Backport pull request #18026 from jellyfin/release-12.z

Fix device access revocation not logging out existing sessions

Original-merge: 950c45cf2032a9a8b3bc3abe92adc32f8b5a8ab2

Merged-by: crobibero <cody@robibe.ro>

Backported-by: Cody Robibero <cody@robibe.ro>

2 files changed, 29 insertions, 5 deletions

diff --git a/Jellyfin.Server.Implementations/Users/DeviceAccessHost.cs b/Jellyfin.Server.Implementations/Users/DeviceAccessHost.cs
index 92e2bb4fa7..7c46ef7721 100644
--- a/Jellyfin.Server.Implementations/Users/DeviceAccessHost.cs
+++ b/Jellyfin.Server.Implementations/Users/DeviceAccessHost.cs
@@ -1,3 +1,4 @@
+using System;
 using System.Threading;
 using System.Threading.Tasks;
 using Jellyfin.Data;
@@ -9,6 +10,7 @@ using MediaBrowser.Controller.Devices;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Session;
 using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
 
 namespace Jellyfin.Server.Implementations.Users;
 
@@ -20,6 +22,7 @@ public sealed class DeviceAccessHost : IHostedService
     private readonly IUserManager _userManager;
     private readonly IDeviceManager _deviceManager;
     private readonly ISessionManager _sessionManager;
+    private readonly ILogger<DeviceAccessHost> _logger;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="DeviceAccessHost"/> class.
@@ -27,11 +30,17 @@ public sealed class DeviceAccessHost : IHostedService
     /// <param name="userManager">The <see cref="IUserManager"/>.</param>
     /// <param name="deviceManager">The <see cref="IDeviceManager"/>.</param>
     /// <param name="sessionManager">The <see cref="ISessionManager"/>.</param>
-    public DeviceAccessHost(IUserManager userManager, IDeviceManager deviceManager, ISessionManager sessionManager)
+    /// <param name="logger">The <see cref="ILogger{TCategoryName}"/>.</param>
+    public DeviceAccessHost(
+        IUserManager userManager,
+        IDeviceManager deviceManager,
+        ISessionManager sessionManager,
+        ILogger<DeviceAccessHost> logger)
     {
         _userManager = userManager;
         _deviceManager = deviceManager;
         _sessionManager = sessionManager;
+        _logger = logger;
     }
 
     /// <inheritdoc />
@@ -53,9 +62,18 @@ public sealed class DeviceAccessHost : IHostedService
     private async void OnUserUpdated(object? sender, GenericEventArgs<User> e)
     {
         var user = e.Argument;
-        if (!user.HasPermission(PermissionKind.EnableAllDevices))
+
+        // This handler is async void, so an escaping exception would terminate the process.
+        try
+        {
+            if (!user.HasPermission(PermissionKind.EnableAllDevices))
+            {
+                await UpdateDeviceAccess(user).ConfigureAwait(false);
+            }
+        }
+        catch (Exception ex)
         {
-            await UpdateDeviceAccess(user).ConfigureAwait(false);
+            _logger.LogError(ex, "Error updating device access for user {UserId}", user.Id);
         }
     }
 
diff --git a/Jellyfin.Server.Implementations/Users/UserManager.cs b/Jellyfin.Server.Implementations/Users/UserManager.cs
index fea6084267..b15f6b98b2 100644
--- a/Jellyfin.Server.Implementations/Users/UserManager.cs
+++ b/Jellyfin.Server.Implementations/Users/UserManager.cs
@@ -847,14 +847,16 @@ namespace Jellyfin.Server.Implementations.Users
         /// <inheritdoc/>
         public async Task UpdatePolicyAsync(Guid userId, UserPolicy policy)
         {
+            User user;
             using (await _userLock.LockAsync(userId).ConfigureAwait(false))
             {
                 var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
                 await using (dbContext.ConfigureAwait(false))
                 {
-                    var user = UserQuery(dbContext)
+                    user = await UserQuery(dbContext)
                         .AsTracking()
-                        .FirstOrDefault(u => u.Id.Equals(userId))
+                        .FirstOrDefaultAsync(u => u.Id.Equals(userId))
+                        .ConfigureAwait(false)
                         ?? throw new ArgumentException("No user exists with given Id!");
 
                     // The default number of login attempts is 3, but for some god forsaken reason it's sent to the server as "0"
@@ -919,6 +921,10 @@ namespace Jellyfin.Server.Implementations.Users
                     await dbContext.SaveChangesAsync().ConfigureAwait(false);
                 }
             }
+
+            var eventArgs = new UserUpdatedEventArgs(user);
+            await _eventManager.PublishAsync(eventArgs).ConfigureAwait(false);
+            OnUserUpdated?.Invoke(this, eventArgs);
         }
 
         /// <inheritdoc/>