Add admin review and confirmation of cross-service user IDs

2026-09-08 15:41:45 +12:00
parent 2976145dd8
commit 12611a9819
14 changed files with 972 additions and 0 deletions
@@ -28,6 +28,9 @@ def link_user(username: str, jellyfin_user_id: str, base_url: str | None) -> Non
    if not user or not jellyfin_user_id or not base_url:
        return
    with closing(db._connect()) as conn, conn:
+        if conn.execute("SELECT 1 FROM user_identity_confirmations WHERE local_user_id = ?", (user["id"],)).fetchone():
+            # Reviewed identities are updated only through the admin confirmation workflow.
+            return
        # A renamed or re-created account must not silently take over an existing identity.
        conn.execute(
            "INSERT OR IGNORE INTO jellyfin_user_links (source, local_user_id, jellyfin_user_id) VALUES (?, ?, ?)",