Support Jellyfin 12 alongside 10.11

Jellyfin 12 moved to .NET 10 and changed the IUserManager surface the
plugin relies on: Users/UsersIds became GetUsers()/GetUsersIds(),
ChangePassword takes a user id, HasPassword left the provider contract,
and the user cache is gone, so every lookup is a detached copy.

The plugin now multi-targets net9.0 (against 10.11.5) and net10.0
(against 12.0.0). The differences sit behind a JELLYFIN_12 constant in
Compat/UserManagerCompat.cs, whose ChangePasswordAsync also carries the
stored hash back onto the caller's instance: on 12 the UpdateUserAsync
that claims the account would otherwise write the stale null password
back over the one provisioning just set.

Each release ships one package per generation, with the fourth version
segment naming the target (x.y.z.11 and x.y.z.12) so a 12 server picks
the 12 package over the 10.11 one. scripts/package.sh wraps jprm for a
single generation and the workflows call it twice. The builder image
moves to the .NET 10 SDK, which builds both targets; the net9.0 test run
rolls forward onto the .NET 10 runtime.

CA1873 is a .NET 10 analyzer that flags the same log calls CA1848 does;
it is set to Info, as in the upstream Jellyfin 12 tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether.Tests/AuthenticationTests.cs

@@ -198,13 +198,16 @@ public class AuthenticationTests
         Assert.Equal("alice+bob", result.Username);
     }
 
+#if !JELLYFIN_12
     [Fact]
     public void HasPassword_IsAlwaysTrue()
     {
         // Returning false would let a client offer a passwordless login for the shared account.
+        // Jellyfin 12 dropped this hook from the provider contract.
         var provider = MakeProvider(null, []);
         Assert.True(provider.HasPassword(MakeUser("alice+bob", null)));
     }
+#endif
 
     [Fact]
     public async Task ChangePassword_IsNotSupported()

Jellyfin.Plugin.WatchedTogether.Tests/Jellyfin.Plugin.WatchedTogether.Tests.csproj

@@ -1,7 +1,8 @@
 <Project Sdk="Microsoft.NET.Sdk">
 
   <PropertyGroup>
-    <TargetFramework>net9.0</TargetFramework>
+    <!-- Mirrors the plugin: each framework is tested against the Jellyfin generation it ships for. -->
+    <TargetFrameworks>net9.0;net10.0</TargetFrameworks>
     <Nullable>enable</Nullable>
     <IsPackable>false</IsPackable>
     <!-- Test code is exempt from the strict analyzer profile the plugin itself uses. -->
@@ -10,13 +11,17 @@
     <GenerateDocumentationFile>false</GenerateDocumentationFile>
     <NoWarn>$(NoWarn);CA1707;SA0001;CS1591</NoWarn>
     <!--
-      The plugin targets net9.0 to match Jellyfin 10.11's ABI, but a machine may only have a newer
-      runtime installed. Rolling the test host forward to the latest major lets the suite run
-      without pinning developers to a .NET 9 runtime.
+      The net9.0 build matches Jellyfin 10.11's ABI, but a machine may only have a newer runtime
+      installed. Rolling the test host forward to the latest major lets the suite run without
+      pinning developers to a .NET 9 runtime.
     -->
     <RollForward>LatestMajor</RollForward>
   </PropertyGroup>
 
+  <PropertyGroup Condition="'$(TargetFramework)' == 'net10.0'">
+    <DefineConstants>$(DefineConstants);JELLYFIN_12</DefineConstants>
+  </PropertyGroup>
+
   <ItemGroup>
     <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
     <PackageReference Include="xunit" Version="2.9.2" />
@@ -28,14 +33,19 @@
     <ProjectReference Include="../Jellyfin.Plugin.WatchedTogether/Jellyfin.Plugin.WatchedTogether.csproj" />
   </ItemGroup>
 
-  <ItemGroup>
-    <!--
-      The plugin excludes the runtime assets of these packages because the Jellyfin server supplies
-      them at load time. Tests run without a server, so they need the real assemblies copied to the
-      output directory.
-    -->
+  <!--
+    The plugin excludes the runtime assets of these packages because the Jellyfin server supplies
+    them at load time. Tests run without a server, so they need the real assemblies copied to the
+    output directory.
+  -->
+  <ItemGroup Condition="'$(TargetFramework)' == 'net9.0'">
     <PackageReference Include="Jellyfin.Controller" Version="10.11.5" />
     <PackageReference Include="Jellyfin.Model" Version="10.11.5" />
   </ItemGroup>
 
+  <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
+    <PackageReference Include="Jellyfin.Controller" Version="12.0.0" />
+    <PackageReference Include="Jellyfin.Model" Version="12.0.0" />
+  </ItemGroup>
+
 </Project>

Jellyfin.Plugin.WatchedTogether.Tests/ProvisioningTests.cs

@@ -43,8 +43,7 @@ public class ProvisioningTests
                 return created;
             });
 
-        userManager.Setup(m => m.ChangePassword(It.IsAny<User>(), It.IsAny<string>()))
-            .Returns((User user, string password) =>
+        userManager.SetupChangePassword(users, (user, password) =>
             {
                 callLog.Add($"ChangePassword(provider={user.AuthenticationProviderId})");
 
@@ -148,4 +147,69 @@ public class ProvisioningTests
         Assert.NotNull(sharedUser);
         Assert.False(string.IsNullOrEmpty(sharedUser!.Password));
     }
+
+    [Fact]
+    public async Task CreateGroupAsync_StoredPasswordSurvivesClaimingTheAccount()
+    {
+        using var context = PluginTestContext.Create();
+
+        // Models Jellyfin 12, where the user manager keeps no cache: every lookup returns a
+        // detached copy of the stored row, and UpdateUserAsync writes back every column of the
+        // instance it is handed. The random password provisioning sets must survive the provider
+        // assignment that is saved afterwards through a different instance.
+        var stored = new List<User> { MakeUser("alice"), MakeUser("bob") };
+        var userManager = new Mock<IUserManager>();
+
+        userManager.Setup(m => m.GetUserById(It.IsAny<Guid>()))
+            .Returns((Guid id) => Copy(stored.Find(u => u.Id == id)));
+
+        userManager.Setup(m => m.CreateUserAsync(It.IsAny<string>()))
+            .ReturnsAsync((string name) =>
+            {
+                var row = MakeUser(name);
+                stored.Add(row);
+                return Copy(row)!;
+            });
+
+        // On 12 the helper resolves the stored row by id, so this writes the hash there and only
+        // there; on 10.11 it writes to the caller's instance, as the real server does.
+        userManager.SetupChangePassword(stored, (user, password) =>
+        {
+            user.Password = password;
+            return Task.CompletedTask;
+        });
+
+        userManager.Setup(m => m.UpdateUserAsync(It.IsAny<User>()))
+            .Returns((User user) =>
+            {
+                var row = stored.Find(u => u.Id == user.Id)!;
+                row.Password = user.Password;
+                row.AuthenticationProviderId = user.AuthenticationProviderId;
+                return Task.CompletedTask;
+            });
+
+        var service = MakeService(userManager);
+
+        var group = await service.CreateGroupAsync([stored[0].Id, stored[1].Id], null);
+
+        var row = stored.Find(u => u.Id == group.SharedUserId);
+        Assert.NotNull(row);
+        Assert.Equal(AuthProviderId, row!.AuthenticationProviderId);
+        Assert.False(
+            string.IsNullOrEmpty(row.Password),
+            "claiming the account must not overwrite the password provisioning stored");
+    }
+
+    /// <summary>
+    /// Copies the columns provisioning touches into a fresh instance with the same id, the way a
+    /// cache-less user manager hands out rows.
+    /// </summary>
+    private static User? Copy(User? row)
+        => row is null
+            ? null
+            : new User(row.Username, row.AuthenticationProviderId, row.PasswordResetProviderId)
+            {
+                Id = row.Id,
+                Password = row.Password,
+            };
 }

Jellyfin.Plugin.WatchedTogether.Tests/SharedAccountEndToEndTests.cs

@@ -64,8 +64,7 @@ public class SharedAccountEndToEndTests
 
         userManager.Setup(m => m.UpdateUserAsync(It.IsAny<User>())).Returns(Task.CompletedTask);
 
-        userManager.Setup(m => m.ChangePassword(It.IsAny<User>(), It.IsAny<string>()))
-            .Returns((User user, string password) =>
+        userManager.SetupChangePassword(users, (user, password) =>
             {
                 // Jellyfin routes this to the user's assigned provider; ours refuses by design.
                 if (string.Equals(user.AuthenticationProviderId, AuthProviderId, StringComparison.Ordinal))

Jellyfin.Plugin.WatchedTogether.Tests/UserManagerMockExtensions.cs

@@ -0,0 +1,41 @@
+using System;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+using Jellyfin.Database.Implementations.Entities;
+using MediaBrowser.Controller.Library;
+using Moq;
+
+namespace Jellyfin.Plugin.WatchedTogether.Tests;
+
+/// <summary>
+/// Sets up the <see cref="IUserManager"/> members whose signatures differ between Jellyfin 10.11
+/// and 12, so the suites read the same whichever generation they are compiled against.
+/// </summary>
+internal static class UserManagerMockExtensions
+{
+    /// <summary>
+    /// Routes <c>ChangePassword</c> to <paramref name="onChange"/> with the user the real server
+    /// would act on: the instance handed in on 10.11, the stored row looked up by id on 12.
+    /// </summary>
+    /// <param name="mock">The user manager mock.</param>
+    /// <param name="users">The users the mock knows about, used to resolve ids on 12.</param>
+    /// <param name="onChange">The behaviour to run for the change.</param>
+    public static void SetupChangePassword(
+        this Mock<IUserManager> mock,
+        List<User> users,
+        Func<User, string, Task> onChange)
+    {
+#if JELLYFIN_12
+        mock.Setup(m => m.ChangePassword(It.IsAny<Guid>(), It.IsAny<string>()))
+            .Returns((Guid id, string password) =>
+            {
+                var user = users.Find(u => u.Id == id)
+                    ?? throw new KeyNotFoundException($"No user with id {id}");
+                return onChange(user, password);
+            });
+#else
+        mock.Setup(m => m.ChangePassword(It.IsAny<User>(), It.IsAny<string>()))
+            .Returns((User user, string password) => onChange(user, password));
+#endif
+    }
+}