From 5231ed2d61aef16366536062e39257d8a73eecb1 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 17:41:58 +0200
Subject: [PATCH 01/19] feat(plex): respect per-user library restrictions when
 reporting availability

Plex lets the owner restrict a shared user to specific libraries, or to items
carrying specific labels. Seerr computed availability for the whole library
regardless, so a restricted user was told a title was available and then could
not play it.

Sharing rules are now read from plex.tv `shared_servers`, which returns both the
label filters and the shared sections in a single call, and are turned into the
set of rating keys the user may see. Plex never returns labels in bulk library
listings, but it does support filtering by label, so the set is resolved with one
request per allowed label rather than one per item. The result is cached per user
for five minutes.

Availability is downgraded to UNKNOWN, rather than the item being hidden, so the
user can still request it and be granted access. Season statuses are downgraded
too, since the UI shows them independently of the show's.

Filtering is applied in Media.getRelatedMedia and Media.getMedia, which cover
Discover, search, collections, people and the detail pages, and in the media
route that feeds the "Recently Added" slider. Background jobs opt out, so they
keep seeing the library's real state.

Resolution fails open: a transient Plex error must not hide the whole library.
Unrestricted users return early and pay no extra cost.
---
 server/api/plexapi.ts       |  40 +++++++
 server/api/plextv.test.ts   | 109 +++++++++++++++++
 server/api/plextv.ts        | 231 ++++++++++++++++++++++++++++++++++++
 server/entity/Media.ts      |  90 +++++++++++++-
 server/lib/plexsharing.ts   | 188 +++++++++++++++++++++++++++++
 server/lib/watchlistsync.ts |   5 +-
 server/routes/media.ts      |   9 +-
 server/routes/movie.ts      |   2 +-
 server/routes/tv.ts         |   2 +-
 9 files changed, 668 insertions(+), 8 deletions(-)
 create mode 100644 server/api/plextv.test.ts
 create mode 100644 server/lib/plexsharing.ts

diff --git a/server/api/plexapi.ts b/server/api/plexapi.ts
index 81e016717f..aac7f8ee28 100644
--- a/server/api/plexapi.ts
+++ b/server/api/plexapi.ts
@@ -199,6 +199,46 @@ class PlexAPI extends ExternalAPI {
     };
   }
 
+  /**
+   * Returns the rating keys of every item in a library section carrying the
+   * given label.
+   *
+   * Plex never returns labels in bulk library listings, whatever the requested
+   * fields, but it does support filtering by label. Resolving one request per
+   * label is therefore far cheaper than fetching metadata item by item.
+   */
+  public async getRatingKeysByLabel(
+    sectionId: string,
+    label: string
+  ): Promise<string[]> {
+    const ratingKeys: string[] = [];
+    const size = 500;
+    let offset = 0;
+    let totalSize = 0;
+
+    do {
+      const response = await this.get<PlexLibraryResponse>(
+        `/library/sections/${sectionId}/all?label=${encodeURIComponent(label)}`,
+        {
+          headers: {
+            'X-Plex-Container-Start': `${offset}`,
+            'X-Plex-Container-Size': `${size}`,
+          },
+        }
+      );
+
+      totalSize = response.MediaContainer.totalSize ?? 0;
+      ratingKeys.push(
+        ...(response.MediaContainer.Metadata ?? []).map(
+          (item) => item.ratingKey
+        )
+      );
+      offset += size;
+    } while (offset < totalSize);
+
+    return ratingKeys;
+  }
+
   public async getMetadata(
     key: string,
     options: { includeChildren?: boolean } = {}
diff --git a/server/api/plextv.test.ts b/server/api/plextv.test.ts
new file mode 100644
index 0000000000..44740bf41d
--- /dev/null
+++ b/server/api/plextv.test.ts
@@ -0,0 +1,109 @@
+import {
+  isAllowedByLabelFilter,
+  parsePlexLabelFilter,
+} from '@server/api/plextv';
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+describe('parsePlexLabelFilter', () => {
+  it('returns empty lists when no restriction is set', () => {
+    for (const value of [undefined, null, '']) {
+      assert.deepEqual(parsePlexLabelFilter(value), { allow: [], deny: [] });
+    }
+  });
+
+  it('parses a single allowed label', () => {
+    assert.deepEqual(parsePlexLabelFilter('label=Family'), {
+      allow: ['Family'],
+      deny: [],
+    });
+  });
+
+  it('parses several comma separated labels', () => {
+    assert.deepEqual(parsePlexLabelFilter('label=Family,Kids'), {
+      allow: ['Family', 'Kids'],
+      deny: [],
+    });
+  });
+
+  it('decodes url encoded values, as returned by plex.tv', () => {
+    assert.deepEqual(parsePlexLabelFilter('label=Family%2CKids'), {
+      allow: ['Family', 'Kids'],
+      deny: [],
+    });
+  });
+
+  it('parses negated restrictions into the deny list', () => {
+    assert.deepEqual(parsePlexLabelFilter('label!=Private'), {
+      allow: [],
+      deny: ['Private'],
+    });
+  });
+
+  it('handles allow and deny clauses in the same filter', () => {
+    assert.deepEqual(parsePlexLabelFilter('label=Family&label!=Private'), {
+      allow: ['Family'],
+      deny: ['Private'],
+    });
+  });
+
+  it('ignores clauses that are not label based', () => {
+    assert.deepEqual(parsePlexLabelFilter('contentRating=PG&label=Family'), {
+      allow: ['Family'],
+      deny: [],
+    });
+  });
+
+  it('drops empty values and surrounding whitespace', () => {
+    assert.deepEqual(parsePlexLabelFilter('label= Family , ,Kids '), {
+      allow: ['Family', 'Kids'],
+      deny: [],
+    });
+  });
+});
+
+describe('isAllowedByLabelFilter', () => {
+  it('allows anything when no restriction applies', () => {
+    assert.equal(isAllowedByLabelFilter({ allow: [], deny: [] }, []), true);
+    assert.equal(
+      isAllowedByLabelFilter({ allow: [], deny: [] }, ['Family']),
+      true
+    );
+  });
+
+  it('requires one of the allowed labels', () => {
+    const filter = { allow: ['Family', 'Kids'], deny: [] };
+
+    assert.equal(isAllowedByLabelFilter(filter, ['Family']), true);
+    assert.equal(isAllowedByLabelFilter(filter, ['Other', 'Kids']), true);
+    assert.equal(isAllowedByLabelFilter(filter, ['Other']), false);
+  });
+
+  it('hides unlabelled media when an allow list is set', () => {
+    assert.equal(
+      isAllowedByLabelFilter({ allow: ['Family'], deny: [] }, []),
+      false
+    );
+  });
+
+  it('denies media carrying a denied label, even when also allowed', () => {
+    assert.equal(
+      isAllowedByLabelFilter({ allow: ['Family'], deny: ['Private'] }, [
+        'Family',
+        'Private',
+      ]),
+      false
+    );
+  });
+
+  it('compares labels case insensitively', () => {
+    assert.equal(
+      isAllowedByLabelFilter({ allow: ['family'], deny: [] }, ['Family']),
+      true
+    );
+    assert.equal(
+      isAllowedByLabelFilter({ allow: [], deny: ['private'] }, ['PRIVATE']),
+      false
+    );
+  });
+});
diff --git a/server/api/plextv.ts b/server/api/plextv.ts
index b8f3c9a47b..02d0a62462 100644
--- a/server/api/plextv.ts
+++ b/server/api/plextv.ts
@@ -80,6 +80,7 @@ interface ServerResponse {
     lastSeenAt: string;
     numLibraries: string;
     owned: string;
+    allLibraries?: string;
   };
 }
 
@@ -92,12 +93,161 @@ interface UsersResponse {
         username: string;
         email: string;
         thumb: string;
+        restricted?: string;
+        home?: string;
+        // Sharing restrictions, as configured in Plex under
+        // Library -> Restrictions. Values are URL encoded, e.g.
+        // `label=Family%2CKids` or `label!=Private`.
+        filterAll?: string;
+        filterMovies?: string;
+        filterTelevision?: string;
+        filterMusic?: string;
+        filterPhotos?: string;
       };
       Server: ServerResponse[];
     }[];
   };
 }
 
+/**
+ * Label based sharing restrictions for a single library type.
+ *
+ * A media item is visible to the user when it carries at least one of the
+ * `allow` labels (or `allow` is empty, meaning no restriction) and none of
+ * the `deny` labels.
+ */
+export interface PlexLabelFilter {
+  allow: string[];
+  deny: string[];
+}
+
+interface SharedServersResponse {
+  MediaContainer: {
+    SharedServer?: {
+      $: {
+        id: string;
+        username: string;
+        email: string;
+        userID: string;
+        machineIdentifier?: string;
+        allLibraries?: string;
+        owned?: string;
+        filterAll?: string;
+        filterMovies?: string;
+        filterTelevision?: string;
+        filterMusic?: string;
+        filterPhotos?: string;
+      };
+      Section?: {
+        $: {
+          id: string;
+          /** Library section key on the server itself, e.g. `1`. */
+          key: string;
+          title: string;
+          type: string;
+          shared: string;
+        };
+      }[];
+    }[];
+  };
+}
+
+export interface PlexUserSharingRules {
+  /** The user has access to every library on the server. */
+  allLibraries: boolean;
+  /**
+   * Section keys of the libraries actually shared with the user, matching the
+   * keys returned by the server's own `/library/sections`. Empty when
+   * `allLibraries` is set, since every library is then accessible.
+   */
+  sharedSectionKeys: string[];
+  movies: PlexLabelFilter;
+  tv: PlexLabelFilter;
+}
+
+const EMPTY_LABEL_FILTER: PlexLabelFilter = { allow: [], deny: [] };
+
+/**
+ * Parses a Plex restriction string into its label allow/deny lists.
+ *
+ * Plex encodes restrictions as `key=value` clauses, where several values are
+ * comma separated and several clauses are separated by `&` or `|`. Only the
+ * `label` key is relevant here; other keys (`contentRating`, ...) are ignored.
+ */
+export const parsePlexLabelFilter = (
+  filter?: string | null
+): PlexLabelFilter => {
+  if (!filter) {
+    return { ...EMPTY_LABEL_FILTER };
+  }
+
+  const allow: string[] = [];
+  const deny: string[] = [];
+
+  for (const clause of decodeURIComponent(filter).split(/[&|]/)) {
+    const match = clause.trim().match(/^label(!?)=(.*)$/i);
+
+    if (!match) {
+      continue;
+    }
+
+    const labels = match[2]
+      .split(',')
+      .map((label) => label.trim())
+      .filter((label) => label.length > 0);
+
+    (match[1] === '!' ? deny : allow).push(...labels);
+  }
+
+  return { allow, deny };
+};
+
+/**
+ * Combines the server wide restriction (`filterAll`) with a per library type
+ * one. Allow lists are intersected when both are set, since the user has to
+ * satisfy both, while deny lists simply add up.
+ */
+const mergeLabelFilters = (
+  all: PlexLabelFilter,
+  specific: PlexLabelFilter
+): PlexLabelFilter => {
+  let allow: string[];
+
+  if (!all.allow.length) {
+    allow = [...specific.allow];
+  } else if (!specific.allow.length) {
+    allow = [...all.allow];
+  } else {
+    allow = all.allow.filter((label) => specific.allow.includes(label));
+  }
+
+  return {
+    allow: [...new Set(allow)],
+    deny: [...new Set([...all.deny, ...specific.deny])],
+  };
+};
+
+/**
+ * Evaluates label based restrictions against the labels carried by a media
+ * item. Items without labels are only visible when no allow list applies.
+ */
+export const isAllowedByLabelFilter = (
+  filter: PlexLabelFilter,
+  labels: string[]
+): boolean => {
+  const normalized = labels.map((label) => label.toLowerCase());
+
+  if (filter.deny.some((label) => normalized.includes(label.toLowerCase()))) {
+    return false;
+  }
+
+  if (!filter.allow.length) {
+    return true;
+  }
+
+  return filter.allow.some((label) => normalized.includes(label.toLowerCase()));
+};
+
 interface WatchlistResponse {
   MediaContainer: {
     totalSize: number;
@@ -268,6 +418,87 @@ class PlexTvAPI extends ExternalAPI {
     return parsedXml;
   }
 
+  /**
+   * Returns the label based sharing restrictions the server owner configured
+   * for a shared user, so availability can be evaluated from that user's point
+   * of view instead of the owner's.
+   *
+   * Returns `null` when no restriction applies, which is the case for the
+   * owner, for users sharing every library, and whenever the rules cannot be
+   * determined. Callers must treat `null` as "no filtering".
+   */
+  public async getUserSharingRules(
+    plexUserId: number
+  ): Promise<PlexUserSharingRules | null> {
+    const settings = getSettings();
+
+    if (!settings.plex.machineId) {
+      return null;
+    }
+
+    try {
+      // `shared_servers` exposes the filters *and* the shared sections in a
+      // single call, unlike `/api/users` which only reports a library count.
+      const response = await this.axios.get(
+        `/api/servers/${settings.plex.machineId}/shared_servers`,
+        {
+          transformResponse: [],
+          responseType: 'text',
+        }
+      );
+
+      const parsedXml = (await xml2js.parseStringPromise(
+        response.data
+      )) as SharedServersResponse;
+
+      const sharedServer = parsedXml.MediaContainer.SharedServer?.find(
+        (s) => parseInt(s.$.userID) === plexUserId
+      );
+
+      // No entry means the library is not shared with this user at all; that
+      // case is handled by checkUserAccess() rather than by filtering here.
+      if (!sharedServer) {
+        return null;
+      }
+
+      const all = parsePlexLabelFilter(sharedServer.$.filterAll);
+      const movies = mergeLabelFilters(
+        all,
+        parsePlexLabelFilter(sharedServer.$.filterMovies)
+      );
+      const tv = mergeLabelFilters(
+        all,
+        parsePlexLabelFilter(sharedServer.$.filterTelevision)
+      );
+
+      const allLibraries = sharedServer.$.allLibraries === '1';
+      const sharedSectionKeys = allLibraries
+        ? []
+        : (sharedServer.Section ?? [])
+            .filter((section) => section.$.shared === '1')
+            .map((section) => section.$.key);
+
+      const hasLabelRestrictions =
+        movies.allow.length > 0 ||
+        movies.deny.length > 0 ||
+        tv.allow.length > 0 ||
+        tv.deny.length > 0;
+
+      if (allLibraries && !hasLabelRestrictions) {
+        return null;
+      }
+
+      return { allLibraries, sharedSectionKeys, movies, tv };
+    } catch (e) {
+      logger.error('Failed to retrieve Plex sharing rules for user', {
+        label: 'Plex.tv API',
+        plexUserId,
+        errorMessage: e.message,
+      });
+      return null;
+    }
+  }
+
   public async getWatchlist({
     offset = 0,
     size = 20,
diff --git a/server/entity/Media.ts b/server/entity/Media.ts
index 304d80e8c4..215a98874d 100644
--- a/server/entity/Media.ts
+++ b/server/entity/Media.ts
@@ -8,6 +8,7 @@ import type { User } from '@server/entity/User';
 import { Watchlist } from '@server/entity/Watchlist';
 import type { DownloadingItem } from '@server/lib/downloadtracker';
 import downloadTracker from '@server/lib/downloadtracker';
+import { getVisibleRatingKeys } from '@server/lib/plexsharing';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import { DbAwareColumn, resolveDbType } from '@server/utils/DbColumnHelper';
@@ -31,7 +32,12 @@ import Season from './Season';
 class Media {
   public static async getRelatedMedia(
     user: User | undefined,
-    items: { tmdbId: number; mediaType: string }[]
+    items: { tmdbId: number; mediaType: string }[],
+    // Background jobs work from the library's point of view, not a user's, so
+    // they opt out to avoid acting on an artificially downgraded status.
+    {
+      applySharingRestrictions = true,
+    }: { applySharingRestrictions?: boolean } = {}
   ): Promise<Media[]> {
     const mediaRepository = getRepository(Media);
 
@@ -53,18 +59,84 @@ class Media {
         .where(' media.tmdbId in (:...finalIds)', { finalIds })
         .getMany();
 
-      return media.filter((m) =>
+      const relatedMedia = media.filter((m) =>
         items.some((i) => i.tmdbId === m.tmdbId && i.mediaType === m.mediaType)
       );
+
+      if (!user || !applySharingRestrictions) {
+        return relatedMedia;
+      }
+
+      return await Media.applySharingRestrictions(user, relatedMedia);
     } catch (e) {
       logger.error(e.message);
       return [];
     }
   }
 
+  /**
+   * Hides availability of media the user has no access to on the media server.
+   *
+   * Plex lets the owner restrict a shared user to specific libraries or labels,
+   * but availability is otherwise computed for the whole library. Without this,
+   * a restricted user is told a title is available and then cannot play it.
+   *
+   * The status is downgraded rather than the item removed, so the user can
+   * still request it and be granted access.
+   */
+  public static async applySharingRestrictions(
+    user: User,
+    media: Media[]
+  ): Promise<Media[]> {
+    const visibleRatingKeys = await getVisibleRatingKeys(user);
+
+    // `null` means the user is unrestricted, the common case.
+    if (!visibleRatingKeys) {
+      return media;
+    }
+
+    const isHidden = (ratingKey?: string | null): boolean =>
+      !ratingKey || !visibleRatingKeys.has(ratingKey);
+
+    const isAvailable = (status: MediaStatus): boolean =>
+      status === MediaStatus.AVAILABLE ||
+      status === MediaStatus.PARTIALLY_AVAILABLE;
+
+    for (const item of media) {
+      const hidden = isHidden(item.ratingKey);
+      const hidden4k = isHidden(item.ratingKey4k);
+
+      if (isAvailable(item.status) && hidden) {
+        item.status = MediaStatus.UNKNOWN;
+      }
+
+      if (isAvailable(item.status4k) && hidden4k) {
+        item.status4k = MediaStatus.UNKNOWN;
+      }
+
+      // Seasons carry their own status, which the UI displays independently of
+      // the show's, so they have to be downgraded as well. Plex restricts
+      // access at show level, hence the show's own visibility is used.
+      for (const season of item.seasons ?? []) {
+        if (isAvailable(season.status) && hidden) {
+          season.status = MediaStatus.UNKNOWN;
+        }
+
+        if (isAvailable(season.status4k) && hidden4k) {
+          season.status4k = MediaStatus.UNKNOWN;
+        }
+      }
+    }
+
+    return media;
+  }
+
   public static async getMedia(
     id: number,
-    mediaType: MediaType
+    mediaType: MediaType,
+    // Passing the requesting user hides availability of media they have no
+    // access to on the media server.
+    user?: User
   ): Promise<Media | undefined> {
     const mediaRepository = getRepository(Media);
 
@@ -74,7 +146,17 @@ class Media {
         relations: { requests: true, issues: true },
       });
 
-      return media ?? undefined;
+      if (!media) {
+        return undefined;
+      }
+
+      if (!user) {
+        return media;
+      }
+
+      const [restricted] = await Media.applySharingRestrictions(user, [media]);
+
+      return restricted;
     } catch (e) {
       logger.error(e.message);
       return undefined;
diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
new file mode 100644
index 0000000000..7eed376b7f
--- /dev/null
+++ b/server/lib/plexsharing.ts
@@ -0,0 +1,188 @@
+import PlexAPI from '@server/api/plexapi';
+import PlexTvAPI from '@server/api/plextv';
+import { MediaServerType } from '@server/constants/server';
+import { UserType } from '@server/constants/user';
+import { getRepository } from '@server/datasource';
+import { User } from '@server/entity/User';
+import { getSettings } from '@server/lib/settings';
+import logger from '@server/logger';
+
+/**
+ * The set of Plex rating keys a restricted user is allowed to see, or `null`
+ * when the user is unrestricted and availability needs no filtering.
+ */
+export type PlexVisibleRatingKeys = Set<string> | null;
+
+interface CacheEntry {
+  expiresAt: number;
+  ratingKeys: PlexVisibleRatingKeys;
+}
+
+/**
+ * Resolving the visible rating keys costs a handful of Plex requests, so the
+ * result is cached per user. Sharing rules and labels change rarely, and a
+ * stale entry only delays a restriction by a few minutes.
+ */
+const CACHE_TTL_MS = 5 * 60 * 1000;
+const cache = new Map<number, CacheEntry>();
+
+export const clearPlexSharingCache = (userId?: number): void => {
+  if (userId === undefined) {
+    cache.clear();
+    return;
+  }
+
+  cache.delete(userId);
+};
+
+const getAdminPlexToken = async (): Promise<string | null> => {
+  const userRepository = getRepository(User);
+  const admin = await userRepository.findOne({
+    select: { id: true, plexToken: true },
+    where: { id: 1 },
+  });
+
+  return admin?.plexToken ?? null;
+};
+
+/**
+ * Builds the set of rating keys visible to a user, honouring both the shared
+ * library selection and the label restrictions configured in Plex.
+ *
+ * Returns `null` when the user is unrestricted, which callers must treat as
+ * "show everything", so unrestricted setups keep their current behaviour and
+ * pay no extra cost.
+ */
+const resolveVisibleRatingKeys = async (
+  user: User
+): Promise<PlexVisibleRatingKeys> => {
+  const settings = getSettings();
+
+  if (
+    settings.main.mediaServerType !== MediaServerType.PLEX ||
+    user.userType !== UserType.PLEX ||
+    !user.plexId
+  ) {
+    return null;
+  }
+
+  // The owner always sees the whole library.
+  if (user.id === 1) {
+    return null;
+  }
+
+  const adminToken = await getAdminPlexToken();
+
+  if (!adminToken) {
+    return null;
+  }
+
+  const rules = await new PlexTvAPI(adminToken).getUserSharingRules(
+    user.plexId
+  );
+
+  if (!rules) {
+    return null;
+  }
+
+  const plexClient = new PlexAPI({ plexToken: adminToken });
+  const libraries = settings.plex.libraries.filter(
+    (library) => library.enabled
+  );
+  const visible = new Set<string>();
+
+  for (const library of libraries) {
+    if (!rules.allLibraries && !rules.sharedSectionKeys.includes(library.id)) {
+      // Library not shared with this user: nothing from it is visible.
+      continue;
+    }
+
+    const filter = library.type === 'show' ? rules.tv : rules.movies;
+    const allowed = new Set<string>();
+
+    if (filter.allow.length) {
+      for (const label of filter.allow) {
+        for (const ratingKey of await plexClient.getRatingKeysByLabel(
+          library.id,
+          label
+        )) {
+          allowed.add(ratingKey);
+        }
+      }
+    } else {
+      // The library is shared without an allow list, so everything in it is
+      // visible unless a deny label excludes it.
+      for (const ratingKey of await getSectionRatingKeys(
+        plexClient,
+        library.id
+      )) {
+        allowed.add(ratingKey);
+      }
+    }
+
+    for (const label of filter.deny) {
+      for (const ratingKey of await plexClient.getRatingKeysByLabel(
+        library.id,
+        label
+      )) {
+        allowed.delete(ratingKey);
+      }
+    }
+
+    for (const ratingKey of allowed) {
+      visible.add(ratingKey);
+    }
+  }
+
+  return visible;
+};
+
+/** Lists every rating key of a library section, paging through the results. */
+const getSectionRatingKeys = async (
+  plexClient: PlexAPI,
+  sectionId: string
+): Promise<string[]> => {
+  const ratingKeys: string[] = [];
+  const size = 500;
+  let offset = 0;
+  let totalSize = 0;
+
+  do {
+    const { totalSize: total, items } = await plexClient.getLibraryContents(
+      sectionId,
+      { offset, size }
+    );
+    totalSize = total;
+    ratingKeys.push(...items.map((item) => item.ratingKey));
+    offset += size;
+  } while (offset < totalSize);
+
+  return ratingKeys;
+};
+
+export const getVisibleRatingKeys = async (
+  user: User
+): Promise<PlexVisibleRatingKeys> => {
+  const cached = cache.get(user.id);
+
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.ratingKeys;
+  }
+
+  try {
+    const ratingKeys = await resolveVisibleRatingKeys(user);
+    cache.set(user.id, {
+      ratingKeys,
+      expiresAt: Date.now() + CACHE_TTL_MS,
+    });
+    return ratingKeys;
+  } catch (e) {
+    logger.error('Failed to resolve Plex sharing restrictions', {
+      label: 'Plex Sharing',
+      userId: user.id,
+      errorMessage: e.message,
+    });
+    // Fail open: a transient Plex error must not hide the whole library.
+    return null;
+  }
+};
diff --git a/server/lib/watchlistsync.ts b/server/lib/watchlistsync.ts
index cb8a5d35e2..18bd943ddc 100644
--- a/server/lib/watchlistsync.ts
+++ b/server/lib/watchlistsync.ts
@@ -70,7 +70,10 @@ class WatchlistSync {
       response.items.map((i) => ({
         tmdbId: i.tmdbId,
         mediaType: i.type === 'show' ? MediaType.TV : MediaType.MOVIE,
-      }))
+      })),
+      // Sync decides what already exists in the library, so it must see the
+      // real status rather than one downgraded by sharing restrictions.
+      { applySharingRestrictions: false }
     );
 
     const watchlistTmdbIds = response.items.map((i) => i.tmdbId);
diff --git a/server/routes/media.ts b/server/routes/media.ts
index 2295f0021e..e6f3a121b2 100644
--- a/server/routes/media.ts
+++ b/server/routes/media.ts
@@ -81,6 +81,13 @@ mediaRoutes.get('/', async (req, res, next) => {
       take: pageSize,
       skip,
     });
+
+    // This endpoint feeds the "Recently Added" slider, so availability has to
+    // be reported from the requesting user's point of view.
+    const results = req.user
+      ? await Media.applySharingRestrictions(req.user, media)
+      : media;
+
     return res.status(200).json({
       pageInfo: {
         pages: Math.ceil(mediaCount / pageSize),
@@ -88,7 +95,7 @@ mediaRoutes.get('/', async (req, res, next) => {
         results: mediaCount,
         page: Math.ceil(skip / pageSize) + 1,
       },
-      results: media,
+      results,
     } as MediaResultsResponse);
   } catch (e) {
     next({ status: 500, message: e.message });
diff --git a/server/routes/movie.ts b/server/routes/movie.ts
index bd86e447a9..e2cb66435d 100644
--- a/server/routes/movie.ts
+++ b/server/routes/movie.ts
@@ -22,7 +22,7 @@ movieRoutes.get('/:id', async (req, res, next) => {
       language: (req.query.language as string) ?? req.locale,
     });
 
-    const media = await Media.getMedia(tmdbMovie.id, MediaType.MOVIE);
+    const media = await Media.getMedia(tmdbMovie.id, MediaType.MOVIE, req.user);
 
     const onUserWatchlist = await getRepository(Watchlist).exist({
       where: {
diff --git a/server/routes/tv.ts b/server/routes/tv.ts
index 743f407e48..0b833853a1 100644
--- a/server/routes/tv.ts
+++ b/server/routes/tv.ts
@@ -30,7 +30,7 @@ tvRoutes.get('/:id', async (req, res, next) => {
       tvId: Number(req.params.id),
       language: (req.query.language as string) ?? req.locale,
     });
-    const media = await Media.getMedia(tv.id, MediaType.TV);
+    const media = await Media.getMedia(tv.id, MediaType.TV, req.user);
 
     const onUserWatchlist = await getRepository(Watchlist).exist({
       where: {

From ea25f33b81b292ab644d55efb73ec55ff58af907 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 17:42:25 +0200
Subject: [PATCH 02/19] feat(plex): optionally grant library access when a
 request is approved

Because restricted users now see hidden media as unavailable, they can request
something the library already holds. Such a request must never reach Radarr or
Sonarr, or the file would be downloaded a second time, so it is short-circuited
before dispatch.

What happens next is left to the owner. A new setting, disabled by default, adds
one of the user's allowed labels to the item so they immediately gain access.
When it stays off, the request simply follows the usual approval flow and
granting access remains a manual decision.

Writing a label requires sending the existing ones back, since Plex replaces the
whole set, and the library section is resolved from the item's own metadata.
---
 server/api/plexapi.ts                       | 72 +++++++++++++++++++++
 server/lib/plexsharing.ts                   | 67 +++++++++++++++++++
 server/lib/settings/index.ts                |  8 +++
 server/subscriber/MediaRequestSubscriber.ts | 58 +++++++++++++++++
 src/components/Settings/SettingsPlex.tsx    | 30 +++++++++
 src/i18n/locale/en.json                     |  2 +
 6 files changed, 237 insertions(+)

diff --git a/server/api/plexapi.ts b/server/api/plexapi.ts
index aac7f8ee28..dd0f1b52d3 100644
--- a/server/api/plexapi.ts
+++ b/server/api/plexapi.ts
@@ -93,6 +93,17 @@ interface PlexMetadataResponse {
   };
 }
 
+interface PlexLabelResponse {
+  MediaContainer: {
+    Metadata?: {
+      librarySectionID?: number | string;
+      Label?: {
+        tag: string;
+      }[];
+    }[];
+  };
+}
+
 class PlexAPI extends ExternalAPI {
   constructor({
     plexToken,
@@ -239,6 +250,67 @@ class PlexAPI extends ExternalAPI {
     return ratingKeys;
   }
 
+  /**
+   * Adds a label to a library item, keeping the labels it already carries.
+   *
+   * Plex replaces the whole label set on write, so existing labels have to be
+   * sent again alongside the new one.
+   */
+  public async addLabel(
+    ratingKey: string,
+    type: 'movie' | 'show',
+    label: string
+  ): Promise<void> {
+    const { sectionId, labels: existing } = await this.getItemLabels(ratingKey);
+
+    if (!sectionId) {
+      throw new Error(
+        `Unable to resolve the library section of Plex item ${ratingKey}`
+      );
+    }
+
+    if (existing.some((l) => l.toLowerCase() === label.toLowerCase())) {
+      return;
+    }
+
+    const labels = [...existing, label];
+    const params = new URLSearchParams({
+      type: type === 'show' ? '2' : '1',
+      id: ratingKey,
+      'label.locked': '1',
+    });
+
+    labels.forEach((value, index) => {
+      params.append(`label[${index}].tag.tag`, value);
+    });
+
+    // ExternalAPI does not wrap PUT, so the axios instance is used directly.
+    await this.axios.put(
+      `/library/sections/${sectionId}/all?${params.toString()}`
+    );
+  }
+
+  /**
+   * Returns the labels currently set on a library item, along with the section
+   * it belongs to, which is required to write labels back.
+   */
+  public async getItemLabels(
+    ratingKey: string
+  ): Promise<{ sectionId?: string; labels: string[] }> {
+    const response = await this.get<PlexLabelResponse>(
+      `/library/metadata/${ratingKey}`
+    );
+
+    const metadata = response.MediaContainer.Metadata?.[0];
+
+    return {
+      sectionId: metadata?.librarySectionID
+        ? `${metadata.librarySectionID}`
+        : undefined,
+      labels: (metadata?.Label ?? []).map((label) => label.tag),
+    };
+  }
+
   public async getMetadata(
     key: string,
     options: { includeChildren?: boolean } = {}
diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
index 7eed376b7f..57c32748f5 100644
--- a/server/lib/plexsharing.ts
+++ b/server/lib/plexsharing.ts
@@ -13,6 +13,12 @@ import logger from '@server/logger';
  */
 export type PlexVisibleRatingKeys = Set<string> | null;
 
+/** Identifies a single item in the Plex library. */
+export interface PlexItemRef {
+  ratingKey: string;
+  type: 'movie' | 'show';
+}
+
 interface CacheEntry {
   expiresAt: number;
   ratingKeys: PlexVisibleRatingKeys;
@@ -160,6 +166,67 @@ const getSectionRatingKeys = async (
   return ratingKeys;
 };
 
+/**
+ * Grants a restricted user access to an item already present in the library, by
+ * adding one of the labels they are allowed to see.
+ *
+ * Returns the label that was applied, or `null` when nothing had to be done:
+ * the user is unrestricted, already has access, or has no allow list to draw a
+ * label from (a deny-only restriction cannot be satisfied this way).
+ */
+export const grantLabelAccess = async (
+  user: User,
+  { ratingKey, type }: PlexItemRef
+): Promise<string | null> => {
+  const settings = getSettings();
+
+  if (
+    settings.main.mediaServerType !== MediaServerType.PLEX ||
+    user.userType !== UserType.PLEX ||
+    !user.plexId ||
+    user.id === 1
+  ) {
+    return null;
+  }
+
+  const adminToken = await getAdminPlexToken();
+
+  if (!adminToken) {
+    return null;
+  }
+
+  const rules = await new PlexTvAPI(adminToken).getUserSharingRules(
+    user.plexId
+  );
+
+  if (!rules) {
+    return null;
+  }
+
+  const filter = type === 'show' ? rules.tv : rules.movies;
+  const label = filter.allow.find(
+    (candidate) => !filter.deny.includes(candidate)
+  );
+
+  if (!label) {
+    return null;
+  }
+
+  await new PlexAPI({ plexToken: adminToken }).addLabel(ratingKey, type, label);
+
+  // The user's visible set just changed, so drop the cached copy.
+  clearPlexSharingCache(user.id);
+
+  logger.info('Granted Plex library access by adding a label', {
+    label: 'Plex Sharing',
+    userId: user.id,
+    ratingKey,
+    plexLabel: label,
+  });
+
+  return label;
+};
+
 export const getVisibleRatingKeys = async (
   user: User
 ): Promise<PlexVisibleRatingKeys> => {
diff --git a/server/lib/settings/index.ts b/server/lib/settings/index.ts
index 0a896524eb..708611ae32 100644
--- a/server/lib/settings/index.ts
+++ b/server/lib/settings/index.ts
@@ -42,6 +42,14 @@ export interface PlexSettings {
   useSsl?: boolean;
   libraries: Library[];
   webAppUrl?: string;
+  /**
+   * When a user restricted by Plex labels requests media that already exists in
+   * the library, automatically add one of their allowed labels to it so they
+   * gain access, instead of leaving the request for the owner to handle.
+   *
+   * Disabled by default: granting library access is the owner's decision.
+   */
+  grantLabelOnApproval?: boolean;
 }
 
 export interface JellyfinSettings {
diff --git a/server/subscriber/MediaRequestSubscriber.ts b/server/subscriber/MediaRequestSubscriber.ts
index c4b2263ccd..bb4a9e9521 100644
--- a/server/subscriber/MediaRequestSubscriber.ts
+++ b/server/subscriber/MediaRequestSubscriber.ts
@@ -18,6 +18,7 @@ import { MediaRequest } from '@server/entity/MediaRequest';
 import Season from '@server/entity/Season';
 import SeasonRequest from '@server/entity/SeasonRequest';
 import notificationManager, { Notification } from '@server/lib/notifications';
+import { grantLabelAccess } from '@server/lib/plexsharing';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import { withNestedTransaction } from '@server/utils/nestedTransaction';
@@ -181,6 +182,55 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
     }
   }
 
+  /**
+   * Media hidden from a user by Plex sharing restrictions is reported as
+   * unavailable to them, so they are able to request something the library
+   * already holds. Such a request must never be sent to Radarr or Sonarr, or
+   * the file would be downloaded a second time.
+   *
+   * Returns `true` when the caller has to stop, and grants library access right
+   * away when the owner opted into it.
+   */
+  private async isAlreadyInLibrary(entity: MediaRequest): Promise<boolean> {
+    const status = entity.is4k ? entity.media.status4k : entity.media.status;
+    const ratingKey = entity.is4k
+      ? entity.media.ratingKey4k
+      : entity.media.ratingKey;
+
+    if (status !== MediaStatus.AVAILABLE || !ratingKey) {
+      return false;
+    }
+
+    const settings = getSettings();
+
+    logger.info(
+      'Request targets media already present in the library, skipping download',
+      {
+        label: 'Media Request',
+        requestId: entity.id,
+        mediaId: entity.media.id,
+        grantLabelOnApproval: !!settings.plex.grantLabelOnApproval,
+      }
+    );
+
+    if (settings.plex.grantLabelOnApproval && entity.requestedBy) {
+      try {
+        await grantLabelAccess(entity.requestedBy, {
+          ratingKey,
+          type: entity.type === MediaType.MOVIE ? 'movie' : 'show',
+        });
+      } catch (e) {
+        logger.error('Failed to grant Plex library access for request', {
+          label: 'Media Request',
+          requestId: entity.id,
+          errorMessage: e.message,
+        });
+      }
+    }
+
+    return true;
+  }
+
   public async sendToRadarr(
     entity: MediaRequest,
     manager: EntityManager
@@ -189,6 +239,10 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
       entity.status === MediaRequestStatus.APPROVED &&
       entity.type === MediaType.MOVIE
     ) {
+      if (await this.isAlreadyInLibrary(entity)) {
+        return;
+      }
+
       try {
         const mediaRepository = manager.getRepository(Media);
         const settings = getSettings();
@@ -488,6 +542,10 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
       entity.status === MediaRequestStatus.APPROVED &&
       entity.type === MediaType.TV
     ) {
+      if (await this.isAlreadyInLibrary(entity)) {
+        return;
+      }
+
       try {
         const mediaRepository = manager.getRepository(Media);
         const settings = getSettings();
diff --git a/src/components/Settings/SettingsPlex.tsx b/src/components/Settings/SettingsPlex.tsx
index 2945344b73..c705ea7ddb 100644
--- a/src/components/Settings/SettingsPlex.tsx
+++ b/src/components/Settings/SettingsPlex.tsx
@@ -70,6 +70,9 @@ const messages = defineMessages('components.Settings', {
   webAppUrl: '<WebAppLink>Web App</WebAppLink> URL',
   webAppUrlTip:
     'Optionally direct users to the web app on your server instead of https://app.plex.tv/desktop',
+  grantLabelOnApproval: 'Grant Library Access on Approval',
+  grantLabelOnApprovalTip:
+    'When a user restricted by labels requests media already in your library, add one of their allowed labels to it instead of leaving the request for you to handle manually',
   tautulliSettings: 'Tautulli Settings',
   tautulliSettingsDescription:
     'Optionally configure the settings for your Tautulli server. Seerr fetches watch history data for your Plex media from Tautulli.',
@@ -386,6 +389,7 @@ const SettingsPlex = ({ isSetupSettings }: SettingsPlexProps) => {
           useSsl: data?.useSsl,
           selectedPreset: undefined,
           webAppUrl: data?.webAppUrl,
+          grantLabelOnApproval: data?.grantLabelOnApproval ?? false,
         }}
         validationSchema={PlexSettingsSchema}
         validateOnMount={true}
@@ -407,6 +411,7 @@ const SettingsPlex = ({ isSetupSettings }: SettingsPlexProps) => {
               port: Number(values.port),
               useSsl: values.useSsl,
               webAppUrl: values.webAppUrl,
+              grantLabelOnApproval: values.grantLabelOnApproval,
             } as PlexSettings);
 
             syncLibraries();
@@ -612,6 +617,31 @@ const SettingsPlex = ({ isSetupSettings }: SettingsPlexProps) => {
                     )}
                 </div>
               </div>
+              <div className="form-row">
+                <label
+                  htmlFor="grantLabelOnApproval"
+                  className="checkbox-label"
+                >
+                  {intl.formatMessage(messages.grantLabelOnApproval)}
+                  <SettingsBadge badgeType="advanced" className="ml-2" />
+                  <span className="label-tip">
+                    {intl.formatMessage(messages.grantLabelOnApprovalTip)}
+                  </span>
+                </label>
+                <div className="form-input-area">
+                  <Field
+                    type="checkbox"
+                    id="grantLabelOnApproval"
+                    name="grantLabelOnApproval"
+                    onChange={() => {
+                      setFieldValue(
+                        'grantLabelOnApproval',
+                        !values.grantLabelOnApproval
+                      );
+                    }}
+                  />
+                </div>
+              </div>
               <div className="actions">
                 <div className="flex justify-end">
                   <span className="ml-3 inline-flex rounded-md shadow-sm">
diff --git a/src/i18n/locale/en.json b/src/i18n/locale/en.json
index d30b6e1fdc..58936f846d 100644
--- a/src/i18n/locale/en.json
+++ b/src/i18n/locale/en.json
@@ -1204,6 +1204,8 @@
   "components.Settings.failed": "Does not work",
   "components.Settings.failedToSaveMetadataSettings": "Failed to save metadata provider settings",
   "components.Settings.general": "General",
+  "components.Settings.grantLabelOnApproval": "Grant Library Access on Approval",
+  "components.Settings.grantLabelOnApprovalTip": "When a user restricted by labels requests media already in your library, add one of their allowed labels to it instead of leaving the request for you to handle manually",
   "components.Settings.hostname": "Hostname or IP Address",
   "components.Settings.importBlocklistedTagsTip": "Import blocklisted tag configuration",
   "components.Settings.invalidKeyword": "{keywordId} is not a TMDB keyword.",

From f91e04bc8359425dee1937f3324346b3d308d020 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 18:11:57 +0200
Subject: [PATCH 03/19] feat(jellyfin): respect per-user library restrictions
 when reporting availability

Extends the previous Plex work to Jellyfin and Emby, which restrict access per
library rather than per label.

The allowed libraries come from the user's policy: `EnableAllFolders` means
unrestricted, otherwise `EnabledFolders` lists the library ids the user may
browse. Both servers report those fields on the user list, so a single request
covers every user.

Items are then listed with the owner's credentials rather than through a
`userId` filter, because neither server honours that filter when queried with an
administrator token: Jellyfin answers 401 for a forbidden library, and Emby
returns an empty list even for an allowed one. Reading the policy is the only
behaviour both agree on.

Resolution moves behind a small dispatcher that picks the implementation from
the configured media server type and owns the per-user cache, so `plexsharing`
becomes a plain resolver. Availability is compared against `ratingKey` for Plex
and `jellyfinMediaId` for Jellyfin and Emby, which share the same columns.

Users reaching every enabled library return early, before any request, so
unrestricted setups keep their current behaviour.
---
 server/api/jellyfin.ts                      |  10 ++
 server/entity/Media.ts                      |  29 +++---
 server/lib/jellyfinsharing.ts               | 102 ++++++++++++++++++++
 server/lib/librarysharing.test.ts           |  70 ++++++++++++++
 server/lib/librarysharing.ts                |  85 ++++++++++++++++
 server/lib/plexsharing.ts                   |  54 +----------
 server/subscriber/MediaRequestSubscriber.ts |   8 +-
 7 files changed, 292 insertions(+), 66 deletions(-)
 create mode 100644 server/lib/jellyfinsharing.ts
 create mode 100644 server/lib/librarysharing.test.ts
 create mode 100644 server/lib/librarysharing.ts

diff --git a/server/api/jellyfin.ts b/server/api/jellyfin.ts
index 188beb1ff1..6f6b3321e0 100644
--- a/server/api/jellyfin.ts
+++ b/server/api/jellyfin.ts
@@ -18,6 +18,16 @@ export interface JellyfinUserResponse {
   };
   Policy: {
     IsAdministrator: boolean;
+    /**
+     * Library access, as configured per user under Access. When
+     * `EnableAllFolders` is set the user reaches every library and
+     * `EnabledFolders` is empty; otherwise it lists the library item ids the
+     * user is allowed to browse.
+     */
+    EnableAllFolders?: boolean;
+    EnabledFolders?: string[];
+    /** Legacy Emby counterpart of `EnabledFolders`. */
+    BlockedMediaFolders?: string[];
   };
   PrimaryImageTag?: string;
 }
diff --git a/server/entity/Media.ts b/server/entity/Media.ts
index 215a98874d..4207c125cd 100644
--- a/server/entity/Media.ts
+++ b/server/entity/Media.ts
@@ -8,7 +8,10 @@ import type { User } from '@server/entity/User';
 import { Watchlist } from '@server/entity/Watchlist';
 import type { DownloadingItem } from '@server/lib/downloadtracker';
 import downloadTracker from '@server/lib/downloadtracker';
-import { getVisibleRatingKeys } from '@server/lib/plexsharing';
+import {
+  getMediaServerItemIds,
+  getVisibleMediaIds,
+} from '@server/lib/librarysharing';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import { DbAwareColumn, resolveDbType } from '@server/utils/DbColumnHelper';
@@ -77,9 +80,10 @@ class Media {
   /**
    * Hides availability of media the user has no access to on the media server.
    *
-   * Plex lets the owner restrict a shared user to specific libraries or labels,
-   * but availability is otherwise computed for the whole library. Without this,
-   * a restricted user is told a title is available and then cannot play it.
+   * Media servers let the owner restrict a shared user to specific libraries,
+   * and Plex additionally to specific labels, but availability is otherwise
+   * computed for the whole library. Without this, a restricted user is told a
+   * title is available and then cannot play it.
    *
    * The status is downgraded rather than the item removed, so the user can
    * still request it and be granted access.
@@ -88,23 +92,24 @@ class Media {
     user: User,
     media: Media[]
   ): Promise<Media[]> {
-    const visibleRatingKeys = await getVisibleRatingKeys(user);
+    const visibleIds = await getVisibleMediaIds(user);
 
     // `null` means the user is unrestricted, the common case.
-    if (!visibleRatingKeys) {
+    if (!visibleIds) {
       return media;
     }
 
-    const isHidden = (ratingKey?: string | null): boolean =>
-      !ratingKey || !visibleRatingKeys.has(ratingKey);
+    const isHidden = (itemId?: string | null): boolean =>
+      !itemId || !visibleIds.has(itemId);
 
     const isAvailable = (status: MediaStatus): boolean =>
       status === MediaStatus.AVAILABLE ||
       status === MediaStatus.PARTIALLY_AVAILABLE;
 
     for (const item of media) {
-      const hidden = isHidden(item.ratingKey);
-      const hidden4k = isHidden(item.ratingKey4k);
+      const { id, id4k } = getMediaServerItemIds(item);
+      const hidden = isHidden(id);
+      const hidden4k = isHidden(id4k);
 
       if (isAvailable(item.status) && hidden) {
         item.status = MediaStatus.UNKNOWN;
@@ -115,8 +120,8 @@ class Media {
       }
 
       // Seasons carry their own status, which the UI displays independently of
-      // the show's, so they have to be downgraded as well. Plex restricts
-      // access at show level, hence the show's own visibility is used.
+      // the show's, so they have to be downgraded as well. Access is granted at
+      // show level, hence the show's own visibility is used.
       for (const season of item.seasons ?? []) {
         if (isAvailable(season.status) && hidden) {
           season.status = MediaStatus.UNKNOWN;
diff --git a/server/lib/jellyfinsharing.ts b/server/lib/jellyfinsharing.ts
new file mode 100644
index 0000000000..d5fffcb87a
--- /dev/null
+++ b/server/lib/jellyfinsharing.ts
@@ -0,0 +1,102 @@
+import JellyfinAPI from '@server/api/jellyfin';
+import { MediaServerType } from '@server/constants/server';
+import { UserType } from '@server/constants/user';
+import { getRepository } from '@server/datasource';
+import { User } from '@server/entity/User';
+import { getSettings } from '@server/lib/settings';
+import logger from '@server/logger';
+import { getHostname } from '@server/utils/getHostname';
+
+/**
+ * Builds the set of Jellyfin or Emby item ids visible to a user.
+ *
+ * Unlike Plex, access is granted per library only, there is no label based
+ * restriction, and the allowed libraries are taken from the user's policy:
+ * `EnableAllFolders` means unrestricted, otherwise `EnabledFolders` lists the
+ * library ids the user may browse. Both servers report those fields on the user
+ * list, so a single request covers every user.
+ *
+ * Items are then listed with the owner's credentials, since neither server
+ * honours a `userId` filter when queried with an administrator token: Jellyfin
+ * answers 401 for a forbidden library, and Emby returns an empty list even for
+ * an allowed one.
+ *
+ * Returns `null` when the user reaches every enabled library, which callers
+ * must treat as "no filtering".
+ */
+export const resolveVisibleJellyfinItemIds = async (
+  user: User
+): Promise<Set<string> | null> => {
+  const settings = getSettings();
+
+  if (
+    (settings.main.mediaServerType !== MediaServerType.JELLYFIN &&
+      settings.main.mediaServerType !== MediaServerType.EMBY) ||
+    user.userType === UserType.PLEX ||
+    !user.jellyfinUserId
+  ) {
+    return null;
+  }
+
+  const userRepository = getRepository(User);
+  const admin = await userRepository.findOne({
+    select: { id: true, jellyfinDeviceId: true, jellyfinUserId: true },
+    where: { id: 1 },
+  });
+
+  // The owner always reaches the whole library.
+  if (!admin || user.id === admin.id) {
+    return null;
+  }
+
+  const client = new JellyfinAPI(
+    getHostname(),
+    settings.jellyfin.apiKey,
+    admin.jellyfinDeviceId
+  );
+  client.setUserId(admin.jellyfinUserId ?? '');
+
+  const { users } = await client.getUsers();
+  const policy = users.find(
+    (candidate) => candidate.Id === user.jellyfinUserId
+  )?.Policy;
+
+  // Without a policy there is nothing to enforce; leave availability untouched
+  // rather than risk hiding a library the user can actually reach.
+  if (!policy || policy.EnableAllFolders !== false) {
+    return null;
+  }
+
+  const allowedLibraryIds = new Set(policy.EnabledFolders ?? []);
+  const enabled = settings.jellyfin.libraries.filter(
+    (library) => library.enabled
+  );
+
+  if (enabled.every((library) => allowedLibraryIds.has(library.id))) {
+    return null;
+  }
+
+  const visible = new Set<string>();
+
+  for (const library of enabled) {
+    if (!allowedLibraryIds.has(library.id)) {
+      // Library not shared with this user: nothing from it is visible.
+      continue;
+    }
+
+    for (const item of await client.getLibraryContents(library.id)) {
+      visible.add(item.Id);
+    }
+  }
+
+  logger.debug('Resolved media server library restrictions for user', {
+    label: 'Media Server Sharing',
+    userId: user.id,
+    allowedLibraries: enabled
+      .filter((library) => allowedLibraryIds.has(library.id))
+      .map((library) => library.name),
+    visibleItems: visible.size,
+  });
+
+  return visible;
+};
diff --git a/server/lib/librarysharing.test.ts b/server/lib/librarysharing.test.ts
new file mode 100644
index 0000000000..25f2282aaa
--- /dev/null
+++ b/server/lib/librarysharing.test.ts
@@ -0,0 +1,70 @@
+import { MediaServerType } from '@server/constants/server';
+import type Media from '@server/entity/Media';
+import { getMediaServerItemIds } from '@server/lib/librarysharing';
+import { getSettings } from '@server/lib/settings';
+import assert from 'node:assert/strict';
+import { afterEach, describe, it } from 'node:test';
+
+const asMedia = (fields: Partial<Media>): Media => fields as Media;
+
+const withMediaServer = (type: MediaServerType) => {
+  getSettings().main.mediaServerType = type;
+};
+
+describe('getMediaServerItemIds', () => {
+  const initialType = getSettings().main.mediaServerType;
+
+  afterEach(() => {
+    getSettings().main.mediaServerType = initialType;
+  });
+
+  it('returns Plex rating keys when the server is Plex', () => {
+    withMediaServer(MediaServerType.PLEX);
+
+    assert.deepEqual(
+      getMediaServerItemIds(
+        asMedia({
+          ratingKey: '51',
+          ratingKey4k: '52',
+          jellyfinMediaId: 'abc',
+          jellyfinMediaId4k: 'def',
+        })
+      ),
+      { id: '51', id4k: '52' }
+    );
+  });
+
+  it('returns Jellyfin item ids when the server is Jellyfin', () => {
+    withMediaServer(MediaServerType.JELLYFIN);
+
+    assert.deepEqual(
+      getMediaServerItemIds(
+        asMedia({
+          ratingKey: '51',
+          ratingKey4k: '52',
+          jellyfinMediaId: 'abc',
+          jellyfinMediaId4k: 'def',
+        })
+      ),
+      { id: 'abc', id4k: 'def' }
+    );
+  });
+
+  it('reuses the Jellyfin columns for Emby', () => {
+    withMediaServer(MediaServerType.EMBY);
+
+    assert.deepEqual(
+      getMediaServerItemIds(asMedia({ jellyfinMediaId: 'abc' })),
+      { id: 'abc', id4k: undefined }
+    );
+  });
+
+  it('tolerates media that carries no identifier yet', () => {
+    withMediaServer(MediaServerType.PLEX);
+
+    assert.deepEqual(getMediaServerItemIds(asMedia({})), {
+      id: undefined,
+      id4k: undefined,
+    });
+  });
+});
diff --git a/server/lib/librarysharing.ts b/server/lib/librarysharing.ts
new file mode 100644
index 0000000000..74c7a093e8
--- /dev/null
+++ b/server/lib/librarysharing.ts
@@ -0,0 +1,85 @@
+import { MediaServerType } from '@server/constants/server';
+import type Media from '@server/entity/Media';
+import type { User } from '@server/entity/User';
+import { resolveVisibleJellyfinItemIds } from '@server/lib/jellyfinsharing';
+import { resolveVisiblePlexRatingKeys } from '@server/lib/plexsharing';
+import { getSettings } from '@server/lib/settings';
+import logger from '@server/logger';
+
+/**
+ * The set of media server item ids a restricted user is allowed to see, or
+ * `null` when the user is unrestricted and availability needs no filtering.
+ */
+export type VisibleMediaIds = Set<string> | null;
+
+interface CacheEntry {
+  expiresAt: number;
+  ids: VisibleMediaIds;
+}
+
+/**
+ * Resolving the visible ids costs a handful of media server requests, so the
+ * result is cached per user. Sharing rules change rarely, and a stale entry
+ * only delays a restriction by a few minutes.
+ */
+const CACHE_TTL_MS = 5 * 60 * 1000;
+const cache = new Map<number, CacheEntry>();
+
+export const clearLibrarySharingCache = (userId?: number): void => {
+  if (userId === undefined) {
+    cache.clear();
+    return;
+  }
+
+  cache.delete(userId);
+};
+
+const resolve = async (user: User): Promise<VisibleMediaIds> => {
+  switch (getSettings().main.mediaServerType) {
+    case MediaServerType.PLEX:
+      return resolveVisiblePlexRatingKeys(user);
+    case MediaServerType.JELLYFIN:
+    case MediaServerType.EMBY:
+      return resolveVisibleJellyfinItemIds(user);
+    default:
+      return null;
+  }
+};
+
+export const getVisibleMediaIds = async (
+  user: User
+): Promise<VisibleMediaIds> => {
+  const cached = cache.get(user.id);
+
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.ids;
+  }
+
+  try {
+    const ids = await resolve(user);
+    cache.set(user.id, { ids, expiresAt: Date.now() + CACHE_TTL_MS });
+    return ids;
+  } catch (e) {
+    logger.error('Failed to resolve media server sharing restrictions', {
+      label: 'Media Server Sharing',
+      userId: user.id,
+      errorMessage: e.message,
+    });
+    // Fail open: a transient media server error must not hide the whole library.
+    return null;
+  }
+};
+
+/**
+ * Returns the identifiers a media item carries on the configured media server,
+ * for the regular and the 4K version.
+ */
+export const getMediaServerItemIds = (
+  media: Media
+): { id?: string | null; id4k?: string | null } => {
+  if (getSettings().main.mediaServerType === MediaServerType.PLEX) {
+    return { id: media.ratingKey, id4k: media.ratingKey4k };
+  }
+
+  return { id: media.jellyfinMediaId, id4k: media.jellyfinMediaId4k };
+};
diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
index 57c32748f5..13e0cda37c 100644
--- a/server/lib/plexsharing.ts
+++ b/server/lib/plexsharing.ts
@@ -19,28 +19,6 @@ export interface PlexItemRef {
   type: 'movie' | 'show';
 }
 
-interface CacheEntry {
-  expiresAt: number;
-  ratingKeys: PlexVisibleRatingKeys;
-}
-
-/**
- * Resolving the visible rating keys costs a handful of Plex requests, so the
- * result is cached per user. Sharing rules and labels change rarely, and a
- * stale entry only delays a restriction by a few minutes.
- */
-const CACHE_TTL_MS = 5 * 60 * 1000;
-const cache = new Map<number, CacheEntry>();
-
-export const clearPlexSharingCache = (userId?: number): void => {
-  if (userId === undefined) {
-    cache.clear();
-    return;
-  }
-
-  cache.delete(userId);
-};
-
 const getAdminPlexToken = async (): Promise<string | null> => {
   const userRepository = getRepository(User);
   const admin = await userRepository.findOne({
@@ -59,7 +37,7 @@ const getAdminPlexToken = async (): Promise<string | null> => {
  * "show everything", so unrestricted setups keep their current behaviour and
  * pay no extra cost.
  */
-const resolveVisibleRatingKeys = async (
+export const resolveVisiblePlexRatingKeys = async (
   user: User
 ): Promise<PlexVisibleRatingKeys> => {
   const settings = getSettings();
@@ -214,9 +192,6 @@ export const grantLabelAccess = async (
 
   await new PlexAPI({ plexToken: adminToken }).addLabel(ratingKey, type, label);
 
-  // The user's visible set just changed, so drop the cached copy.
-  clearPlexSharingCache(user.id);
-
   logger.info('Granted Plex library access by adding a label', {
     label: 'Plex Sharing',
     userId: user.id,
@@ -226,30 +201,3 @@ export const grantLabelAccess = async (
 
   return label;
 };
-
-export const getVisibleRatingKeys = async (
-  user: User
-): Promise<PlexVisibleRatingKeys> => {
-  const cached = cache.get(user.id);
-
-  if (cached && cached.expiresAt > Date.now()) {
-    return cached.ratingKeys;
-  }
-
-  try {
-    const ratingKeys = await resolveVisibleRatingKeys(user);
-    cache.set(user.id, {
-      ratingKeys,
-      expiresAt: Date.now() + CACHE_TTL_MS,
-    });
-    return ratingKeys;
-  } catch (e) {
-    logger.error('Failed to resolve Plex sharing restrictions', {
-      label: 'Plex Sharing',
-      userId: user.id,
-      errorMessage: e.message,
-    });
-    // Fail open: a transient Plex error must not hide the whole library.
-    return null;
-  }
-};
diff --git a/server/subscriber/MediaRequestSubscriber.ts b/server/subscriber/MediaRequestSubscriber.ts
index bb4a9e9521..a4ef4d6ded 100644
--- a/server/subscriber/MediaRequestSubscriber.ts
+++ b/server/subscriber/MediaRequestSubscriber.ts
@@ -17,6 +17,7 @@ import Media from '@server/entity/Media';
 import { MediaRequest } from '@server/entity/MediaRequest';
 import Season from '@server/entity/Season';
 import SeasonRequest from '@server/entity/SeasonRequest';
+import { clearLibrarySharingCache } from '@server/lib/librarysharing';
 import notificationManager, { Notification } from '@server/lib/notifications';
 import { grantLabelAccess } from '@server/lib/plexsharing';
 import { getSettings } from '@server/lib/settings';
@@ -215,10 +216,15 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
 
     if (settings.plex.grantLabelOnApproval && entity.requestedBy) {
       try {
-        await grantLabelAccess(entity.requestedBy, {
+        const granted = await grantLabelAccess(entity.requestedBy, {
           ratingKey,
           type: entity.type === MediaType.MOVIE ? 'movie' : 'show',
         });
+
+        if (granted) {
+          // The user's visible set just changed, so drop the cached copy.
+          clearLibrarySharingCache(entity.requestedBy.id);
+        }
       } catch (e) {
         logger.error('Failed to grant Plex library access for request', {
           label: 'Media Request',

From f3cab77f49b8ef749ade578573ec4be5876db5db Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 18:45:52 +0200
Subject: [PATCH 04/19] fix: address review feedback on library sharing
 restrictions

Requests for media already in the library no longer stay stuck in APPROVED. The
guard added earlier returned before the pre-existing branch that marks such a
request COMPLETED, which also made the guard redundant: that branch already runs
before anything reaches Radarr or Sonarr, so nothing was ever downloaded twice.
Granting library access now hooks into it instead.

Two allow lists sharing no label no longer collapse into "no restriction", which
granted access to the whole library instead of denying it. The combined filter
can now express "nothing is visible", and the intersection is case insensitive,
as evaluation already was. Picking a label to grant compares the deny list case
insensitively too, so a label the filter would then reject is never applied.

Restriction strings are split into clauses before decoding, so an encoded `&` or
`|` inside a label value is no longer taken for a separator, and a malformed
escape no longer throws. Values are still decoded before being split on commas,
because Plex encodes the comma that separates them.

Concurrent resolutions for the same user now share a single in-flight promise
rather than each starting their own, and a library whose restrictions cannot be
satisfied is skipped instead of being listed only to discard everything.

Adding a label no longer reads the existing set to replay it, since Plex merges
what it is sent, so two concurrent grants cannot drop each other's label. The
write goes through a new ExternalAPI put wrapper rather than the raw axios
instance.
---
 server/api/externalapi.ts                   | 25 ++++++
 server/api/plexapi.ts                       | 18 ++---
 server/api/plextv.test.ts                   | 24 ++++++
 server/api/plextv.ts                        | 45 +++++++++--
 server/lib/librarysharing.ts                | 46 ++++++++---
 server/lib/plexsharing.ts                   | 17 +++-
 server/subscriber/MediaRequestSubscriber.ts | 90 +++++++++------------
 7 files changed, 182 insertions(+), 83 deletions(-)

diff --git a/server/api/externalapi.ts b/server/api/externalapi.ts
index 9b71b7a159..aad8b68fe1 100644
--- a/server/api/externalapi.ts
+++ b/server/api/externalapi.ts
@@ -101,6 +101,31 @@ class ExternalAPI {
     return response.data;
   }
 
+  protected async put<T>(
+    endpoint: string,
+    data?: Record<string, unknown>,
+    config?: AxiosRequestConfig,
+    ttl?: number
+  ): Promise<T> {
+    const cacheKey = this.serializeCacheKey(endpoint, {
+      config: config?.params,
+      ...(data ? { data } : {}),
+    });
+
+    const cachedItem = this.cache?.get<T>(cacheKey);
+    if (cachedItem) {
+      return cachedItem;
+    }
+
+    const response = await this.axios.put<T>(endpoint, data, config);
+
+    if (this.cache && ttl !== 0) {
+      this.cache.set(cacheKey, response.data, ttl ?? DEFAULT_TTL);
+    }
+
+    return response.data;
+  }
+
   protected async getRolling<T>(
     endpoint: string,
     config?: AxiosRequestConfig,
diff --git a/server/api/plexapi.ts b/server/api/plexapi.ts
index dd0f1b52d3..e3584bdeaa 100644
--- a/server/api/plexapi.ts
+++ b/server/api/plexapi.ts
@@ -251,10 +251,11 @@ class PlexAPI extends ExternalAPI {
   }
 
   /**
-   * Adds a label to a library item, keeping the labels it already carries.
+   * Adds a label to a library item.
    *
-   * Plex replaces the whole label set on write, so existing labels have to be
-   * sent again alongside the new one.
+   * Plex merges the labels sent with the ones already set, so the existing set
+   * is never read back and replayed: two concurrent grants on the same item
+   * cannot drop each other's label.
    */
   public async addLabel(
     ratingKey: string,
@@ -273,21 +274,14 @@ class PlexAPI extends ExternalAPI {
       return;
     }
 
-    const labels = [...existing, label];
     const params = new URLSearchParams({
       type: type === 'show' ? '2' : '1',
       id: ratingKey,
+      'label[0].tag.tag': label,
       'label.locked': '1',
     });
 
-    labels.forEach((value, index) => {
-      params.append(`label[${index}].tag.tag`, value);
-    });
-
-    // ExternalAPI does not wrap PUT, so the axios instance is used directly.
-    await this.axios.put(
-      `/library/sections/${sectionId}/all?${params.toString()}`
-    );
+    await this.put(`/library/sections/${sectionId}/all?${params.toString()}`);
   }
 
   /**
diff --git a/server/api/plextv.test.ts b/server/api/plextv.test.ts
index 44740bf41d..38eb954fff 100644
--- a/server/api/plextv.test.ts
+++ b/server/api/plextv.test.ts
@@ -54,6 +54,21 @@ describe('parsePlexLabelFilter', () => {
     });
   });
 
+  it('keeps encoded separators inside a label value', () => {
+    // %26 is `&`, which must not be mistaken for a clause separator.
+    assert.deepEqual(parsePlexLabelFilter('label=Tom%20%26%20Jerry'), {
+      allow: ['Tom & Jerry'],
+      deny: [],
+    });
+  });
+
+  it('does not throw on a malformed encoding', () => {
+    assert.deepEqual(parsePlexLabelFilter('label=100%'), {
+      allow: ['100%'],
+      deny: [],
+    });
+  });
+
   it('drops empty values and surrounding whitespace', () => {
     assert.deepEqual(parsePlexLabelFilter('label= Family , ,Kids '), {
       allow: ['Family', 'Kids'],
@@ -63,6 +78,15 @@ describe('parsePlexLabelFilter', () => {
 });
 
 describe('isAllowedByLabelFilter', () => {
+  it('hides everything when the restrictions cannot be satisfied', () => {
+    assert.equal(
+      isAllowedByLabelFilter({ allow: [], deny: [], allowNothing: true }, [
+        'Family',
+      ]),
+      false
+    );
+  });
+
   it('allows anything when no restriction applies', () => {
     assert.equal(isAllowedByLabelFilter({ allow: [], deny: [] }, []), true);
     assert.equal(
diff --git a/server/api/plextv.ts b/server/api/plextv.ts
index 02d0a62462..2b418c5f51 100644
--- a/server/api/plextv.ts
+++ b/server/api/plextv.ts
@@ -119,6 +119,12 @@ interface UsersResponse {
 export interface PlexLabelFilter {
   allow: string[];
   deny: string[];
+  /**
+   * Set when the combined restrictions cannot be satisfied by any label, so
+   * nothing in the library is visible. Distinguishes that case from an empty
+   * `allow` list, which means "no allow restriction".
+   */
+  allowNothing?: boolean;
 }
 
 interface SharedServersResponse {
@@ -167,6 +173,18 @@ export interface PlexUserSharingRules {
 
 const EMPTY_LABEL_FILTER: PlexLabelFilter = { allow: [], deny: [] };
 
+/**
+ * Decodes a single restriction value. Plex url encodes them, but a malformed
+ * sequence must not turn parsing a filter into an exception.
+ */
+const decodeLabel = (value: string): string => {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+};
+
 /**
  * Parses a Plex restriction string into its label allow/deny lists.
  *
@@ -184,14 +202,17 @@ export const parsePlexLabelFilter = (
   const allow: string[] = [];
   const deny: string[] = [];
 
-  for (const clause of decodeURIComponent(filter).split(/[&|]/)) {
+  // Clauses are split on the raw string, so an encoded `&` or `|` inside a
+  // label value is not mistaken for a separator. Values are then decoded before
+  // being split on commas, because Plex encodes the comma that separates them.
+  for (const clause of filter.split(/[&|]/)) {
     const match = clause.trim().match(/^label(!?)=(.*)$/i);
 
     if (!match) {
       continue;
     }
 
-    const labels = match[2]
+    const labels = decodeLabel(match[2])
       .split(',')
       .map((label) => label.trim())
       .filter((label) => label.length > 0);
@@ -211,20 +232,26 @@ const mergeLabelFilters = (
   all: PlexLabelFilter,
   specific: PlexLabelFilter
 ): PlexLabelFilter => {
+  const deny = [...new Set([...all.deny, ...specific.deny])];
   let allow: string[];
+  let allowNothing = false;
 
   if (!all.allow.length) {
     allow = [...specific.allow];
   } else if (!specific.allow.length) {
     allow = [...all.allow];
   } else {
-    allow = all.allow.filter((label) => specific.allow.includes(label));
+    const specificLower = new Set(
+      specific.allow.map((label) => label.toLowerCase())
+    );
+    allow = all.allow.filter((label) => specificLower.has(label.toLowerCase()));
+
+    // Two allow lists sharing no label cannot both be satisfied. Treating the
+    // empty result as "no restriction" would grant access to everything.
+    allowNothing = allow.length === 0;
   }
 
-  return {
-    allow: [...new Set(allow)],
-    deny: [...new Set([...all.deny, ...specific.deny])],
-  };
+  return { allow: [...new Set(allow)], deny, allowNothing };
 };
 
 /**
@@ -235,6 +262,10 @@ export const isAllowedByLabelFilter = (
   filter: PlexLabelFilter,
   labels: string[]
 ): boolean => {
+  if (filter.allowNothing) {
+    return false;
+  }
+
   const normalized = labels.map((label) => label.toLowerCase());
 
   if (filter.deny.some((label) => normalized.includes(label.toLowerCase()))) {
diff --git a/server/lib/librarysharing.ts b/server/lib/librarysharing.ts
index 74c7a093e8..2bcf2e0364 100644
--- a/server/lib/librarysharing.ts
+++ b/server/lib/librarysharing.ts
@@ -25,13 +25,21 @@ interface CacheEntry {
 const CACHE_TTL_MS = 5 * 60 * 1000;
 const cache = new Map<number, CacheEntry>();
 
+/**
+ * Resolution takes several requests, so concurrent callers for the same user
+ * share the one in flight instead of each starting their own.
+ */
+const inFlight = new Map<number, Promise<VisibleMediaIds>>();
+
 export const clearLibrarySharingCache = (userId?: number): void => {
   if (userId === undefined) {
     cache.clear();
+    inFlight.clear();
     return;
   }
 
   cache.delete(userId);
+  inFlight.delete(userId);
 };
 
 const resolve = async (user: User): Promise<VisibleMediaIds> => {
@@ -55,19 +63,33 @@ export const getVisibleMediaIds = async (
     return cached.ids;
   }
 
-  try {
-    const ids = await resolve(user);
-    cache.set(user.id, { ids, expiresAt: Date.now() + CACHE_TTL_MS });
-    return ids;
-  } catch (e) {
-    logger.error('Failed to resolve media server sharing restrictions', {
-      label: 'Media Server Sharing',
-      userId: user.id,
-      errorMessage: e.message,
-    });
-    // Fail open: a transient media server error must not hide the whole library.
-    return null;
+  const pending = inFlight.get(user.id);
+
+  if (pending) {
+    return pending;
   }
+
+  const resolution = resolve(user)
+    .then((ids) => {
+      cache.set(user.id, { ids, expiresAt: Date.now() + CACHE_TTL_MS });
+      return ids;
+    })
+    .catch((e) => {
+      logger.error('Failed to resolve media server sharing restrictions', {
+        label: 'Media Server Sharing',
+        userId: user.id,
+        errorMessage: e.message,
+      });
+      // Fail open: a transient error must not hide the whole library.
+      return null;
+    })
+    .finally(() => {
+      inFlight.delete(user.id);
+    });
+
+  inFlight.set(user.id, resolution);
+
+  return resolution;
 };
 
 /**
diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
index 13e0cda37c..0e1175c20c 100644
--- a/server/lib/plexsharing.ts
+++ b/server/lib/plexsharing.ts
@@ -82,6 +82,13 @@ export const resolveVisiblePlexRatingKeys = async (
     }
 
     const filter = library.type === 'show' ? rules.tv : rules.movies;
+
+    if (filter.allowNothing) {
+      // The restrictions cannot be satisfied, so skip the library entirely
+      // rather than listing items only to discard them.
+      continue;
+    }
+
     const allowed = new Set<string>();
 
     if (filter.allow.length) {
@@ -182,8 +189,16 @@ export const grantLabelAccess = async (
   }
 
   const filter = type === 'show' ? rules.tv : rules.movies;
+
+  if (filter.allowNothing) {
+    return null;
+  }
+
+  // Case-insensitive, to match how the filter is evaluated: granting a label
+  // that the deny list then rejects would achieve nothing.
+  const denied = new Set(filter.deny.map((entry) => entry.toLowerCase()));
   const label = filter.allow.find(
-    (candidate) => !filter.deny.includes(candidate)
+    (candidate) => !denied.has(candidate.toLowerCase())
   );
 
   if (!label) {
diff --git a/server/subscriber/MediaRequestSubscriber.ts b/server/subscriber/MediaRequestSubscriber.ts
index a4ef4d6ded..18a6443079 100644
--- a/server/subscriber/MediaRequestSubscriber.ts
+++ b/server/subscriber/MediaRequestSubscriber.ts
@@ -184,57 +184,45 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
   }
 
   /**
-   * Media hidden from a user by Plex sharing restrictions is reported as
-   * unavailable to them, so they are able to request something the library
-   * already holds. Such a request must never be sent to Radarr or Sonarr, or
-   * the file would be downloaded a second time.
+   * Grants the requester access to media the library already holds, when the
+   * owner opted into it.
    *
-   * Returns `true` when the caller has to stop, and grants library access right
-   * away when the owner opted into it.
+   * A restricted user only sees such media as unavailable because the media
+   * server hides it from them, so the request is legitimate even though nothing
+   * has to be downloaded. Plex only, since it relies on labels.
    */
-  private async isAlreadyInLibrary(entity: MediaRequest): Promise<boolean> {
-    const status = entity.is4k ? entity.media.status4k : entity.media.status;
-    const ratingKey = entity.is4k
-      ? entity.media.ratingKey4k
-      : entity.media.ratingKey;
-
-    if (status !== MediaStatus.AVAILABLE || !ratingKey) {
-      return false;
-    }
-
+  private async grantLibraryAccessIfEnabled(
+    entity: MediaRequest,
+    media: Media
+  ): Promise<void> {
     const settings = getSettings();
+    const ratingKey = entity.is4k ? media.ratingKey4k : media.ratingKey;
 
-    logger.info(
-      'Request targets media already present in the library, skipping download',
-      {
-        label: 'Media Request',
-        requestId: entity.id,
-        mediaId: entity.media.id,
-        grantLabelOnApproval: !!settings.plex.grantLabelOnApproval,
-      }
-    );
+    if (
+      !settings.plex.grantLabelOnApproval ||
+      !ratingKey ||
+      !entity.requestedBy
+    ) {
+      return;
+    }
 
-    if (settings.plex.grantLabelOnApproval && entity.requestedBy) {
-      try {
-        const granted = await grantLabelAccess(entity.requestedBy, {
-          ratingKey,
-          type: entity.type === MediaType.MOVIE ? 'movie' : 'show',
-        });
+    try {
+      const granted = await grantLabelAccess(entity.requestedBy, {
+        ratingKey,
+        type: entity.type === MediaType.MOVIE ? 'movie' : 'show',
+      });
 
-        if (granted) {
-          // The user's visible set just changed, so drop the cached copy.
-          clearLibrarySharingCache(entity.requestedBy.id);
-        }
-      } catch (e) {
-        logger.error('Failed to grant Plex library access for request', {
-          label: 'Media Request',
-          requestId: entity.id,
-          errorMessage: e.message,
-        });
+      if (granted) {
+        // The user's visible set just changed, so drop the cached copy.
+        clearLibrarySharingCache(entity.requestedBy.id);
       }
+    } catch (e) {
+      logger.error('Failed to grant media server library access for request', {
+        label: 'Media Request',
+        requestId: entity.id,
+        errorMessage: e.message,
+      });
     }
-
-    return true;
   }
 
   public async sendToRadarr(
@@ -245,10 +233,6 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
       entity.status === MediaRequestStatus.APPROVED &&
       entity.type === MediaType.MOVIE
     ) {
-      if (await this.isAlreadyInLibrary(entity)) {
-        return;
-      }
-
       try {
         const mediaRepository = manager.getRepository(Media);
         const settings = getSettings();
@@ -366,6 +350,10 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
             mediaId: entity.media.id,
           });
 
+          // The requester may only be seeing this as unavailable because the
+          // media server hides it from them, so optionally grant them access.
+          await this.grantLibraryAccessIfEnabled(entity, media);
+
           const requestRepository = manager.getRepository(MediaRequest);
           entity.status = MediaRequestStatus.COMPLETED;
           await requestRepository.save(entity);
@@ -548,10 +536,6 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
       entity.status === MediaRequestStatus.APPROVED &&
       entity.type === MediaType.TV
     ) {
-      if (await this.isAlreadyInLibrary(entity)) {
-        return;
-      }
-
       try {
         const mediaRepository = manager.getRepository(Media);
         const settings = getSettings();
@@ -622,6 +606,10 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
             mediaId: entity.media.id,
           });
 
+          // The requester may only be seeing this as unavailable because the
+          // media server hides it from them, so optionally grant them access.
+          await this.grantLibraryAccessIfEnabled(entity, media);
+
           const requestRepository = manager.getRepository(MediaRequest);
           entity.status = MediaRequestStatus.COMPLETED;
           entity.seasons.forEach((season) => {

From 8a802e63fce96a953d53786212b890409cb974ce Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 19:05:27 +0200
Subject: [PATCH 05/19] fix(media): drop deep links for restricted media

Play links are built from the media server id in an @AfterLoad hook, which
runs regardless of status, so downgrading availability was not enough: a
restricted user was still handed a working "Play on Plex" button for media
they cannot open. Clear mediaUrl and iOSPlexUrl, 4k included, whenever an
item is hidden.
---
 server/entity/Media.ts | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/server/entity/Media.ts b/server/entity/Media.ts
index 4207c125cd..b2d1154ab5 100644
--- a/server/entity/Media.ts
+++ b/server/entity/Media.ts
@@ -111,12 +111,25 @@ class Media {
       const hidden = isHidden(id);
       const hidden4k = isHidden(id4k);
 
-      if (isAvailable(item.status) && hidden) {
-        item.status = MediaStatus.UNKNOWN;
+      if (hidden) {
+        if (isAvailable(item.status)) {
+          item.status = MediaStatus.UNKNOWN;
+        }
+
+        // Deep links are built from the media server id regardless of status,
+        // so they have to be dropped as well: a restricted user must not be
+        // handed a working "play" link to media they cannot open.
+        item.mediaUrl = undefined;
+        item.iOSPlexUrl = undefined;
       }
 
-      if (isAvailable(item.status4k) && hidden4k) {
-        item.status4k = MediaStatus.UNKNOWN;
+      if (hidden4k) {
+        if (isAvailable(item.status4k)) {
+          item.status4k = MediaStatus.UNKNOWN;
+        }
+
+        item.mediaUrl4k = undefined;
+        item.iOSPlexUrl4k = undefined;
       }
 
       // Seasons carry their own status, which the UI displays independently of

From 552c4db7e0b912e113b19059fd038f44e35ffafe Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 19:20:11 +0200
Subject: [PATCH 06/19] fix(requests): apply library restrictions to request
 media

Requests load their media eagerly, so the requests list and the single
request route returned it untouched by the filtering done in the Media
finders. A restricted user saw hidden media reported as available there,
with a working play link, while the detail page correctly reported it as
unknown.
---
 server/routes/request.ts | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/server/routes/request.ts b/server/routes/request.ts
index fafa90692e..09b90a8160 100644
--- a/server/routes/request.ts
+++ b/server/routes/request.ts
@@ -29,6 +29,31 @@ import { Router } from 'express';
 
 const requestRoutes = Router();
 
+/**
+ * Applies the requesting user's media server restrictions to the media carried
+ * by requests.
+ *
+ * Requests load their media eagerly, which bypasses the filtering done by the
+ * `Media` finders, so it has to be applied here as well. Without this the
+ * requests list reports media hidden from the user as available, and hands them
+ * a deep link they cannot open.
+ */
+const hideRestrictedMedia = async (
+  user: User | undefined,
+  requests: MediaRequest[]
+): Promise<void> => {
+  if (!user) {
+    return;
+  }
+
+  await Media.applySharingRestrictions(
+    user,
+    requests
+      .map((request) => request.media)
+      .filter((media): media is Media => !!media)
+  );
+};
+
 requestRoutes.get<Record<string, unknown>, RequestResultsResponse>(
   '/',
   async (req, res, next) => {
@@ -181,6 +206,8 @@ requestRoutes.get<Record<string, unknown>, RequestResultsResponse>(
         .skip(skip)
         .getManyAndCount();
 
+      await hideRestrictedMedia(req.user, requests);
+
       const settings = getSettings();
 
       // get all quality profiles for every configured sonarr server
@@ -447,6 +474,8 @@ requestRoutes.get('/:requestId', async (req, res, next) => {
       });
     }
 
+    await hideRestrictedMedia(req.user, [request]);
+
     return res.status(200).json(request);
   } catch (e) {
     logger.debug('Failed to retrieve request.', {

From a00bc311922c5902d78d3a866940fa57ee22c057 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 19:35:47 +0200
Subject: [PATCH 07/19] fix(plex): grant the most exclusive label a user is
 allowed to see

A label is a shared bucket rather than a per-user permission, so applying
the first one of the allow list handed the item to every other user allowed
to see that label. On my server a user restricted to five labels was granted
the one shared with another user, exposing the movie to them as well.

The label the fewest other restricted users can see now wins, and a label
named after the user breaks ties, which is the usual convention. Unrestricted
users are not counted, since they already see the item whatever label it
carries, and the count of users the grant widens access to is logged.
---
 server/api/plextv.ts           | 203 ++++++++++++++++++++-------------
 server/lib/plexsharing.test.ts |  63 ++++++++++
 server/lib/plexsharing.ts      |  99 ++++++++++++++--
 3 files changed, 277 insertions(+), 88 deletions(-)
 create mode 100644 server/lib/plexsharing.test.ts

diff --git a/server/api/plextv.ts b/server/api/plextv.ts
index 2b418c5f51..fac946e1b9 100644
--- a/server/api/plextv.ts
+++ b/server/api/plextv.ts
@@ -127,34 +127,36 @@ export interface PlexLabelFilter {
   allowNothing?: boolean;
 }
 
+interface PlexSharedServer {
+  $: {
+    id: string;
+    username: string;
+    email: string;
+    userID: string;
+    machineIdentifier?: string;
+    allLibraries?: string;
+    owned?: string;
+    filterAll?: string;
+    filterMovies?: string;
+    filterTelevision?: string;
+    filterMusic?: string;
+    filterPhotos?: string;
+  };
+  Section?: {
+    $: {
+      id: string;
+      /** Library section key on the server itself, e.g. `1`. */
+      key: string;
+      title: string;
+      type: string;
+      shared: string;
+    };
+  }[];
+}
+
 interface SharedServersResponse {
   MediaContainer: {
-    SharedServer?: {
-      $: {
-        id: string;
-        username: string;
-        email: string;
-        userID: string;
-        machineIdentifier?: string;
-        allLibraries?: string;
-        owned?: string;
-        filterAll?: string;
-        filterMovies?: string;
-        filterTelevision?: string;
-        filterMusic?: string;
-        filterPhotos?: string;
-      };
-      Section?: {
-        $: {
-          id: string;
-          /** Library section key on the server itself, e.g. `1`. */
-          key: string;
-          title: string;
-          type: string;
-          shared: string;
-        };
-      }[];
-    }[];
+    SharedServer?: PlexSharedServer[];
   };
 }
 
@@ -173,6 +175,43 @@ export interface PlexUserSharingRules {
 
 const EMPTY_LABEL_FILTER: PlexLabelFilter = { allow: [], deny: [] };
 
+/**
+ * Turns a `shared_servers` entry into the restrictions that apply to that user,
+ * or `null` when none do.
+ */
+const parseSharingRules = (
+  sharedServer: PlexSharedServer
+): PlexUserSharingRules | null => {
+  const all = parsePlexLabelFilter(sharedServer.$.filterAll);
+  const movies = mergeLabelFilters(
+    all,
+    parsePlexLabelFilter(sharedServer.$.filterMovies)
+  );
+  const tv = mergeLabelFilters(
+    all,
+    parsePlexLabelFilter(sharedServer.$.filterTelevision)
+  );
+
+  const allLibraries = sharedServer.$.allLibraries === '1';
+  const sharedSectionKeys = allLibraries
+    ? []
+    : (sharedServer.Section ?? [])
+        .filter((section) => section.$.shared === '1')
+        .map((section) => section.$.key);
+
+  const hasLabelRestrictions =
+    movies.allow.length > 0 ||
+    movies.deny.length > 0 ||
+    tv.allow.length > 0 ||
+    tv.deny.length > 0;
+
+  if (allLibraries && !hasLabelRestrictions) {
+    return null;
+  }
+
+  return { allLibraries, sharedSectionKeys, movies, tv };
+};
+
 /**
  * Decodes a single restriction value. Plex url encodes them, but a malformed
  * sequence must not turn parsing a filter into an exception.
@@ -461,65 +500,16 @@ class PlexTvAPI extends ExternalAPI {
   public async getUserSharingRules(
     plexUserId: number
   ): Promise<PlexUserSharingRules | null> {
-    const settings = getSettings();
-
-    if (!settings.plex.machineId) {
-      return null;
-    }
-
     try {
-      // `shared_servers` exposes the filters *and* the shared sections in a
-      // single call, unlike `/api/users` which only reports a library count.
-      const response = await this.axios.get(
-        `/api/servers/${settings.plex.machineId}/shared_servers`,
-        {
-          transformResponse: [],
-          responseType: 'text',
-        }
-      );
-
-      const parsedXml = (await xml2js.parseStringPromise(
-        response.data
-      )) as SharedServersResponse;
-
-      const sharedServer = parsedXml.MediaContainer.SharedServer?.find(
-        (s) => parseInt(s.$.userID) === plexUserId
-      );
+      const sharedServers = await this.getSharedServers();
 
       // No entry means the library is not shared with this user at all; that
       // case is handled by checkUserAccess() rather than by filtering here.
-      if (!sharedServer) {
-        return null;
-      }
-
-      const all = parsePlexLabelFilter(sharedServer.$.filterAll);
-      const movies = mergeLabelFilters(
-        all,
-        parsePlexLabelFilter(sharedServer.$.filterMovies)
-      );
-      const tv = mergeLabelFilters(
-        all,
-        parsePlexLabelFilter(sharedServer.$.filterTelevision)
+      const sharedServer = sharedServers?.find(
+        (s) => parseInt(s.$.userID) === plexUserId
       );
 
-      const allLibraries = sharedServer.$.allLibraries === '1';
-      const sharedSectionKeys = allLibraries
-        ? []
-        : (sharedServer.Section ?? [])
-            .filter((section) => section.$.shared === '1')
-            .map((section) => section.$.key);
-
-      const hasLabelRestrictions =
-        movies.allow.length > 0 ||
-        movies.deny.length > 0 ||
-        tv.allow.length > 0 ||
-        tv.deny.length > 0;
-
-      if (allLibraries && !hasLabelRestrictions) {
-        return null;
-      }
-
-      return { allLibraries, sharedSectionKeys, movies, tv };
+      return sharedServer ? parseSharingRules(sharedServer) : null;
     } catch (e) {
       logger.error('Failed to retrieve Plex sharing rules for user', {
         label: 'Plex.tv API',
@@ -530,6 +520,61 @@ class PlexTvAPI extends ExternalAPI {
     }
   }
 
+  /**
+   * Returns the sharing rules of every restricted user, keyed by Plex user id.
+   *
+   * Needed to tell how exclusive a label is before granting it: a label several
+   * users are allowed to see cannot be used to give access to one of them
+   * alone. Unrestricted users are left out, since they already see everything
+   * and applying a label changes nothing for them.
+   */
+  public async getAllUserSharingRules(): Promise<
+    Map<number, PlexUserSharingRules>
+  > {
+    const rulesByUserId = new Map<number, PlexUserSharingRules>();
+
+    try {
+      for (const sharedServer of (await this.getSharedServers()) ?? []) {
+        const rules = parseSharingRules(sharedServer);
+
+        if (rules) {
+          rulesByUserId.set(parseInt(sharedServer.$.userID), rules);
+        }
+      }
+    } catch (e) {
+      logger.error('Failed to retrieve Plex sharing rules', {
+        label: 'Plex.tv API',
+        errorMessage: e.message,
+      });
+    }
+
+    return rulesByUserId;
+  }
+
+  private async getSharedServers(): Promise<PlexSharedServer[] | undefined> {
+    const settings = getSettings();
+
+    if (!settings.plex.machineId) {
+      return undefined;
+    }
+
+    // `shared_servers` exposes the filters *and* the shared sections in a
+    // single call, unlike `/api/users` which only reports a library count.
+    const response = await this.axios.get(
+      `/api/servers/${settings.plex.machineId}/shared_servers`,
+      {
+        transformResponse: [],
+        responseType: 'text',
+      }
+    );
+
+    const parsedXml = (await xml2js.parseStringPromise(
+      response.data
+    )) as SharedServersResponse;
+
+    return parsedXml.MediaContainer.SharedServer;
+  }
+
   public async getWatchlist({
     offset = 0,
     size = 20,
diff --git a/server/lib/plexsharing.test.ts b/server/lib/plexsharing.test.ts
new file mode 100644
index 0000000000..87480748ca
--- /dev/null
+++ b/server/lib/plexsharing.test.ts
@@ -0,0 +1,63 @@
+import { pickGrantLabel } from '@server/lib/plexsharing';
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+const sharedWith = (counts: Record<string, number>): Map<string, number> =>
+  new Map(Object.entries(counts));
+
+describe('pickGrantLabel', () => {
+  it('prefers the label no other user is allowed to see', () => {
+    assert.deepEqual(
+      pickGrantLabel(
+        ['Famille', 'Nico', 'cedric2605'],
+        ['cedric2605'],
+        sharedWith({ famille: 2, nico: 1 })
+      ),
+      { label: 'cedric2605', alsoVisibleTo: 0 }
+    );
+  });
+
+  it('breaks ties between exclusive labels on the user name', () => {
+    assert.deepEqual(
+      pickGrantLabel(
+        ['brunocarrer', 'nikaii', 'cedric2605'],
+        ['cedric2605'],
+        sharedWith({})
+      ),
+      { label: 'cedric2605', alsoVisibleTo: 0 }
+    );
+  });
+
+  it('falls back to the least shared label when none is exclusive', () => {
+    assert.deepEqual(
+      pickGrantLabel(
+        ['Famille', 'Nico'],
+        ['cedric2605'],
+        sharedWith({ famille: 2, nico: 1 })
+      ),
+      { label: 'Nico', alsoVisibleTo: 1 }
+    );
+  });
+
+  it('keeps the allow list order when nothing else separates the labels', () => {
+    assert.deepEqual(
+      pickGrantLabel(
+        ['Nico', 'Famille'],
+        [],
+        sharedWith({ nico: 1, famille: 1 })
+      ),
+      { label: 'Nico', alsoVisibleTo: 1 }
+    );
+  });
+
+  it('matches the user name case-insensitively', () => {
+    assert.deepEqual(
+      pickGrantLabel(['Famille', 'Cedric2605'], ['cedric2605'], sharedWith({})),
+      { label: 'Cedric2605', alsoVisibleTo: 0 }
+    );
+  });
+
+  it('returns null when there is no candidate', () => {
+    assert.equal(pickGrantLabel([], ['cedric2605'], sharedWith({})), null);
+  });
+});
diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
index 0e1175c20c..26f72963f6 100644
--- a/server/lib/plexsharing.ts
+++ b/server/lib/plexsharing.ts
@@ -1,4 +1,5 @@
 import PlexAPI from '@server/api/plexapi';
+import type { PlexUserSharingRules } from '@server/api/plextv';
 import PlexTvAPI from '@server/api/plextv';
 import { MediaServerType } from '@server/constants/server';
 import { UserType } from '@server/constants/user';
@@ -19,6 +20,48 @@ export interface PlexItemRef {
   type: 'movie' | 'show';
 }
 
+/**
+ * Picks which of the labels a user is allowed to see should be applied to grant
+ * them access to an item.
+ *
+ * A label is a shared bucket rather than a per-user permission: applying one
+ * that other restricted users are also allowed to see hands them the item too.
+ * So the label the fewest other users can see wins, and a label named after the
+ * user breaks ties, since naming a label after its user is the usual
+ * convention. Ordering is otherwise stable, to keep the choice predictable.
+ *
+ * `sharedWithCount` maps a lowercased label to the number of *other* restricted
+ * users allowed to see it. Unrestricted users are not counted: they already see
+ * the item whatever label it carries.
+ */
+export const pickGrantLabel = (
+  candidates: string[],
+  preferredNames: string[],
+  sharedWithCount: Map<string, number>
+): { label: string; alsoVisibleTo: number } | null => {
+  const names = new Set(
+    preferredNames.filter(Boolean).map((name) => name.toLowerCase())
+  );
+
+  const ranked = candidates
+    .map((label, index) => ({
+      label,
+      index,
+      alsoVisibleTo: sharedWithCount.get(label.toLowerCase()) ?? 0,
+      matchesName: names.has(label.toLowerCase()),
+    }))
+    .sort(
+      (a, b) =>
+        a.alsoVisibleTo - b.alsoVisibleTo ||
+        Number(b.matchesName) - Number(a.matchesName) ||
+        a.index - b.index
+    );
+
+  const best = ranked[0];
+
+  return best ? { label: best.label, alsoVisibleTo: best.alsoVisibleTo } : null;
+};
+
 const getAdminPlexToken = async (): Promise<string | null> => {
   const userRepository = getRepository(User);
   const admin = await userRepository.findOne({
@@ -180,15 +223,17 @@ export const grantLabelAccess = async (
     return null;
   }
 
-  const rules = await new PlexTvAPI(adminToken).getUserSharingRules(
-    user.plexId
-  );
+  const plexTvClient = new PlexTvAPI(adminToken);
+  const rulesByPlexUserId = await plexTvClient.getAllUserSharingRules();
+  const rules = rulesByPlexUserId.get(user.plexId);
 
   if (!rules) {
     return null;
   }
 
-  const filter = type === 'show' ? rules.tv : rules.movies;
+  const filterOf = (candidate: PlexUserSharingRules) =>
+    type === 'show' ? candidate.tv : candidate.movies;
+  const filter = filterOf(rules);
 
   if (filter.allowNothing) {
     return null;
@@ -197,22 +242,58 @@ export const grantLabelAccess = async (
   // Case-insensitive, to match how the filter is evaluated: granting a label
   // that the deny list then rejects would achieve nothing.
   const denied = new Set(filter.deny.map((entry) => entry.toLowerCase()));
-  const label = filter.allow.find(
+  const candidates = filter.allow.filter(
     (candidate) => !denied.has(candidate.toLowerCase())
   );
 
-  if (!label) {
+  // How many other restricted users each candidate label would also expose the
+  // item to, so the most exclusive one can be preferred.
+  const sharedWithCount = new Map<string, number>();
+
+  for (const [plexUserId, otherRules] of rulesByPlexUserId) {
+    if (plexUserId === user.plexId) {
+      continue;
+    }
+
+    const otherFilter = filterOf(otherRules);
+    const otherDenied = new Set(
+      otherFilter.deny.map((entry) => entry.toLowerCase())
+    );
+
+    for (const allowed of otherFilter.allow) {
+      const key = allowed.toLowerCase();
+
+      if (!otherDenied.has(key)) {
+        sharedWithCount.set(key, (sharedWithCount.get(key) ?? 0) + 1);
+      }
+    }
+  }
+
+  const picked = pickGrantLabel(
+    candidates,
+    [user.plexUsername, user.username].filter((name): name is string => !!name),
+    sharedWithCount
+  );
+
+  if (!picked) {
     return null;
   }
 
-  await new PlexAPI({ plexToken: adminToken }).addLabel(ratingKey, type, label);
+  await new PlexAPI({ plexToken: adminToken }).addLabel(
+    ratingKey,
+    type,
+    picked.label
+  );
 
   logger.info('Granted Plex library access by adding a label', {
     label: 'Plex Sharing',
     userId: user.id,
     ratingKey,
-    plexLabel: label,
+    plexLabel: picked.label,
+    // Worth surfacing: no label is exclusive to a single user in every setup,
+    // so the owner should know when granting access widens it to others.
+    alsoVisibleToOtherUsers: picked.alsoVisibleTo,
   });
 
-  return label;
+  return picked.label;
 };

From 009cbed419c0be5ad43b600a2bc4119d484a22ce Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 19:49:06 +0200
Subject: [PATCH 08/19] docs(settings): describe which label the grant setting
 applies

The description said one of the allowed labels was added, which was accurate
when the first of the list was used. It now says which one, since the label
the fewest other users can see is picked. English only, the key is new and
Weblate owns the other locales.
---
 src/components/Settings/SettingsPlex.tsx | 2 +-
 src/i18n/locale/en.json                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/components/Settings/SettingsPlex.tsx b/src/components/Settings/SettingsPlex.tsx
index c705ea7ddb..42f14edb2b 100644
--- a/src/components/Settings/SettingsPlex.tsx
+++ b/src/components/Settings/SettingsPlex.tsx
@@ -72,7 +72,7 @@ const messages = defineMessages('components.Settings', {
     'Optionally direct users to the web app on your server instead of https://app.plex.tv/desktop',
   grantLabelOnApproval: 'Grant Library Access on Approval',
   grantLabelOnApprovalTip:
-    'When a user restricted by labels requests media already in your library, add one of their allowed labels to it instead of leaving the request for you to handle manually',
+    'When a user restricted by labels requests media already in your library, grant them access by adding the label the fewest other users can see, instead of leaving the request for you to handle manually',
   tautulliSettings: 'Tautulli Settings',
   tautulliSettingsDescription:
     'Optionally configure the settings for your Tautulli server. Seerr fetches watch history data for your Plex media from Tautulli.',
diff --git a/src/i18n/locale/en.json b/src/i18n/locale/en.json
index 58936f846d..a27f5d0a84 100644
--- a/src/i18n/locale/en.json
+++ b/src/i18n/locale/en.json
@@ -1205,7 +1205,7 @@
   "components.Settings.failedToSaveMetadataSettings": "Failed to save metadata provider settings",
   "components.Settings.general": "General",
   "components.Settings.grantLabelOnApproval": "Grant Library Access on Approval",
-  "components.Settings.grantLabelOnApprovalTip": "When a user restricted by labels requests media already in your library, add one of their allowed labels to it instead of leaving the request for you to handle manually",
+  "components.Settings.grantLabelOnApprovalTip": "When a user restricted by labels requests media already in your library, grant them access by adding the label the fewest other users can see, instead of leaving the request for you to handle manually",
   "components.Settings.hostname": "Hostname or IP Address",
   "components.Settings.importBlocklistedTagsTip": "Import blocklisted tag configuration",
   "components.Settings.invalidKeyword": "{keywordId} is not a TMDB keyword.",

From 4914b8b82c04e409e58ea93418a71a49ee5b1ae1 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 20:04:31 +0200
Subject: [PATCH 09/19] chore(plex): log the resolved visible item count

The Jellyfin resolver logs what it resolved for a user, the Plex one did not,
which makes a restriction that looks wrong hard to tell apart from a stale
cache entry.
---
 server/lib/plexsharing.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
index 26f72963f6..95d971b687 100644
--- a/server/lib/plexsharing.ts
+++ b/server/lib/plexsharing.ts
@@ -168,6 +168,12 @@ export const resolveVisiblePlexRatingKeys = async (
     }
   }
 
+  logger.debug('Resolved Plex library restrictions for user', {
+    label: 'Plex Sharing',
+    userId: user.id,
+    visibleItems: visible.size,
+  });
+
   return visible;
 };
 

From f9bc03d1a479c68c68c1e11894934ef27d44a00c Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 21:00:30 +0200
Subject: [PATCH 10/19] docs(jellyfin): correct the claim that access is per
 library only

Jellyfin and Emby both carry a tag based restriction next to the library
selection, the direct analogue of Plex labels, and both enforce it: a user
allowed a library but denied one of its tags is shown fewer items than the
library holds. Only the library dimension is implemented, so say so instead
of claiming the mechanism does not exist.
---
 server/lib/jellyfinsharing.ts | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/server/lib/jellyfinsharing.ts b/server/lib/jellyfinsharing.ts
index d5fffcb87a..ac4c98b832 100644
--- a/server/lib/jellyfinsharing.ts
+++ b/server/lib/jellyfinsharing.ts
@@ -10,11 +10,16 @@ import { getHostname } from '@server/utils/getHostname';
 /**
  * Builds the set of Jellyfin or Emby item ids visible to a user.
  *
- * Unlike Plex, access is granted per library only, there is no label based
- * restriction, and the allowed libraries are taken from the user's policy:
- * `EnableAllFolders` means unrestricted, otherwise `EnabledFolders` lists the
- * library ids the user may browse. Both servers report those fields on the user
- * list, so a single request covers every user.
+ * The allowed libraries are taken from the user's policy: `EnableAllFolders`
+ * means unrestricted, otherwise `EnabledFolders` lists the library ids the user
+ * may browse. Both servers report those fields on the user list, so a single
+ * request covers every user.
+ *
+ * Only that library dimension is handled here. Both servers carry a second,
+ * tag based mechanism which is the direct analogue of Plex labels, and which
+ * they do enforce: Jellyfin exposes `AllowedTags` and `BlockedTags` on the
+ * policy, Emby `IncludeTags`, `BlockedTags` and `IsTagBlockingModeInclusive`.
+ * A user restricted that way is still reported as having access here.
  *
  * Items are then listed with the owner's credentials, since neither server
  * honours a `userId` filter when queried with an administrator token: Jellyfin

From 95b112e9796aad92bfbd9f89b397167d7495670c Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 21:24:00 +0200
Subject: [PATCH 11/19] fix(emby): match library policy entries on the guid as
 well

Emby's user policy references libraries by their guid while the identifier
stored in the settings is the numeric one it returns elsewhere, so no
configured library ever matched a policy entry. That is not a partial
failure: with nothing matching, a restricted user was told the entire
library was unavailable, including the libraries Emby does grant them.

Jellyfin was unaffected, its library id already being the guid, which is
why this went unnoticed. Policy entries are now matched against either
identifier, so the same code covers both servers.
---
 server/api/jellyfin.ts        |  36 +++++++++++-
 server/lib/jellyfinsharing.ts | 103 ++++++++++++++++++++++++++++++++--
 2 files changed, 131 insertions(+), 8 deletions(-)

diff --git a/server/api/jellyfin.ts b/server/api/jellyfin.ts
index 6f6b3321e0..10925d425b 100644
--- a/server/api/jellyfin.ts
+++ b/server/api/jellyfin.ts
@@ -28,6 +28,20 @@ export interface JellyfinUserResponse {
     EnabledFolders?: string[];
     /** Legacy Emby counterpart of `EnabledFolders`. */
     BlockedMediaFolders?: string[];
+    /**
+     * Tag based restrictions, the counterpart of Plex labels. The two servers
+     * disagree on how they are expressed, which was established against real
+     * servers rather than taken from the documentation:
+     *
+     * - Jellyfin uses two independent lists, `AllowedTags` and `BlockedTags`,
+     *   and applies both, a denied tag winning over an allowed one.
+     * - Emby keeps a single list in `BlockedTags` whose polarity is flipped by
+     *   `IsTagBlockingModeInclusive`: false denies those tags, true allows only
+     *   those tags. Its `IncludeTags` field has no effect.
+     */
+    AllowedTags?: string[];
+    BlockedTags?: string[];
+    IsTagBlockingModeInclusive?: boolean;
   };
   PrimaryImageTag?: string;
 }
@@ -80,6 +94,12 @@ interface JellyfinMediaFolder {
   Id: string;
   Type: string;
   CollectionType: string;
+  /**
+   * Emby only. Its user policy references libraries by this value while `Id`
+   * stays numeric, so both have to be kept to match a policy entry. Jellyfin
+   * does not return it, its `Id` already being the guid.
+   */
+  Guid?: string;
 }
 
 export interface JellyfinLibrary {
@@ -87,6 +107,8 @@ export interface JellyfinLibrary {
   key: string;
   title: string;
   agent: string;
+  /** Emby's alternative identifier for the same library, see `JellyfinMediaFolder`. */
+  guid?: string;
 }
 
 export interface JellyfinLibraryItem {
@@ -103,6 +125,10 @@ export interface JellyfinLibraryItem {
   IndexNumberEnd?: number;
   ParentIndexNumber?: number;
   MediaType: string;
+  /** Only populated when requested through `fields`. Jellyfin answers with
+   * `Tags`, Emby with `TagItems`, so callers have to read both. */
+  Tags?: string[];
+  TagItems?: { Name: string }[];
 }
 
 export interface JellyfinMediaStream {
@@ -452,14 +478,20 @@ class JellyfinAPI extends ExternalAPI {
           title: Item.Name,
           type: Item.CollectionType === 'movies' ? 'movie' : 'show',
           agent: 'jellyfin',
+          guid: Item.Guid,
         };
       });
   }
 
-  public async getLibraryContents(id: string): Promise<JellyfinLibraryItem[]> {
+  public async getLibraryContents(
+    id: string,
+    { fields }: { fields?: string } = {}
+  ): Promise<JellyfinLibraryItem[]> {
     try {
       const libraryItemsResponse = await this.get<any>(
-        `/Items?SortBy=SortName&SortOrder=Ascending&IncludeItemTypes=Series,Movie,Others&Recursive=true&StartIndex=0&ParentId=${id}&collapseBoxSetItems=false`
+        `/Items?SortBy=SortName&SortOrder=Ascending&IncludeItemTypes=Series,Movie,Others&Recursive=true&StartIndex=0&ParentId=${id}&collapseBoxSetItems=false${
+          fields ? `&Fields=${fields}` : ''
+        }`
       );
 
       return libraryItemsResponse.Items.filter(
diff --git a/server/lib/jellyfinsharing.ts b/server/lib/jellyfinsharing.ts
index ac4c98b832..15237d7f5a 100644
--- a/server/lib/jellyfinsharing.ts
+++ b/server/lib/jellyfinsharing.ts
@@ -1,9 +1,15 @@
+import type {
+  JellyfinLibraryItem,
+  JellyfinUserResponse,
+} from '@server/api/jellyfin';
 import JellyfinAPI from '@server/api/jellyfin';
 import { MediaServerType } from '@server/constants/server';
 import { UserType } from '@server/constants/user';
 import { getRepository } from '@server/datasource';
 import { User } from '@server/entity/User';
 import { getSettings } from '@server/lib/settings';
+import type { TagRestriction } from '@server/lib/tagrestrictions';
+import { isAllowedByTagRestriction } from '@server/lib/tagrestrictions';
 import logger from '@server/logger';
 import { getHostname } from '@server/utils/getHostname';
 
@@ -29,6 +35,62 @@ import { getHostname } from '@server/utils/getHostname';
  * Returns `null` when the user reaches every enabled library, which callers
  * must treat as "no filtering".
  */
+/**
+ * Normalises the tag restrictions of a user policy, whose shape differs between
+ * the two servers. Both behaviours were established against real servers:
+ * Jellyfin applies `AllowedTags` and `BlockedTags` independently, while Emby
+ * keeps a single list in `BlockedTags` that `IsTagBlockingModeInclusive` turns
+ * from a deny list into an allow list.
+ */
+export const parseTagRestriction = (
+  policy: JellyfinUserResponse['Policy'],
+  serverType: MediaServerType
+): TagRestriction => {
+  const blocked = policy.BlockedTags ?? [];
+
+  if (serverType === MediaServerType.EMBY) {
+    return policy.IsTagBlockingModeInclusive
+      ? { allow: [...blocked], deny: [] }
+      : { allow: [], deny: [...blocked] };
+  }
+
+  return { allow: [...(policy.AllowedTags ?? [])], deny: [...blocked] };
+};
+
+/** Jellyfin reports item tags as `Tags`, Emby as `TagItems`. */
+const getItemTags = (item: JellyfinLibraryItem): string[] =>
+  item.Tags ?? item.TagItems?.map((tag) => tag.Name) ?? [];
+
+/**
+ * Builds the test telling whether a configured library is shared with the user.
+ *
+ * Emby's policy references libraries by their guid while the id stored in the
+ * settings is the numeric one it returns elsewhere, so a policy entry has to be
+ * matched against either identifier. Getting this wrong is not a partial
+ * failure: no library matches and the whole library reads as unavailable.
+ */
+const buildLibraryMatcher = async (
+  client: JellyfinAPI,
+  policy: JellyfinUserResponse['Policy']
+): Promise<(library: { id: string }) => boolean> => {
+  const allowedFolders = new Set(policy.EnabledFolders ?? []);
+  const guidById = new Map(
+    (await client.getLibraries())
+      .filter((library) => library.guid)
+      .map((library) => [library.key, library.guid as string])
+  );
+
+  return (library) => {
+    if (allowedFolders.has(library.id)) {
+      return true;
+    }
+
+    const guid = guidById.get(library.id);
+
+    return !!guid && allowedFolders.has(guid);
+  };
+};
+
 export const resolveVisibleJellyfinItemIds = async (
   user: User
 ): Promise<Set<string> | null> => {
@@ -68,28 +130,56 @@ export const resolveVisibleJellyfinItemIds = async (
 
   // Without a policy there is nothing to enforce; leave availability untouched
   // rather than risk hiding a library the user can actually reach.
-  if (!policy || policy.EnableAllFolders !== false) {
+  if (!policy) {
+    return null;
+  }
+
+  const tagRestriction = parseTagRestriction(
+    policy,
+    settings.main.mediaServerType
+  );
+  const hasTagRestrictions =
+    tagRestriction.allow.length > 0 || tagRestriction.deny.length > 0;
+  const reachesEveryLibrary = policy.EnableAllFolders !== false;
+
+  if (reachesEveryLibrary && !hasTagRestrictions) {
     return null;
   }
 
-  const allowedLibraryIds = new Set(policy.EnabledFolders ?? []);
   const enabled = settings.jellyfin.libraries.filter(
     (library) => library.enabled
   );
+  const isLibraryAllowed = reachesEveryLibrary
+    ? () => true
+    : await buildLibraryMatcher(client, policy);
 
-  if (enabled.every((library) => allowedLibraryIds.has(library.id))) {
+  if (enabled.every(isLibraryAllowed) && !hasTagRestrictions) {
     return null;
   }
 
   const visible = new Set<string>();
 
   for (const library of enabled) {
-    if (!allowedLibraryIds.has(library.id)) {
+    if (!isLibraryAllowed(library)) {
       // Library not shared with this user: nothing from it is visible.
       continue;
     }
 
-    for (const item of await client.getLibraryContents(library.id)) {
+    // Tags are only requested when they can change the outcome, since both
+    // servers return a long list of metadata keywords under the same field.
+    const items = await client.getLibraryContents(
+      library.id,
+      hasTagRestrictions ? { fields: 'Tags,TagItems' } : {}
+    );
+
+    for (const item of items) {
+      if (
+        hasTagRestrictions &&
+        !isAllowedByTagRestriction(tagRestriction, getItemTags(item))
+      ) {
+        continue;
+      }
+
       visible.add(item.Id);
     }
   }
@@ -98,8 +188,9 @@ export const resolveVisibleJellyfinItemIds = async (
     label: 'Media Server Sharing',
     userId: user.id,
     allowedLibraries: enabled
-      .filter((library) => allowedLibraryIds.has(library.id))
+      .filter(isLibraryAllowed)
       .map((library) => library.name),
+    tagRestriction: hasTagRestrictions ? tagRestriction : undefined,
     visibleItems: visible.size,
   });
 

From d72a015431ff41179d51e1cf746bd1ec4ce18a33 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Sun, 26 Jul 2026 21:24:00 +0200
Subject: [PATCH 12/19] feat(jellyfin,emby): honour tag restrictions alongside
 library access

Both servers carry a tag based restriction next to the library selection,
the direct analogue of Plex labels, and both enforce it. Availability was
computed from the library selection alone, so a user denied a tag was still
told the items carrying it were available, with a working play link.

The two servers express it differently, which was established against real
servers rather than taken from the documentation: Jellyfin applies
`AllowedTags` and `BlockedTags` independently, a denied tag winning over an
allowed one, while Emby keeps a single list in `BlockedTags` whose polarity
`IsTagBlockingModeInclusive` flips, and ignores its own `IncludeTags`.

Both are normalised into the allow/deny shape already used for Plex labels,
so the matching rule now lives in one place instead of once per server.
Tags are only requested when they can change the outcome, since both
servers return metadata keywords under the same field. A user restricted by
tags alone is no longer skipped, which the previous early return did.
---
 server/api/plextv.ts               | 19 +--------
 server/lib/jellyfinsharing.test.ts | 63 ++++++++++++++++++++++++++++++
 server/lib/tagrestrictions.test.ts | 62 +++++++++++++++++++++++++++++
 server/lib/tagrestrictions.ts      | 50 ++++++++++++++++++++++++
 4 files changed, 177 insertions(+), 17 deletions(-)
 create mode 100644 server/lib/jellyfinsharing.test.ts
 create mode 100644 server/lib/tagrestrictions.test.ts
 create mode 100644 server/lib/tagrestrictions.ts

diff --git a/server/api/plextv.ts b/server/api/plextv.ts
index fac946e1b9..34f3545a18 100644
--- a/server/api/plextv.ts
+++ b/server/api/plextv.ts
@@ -1,6 +1,7 @@
 import type { PlexDevice } from '@server/interfaces/api/plexInterfaces';
 import cacheManager from '@server/lib/cache';
 import { getSettings } from '@server/lib/settings';
+import { isAllowedByTagRestriction } from '@server/lib/tagrestrictions';
 import logger from '@server/logger';
 import { randomUUID } from 'node:crypto';
 import xml2js from 'xml2js';
@@ -300,23 +301,7 @@ const mergeLabelFilters = (
 export const isAllowedByLabelFilter = (
   filter: PlexLabelFilter,
   labels: string[]
-): boolean => {
-  if (filter.allowNothing) {
-    return false;
-  }
-
-  const normalized = labels.map((label) => label.toLowerCase());
-
-  if (filter.deny.some((label) => normalized.includes(label.toLowerCase()))) {
-    return false;
-  }
-
-  if (!filter.allow.length) {
-    return true;
-  }
-
-  return filter.allow.some((label) => normalized.includes(label.toLowerCase()));
-};
+): boolean => isAllowedByTagRestriction(filter, labels);
 
 interface WatchlistResponse {
   MediaContainer: {
diff --git a/server/lib/jellyfinsharing.test.ts b/server/lib/jellyfinsharing.test.ts
new file mode 100644
index 0000000000..fd5f5b8435
--- /dev/null
+++ b/server/lib/jellyfinsharing.test.ts
@@ -0,0 +1,63 @@
+import type { JellyfinUserResponse } from '@server/api/jellyfin';
+import { MediaServerType } from '@server/constants/server';
+import { parseTagRestriction } from '@server/lib/jellyfinsharing';
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+type Policy = JellyfinUserResponse['Policy'];
+
+const policy = (fields: Partial<Policy>): Policy =>
+  ({ IsAdministrator: false, ...fields }) as Policy;
+
+describe('parseTagRestriction', () => {
+  describe('Jellyfin', () => {
+    const parse = (fields: Partial<Policy>) =>
+      parseTagRestriction(policy(fields), MediaServerType.JELLYFIN);
+
+    it('reads the two lists independently', () => {
+      assert.deepEqual(
+        parse({ AllowedTags: ['Family'], BlockedTags: ['Private'] }),
+        { allow: ['Family'], deny: ['Private'] }
+      );
+    });
+
+    it('returns an empty restriction when the policy carries no tag', () => {
+      assert.deepEqual(parse({}), { allow: [], deny: [] });
+    });
+
+    it('ignores the Emby inclusive flag', () => {
+      // The flag exists on Jellyfin policies too but has no meaning there, so
+      // reading it would silently turn a deny list into an allow list.
+      assert.deepEqual(
+        parse({ BlockedTags: ['Private'], IsTagBlockingModeInclusive: true }),
+        { allow: [], deny: ['Private'] }
+      );
+    });
+  });
+
+  describe('Emby', () => {
+    const parse = (fields: Partial<Policy>) =>
+      parseTagRestriction(policy(fields), MediaServerType.EMBY);
+
+    it('treats the single list as a deny list by default', () => {
+      assert.deepEqual(
+        parse({ BlockedTags: ['Private'], IsTagBlockingModeInclusive: false }),
+        { allow: [], deny: ['Private'] }
+      );
+    });
+
+    it('turns the same list into an allow list in inclusive mode', () => {
+      assert.deepEqual(
+        parse({ BlockedTags: ['Family'], IsTagBlockingModeInclusive: true }),
+        { allow: ['Family'], deny: [] }
+      );
+    });
+
+    it('ignores AllowedTags, which Emby does not use', () => {
+      assert.deepEqual(parse({ AllowedTags: ['Family'] }), {
+        allow: [],
+        deny: [],
+      });
+    });
+  });
+});
diff --git a/server/lib/tagrestrictions.test.ts b/server/lib/tagrestrictions.test.ts
new file mode 100644
index 0000000000..f1b61092d4
--- /dev/null
+++ b/server/lib/tagrestrictions.test.ts
@@ -0,0 +1,62 @@
+import { isAllowedByTagRestriction } from '@server/lib/tagrestrictions';
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+
+describe('isAllowedByTagRestriction', () => {
+  it('allows everything when no restriction applies', () => {
+    assert.equal(
+      isAllowedByTagRestriction({ allow: [], deny: [] }, ['anything']),
+      true
+    );
+    assert.equal(isAllowedByTagRestriction({ allow: [], deny: [] }, []), true);
+  });
+
+  it('denies an item carrying a denied tag', () => {
+    assert.equal(
+      isAllowedByTagRestriction({ allow: [], deny: ['Private'] }, ['Private']),
+      false
+    );
+    assert.equal(
+      isAllowedByTagRestriction({ allow: [], deny: ['Private'] }, ['Family']),
+      true
+    );
+  });
+
+  it('requires one of the allowed tags when an allow list applies', () => {
+    const restriction = { allow: ['Family'], deny: [] };
+
+    assert.equal(isAllowedByTagRestriction(restriction, ['Family']), true);
+    assert.equal(isAllowedByTagRestriction(restriction, ['Other']), false);
+    assert.equal(isAllowedByTagRestriction(restriction, []), false);
+  });
+
+  it('lets a denied tag win over an allowed one', () => {
+    // Matches what both Plex and Jellyfin do when the same tag is on both
+    // lists: nothing carrying it is visible, and nothing without it satisfies
+    // the allow list either.
+    const restriction = { allow: ['Shared'], deny: ['Shared'] };
+
+    assert.equal(isAllowedByTagRestriction(restriction, ['Shared']), false);
+    assert.equal(isAllowedByTagRestriction(restriction, ['Other']), false);
+  });
+
+  it('compares tags case-insensitively', () => {
+    assert.equal(
+      isAllowedByTagRestriction({ allow: ['family'], deny: [] }, ['Family']),
+      true
+    );
+    assert.equal(
+      isAllowedByTagRestriction({ allow: [], deny: ['PRIVATE'] }, ['private']),
+      false
+    );
+  });
+
+  it('shows nothing when the restriction is unsatisfiable', () => {
+    assert.equal(
+      isAllowedByTagRestriction({ allow: [], deny: [], allowNothing: true }, [
+        'Family',
+      ]),
+      false
+    );
+  });
+});
diff --git a/server/lib/tagrestrictions.ts b/server/lib/tagrestrictions.ts
new file mode 100644
index 0000000000..0599f594d6
--- /dev/null
+++ b/server/lib/tagrestrictions.ts
@@ -0,0 +1,50 @@
+/**
+ * A restriction expressed as the labels or tags a user may and may not see.
+ *
+ * Every media server exposes the same idea under a different name: Plex calls
+ * them labels and encodes them in the sharing filter, Jellyfin splits them into
+ * `AllowedTags` and `BlockedTags`, Emby keeps a single list whose polarity is
+ * flipped by a flag. They are normalised into this shape so the matching rule
+ * lives in one place rather than once per server.
+ */
+export interface TagRestriction {
+  allow: string[];
+  deny: string[];
+  /**
+   * Set when the combined restrictions cannot be satisfied by any tag, so
+   * nothing is visible and the media server need not be queried at all.
+   */
+  allowNothing?: boolean;
+}
+
+export const EMPTY_TAG_RESTRICTION: TagRestriction = { allow: [], deny: [] };
+
+/**
+ * Evaluates a restriction against the tags carried by an item. Items without
+ * tags are only visible when no allow list applies.
+ *
+ * A deny entry wins over an allow entry, which is what both Plex and Jellyfin
+ * do: a user allowed and denied the same tag sees nothing carrying it.
+ */
+export const isAllowedByTagRestriction = (
+  restriction: TagRestriction,
+  tags: string[]
+): boolean => {
+  if (restriction.allowNothing) {
+    return false;
+  }
+
+  const normalized = tags.map((tag) => tag.toLowerCase());
+
+  if (restriction.deny.some((tag) => normalized.includes(tag.toLowerCase()))) {
+    return false;
+  }
+
+  if (!restriction.allow.length) {
+    return true;
+  }
+
+  return restriction.allow.some((tag) =>
+    normalized.includes(tag.toLowerCase())
+  );
+};

From e7e76ec391bafd96f90bb1e11d7ab9943306cded Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Mon, 27 Jul 2026 09:57:32 +0200
Subject: [PATCH 13/19] fix(requests): complete already available media before
 any arr lookup

The branch marking a request COMPLETED when the library already holds the
media sat after the Radarr and Sonarr configuration checks, both of which
return early. On an instance with no default server the request therefore
stayed approved forever, and with request tagging enabled the server was
called for nothing before the branch was ever reached.

Media already in the library needs no download client, so it is now settled
first. Reported by CodeRabbit on this PR.
---
 server/subscriber/MediaRequestSubscriber.ts | 135 ++++++++++----------
 1 file changed, 71 insertions(+), 64 deletions(-)

diff --git a/server/subscriber/MediaRequestSubscriber.ts b/server/subscriber/MediaRequestSubscriber.ts
index 18a6443079..19b3671ab3 100644
--- a/server/subscriber/MediaRequestSubscriber.ts
+++ b/server/subscriber/MediaRequestSubscriber.ts
@@ -236,6 +236,43 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
       try {
         const mediaRepository = manager.getRepository(Media);
         const settings = getSettings();
+
+        // Media already in the library never needs a download client, so this
+        // is settled before any server is looked up. Doing it later leaves the
+        // request approved forever on an instance without a default one, and
+        // makes the tag handling below call the server for nothing.
+        const media = await mediaRepository.findOne({
+          where: { id: entity.media.id },
+        });
+
+        if (!media) {
+          logger.error('Media data not found', {
+            label: 'Media Request',
+            requestId: entity.id,
+            mediaId: entity.media.id,
+          });
+          return;
+        }
+
+        if (
+          media[entity.is4k ? 'status4k' : 'status'] === MediaStatus.AVAILABLE
+        ) {
+          logger.warn('Media already exists, marking request as COMPLETED', {
+            label: 'Media Request',
+            requestId: entity.id,
+            mediaId: entity.media.id,
+          });
+
+          // The requester may only be seeing this as unavailable because the
+          // media server hides it from them, so optionally grant them access.
+          await this.grantLibraryAccessIfEnabled(entity, media);
+
+          const requestRepository = manager.getRepository(MediaRequest);
+          entity.status = MediaRequestStatus.COMPLETED;
+          await requestRepository.save(entity);
+          return;
+        }
+
         if (settings.radarr.length === 0 && !settings.radarr[0]) {
           logger.info(
             'No Radarr server configured, skipping request processing',
@@ -328,38 +365,6 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
           });
         }
 
-        const media = await mediaRepository.findOne({
-          where: { id: entity.media.id },
-        });
-
-        if (!media) {
-          logger.error('Media data not found', {
-            label: 'Media Request',
-            requestId: entity.id,
-            mediaId: entity.media.id,
-          });
-          return;
-        }
-
-        if (
-          media[entity.is4k ? 'status4k' : 'status'] === MediaStatus.AVAILABLE
-        ) {
-          logger.warn('Media already exists, marking request as COMPLETED', {
-            label: 'Media Request',
-            requestId: entity.id,
-            mediaId: entity.media.id,
-          });
-
-          // The requester may only be seeing this as unavailable because the
-          // media server hides it from them, so optionally grant them access.
-          await this.grantLibraryAccessIfEnabled(entity, media);
-
-          const requestRepository = manager.getRepository(MediaRequest);
-          entity.status = MediaRequestStatus.COMPLETED;
-          await requestRepository.save(entity);
-          return;
-        }
-
         const tmdb = new TheMovieDb();
         const radarr = new RadarrAPI({
           apiKey: radarrSettings.apiKey,
@@ -451,7 +456,7 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
           })
           .catch(async () => {
             try {
-              const requestRepository = getRepository(MediaRequest);
+              const requestRepository = manager.getRepository(MediaRequest);
 
               if (entity.status !== MediaRequestStatus.FAILED) {
                 entity.status = MediaRequestStatus.FAILED;
@@ -539,6 +544,38 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
       try {
         const mediaRepository = manager.getRepository(Media);
         const settings = getSettings();
+
+        // Same as for movies: settled before any server is looked up.
+        const media = await mediaRepository.findOne({
+          where: { id: entity.media.id },
+        });
+
+        if (!media) {
+          throw new Error('Media data not found');
+        }
+
+        if (
+          media[entity.is4k ? 'status4k' : 'status'] === MediaStatus.AVAILABLE
+        ) {
+          logger.warn('Media already exists, marking request as COMPLETED', {
+            label: 'Media Request',
+            requestId: entity.id,
+            mediaId: entity.media.id,
+          });
+
+          // The requester may only be seeing this as unavailable because the
+          // media server hides it from them, so optionally grant them access.
+          await this.grantLibraryAccessIfEnabled(entity, media);
+
+          const requestRepository = manager.getRepository(MediaRequest);
+          entity.status = MediaRequestStatus.COMPLETED;
+          entity.seasons.forEach((season) => {
+            season.status = MediaRequestStatus.COMPLETED;
+          });
+          await requestRepository.save(entity);
+          return;
+        }
+
         if (settings.sonarr.length === 0 && !settings.sonarr[0]) {
           logger.warn(
             'No Sonarr server configured, skipping request processing',
@@ -589,36 +626,6 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
           return;
         }
 
-        const media = await mediaRepository.findOne({
-          where: { id: entity.media.id },
-        });
-
-        if (!media) {
-          throw new Error('Media data not found');
-        }
-
-        if (
-          media[entity.is4k ? 'status4k' : 'status'] === MediaStatus.AVAILABLE
-        ) {
-          logger.warn('Media already exists, marking request as COMPLETED', {
-            label: 'Media Request',
-            requestId: entity.id,
-            mediaId: entity.media.id,
-          });
-
-          // The requester may only be seeing this as unavailable because the
-          // media server hides it from them, so optionally grant them access.
-          await this.grantLibraryAccessIfEnabled(entity, media);
-
-          const requestRepository = manager.getRepository(MediaRequest);
-          entity.status = MediaRequestStatus.COMPLETED;
-          entity.seasons.forEach((season) => {
-            season.status = MediaRequestStatus.COMPLETED;
-          });
-          await requestRepository.save(entity);
-          return;
-        }
-
         const tmdb = new TheMovieDb();
         const sonarr = new SonarrAPI({
           apiKey: sonarrSettings.apiKey,
@@ -803,7 +810,7 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
           })
           .catch(async () => {
             try {
-              const requestRepository = getRepository(MediaRequest);
+              const requestRepository = manager.getRepository(MediaRequest);
 
               if (entity.status !== MediaRequestStatus.FAILED) {
                 entity.status = MediaRequestStatus.FAILED;

From 6ae0211f9460b242d408884cf33730efa9cf34f2 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Mon, 27 Jul 2026 10:10:41 +0200
Subject: [PATCH 14/19] test(plex): use fictional names in the grant label
 fixtures

The fixtures were copied from a real server and carried the Plex usernames
of actual shared users. Replaced with placeholder names.
---
 server/lib/plexsharing.test.ts | 36 +++++++++++++++-------------------
 1 file changed, 16 insertions(+), 20 deletions(-)

diff --git a/server/lib/plexsharing.test.ts b/server/lib/plexsharing.test.ts
index 87480748ca..ce06dabe98 100644
--- a/server/lib/plexsharing.test.ts
+++ b/server/lib/plexsharing.test.ts
@@ -9,55 +9,51 @@ describe('pickGrantLabel', () => {
   it('prefers the label no other user is allowed to see', () => {
     assert.deepEqual(
       pickGrantLabel(
-        ['Famille', 'Nico', 'cedric2605'],
-        ['cedric2605'],
-        sharedWith({ famille: 2, nico: 1 })
+        ['Family', 'Household', 'alice'],
+        ['alice'],
+        sharedWith({ family: 2, household: 1 })
       ),
-      { label: 'cedric2605', alsoVisibleTo: 0 }
+      { label: 'alice', alsoVisibleTo: 0 }
     );
   });
 
   it('breaks ties between exclusive labels on the user name', () => {
     assert.deepEqual(
-      pickGrantLabel(
-        ['brunocarrer', 'nikaii', 'cedric2605'],
-        ['cedric2605'],
-        sharedWith({})
-      ),
-      { label: 'cedric2605', alsoVisibleTo: 0 }
+      pickGrantLabel(['bob', 'carol', 'alice'], ['alice'], sharedWith({})),
+      { label: 'alice', alsoVisibleTo: 0 }
     );
   });
 
   it('falls back to the least shared label when none is exclusive', () => {
     assert.deepEqual(
       pickGrantLabel(
-        ['Famille', 'Nico'],
-        ['cedric2605'],
-        sharedWith({ famille: 2, nico: 1 })
+        ['Family', 'Household'],
+        ['alice'],
+        sharedWith({ family: 2, household: 1 })
       ),
-      { label: 'Nico', alsoVisibleTo: 1 }
+      { label: 'Household', alsoVisibleTo: 1 }
     );
   });
 
   it('keeps the allow list order when nothing else separates the labels', () => {
     assert.deepEqual(
       pickGrantLabel(
-        ['Nico', 'Famille'],
+        ['Household', 'Family'],
         [],
-        sharedWith({ nico: 1, famille: 1 })
+        sharedWith({ household: 1, family: 1 })
       ),
-      { label: 'Nico', alsoVisibleTo: 1 }
+      { label: 'Household', alsoVisibleTo: 1 }
     );
   });
 
   it('matches the user name case-insensitively', () => {
     assert.deepEqual(
-      pickGrantLabel(['Famille', 'Cedric2605'], ['cedric2605'], sharedWith({})),
-      { label: 'Cedric2605', alsoVisibleTo: 0 }
+      pickGrantLabel(['Family', 'Alice'], ['alice'], sharedWith({})),
+      { label: 'Alice', alsoVisibleTo: 0 }
     );
   });
 
   it('returns null when there is no candidate', () => {
-    assert.equal(pickGrantLabel([], ['cedric2605'], sharedWith({})), null);
+    assert.equal(pickGrantLabel([], ['alice'], sharedWith({})), null);
   });
 });

From e2dd49a3287c67ce1a7dd93f176b0c75f4300b6e Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Mon, 27 Jul 2026 11:25:36 +0200
Subject: [PATCH 15/19] fix(media): drop items the per-user downgrade took out
 of the filter

The list endpoint filters by availability in SQL, then reports availability
from the requesting user's point of view. An item hidden from that user
therefore stayed in an "available" listing, merely flagged unavailable, so
the Recently Added slider showed a restricted user exactly the titles the
media server hides from them.

The requested filter is now honoured after the downgrade. Only the returned
page shrinks; the total stays the library's, which no caller paginates on.
---
 server/routes/media.ts | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/server/routes/media.ts b/server/routes/media.ts
index e6f3a121b2..d7b189250a 100644
--- a/server/routes/media.ts
+++ b/server/routes/media.ts
@@ -27,29 +27,31 @@ mediaRoutes.get('/', async (req, res, next) => {
   const pageSize = req.query.take ? Number(req.query.take) : 20;
   const skip = req.query.skip ? Number(req.query.skip) : 0;
 
-  let statusFilter = undefined;
+  let acceptedStatuses: MediaStatus[] | undefined;
 
   switch (req.query.filter) {
     case 'available':
-      statusFilter = MediaStatus.AVAILABLE;
+      acceptedStatuses = [MediaStatus.AVAILABLE];
       break;
     case 'partial':
-      statusFilter = MediaStatus.PARTIALLY_AVAILABLE;
+      acceptedStatuses = [MediaStatus.PARTIALLY_AVAILABLE];
       break;
     case 'allavailable':
-      statusFilter = In([
+      acceptedStatuses = [
         MediaStatus.AVAILABLE,
         MediaStatus.PARTIALLY_AVAILABLE,
-      ]);
+      ];
       break;
     case 'processing':
-      statusFilter = MediaStatus.PROCESSING;
+      acceptedStatuses = [MediaStatus.PROCESSING];
       break;
     case 'pending':
-      statusFilter = MediaStatus.PENDING;
+      acceptedStatuses = [MediaStatus.PENDING];
       break;
   }
 
+  const statusFilter = acceptedStatuses ? In(acceptedStatuses) : undefined;
+
   let sortFilter: FindOneOptions<Media>['order'] = {
     id: 'DESC',
   };
@@ -84,10 +86,19 @@ mediaRoutes.get('/', async (req, res, next) => {
 
     // This endpoint feeds the "Recently Added" slider, so availability has to
     // be reported from the requesting user's point of view.
-    const results = req.user
+    const restricted = req.user
       ? await Media.applySharingRestrictions(req.user, media)
       : media;
 
+    // The caller asked for media in a given availability state, so an item the
+    // downgrade just took out of that state has no place in the answer. Without
+    // this, a restricted user is shown, as recently added, the titles the media
+    // server hides from them, merely flagged unavailable. Only the page shrinks,
+    // the total stays the library's, which no caller paginates on.
+    const results = acceptedStatuses
+      ? restricted.filter((item) => acceptedStatuses.includes(item.status))
+      : restricted;
+
     return res.status(200).json({
       pageInfo: {
         pages: Math.ceil(mediaCount / pageSize),

From d30d06574a6d3c59adcdf777f4a0afbcb62077a8 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Mon, 27 Jul 2026 11:31:28 +0200
Subject: [PATCH 16/19] fix(media): keep the page full for a restricted user

Reapplying the filter after the per-user downgrade left a restricted user
with a short page: the Recently Added slider showed them thirteen titles
where the owner got twenty. The library is now walked further until the page
is full, so the client receives a complete page already scoped to the user
and needs to know nothing about the restrictions.

The walk is bounded to ten pages worth of rows. A user who can see very
little gets a short page rather than a full table scan.
---
 server/routes/media.ts | 62 ++++++++++++++++++++++++++++--------------
 1 file changed, 42 insertions(+), 20 deletions(-)

diff --git a/server/routes/media.ts b/server/routes/media.ts
index d7b189250a..762ee3ccee 100644
--- a/server/routes/media.ts
+++ b/server/routes/media.ts
@@ -77,27 +77,49 @@ mediaRoutes.get('/', async (req, res, next) => {
   }
 
   try {
-    const [media, mediaCount] = await mediaRepository.findAndCount({
-      order: sortFilter,
-      where: whereClause,
-      take: pageSize,
-      skip,
-    });
+    const mediaCount = await mediaRepository.count({ where: whereClause });
 
     // This endpoint feeds the "Recently Added" slider, so availability has to
-    // be reported from the requesting user's point of view.
-    const restricted = req.user
-      ? await Media.applySharingRestrictions(req.user, media)
-      : media;
-
-    // The caller asked for media in a given availability state, so an item the
-    // downgrade just took out of that state has no place in the answer. Without
-    // this, a restricted user is shown, as recently added, the titles the media
-    // server hides from them, merely flagged unavailable. Only the page shrinks,
-    // the total stays the library's, which no caller paginates on.
-    const results = acceptedStatuses
-      ? restricted.filter((item) => acceptedStatuses.includes(item.status))
-      : restricted;
+    // be reported from the requesting user's point of view. The requested
+    // filter is then applied a second time: an item hidden from that user is no
+    // longer in the state the caller asked for, and without this pass the
+    // slider shows a restricted user exactly the titles the media server hides
+    // from them, merely flagged unavailable.
+    //
+    // Dropping them would leave a short page, so the library is walked further
+    // until the page is full. The walk is bounded, because a user who can see
+    // very little must not turn this endpoint into a full table scan; such a
+    // user gets a short page rather than an expensive one.
+    const results: Media[] = [];
+    const maxRowsScanned = pageSize * 10;
+    let offset = skip;
+    let rowsScanned = 0;
+
+    while (results.length < pageSize && rowsScanned < maxRowsScanned) {
+      const batch = await mediaRepository.find({
+        order: sortFilter,
+        where: whereClause,
+        take: pageSize,
+        skip: offset,
+      });
+
+      if (!batch.length) {
+        break;
+      }
+
+      offset += batch.length;
+      rowsScanned += batch.length;
+
+      const restricted = req.user
+        ? await Media.applySharingRestrictions(req.user, batch)
+        : batch;
+
+      results.push(
+        ...(acceptedStatuses
+          ? restricted.filter((item) => acceptedStatuses.includes(item.status))
+          : restricted)
+      );
+    }
 
     return res.status(200).json({
       pageInfo: {
@@ -106,7 +128,7 @@ mediaRoutes.get('/', async (req, res, next) => {
         results: mediaCount,
         page: Math.ceil(skip / pageSize) + 1,
       },
-      results,
+      results: results.slice(0, pageSize),
     } as MediaResultsResponse);
   } catch (e) {
     next({ status: 500, message: e.message });

From 49d425151ddd3d379f6649b8ff489fce2929b7b6 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:03:29 +0200
Subject: [PATCH 17/19] fix(plex): only grant the label named after the user

Picking the least shared label handed the item to whoever else was allowed
to see that label, since a label is a shared bucket rather than a per-user
permission. Only a label named after the user is applied now, and nothing
is granted when they are allowed none: handing out a shared bucket is the
owner's decision, not Seerr's.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/lib/plexsharing.test.ts           | 60 +++++++++++++++++-------
 server/lib/plexsharing.ts                | 44 ++++++++++-------
 server/lib/settings/index.ts             |  5 +-
 src/components/Settings/SettingsPlex.tsx |  2 +-
 src/i18n/locale/en.json                  |  2 +-
 5 files changed, 76 insertions(+), 37 deletions(-)

diff --git a/server/lib/plexsharing.test.ts b/server/lib/plexsharing.test.ts
index ce06dabe98..8c9456fb6d 100644
--- a/server/lib/plexsharing.test.ts
+++ b/server/lib/plexsharing.test.ts
@@ -6,7 +6,7 @@ const sharedWith = (counts: Record<string, number>): Map<string, number> =>
   new Map(Object.entries(counts));
 
 describe('pickGrantLabel', () => {
-  it('prefers the label no other user is allowed to see', () => {
+  it('grants the label named after the user', () => {
     assert.deepEqual(
       pickGrantLabel(
         ['Family', 'Household', 'alice'],
@@ -17,39 +17,65 @@ describe('pickGrantLabel', () => {
     );
   });
 
-  it('breaks ties between exclusive labels on the user name', () => {
+  it('grants nothing when no label is named after the user', () => {
+    assert.equal(
+      pickGrantLabel(
+        ['Family', 'Household'],
+        ['alice'],
+        sharedWith({ family: 2, household: 1 })
+      ),
+      null
+    );
+  });
+
+  it('grants nothing when the user has no name to match', () => {
+    assert.equal(pickGrantLabel(['Family', 'alice'], [], sharedWith({})), null);
+  });
+
+  it('matches the user name case-insensitively', () => {
     assert.deepEqual(
-      pickGrantLabel(['bob', 'carol', 'alice'], ['alice'], sharedWith({})),
-      { label: 'alice', alsoVisibleTo: 0 }
+      pickGrantLabel(['Family', 'Alice'], ['alice'], sharedWith({})),
+      { label: 'Alice', alsoVisibleTo: 0 }
     );
   });
 
-  it('falls back to the least shared label when none is exclusive', () => {
+  it('matches any of the names the user is known by', () => {
     assert.deepEqual(
       pickGrantLabel(
-        ['Family', 'Household'],
-        ['alice'],
-        sharedWith({ family: 2, household: 1 })
+        ['Family', 'alice'],
+        ['alice.plex', 'alice'],
+        sharedWith({})
       ),
-      { label: 'Household', alsoVisibleTo: 1 }
+      { label: 'alice', alsoVisibleTo: 0 }
     );
   });
 
-  it('keeps the allow list order when nothing else separates the labels', () => {
+  it('reports the other users a matching label is also visible to', () => {
+    assert.deepEqual(
+      pickGrantLabel(['alice'], ['alice'], sharedWith({ alice: 2 })),
+      { label: 'alice', alsoVisibleTo: 2 }
+    );
+  });
+
+  it('prefers the least shared match when several names apply', () => {
     assert.deepEqual(
       pickGrantLabel(
-        ['Household', 'Family'],
-        [],
-        sharedWith({ household: 1, family: 1 })
+        ['alice', 'Family', 'alice-plex'],
+        ['alice', 'alice-plex'],
+        sharedWith({ alice: 2, 'alice-plex': 0 })
       ),
-      { label: 'Household', alsoVisibleTo: 1 }
+      { label: 'alice-plex', alsoVisibleTo: 0 }
     );
   });
 
-  it('matches the user name case-insensitively', () => {
+  it('keeps the allow list order when nothing else separates the matches', () => {
     assert.deepEqual(
-      pickGrantLabel(['Family', 'Alice'], ['alice'], sharedWith({})),
-      { label: 'Alice', alsoVisibleTo: 0 }
+      pickGrantLabel(
+        ['alice-plex', 'alice'],
+        ['alice', 'alice-plex'],
+        sharedWith({ alice: 1, 'alice-plex': 1 })
+      ),
+      { label: 'alice-plex', alsoVisibleTo: 1 }
     );
   });
 
diff --git a/server/lib/plexsharing.ts b/server/lib/plexsharing.ts
index 95d971b687..e01460df75 100644
--- a/server/lib/plexsharing.ts
+++ b/server/lib/plexsharing.ts
@@ -26,21 +26,24 @@ export interface PlexItemRef {
  *
  * A label is a shared bucket rather than a per-user permission: applying one
  * that other restricted users are also allowed to see hands them the item too.
- * So the label the fewest other users can see wins, and a label named after the
- * user breaks ties, since naming a label after its user is the usual
- * convention. Ordering is otherwise stable, to keep the choice predictable.
+ * Only a label named after the user is therefore ever applied, since that is the
+ * usual convention for a label meant for a single person, and nothing is granted
+ * when the user has no such label: a shared bucket is the owner's to hand out,
+ * not Seerr's.
  *
  * `sharedWithCount` maps a lowercased label to the number of *other* restricted
  * users allowed to see it. Unrestricted users are not counted: they already see
- * the item whatever label it carries.
+ * the item whatever label it carries. It no longer drives the choice, only the
+ * least shared of several name matches and the count reported to the owner,
+ * since even a label named after the user may be allowed to others.
  */
 export const pickGrantLabel = (
   candidates: string[],
-  preferredNames: string[],
+  userNames: string[],
   sharedWithCount: Map<string, number>
 ): { label: string; alsoVisibleTo: number } | null => {
   const names = new Set(
-    preferredNames.filter(Boolean).map((name) => name.toLowerCase())
+    userNames.filter(Boolean).map((name) => name.toLowerCase())
   );
 
   const ranked = candidates
@@ -48,14 +51,10 @@ export const pickGrantLabel = (
       label,
       index,
       alsoVisibleTo: sharedWithCount.get(label.toLowerCase()) ?? 0,
-      matchesName: names.has(label.toLowerCase()),
     }))
-    .sort(
-      (a, b) =>
-        a.alsoVisibleTo - b.alsoVisibleTo ||
-        Number(b.matchesName) - Number(a.matchesName) ||
-        a.index - b.index
-    );
+    .filter(({ label }) => names.has(label.toLowerCase()))
+    // Ordering is stable, to keep the choice predictable.
+    .sort((a, b) => a.alsoVisibleTo - b.alsoVisibleTo || a.index - b.index);
 
   const best = ranked[0];
 
@@ -205,8 +204,9 @@ const getSectionRatingKeys = async (
  * adding one of the labels they are allowed to see.
  *
  * Returns the label that was applied, or `null` when nothing had to be done:
- * the user is unrestricted, already has access, or has no allow list to draw a
- * label from (a deny-only restriction cannot be satisfied this way).
+ * the user is unrestricted, already has access, has no allow list to draw a
+ * label from (a deny-only restriction cannot be satisfied this way), or is
+ * allowed no label named after them.
  */
 export const grantLabelAccess = async (
   user: User,
@@ -253,7 +253,7 @@ export const grantLabelAccess = async (
   );
 
   // How many other restricted users each candidate label would also expose the
-  // item to, so the most exclusive one can be preferred.
+  // item to, which is reported to the owner along with the granted label.
   const sharedWithCount = new Map<string, number>();
 
   for (const [plexUserId, otherRules] of rulesByPlexUserId) {
@@ -282,6 +282,18 @@ export const grantLabelAccess = async (
   );
 
   if (!picked) {
+    // Worth surfacing: the owner enabled the grant and nothing happened, which
+    // from the outside is indistinguishable from a failure.
+    logger.info(
+      'No Plex label named after the user to grant, leaving the item untouched',
+      {
+        label: 'Plex Sharing',
+        userId: user.id,
+        ratingKey,
+        allowedLabels: candidates,
+      }
+    );
+
     return null;
   }
 
diff --git a/server/lib/settings/index.ts b/server/lib/settings/index.ts
index 708611ae32..634cead729 100644
--- a/server/lib/settings/index.ts
+++ b/server/lib/settings/index.ts
@@ -44,8 +44,9 @@ export interface PlexSettings {
   webAppUrl?: string;
   /**
    * When a user restricted by Plex labels requests media that already exists in
-   * the library, automatically add one of their allowed labels to it so they
-   * gain access, instead of leaving the request for the owner to handle.
+   * the library, automatically add the label named after them to it so they gain
+   * access, instead of leaving the request for the owner to handle. Nothing is
+   * added when they are allowed no such label.
    *
    * Disabled by default: granting library access is the owner's decision.
    */
diff --git a/src/components/Settings/SettingsPlex.tsx b/src/components/Settings/SettingsPlex.tsx
index 42f14edb2b..98722b7a76 100644
--- a/src/components/Settings/SettingsPlex.tsx
+++ b/src/components/Settings/SettingsPlex.tsx
@@ -72,7 +72,7 @@ const messages = defineMessages('components.Settings', {
     'Optionally direct users to the web app on your server instead of https://app.plex.tv/desktop',
   grantLabelOnApproval: 'Grant Library Access on Approval',
   grantLabelOnApprovalTip:
-    'When a user restricted by labels requests media already in your library, grant them access by adding the label the fewest other users can see, instead of leaving the request for you to handle manually',
+    'When a user restricted by labels requests media already in your library, grant them access by adding the label named after them, instead of leaving the request for you to handle manually. Nothing is added when they are allowed no such label',
   tautulliSettings: 'Tautulli Settings',
   tautulliSettingsDescription:
     'Optionally configure the settings for your Tautulli server. Seerr fetches watch history data for your Plex media from Tautulli.',
diff --git a/src/i18n/locale/en.json b/src/i18n/locale/en.json
index a27f5d0a84..fbb0f4e2db 100644
--- a/src/i18n/locale/en.json
+++ b/src/i18n/locale/en.json
@@ -1205,7 +1205,7 @@
   "components.Settings.failedToSaveMetadataSettings": "Failed to save metadata provider settings",
   "components.Settings.general": "General",
   "components.Settings.grantLabelOnApproval": "Grant Library Access on Approval",
-  "components.Settings.grantLabelOnApprovalTip": "When a user restricted by labels requests media already in your library, grant them access by adding the label the fewest other users can see, instead of leaving the request for you to handle manually",
+  "components.Settings.grantLabelOnApprovalTip": "When a user restricted by labels requests media already in your library, grant them access by adding the label named after them, instead of leaving the request for you to handle manually. Nothing is added when they are allowed no such label",
   "components.Settings.hostname": "Hostname or IP Address",
   "components.Settings.importBlocklistedTagsTip": "Import blocklisted tag configuration",
   "components.Settings.invalidKeyword": "{keywordId} is not a TMDB keyword.",

From e3a05beb3035a5ce58bd151cc58c3d01cd91dec5 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:03:40 +0200
Subject: [PATCH 18/19] fix(requests): grant the label once the download makes
 the media available

The grant only ran where the library already held the media, so a request
that went to Radarr or Sonarr never got a label, which is what happens to
almost every request. The requester was told the media was unavailable,
requested it, waited for the download and still could not see it.

The shared helper now runs from both routes: the media was already there,
or the scanner has just made it available. Media marked deleted is skipped,
since it keeps its rating key for as long as a request is still active.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/lib/librarysharing.ts                | 47 +++++++++++++++-
 server/subscriber/MediaRequestSubscriber.ts | 59 +++++----------------
 server/subscriber/MediaSubscriber.ts        | 24 +++++++++
 3 files changed, 83 insertions(+), 47 deletions(-)

diff --git a/server/lib/librarysharing.ts b/server/lib/librarysharing.ts
index 2bcf2e0364..aa579c3570 100644
--- a/server/lib/librarysharing.ts
+++ b/server/lib/librarysharing.ts
@@ -1,8 +1,12 @@
+import { MediaType } from '@server/constants/media';
 import { MediaServerType } from '@server/constants/server';
 import type Media from '@server/entity/Media';
 import type { User } from '@server/entity/User';
 import { resolveVisibleJellyfinItemIds } from '@server/lib/jellyfinsharing';
-import { resolveVisiblePlexRatingKeys } from '@server/lib/plexsharing';
+import {
+  grantLabelAccess,
+  resolveVisiblePlexRatingKeys,
+} from '@server/lib/plexsharing';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 
@@ -105,3 +109,44 @@ export const getMediaServerItemIds = (
 
   return { id: media.jellyfinMediaId, id4k: media.jellyfinMediaId4k };
 };
+
+/**
+ * Grants the requester access to media that has just become available, when the
+ * owner opted into it.
+ *
+ * Both routes a request can take end up here: the library already held the
+ * media, or a download landed and the scanner made it available. Granting from
+ * only one of them leaves the requester without access on the other, which is
+ * the more common case since most requests are downloaded rather than already
+ * present.
+ *
+ * Never throws: a failed grant must not hold up the request it belongs to.
+ */
+export const grantLibraryAccessForRequest = async (
+  user: User | null | undefined,
+  ratingKey: string | null | undefined,
+  mediaType: MediaType,
+  requestId: number
+): Promise<void> => {
+  if (!getSettings().plex.grantLabelOnApproval || !user || !ratingKey) {
+    return;
+  }
+
+  try {
+    const granted = await grantLabelAccess(user, {
+      ratingKey,
+      type: mediaType === MediaType.MOVIE ? 'movie' : 'show',
+    });
+
+    if (granted) {
+      // The user's visible set just changed, so drop the cached copy.
+      clearLibrarySharingCache(user.id);
+    }
+  } catch (e) {
+    logger.error('Failed to grant media server library access for request', {
+      label: 'Media Request',
+      requestId,
+      errorMessage: e instanceof Error ? e.message : String(e),
+    });
+  }
+};
diff --git a/server/subscriber/MediaRequestSubscriber.ts b/server/subscriber/MediaRequestSubscriber.ts
index 19b3671ab3..d17d0c7dfa 100644
--- a/server/subscriber/MediaRequestSubscriber.ts
+++ b/server/subscriber/MediaRequestSubscriber.ts
@@ -17,9 +17,8 @@ import Media from '@server/entity/Media';
 import { MediaRequest } from '@server/entity/MediaRequest';
 import Season from '@server/entity/Season';
 import SeasonRequest from '@server/entity/SeasonRequest';
-import { clearLibrarySharingCache } from '@server/lib/librarysharing';
+import { grantLibraryAccessForRequest } from '@server/lib/librarysharing';
 import notificationManager, { Notification } from '@server/lib/notifications';
-import { grantLabelAccess } from '@server/lib/plexsharing';
 import { getSettings } from '@server/lib/settings';
 import logger from '@server/logger';
 import { withNestedTransaction } from '@server/utils/nestedTransaction';
@@ -183,48 +182,6 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
     }
   }
 
-  /**
-   * Grants the requester access to media the library already holds, when the
-   * owner opted into it.
-   *
-   * A restricted user only sees such media as unavailable because the media
-   * server hides it from them, so the request is legitimate even though nothing
-   * has to be downloaded. Plex only, since it relies on labels.
-   */
-  private async grantLibraryAccessIfEnabled(
-    entity: MediaRequest,
-    media: Media
-  ): Promise<void> {
-    const settings = getSettings();
-    const ratingKey = entity.is4k ? media.ratingKey4k : media.ratingKey;
-
-    if (
-      !settings.plex.grantLabelOnApproval ||
-      !ratingKey ||
-      !entity.requestedBy
-    ) {
-      return;
-    }
-
-    try {
-      const granted = await grantLabelAccess(entity.requestedBy, {
-        ratingKey,
-        type: entity.type === MediaType.MOVIE ? 'movie' : 'show',
-      });
-
-      if (granted) {
-        // The user's visible set just changed, so drop the cached copy.
-        clearLibrarySharingCache(entity.requestedBy.id);
-      }
-    } catch (e) {
-      logger.error('Failed to grant media server library access for request', {
-        label: 'Media Request',
-        requestId: entity.id,
-        errorMessage: e.message,
-      });
-    }
-  }
-
   public async sendToRadarr(
     entity: MediaRequest,
     manager: EntityManager
@@ -265,7 +222,12 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
 
           // The requester may only be seeing this as unavailable because the
           // media server hides it from them, so optionally grant them access.
-          await this.grantLibraryAccessIfEnabled(entity, media);
+          await grantLibraryAccessForRequest(
+            entity.requestedBy,
+            entity.is4k ? media.ratingKey4k : media.ratingKey,
+            entity.type,
+            entity.id
+          );
 
           const requestRepository = manager.getRepository(MediaRequest);
           entity.status = MediaRequestStatus.COMPLETED;
@@ -565,7 +527,12 @@ export class MediaRequestSubscriber implements EntitySubscriberInterface<MediaRe
 
           // The requester may only be seeing this as unavailable because the
           // media server hides it from them, so optionally grant them access.
-          await this.grantLibraryAccessIfEnabled(entity, media);
+          await grantLibraryAccessForRequest(
+            entity.requestedBy,
+            entity.is4k ? media.ratingKey4k : media.ratingKey,
+            entity.type,
+            entity.id
+          );
 
           const requestRepository = manager.getRepository(MediaRequest);
           entity.status = MediaRequestStatus.COMPLETED;
diff --git a/server/subscriber/MediaSubscriber.ts b/server/subscriber/MediaSubscriber.ts
index 1ee26273fc..16749e780d 100644
--- a/server/subscriber/MediaSubscriber.ts
+++ b/server/subscriber/MediaSubscriber.ts
@@ -7,6 +7,7 @@ import Media from '@server/entity/Media';
 import { MediaRequest } from '@server/entity/MediaRequest';
 import Season from '@server/entity/Season';
 import SeasonRequest from '@server/entity/SeasonRequest';
+import { grantLibraryAccessForRequest } from '@server/lib/librarysharing';
 import logger from '@server/logger';
 import { withNestedTransaction } from '@server/utils/nestedTransaction';
 import type {
@@ -131,6 +132,29 @@ export class MediaSubscriber implements EntitySubscriberInterface<Media> {
       }
 
       await requestRepository.save(completedRequests);
+
+      // The other half of the grant done when the library already held the
+      // media: most requests are downloaded rather than already present, and
+      // without this a restricted user still cannot see what they requested.
+      // The rating key is read from the entity being saved, since the scanner
+      // sets it in the same write that makes the media available.
+      // A request also completes when the media is marked deleted, and the
+      // rating key survives that for as long as a request is still active, so
+      // that case is skipped rather than left to fail against Plex.
+      if ((is4k ? event.status4k : event.status) !== MediaStatus.DELETED) {
+        const ratingKey = is4k
+          ? (event.ratingKey4k ?? databaseEvent.ratingKey4k)
+          : (event.ratingKey ?? databaseEvent.ratingKey);
+
+        for (const request of completedRequests) {
+          await grantLibraryAccessForRequest(
+            request.requestedBy,
+            ratingKey,
+            request.type,
+            request.id
+          );
+        }
+      }
     }
   }
 

From 817f3e82b7e033c4ecd6d8eb023bbeea1b3ff4a3 Mon Sep 17 00:00:00 2001
From: Izakun <30216483+Izakun@users.noreply.github.com>
Date: Tue, 18 Aug 2026 23:16:46 +0200
Subject: [PATCH 19/19] fix(requests): grant the label outside the completing
 transaction

Granting talks to plex.tv and to the media server, and the requests it
follows are completed inside a transaction, so the write lock was held for
the whole round trip. The completed requests are handed back to the caller
and granted once the transaction is done.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 server/subscriber/MediaSubscriber.ts | 116 ++++++++++++++++++---------
 1 file changed, 78 insertions(+), 38 deletions(-)

diff --git a/server/subscriber/MediaSubscriber.ts b/server/subscriber/MediaSubscriber.ts
index 16749e780d..3851f63b07 100644
--- a/server/subscriber/MediaSubscriber.ts
+++ b/server/subscriber/MediaSubscriber.ts
@@ -133,28 +133,50 @@ export class MediaSubscriber implements EntitySubscriberInterface<Media> {
 
       await requestRepository.save(completedRequests);
 
-      // The other half of the grant done when the library already held the
-      // media: most requests are downloaded rather than already present, and
-      // without this a restricted user still cannot see what they requested.
-      // The rating key is read from the entity being saved, since the scanner
-      // sets it in the same write that makes the media available.
-      // A request also completes when the media is marked deleted, and the
-      // rating key survives that for as long as a request is still active, so
-      // that case is skipped rather than left to fail against Plex.
-      if ((is4k ? event.status4k : event.status) !== MediaStatus.DELETED) {
-        const ratingKey = is4k
-          ? (event.ratingKey4k ?? databaseEvent.ratingKey4k)
-          : (event.ratingKey ?? databaseEvent.ratingKey);
-
-        for (const request of completedRequests) {
-          await grantLibraryAccessForRequest(
-            request.requestedBy,
-            ratingKey,
-            request.type,
-            request.id
-          );
-        }
-      }
+      return completedRequests;
+    }
+
+    return [];
+  }
+
+  /**
+   * Grants the requester access to the media their request was just completed
+   * by, when the owner opted into it.
+   *
+   * The other half of the grant done when the library already held the media:
+   * most requests are downloaded rather than already present, and without this
+   * a restricted user still cannot see what they requested.
+   *
+   * Deliberately run outside the transaction that completed the requests, since
+   * granting talks to plex.tv and to the media server, which must not happen
+   * with a write lock held.
+   */
+  private async grantLibraryAccessForCompleted(
+    completedRequests: MediaRequest[],
+    event: Media,
+    databaseEvent: Media,
+    is4k: boolean
+  ): Promise<void> {
+    // A request also completes when the media is marked deleted, and the rating
+    // key survives that for as long as a request is still active, so that case
+    // is skipped rather than left to fail against Plex.
+    if ((is4k ? event.status4k : event.status) === MediaStatus.DELETED) {
+      return;
+    }
+
+    // Read from the entity being saved, since the scanner sets the rating key
+    // in the same write that makes the media available.
+    const ratingKey = is4k
+      ? (event.ratingKey4k ?? databaseEvent.ratingKey4k)
+      : (event.ratingKey ?? databaseEvent.ratingKey);
+
+    for (const request of completedRequests) {
+      await grantLibraryAccessForRequest(
+        request.requestedBy,
+        ratingKey,
+        request.type,
+        request.id
+      );
     }
   }
 
@@ -254,14 +276,23 @@ export class MediaSubscriber implements EntitySubscriberInterface<Media> {
             seasonStatusCheck(false))) &&
         validStatuses.includes(event.entity.status)
       ) {
-        await withNestedTransaction(event.manager, async (manager) => {
-          await this.updateRelatedMediaRequest(
-            manager,
-            event.entity as Media,
-            event.databaseEntity as Media,
-            false
-          );
-        });
+        const completedRequests = await withNestedTransaction(
+          event.manager,
+          async (manager) =>
+            this.updateRelatedMediaRequest(
+              manager,
+              event.entity as Media,
+              event.databaseEntity as Media,
+              false
+            )
+        );
+
+        await this.grantLibraryAccessForCompleted(
+          completedRequests,
+          event.entity as Media,
+          event.databaseEntity as Media,
+          false
+        );
       }
     } catch (e) {
       logger.error(
@@ -282,14 +313,23 @@ export class MediaSubscriber implements EntitySubscriberInterface<Media> {
             seasonStatusCheck(true))) &&
         validStatuses.includes(event.entity.status4k)
       ) {
-        await withNestedTransaction(event.manager, async (manager) => {
-          await this.updateRelatedMediaRequest(
-            manager,
-            event.entity as Media,
-            event.databaseEntity as Media,
-            true
-          );
-        });
+        const completedRequests = await withNestedTransaction(
+          event.manager,
+          async (manager) =>
+            this.updateRelatedMediaRequest(
+              manager,
+              event.entity as Media,
+              event.databaseEntity as Media,
+              true
+            )
+        );
+
+        await this.grantLibraryAccessForCompleted(
+          completedRequests,
+          event.entity as Media,
+          event.databaseEntity as Media,
+          true
+        );
       }
     } catch (e) {
       logger.error(