pastilhas
470d4f83c3
the platform pushes the account list (users:list, declared by userProvisioning in the manifest); this decides what to do about each one and does it. DECIDING IS SEPARATE FROM DOING. reconcile.ts is pure and has no idea what jellyfin is — which is why it can be tested against the real populations on alpha without creating anything. nine tests, built on the actual overlap: diogo and fedra already have jellyfin accounts, conceiba and guipinto do not, rezio and peter exist only on jellyfin. that test found a real bug before it shipped. officer's `username` was unique CASE-SENSITIVELY, so `diogo` and `DIOGO` could both exist here while colliding on jellyfin's uppercased NormalizedUsername index — and the first version handed both the same jellyfin account, because it only checked links that already existed rather than ones claimed during the pass. the platform side is now case-insensitive too, so the collision cannot be created in the first place; the guard stays because the constraint and the guard protect different moments. three outcomes, and the third is the point: LINK an account that already exists, CREATE one that does not, LEAVE ALONE a jellyfin account with no officer user. never delete. an absence in officer is indistinguishable from a list that has not been told about someone yet, and a wrong deletion costs somebody their watch history. `adopted` carries that distinction into the mapping table. false means officer made the account and may remove it; true means it existed first and was merely linked. NOBODY IS EVER TOLD THEIR PASSWORD. jellyfin has no must-change flag — verified against its openapi, UserPolicy has 44 properties and none of them is one — so a handed-over password stays valid forever. instead the generated one is used once, immediately, to mint that person's own access token, and discarded. the account exists and their officer session can already read their library. which also makes rule 4 unskippable: the sign-in that verifies the account is the same call that obtains the token, so there is no version of this that "verifies later". one failure does not stop the rest. a partially provisioned server is fixed by running again; a run that aborts on the first error leaves everyone after them unprovisioned and no record of who.
Video (Jellyfin)
Films and shows from your own Jellyfin server, inside Officer — with a player that handles direct play, HLS and progressive, and an access token that never leaves the server.
What you get
- Home — resume, next up, recently added
- Libraries — browse films, shows, seasons and episodes
- Search across the library
- A real player — direct play where the file allows it, HLS where it doesn't, progressive as the fallback, with playback reported back to Jellyfin so resume works everywhere
- Multiple servers — add several and switch between them
Requirements
A running Jellyfin server Officer can reach, and an access token.
Setup
Install the plugin, open /jellyfin, and add a server: a label, the URL, and the token. The token is encrypted at rest and never sent to the browser.
Unlike Transmission and Soulseek, this plugin keeps its own registry — jellyfin_servers — because
having more than one Jellyfin is a real thing (a home server and a friend's). One is marked active.
The plugin does not install or supervise Jellyfin. Point it at one you already run.
Permissions
One permission, jellyfin, grantable per role like any other app permission.
Notes
web/vendor/hls.mjsis a checked-in third-party build (~1.3 MB), deliberately excluded from formatting so the diff against upstream stays readable.- Transcoding is the Jellyfin server's job. This plugin asks for a stream and plays what it gets.