| | | 1 | | #pragma warning disable RS0030 // Do not use banned APIs |
| | | 2 | | |
| | | 3 | | using System; |
| | | 4 | | using System.Collections.Generic; |
| | | 5 | | using System.Globalization; |
| | | 6 | | using System.Linq; |
| | | 7 | | using System.Text.RegularExpressions; |
| | | 8 | | using System.Threading; |
| | | 9 | | using System.Threading.Tasks; |
| | | 10 | | using AsyncKeyedLock; |
| | | 11 | | using Jellyfin.Data; |
| | | 12 | | using Jellyfin.Data.Enums; |
| | | 13 | | using Jellyfin.Data.Events; |
| | | 14 | | using Jellyfin.Data.Events.Users; |
| | | 15 | | using Jellyfin.Database.Implementations; |
| | | 16 | | using Jellyfin.Database.Implementations.Entities; |
| | | 17 | | using Jellyfin.Database.Implementations.Enums; |
| | | 18 | | using Jellyfin.Extensions; |
| | | 19 | | using MediaBrowser.Common; |
| | | 20 | | using MediaBrowser.Common.Extensions; |
| | | 21 | | using MediaBrowser.Common.Net; |
| | | 22 | | using MediaBrowser.Controller.Authentication; |
| | | 23 | | using MediaBrowser.Controller.Configuration; |
| | | 24 | | using MediaBrowser.Controller.Drawing; |
| | | 25 | | using MediaBrowser.Controller.Events; |
| | | 26 | | using MediaBrowser.Controller.Library; |
| | | 27 | | using MediaBrowser.Controller.Net; |
| | | 28 | | using MediaBrowser.Model.Configuration; |
| | | 29 | | using MediaBrowser.Model.Dto; |
| | | 30 | | using MediaBrowser.Model.Users; |
| | | 31 | | using Microsoft.EntityFrameworkCore; |
| | | 32 | | using Microsoft.Extensions.Logging; |
| | | 33 | | |
| | | 34 | | namespace Jellyfin.Server.Implementations.Users |
| | | 35 | | { |
| | | 36 | | /// <summary> |
| | | 37 | | /// Manages the creation and retrieval of <see cref="User"/> instances. |
| | | 38 | | /// </summary> |
| | | 39 | | public partial class UserManager : IUserManager, IDisposable |
| | | 40 | | { |
| | | 41 | | private readonly IDbContextFactory<JellyfinDbContext> _dbProvider; |
| | | 42 | | private readonly IEventManager _eventManager; |
| | | 43 | | private readonly INetworkManager _networkManager; |
| | | 44 | | private readonly IApplicationHost _appHost; |
| | | 45 | | private readonly IImageProcessor _imageProcessor; |
| | | 46 | | private readonly ILogger<UserManager> _logger; |
| | | 47 | | private readonly IReadOnlyCollection<IPasswordResetProvider> _passwordResetProviders; |
| | | 48 | | private readonly IReadOnlyCollection<IAuthenticationProvider> _authenticationProviders; |
| | | 49 | | private readonly InvalidAuthProvider _invalidAuthProvider; |
| | | 50 | | private readonly DefaultAuthenticationProvider _defaultAuthenticationProvider; |
| | | 51 | | private readonly DefaultPasswordResetProvider _defaultPasswordResetProvider; |
| | | 52 | | private readonly IServerConfigurationManager _serverConfigurationManager; |
| | | 53 | | |
| | 49 | 54 | | private readonly LockHelper _userLock = new(); |
| | | 55 | | |
| | | 56 | | /// <summary> |
| | | 57 | | /// Initializes a new instance of the <see cref="UserManager"/> class. |
| | | 58 | | /// </summary> |
| | | 59 | | /// <param name="dbProvider">The database provider.</param> |
| | | 60 | | /// <param name="eventManager">The event manager.</param> |
| | | 61 | | /// <param name="networkManager">The network manager.</param> |
| | | 62 | | /// <param name="appHost">The application host.</param> |
| | | 63 | | /// <param name="imageProcessor">The image processor.</param> |
| | | 64 | | /// <param name="logger">The logger.</param> |
| | | 65 | | /// <param name="serverConfigurationManager">The system config manager.</param> |
| | | 66 | | /// <param name="passwordResetProviders">The password reset providers.</param> |
| | | 67 | | /// <param name="authenticationProviders">The authentication providers.</param> |
| | | 68 | | public UserManager( |
| | | 69 | | IDbContextFactory<JellyfinDbContext> dbProvider, |
| | | 70 | | IEventManager eventManager, |
| | | 71 | | INetworkManager networkManager, |
| | | 72 | | IApplicationHost appHost, |
| | | 73 | | IImageProcessor imageProcessor, |
| | | 74 | | ILogger<UserManager> logger, |
| | | 75 | | IServerConfigurationManager serverConfigurationManager, |
| | | 76 | | IEnumerable<IPasswordResetProvider> passwordResetProviders, |
| | | 77 | | IEnumerable<IAuthenticationProvider> authenticationProviders) |
| | | 78 | | { |
| | 49 | 79 | | _dbProvider = dbProvider; |
| | 49 | 80 | | _eventManager = eventManager; |
| | 49 | 81 | | _networkManager = networkManager; |
| | 49 | 82 | | _appHost = appHost; |
| | 49 | 83 | | _imageProcessor = imageProcessor; |
| | 49 | 84 | | _logger = logger; |
| | 49 | 85 | | _serverConfigurationManager = serverConfigurationManager; |
| | | 86 | | |
| | 49 | 87 | | _passwordResetProviders = passwordResetProviders.ToList(); |
| | 49 | 88 | | _authenticationProviders = authenticationProviders.ToList(); |
| | | 89 | | |
| | 49 | 90 | | _invalidAuthProvider = _authenticationProviders.OfType<InvalidAuthProvider>().First(); |
| | 49 | 91 | | _defaultAuthenticationProvider = _authenticationProviders.OfType<DefaultAuthenticationProvider>().First(); |
| | 49 | 92 | | _defaultPasswordResetProvider = _passwordResetProviders.OfType<DefaultPasswordResetProvider>().First(); |
| | 49 | 93 | | } |
| | | 94 | | |
| | | 95 | | /// <inheritdoc/> |
| | | 96 | | public event EventHandler<GenericEventArgs<User>>? OnUserUpdated; |
| | | 97 | | |
| | | 98 | | /// <inheritdoc/> |
| | | 99 | | public IEnumerable<User> GetUsers() |
| | | 100 | | { |
| | 25 | 101 | | using var dbContext = _dbProvider.CreateDbContext(); |
| | 25 | 102 | | return UserQuery(dbContext) |
| | 25 | 103 | | .ToArray(); |
| | 25 | 104 | | } |
| | | 105 | | |
| | | 106 | | /// <inheritdoc/> |
| | | 107 | | public IEnumerable<Guid> GetUsersIds() |
| | | 108 | | { |
| | 0 | 109 | | using var dbContext = _dbProvider.CreateDbContext(); |
| | 0 | 110 | | return dbContext.Users |
| | 0 | 111 | | .AsNoTracking() |
| | 0 | 112 | | .Select(user => user.Id) |
| | 0 | 113 | | .ToArray(); |
| | 0 | 114 | | } |
| | | 115 | | |
| | | 116 | | // This is some regex that matches only on unicode "word" characters, as well as -, _ and @ |
| | | 117 | | // In theory this will cut out most if not all 'control' characters which should help minimize any weirdness |
| | | 118 | | // Usernames can contain letters (a-z + whatever else unicode is cool with), numbers (0-9), at-signs (@), dashes |
| | | 119 | | [GeneratedRegex(@"^(?!\s)[\w\ \-'._@+]+(?<!\s)$")] |
| | | 120 | | private static partial Regex ValidUsernameRegex(); |
| | | 121 | | |
| | | 122 | | /// <inheritdoc/> |
| | | 123 | | public User? GetUserById(Guid id) |
| | | 124 | | { |
| | 411 | 125 | | if (id.IsEmpty()) |
| | | 126 | | { |
| | 0 | 127 | | throw new ArgumentException("Guid can't be empty", nameof(id)); |
| | | 128 | | } |
| | | 129 | | |
| | 411 | 130 | | using var dbContext = _dbProvider.CreateDbContext(); |
| | 411 | 131 | | return UserQuery(dbContext) |
| | 411 | 132 | | .FirstOrDefault(user => user.Id == id); |
| | 411 | 133 | | } |
| | | 134 | | |
| | | 135 | | private static IQueryable<User> UserQuery(JellyfinDbContext dbContext) |
| | | 136 | | { |
| | 550 | 137 | | return dbContext.Users |
| | 550 | 138 | | .AsSingleQuery() |
| | 550 | 139 | | .Include(user => user.Permissions) |
| | 550 | 140 | | .Include(user => user.Preferences) |
| | 550 | 141 | | .Include(user => user.AccessSchedules) |
| | 550 | 142 | | .Include(user => user.ProfileImage) |
| | 550 | 143 | | .AsNoTracking(); |
| | | 144 | | } |
| | | 145 | | |
| | | 146 | | /// <inheritdoc/> |
| | | 147 | | public User? GetFirstUser() |
| | | 148 | | { |
| | 19 | 149 | | using var dbContext = _dbProvider.CreateDbContext(); |
| | 19 | 150 | | return UserQuery(dbContext).FirstOrDefault(); |
| | 19 | 151 | | } |
| | | 152 | | |
| | | 153 | | /// <inheritdoc/> |
| | | 154 | | public User? GetUserByName(string name) |
| | | 155 | | { |
| | 50 | 156 | | if (string.IsNullOrWhiteSpace(name)) |
| | | 157 | | { |
| | 0 | 158 | | throw new ArgumentException("Invalid username", nameof(name)); |
| | | 159 | | } |
| | | 160 | | |
| | 50 | 161 | | using var dbContext = _dbProvider.CreateDbContext(); |
| | | 162 | | #pragma warning disable CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | 50 | 163 | | return UserQuery(dbContext) |
| | 50 | 164 | | .FirstOrDefault(u => u.NormalizedUsername == name.ToUpperInvariant()); |
| | | 165 | | #pragma warning restore CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | 50 | 166 | | } |
| | | 167 | | |
| | | 168 | | /// <inheritdoc/> |
| | | 169 | | public async Task RenameUser(Guid userId, string oldName, string newName) |
| | | 170 | | { |
| | 10 | 171 | | ThrowIfInvalidUsername(newName); |
| | | 172 | | |
| | 10 | 173 | | if (oldName.Equals(newName, StringComparison.Ordinal)) |
| | | 174 | | { |
| | 0 | 175 | | throw new ArgumentException("The new and old names must be different."); |
| | | 176 | | } |
| | | 177 | | |
| | 10 | 178 | | User user = null!; // user is never actually null where its used afterwards so we can just ignore. |
| | 10 | 179 | | using (await _userLock.LockAsync(userId).ConfigureAwait(false)) |
| | | 180 | | { |
| | 10 | 181 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 10 | 182 | | await using (dbContext.ConfigureAwait(false)) |
| | | 183 | | { |
| | | 184 | | #pragma warning disable CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | 10 | 185 | | if (await dbContext.Users |
| | 10 | 186 | | .AnyAsync(u => u.NormalizedUsername == newName.ToUpperInvariant() && u.Id != userId) |
| | 10 | 187 | | .ConfigureAwait(false)) |
| | | 188 | | { |
| | 4 | 189 | | throw new ArgumentException(string.Format( |
| | 4 | 190 | | CultureInfo.InvariantCulture, |
| | 4 | 191 | | "A user with the name '{0}' already exists.", |
| | 4 | 192 | | newName)); |
| | | 193 | | } |
| | | 194 | | #pragma warning restore CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | | 195 | | |
| | 6 | 196 | | user = await UserQuery(dbContext) |
| | 6 | 197 | | .AsTracking() |
| | 6 | 198 | | .FirstOrDefaultAsync(u => u.Id == userId) |
| | 6 | 199 | | .ConfigureAwait(false) |
| | 6 | 200 | | ?? throw new ResourceNotFoundException(nameof(userId)); |
| | 6 | 201 | | user.Username = newName; |
| | 6 | 202 | | user.NormalizedUsername = newName.ToUpperInvariant(); |
| | 6 | 203 | | await UpdateUserInternalAsync(dbContext, user).ConfigureAwait(false); |
| | | 204 | | } |
| | 6 | 205 | | } |
| | | 206 | | |
| | 6 | 207 | | var eventArgs = new UserUpdatedEventArgs(user); |
| | 6 | 208 | | await _eventManager.PublishAsync(eventArgs).ConfigureAwait(false); |
| | 6 | 209 | | OnUserUpdated?.Invoke(this, eventArgs); |
| | 6 | 210 | | } |
| | | 211 | | |
| | | 212 | | /// <inheritdoc/> |
| | | 213 | | public async Task UpdateUserAsync(User user) |
| | | 214 | | { |
| | 2 | 215 | | using (await _userLock.LockAsync(user.Id).ConfigureAwait(false)) |
| | | 216 | | { |
| | 2 | 217 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 2 | 218 | | await using (dbContext.ConfigureAwait(false)) |
| | | 219 | | { |
| | | 220 | | // TODO: this is a bit of a hack. Because the user entity can be created in another context, it is m |
| | 2 | 221 | | var dbUser = await UserQuery(dbContext) |
| | 2 | 222 | | .AsTracking() |
| | 2 | 223 | | .FirstOrDefaultAsync(u => u.Id == user.Id) |
| | 2 | 224 | | .ConfigureAwait(false) |
| | 2 | 225 | | ?? throw new ResourceNotFoundException(nameof(user.Id)); |
| | | 226 | | |
| | 2 | 227 | | dbContext.Entry(dbUser).CurrentValues.SetValues(user); |
| | 2 | 228 | | dbUser.Permissions.Clear(); |
| | 100 | 229 | | foreach (var permission in user.Permissions) |
| | | 230 | | { |
| | 48 | 231 | | dbUser.Permissions.Add(new Permission(permission.Kind, permission.Value)); |
| | | 232 | | } |
| | | 233 | | |
| | 2 | 234 | | dbUser.Preferences.Clear(); |
| | 56 | 235 | | foreach (var preference in user.Preferences) |
| | | 236 | | { |
| | 26 | 237 | | dbUser.Preferences.Add(new Preference(preference.Kind, preference.Value)); |
| | | 238 | | } |
| | | 239 | | |
| | 2 | 240 | | dbUser.AccessSchedules.Clear(); |
| | 4 | 241 | | foreach (var accessSchedule in user.AccessSchedules) |
| | | 242 | | { |
| | 0 | 243 | | dbUser.AccessSchedules.Add(new AccessSchedule(accessSchedule.DayOfWeek, accessSchedule.StartHour |
| | | 244 | | } |
| | | 245 | | |
| | 2 | 246 | | if (user.ProfileImage is null) |
| | | 247 | | { |
| | 1 | 248 | | if (dbUser.ProfileImage is not null) |
| | | 249 | | { |
| | 0 | 250 | | dbContext.Remove(dbUser.ProfileImage); |
| | 0 | 251 | | dbUser.ProfileImage = null; |
| | | 252 | | } |
| | | 253 | | } |
| | 1 | 254 | | else if (dbUser.ProfileImage is null) |
| | | 255 | | { |
| | 1 | 256 | | dbUser.ProfileImage = new Jellyfin.Database.Implementations.Entities.ImageInfo(user.ProfileImage |
| | 1 | 257 | | { |
| | 1 | 258 | | LastModified = user.ProfileImage.LastModified |
| | 1 | 259 | | }; |
| | | 260 | | } |
| | | 261 | | else |
| | | 262 | | { |
| | 0 | 263 | | dbUser.ProfileImage.Path = user.ProfileImage.Path; |
| | 0 | 264 | | dbUser.ProfileImage.LastModified = user.ProfileImage.LastModified; |
| | | 265 | | } |
| | | 266 | | |
| | 2 | 267 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 268 | | } |
| | 2 | 269 | | } |
| | 2 | 270 | | } |
| | | 271 | | |
| | | 272 | | internal async Task<User> CreateUserInternalAsync(string name, JellyfinDbContext dbContext) |
| | | 273 | | { |
| | | 274 | | // TODO: Remove after user item data is migrated. |
| | 50 | 275 | | var max = await dbContext.Users.AsQueryable().AnyAsync().ConfigureAwait(false) |
| | 50 | 276 | | ? await dbContext.Users.AsQueryable().Select(u => u.InternalId).MaxAsync().ConfigureAwait(false) |
| | 50 | 277 | | : 0; |
| | | 278 | | |
| | 50 | 279 | | var user = new User( |
| | 50 | 280 | | name, |
| | 50 | 281 | | _defaultAuthenticationProvider.GetType().FullName!, |
| | 50 | 282 | | _defaultPasswordResetProvider.GetType().FullName!) |
| | 50 | 283 | | { |
| | 50 | 284 | | InternalId = max + 1 |
| | 50 | 285 | | }; |
| | | 286 | | |
| | 50 | 287 | | user.AddDefaultPermissions(); |
| | 50 | 288 | | user.AddDefaultPreferences(); |
| | | 289 | | |
| | 50 | 290 | | return user; |
| | 50 | 291 | | } |
| | | 292 | | |
| | | 293 | | /// <inheritdoc/> |
| | | 294 | | public async Task<User> CreateUserAsync(string name) |
| | | 295 | | { |
| | 38 | 296 | | ThrowIfInvalidUsername(name); |
| | | 297 | | |
| | | 298 | | User newUser; |
| | 37 | 299 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 37 | 300 | | await using (dbContext.ConfigureAwait(false)) |
| | | 301 | | { |
| | | 302 | | #pragma warning disable CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | 37 | 303 | | if (await dbContext.Users |
| | 37 | 304 | | .AnyAsync(u => u.NormalizedUsername == name.ToUpperInvariant()) |
| | 37 | 305 | | .ConfigureAwait(false)) |
| | | 306 | | { |
| | 4 | 307 | | throw new ArgumentException(string.Format( |
| | 4 | 308 | | CultureInfo.InvariantCulture, |
| | 4 | 309 | | "A user with the name '{0}' already exists.", |
| | 4 | 310 | | name)); |
| | | 311 | | } |
| | | 312 | | #pragma warning restore CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | | 313 | | |
| | 33 | 314 | | newUser = await CreateUserInternalAsync(name, dbContext).ConfigureAwait(false); |
| | | 315 | | |
| | 33 | 316 | | dbContext.Users.Add(newUser); |
| | 33 | 317 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 318 | | } |
| | | 319 | | |
| | 33 | 320 | | await _eventManager.PublishAsync(new UserCreatedEventArgs(newUser)).ConfigureAwait(false); |
| | | 321 | | |
| | 33 | 322 | | return newUser; |
| | 33 | 323 | | } |
| | | 324 | | |
| | | 325 | | /// <inheritdoc/> |
| | | 326 | | public async Task DeleteUserAsync(Guid userId) |
| | | 327 | | { |
| | | 328 | | User? user; |
| | 0 | 329 | | using (await _userLock.LockAsync(userId).ConfigureAwait(false)) |
| | | 330 | | { |
| | 0 | 331 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 0 | 332 | | await using (dbContext.ConfigureAwait(false)) |
| | | 333 | | { |
| | 0 | 334 | | user = await dbContext.Users |
| | 0 | 335 | | .Include(u => u.Permissions) |
| | 0 | 336 | | .FirstOrDefaultAsync(u => u.Id.Equals(userId)) |
| | 0 | 337 | | .ConfigureAwait(false); |
| | 0 | 338 | | if (user is null) |
| | | 339 | | { |
| | 0 | 340 | | throw new ResourceNotFoundException(nameof(userId)); |
| | | 341 | | } |
| | | 342 | | |
| | 0 | 343 | | var userCount = await dbContext.Users.CountAsync().ConfigureAwait(false); |
| | 0 | 344 | | if (userCount == 1) |
| | | 345 | | { |
| | 0 | 346 | | throw new InvalidOperationException(string.Format( |
| | 0 | 347 | | CultureInfo.InvariantCulture, |
| | 0 | 348 | | "The user '{0}' cannot be deleted because there must be at least one user in the system.", |
| | 0 | 349 | | user.Username)); |
| | | 350 | | } |
| | | 351 | | |
| | 0 | 352 | | if (user.HasPermission(PermissionKind.IsAdministrator) |
| | 0 | 353 | | && await dbContext.Users |
| | 0 | 354 | | .CountAsync(i => i.Permissions.Any(p => p.Kind == PermissionKind.IsAdministrator && p.Value) |
| | 0 | 355 | | .ConfigureAwait(false) == 1) |
| | | 356 | | { |
| | 0 | 357 | | throw new ArgumentException( |
| | 0 | 358 | | string.Format( |
| | 0 | 359 | | CultureInfo.InvariantCulture, |
| | 0 | 360 | | "The user '{0}' cannot be deleted because there must be at least one admin user in the s |
| | 0 | 361 | | user.Username), |
| | 0 | 362 | | nameof(userId)); |
| | | 363 | | } |
| | | 364 | | |
| | 0 | 365 | | dbContext.Users.Remove(user); |
| | 0 | 366 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 367 | | } |
| | 0 | 368 | | } |
| | | 369 | | |
| | 0 | 370 | | await _eventManager.PublishAsync(new UserDeletedEventArgs(user)).ConfigureAwait(false); |
| | 0 | 371 | | } |
| | | 372 | | |
| | | 373 | | /// <inheritdoc/> |
| | | 374 | | public Task ResetPassword(Guid userId) |
| | | 375 | | { |
| | 0 | 376 | | return ChangePassword(userId, string.Empty); |
| | | 377 | | } |
| | | 378 | | |
| | | 379 | | /// <inheritdoc/> |
| | | 380 | | public async Task ChangePassword(Guid userId, string newPassword) |
| | | 381 | | { |
| | 3 | 382 | | User dbUser = null!; |
| | 3 | 383 | | using (await _userLock.LockAsync(userId).ConfigureAwait(false)) |
| | | 384 | | { |
| | 3 | 385 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 3 | 386 | | await using (dbContext.ConfigureAwait(false)) |
| | | 387 | | { |
| | 3 | 388 | | dbUser = await UserQuery(dbContext) |
| | 3 | 389 | | .AsTracking() |
| | 3 | 390 | | .FirstOrDefaultAsync(u => u.Id == userId) |
| | 3 | 391 | | .ConfigureAwait(false) |
| | 3 | 392 | | ?? throw new ResourceNotFoundException(nameof(userId)); |
| | 3 | 393 | | if (dbUser.HasPermission(PermissionKind.IsAdministrator) && string.IsNullOrWhiteSpace(newPassword)) |
| | | 394 | | { |
| | 0 | 395 | | throw new ArgumentException("Admin user passwords must not be empty", nameof(newPassword)); |
| | | 396 | | } |
| | | 397 | | |
| | 3 | 398 | | await GetAuthenticationProvider(dbUser).ChangePassword(dbUser, newPassword).ConfigureAwait(false); |
| | 3 | 399 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 400 | | } |
| | 3 | 401 | | } |
| | | 402 | | |
| | 3 | 403 | | await _eventManager.PublishAsync(new UserPasswordChangedEventArgs(dbUser)).ConfigureAwait(false); |
| | 3 | 404 | | } |
| | | 405 | | |
| | | 406 | | /// <inheritdoc/> |
| | | 407 | | public UserDto GetUserDto(User user, string? remoteEndPoint = null) |
| | | 408 | | { |
| | 39 | 409 | | var castReceiverApplications = _serverConfigurationManager.Configuration.CastReceiverApplications; |
| | 39 | 410 | | return new UserDto |
| | 39 | 411 | | { |
| | 39 | 412 | | Name = user.Username, |
| | 39 | 413 | | Id = user.Id, |
| | 39 | 414 | | ServerId = _appHost.SystemId, |
| | 39 | 415 | | EnableAutoLogin = user.EnableAutoLogin, |
| | 39 | 416 | | LastLoginDate = user.LastLoginDate, |
| | 39 | 417 | | LastActivityDate = user.LastActivityDate, |
| | 39 | 418 | | PrimaryImageTag = user.ProfileImage is not null ? _imageProcessor.GetImageCacheTag(user) : null, |
| | 39 | 419 | | Configuration = new UserConfiguration |
| | 39 | 420 | | { |
| | 39 | 421 | | SubtitleMode = user.SubtitleMode, |
| | 39 | 422 | | HidePlayedInLatest = user.HidePlayedInLatest, |
| | 39 | 423 | | EnableLocalPassword = user.EnableLocalPassword, |
| | 39 | 424 | | PlayDefaultAudioTrack = user.PlayDefaultAudioTrack, |
| | 39 | 425 | | DisplayCollectionsView = user.DisplayCollectionsView, |
| | 39 | 426 | | DisplayMissingEpisodes = user.DisplayMissingEpisodes, |
| | 39 | 427 | | AudioLanguagePreference = user.AudioLanguagePreference, |
| | 39 | 428 | | RememberAudioSelections = user.RememberAudioSelections, |
| | 39 | 429 | | EnableNextEpisodeAutoPlay = user.EnableNextEpisodeAutoPlay, |
| | 39 | 430 | | RememberSubtitleSelections = user.RememberSubtitleSelections, |
| | 39 | 431 | | SubtitleLanguagePreference = user.SubtitleLanguagePreference ?? string.Empty, |
| | 39 | 432 | | OrderedViews = user.GetPreferenceValues<Guid>(PreferenceKind.OrderedViews), |
| | 39 | 433 | | GroupedFolders = user.GetPreferenceValues<Guid>(PreferenceKind.GroupedFolders), |
| | 39 | 434 | | MyMediaExcludes = user.GetPreferenceValues<Guid>(PreferenceKind.MyMediaExcludes), |
| | 39 | 435 | | LatestItemsExcludes = user.GetPreferenceValues<Guid>(PreferenceKind.LatestItemExcludes), |
| | 39 | 436 | | CastReceiverId = string.IsNullOrEmpty(user.CastReceiverId) |
| | 39 | 437 | | ? castReceiverApplications.FirstOrDefault()?.Id |
| | 39 | 438 | | : castReceiverApplications.FirstOrDefault(c => string.Equals(c.Id, user.CastReceiverId, StringCo |
| | 39 | 439 | | ?? castReceiverApplications.FirstOrDefault()?.Id |
| | 39 | 440 | | }, |
| | 39 | 441 | | Policy = new UserPolicy |
| | 39 | 442 | | { |
| | 39 | 443 | | MaxParentalRating = user.MaxParentalRatingScore, |
| | 39 | 444 | | MaxParentalSubRating = user.MaxParentalRatingSubScore, |
| | 39 | 445 | | EnableUserPreferenceAccess = user.EnableUserPreferenceAccess, |
| | 39 | 446 | | RemoteClientBitrateLimit = user.RemoteClientBitrateLimit ?? 0, |
| | 39 | 447 | | AuthenticationProviderId = user.AuthenticationProviderId, |
| | 39 | 448 | | PasswordResetProviderId = user.PasswordResetProviderId, |
| | 39 | 449 | | InvalidLoginAttemptCount = user.InvalidLoginAttemptCount, |
| | 39 | 450 | | LoginAttemptsBeforeLockout = user.LoginAttemptsBeforeLockout ?? -1, |
| | 39 | 451 | | MaxActiveSessions = user.MaxActiveSessions, |
| | 39 | 452 | | IsAdministrator = user.HasPermission(PermissionKind.IsAdministrator), |
| | 39 | 453 | | IsHidden = user.HasPermission(PermissionKind.IsHidden), |
| | 39 | 454 | | IsDisabled = user.HasPermission(PermissionKind.IsDisabled), |
| | 39 | 455 | | EnableSharedDeviceControl = user.HasPermission(PermissionKind.EnableSharedDeviceControl), |
| | 39 | 456 | | EnableRemoteAccess = user.HasPermission(PermissionKind.EnableRemoteAccess), |
| | 39 | 457 | | EnableLiveTvManagement = user.HasPermission(PermissionKind.EnableLiveTvManagement), |
| | 39 | 458 | | EnableLiveTvAccess = user.HasPermission(PermissionKind.EnableLiveTvAccess), |
| | 39 | 459 | | EnableMediaPlayback = user.HasPermission(PermissionKind.EnableMediaPlayback), |
| | 39 | 460 | | EnableAudioPlaybackTranscoding = user.HasPermission(PermissionKind.EnableAudioPlaybackTranscoding), |
| | 39 | 461 | | EnableVideoPlaybackTranscoding = user.HasPermission(PermissionKind.EnableVideoPlaybackTranscoding), |
| | 39 | 462 | | EnableContentDeletion = user.HasPermission(PermissionKind.EnableContentDeletion), |
| | 39 | 463 | | EnableContentDownloading = user.HasPermission(PermissionKind.EnableContentDownloading), |
| | 39 | 464 | | EnableSyncTranscoding = user.HasPermission(PermissionKind.EnableSyncTranscoding), |
| | 39 | 465 | | EnableMediaConversion = user.HasPermission(PermissionKind.EnableMediaConversion), |
| | 39 | 466 | | EnableAllChannels = user.HasPermission(PermissionKind.EnableAllChannels), |
| | 39 | 467 | | EnableAllDevices = user.HasPermission(PermissionKind.EnableAllDevices), |
| | 39 | 468 | | EnableAllFolders = user.HasPermission(PermissionKind.EnableAllFolders), |
| | 39 | 469 | | EnableRemoteControlOfOtherUsers = user.HasPermission(PermissionKind.EnableRemoteControlOfOtherUsers) |
| | 39 | 470 | | EnablePlaybackRemuxing = user.HasPermission(PermissionKind.EnablePlaybackRemuxing), |
| | 39 | 471 | | ForceRemoteSourceTranscoding = user.HasPermission(PermissionKind.ForceRemoteSourceTranscoding), |
| | 39 | 472 | | EnablePublicSharing = user.HasPermission(PermissionKind.EnablePublicSharing), |
| | 39 | 473 | | EnableCollectionManagement = user.HasPermission(PermissionKind.EnableCollectionManagement), |
| | 39 | 474 | | EnableSubtitleManagement = user.HasPermission(PermissionKind.EnableSubtitleManagement), |
| | 39 | 475 | | AccessSchedules = user.AccessSchedules.ToArray(), |
| | 39 | 476 | | BlockedTags = user.GetPreference(PreferenceKind.BlockedTags), |
| | 39 | 477 | | AllowedTags = user.GetPreference(PreferenceKind.AllowedTags), |
| | 39 | 478 | | EnabledChannels = user.GetPreferenceValues<Guid>(PreferenceKind.EnabledChannels), |
| | 39 | 479 | | EnabledDevices = user.GetPreference(PreferenceKind.EnabledDevices), |
| | 39 | 480 | | EnabledFolders = user.GetPreferenceValues<Guid>(PreferenceKind.EnabledFolders), |
| | 39 | 481 | | EnableContentDeletionFromFolders = user.GetPreference(PreferenceKind.EnableContentDeletionFromFolder |
| | 39 | 482 | | SyncPlayAccess = user.SyncPlayAccess, |
| | 39 | 483 | | BlockedChannels = user.GetPreferenceValues<Guid>(PreferenceKind.BlockedChannels), |
| | 39 | 484 | | BlockedMediaFolders = user.GetPreferenceValues<Guid>(PreferenceKind.BlockedMediaFolders), |
| | 39 | 485 | | BlockUnratedItems = user.GetPreferenceValues<UnratedItem>(PreferenceKind.BlockUnratedItems) |
| | 39 | 486 | | } |
| | 39 | 487 | | }; |
| | | 488 | | } |
| | | 489 | | |
| | | 490 | | /// <inheritdoc/> |
| | | 491 | | public async Task<User?> AuthenticateUser( |
| | | 492 | | string username, |
| | | 493 | | string password, |
| | | 494 | | string remoteEndPoint, |
| | | 495 | | bool isUserSession) |
| | | 496 | | { |
| | 16 | 497 | | if (string.IsNullOrWhiteSpace(username)) |
| | | 498 | | { |
| | 0 | 499 | | _logger.LogInformation("Authentication request without username has been denied (IP: {IP}).", remoteEndP |
| | 0 | 500 | | throw new ArgumentNullException(nameof(username)); |
| | | 501 | | } |
| | | 502 | | |
| | | 503 | | bool success; |
| | 16 | 504 | | var user = GetUserByName(username); |
| | 16 | 505 | | using (await _userLock.LockAsync(user?.Id ?? Guid.Empty).ConfigureAwait(false)) |
| | | 506 | | { |
| | 16 | 507 | | using var dbContext = _dbProvider.CreateDbContext(); |
| | | 508 | | |
| | | 509 | | // Reload the user now that we hold the lock so the RowVersion is current. |
| | | 510 | | // GetUserByName uses AsNoTracking and the snapshot may be stale if another |
| | | 511 | | // write (e.g. a concurrent login) incremented RowVersion after our initial load. |
| | 16 | 512 | | if (user is not null) |
| | | 513 | | { |
| | 16 | 514 | | user = await UserQuery(dbContext).FirstOrDefaultAsync(e => e.Id == user.Id).ConfigureAwait(false) ?? |
| | | 515 | | } |
| | | 516 | | |
| | 16 | 517 | | var authResult = await AuthenticateLocalUser(username, password, user) |
| | 16 | 518 | | .ConfigureAwait(false); |
| | 16 | 519 | | var authenticationProvider = authResult.AuthenticationProvider; |
| | 16 | 520 | | success = authResult.Success; |
| | | 521 | | |
| | 16 | 522 | | if (success && user is not null) |
| | | 523 | | { |
| | | 524 | | // refresh the user if the auth provider might have updated it in the auth method. |
| | | 525 | | // this is a hack, this needs removal once the LDAP plugin uses the correct interface to get the use |
| | 16 | 526 | | user = await UserQuery(dbContext).FirstOrDefaultAsync(e => e.Id == user.Id).ConfigureAwait(false); |
| | | 527 | | } |
| | | 528 | | |
| | 16 | 529 | | if (user is null) |
| | | 530 | | { |
| | 0 | 531 | | string updatedUsername = authResult.Username; |
| | | 532 | | |
| | 0 | 533 | | if (success |
| | 0 | 534 | | && authenticationProvider is not null |
| | 0 | 535 | | && authenticationProvider is not DefaultAuthenticationProvider) |
| | | 536 | | { |
| | | 537 | | // Trust the username returned by the authentication provider |
| | 0 | 538 | | username = updatedUsername; |
| | | 539 | | |
| | | 540 | | // Search the database for the user again |
| | | 541 | | // the authentication provider might have created it |
| | | 542 | | #pragma warning disable CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | 0 | 543 | | user = await UserQuery(dbContext) |
| | 0 | 544 | | .FirstOrDefaultAsync(e => e.NormalizedUsername == username.ToUpperInvariant()).ConfigureAwai |
| | | 545 | | |
| | 0 | 546 | | if (authenticationProvider is IHasNewUserPolicy hasNewUserPolicy && user is not null) |
| | | 547 | | { |
| | 0 | 548 | | await UpdatePolicyAsync(user.Id, hasNewUserPolicy.GetNewUserPolicy()).ConfigureAwait(false); |
| | 0 | 549 | | user = await UserQuery(dbContext) |
| | 0 | 550 | | .FirstOrDefaultAsync(e => e.NormalizedUsername == username.ToUpperInvariant()).Configure |
| | | 551 | | #pragma warning restore CA1862 // Use the 'StringComparison' method overloads to perform case-insensitive string compari |
| | | 552 | | } |
| | | 553 | | } |
| | | 554 | | } |
| | | 555 | | |
| | 16 | 556 | | if (success && user is not null && authenticationProvider is not null) |
| | | 557 | | { |
| | 16 | 558 | | var providerId = authenticationProvider.GetType().FullName; |
| | | 559 | | |
| | 16 | 560 | | if (providerId is not null && !string.Equals(providerId, user.AuthenticationProviderId, StringCompar |
| | | 561 | | { |
| | 0 | 562 | | await dbContext.Users |
| | 0 | 563 | | .Where(e => e.Id == user.Id) |
| | 0 | 564 | | .ExecuteUpdateAsync(e => e.SetProperty(f => f.AuthenticationProviderId, providerId)) |
| | 0 | 565 | | .ConfigureAwait(false); |
| | | 566 | | } |
| | | 567 | | } |
| | | 568 | | |
| | 16 | 569 | | if (user is null) |
| | | 570 | | { |
| | 0 | 571 | | _logger.LogInformation( |
| | 0 | 572 | | "Authentication request for {UserName} has been denied (IP: {IP}).", |
| | 0 | 573 | | username, |
| | 0 | 574 | | remoteEndPoint); |
| | 0 | 575 | | throw new AuthenticationException("Invalid username or password entered."); |
| | | 576 | | } |
| | | 577 | | |
| | 16 | 578 | | if (user.HasPermission(PermissionKind.IsDisabled)) |
| | | 579 | | { |
| | 0 | 580 | | _logger.LogInformation( |
| | 0 | 581 | | "Authentication request for {UserName} has been denied because this account is currently disable |
| | 0 | 582 | | username, |
| | 0 | 583 | | remoteEndPoint); |
| | 0 | 584 | | throw new SecurityException( |
| | 0 | 585 | | $"The {user.Username} account is currently disabled. Please consult with your administrator."); |
| | | 586 | | } |
| | | 587 | | |
| | 16 | 588 | | if (!user.HasPermission(PermissionKind.EnableRemoteAccess) && |
| | 16 | 589 | | !_networkManager.IsInLocalNetwork(remoteEndPoint)) |
| | | 590 | | { |
| | 0 | 591 | | _logger.LogInformation( |
| | 0 | 592 | | "Authentication request for {UserName} forbidden: remote access disabled and user not in local n |
| | 0 | 593 | | username, |
| | 0 | 594 | | remoteEndPoint); |
| | 0 | 595 | | throw new SecurityException("Forbidden."); |
| | | 596 | | } |
| | | 597 | | |
| | 16 | 598 | | if (!user.IsParentalScheduleAllowed()) |
| | | 599 | | { |
| | 0 | 600 | | _logger.LogInformation( |
| | 0 | 601 | | "Authentication request for {UserName} is not allowed at this time due parental restrictions (IP |
| | 0 | 602 | | username, |
| | 0 | 603 | | remoteEndPoint); |
| | 0 | 604 | | throw new SecurityException("User is not allowed access at this time."); |
| | | 605 | | } |
| | | 606 | | |
| | | 607 | | // Update LastActivityDate and LastLoginDate, then save |
| | 16 | 608 | | if (success) |
| | | 609 | | { |
| | 16 | 610 | | if (isUserSession) |
| | | 611 | | { |
| | 16 | 612 | | var date = DateTime.UtcNow; |
| | 16 | 613 | | await dbContext.Users |
| | 16 | 614 | | .Where(e => e.Id == user.Id) |
| | 16 | 615 | | .ExecuteUpdateAsync(e => e |
| | 16 | 616 | | .SetProperty(f => f.LastActivityDate, date) |
| | 16 | 617 | | .SetProperty(f => f.LastLoginDate, date)) |
| | 16 | 618 | | .ConfigureAwait(false); |
| | | 619 | | |
| | | 620 | | // ExecuteUpdateAsync bypasses the change tracker, so keep the |
| | | 621 | | // returned entity in sync. Otherwise SessionManager.LogSessionActivity |
| | | 622 | | // saves this (stale) entity in full and reverts LastLoginDate. |
| | 16 | 623 | | user.LastActivityDate = date; |
| | 16 | 624 | | user.LastLoginDate = date; |
| | 16 | 625 | | } |
| | | 626 | | |
| | 16 | 627 | | await dbContext.Users |
| | 16 | 628 | | .Where(e => e.Id == user.Id) |
| | 16 | 629 | | .ExecuteUpdateAsync(e => e.SetProperty(f => f.InvalidLoginAttemptCount, 0)) |
| | 16 | 630 | | .ConfigureAwait(false); |
| | 16 | 631 | | _logger.LogInformation("Authentication request for {UserName} has succeeded.", user.Username); |
| | | 632 | | } |
| | | 633 | | else |
| | | 634 | | { |
| | 0 | 635 | | user.InvalidLoginAttemptCount++; |
| | 0 | 636 | | int? maxInvalidLogins = user.LoginAttemptsBeforeLockout; |
| | 0 | 637 | | if (maxInvalidLogins.HasValue && user.InvalidLoginAttemptCount >= maxInvalidLogins) |
| | | 638 | | { |
| | 0 | 639 | | user.SetPermission(PermissionKind.IsDisabled, true); |
| | 0 | 640 | | dbContext.Update(user); |
| | 0 | 641 | | await dbContext.SaveChangesAsync() |
| | 0 | 642 | | .ConfigureAwait(false); |
| | 0 | 643 | | await _eventManager.PublishAsync(new UserLockedOutEventArgs(user)).ConfigureAwait(false); |
| | 0 | 644 | | _logger.LogWarning( |
| | 0 | 645 | | "Disabling user {Username} due to {Attempts} unsuccessful login attempts.", |
| | 0 | 646 | | user.Username, |
| | 0 | 647 | | user.InvalidLoginAttemptCount); |
| | | 648 | | } |
| | | 649 | | |
| | 0 | 650 | | await dbContext.Users |
| | 0 | 651 | | .Where(e => e.Id == user.Id) |
| | 0 | 652 | | .ExecuteUpdateAsync(e => e.SetProperty(f => f.InvalidLoginAttemptCount, f => f.InvalidLoginAttem |
| | 0 | 653 | | .ConfigureAwait(false); |
| | | 654 | | |
| | 0 | 655 | | _logger.LogInformation( |
| | 0 | 656 | | "Authentication request for {UserName} has been denied (IP: {IP}).", |
| | 0 | 657 | | user.Username, |
| | 0 | 658 | | remoteEndPoint); |
| | | 659 | | } |
| | 16 | 660 | | } |
| | | 661 | | |
| | 16 | 662 | | return success ? user : null; |
| | 16 | 663 | | } |
| | | 664 | | |
| | | 665 | | /// <inheritdoc/> |
| | | 666 | | public async Task<ForgotPasswordResult> StartForgotPasswordProcess(string enteredUsername, bool isInNetwork) |
| | | 667 | | { |
| | 0 | 668 | | var user = string.IsNullOrWhiteSpace(enteredUsername) ? null : GetUserByName(enteredUsername); |
| | 0 | 669 | | var passwordResetProvider = GetPasswordResetProvider(user); |
| | | 670 | | |
| | 0 | 671 | | var result = await passwordResetProvider |
| | 0 | 672 | | .StartForgotPasswordProcess(user, enteredUsername, isInNetwork) |
| | 0 | 673 | | .ConfigureAwait(false); |
| | | 674 | | |
| | 0 | 675 | | if (user is not null && isInNetwork) |
| | | 676 | | { |
| | 0 | 677 | | await UpdateUserAsync(user).ConfigureAwait(false); |
| | | 678 | | } |
| | | 679 | | |
| | 0 | 680 | | return result; |
| | 0 | 681 | | } |
| | | 682 | | |
| | | 683 | | /// <inheritdoc/> |
| | | 684 | | public async Task<PinRedeemResult> RedeemPasswordResetPin(string pin) |
| | | 685 | | { |
| | 0 | 686 | | foreach (var provider in _passwordResetProviders) |
| | | 687 | | { |
| | 0 | 688 | | var result = await provider.RedeemPasswordResetPin(pin).ConfigureAwait(false); |
| | | 689 | | |
| | 0 | 690 | | if (result.Success) |
| | | 691 | | { |
| | 0 | 692 | | return result; |
| | | 693 | | } |
| | | 694 | | } |
| | | 695 | | |
| | 0 | 696 | | return new PinRedeemResult(); |
| | 0 | 697 | | } |
| | | 698 | | |
| | | 699 | | /// <inheritdoc /> |
| | | 700 | | public async Task InitializeAsync() |
| | | 701 | | { |
| | | 702 | | // TODO: Refactor the startup wizard so that it doesn't require a user to already exist. |
| | 18 | 703 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 18 | 704 | | await using (dbContext.ConfigureAwait(false)) |
| | | 705 | | { |
| | 18 | 706 | | if (await dbContext.Users.AnyAsync().ConfigureAwait(false)) |
| | | 707 | | { |
| | | 708 | | return; |
| | | 709 | | } |
| | | 710 | | |
| | 17 | 711 | | var defaultName = Environment.UserName; |
| | 17 | 712 | | if (string.IsNullOrWhiteSpace(defaultName) || !ValidUsernameRegex().IsMatch(defaultName)) |
| | | 713 | | { |
| | 0 | 714 | | defaultName = "MyJellyfinUser"; |
| | | 715 | | } |
| | | 716 | | |
| | 17 | 717 | | _logger.LogWarning("No users, creating one with username {UserName}", defaultName); |
| | | 718 | | |
| | 17 | 719 | | var newUser = await CreateUserInternalAsync(defaultName, dbContext).ConfigureAwait(false); |
| | 17 | 720 | | newUser.SetPermission(PermissionKind.IsAdministrator, true); |
| | 17 | 721 | | newUser.SetPermission(PermissionKind.EnableContentDeletion, true); |
| | 17 | 722 | | newUser.SetPermission(PermissionKind.EnableRemoteControlOfOtherUsers, true); |
| | | 723 | | |
| | 17 | 724 | | dbContext.Users.Add(newUser); |
| | 17 | 725 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 726 | | } |
| | 18 | 727 | | } |
| | | 728 | | |
| | | 729 | | /// <inheritdoc/> |
| | | 730 | | public NameIdPair[] GetAuthenticationProviders() |
| | | 731 | | { |
| | 0 | 732 | | return _authenticationProviders |
| | 0 | 733 | | .Where(provider => provider.IsEnabled) |
| | 0 | 734 | | .OrderBy(i => i is DefaultAuthenticationProvider ? 0 : 1) |
| | 0 | 735 | | .ThenBy(i => i.Name) |
| | 0 | 736 | | .Select(i => new NameIdPair |
| | 0 | 737 | | { |
| | 0 | 738 | | Name = i.Name, |
| | 0 | 739 | | Id = i.GetType().FullName |
| | 0 | 740 | | }) |
| | 0 | 741 | | .ToArray(); |
| | | 742 | | } |
| | | 743 | | |
| | | 744 | | /// <inheritdoc/> |
| | | 745 | | public NameIdPair[] GetPasswordResetProviders() |
| | | 746 | | { |
| | 0 | 747 | | return _passwordResetProviders |
| | 0 | 748 | | .Where(provider => provider.IsEnabled) |
| | 0 | 749 | | .OrderBy(i => i is DefaultPasswordResetProvider ? 0 : 1) |
| | 0 | 750 | | .ThenBy(i => i.Name) |
| | 0 | 751 | | .Select(i => new NameIdPair |
| | 0 | 752 | | { |
| | 0 | 753 | | Name = i.Name, |
| | 0 | 754 | | Id = i.GetType().FullName |
| | 0 | 755 | | }) |
| | 0 | 756 | | .ToArray(); |
| | | 757 | | } |
| | | 758 | | |
| | | 759 | | /// <inheritdoc/> |
| | | 760 | | public async Task UpdateConfigurationAsync(Guid userId, UserConfiguration config) |
| | | 761 | | { |
| | 1 | 762 | | using (await _userLock.LockAsync(userId).ConfigureAwait(false)) |
| | | 763 | | { |
| | 1 | 764 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 1 | 765 | | await using (dbContext.ConfigureAwait(false)) |
| | | 766 | | { |
| | 1 | 767 | | var user = UserQuery(dbContext) |
| | 1 | 768 | | .AsTracking() |
| | 1 | 769 | | .FirstOrDefault(u => u.Id.Equals(userId)) |
| | 1 | 770 | | ?? throw new ArgumentException("No user exists with given Id!"); |
| | | 771 | | |
| | 1 | 772 | | user.SubtitleMode = config.SubtitleMode; |
| | 1 | 773 | | user.HidePlayedInLatest = config.HidePlayedInLatest; |
| | 1 | 774 | | user.EnableLocalPassword = config.EnableLocalPassword; |
| | 1 | 775 | | user.PlayDefaultAudioTrack = config.PlayDefaultAudioTrack; |
| | 1 | 776 | | user.DisplayCollectionsView = config.DisplayCollectionsView; |
| | 1 | 777 | | user.DisplayMissingEpisodes = config.DisplayMissingEpisodes; |
| | 1 | 778 | | user.AudioLanguagePreference = config.AudioLanguagePreference; |
| | 1 | 779 | | user.RememberAudioSelections = config.RememberAudioSelections; |
| | 1 | 780 | | user.EnableNextEpisodeAutoPlay = config.EnableNextEpisodeAutoPlay; |
| | 1 | 781 | | user.RememberSubtitleSelections = config.RememberSubtitleSelections; |
| | 1 | 782 | | user.SubtitleLanguagePreference = config.SubtitleLanguagePreference; |
| | | 783 | | |
| | | 784 | | // Only set cast receiver id if it is passed in and it exists in the server config. |
| | 1 | 785 | | if (!string.IsNullOrEmpty(config.CastReceiverId) |
| | 1 | 786 | | && _serverConfigurationManager.Configuration.CastReceiverApplications.Any(c => string.Equals(c.I |
| | | 787 | | { |
| | 1 | 788 | | user.CastReceiverId = config.CastReceiverId; |
| | | 789 | | } |
| | | 790 | | |
| | 1 | 791 | | user.SetPreference(PreferenceKind.OrderedViews, config.OrderedViews); |
| | 1 | 792 | | user.SetPreference(PreferenceKind.GroupedFolders, config.GroupedFolders); |
| | 1 | 793 | | user.SetPreference(PreferenceKind.MyMediaExcludes, config.MyMediaExcludes); |
| | 1 | 794 | | user.SetPreference(PreferenceKind.LatestItemExcludes, config.LatestItemsExcludes); |
| | | 795 | | |
| | 1 | 796 | | dbContext.Update(user); |
| | 1 | 797 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 798 | | } |
| | 1 | 799 | | } |
| | 1 | 800 | | } |
| | | 801 | | |
| | | 802 | | /// <inheritdoc/> |
| | | 803 | | public async Task UpdatePolicyAsync(Guid userId, UserPolicy policy) |
| | | 804 | | { |
| | 0 | 805 | | using (await _userLock.LockAsync(userId).ConfigureAwait(false)) |
| | | 806 | | { |
| | 0 | 807 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 0 | 808 | | await using (dbContext.ConfigureAwait(false)) |
| | | 809 | | { |
| | 0 | 810 | | var user = UserQuery(dbContext) |
| | 0 | 811 | | .AsTracking() |
| | 0 | 812 | | .FirstOrDefault(u => u.Id.Equals(userId)) |
| | 0 | 813 | | ?? throw new ArgumentException("No user exists with given Id!"); |
| | | 814 | | |
| | | 815 | | // The default number of login attempts is 3, but for some god forsaken reason it's sent to the serv |
| | 0 | 816 | | int? maxLoginAttempts = policy.LoginAttemptsBeforeLockout switch |
| | 0 | 817 | | { |
| | 0 | 818 | | -1 => null, |
| | 0 | 819 | | 0 => 3, |
| | 0 | 820 | | _ => policy.LoginAttemptsBeforeLockout |
| | 0 | 821 | | }; |
| | | 822 | | |
| | 0 | 823 | | user.MaxParentalRatingScore = policy.MaxParentalRating; |
| | 0 | 824 | | user.MaxParentalRatingSubScore = policy.MaxParentalSubRating; |
| | 0 | 825 | | user.EnableUserPreferenceAccess = policy.EnableUserPreferenceAccess; |
| | 0 | 826 | | user.RemoteClientBitrateLimit = policy.RemoteClientBitrateLimit; |
| | 0 | 827 | | user.AuthenticationProviderId = policy.AuthenticationProviderId; |
| | 0 | 828 | | user.PasswordResetProviderId = policy.PasswordResetProviderId; |
| | 0 | 829 | | user.InvalidLoginAttemptCount = policy.InvalidLoginAttemptCount; |
| | 0 | 830 | | user.LoginAttemptsBeforeLockout = maxLoginAttempts; |
| | 0 | 831 | | user.MaxActiveSessions = policy.MaxActiveSessions; |
| | 0 | 832 | | user.SyncPlayAccess = policy.SyncPlayAccess; |
| | 0 | 833 | | user.SetPermission(PermissionKind.IsAdministrator, policy.IsAdministrator); |
| | 0 | 834 | | user.SetPermission(PermissionKind.IsHidden, policy.IsHidden); |
| | 0 | 835 | | user.SetPermission(PermissionKind.IsDisabled, policy.IsDisabled); |
| | 0 | 836 | | user.SetPermission(PermissionKind.EnableSharedDeviceControl, policy.EnableSharedDeviceControl); |
| | 0 | 837 | | user.SetPermission(PermissionKind.EnableRemoteAccess, policy.EnableRemoteAccess); |
| | 0 | 838 | | user.SetPermission(PermissionKind.EnableLiveTvManagement, policy.EnableLiveTvManagement); |
| | 0 | 839 | | user.SetPermission(PermissionKind.EnableLiveTvAccess, policy.EnableLiveTvAccess); |
| | 0 | 840 | | user.SetPermission(PermissionKind.EnableMediaPlayback, policy.EnableMediaPlayback); |
| | 0 | 841 | | user.SetPermission(PermissionKind.EnableAudioPlaybackTranscoding, policy.EnableAudioPlaybackTranscod |
| | 0 | 842 | | user.SetPermission(PermissionKind.EnableVideoPlaybackTranscoding, policy.EnableVideoPlaybackTranscod |
| | 0 | 843 | | user.SetPermission(PermissionKind.EnableContentDeletion, policy.EnableContentDeletion); |
| | 0 | 844 | | user.SetPermission(PermissionKind.EnableContentDownloading, policy.EnableContentDownloading); |
| | 0 | 845 | | user.SetPermission(PermissionKind.EnableSyncTranscoding, policy.EnableSyncTranscoding); |
| | 0 | 846 | | user.SetPermission(PermissionKind.EnableMediaConversion, policy.EnableMediaConversion); |
| | 0 | 847 | | user.SetPermission(PermissionKind.EnableAllChannels, policy.EnableAllChannels); |
| | 0 | 848 | | user.SetPermission(PermissionKind.EnableAllDevices, policy.EnableAllDevices); |
| | 0 | 849 | | user.SetPermission(PermissionKind.EnableAllFolders, policy.EnableAllFolders); |
| | 0 | 850 | | user.SetPermission(PermissionKind.EnableRemoteControlOfOtherUsers, policy.EnableRemoteControlOfOther |
| | 0 | 851 | | user.SetPermission(PermissionKind.EnablePlaybackRemuxing, policy.EnablePlaybackRemuxing); |
| | 0 | 852 | | user.SetPermission(PermissionKind.EnableCollectionManagement, policy.EnableCollectionManagement); |
| | 0 | 853 | | user.SetPermission(PermissionKind.EnableSubtitleManagement, policy.EnableSubtitleManagement); |
| | 0 | 854 | | user.SetPermission(PermissionKind.EnableLyricManagement, policy.EnableLyricManagement); |
| | 0 | 855 | | user.SetPermission(PermissionKind.ForceRemoteSourceTranscoding, policy.ForceRemoteSourceTranscoding) |
| | 0 | 856 | | user.SetPermission(PermissionKind.EnablePublicSharing, policy.EnablePublicSharing); |
| | | 857 | | |
| | 0 | 858 | | user.AccessSchedules.Clear(); |
| | 0 | 859 | | foreach (var policyAccessSchedule in policy.AccessSchedules) |
| | | 860 | | { |
| | 0 | 861 | | user.AccessSchedules.Add(policyAccessSchedule); |
| | | 862 | | } |
| | | 863 | | |
| | | 864 | | // TODO: fix this at some point |
| | 0 | 865 | | user.SetPreference(PreferenceKind.BlockUnratedItems, policy.BlockUnratedItems ?? Array.Empty<Unrated |
| | 0 | 866 | | user.SetPreference(PreferenceKind.BlockedTags, policy.BlockedTags); |
| | 0 | 867 | | user.SetPreference(PreferenceKind.AllowedTags, policy.AllowedTags); |
| | 0 | 868 | | user.SetPreference(PreferenceKind.EnabledChannels, policy.EnabledChannels); |
| | 0 | 869 | | user.SetPreference(PreferenceKind.EnabledDevices, policy.EnabledDevices); |
| | 0 | 870 | | user.SetPreference(PreferenceKind.EnabledFolders, policy.EnabledFolders); |
| | 0 | 871 | | user.SetPreference(PreferenceKind.EnableContentDeletionFromFolders, policy.EnableContentDeletionFrom |
| | | 872 | | |
| | 0 | 873 | | dbContext.Update(user); |
| | 0 | 874 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 875 | | } |
| | 0 | 876 | | } |
| | 0 | 877 | | } |
| | | 878 | | |
| | | 879 | | /// <inheritdoc/> |
| | | 880 | | public async Task ClearProfileImageAsync(User user) |
| | | 881 | | { |
| | 2 | 882 | | if (user.ProfileImage is null) |
| | | 883 | | { |
| | 1 | 884 | | return; |
| | | 885 | | } |
| | | 886 | | |
| | 1 | 887 | | using (await _userLock.LockAsync(user.Id).ConfigureAwait(false)) |
| | | 888 | | { |
| | 1 | 889 | | var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false); |
| | 1 | 890 | | await using (dbContext.ConfigureAwait(false)) |
| | | 891 | | { |
| | | 892 | | // Remove the tracked profile image loaded from the database instead of the |
| | | 893 | | // detached instance on the passed in user. That instance can carry a stale, |
| | | 894 | | // never-persisted (temporary) key, which makes EF Core throw when it is marked |
| | | 895 | | // for deletion, leaving the profile image impossible to clear or replace. |
| | 1 | 896 | | var dbUser = await UserQuery(dbContext) |
| | 1 | 897 | | .AsTracking() |
| | 1 | 898 | | .FirstOrDefaultAsync(u => u.Id == user.Id) |
| | 1 | 899 | | .ConfigureAwait(false); |
| | 1 | 900 | | if (dbUser?.ProfileImage is not null) |
| | | 901 | | { |
| | 1 | 902 | | dbContext.Remove(dbUser.ProfileImage); |
| | 1 | 903 | | dbUser.ProfileImage = null; |
| | 1 | 904 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | | 905 | | } |
| | | 906 | | } |
| | | 907 | | |
| | 1 | 908 | | user.ProfileImage = null; |
| | 1 | 909 | | } |
| | 2 | 910 | | } |
| | | 911 | | |
| | | 912 | | internal static void ThrowIfInvalidUsername(string name) |
| | | 913 | | { |
| | 63 | 914 | | if (!string.IsNullOrWhiteSpace(name) && ValidUsernameRegex().IsMatch(name) && !string.Equals(name, ".", Stri |
| | | 915 | | { |
| | 53 | 916 | | return; |
| | | 917 | | } |
| | | 918 | | |
| | 10 | 919 | | throw new ArgumentException("Usernames can contain unicode symbols, numbers (0-9), dashes (-), underscores ( |
| | | 920 | | } |
| | | 921 | | |
| | | 922 | | private IAuthenticationProvider GetAuthenticationProvider(User user) |
| | | 923 | | { |
| | 3 | 924 | | return GetAuthenticationProviders(user)[0]; |
| | | 925 | | } |
| | | 926 | | |
| | | 927 | | private IPasswordResetProvider GetPasswordResetProvider(User? user) |
| | | 928 | | { |
| | 0 | 929 | | if (user is null) |
| | | 930 | | { |
| | 0 | 931 | | return _defaultPasswordResetProvider; |
| | | 932 | | } |
| | | 933 | | |
| | 0 | 934 | | return GetPasswordResetProviders(user)[0]; |
| | | 935 | | } |
| | | 936 | | |
| | | 937 | | private List<IAuthenticationProvider> GetAuthenticationProviders(User? user) |
| | | 938 | | { |
| | 19 | 939 | | var authenticationProviderId = user?.AuthenticationProviderId; |
| | | 940 | | |
| | 19 | 941 | | var providers = _authenticationProviders.Where(i => i.IsEnabled).ToList(); |
| | | 942 | | |
| | 19 | 943 | | if (!string.IsNullOrEmpty(authenticationProviderId)) |
| | | 944 | | { |
| | 19 | 945 | | providers = providers.Where(i => string.Equals(authenticationProviderId, i.GetType().FullName, StringCom |
| | | 946 | | } |
| | | 947 | | |
| | 19 | 948 | | if (providers.Count == 0) |
| | | 949 | | { |
| | | 950 | | // Assign the user to the InvalidAuthProvider since no configured auth provider was valid/found |
| | 0 | 951 | | _logger.LogWarning( |
| | 0 | 952 | | "User {Username} was found with invalid/missing Authentication Provider {AuthenticationProviderId}. |
| | 0 | 953 | | user?.Username, |
| | 0 | 954 | | user?.AuthenticationProviderId); |
| | 0 | 955 | | providers = new List<IAuthenticationProvider> |
| | 0 | 956 | | { |
| | 0 | 957 | | _invalidAuthProvider |
| | 0 | 958 | | }; |
| | | 959 | | } |
| | | 960 | | |
| | 19 | 961 | | return providers; |
| | | 962 | | } |
| | | 963 | | |
| | | 964 | | private IPasswordResetProvider[] GetPasswordResetProviders(User user) |
| | | 965 | | { |
| | 0 | 966 | | var passwordResetProviderId = user.PasswordResetProviderId; |
| | 0 | 967 | | var providers = _passwordResetProviders.Where(i => i.IsEnabled).ToArray(); |
| | | 968 | | |
| | 0 | 969 | | if (!string.IsNullOrEmpty(passwordResetProviderId)) |
| | | 970 | | { |
| | 0 | 971 | | providers = providers.Where(i => |
| | 0 | 972 | | string.Equals(passwordResetProviderId, i.GetType().FullName, StringComparison.OrdinalIgnoreCase) |
| | 0 | 973 | | .ToArray(); |
| | | 974 | | } |
| | | 975 | | |
| | 0 | 976 | | if (providers.Length == 0) |
| | | 977 | | { |
| | 0 | 978 | | providers = new IPasswordResetProvider[] |
| | 0 | 979 | | { |
| | 0 | 980 | | _defaultPasswordResetProvider |
| | 0 | 981 | | }; |
| | | 982 | | } |
| | | 983 | | |
| | 0 | 984 | | return providers; |
| | | 985 | | } |
| | | 986 | | |
| | | 987 | | private async Task<(IAuthenticationProvider? AuthenticationProvider, string Username, bool Success)> Authenticat |
| | | 988 | | string username, |
| | | 989 | | string password, |
| | | 990 | | User? user) |
| | | 991 | | { |
| | 16 | 992 | | bool success = false; |
| | 16 | 993 | | IAuthenticationProvider? authenticationProvider = null; |
| | | 994 | | |
| | 48 | 995 | | foreach (var provider in GetAuthenticationProviders(user)) |
| | | 996 | | { |
| | 16 | 997 | | var providerAuthResult = |
| | 16 | 998 | | await AuthenticateWithProvider(provider, username, password, user).ConfigureAwait(false); |
| | 16 | 999 | | var updatedUsername = providerAuthResult.Username; |
| | 16 | 1000 | | success = providerAuthResult.Success; |
| | | 1001 | | |
| | 16 | 1002 | | if (success) |
| | | 1003 | | { |
| | 16 | 1004 | | authenticationProvider = provider; |
| | 16 | 1005 | | username = updatedUsername; |
| | 16 | 1006 | | break; |
| | | 1007 | | } |
| | 0 | 1008 | | } |
| | | 1009 | | |
| | 16 | 1010 | | return (authenticationProvider, username, success); |
| | 16 | 1011 | | } |
| | | 1012 | | |
| | | 1013 | | private async Task<(string Username, bool Success)> AuthenticateWithProvider( |
| | | 1014 | | IAuthenticationProvider provider, |
| | | 1015 | | string username, |
| | | 1016 | | string password, |
| | | 1017 | | User? resolvedUser) |
| | | 1018 | | { |
| | | 1019 | | try |
| | | 1020 | | { |
| | 16 | 1021 | | var authenticationResult = provider is IRequiresResolvedUser requiresResolvedUser |
| | 16 | 1022 | | ? await requiresResolvedUser.Authenticate(username, password, resolvedUser).ConfigureAwait(false) |
| | 16 | 1023 | | : await provider.Authenticate(username, password).ConfigureAwait(false); |
| | | 1024 | | |
| | 16 | 1025 | | if (authenticationResult.Username != username) |
| | | 1026 | | { |
| | 0 | 1027 | | _logger.LogDebug("Authentication provider provided updated username {1}", authenticationResult.Usern |
| | 0 | 1028 | | username = authenticationResult.Username; |
| | | 1029 | | } |
| | | 1030 | | |
| | 16 | 1031 | | return (username, true); |
| | | 1032 | | } |
| | 0 | 1033 | | catch (AuthenticationException ex) |
| | | 1034 | | { |
| | 0 | 1035 | | _logger.LogDebug(ex, "Error authenticating with provider {Provider}", provider.Name); |
| | | 1036 | | |
| | 0 | 1037 | | return (username, false); |
| | | 1038 | | } |
| | 16 | 1039 | | } |
| | | 1040 | | |
| | | 1041 | | private async Task UpdateUserInternalAsync(JellyfinDbContext dbContext, User user) |
| | | 1042 | | { |
| | 6 | 1043 | | dbContext.Users.Attach(user); |
| | 6 | 1044 | | dbContext.Entry(user).State = EntityState.Modified; |
| | 6 | 1045 | | await dbContext.SaveChangesAsync().ConfigureAwait(false); |
| | 6 | 1046 | | } |
| | | 1047 | | |
| | | 1048 | | /// <inheritdoc/> |
| | | 1049 | | public void Dispose() |
| | | 1050 | | { |
| | 49 | 1051 | | Dispose(true); |
| | 49 | 1052 | | GC.SuppressFinalize(this); |
| | 49 | 1053 | | } |
| | | 1054 | | |
| | | 1055 | | /// <summary> |
| | | 1056 | | /// Disposes all members of this class. |
| | | 1057 | | /// </summary> |
| | | 1058 | | /// <param name="disposing">Defines if the class has been cleaned up by a dispose or finalizer.</param> |
| | | 1059 | | protected virtual void Dispose(bool disposing) |
| | | 1060 | | { |
| | 49 | 1061 | | if (disposing) |
| | | 1062 | | { |
| | 49 | 1063 | | _userLock.Dispose(); |
| | | 1064 | | } |
| | 49 | 1065 | | } |
| | | 1066 | | |
| | | 1067 | | internal sealed class LockHelper : IDisposable |
| | | 1068 | | { |
| | 53 | 1069 | | private readonly AsyncKeyedLocker<Guid> _userLock = new(); |
| | | 1070 | | |
| | | 1071 | | private bool _disposed; |
| | | 1072 | | |
| | 2 | 1073 | | public static AsyncLocal<int> IsNestedLock { get; set; } = new(); |
| | | 1074 | | |
| | | 1075 | | public bool ShouldLock() |
| | | 1076 | | { |
| | 5 | 1077 | | return IsNestedLock.Value == 0; |
| | | 1078 | | } |
| | | 1079 | | |
| | | 1080 | | public ValueTask<IDisposable> LockAsync(Guid key) |
| | | 1081 | | { |
| | 38 | 1082 | | ThrowIfDisposed(); |
| | 37 | 1083 | | var isNested = LockHelper.IsNestedLock.Value != 0; |
| | 37 | 1084 | | LockHelper.IsNestedLock.Value = LockHelper.IsNestedLock.Value + 1; |
| | 37 | 1085 | | if (isNested) |
| | | 1086 | | { |
| | 1 | 1087 | | return new ValueTask<IDisposable>(new LockHandle { Parent = null }); |
| | | 1088 | | } |
| | | 1089 | | |
| | 36 | 1090 | | return AcquireLockAsync(key); |
| | | 1091 | | } |
| | | 1092 | | |
| | | 1093 | | private async ValueTask<IDisposable> AcquireLockAsync(Guid key) |
| | | 1094 | | { |
| | 36 | 1095 | | var lockHandle = await _userLock.LockAsync(key, true).ConfigureAwait(false); |
| | 36 | 1096 | | return new LockHandle { Parent = lockHandle }; |
| | 36 | 1097 | | } |
| | | 1098 | | |
| | | 1099 | | public void Dispose() |
| | | 1100 | | { |
| | 56 | 1101 | | if (_disposed) |
| | | 1102 | | { |
| | 3 | 1103 | | return; |
| | | 1104 | | } |
| | | 1105 | | |
| | 53 | 1106 | | _disposed = true; |
| | 53 | 1107 | | _userLock.Dispose(); |
| | 53 | 1108 | | } |
| | | 1109 | | |
| | | 1110 | | private void ThrowIfDisposed() |
| | | 1111 | | { |
| | 38 | 1112 | | ObjectDisposedException.ThrowIf(_disposed, this); |
| | 37 | 1113 | | } |
| | | 1114 | | |
| | | 1115 | | private sealed class LockHandle : IDisposable |
| | | 1116 | | { |
| | | 1117 | | public required IDisposable? Parent { get; init; } |
| | | 1118 | | |
| | | 1119 | | public void Dispose() |
| | | 1120 | | { |
| | 37 | 1121 | | Parent?.Dispose(); |
| | 37 | 1122 | | LockHelper.IsNestedLock.Value = LockHelper.IsNestedLock.Value - 1; |
| | | 1123 | | |
| | 37 | 1124 | | if (LockHelper.IsNestedLock.Value < 0) |
| | | 1125 | | { |
| | 0 | 1126 | | throw new InvalidOperationException("Mismatched locking detected. Threads internal NestedLock is |
| | | 1127 | | } |
| | 37 | 1128 | | } |
| | | 1129 | | } |
| | | 1130 | | } |
| | | 1131 | | } |
| | | 1132 | | } |