Skip to content

Fix device access revocation not logging out existing sessions - #18026

Merged
crobibero merged 4 commits into
jellyfin:release-12.zfrom
fma-rc:fix/device-access-hosted-service-12z
Sep 14, 2026
Merged

crobibero merged 4 commits into
jellyfin:release-12.zfrom
fma-rc:fix/device-access-hosted-service-12z

Conversation

@fma-rc

@fma-rc fma-rc commented Sep 13, 2026

Copy link
Copy Markdown
Contributor

Changes
Removing a device from a user's allowed device list or switching off enable all devices only applied to new logins. Since commit d986a82 which converted DeviceAccessHost from an IServerEntryPoint to an IHostedService (which needs an explicit AddHostedService), DeviceAccessHost was never run and OnUserUpdated was only raised for RenameUser. Fixed in UpdatePolicyAsync in UserManager.cs by hoisting the user out of the lock scope and raising OnUserUpdated so it doesn't only apply to renames and then adding AddHostedService<DeviceAccessHost>() in Startup.cs. Added a logger to DeviceAccessHost.cs and a try/catch block around OnUserUpdated body. As a side effect of adding _eventManager.PublishAsync(eventArgs), UserUpdatedNotifier now emits a user updated notification on policy change. I included 4 regression tests.

Code assistance

Defect found by an LLM audit, then Opus 5 wrote the fix and regression tests and ran the test suite. Verified the changes myself.

Issues

None

@fma-rc
fma-rc marked this pull request as ready for review September 13, 2026 10:52
@sonarqubecloud

Copy link
Copy Markdown

@jellyfin-project-automation jellyfin-project-automation Bot added this to the v12.1 milestone Sep 13, 2026
@Shadowghost
Shadowghost requested a review from a team September 13, 2026 16:08
@Shadowghost Shadowghost added the stable backport Backport into the next stable release label Sep 13, 2026
@jellyfin-bot

Copy link
Copy Markdown
Contributor

Jellyfin API (v 12.0.0)


Result


No differences. Specifications are equivalent

@jellyfin-project-automation jellyfin-project-automation Bot moved this from Review to Approved in Jellyfin v12 Sep 14, 2026
@crobibero
crobibero merged commit 950c45c into jellyfin:release-12.z Sep 14, 2026
17 of 18 checks passed
@github-project-automation github-project-automation Bot moved this from Approved to Done in Jellyfin v12 Sep 14, 2026
joshuaboniface pushed a commit that referenced this pull request Sep 15, 2026
Fix device access revocation not logging out existing sessions

Original-merge: 950c45c

Merged-by: crobibero <cody@robibe.ro>

Backported-by: Cody Robibero <cody@robibe.ro>
@crobibero crobibero removed the stable backport Backport into the next stable release label Sep 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

5 participants