refactor(server): e2e (#7223)

* refactor: download e2e

* refactor: oauth e2e

* refactor: system config e2e

* refactor: partner e2e

* refactor: server-info e2e

* refactor: user e2e

* chore: uncomment test

e2e/src/api/specs/download.e2e-spec.ts

@@ -0,0 +1,62 @@
+import { AssetResponseDto, LoginResponseDto } from '@immich/sdk';
+import { errorDto } from 'src/responses';
+import { apiUtils, app, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+describe('/download', () => {
+  let admin: LoginResponseDto;
+  let asset1: AssetResponseDto;
+
+  beforeAll(async () => {
+    apiUtils.setup();
+    await dbUtils.reset();
+    admin = await apiUtils.adminSetup();
+    asset1 = await apiUtils.createAsset(admin.accessToken);
+  });
+
+  describe('POST /download/info', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .post(`/download/info`)
+        .send({ assetIds: [asset1.id] });
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should download info', async () => {
+      const { status, body } = await request(app)
+        .post('/download/info')
+        .set('Authorization', `Bearer ${admin.accessToken}`)
+        .send({ assetIds: [asset1.id] });
+
+      expect(status).toBe(201);
+      expect(body).toEqual(
+        expect.objectContaining({
+          archives: [expect.objectContaining({ assetIds: [asset1.id] })],
+        })
+      );
+    });
+  });
+
+  describe('POST /download/asset/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(
+        `/download/asset/${asset1.id}`
+      );
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should download file', async () => {
+      const response = await request(app)
+        .post(`/download/asset/${asset1.id}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(response.status).toBe(200);
+      expect(response.headers['content-type']).toEqual('image/jpeg');
+    });
+  });
+});

e2e/src/api/specs/oauth.e2e-spec.ts

@@ -0,0 +1,30 @@
+import { errorDto } from 'src/responses';
+import { apiUtils, app, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
+
+describe(`/oauth`, () => {
+  beforeAll(() => {
+    apiUtils.setup();
+  });
+
+  beforeEach(async () => {
+    await dbUtils.reset();
+    await apiUtils.adminSetup();
+  });
+
+  describe('POST /oauth/authorize', () => {
+    it(`should throw an error if a redirect uri is not provided`, async () => {
+      const { status, body } = await request(app)
+        .post('/oauth/authorize')
+        .send({});
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        errorDto.badRequest([
+          'redirectUri must be a string',
+          'redirectUri should not be empty',
+        ])
+      );
+    });
+  });
+});

e2e/src/api/specs/partner.e2e-spec.ts

@@ -0,0 +1,150 @@
+import { LoginResponseDto, createPartner } from '@immich/sdk';
+import { createUserDto } from 'src/fixtures';
+import { errorDto } from 'src/responses';
+import { apiUtils, app, asBearerAuth, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+describe('/partner', () => {
+  let admin: LoginResponseDto;
+  let user1: LoginResponseDto;
+  let user2: LoginResponseDto;
+  let user3: LoginResponseDto;
+
+  beforeAll(async () => {
+    apiUtils.setup();
+    await dbUtils.reset();
+
+    admin = await apiUtils.adminSetup();
+
+    [user1, user2, user3] = await Promise.all([
+      apiUtils.userSetup(admin.accessToken, createUserDto.user1),
+      apiUtils.userSetup(admin.accessToken, createUserDto.user2),
+      apiUtils.userSetup(admin.accessToken, createUserDto.user3),
+    ]);
+
+    await Promise.all([
+      createPartner(
+        { id: user2.userId },
+        { headers: asBearerAuth(user1.accessToken) }
+      ),
+      createPartner(
+        { id: user1.userId },
+        { headers: asBearerAuth(user2.accessToken) }
+      ),
+    ]);
+  });
+
+  describe('GET /partner', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/partner');
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should get all partners shared by user', async () => {
+      const { status, body } = await request(app)
+        .get('/partner')
+        .set('Authorization', `Bearer ${user1.accessToken}`)
+        .query({ direction: 'shared-by' });
+
+      expect(status).toBe(200);
+      expect(body).toEqual([expect.objectContaining({ id: user2.userId })]);
+    });
+
+    it('should get all partners that share with user', async () => {
+      const { status, body } = await request(app)
+        .get('/partner')
+        .set('Authorization', `Bearer ${user1.accessToken}`)
+        .query({ direction: 'shared-with' });
+
+      expect(status).toBe(200);
+      expect(body).toEqual([expect.objectContaining({ id: user2.userId })]);
+    });
+  });
+
+  describe('POST /partner/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).post(
+        `/partner/${user3.userId}`
+      );
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should share with new partner', async () => {
+      const { status, body } = await request(app)
+        .post(`/partner/${user3.userId}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+
+      expect(status).toBe(201);
+      expect(body).toEqual(expect.objectContaining({ id: user3.userId }));
+    });
+
+    it('should not share with new partner if already sharing with this partner', async () => {
+      const { status, body } = await request(app)
+        .post(`/partner/${user2.userId}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        expect.objectContaining({ message: 'Partner already exists' })
+      );
+    });
+  });
+
+  describe('PUT /partner/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(
+        `/partner/${user2.userId}`
+      );
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should update partner', async () => {
+      const { status, body } = await request(app)
+        .put(`/partner/${user2.userId}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`)
+        .send({ inTimeline: false });
+
+      expect(status).toBe(200);
+      expect(body).toEqual(
+        expect.objectContaining({ id: user2.userId, inTimeline: false })
+      );
+    });
+  });
+
+  describe('DELETE /partner/:id', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).delete(
+        `/partner/${user3.userId}`
+      );
+
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should delete partner', async () => {
+      const { status } = await request(app)
+        .delete(`/partner/${user3.userId}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+
+      expect(status).toBe(200);
+    });
+
+    it('should throw a bad request if partner not found', async () => {
+      const { status, body } = await request(app)
+        .delete(`/partner/${user3.userId}`)
+        .set('Authorization', `Bearer ${user1.accessToken}`);
+
+      expect(status).toBe(400);
+      expect(body).toEqual(
+        expect.objectContaining({ message: 'Partner not found' })
+      );
+    });
+  });
+});

e2e/src/api/specs/server-info.e2e-spec.ts

@@ -0,0 +1,184 @@
+import { LoginResponseDto, getServerConfig } from '@immich/sdk';
+import { createUserDto } from 'src/fixtures';
+import { errorDto } from 'src/responses';
+import { apiUtils, app, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+describe('/server-info', () => {
+  let admin: LoginResponseDto;
+  let nonAdmin: LoginResponseDto;
+
+  beforeAll(async () => {
+    apiUtils.setup();
+    await dbUtils.reset();
+    admin = await apiUtils.adminSetup({ onboarding: false });
+    nonAdmin = await apiUtils.userSetup(admin.accessToken, createUserDto.user1);
+  });
+
+  describe('GET /server-info', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/server-info');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should return the disk information', async () => {
+      const { status, body } = await request(app)
+        .get('/server-info')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        diskAvailable: expect.any(String),
+        diskAvailableRaw: expect.any(Number),
+        diskSize: expect.any(String),
+        diskSizeRaw: expect.any(Number),
+        diskUsagePercentage: expect.any(Number),
+        diskUse: expect.any(String),
+        diskUseRaw: expect.any(Number),
+      });
+    });
+  });
+
+  describe('GET /server-info/ping', () => {
+    it('should respond with pong', async () => {
+      const { status, body } = await request(app).get('/server-info/ping');
+      expect(status).toBe(200);
+      expect(body).toEqual({ res: 'pong' });
+    });
+  });
+
+  describe('GET /server-info/version', () => {
+    it('should respond with the server version', async () => {
+      const { status, body } = await request(app).get('/server-info/version');
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        major: expect.any(Number),
+        minor: expect.any(Number),
+        patch: expect.any(Number),
+      });
+    });
+  });
+
+  describe('GET /server-info/features', () => {
+    it('should respond with the server features', async () => {
+      const { status, body } = await request(app).get('/server-info/features');
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        smartSearch: false,
+        configFile: false,
+        facialRecognition: false,
+        map: true,
+        reverseGeocoding: true,
+        oauth: false,
+        oauthAutoLaunch: false,
+        passwordLogin: true,
+        search: true,
+        sidecar: true,
+        trash: true,
+      });
+    });
+  });
+
+  describe('GET /server-info/config', () => {
+    it('should respond with the server configuration', async () => {
+      const { status, body } = await request(app).get('/server-info/config');
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        loginPageMessage: '',
+        oauthButtonText: 'Login with OAuth',
+        trashDays: 30,
+        isInitialized: true,
+        externalDomain: '',
+        isOnboarded: false,
+      });
+    });
+  });
+
+  describe('GET /server-info/statistics', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(
+        '/server-info/statistics'
+      );
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should only work for admins', async () => {
+      const { status, body } = await request(app)
+        .get('/server-info/statistics')
+        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
+      expect(status).toBe(403);
+      expect(body).toEqual(errorDto.forbidden);
+    });
+
+    it('should return the server stats', async () => {
+      const { status, body } = await request(app)
+        .get('/server-info/statistics')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        photos: 0,
+        usage: 0,
+        usageByUser: [
+          {
+            quotaSizeInBytes: null,
+            photos: 0,
+            usage: 0,
+            userName: 'Immich Admin',
+            userId: admin.userId,
+            videos: 0,
+          },
+          {
+            quotaSizeInBytes: null,
+            photos: 0,
+            usage: 0,
+            userName: 'User 1',
+            userId: nonAdmin.userId,
+            videos: 0,
+          },
+        ],
+        videos: 0,
+      });
+    });
+  });
+
+  describe('GET /server-info/media-types', () => {
+    it('should return accepted media types', async () => {
+      const { status, body } = await request(app).get(
+        '/server-info/media-types'
+      );
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        sidecar: ['.xmp'],
+        image: expect.any(Array),
+        video: expect.any(Array),
+      });
+    });
+  });
+
+  describe('GET /server-info/theme', () => {
+    it('should respond with the server theme', async () => {
+      const { status, body } = await request(app).get('/server-info/theme');
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        customCss: '',
+      });
+    });
+  });
+
+  describe('POST /server-info/admin-onboarding', () => {
+    it('should set admin onboarding', async () => {
+      const config = await getServerConfig({});
+      expect(config.isOnboarded).toBe(false);
+
+      const { status } = await request(app)
+        .post('/server-info/admin-onboarding')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(204);
+
+      const newConfig = await getServerConfig({});
+      expect(newConfig.isOnboarded).toBe(true);
+    });
+  });
+});

e2e/src/api/specs/system-config.e2e-spec.ts

@@ -0,0 +1,70 @@
+import { LoginResponseDto } from '@immich/sdk';
+import { createUserDto } from 'src/fixtures';
+import { errorDto } from 'src/responses';
+import { apiUtils, app, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, describe, expect, it } from 'vitest';
+
+describe('/system-config', () => {
+  let admin: LoginResponseDto;
+  let nonAdmin: LoginResponseDto;
+
+  beforeAll(async () => {
+    apiUtils.setup();
+    await dbUtils.reset();
+    admin = await apiUtils.adminSetup();
+    nonAdmin = await apiUtils.userSetup(admin.accessToken, createUserDto.user1);
+  });
+
+  describe('GET /system-config/map/style.json', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(
+        '/system-config/map/style.json'
+      );
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should throw an error if a theme is not light or dark', async () => {
+      for (const theme of ['dark1', true, 123, '', null, undefined]) {
+        const { status, body } = await request(app)
+          .get('/system-config/map/style.json')
+          .query({ theme })
+          .set('Authorization', `Bearer ${admin.accessToken}`);
+        expect(status).toBe(400);
+        expect(body).toEqual(
+          errorDto.badRequest([
+            'theme must be one of the following values: light, dark',
+          ])
+        );
+      }
+    });
+
+    it('should return the light style.json', async () => {
+      const { status, body } = await request(app)
+        .get('/system-config/map/style.json')
+        .query({ theme: 'light' })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual(expect.objectContaining({ id: 'immich-map-light' }));
+    });
+
+    it('should return the dark style.json', async () => {
+      const { status, body } = await request(app)
+        .get('/system-config/map/style.json')
+        .query({ theme: 'dark' })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual(expect.objectContaining({ id: 'immich-map-dark' }));
+    });
+
+    it('should not require admin authentication', async () => {
+      const { status, body } = await request(app)
+        .get('/system-config/map/style.json')
+        .query({ theme: 'dark' })
+        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toEqual(expect.objectContaining({ id: 'immich-map-dark' }));
+    });
+  });
+});

e2e/src/api/specs/user.e2e-spec.ts

@@ -0,0 +1,323 @@
+import {
+  LoginResponseDto,
+  UserResponseDto,
+  createUser,
+  deleteUser,
+  getUserById,
+} from '@immich/sdk';
+import { createUserDto, userDto } from 'src/fixtures';
+import { errorDto } from 'src/responses';
+import { apiUtils, app, asBearerAuth, dbUtils } from 'src/utils';
+import request from 'supertest';
+import { beforeAll, beforeEach, describe, expect, it } from 'vitest';
+
+describe('/server-info', () => {
+  let admin: LoginResponseDto;
+
+  beforeAll(async () => {
+    apiUtils.setup();
+  });
+
+  beforeEach(async () => {
+    await dbUtils.reset();
+    admin = await apiUtils.adminSetup({ onboarding: false });
+  });
+
+  describe('GET /user', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get('/user');
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should start with the admin', async () => {
+      const { status, body } = await request(app)
+        .get('/user')
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toEqual(200);
+      expect(body).toHaveLength(1);
+      expect(body[0]).toMatchObject({ email: 'admin@immich.cloud' });
+    });
+
+    it('should hide deleted users', async () => {
+      const user1 = await apiUtils.userSetup(
+        admin.accessToken,
+        createUserDto.user1
+      );
+      await deleteUser(
+        { id: user1.userId },
+        { headers: asBearerAuth(admin.accessToken) }
+      );
+
+      const { status, body } = await request(app)
+        .get(`/user`)
+        .query({ isAll: true })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toHaveLength(1);
+      expect(body[0]).toMatchObject({ email: 'admin@immich.cloud' });
+    });
+
+    it('should include deleted users', async () => {
+      const user1 = await apiUtils.userSetup(
+        admin.accessToken,
+        createUserDto.user1
+      );
+      await deleteUser(
+        { id: user1.userId },
+        { headers: asBearerAuth(admin.accessToken) }
+      );
+
+      const { status, body } = await request(app)
+        .get(`/user`)
+        .query({ isAll: false })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toHaveLength(2);
+      expect(body[0]).toMatchObject({
+        id: user1.userId,
+        email: 'user1@immich.cloud',
+        deletedAt: expect.any(String),
+      });
+      expect(body[1]).toMatchObject({
+        id: admin.userId,
+        email: 'admin@immich.cloud',
+      });
+    });
+  });
+
+  describe('GET /user/info/:id', () => {
+    it('should require authentication', async () => {
+      const { status } = await request(app).get(`/user/info/${admin.userId}`);
+      expect(status).toEqual(401);
+    });
+
+    it('should get the user info', async () => {
+      const { status, body } = await request(app)
+        .get(`/user/info/${admin.userId}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toMatchObject({
+        id: admin.userId,
+        email: 'admin@immich.cloud',
+      });
+    });
+  });
+
+  describe('GET /user/me', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/user/me`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should get my info', async () => {
+      const { status, body } = await request(app)
+        .get(`/user/me`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(status).toBe(200);
+      expect(body).toMatchObject({
+        id: admin.userId,
+        email: 'admin@immich.cloud',
+      });
+    });
+  });
+
+  describe('POST /user', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app)
+        .post(`/user`)
+        .send(createUserDto.user1);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    for (const key of Object.keys(createUserDto.user1)) {
+      it(`should not allow null ${key}`, async () => {
+        const { status, body } = await request(app)
+          .post(`/user`)
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send({ ...createUserDto.user1, [key]: null });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+    }
+
+    it('should ignore `isAdmin`', async () => {
+      const { status, body } = await request(app)
+        .post(`/user`)
+        .send({
+          isAdmin: true,
+          email: 'user1@immich.cloud',
+          password: 'Password123',
+          name: 'Immich',
+        })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(body).toMatchObject({
+        email: 'user1@immich.cloud',
+        isAdmin: false,
+        shouldChangePassword: true,
+      });
+      expect(status).toBe(201);
+    });
+
+    it('should create a user without memories enabled', async () => {
+      const { status, body } = await request(app)
+        .post(`/user`)
+        .send({
+          email: 'no-memories@immich.cloud',
+          password: 'Password123',
+          name: 'No Memories',
+          memoriesEnabled: false,
+        })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+      expect(body).toMatchObject({
+        email: 'no-memories@immich.cloud',
+        memoriesEnabled: false,
+      });
+      expect(status).toBe(201);
+    });
+  });
+
+  describe('DELETE /user/:id', () => {
+    let userToDelete: UserResponseDto;
+
+    beforeEach(async () => {
+      userToDelete = await createUser(
+        { createUserDto: createUserDto.user1 },
+        { headers: asBearerAuth(admin.accessToken) }
+      );
+    });
+
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).delete(
+        `/user/${userToDelete.id}`
+      );
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should delete user', async () => {
+      const { status, body } = await request(app)
+        .delete(`/user/${userToDelete.id}`)
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        ...userToDelete,
+        updatedAt: expect.any(String),
+        deletedAt: expect.any(String),
+      });
+    });
+  });
+
+  describe('PUT /user', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).put(`/user`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    for (const key of Object.keys(userDto.admin)) {
+      it(`should not allow null ${key}`, async () => {
+        const { status, body } = await request(app)
+          .put(`/user`)
+          .set('Authorization', `Bearer ${admin.accessToken}`)
+          .send({ ...userDto.admin, [key]: null });
+        expect(status).toBe(400);
+        expect(body).toEqual(errorDto.badRequest());
+      });
+    }
+
+    it('should not allow a non-admin to become an admin', async () => {
+      const user = await apiUtils.userSetup(
+        admin.accessToken,
+        createUserDto.user1
+      );
+
+      const { status, body } = await request(app)
+        .put(`/user`)
+        .send({ isAdmin: true, id: user.userId })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(400);
+      expect(body).toEqual(errorDto.alreadyHasAdmin);
+    });
+
+    it('ignores updates to profileImagePath', async () => {
+      const { status, body } = await request(app)
+        .put(`/user`)
+        .send({ id: admin.userId, profileImagePath: 'invalid.jpg' })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toMatchObject({ id: admin.userId, profileImagePath: '' });
+    });
+
+    it('should ignore updates to createdAt, updatedAt and deletedAt', async () => {
+      const before = await getUserById(
+        { id: admin.userId },
+        { headers: asBearerAuth(admin.accessToken) }
+      );
+
+      const { status, body } = await request(app)
+        .put(`/user`)
+        .send({
+          id: admin.userId,
+          createdAt: '2023-01-01T00:00:00.000Z',
+          updatedAt: '2023-01-01T00:00:00.000Z',
+          deletedAt: '2023-01-01T00:00:00.000Z',
+        })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toStrictEqual(before);
+    });
+
+    it('should update first and last name', async () => {
+      const before = await getUserById(
+        { id: admin.userId },
+        { headers: asBearerAuth(admin.accessToken) }
+      );
+
+      const { status, body } = await request(app)
+        .put(`/user`)
+        .send({
+          id: admin.userId,
+          name: 'Name',
+        })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toEqual({
+        ...before,
+        updatedAt: expect.any(String),
+        name: 'Name',
+      });
+      expect(before.updatedAt).not.toEqual(body.updatedAt);
+    });
+
+    it('should update memories enabled', async () => {
+      const before = await getUserById(
+        { id: admin.userId },
+        { headers: asBearerAuth(admin.accessToken) }
+      );
+      const { status, body } = await request(app)
+        .put(`/user`)
+        .send({
+          id: admin.userId,
+          memoriesEnabled: false,
+        })
+        .set('Authorization', `Bearer ${admin.accessToken}`);
+
+      expect(status).toBe(200);
+      expect(body).toMatchObject({
+        ...before,
+        updatedAt: expect.anything(),
+        memoriesEnabled: false,
+      });
+      expect(before.updatedAt).not.toEqual(body.updatedAt);
+    });
+  });
+});

e2e/src/fixtures.ts

@@ -1,3 +1,5 @@
+import { UserAvatarColor } from '@immich/sdk';
+
 export const uuidDto = {
   invalid: 'invalid-uuid',
   // valid uuid v4
@@ -17,3 +19,62 @@ export const loginDto = {
 export const signupDto = {
   admin: adminSignupDto,
 };
+
+export const createUserDto = {
+  user1: {
+    email: 'user1@immich.cloud',
+    name: 'User 1',
+    password: 'password1',
+  },
+  user2: {
+    email: 'user2@immich.cloud',
+    name: 'User 2',
+    password: 'password12',
+  },
+  user3: {
+    email: 'user3@immich.cloud',
+    name: 'User 3',
+    password: 'password123',
+  },
+};
+
+export const userDto = {
+  admin: {
+    name: signupDto.admin.name,
+    email: signupDto.admin.email,
+    password: signupDto.admin.password,
+    storageLabel: 'admin',
+    externalPath: null,
+    oauthId: '',
+    shouldChangePassword: false,
+    profileImagePath: '',
+    createdAt: new Date('2021-01-01'),
+    deletedAt: null,
+    updatedAt: new Date('2021-01-01'),
+    tags: [],
+    assets: [],
+    memoriesEnabled: true,
+    avatarColor: UserAvatarColor.Primary,
+    quotaSizeInBytes: null,
+    quotaUsageInBytes: 0,
+  },
+  user1: {
+    name: createUserDto.user1.name,
+    email: createUserDto.user1.email,
+    password: createUserDto.user1.password,
+    storageLabel: null,
+    externalPath: null,
+    oauthId: '',
+    shouldChangePassword: false,
+    profileImagePath: '',
+    createdAt: new Date('2021-01-01'),
+    deletedAt: null,
+    updatedAt: new Date('2021-01-01'),
+    tags: [],
+    assets: [],
+    memoriesEnabled: true,
+    avatarColor: UserAvatarColor.Primary,
+    quotaSizeInBytes: null,
+    quotaUsageInBytes: 0,
+  },
+};

e2e/src/utils.ts

@@ -1,6 +1,10 @@
 import {
+  AssetResponseDto,
+  CreateAssetDto,
+  CreateUserDto,
   LoginResponseDto,
   createApiKey,
+  createUser,
   defaults,
   login,
   setAdminOnboarding,
@@ -8,10 +12,12 @@ import {
 } from '@immich/sdk';
 import { BrowserContext } from '@playwright/test';
 import { spawn } from 'child_process';
+import { randomBytes } from 'node:crypto';
 import { access } from 'node:fs/promises';
 import path from 'node:path';
 import pg from 'pg';
 import { loginDto, signupDto } from 'src/fixtures';
+import request from 'supertest';
 
 export const app = 'http://127.0.0.1:2283/api';
 
@@ -105,22 +111,60 @@ export const immichCli = async (args: string[]) => {
   return deferred;
 };
 
+export interface AdminSetupOptions {
+  onboarding?: boolean;
+}
+
 export const apiUtils = {
   setup: () => {
     setBaseUrl();
   },
-  adminSetup: async () => {
+  adminSetup: async (options?: AdminSetupOptions) => {
+    options = options || { onboarding: true };
+
     await signUpAdmin({ signUpDto: signupDto.admin });
     const response = await login({ loginCredentialDto: loginDto.admin });
-    await setAdminOnboarding({ headers: asBearerAuth(response.accessToken) });
+    if (options.onboarding) {
+      await setAdminOnboarding({ headers: asBearerAuth(response.accessToken) });
+    }
     return response;
   },
+  userSetup: async (accessToken: string, dto: CreateUserDto) => {
+    await createUser(
+      { createUserDto: dto },
+      { headers: asBearerAuth(accessToken) }
+    );
+    return login({
+      loginCredentialDto: { email: dto.email, password: dto.password },
+    });
+  },
   createApiKey: (accessToken: string) => {
     return createApiKey(
       { apiKeyCreateDto: { name: 'e2e' } },
       { headers: asBearerAuth(accessToken) }
     );
   },
+  createAsset: async (
+    accessToken: string,
+    dto?: Omit<CreateAssetDto, 'assetData'>
+  ) => {
+    dto = dto || {
+      deviceAssetId: 'test-1',
+      deviceId: 'test',
+      fileCreatedAt: new Date().toISOString(),
+      fileModifiedAt: new Date().toISOString(),
+    };
+    const { body } = await request(app)
+      .post(`/asset/upload`)
+      .field('deviceAssetId', dto.deviceAssetId)
+      .field('deviceId', dto.deviceId)
+      .field('fileCreatedAt', dto.fileCreatedAt)
+      .field('fileModifiedAt', dto.fileModifiedAt)
+      .attach('assetData', randomBytes(32), 'example.jpg')
+      .set('Authorization', `Bearer ${accessToken}`);
+
+    return body as AssetResponseDto;
+  },
 };
 
 export const cliUtils = {