Setup should detect if Jellyfin account isn't an admin

[nicdumz]

Description

It turns out that for jellyseerr to work, the user used for setup must be an admin in Jellyfin ("Allow this user to manage the server" permission should be true).

That is however not documented and quite hard to discover, leading to setup issues.

Desired Behavior

The login flow could check for .Policy.IsAdministrator boolean property in the returned object after login (https://api.jellyfin.org/#tag/User/operation/AuthenticateUser), and could abort setup if the provided user is not an admin, returning a user-friendly error message in that case.

Additionally, consider if this requirement is worth documenting in https://github.com/Fallenbagel/jellyseerr#pre-requisite-important, thanks!

Additional Context

No response

Code of Conduct

• I agree to follow Jellyseerr's Code of Conduct

[nicdumz]

(Note that you can check Policy objects via Users/Public, e.g. curl http://jellyfin.your.local.domain/Users/Public | jq -r '{user: .[].Name, isAdmin: .[].Policy.IsAdministrator}', but this only returns the 'public' users, so this is a partial reply)

[Fallenbagel]

(Note that you can check Policy objects via Users/Public, e.g. curl http://jellyfin.your.local.domain/Users/Public | jq -r '{user: .[].Name, isAdmin: .[].Policy.IsAdministrator}', but this only returns the 'public' users, so this is a partial reply)

We could check /Users/{userId} during authentication. It returns a "Policy": { "IsAdministrator": true, ...}

[nicdumz]

True but that GetUser endpoint requires authentication, so it sounds like checking the User object returned during the initial login is just equivalent.

…

On Wed, Jan 3, 2024, 08:21 Fallenbagel ***@***.***> wrote: (Note that you can check Policy objects via Users/Public, e.g. curl http://jellyfin.your.local.domain/Users/Public | jq -r '{user: .[].Name, isAdmin: .[].Policy.IsAdministrator}', but this only returns the 'public' users, so this is a partial reply) We could check /Users/{userId}. It returns a "Policy": { "IsAdministrator": true, ...} — Reply to this email directly, view it on GitHub <#610 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAA5BV6UUIZ2BI5F7GTFXATYMUBHZAVCNFSM6AAAAABBKKPEDWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNZUHE2DGMRVGU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[Fallenbagel]

True but that GetUser endpoint requires authentication, so it sounds like checking the User object returned during the initial login is just equivalent.

If the user object returned during the initial login includes the IsAdministrator policy then that's even better yeah (I don't remember now will have to check).

[nicdumz]

Yep, it is the case. It is documented in the https://api.jellyfin.org/#tag/User/operation/AuthenticateUser response sample and I've tested that locally too.

[Fallenbagel]

🎉 This issue has been resolved in version 1.8.0 🎉

The release is available on:

• v1.8.0
• GitHub release

Your semantic-release bot 📦🚀