dtourolle
da762da55d
A shared device can hold several accounts from the same server and switch between them in a couple of taps. A profile can be locked behind a 4-8 digit PIN; one without a PIN is one tap away. Forgetting a PIN falls through to the account's own Jellyfin password, so there is no reset flow and no recovery secret to store. Opt-in by construction: a single account with no PIN starts, plays and downloads exactly as before, and never sees a picker. Two decisions worth keeping: - Switching is not logging out. auth_logout invalidates the token server-side, which is precisely what a switch must not do, or every switch back would cost a password. The switch runs as a plan (profiles/switch.rs) so the teardown *ordering* is unit-testable with no player and no server -- a straggler reporting after the active user flips would attribute one account's viewing to another, silently. - The PIN gates switching, not the token at rest. Wrapping each token with its PIN would leave a locked profile unable to resume its own downloads or drain its own sync queue until somebody typed the code, which on a device that reboots nightly costs more than it defends against a four-digit secret. auth_initialize does refuse to restore a PIN-protected session, so the gate is on the session rather than on which screen is shown. "Child account" is not modelled anywhere -- a child's profile is simply one with no PIN. The frontend renders an opaque unlockMethod and never compares a PIN, counts an attempt or infers a role. Migration 024 adds user_pins, user_item_visibility, user_libraries and download_grants, and backfills the existing user so an upgrade does not blank its library. The visibility and grant tables are the schema half of the cache-scoping and shared-download work; the read-path enforcement is still to come (see docs/specs/multi-user-profiles.md).
45 lines
1.1 KiB
Rust
45 lines
1.1 KiB
Rust
// Tauri commands exposed to frontend
|
|
// TRACES: UR-002, UR-003, UR-004, UR-005, UR-009, UR-011, UR-012, UR-017, UR-019, UR-025 |
|
|
// DR-015, DR-017, DR-021, DR-028
|
|
pub mod auth;
|
|
pub mod catalog;
|
|
pub mod connectivity;
|
|
pub mod conversions;
|
|
pub mod device;
|
|
pub mod diagnostics;
|
|
pub mod download;
|
|
pub mod favorites;
|
|
pub mod library;
|
|
pub mod offline;
|
|
pub mod playback_mode;
|
|
pub mod playback_reporting;
|
|
pub mod player;
|
|
pub mod playlist;
|
|
pub mod profiles;
|
|
pub mod repository;
|
|
pub mod sessions;
|
|
pub mod storage;
|
|
pub mod sync;
|
|
pub mod sync_drain;
|
|
|
|
pub use auth::*;
|
|
pub use catalog::*;
|
|
pub use connectivity::*;
|
|
pub use conversions::*;
|
|
pub use device::*;
|
|
pub use diagnostics::*;
|
|
pub use download::*;
|
|
pub use library::*;
|
|
pub use offline::*;
|
|
pub use playback_mode::*;
|
|
#[allow(unused_imports)] // Used when playback_reporting is fully integrated
|
|
pub use playback_reporting::*;
|
|
pub use player::*;
|
|
pub use playlist::*;
|
|
pub use profiles::*;
|
|
pub use repository::{RepositoryManager, RepositoryManagerWrapper, *};
|
|
pub use sessions::*;
|
|
pub use storage::*;
|
|
pub use sync::*;
|
|
pub use sync_drain::*;
|