Reconcile verified account IDs and make language repairs observable

backend/app/routers/auth.py

@@ -733,6 +733,13 @@ async def jellyfin_login(
     if not isinstance(auth_response, dict) or not auth_response.get("User"):
         _record_login_failure(request, username)
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid Jellyfin credentials")
+    from ..services.jellyfin_identity import user_for_identity
+    identity_owner = user_for_identity(auth_response['User'].get('Id'), runtime.jellyfin_base_url)
+    if identity_owner:
+        preferred_match = identity_owner
+        user = identity_owner
+        canonical_username = identity_owner['username']
+        _assert_user_can_login(user)
     if not preferred_match:
         create_user_if_missing(
             canonical_username,
@@ -815,8 +822,13 @@ async def jellyseerr_login(
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid Seerr credentials")
     jellyseerr_user_id = _extract_jellyseerr_user_id(auth_response)
     jellyseerr_email = _extract_jellyseerr_response_email(auth_response)
+    id_matches = [row for row in get_all_users() if jellyseerr_user_id is not None and row.get('jellyseerr_user_id') == jellyseerr_user_id]
+    if len(id_matches) > 1:
+        raise HTTPException(409, 'Multiple Magent accounts claim this Seerr identity. Ask an administrator to repair the links.')
     ci_matches = get_users_by_username_ci(form_data.username)
-    preferred_match = _pick_preferred_ci_user_match(ci_matches, form_data.username)
+    preferred_match = id_matches[0] if id_matches else _pick_preferred_ci_user_match(ci_matches, form_data.username)
+    if preferred_match and preferred_match.get('jellyseerr_user_id') not in (None, jellyseerr_user_id):
+        raise HTTPException(409, 'The account name and authenticated identity disagree. Ask an administrator to repair the links.')
     canonical_username = str(preferred_match.get("username") or form_data.username) if preferred_match else form_data.username
     if not preferred_match:
         create_user_if_missing(