Resolve the group services lazily in the authentication provider

Jellyfin's UserManager constructor-injects every IAuthenticationProvider, so
building IUserManager forced SharedAccountAuthenticationProvider to be built
first. That provider eagerly required IGroupService and IDynamicGroupService,
both of which need IUserManager, and the container refused to start the server
with "a circular dependency was detected".

Take the two group services as Lazy<T> and dereference them at authentication
time instead. Nobody can log in before the host is up, so the deferred lookup
is always safe. Microsoft's container has no built-in Lazy<T> support, hence
the explicit factory registrations.

The accompanying test builds the service graph through a stand-in that mimics
UserManager's constructor shape and validates it on build, so a reintroduced
cycle fails in CI rather than at server startup.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether/Auth/SharedAccountAuthenticationProvider.cs

@@ -28,21 +28,28 @@ namespace Jellyfin.Plugin.WatchedTogether.Auth;
 public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IRequiresResolvedUser
 {
     private readonly ICryptoProvider _cryptoProvider;
-    private readonly Services.IGroupService _groupService;
-    private readonly Services.IDynamicGroupService _dynamicGroupService;
+    private readonly Lazy<Services.IGroupService> _groupService;
+    private readonly Lazy<Services.IDynamicGroupService> _dynamicGroupService;
     private readonly ILogger<SharedAccountAuthenticationProvider> _logger;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="SharedAccountAuthenticationProvider"/> class.
     /// </summary>
     /// <param name="cryptoProvider">The crypto provider used to verify stored password hashes.</param>
-    /// <param name="groupService">The group service.</param>
-    /// <param name="dynamicGroupService">The on-demand group creation service.</param>
+    /// <param name="groupService">A deferred handle to the group service.</param>
+    /// <param name="dynamicGroupService">A deferred handle to the on-demand group creation service.</param>
     /// <param name="logger">The logger.</param>
+    /// <remarks>
+    /// The group services are taken as <see cref="Lazy{T}"/> to break a container-level cycle.
+    /// Jellyfin's <c>UserManager</c> constructor-injects every <see cref="IAuthenticationProvider"/>,
+    /// so resolving those services eagerly here would require <c>IUserManager</c> while it is still
+    /// being built and the host would refuse to start. Deferring the lookup to the first
+    /// authentication is safe: nobody can log in until the host is fully up.
+    /// </remarks>
     public SharedAccountAuthenticationProvider(
         ICryptoProvider cryptoProvider,
-        Services.IGroupService groupService,
-        Services.IDynamicGroupService dynamicGroupService,
+        Lazy<Services.IGroupService> groupService,
+        Lazy<Services.IDynamicGroupService> dynamicGroupService,
         ILogger<SharedAccountAuthenticationProvider> logger)
     {
         _cryptoProvider = cryptoProvider;
@@ -73,7 +80,7 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
         // a real user with that exact name always resolves first and never reaches this branch.
         if (resolvedUser is null)
         {
-            var created = await _dynamicGroupService
+            var created = await _dynamicGroupService.Value
                 .TryCreateFromLoginAsync(username, password)
                 .ConfigureAwait(false);
 
@@ -85,7 +92,7 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
             return new ProviderAuthenticationResult { Username = created.SharedUsername };
         }
 
-        var group = _groupService.GetGroupForSharedUser(resolvedUser.Id);
+        var group = _groupService.Value.GetGroupForSharedUser(resolvedUser.Id);
         if (group is null)
         {
             // Either not one of ours, or the group is disabled. Either way this account has no
@@ -96,7 +103,7 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
             throw new AuthenticationException("Invalid username or password.");
         }
 
-        var members = _groupService.GetEligibleMembers(group);
+        var members = _groupService.Value.GetEligibleMembers(group);
         if (members.Count == 0)
         {
             _logger.LogWarning(

Jellyfin.Plugin.WatchedTogether/ServiceRegistrator.cs

@@ -1,3 +1,4 @@
+using System;
 using Jellyfin.Plugin.WatchedTogether.Auth;
 using Jellyfin.Plugin.WatchedTogether.Services;
 using MediaBrowser.Controller;
@@ -20,6 +21,14 @@ public class ServiceRegistrator : IPluginServiceRegistrator
         serviceCollection.AddSingleton<IProvisioningService, ProvisioningService>();
         serviceCollection.AddSingleton<IDynamicGroupService, DynamicGroupService>();
 
+        // The auth provider takes these lazily so the container can build it while IUserManager is
+        // still under construction; see SharedAccountAuthenticationProvider's constructor remarks.
+        // Microsoft's container has no built-in Lazy<T> support, so the factories are explicit.
+        serviceCollection.AddSingleton(
+            provider => new Lazy<IGroupService>(provider.GetRequiredService<IGroupService>));
+        serviceCollection.AddSingleton(
+            provider => new Lazy<IDynamicGroupService>(provider.GetRequiredService<IDynamicGroupService>));
+
         // Discovered by Jellyfin and matched to shared accounts via User.AuthenticationProviderId.
         serviceCollection.AddSingleton<IAuthenticationProvider, SharedAccountAuthenticationProvider>();