Remove the session policy bridge (IsAdmin/DownloadAllowed/LibraryIDs cached
on Session): the fields were never persisted to jellycompat_sessions, so any
restart zeroed them (admins rendered as non-admin, restricted users as
unrestricted), and group edits never refreshed them. Policy is now always
read from a freshly loaded user.
- userDTO loads the user via a userLoader (hydrated effective policy) and
fails the request on load error instead of falling back to permissive
defaults; login, /Users/Me, /Users, /Users/{id} are cold paths.
- Rename the apiKeyUserLoader interface/Dependencies field to userLoader/
UserLoader since it now also backs user DTOs and download enforcement.
- HandleDownload enforces the group-derived DownloadAllowed policy with a
fresh user load, returning 403 for restricted users and failing closed on
load errors; allowed-user behavior is unchanged (Infuse depends on it).
- Pin the EnabledFolders GUID encoding in TestUserPolicyFromEffectivePolicy.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude Code
6701da1829