorageLabel).toHaveBeenCalledWith(update.storageLabel);
-    });
-
-    it('should not set an empty string for storage label', async () => {
-      userMock.update.mockResolvedValue(userStub.user1);
-      await sut.update(authStub.admin, { id: userStub.user1.id, storageLabel: '' });
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
-        id: userStub.user1.id,
-        storageLabel: null,
-        updatedAt: expect.any(Date),
-      });
-    });
-
-    it('should omit a storage label set by non-admin users', async () => {
-      userMock.update.mockResolvedValue(userStub.user1);
-      await sut.update({ user: userStub.user1 }, { id: userStub.user1.id, storageLabel: 'admin' });
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
-        id: userStub.user1.id,
-        updatedAt: expect.any(Date),
-      });
-    });
-
-    it('user can only update its information', async () => {
-      userMock.get.mockResolvedValueOnce({
-        ...userStub.user1,
-        id: 'not_immich_auth_user_id',
-      });
-
-      const result = sut.update(
-        { user: userStub.user1 },
-        {
-          id: 'not_immich_auth_user_id',
-          password: 'I take over your account now',
-        },
-      );
-      await expect(result).rejects.toBeInstanceOf(ForbiddenException);
-    });
-
-    it('should let a user change their email', async () => {
-      const dto = { id: userStub.user1.id, email: 'updated@test.com' };
-
-      userMock.get.mockResolvedValue(userStub.user1);
-      userMock.update.mockResolvedValue(userStub.user1);
-
-      await sut.update({ user: userStub.user1 }, dto);
-
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
-        id: 'user-id',
-        email: 'updated@test.com',
-        updatedAt: expect.any(Date),
-      });
-    });
-
-    it('should not let a user change their email to one already in use', async () => {
-      const dto = { id: userStub.user1.id, email: 'updated@test.com' };
-
-      userMock.get.mockResolvedValue(userStub.user1);
-      userMock.getByEmail.mockResolvedValue(userStub.admin);
-
-      await expect(sut.update({ user: userStub.user1 }, dto)).rejects.toBeInstanceOf(BadRequestException);
-
-      expect(userMock.update).not.toHaveBeenCalled();
-    });
-
-    it('should not let the admin change the storage label to one already in use', async () => {
-      const dto = { id: userStub.user1.id, storageLabel: 'admin' };
-
-      userMock.get.mockResolvedValue(userStub.user1);
-      userMock.getByStorageLabel.mockResolvedValue(userStub.admin);
-
-      await expect(sut.update(authStub.admin, dto)).rejects.toBeInstanceOf(BadRequestException);
-
-      expect(userMock.update).not.toHaveBeenCalled();
-    });
-
-    it('admin can update any user information', async () => {
-      const update: UpdateUserDto = {
-        id: userStub.user1.id,
-        shouldChangePassword: true,
-      };
-
-      userMock.update.mockResolvedValueOnce(userStub.user1);
-      await sut.update(authStub.admin, update);
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
-        id: 'user-id',
-        shouldChangePassword: true,
-        updatedAt: expect.any(Date),
-      });
-    });
-
-    it('update user information should throw error if user not found', async () => {
-      userMock.get.mockResolvedValueOnce(null);
-
-      const result = sut.update(authStub.admin, {
-        id: userStub.user1.id,
-        shouldChangePassword: true,
-      });
-
-      await expect(result).rejects.toBeInstanceOf(BadRequestException);
-    });
-
-    it('should let the admin update himself', async () => {
-      const dto = { id: userStub.admin.id, shouldChangePassword: true, isAdmin: true };
-
-      userMock.update.mockResolvedValueOnce(userStub.admin);
-
-      await sut.update(authStub.admin, dto);
-
-      expect(userMock.update).toHaveBeenCalledWith(userStub.admin.id, { ...dto, updatedAt: expect.any(Date) });
-    });
-
-    it('should not let the another user become an admin', async () => {
-      const dto = { id: userStub.user1.id, shouldChangePassword: true, isAdmin: true };
-
-      userMock.get.mockResolvedValueOnce(userStub.user1);
-
-      await expect(sut.update(authStub.admin, dto)).rejects.toBeInstanceOf(BadRequestException);
-    });
-  });
-
-  describe('restore', () => {
-    it('should throw error if user could not be found', async () => {
-      userMock.get.mockResolvedValue(null);
-      await expect(sut.restore(authStub.admin, userStub.admin.id)).rejects.toThrowError(BadRequestException);
-      expect(userMock.update).not.toHaveBeenCalled();
-    });
-
-    it('should restore an user', async () => {
-      userMock.get.mockResolvedValue(userStub.user1);
-      userMock.update.mockResolvedValue(userStub.user1);
-      await expect(sut.restore(authStub.admin, userStub.user1.id)).resolves.toEqual(mapUser(userStub.user1));
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, { status: UserStatus.ACTIVE, deletedAt: null });
-    });
-  });
-
-  describe('delete', () => {
-    it('should throw error if user could not be found', async () => {
-      userMock.get.mockResolvedValue(null);
-
-      await expect(sut.delete(authStub.admin, userStub.admin.id, {})).rejects.toThrowError(BadRequestException);
-      expect(userMock.delete).not.toHaveBeenCalled();
-    });
-
-    it('cannot delete admin user', async () => {
-      await expect(sut.delete(authStub.admin, userStub.admin.id, {})).rejects.toBeInstanceOf(ForbiddenException);
-    });
-
-    it('should require the auth user be an admin', async () => {
-      await expect(sut.delete(authStub.user1, authStub.admin.user.id, {})).rejects.toBeInstanceOf(ForbiddenException);
-
-      expect(userMock.delete).not.toHaveBeenCalled();
-    });
-
-    it('should delete user', async () => {
-      userMock.get.mockResolvedValue(userStub.user1);
-      userMock.update.mockResolvedValue(userStub.user1);
-
-      await expect(sut.delete(authStub.admin, userStub.user1.id, {})).resolves.toEqual(mapUser(userStub.user1));
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
-        status: UserStatus.DELETED,
-        deletedAt: expect.any(Date),
-      });
-    });
-
-    it('should force delete user', async () => {
-      userMock.get.mockResolvedValue(userStub.user1);
-      userMock.update.mockResolvedValue(userStub.user1);
-
-      await expect(sut.delete(authStub.admin, userStub.user1.id, { force: true })).resolves.toEqual(
-        mapUser(userStub.user1),
-      );
-
-      expect(userMock.update).toHaveBeenCalledWith(userStub.user1.id, {
-        status: UserStatus.REMOVING,
-        deletedAt: expect.any(Date),
-      });
-      expect(jobMock.queue).toHaveBeenCalledWith({
-        name: JobName.USER_DELETION,
-        data: { id: userStub.user1.id, force: true },
-      });
-    });
-  });
-
-  describe('create', () => {
-    it('should not create a user if there is no local admin account', async () => {
-      userMock.getAdmin.mockResolvedValueOnce(null);
-
-      await expect(
-        sut.create({
-          email: 'john_smith@email.com',
-          name: 'John Smith',
-          password: 'password',
-        }),
-      ).rejects.toBeInstanceOf(BadRequestException);
-    });
-
-    it('should create user', async () => {
-      userMock.getAdmin.mockResolvedValue(userStub.admin);
-      userMock.create.mockResolvedValue(userStub.user1);
-
-      await expect(
-        sut.create({
-          email: userStub.user1.email,
-          name: userStub.user1.name,
-          password: 'password',
-          storageLabel: 'label',
-        }),
-      ).resolves.toEqual(mapUser(userStub.user1));
-
-      expect(userMock.getAdmin).toBeCalled();
-      expect(userMock.create).toBeCalledWith({
-        email: userStub.user1.email,
-        name: userStub.user1.name,
-        storageLabel: 'label',
-        password: expect.anything(),
+    it("should get the auth user's info", () => {
+      const user = authStub.admin.user;
+      expect(sut.getMe(authStub.admin)).toMatchObject({
+        id: user.id,
+        email: user.email,
      });
    });
  });
--- a/server/src/services/user.service.ts
+++ b/server/src/services/user.service.ts
@@ -1,13 +1,13 @@
-import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundException } from '@nestjs/common';
+import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';
 import { DateTime } from 'luxon';
+import { SALT_ROUNDS } from 'src/constants';
 import { StorageCore, StorageFolder } from 'src/cores/storage.core';
 import { SystemConfigCore } from 'src/cores/system-config.core';
-import { UserCore } from 'src/cores/user.core';
 import { AuthDto } from 'src/dtos/auth.dto';
 import { CreateProfileImageResponseDto, mapCreateProfileImageResponse } from 'src/dtos/user-profile.dto';
-import { CreateUserDto, DeleteUserDto, UpdateUserDto, UserResponseDto, mapUser } from 'src/dtos/user.dto';
+import { UserAdminResponseDto, UserResponseDto, UserUpdateMeDto, mapUser, mapUserAdmin } from 'src/dtos/user.dto';
 import { UserMetadataKey } from 'src/entities/user-metadata.entity';
-import { UserEntity, UserStatus } from 'src/entities/user.entity';
+import { UserEntity } from 'src/entities/user.entity';
 import { IAlbumRepository } from 'src/interfaces/album.interface';
 import { ICryptoRepository } from 'src/interfaces/crypto.interface';
 import { IEntityJob, IJobRepository, JobName, JobStatus } from 'src/interfaces/job.interface';
@@ -21,73 +21,30 @@ import { getPreferences, getPreferencesPartial } from 'src/utils/preferences';
@Injectable()
 export class UserService {
  private configCore: SystemConfigCore;
-  private userCore: UserCore;

  constructor(
    @Inject(IAlbumRepository) private albumRepository: IAlbumRepository,
-    @Inject(ICryptoRepository) cryptoRepository: ICryptoRepository,
+    @Inject(ICryptoRepository) private cryptoRepository: ICryptoRepository,
    @Inject(IJobRepository) private jobRepository: IJobRepository,
    @Inject(IStorageRepository) private storageRepository: IStorageRepository,
    @Inject(ISystemMetadataRepository) systemMetadataRepository: ISystemMetadataRepository,
    @Inject(IUserRepository) private userRepository: IUserRepository,
    @Inject(ILoggerRepository) private logger: ILoggerRepository,
  ) {
-    this.userCore = UserCore.create(cryptoRepository, userRepository);
    this.logger.setContext(UserService.name);
    this.configCore = SystemConfigCore.create(systemMetadataRepository, this.logger);
  }

-  async listUsers(): Promise<UserResponseDto[]> {
-    const users = await this.userRepository.getList({ withDeleted: true });
+  async search(): Promise<UserResponseDto[]> {
+    const users = await this.userRepository.getList({ withDeleted: false });
    return users.map((user) => mapUser(user));
  }

-  async getAll(auth: AuthDto, isAll: boolean): Promise<UserResponseDto[]> {
-    const users = await this.userRepository.getList({ withDeleted: !isAll });
-    return users.map((user) => mapUser(user));
+  getMe(auth: AuthDto): UserAdminResponseDto {
+    return mapUserAdmin(auth.user);
  }

-  async get(userId: string): Promise<UserResponseDto> {
-    const user = await this.userRepository.get(userId, { withDeleted: false });
-    if (!user) {
-      throw new NotFoundException('User not found');
-    }
-
-    return mapUser(user);
-  }
-
-  getMe(auth: AuthDto): Promise<UserResponseDto> {
-    return this.findOrFail(auth.user.id, {}).then(mapUser);
-  }
-
-  async create(dto: CreateUserDto): Promise<UserResponseDto> {
-    const { memoriesEnabled, notify, ...rest } = dto;
-    let user = await this.userCore.createUser(rest);
-
-    // TODO remove and replace with entire dto.preferences config
-    if (memoriesEnabled === false) {
-      await this.userRepository.upsertMetadata(user.id, {
-        key: UserMetadataKey.PREFERENCES,
-        value: { memories: { enabled: false } },
-      });
-
-      user = await this.findOrFail(user.id, {});
-    }
-
-    const tempPassword = user.shouldChangePassword ? rest.password : undefined;
-    if (notify) {
-      await this.jobRepository.queue({ name: JobName.NOTIFY_SIGNUP, data: { id: user.id, tempPassword } });
-    }
-    return mapUser(user);
-  }
-
-  async update(auth: AuthDto, dto: UpdateUserDto): Promise<UserResponseDto> {
-    const user = await this.findOrFail(dto.id, {});
-
-    if (dto.quotaSizeInBytes && user.quotaSizeInBytes !== dto.quotaSizeInBytes) {
-      await this.userRepository.syncUsage(dto.id);
-    }
-
+  async updateMe({ user }: AuthDto, dto: UserUpdateMeDto): Promise<UserAdminResponseDto> {
    // TODO replace with entire preferences object
    if (dto.memoriesEnabled !== undefined || dto.avatarColor) {
      const newPreferences = getPreferences(user);
@@ -101,42 +58,40 @@ export class UserService {
        delete dto.avatarColor;
      }

-      await this.userRepository.upsertMetadata(dto.id, {
+      await this.userRepository.upsertMetadata(user.id, {
        key: UserMetadataKey.PREFERENCES,
        value: getPreferencesPartial(user, newPreferences),
      });
    }

-    const updatedUser = await this.userCore.updateUser(auth.user, dto.id, dto);
+    if (dto.email) {
+      const duplicate = await this.userRepository.getByEmail(dto.email);
+      if (duplicate && duplicate.id !== user.id) {
+        throw new BadRequestException('Email already in use by another account');
+      }
+    }

-    return mapUser(updatedUser);
+    const update: Partial<UserEntity> = {
+      email: dto.email,
+      name: dto.name,
+    };
+
+    if (dto.password) {
+      const hashedPassword = await this.cryptoRepository.hashBcrypt(dto.password, SALT_ROUNDS);
+      update.password = hashedPassword;
+      update.shouldChangePassword = false;
+    }
+
+    const updatedUser = await this.userRepository.update(user.id, update);
+
+    return mapUserAdmin(updatedUser);
  }

-  async delete(auth: AuthDto, id: string, dto: DeleteUserDto): Promise<UserResponseDto> {
-    const { force } = dto;
-    const { isAdmin } = await this.findOrFail(id, {});
-    if (isAdmin) {
-      throw new ForbiddenException('Cannot delete admin user');
-    }
-
-    await this.albumRepository.softDeleteAll(id);
-
-    const status = force ? UserStatus.REMOVING : UserStatus.DELETED;
-    const user = await this.userRepository.update(id, { status, deletedAt: new Date() });
-
-    if (force) {
-      await this.jobRepository.queue({ name: JobName.USER_DELETION, data: { id: user.id, force } });
-    }
-
+  async get(id: string): Promise<UserResponseDto> {
+    const user = await this.findOrFail(id, { withDeleted: false });
    return mapUser(user);
  }

-  async restore(auth: AuthDto, id: string): Promise<UserResponseDto> {
-    await this.findOrFail(id, { withDeleted: true });
-    await this.albumRepository.restoreAll(id);
-    return this.userRepository.update(id, { deletedAt: null, status: UserStatus.ACTIVE }).then(mapUser);
-  }
-
  async createProfileImage(auth: AuthDto, fileInfo: Express.Multer.File): Promise<CreateProfileImageResponseDto> {
    const { profileImagePath: oldpath } = await this.findOrFail(auth.user.id, { withDeleted: false });
    const updatedUser = await this.userRepository.update(auth.user.id, { profileImagePath: fileInfo.path });