Inherit parental restrictions on shared accounts, with a chosen rating cap

A shared account previously inherited its members' library access but
none of their content restrictions, so a child could log into "alice+kid"
with their own password and get around their own rating cap.

The shared account now gets the strictest member's parental rating,
unrated-item block, blocked tags and allowed tags, recomputed at
creation, on membership change and at startup. An admin can raise the
rating cap on a slider between the strictest and the loosest member;
unrated and tag rules stay strictest-wins.

What makes raising the cap safe is the unlock rule: after a member's
password matches, both users' live policies are compared and the login
is refused if the account is looser than the member on any field. So
raising the cap above the child's rating means the child's password no
longer opens the account, while the parent's still does. The same rule
bounds the slider - past the loosest member nobody could unlock the
account - so a chosen cap is clamped back into range whenever applied.

Allowed tags need care: Jellyfin reads an empty list as "no whitelist",
so an empty intersection of members' whitelists is written as a sentinel
tag no item carries. Access schedules and channels are not inherited yet.

The shared account is never an administrator. Groups created at the
login screen always inherit and are restricted before the first session
exists. The dashboard shows each member's cap, who a chosen cap shuts
out, and the restrictions in effect, and gains a per-group edit form for
the sync options.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether/Services/ProvisioningService.cs

@@ -33,6 +33,7 @@ public class ProvisioningService : IProvisioningService
 
     private readonly IUserManager _userManager;
     private readonly ILibraryAccessService _libraryAccessService;
+    private readonly IRestrictionService _restrictionService;
     private readonly ILogger<ProvisioningService> _logger;
 
     /// <summary>
@@ -40,14 +41,17 @@ public class ProvisioningService : IProvisioningService
     /// </summary>
     /// <param name="userManager">The user manager.</param>
     /// <param name="libraryAccessService">The library access service.</param>
+    /// <param name="restrictionService">The content restriction service.</param>
     /// <param name="logger">The logger.</param>
     public ProvisioningService(
         IUserManager userManager,
         ILibraryAccessService libraryAccessService,
+        IRestrictionService restrictionService,
         ILogger<ProvisioningService> logger)
     {
         _userManager = userManager;
         _libraryAccessService = libraryAccessService;
+        _restrictionService = restrictionService;
         _logger = logger;
     }
 
@@ -119,14 +123,17 @@ public class ProvisioningService : IProvisioningService
         sharedUser.AuthenticationProviderId = AuthProviderId;
         await _userManager.UpdateUserAsync(sharedUser).ConfigureAwait(false);
 
-        await ApplyLibraryAccessAsync(sharedUser.Id, distinctIds).ConfigureAwait(false);
-
         var group = new SharedGroup
         {
             SharedUserId = sharedUser.Id,
             MemberUserIds = distinctIds
         };
 
+        // Restrict before the group is recorded, so an account created from the login screen is
+        // never usable, even once, with fewer restrictions than its members have. A new group
+        // always inherits; a cap is chosen afterwards in the dashboard.
+        await ApplyDerivedPolicyAsync(group).ConfigureAwait(false);
+
         config.Groups.Add(group);
         plugin.UpdateConfiguration(config);
 
@@ -145,7 +152,9 @@ public class ProvisioningService : IProvisioningService
         IReadOnlyList<Guid> memberIds,
         bool syncUnwatched,
         bool syncPlayCount,
-        bool isDisabled)
+        bool isDisabled,
+        bool inheritParentalRating,
+        int? parentalRatingCap)
     {
         ArgumentNullException.ThrowIfNull(memberIds);
 
@@ -188,18 +197,25 @@ public class ProvisioningService : IProvisioningService
         group.SyncUnwatched = syncUnwatched;
         group.SyncPlayCount = syncPlayCount;
         group.IsDisabled = isDisabled;
+        group.InheritParentalRating = inheritParentalRating;
+        group.ParentalRatingCap = inheritParentalRating ? null : parentalRatingCap;
 
         plugin.UpdateConfiguration(config);
 
-        // Membership drives library access, so recompute it: adding a member can only narrow the
-        // intersection, and removing one may widen it.
-        await ApplyLibraryAccessAsync(sharedUserId, distinctIds).ConfigureAwait(false);
+        // Membership drives the derived policy, so recompute it: adding a member can only narrow
+        // library access and tighten restrictions, and removing one may widen either. The chosen
+        // cap may be pulled back into the new members' range, in which case it is saved again.
+        if (await ApplyDerivedPolicyAsync(group).ConfigureAwait(false))
+        {
+            plugin.UpdateConfiguration(config);
+        }
 
         _logger.LogInformation(
-            "Updated group {SharedUserId}: {MemberCount} members, disabled={IsDisabled}",
+            "Updated group {SharedUserId}: {MemberCount} members, disabled={IsDisabled}, rating cap={RatingCap}",
             sharedUserId,
             distinctIds.Count,
-            isDisabled);
+            isDisabled,
+            group.InheritParentalRating ? "inherited" : group.ParentalRatingCap?.ToString(CultureInfo.InvariantCulture) ?? "none");
 
         return group;
     }
@@ -266,24 +282,30 @@ public class ProvisioningService : IProvisioningService
         => Convert.ToBase64String(RandomNumberGenerator.GetBytes(48));
 
     /// <summary>
-    /// Sets library access on the shared account.
+    /// Writes everything about the shared account's policy that follows from its membership:
+    /// library access and content restrictions.
     /// </summary>
-    /// <param name="sharedUserId">The shared account.</param>
-    /// <param name="memberIds">The members whose access is intersected.</param>
-    /// <returns>A task representing the update.</returns>
-    private async Task ApplyLibraryAccessAsync(Guid sharedUserId, IReadOnlyList<Guid> memberIds)
+    /// <param name="group">The group whose shared account to update.</param>
+    /// <returns><c>true</c> if the group's chosen rating cap was adjusted and needs saving.</returns>
+    private async Task<bool> ApplyDerivedPolicyAsync(SharedGroup group)
     {
-        var user = _userManager.GetUserById(sharedUserId);
+        var user = _userManager.GetUserById(group.SharedUserId);
         if (user is null)
         {
-            return;
+            return false;
         }
 
         // Never "all folders": the shared account gets an explicit list of the libraries every
-        // member can already reach, so joining a group can never grant access to anything.
+        // member can already reach, so joining a group can never grant access to anything. And
+        // never an administrator: the account is a union of other people's credentials and must
+        // not carry a privilege none of them individually hold.
         user.SetPermission(PermissionKind.EnableAllFolders, false);
+        user.SetPermission(PermissionKind.IsAdministrator, false);
         await _userManager.UpdateUserAsync(user).ConfigureAwait(false);
 
-        await _libraryAccessService.ApplyIntersectionAsync(sharedUserId, memberIds).ConfigureAwait(false);
+        await _libraryAccessService.ApplyIntersectionAsync(group.SharedUserId, group.MemberUserIds).ConfigureAwait(false);
+
+        var applied = await _restrictionService.ApplyAsync(group).ConfigureAwait(false);
+        return applied.CapAdjusted;
     }
 }