1 files changed, 23 insertions, 26 deletions
diff --git a/Emby.Server.Implementations/Library/Search/SearchManager.cs b/Emby.Server.Implementations/Library/Search/SearchManager.cs
index a5be3f07bd..0e180753a6 100644
--- a/Emby.Server.Implementations/Library/Search/SearchManager.cs
+++ b/Emby.Server.Implementations/Library/Search/SearchManager.cs
@@ -92,49 +92,46 @@ public class SearchManager : ISearchManager
         await Task.WhenAll(externalTask, internalTask).ConfigureAwait(false);
 
         var externalResults = await externalTask.ConfigureAwait(false);
-        var fromExternal = externalResults.Count > 0;
-        IReadOnlyList<SearchResult> results;
-        if (fromExternal)
-        {
-            results = externalResults;
-        }
-        else
-        {
-            results = await internalTask.ConfigureAwait(false);
-            if (_internalProviders.Length > 0)
-            {
-                _logger.LogDebug("No results from external providers, using internal provider results");
-            }
-        }
 
         // Internal providers apply user-access filtering inline in their queries. External
         // providers don't know about user permissions, so they may return IDs from hidden
-        // libraries or items the user is otherwise blocked from. Run the post-filter only
-        // when results came from externals to close that gap. The Items controller's second
-        // roundtrip via folder.GetItems applies most of these again, but it does not restrict
-        // by TopParentIds when ItemIds is set.
-        if (fromExternal && results.Count > 0 && query.UserId.HasValue && !query.UserId.Value.IsEmpty())
+        // libraries or items the user is otherwise blocked from. Filter them here to close
+        // that gap. The Items controller's second roundtrip via folder.GetItems applies most
+        // of these again, but it does not restrict by TopParentIds when ItemIds is set.
+        if (externalResults.Count > 0 && query.UserId.HasValue && !query.UserId.Value.IsEmpty())
         {
             var user = _userManager.GetUserById(query.UserId.Value);
             if (user is not null)
             {
-                results = await FilterByUserAccessAsync(results, user, cancellationToken).ConfigureAwait(false);
+                externalResults = await FilterByUserAccessAsync(externalResults, user, query, cancellationToken).ConfigureAwait(false);
             }
         }
 
-        return results;
+        if (externalResults.Count > 0)
+        {
+            return externalResults;
+        }
+
+        var internalResults = await internalTask.ConfigureAwait(false);
+        if (_internalProviders.Length > 0)
+        {
+            _logger.LogDebug("No results from external providers, using internal provider results");
+        }
+
+        return internalResults;
     }
 
     private async Task<IReadOnlyList<SearchResult>> FilterByUserAccessAsync(
         IReadOnlyList<SearchResult> candidates,
         User user,
+        SearchProviderQuery query,
         CancellationToken cancellationToken)
     {
-        // SetUser populates parental rating + blocked/allowed tags. ConfigureUserAccess populates
-        // TopParentIds for the user's accessible libraries — we call it before assigning ItemIds
-        // because LibraryManager.AddUserToQuery skips TopParentIds when ItemIds is non-empty.
-        var accessFilter = new InternalItemsQuery(user);
-        _libraryManager.ConfigureUserAccess(accessFilter, user);
+        // SetUser populates parental rating + blocked/allowed tags, Build populates TopParentIds
+        // for the user's accessible libraries. The candidate ids are applied to the query below
+        // rather than to the filter because LibraryManager.AddUserToQuery skips TopParentIds when
+        // ItemIds is non-empty.
+        var accessFilter = SearchQueryAccessFilter.Build(user, query, _libraryManager);
 
         Guid[] candidateIds = [.. candidates.Select(c => c.ItemId)];