From 07e50b72b6d797df2645a5b0565c7a1bcd04ac06 Mon Sep 17 00:00:00 2001
From: zZebrahz <zzebrahz@gmail.com>
Date: Sat, 30 May 2026 19:31:46 -0700
Subject: [PATCH] fix(auth): keep sessions on library scope changes

---
 internal/api/handlers/admin.go      |  9 ---------
 internal/api/handlers/admin_test.go | 14 +++++++-------
 2 files changed, 7 insertions(+), 16 deletions(-)

diff --git a/internal/api/handlers/admin.go b/internal/api/handlers/admin.go
index e1ccb92f..4c84e8e1 100644
--- a/internal/api/handlers/admin.go
+++ b/internal/api/handlers/admin.go
@@ -774,7 +774,6 @@ func updateMayRequireSessionRevocation(input models.UpdateUserInput) bool {
 	return input.Password != nil ||
 		input.Role != nil ||
 		input.Enabled != nil ||
-		input.LibraryIDs != nil ||
 		input.Permissions != nil ||
 		input.MaxPlaybackQuality != nil
 }
@@ -792,14 +791,6 @@ func updateRequiresSessionRevocation(current *models.User, input models.UpdateUs
 	if input.Enabled != nil && *input.Enabled != current.Enabled {
 		return true
 	}
-	if input.LibraryIDs != nil {
-		if (*input.LibraryIDs == nil) != (current.LibraryIDs == nil) {
-			return true
-		}
-		if *input.LibraryIDs != nil && !slices.Equal(*input.LibraryIDs, current.LibraryIDs) {
-			return true
-		}
-	}
 	if input.Permissions != nil && !slices.Equal(*input.Permissions, current.Permissions) {
 		return true
 	}
diff --git a/internal/api/handlers/admin_test.go b/internal/api/handlers/admin_test.go
index 423e0f09..a0ce0136 100644
--- a/internal/api/handlers/admin_test.go
+++ b/internal/api/handlers/admin_test.go
@@ -67,9 +67,9 @@ func TestUpdateRequiresSessionRevocation(t *testing.T) {
 			want: false,
 		},
 		{
-			name: "library ids",
+			name: "library ids does not revoke session",
 			in:   models.UpdateUserInput{LibraryIDs: &libraryIDs},
-			want: true,
+			want: false,
 		},
 		{
 			name: "library ids unchanged",
@@ -77,9 +77,9 @@ func TestUpdateRequiresSessionRevocation(t *testing.T) {
 			want: false,
 		},
 		{
-			name: "library ids nil differs from restricted",
+			name: "library ids nil does not revoke session",
 			in:   models.UpdateUserInput{LibraryIDs: &allLibraryIDs},
-			want: true,
+			want: false,
 		},
 		{
 			name: "max playback quality",
@@ -118,9 +118,9 @@ func TestUpdateRequiresSessionRevocation(t *testing.T) {
 
 	unrestrictedCurrent := *current
 	unrestrictedCurrent.LibraryIDs = nil
-	t.Run("library ids empty differs from nil", func(t *testing.T) {
-		if got := updateRequiresSessionRevocation(&unrestrictedCurrent, models.UpdateUserInput{LibraryIDs: &emptyLibraryIDs}); !got {
-			t.Fatalf("updateRequiresSessionRevocation() = %v, want true", got)
+	t.Run("library ids empty does not revoke session", func(t *testing.T) {
+		if got := updateRequiresSessionRevocation(&unrestrictedCurrent, models.UpdateUserInput{LibraryIDs: &emptyLibraryIDs}); got {
+			t.Fatalf("updateRequiresSessionRevocation() = %v, want false", got)
 		}
 	})