dtourolleandClaude Opus 5
27cd2a3d37
A shared account previously inherited its members' library access but none of their content restrictions, so a child could log into "alice+kid" with their own password and get around their own rating cap. The shared account now gets the strictest member's parental rating, unrated-item block, blocked tags and allowed tags, recomputed at creation, on membership change and at startup. An admin can raise the rating cap on a slider between the strictest and the loosest member; unrated and tag rules stay strictest-wins. What makes raising the cap safe is the unlock rule: after a member's password matches, both users' live policies are compared and the login is refused if the account is looser than the member on any field. So raising the cap above the child's rating means the child's password no longer opens the account, while the parent's still does. The same rule bounds the slider - past the loosest member nobody could unlock the account - so a chosen cap is clamped back into range whenever applied. Allowed tags need care: Jellyfin reads an empty list as "no whitelist", so an empty intersection of members' whitelists is written as a sentinel tag no item carries. Access schedules and channels are not inherited yet. The shared account is never an administrator. Groups created at the login screen always inherit and are restricted before the first session exists. The dashboard shows each member's cap, who a chosen cap shuts out, and the restrictions in effect, and gains a per-group edit form for the sync options. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
74 lines
3.6 KiB
C#
74 lines
3.6 KiB
C#
using System;
|
|
using System.Collections.Generic;
|
|
using System.Diagnostics.CodeAnalysis;
|
|
|
|
namespace Jellyfin.Plugin.WatchedTogether.Configuration;
|
|
|
|
/// <summary>
|
|
/// The association between one shared account and the members who may unlock it.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Membership is stored as GUIDs rather than being parsed out of the shared account's username.
|
|
/// The default separator ('+') is itself a legal username character, so a name like "alice+bob"
|
|
/// is ambiguous between the group [alice, bob] and a single user literally called "alice+bob".
|
|
/// GUIDs remove that ambiguity and support any number of members.
|
|
/// </remarks>
|
|
public class SharedGroup
|
|
{
|
|
/// <summary>
|
|
/// Gets or sets the identifier of the shared account that members log into collectively.
|
|
/// </summary>
|
|
public Guid SharedUserId { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets the identifiers of the members whose passwords unlock the shared account,
|
|
/// and whose own accounts receive its watched state. A usable group has at least two.
|
|
/// </summary>
|
|
[SuppressMessage("Usage", "CA2227:Collection properties should be read only", Justification = "Plugin configuration is round-tripped by the XML serializer, which requires a settable List<T>.")]
|
|
[SuppressMessage("Design", "CA1002:Do not expose generic lists", Justification = "Plugin configuration is round-tripped by the XML serializer, which requires a settable List<T>.")]
|
|
public List<Guid> MemberUserIds { get; set; } = new();
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether marking something unwatched on the shared account
|
|
/// also marks it unwatched for every member. When false, only the transition to watched
|
|
/// propagates.
|
|
/// </summary>
|
|
public bool SyncUnwatched { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether a member's play count is raised to at least one
|
|
/// when an item becomes watched. Play counts are never decremented.
|
|
/// </summary>
|
|
public bool SyncPlayCount { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether the shared account's parental rating cap is the
|
|
/// strictest member's. When false, <see cref="ParentalRatingCap"/> is used instead.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Groups created at the login screen always inherit; choosing a cap is a dashboard-only
|
|
/// action so nobody can widen access from the login screen. Unrated-item blocks and tag rules
|
|
/// are always the strictest member's - they have no meaningful "level" to choose.
|
|
/// </remarks>
|
|
public bool InheritParentalRating { get; set; } = true;
|
|
|
|
/// <summary>
|
|
/// Gets or sets the parental rating cap, as Jellyfin's numeric score, to use when
|
|
/// <see cref="InheritParentalRating"/> is false. <c>null</c> means no cap.
|
|
/// </summary>
|
|
/// <remarks>
|
|
/// Kept within the range spanned by the members' own caps whenever it is applied: no lower than
|
|
/// the strictest member (that would just be inheriting) and no looser than the loosest member
|
|
/// (nobody could unlock the account past that, since a member may only unlock an account at
|
|
/// least as restricted as they are). Wherever it sits in that range, members stricter than it
|
|
/// can no longer unlock the account - that is the whole point of choosing one.
|
|
/// </remarks>
|
|
public int? ParentalRatingCap { get; set; }
|
|
|
|
/// <summary>
|
|
/// Gets or sets a value indicating whether this group is suspended. A group drops out of both
|
|
/// authentication and sync while disabled - set automatically if it falls below two members.
|
|
/// </summary>
|
|
public bool IsDisabled { get; set; }
|
|
}
|