Inherit parental restrictions on shared accounts, with a chosen rating cap

A shared account previously inherited its members' library access but
none of their content restrictions, so a child could log into "alice+kid"
with their own password and get around their own rating cap.

The shared account now gets the strictest member's parental rating,
unrated-item block, blocked tags and allowed tags, recomputed at
creation, on membership change and at startup. An admin can raise the
rating cap on a slider between the strictest and the loosest member;
unrated and tag rules stay strictest-wins.

What makes raising the cap safe is the unlock rule: after a member's
password matches, both users' live policies are compared and the login
is refused if the account is looser than the member on any field. So
raising the cap above the child's rating means the child's password no
longer opens the account, while the parent's still does. The same rule
bounds the slider - past the loosest member nobody could unlock the
account - so a chosen cap is clamped back into range whenever applied.

Allowed tags need care: Jellyfin reads an empty list as "no whitelist",
so an empty intersection of members' whitelists is written as a sentinel
tag no item carries. Access schedules and channels are not inherited yet.

The shared account is never an administrator. Groups created at the
login screen always inherit and are restricted before the first session
exists. The dashboard shows each member's cap, who a chosen cap shuts
out, and the restrictions in effect, and gains a per-group edit form for
the sync options.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether/Services/UserLifecycleService.cs

@@ -23,6 +23,7 @@ public sealed class UserLifecycleService : IHostedService
     private readonly IUserManager _userManager;
     private readonly IGroupService _groupService;
     private readonly ILibraryAccessService _libraryAccessService;
+    private readonly IRestrictionService _restrictionService;
     private readonly ILogger<UserLifecycleService> _logger;
 
     /// <summary>
@@ -31,16 +32,19 @@ public sealed class UserLifecycleService : IHostedService
     /// <param name="userManager">The user manager.</param>
     /// <param name="groupService">The group service.</param>
     /// <param name="libraryAccessService">The library access service.</param>
+    /// <param name="restrictionService">The content restriction service.</param>
     /// <param name="logger">The logger.</param>
     public UserLifecycleService(
         IUserManager userManager,
         IGroupService groupService,
         ILibraryAccessService libraryAccessService,
+        IRestrictionService restrictionService,
         ILogger<UserLifecycleService> logger)
     {
         _userManager = userManager;
         _groupService = groupService;
         _libraryAccessService = libraryAccessService;
+        _restrictionService = restrictionService;
         _logger = logger;
     }
 
@@ -50,7 +54,7 @@ public sealed class UserLifecycleService : IHostedService
         try
         {
             Reconcile();
-            await ReapplyLibraryAccessAsync().ConfigureAwait(false);
+            await ReapplyDerivedPolicyAsync().ConfigureAwait(false);
         }
 #pragma warning disable CA1031 // Reconciliation must never prevent the server from starting.
         catch (Exception ex)
@@ -61,27 +65,40 @@ public sealed class UserLifecycleService : IHostedService
     }
 
     /// <summary>
-    /// Recomputes every group's library access.
+    /// Recomputes every group's library access and content restrictions.
     /// </summary>
     /// <remarks>
-    /// A member's own library access can be narrowed at any time through the normal user editor,
-    /// which would leave a group's stored intersection too wide. Recomputing at startup brings
-    /// shared accounts back in line without needing to hook every policy change.
+    /// A member's own access can be narrowed at any time through the normal user editor, which
+    /// would leave a group's stored policy too wide. Recomputing at startup brings shared accounts
+    /// back in line without needing to hook every policy change. Between restarts the unlock rule
+    /// in the authentication provider covers the security side of that drift.
     /// </remarks>
     /// <returns>A task representing the update.</returns>
-    private async Task ReapplyLibraryAccessAsync()
+    private async Task ReapplyDerivedPolicyAsync()
     {
-        var config = Plugin.Instance?.Configuration;
-        if (config is null)
+        var plugin = Plugin.Instance;
+        if (plugin is null)
         {
             return;
         }
 
+        var config = plugin.Configuration;
+        var changed = false;
+
         foreach (var group in config.Groups.ToList())
         {
             await _libraryAccessService
                 .ApplyIntersectionAsync(group.SharedUserId, group.MemberUserIds)
                 .ConfigureAwait(false);
+
+            // A member's cap may have moved since the group's own cap was chosen.
+            var applied = await _restrictionService.ApplyAsync(group).ConfigureAwait(false);
+            changed |= applied.CapAdjusted;
+        }
+
+        if (changed)
+        {
+            plugin.UpdateConfiguration(config);
         }
     }