fix: set specific AssetUpload permission on checkBulkUpload endpoint (#21470)

* fix: set specific AssetUpload permission on checkBulkUpload endpoint

Fixes #21456

* fix: make open-api

mobile/openapi/lib/api/assets_api.dart

@@ -18,7 +18,7 @@ class AssetsApi {
 
   /// checkBulkUpload
   ///
-  /// Checks if assets exist by checksums
+  /// Checks if assets exist by checksums. This endpoint requires the `asset.upload` permission.
   ///
   /// Note: This method returns the HTTP [Response].
   ///
@@ -52,7 +52,7 @@ class AssetsApi {
 
   /// checkBulkUpload
   ///
-  /// Checks if assets exist by checksums
+  /// Checks if assets exist by checksums. This endpoint requires the `asset.upload` permission.
   ///
   /// Parameters:
   ///

open-api/immich-openapi-specs.json

@@ -1855,7 +1855,7 @@
     },
     "/assets/bulk-upload-check": {
       "post": {
-        "description": "Checks if assets exist by checksums",
+        "description": "Checks if assets exist by checksums. This endpoint requires the `asset.upload` permission.",
         "operationId": "checkBulkUpload",
         "parameters": [],
         "requestBody": {
@@ -1894,7 +1894,8 @@
         "summary": "checkBulkUpload",
         "tags": [
           "Assets"
-        ]
+        ],
+        "x-immich-permission": "asset.upload"
       }
     },
     "/assets/device/{deviceId}": {

server/src/controllers/asset-media.controller.ts

@@ -188,7 +188,7 @@ export class AssetMediaController {
    * Checks if assets exist by checksums
    */
   @Post('bulk-upload-check')
-  @Authenticated()
+  @Authenticated({ permission: Permission.AssetUpload })
   @ApiOperation({
     summary: 'checkBulkUpload',
     description: 'Checks if assets exist by checksums',