2 files changed, 134 insertions, 0 deletions
diff --git a/tests/Jellyfin.Server.Implementations.Tests/Users/DeviceAccessHostTests.cs b/tests/Jellyfin.Server.Implementations.Tests/Users/DeviceAccessHostTests.cs
new file mode 100644
index 0000000000..5bb5081b60
--- /dev/null
+++ b/tests/Jellyfin.Server.Implementations.Tests/Users/DeviceAccessHostTests.cs
@@ -0,0 +1,111 @@
+using System;
+using System.Collections.Generic;
+using System.Threading;
+using System.Threading.Tasks;
+using Jellyfin.Data.Events;
+using Jellyfin.Data.Queries;
+using Jellyfin.Database.Implementations.Entities;
+using Jellyfin.Database.Implementations.Entities.Security;
+using Jellyfin.Server.Implementations.Users;
+using MediaBrowser.Controller.Devices;
+using MediaBrowser.Controller.Library;
+using MediaBrowser.Controller.Session;
+using MediaBrowser.Model.Querying;
+using Microsoft.Extensions.Logging.Abstractions;
+using Moq;
+using Xunit;
+
+namespace Jellyfin.Server.Implementations.Tests.Users;
+
+public class DeviceAccessHostTests
+{
+    [Fact]
+    public async Task OnUserUpdated_LogoutThrows_DoesNotEscapeToThreadPool()
+    {
+        var user = new User("test", "default", "default");
+        var device = new Device(user.Id, "app", "1.0", "device", "device-id");
+
+        var deviceManager = new Mock<IDeviceManager>();
+        deviceManager.Setup(d => d.GetDevices(It.IsAny<DeviceQuery>()))
+            .Returns(new QueryResult<Device>(new[] { device }));
+        deviceManager.Setup(d => d.CanAccessDevice(user, device.DeviceId)).Returns(false);
+
+        var sessionManager = new Mock<ISessionManager>();
+        sessionManager.Setup(s => s.Logout(It.IsAny<Device>()))
+            .ThrowsAsync(new ObjectDisposedException(nameof(ISessionManager)));
+
+        var userManager = new Mock<IUserManager>();
+        var host = new DeviceAccessHost(
+            userManager.Object,
+            deviceManager.Object,
+            sessionManager.Object,
+            NullLogger<DeviceAccessHost>.Instance);
+        await host.StartAsync(TestContext.Current.CancellationToken);
+
+        var context = new CapturingSynchronizationContext();
+        var previous = SynchronizationContext.Current;
+        SynchronizationContext.SetSynchronizationContext(context);
+        try
+        {
+            userManager.Raise(m => m.OnUserUpdated += null, userManager.Object, new GenericEventArgs<User>(user));
+        }
+        finally
+        {
+            SynchronizationContext.SetSynchronizationContext(previous);
+        }
+
+        Assert.Empty(context.Exceptions);
+    }
+
+    [Fact]
+    public async Task OnUserUpdated_DeviceNoLongerAllowed_LogsOutDevice()
+    {
+        var user = new User("test", "default", "default");
+        var device = new Device(user.Id, "app", "1.0", "device", "device-id");
+
+        var deviceManager = new Mock<IDeviceManager>();
+        deviceManager.Setup(d => d.GetDevices(It.IsAny<DeviceQuery>()))
+            .Returns(new QueryResult<Device>(new[] { device }));
+        deviceManager.Setup(d => d.CanAccessDevice(user, device.DeviceId)).Returns(false);
+
+        var loggedOut = new TaskCompletionSource();
+        var sessionManager = new Mock<ISessionManager>();
+        sessionManager.Setup(s => s.Logout(It.IsAny<Device>()))
+            .Callback(() => loggedOut.TrySetResult())
+            .Returns(Task.CompletedTask);
+
+        var userManager = new Mock<IUserManager>();
+        var host = new DeviceAccessHost(
+            userManager.Object,
+            deviceManager.Object,
+            sessionManager.Object,
+            NullLogger<DeviceAccessHost>.Instance);
+        await host.StartAsync(TestContext.Current.CancellationToken);
+
+        userManager.Raise(m => m.OnUserUpdated += null, userManager.Object, new GenericEventArgs<User>(user));
+
+        await loggedOut.Task.WaitAsync(TimeSpan.FromSeconds(10), TestContext.Current.CancellationToken);
+        sessionManager.Verify(s => s.Logout(device), Times.Once);
+    }
+
+    private sealed class CapturingSynchronizationContext : SynchronizationContext
+    {
+        public List<Exception> Exceptions { get; } = new List<Exception>();
+
+        public override void Post(SendOrPostCallback d, object? state) => Run(d, state);
+
+        public override void Send(SendOrPostCallback d, object? state) => Run(d, state);
+
+        private void Run(SendOrPostCallback d, object? state)
+        {
+            try
+            {
+                d(state);
+            }
+            catch (Exception ex)
+            {
+                Exceptions.Add(ex);
+            }
+        }
+    }
+}
diff --git a/tests/Jellyfin.Server.Implementations.Tests/Users/UserManagerUpdateUserTests.cs b/tests/Jellyfin.Server.Implementations.Tests/Users/UserManagerUpdateUserTests.cs
index c940f92109..e91ebdf1b6 100644
--- a/tests/Jellyfin.Server.Implementations.Tests/Users/UserManagerUpdateUserTests.cs
+++ b/tests/Jellyfin.Server.Implementations.Tests/Users/UserManagerUpdateUserTests.cs
@@ -6,6 +6,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using Jellyfin.Data;
 using Jellyfin.Database.Implementations;
+using Jellyfin.Database.Implementations.Entities;
 using Jellyfin.Database.Implementations.Enums;
 using Jellyfin.Database.Implementations.Locking;
 using Jellyfin.Database.Providers.Sqlite;
@@ -17,6 +18,7 @@ using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Controller.Drawing;
 using MediaBrowser.Controller.Events;
 using MediaBrowser.Model.Cryptography;
+using MediaBrowser.Model.Users;
 using Microsoft.Data.Sqlite;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging.Abstractions;
@@ -120,6 +122,27 @@ public sealed class UserManagerUpdateUserTests : IDisposable
     }
 
     [Fact]
+    public async Task UpdatePolicyAsync_RaisesOnUserUpdated()
+    {
+        var user = await _userManager.CreateUserAsync("policyeventuser");
+
+        User? updated = null;
+        _userManager.OnUserUpdated += (_, e) => updated = e.Argument;
+
+        await _userManager.UpdatePolicyAsync(
+            user.Id,
+            new UserPolicy
+            {
+                EnableAllDevices = false,
+                AuthenticationProviderId = user.AuthenticationProviderId,
+                PasswordResetProviderId = user.PasswordResetProviderId
+            });
+
+        Assert.NotNull(updated);
+        Assert.Equal(user.Id, updated.Id);
+    }
+
+    [Fact]
     public async Task UpdateUserAsync_AppliesPermissionAndPreferenceChanges()
     {
         var user = await _userManager.CreateUserAsync("policyuser");