1 files changed, 77 insertions, 14 deletions

diff --git a/Jellyfin.Server.Implementations/Users/UserManager.cs b/Jellyfin.Server.Implementations/Users/UserManager.cs
index 583f29f94f..fea6084267 100644
--- a/Jellyfin.Server.Implementations/Users/UserManager.cs
+++ b/Jellyfin.Server.Implementations/Users/UserManager.cs
@@ -225,17 +225,8 @@ namespace Jellyfin.Server.Implementations.Users
                         ?? throw new ResourceNotFoundException(nameof(user.Id));
 
                     dbContext.Entry(dbUser).CurrentValues.SetValues(user);
-                    dbUser.Permissions.Clear();
-                    foreach (var permission in user.Permissions)
-                    {
-                        dbUser.Permissions.Add(new Permission(permission.Kind, permission.Value));
-                    }
-
-                    dbUser.Preferences.Clear();
-                    foreach (var preference in user.Preferences)
-                    {
-                        dbUser.Preferences.Add(new Preference(preference.Kind, preference.Value));
-                    }
+                    SyncPermissions(dbUser, user.Permissions);
+                    SyncPreferences(dbUser, user.Preferences);
 
                     dbUser.AccessSchedules.Clear();
                     foreach (var accessSchedule in user.AccessSchedules)
@@ -269,6 +260,60 @@ namespace Jellyfin.Server.Implementations.Users
             }
         }
 
+        private static void SyncPermissions(User dbUser, ICollection<Permission> source)
+        {
+            var incoming = new Dictionary<PermissionKind, bool>();
+            foreach (var permission in source)
+            {
+                incoming[permission.Kind] = permission.Value;
+            }
+
+            foreach (var existing in dbUser.Permissions)
+            {
+                if (incoming.Remove(existing.Kind, out var value))
+                {
+                    // EF only marks the row modified if the value actually differs, so an update that
+                    // touches nothing but the user row - a session activity stamp - writes no children.
+                    existing.Value = value;
+                }
+                else
+                {
+                    dbUser.Permissions.Remove(existing);
+                }
+            }
+
+            foreach (var (kind, value) in incoming)
+            {
+                dbUser.Permissions.Add(new Permission(kind, value));
+            }
+        }
+
+        private static void SyncPreferences(User dbUser, ICollection<Preference> source)
+        {
+            var incoming = new Dictionary<PreferenceKind, string>();
+            foreach (var preference in source)
+            {
+                incoming[preference.Kind] = preference.Value;
+            }
+
+            foreach (var existing in dbUser.Preferences)
+            {
+                if (incoming.Remove(existing.Kind, out var value))
+                {
+                    existing.Value = value;
+                }
+                else
+                {
+                    dbUser.Preferences.Remove(existing);
+                }
+            }
+
+            foreach (var (kind, value) in incoming)
+            {
+                dbUser.Preferences.Add(new Preference(kind, value));
+            }
+        }
+
         internal async Task<User> CreateUserInternalAsync(string name, JellyfinDbContext dbContext)
         {
             // TODO: Remove after user item data is migrated.
@@ -616,6 +661,12 @@ namespace Jellyfin.Server.Implementations.Users
                                 .SetProperty(f => f.LastActivityDate, date)
                                 .SetProperty(f => f.LastLoginDate, date))
                             .ConfigureAwait(false);
+
+                        // ExecuteUpdateAsync bypasses the change tracker, so keep the
+                        // returned entity in sync. Otherwise SessionManager.LogSessionActivity
+                        // saves this (stale) entity in full and reverts LastLoginDate.
+                        user.LastActivityDate = date;
+                        user.LastLoginDate = date;
                     }
 
                     await dbContext.Users
@@ -883,8 +934,20 @@ namespace Jellyfin.Server.Implementations.Users
                 var dbContext = await _dbProvider.CreateDbContextAsync().ConfigureAwait(false);
                 await using (dbContext.ConfigureAwait(false))
                 {
-                    dbContext.Remove(user.ProfileImage);
-                    await dbContext.SaveChangesAsync().ConfigureAwait(false);
+                    // Remove the tracked profile image loaded from the database instead of the
+                    // detached instance on the passed in user. That instance can carry a stale,
+                    // never-persisted (temporary) key, which makes EF Core throw when it is marked
+                    // for deletion, leaving the profile image impossible to clear or replace.
+                    var dbUser = await UserQuery(dbContext)
+                        .AsTracking()
+                        .FirstOrDefaultAsync(u => u.Id == user.Id)
+                        .ConfigureAwait(false);
+                    if (dbUser?.ProfileImage is not null)
+                    {
+                        dbContext.Remove(dbUser.ProfileImage);
+                        dbUser.ProfileImage = null;
+                        await dbContext.SaveChangesAsync().ConfigureAwait(false);
+                    }
                 }
 
                 user.ProfileImage = null;
@@ -893,7 +956,7 @@ namespace Jellyfin.Server.Implementations.Users
 
         internal static void ThrowIfInvalidUsername(string name)
         {
-            if (!string.IsNullOrWhiteSpace(name) && ValidUsernameRegex().IsMatch(name))
+            if (!string.IsNullOrWhiteSpace(name) && ValidUsernameRegex().IsMatch(name) && !string.Equals(name, ".", StringComparison.Ordinal) && !string.Equals(name, "..", StringComparison.Ordinal))
             {
                 return;
             }