From 96299be57c47b27c8521fb404edeb8cfcb9bfddb Mon Sep 17 00:00:00 2001
From: Franciskid <Franciskid97@gmail.com>
Date: Sun, 26 Jul 2026 16:24:14 +0200
Subject: [PATCH] apply the key file mode on load too, so existing keys get
 fixed

---
 Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs b/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
index d254cfd..6038a4e 100644
--- a/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
+++ b/Jellyfin.Plugin.ShareLinks/Services/ShareTokenService.cs
@@ -111,6 +111,9 @@ public sealed class ShareTokenService
                     _secretKey = Base64UrlDecode(secretText.Trim());
                     if (_secretKey.Length >= 16)
                     {
+                        // Also applied on load so a key written by an older build
+                        // stops being world readable.
+                        RestrictToOwner(_secretPath);
                         return _secretKey;
                     }
                 }