Requests are automatically approved for users without auto-approve permission in Jellyseerr

[Jototo39]

Hello there,

Just installed and setup the plugin (2.1.9.11).
Jellyfin is 10.11.3
Jellyseerr is 2.7.3

I've tested to add favorite for couple shows from a Jellyfin regular user (i.e. non-admin on both Jellyfin/Jellyseerr),
Upon sync, the request is sent to Jellyseerr (as expected), but it is auto-approved, which triggers adding it to Sonarr, and grabing/downloading everything.

That is happening even though the Jellyseerr user permission setup specifically request an approval from admin :

I would assume that the plugin respects Jellyseerr permissions per user.

I've gone through the documentation but cannot find any relevant settings that I would have missed.
Please let me know otherwise.

Thank you,
Have a great day.

[kinggeorges12]

@Jototo39 thank you for submitting this. I was not testing for the auto-approval feature.

I doubt you are doing making a mistake with the setup. The Jellyseerr integration probably uses the API authorized user account (root/admin, in this case) to validate the auto-approve feature, which to me seems like a bug. Let me look at the documentation to see if Jellyseerr provides a way to authorize the request as that particular user so it doesn't use the API user's account for the auto-approve step.

[Jototo39]

Hello,
To further clarify, here is the status of 2 requests in Jellyseerr, both done with the same user that DO NOT have auto-approve permission (require an admin approval)

• The top one went through the Jellyseerr standard process (requested by user in Jellyseerr, pending approval of admin)
• The bottom one was created by setting an item as favorite in Jellyfin, then was somehow auto-approved by the plugin

[kinggeorges12]

@Jototo39 Yes thanks for the additional documentation. I agree 100% with your assessment that this is not following the expected behavior.

I tested this myself and the issue stems from Jellyseerr itself. The way the API works is that it uses the auto-approve permissions of the API key holder, which in this case is the admin user. This seems like an unexpected behavior, which I would expect to use the permissions of the "requesting user" rather than the submitter (admin or API key holder) to provide the auto-approve permissions.

In the same API call, the permissions make the request and quotas are all inherited from the "requesting user". The only difference comes from the auto-approve permissions, which for some reason use the admin or API key holder permissions.

I will submit a pull request with the updated code to the main jellyseerr project. However, they have a message on their github that they are merging the project with something right now so it could be quite a while to update this. In the meantime, I will upload my own image to dockerhub to use with just that one code update.

Sorry that this solution may not be ideal for users that want to use the latest release from Jellyseerr, but these larger projects have a complex development process, and I wouldn't want to short-circuit their team when they are making such big changes. It may help me if you can submit an issue in the Seerr repository so that I can create a pull request and get this fix included in the next Jellyseerr release: https://github.com/seerr-team/seerr/issues

The new docker image uses the same exact code as the official fallenbagel image, with the one change you are requesting. Please change your docker compose to point to the image kinggeorges12/jellyseerr:latest or kinggeorges12/jellyseerr:2.7.3-jb

You may also see the Github branch with the code change here: https://github.com/kinggeorges12/seerr/tree/v2.7.3-jb

Added the pull request for Jellyseerr's develop branch: seerr-team/seerr#2173

[Jototo39]

Hi,

Thanks for checking this, seems consistant with what I've experienced.

Indeed, I've heard about the merging of Jellyseerr and Overseerr into Seerr, not sure when this will go live though...

I'll be sure to test again if they include the fix you submitted.

[kinggeorges12]

@Jototo39 Great! In the meantime, feel free to use that docker image kinggeorges12/jellyseerr:latest with the included fix to the Requests API. I just got done testing it for the bug report and the permissions are consistent with expectations (root can request on behalf of users, users can't request for root). Hopefully, Jellyseerr will accept the pull request to fix this bug and you can switch back to the main Jellyseerr branch whenever it goes live!