Support Jellyfin 12 alongside 10.11

Jellyfin 12 moved to .NET 10 and changed the IUserManager surface the
plugin relies on: Users/UsersIds became GetUsers()/GetUsersIds(),
ChangePassword takes a user id, HasPassword left the provider contract,
and the user cache is gone, so every lookup is a detached copy.

The plugin now multi-targets net9.0 (against 10.11.5) and net10.0
(against 12.0.0). The differences sit behind a JELLYFIN_12 constant in
Compat/UserManagerCompat.cs, whose ChangePasswordAsync also carries the
stored hash back onto the caller's instance: on 12 the UpdateUserAsync
that claims the account would otherwise write the stale null password
back over the one provisioning just set.

Each release ships one package per generation, with the fourth version
segment naming the target (x.y.z.11 and x.y.z.12) so a 12 server picks
the 12 package over the 10.11 one. scripts/package.sh wraps jprm for a
single generation and the workflows call it twice. The builder image
moves to the .NET 10 SDK, which builds both targets; the net9.0 test run
rolls forward onto the .NET 10 runtime.

CA1873 is a .NET 10 analyzer that flags the same log calls CA1848 does;
it is set to Info, as in the upstream Jellyfin 12 tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether/Auth/SharedAccountAuthenticationProvider.cs

@@ -136,12 +136,15 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
         throw new AuthenticationException("Invalid username or password.");
     }
 
+#if !JELLYFIN_12
     /// <inheritdoc />
     /// <remarks>
     /// A shared account always has a password in the sense that matters to Jellyfin: some member
     /// credential is required. Returning <c>false</c> would let clients offer a passwordless login.
+    /// Jellyfin 12 removed this hook from the provider contract along with passwordless logins.
     /// </remarks>
     public bool HasPassword(User user) => true;
+#endif
 
     /// <inheritdoc />
     /// <remarks>

Jellyfin.Plugin.WatchedTogether/Compat/UserManagerCompat.cs

@@ -0,0 +1,87 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Jellyfin.Database.Implementations.Entities;
+using MediaBrowser.Controller.Library;
+
+namespace Jellyfin.Plugin.WatchedTogether.Compat;
+
+/// <summary>
+/// Papers over the <see cref="IUserManager"/> differences between Jellyfin 10.11 and 12.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Jellyfin 12 turned the <c>Users</c> and <c>UsersIds</c> properties into methods and made
+/// <c>ChangePassword</c> take a user id instead of a user. The plugin is compiled once per server
+/// generation (see the project file), and this is the only place that needs to know which one it
+/// is building for, so the rest of the code reads the same either way.
+/// </para>
+/// <para>
+/// Jellyfin 12 also dropped the in-memory user cache: every lookup returns a detached copy, and
+/// <see cref="IUserManager.UpdateUserAsync"/> copies every column from the instance it is given.
+/// Callers that mutate a user and save it must therefore work with a fresh copy, which is why
+/// <see cref="ChangePasswordAsync"/> carries the stored hash back onto the caller's instance.
+/// </para>
+/// </remarks>
+internal static class UserManagerCompat
+{
+    /// <summary>
+    /// Gets every user on the server.
+    /// </summary>
+    /// <param name="userManager">The user manager.</param>
+    /// <returns>All users.</returns>
+    public static IEnumerable<User> GetAllUsers(this IUserManager userManager)
+    {
+        ArgumentNullException.ThrowIfNull(userManager);
+#if JELLYFIN_12
+        return userManager.GetUsers();
+#else
+        return userManager.Users;
+#endif
+    }
+
+    /// <summary>
+    /// Gets the id of every user on the server.
+    /// </summary>
+    /// <param name="userManager">The user manager.</param>
+    /// <returns>All user ids.</returns>
+    public static IEnumerable<Guid> GetAllUserIds(this IUserManager userManager)
+    {
+        ArgumentNullException.ThrowIfNull(userManager);
+#if JELLYFIN_12
+        return userManager.GetUsersIds();
+#else
+        return userManager.UsersIds;
+#endif
+    }
+
+    /// <summary>
+    /// Changes a user's password through the provider the user is currently assigned to.
+    /// </summary>
+    /// <param name="userManager">The user manager.</param>
+    /// <param name="user">The user whose password to change.</param>
+    /// <param name="newPassword">The new password.</param>
+    /// <returns>A task representing the change.</returns>
+    /// <remarks>
+    /// On return <paramref name="user"/> carries the newly stored hash on both server generations,
+    /// so a subsequent <see cref="IUserManager.UpdateUserAsync"/> with the same instance keeps it.
+    /// </remarks>
+    public static async Task ChangePasswordAsync(this IUserManager userManager, User user, string newPassword)
+    {
+        ArgumentNullException.ThrowIfNull(userManager);
+        ArgumentNullException.ThrowIfNull(user);
+#if JELLYFIN_12
+        await userManager.ChangePassword(user.Id, newPassword).ConfigureAwait(false);
+
+        // 12 loaded and saved its own copy; without this the caller's instance still says "no
+        // password" and the next UpdateUserAsync would write that back over the stored hash.
+        var stored = userManager.GetUserById(user.Id);
+        if (stored is not null)
+        {
+            user.Password = stored.Password;
+        }
+#else
+        await userManager.ChangePassword(user, newPassword).ConfigureAwait(false);
+#endif
+    }
+}

Jellyfin.Plugin.WatchedTogether/Controllers/WatchedTogetherController.cs

@@ -3,6 +3,7 @@ using System.Collections.Generic;
 using System.Linq;
 using System.Net.Mime;
 using System.Threading.Tasks;
+using Jellyfin.Plugin.WatchedTogether.Compat;
 using Jellyfin.Plugin.WatchedTogether.Models;
 using Jellyfin.Plugin.WatchedTogether.Services;
 using MediaBrowser.Common.Api;
@@ -86,7 +87,7 @@ public class WatchedTogetherController : ControllerBase
             .Select(g => g.SharedUserId)
             .ToHashSet() ?? [];
 
-        var users = _userManager.Users
+        var users = _userManager.GetAllUsers()
             .Where(u => !sharedIds.Contains(u.Id))
             .Select(u => new MemberDto { UserId = u.Id, Username = u.Username })
             .OrderBy(u => u.Username, StringComparer.OrdinalIgnoreCase)

Jellyfin.Plugin.WatchedTogether/Jellyfin.Plugin.WatchedTogether.csproj

@@ -1,7 +1,13 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
+  <!--
+    One source tree, two Jellyfin generations. Jellyfin 10.11 runs on .NET 9 and Jellyfin 12 on
+    .NET 10, and 12 changed a handful of IUserManager signatures, so the plugin is built once per
+    target framework against the matching server packages. The JELLYFIN_12 constant guards the few
+    call sites that differ; see Compat/UserManagerCompat.cs.
+  -->
   <PropertyGroup>
-    <TargetFramework>net9.0</TargetFramework>
+    <TargetFrameworks>net9.0;net10.0</TargetFrameworks>
     <RootNamespace>Jellyfin.Plugin.WatchedTogether</RootNamespace>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
     <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
@@ -10,7 +16,11 @@
     <CodeAnalysisRuleSet>../jellyfin.ruleset</CodeAnalysisRuleSet>
   </PropertyGroup>
 
-  <ItemGroup>
+  <PropertyGroup Condition="'$(TargetFramework)' == 'net10.0'">
+    <DefineConstants>$(DefineConstants);JELLYFIN_12</DefineConstants>
+  </PropertyGroup>
+
+  <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
     <PackageReference Include="Jellyfin.Controller" Version="10.11.5">
       <ExcludeAssets>runtime</ExcludeAssets>
     </PackageReference>
@@ -19,6 +29,15 @@
     </PackageReference>
   </ItemGroup>
 
+  <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
+    <PackageReference Include="Jellyfin.Controller" Version="12.0.0">
+      <ExcludeAssets>runtime</ExcludeAssets>
+    </PackageReference>
+    <PackageReference Include="Jellyfin.Model" Version="12.0.0">
+      <ExcludeAssets>runtime</ExcludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
   <ItemGroup>
     <PackageReference Include="SerilogAnalyzer" Version="0.15.0" PrivateAssets="All" />
     <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556" PrivateAssets="All" />

Jellyfin.Plugin.WatchedTogether/Services/ProvisioningService.cs

@@ -6,6 +6,7 @@ using System.Security.Cryptography;
 using System.Threading.Tasks;
 using Jellyfin.Data;
 using Jellyfin.Database.Implementations.Enums;
+using Jellyfin.Plugin.WatchedTogether.Compat;
 using Jellyfin.Plugin.WatchedTogether.Configuration;
 using MediaBrowser.Controller.Library;
 using Microsoft.Extensions.Logging;
@@ -108,7 +109,9 @@ public class ProvisioningService : IProvisioningService
         // dispatches to the provider the user is currently assigned to, and ours refuses the call
         // by design, so claiming first would make provisioning throw NotSupportedException. A
         // freshly created user is still on Jellyfin's default provider, which stores the hash.
-        await _userManager.ChangePassword(sharedUser, GenerateUnusedPassword()).ConfigureAwait(false);
+        // The compat wrapper also keeps sharedUser in step with what was stored, which matters on
+        // Jellyfin 12 where UpdateUserAsync below would otherwise overwrite the hash with null.
+        await _userManager.ChangePasswordAsync(sharedUser, GenerateUnusedPassword()).ConfigureAwait(false);
 
         // Route this account's logins through our provider. Jellyfin matches providers by
         // GetType().FullName, the same key the SSO plugin uses, and the assignment only sticks

Jellyfin.Plugin.WatchedTogether/Services/UserLifecycleService.cs

@@ -2,6 +2,7 @@ using System;
 using System.Linq;
 using System.Threading;
 using System.Threading.Tasks;
+using Jellyfin.Plugin.WatchedTogether.Compat;
 using MediaBrowser.Controller.Library;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
@@ -98,7 +99,7 @@ public sealed class UserLifecycleService : IHostedService
             return;
         }
 
-        var liveIds = _userManager.UsersIds.ToHashSet();
+        var liveIds = _userManager.GetAllUserIds().ToHashSet();
 
         var referenced = config.Groups
             .SelectMany(g => g.MemberUserIds.Append(g.SharedUserId))