WatchedTogether/Jellyfin.Plugin.WatchedTogether/Services/ProvisioningService.cs

using System;
using System.Collections.Generic;
using System.Globalization;
using System.Linq;
using System.Security.Cryptography;
using System.Threading.Tasks;
using Jellyfin.Data;
using Jellyfin.Database.Implementations.Enums;
using Jellyfin.Plugin.WatchedTogether.Compat;
using Jellyfin.Plugin.WatchedTogether.Configuration;
using MediaBrowser.Controller.Library;
using Microsoft.Extensions.Logging;

namespace Jellyfin.Plugin.WatchedTogether.Services;

/// <summary>
/// Creates and maintains shared accounts and the groups that describe them.
/// </summary>
public class ProvisioningService : IProvisioningService
{
    /// <summary>
    /// The database column limit on usernames. A generated name is shortened to fit.
    /// </summary>
    private const int MaxUsernameLength = 255;

    /// <summary>
    /// The provider key Jellyfin stores on a shared account to route its logins to us. Jellyfin
    /// resolves providers by <c>GetType().FullName</c>, so this must match the provider type's
    /// full name exactly.
    /// </summary>
    private static readonly string AuthProviderId =
        typeof(Auth.SharedAccountAuthenticationProvider).FullName!;

    private readonly IUserManager _userManager;
    private readonly ILibraryAccessService _libraryAccessService;
    private readonly IRestrictionService _restrictionService;
    private readonly ILogger<ProvisioningService> _logger;

    /// <summary>
    /// Initializes a new instance of the <see cref="ProvisioningService"/> class.
    /// </summary>
    /// <param name="userManager">The user manager.</param>
    /// <param name="libraryAccessService">The library access service.</param>
    /// <param name="restrictionService">The content restriction service.</param>
    /// <param name="logger">The logger.</param>
    public ProvisioningService(
        IUserManager userManager,
        ILibraryAccessService libraryAccessService,
        IRestrictionService restrictionService,
        ILogger<ProvisioningService> logger)
    {
        _userManager = userManager;
        _libraryAccessService = libraryAccessService;
        _restrictionService = restrictionService;
        _logger = logger;
    }

    /// <inheritdoc />
    public async Task<SharedGroup> CreateGroupAsync(IReadOnlyList<Guid> memberIds, string? name)
    {
        ArgumentNullException.ThrowIfNull(memberIds);

        var plugin = Plugin.Instance
            ?? throw new InvalidOperationException("The plugin is not initialised.");
        var config = plugin.Configuration;

        var distinctIds = memberIds.Distinct().ToList();
        if (distinctIds.Count < 2)
        {
            throw new ArgumentException("A group needs at least two distinct members.", nameof(memberIds));
        }

        var members = new List<Jellyfin.Database.Implementations.Entities.User>(distinctIds.Count);
        foreach (var id in distinctIds)
        {
            var member = _userManager.GetUserById(id)
                ?? throw new ArgumentException(
                    string.Format(CultureInfo.InvariantCulture, "No user exists with id {0}.", id),
                    nameof(memberIds));

            // A shared account must not become a member of another group: its own login is already
            // a union of other people's credentials, and nesting would compound that invisibly.
            if (config.Groups.Any(g => g.SharedUserId == id))
            {
                throw new ArgumentException(
                    string.Format(
                        CultureInfo.InvariantCulture,
                        "'{0}' is itself a shared account and cannot be a member of a group.",
                        member.Username),
                    nameof(memberIds));
            }

            members.Add(member);
        }

        // Store members in the same alphabetical order the generated name uses, so that the stored
        // order is canonical however the members were supplied. Password checks then always run in
        // a predictable order too.
        members = members.OrderBy(m => m.Username, StringComparer.OrdinalIgnoreCase).ToList();
        distinctIds = members.Select(m => m.Id).ToList();

        var accountName = string.IsNullOrWhiteSpace(name)
            ? BuildDefaultName(members.Select(m => m.Username), config.NameSeparator)
            : name.Trim();

        var sharedUser = await _userManager.CreateUserAsync(accountName).ConfigureAwait(false);

        // The shared account never authenticates against its own password - our provider checks
        // member hashes instead. Setting a random one avoids leaving a passwordless account behind
        // if the provider is ever unassigned.
        //
        // This must happen before the account is claimed below. IUserManager.ChangePassword
        // dispatches to the provider the user is currently assigned to, and ours refuses the call
        // by design, so claiming first would make provisioning throw NotSupportedException. A
        // freshly created user is still on Jellyfin's default provider, which stores the hash.
        // The compat wrapper also keeps sharedUser in step with what was stored, which matters on
        // Jellyfin 12 where UpdateUserAsync below would otherwise overwrite the hash with null.
        await _userManager.ChangePasswordAsync(sharedUser, GenerateUnusedPassword()).ConfigureAwait(false);

        // Route this account's logins through our provider. Jellyfin matches providers by
        // GetType().FullName, the same key the SSO plugin uses, and the assignment only sticks
        // once the user is updated.
        sharedUser.AuthenticationProviderId = AuthProviderId;
        await _userManager.UpdateUserAsync(sharedUser).ConfigureAwait(false);

        var group = new SharedGroup
        {
            SharedUserId = sharedUser.Id,
            MemberUserIds = distinctIds
        };

        // Restrict before the group is recorded, so an account created from the login screen is
        // never usable, even once, with fewer restrictions than its members have. A new group
        // always inherits; a cap is chosen afterwards in the dashboard.
        await ApplyDerivedPolicyAsync(group).ConfigureAwait(false);

        config.Groups.Add(group);
        plugin.UpdateConfiguration(config);

        _logger.LogInformation(
            "Created shared account {Username} ({SharedUserId}) with {MemberCount} members",
            sharedUser.Username,
            sharedUser.Id,
            distinctIds.Count);

        return group;
    }

    /// <inheritdoc />
    public async Task<SharedGroup> UpdateGroupAsync(
        Guid sharedUserId,
        IReadOnlyList<Guid> memberIds,
        bool syncUnwatched,
        bool syncPlayCount,
        bool isDisabled,
        bool inheritParentalRating,
        int? parentalRatingCap)
    {
        ArgumentNullException.ThrowIfNull(memberIds);

        var plugin = Plugin.Instance
            ?? throw new InvalidOperationException("The plugin is not initialised.");
        var config = plugin.Configuration;

        var group = config.Groups.FirstOrDefault(g => g.SharedUserId == sharedUserId)
            ?? throw new ArgumentException("No group exists for that shared account.", nameof(sharedUserId));

        var distinctIds = memberIds.Distinct().ToList();
        if (distinctIds.Count < 2)
        {
            throw new ArgumentException("A group needs at least two distinct members.", nameof(memberIds));
        }

        foreach (var id in distinctIds)
        {
            if (_userManager.GetUserById(id) is null)
            {
                throw new ArgumentException(
                    string.Format(CultureInfo.InvariantCulture, "No user exists with id {0}.", id),
                    nameof(memberIds));
            }

            if (id == sharedUserId || config.Groups.Any(g => g.SharedUserId == id))
            {
                throw new ArgumentException(
                    "A shared account cannot be a member of a group.",
                    nameof(memberIds));
            }
        }

        // Keep the stored order canonical, matching how groups are created.
        distinctIds = distinctIds
            .OrderBy(id => _userManager.GetUserById(id)?.Username, StringComparer.OrdinalIgnoreCase)
            .ToList();

        group.MemberUserIds = distinctIds;
        group.SyncUnwatched = syncUnwatched;
        group.SyncPlayCount = syncPlayCount;
        group.IsDisabled = isDisabled;
        group.InheritParentalRating = inheritParentalRating;
        group.ParentalRatingCap = inheritParentalRating ? null : parentalRatingCap;

        plugin.UpdateConfiguration(config);

        // Membership drives the derived policy, so recompute it: adding a member can only narrow
        // library access and tighten restrictions, and removing one may widen either. The chosen
        // cap may be pulled back into the new members' range, in which case it is saved again.
        if (await ApplyDerivedPolicyAsync(group).ConfigureAwait(false))
        {
            plugin.UpdateConfiguration(config);
        }

        _logger.LogInformation(
            "Updated group {SharedUserId}: {MemberCount} members, disabled={IsDisabled}, rating cap={RatingCap}",
            sharedUserId,
            distinctIds.Count,
            isDisabled,
            group.InheritParentalRating ? "inherited" : group.ParentalRatingCap?.ToString(CultureInfo.InvariantCulture) ?? "none");

        return group;
    }

    /// <inheritdoc />
    public async Task DeleteGroupAsync(Guid sharedUserId, bool deleteSharedUser)
    {
        var plugin = Plugin.Instance
            ?? throw new InvalidOperationException("The plugin is not initialised.");
        var config = plugin.Configuration;

        var group = config.Groups.FirstOrDefault(g => g.SharedUserId == sharedUserId)
            ?? throw new ArgumentException("No group exists for that shared account.", nameof(sharedUserId));

        // Drop the group first: if account deletion fails we are left with an orphaned account
        // rather than a group pointing at a user that may be half-deleted.
        config.Groups.Remove(group);
        plugin.UpdateConfiguration(config);

        if (deleteSharedUser && _userManager.GetUserById(sharedUserId) is not null)
        {
            await _userManager.DeleteUserAsync(sharedUserId).ConfigureAwait(false);
            _logger.LogInformation("Deleted shared account {SharedUserId}", sharedUserId);
        }

        _logger.LogInformation("Removed group {SharedUserId}", sharedUserId);
    }

    /// <summary>
    /// Joins member names into a display name, falling back to a generic name if the result would
    /// exceed the username column limit.
    /// </summary>
    /// <remarks>
    /// Names are sorted alphabetically so that a given set of members always produces the same
    /// account name. Without this, "jane+john" and "john+jane" would be two different names for the
    /// same group and would end up as two separate accounts.
    /// </remarks>
    /// <param name="usernames">The member usernames.</param>
    /// <param name="separator">The configured separator.</param>
    /// <returns>A name that fits within the username length limit.</returns>
    private static string BuildDefaultName(IEnumerable<string> usernames, string separator)
    {
        var sep = string.IsNullOrEmpty(separator) ? "+" : separator;
        var joined = string.Join(sep, usernames.OrderBy(n => n, StringComparer.OrdinalIgnoreCase));

        if (joined.Length <= MaxUsernameLength)
        {
            return joined;
        }

        // Truncating mid-name would produce something misleading, so switch to a neutral label
        // with a short unique suffix instead.
        return string.Format(
            CultureInfo.InvariantCulture,
            "Shared-{0}",
            Guid.NewGuid().ToString("N")[..8]);
    }

    /// <summary>
    /// Generates a random password that is never used for authentication.
    /// </summary>
    /// <returns>A random password string.</returns>
    private static string GenerateUnusedPassword()
        => Convert.ToBase64String(RandomNumberGenerator.GetBytes(48));

    /// <summary>
    /// Writes everything about the shared account's policy that follows from its membership:
    /// library access and content restrictions.
    /// </summary>
    /// <param name="group">The group whose shared account to update.</param>
    /// <returns><c>true</c> if the group's chosen rating cap was adjusted and needs saving.</returns>
    private async Task<bool> ApplyDerivedPolicyAsync(SharedGroup group)
    {
        var user = _userManager.GetUserById(group.SharedUserId);
        if (user is null)
        {
            return false;
        }

        // Never "all folders": the shared account gets an explicit list of the libraries every
        // member can already reach, so joining a group can never grant access to anything. And
        // never an administrator: the account is a union of other people's credentials and must
        // not carry a privilege none of them individually hold.
        user.SetPermission(PermissionKind.EnableAllFolders, false);
        user.SetPermission(PermissionKind.IsAdministrator, false);
        await _userManager.UpdateUserAsync(user).ConfigureAwait(false);

        await _libraryAccessService.ApplyIntersectionAsync(group.SharedUserId, group.MemberUserIds).ConfigureAwait(false);

        var applied = await _restrictionService.ApplyAsync(group).ConfigureAwait(false);
        return applied.CapAdjusted;
    }
}