The CSS data-id selector wasn't reliably hiding the action-sheet item in
guest sessions, so add a JS pass (part of the lockdown refresh) that
matches menu items by data-id, localized visible text, and icon, and
hides them with an inline style. The action sheet is added on menu open,
which the existing mutation observer already picks up.
The movie detail page's Tags section lives in its own .itemTags container,
not inside .detailsGroupItem like genres/studios/cast, so tag chips stayed
clickable for guests. Disable those links too.
The add-to-playlist and add-to-collection entries in the item's "..."
menu render with data-id="playlist"/data-id="addtocollection", not
data-action="addtoplaylist"/"addtocollection" as previously assumed —
that selector matched an unrelated list-row button and never hid the
actual menu items. Target the correct attribute so both are hidden.
Also drop the specific plugin name from the guest-hidden-selectors
description in favor of generic wording; the default selector value
is unchanged.
Rename the injected context-menu action from 'Create guest link' to
'ShareLink' and swap its cloned copy icon (content_copy) for the share
icon, matching the other menu items' style.
Replace the placeholder scaffold README with a user-facing one describing
what the plugin does, the server-side guest confinement, configuration,
and the known Jellyfin cast/crew tag bug (jellyfin/jellyfin#14926).
Hiding .headerBackButton for guests also removed the video player's back
button (same class), so a guest could not return from playback to the
movie page. Stop hiding that class; keep home/drawer/search hidden.
Cast, studio, genre and tag links on the detail page now have
pointer-events disabled for guests so they stay visible but inert
(clicking Studio no longer spins on a page the guest cannot load), and
the add-to-playlist/add-to-collection actions are hidden.
Add a GuestHiddenSelectors config field (comma-separated CSS selectors,
surfaced through GuestState since guests cannot read plugin config) so
other plugins injected UI can be suppressed for guest sessions without
code changes; defaults to hiding the AI Search elements.
Creating a link from a home-page carousel resolved the wrong id: the
card context menu detaches into a body-level action sheet, so the DOM
walk missed the movie and fell back to the first data-id on the page (a
library folder), which then got rejected. Capture the pointed-at card's
item id at pointerdown so the action injects the right id.
Guest lockdown let guests reach the home page: nav was hidden by
matching English label keywords, which never matched the French UI, and
any details/list route counted as allowed. Hide the header
back/home/drawer/search buttons by CSS class instead, and treat only the
guest's own item page (or a playback route) as allowed so off-item
routes redirect back to the shared title.
The sign-in bootstrap sent the auth request body as a JS object, so it
was coerced to [object Object] and AuthenticateByName returned 400. Send
JSON.stringify(...) instead.
Guest credentials were written to localStorage as a flat object under
made-up keys. jellyfin-web reads jellyfin_credentials as
{Servers:[{Id,AccessToken,UserId,...}]}, so the guest was treated as
logged out. Write that shape, pulling server Id/name from
System/Info/Public, and redirect with the 10.11 hash route
(#/details?id=...&serverId=...) instead of the legacy #!/ form that
rendered a blank page.
Creating a link now rejects folders and libraries (only movies and
episodes are shareable) so a guest cannot land on an empty tag-filtered
library. Item ids from the menu action are validated as GUIDs client
side, rejected creates are logged server side, malformed redeem tokens
return 404 instead of 500, and the admin table shows the item name and a
copyable link instead of the raw item id.
Includes fix for redemption failing with DbUpdateConcurrencyException:
change the guest password before applying the user policy, since
UpdatePolicyAsync bumps the user's EF concurrency token and a stale
instance then breaks ChangePassword.
Franciskid