From 1937a1e512bb79956ec637e6b9e3d87cef89375a Mon Sep 17 00:00:00 2001
From: Ben <benklop@gmail.com>
Date: Sun, 18 Oct 2026 22:48:15 -0400
Subject: [PATCH] Say why a sign in was refused when the account can't be used
 right now.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 components/config/SigninScene.bs        | 11 +++++++
 components/config/SigninScene.xml       |  2 +-
 components/quickConnect/QuickConnect.bs |  9 ++++--
 locale/en_US/translations.ts            |  5 +++
 source/api/userauth.bs                  | 41 +++++++++++++++----------
 test/server-compatibility.bs            |  1 +
 test/server-compatibility.mjs           |  3 +-
 test/sign-in-refused.bs                 | 21 +++++++++++++
 8 files changed, 73 insertions(+), 20 deletions(-)
 create mode 100644 test/sign-in-refused.bs

diff --git a/components/config/SigninScene.bs b/components/config/SigninScene.bs
index 3a248528a..a104a71fb 100644
--- a/components/config/SigninScene.bs
+++ b/components/config/SigninScene.bs
@@ -191,6 +191,11 @@ sub onAlertChange()
 
     errorMessage = m.top.findNode("errorMessage")
     errorMessage.text = m.top.alert
+
+    ' Some messages run to several lines, so the box grows to hold them instead of covering the first.
+    textHeight = errorMessage.boundingRect().height
+    m.errorContainer.height = textHeight + 26
+    if m.errorContainer.height < 60 then m.errorContainer.height = 60
 end sub
 
 sub onUserChange()
@@ -282,6 +287,12 @@ sub onQuickConnectAuthenticated()
 
     if authenticated >= 0 then return
 
+    if authenticated = -2
+        m.top.alert = signInRefusedMessage()
+        hideQuickConnect()
+        return
+    end if
+
     ' A poll that can never succeed looks the same as one still waiting to be approved, so
     ' the wait is bounded rather than left running until the viewer walks away
     m.quickConnectAttempts = m.quickConnectAttempts + 1
diff --git a/components/config/SigninScene.xml b/components/config/SigninScene.xml
index 46ae31486..c1419c51f 100644
--- a/components/config/SigninScene.xml
+++ b/components/config/SigninScene.xml
@@ -25,7 +25,7 @@
       uri="pkg:/images/surface.9.png">
 
       <Rectangle id="errorContainer" visible="false" width="600" height="60" translation="[305, 625]">
-        <Text id="errorMessage" text="" wrap="true" width="600" font="font:SmallSystemFont" horizAlign="center" color="0xffe0e0" translation="[10, 13]" />
+        <Text id="errorMessage" text="" wrap="true" width="580" font="font:SmallSystemFont" horizAlign="center" color="0xffe0e0" translation="[10, 13]" />
       </Rectangle>
 
       <Label id="signInTitle"
diff --git a/components/quickConnect/QuickConnect.bs b/components/quickConnect/QuickConnect.bs
index e999416b8..c4054bc33 100644
--- a/components/quickConnect/QuickConnect.bs
+++ b/components/quickConnect/QuickConnect.bs
@@ -39,8 +39,13 @@ sub monitorQuickConnect()
     authenticated = checkQuickConnect(m.top.secret)
 
     if authenticated = true
-        loggedIn = AuthenticateViaQuickConnect(m.top.secret)
-        if loggedIn
+        result = AuthenticateViaQuickConnect(m.top.secret)
+        if result.refused
+            ' Polling again would only be refused again.
+            m.top.authenticated = -2
+            return
+        end if
+        if result.ok
             session.setRuntimeRequestContextValue("moonfin.authToken", m.global.session.user.authToken)
 
             currentUser = AboutMe()
diff --git a/locale/en_US/translations.ts b/locale/en_US/translations.ts
index 9ef390f37..84ad9e625 100644
--- a/locale/en_US/translations.ts
+++ b/locale/en_US/translations.ts
@@ -7120,5 +7120,10 @@
         <translation>External Lists</translation>
         <extracomment>Heading of a group of disabled rows in the Home Rows editor</extracomment>
     </message>
+    <message>
+        <source>This account can&apos;t sign in right now. It may be outside its allowed hours, locked or disabled. Try again later or ask an administrator.</source>
+        <translation>This account can&apos;t sign in right now. It may be outside its allowed hours, locked or disabled. Try again later or ask an administrator.</translation>
+        <extracomment>Shown when the server refuses a sign in because the account can't be used right now, for example outside its access schedule</extracomment>
+    </message>
 </context>
 </TS>
diff --git a/source/api/userauth.bs b/source/api/userauth.bs
index 0494140a9..ca178fa66 100644
--- a/source/api/userauth.bs
+++ b/source/api/userauth.bs
@@ -23,9 +23,17 @@ function validPasswordLogin(response as object) as boolean
     return embyConnect.StringValue(json.User, ["Id"]) <> "" and embyConnect.StringValue(json.User, ["Name"]) <> ""
 end function
 
+' Jellyfin refuses a sign in with a 403 when the account can't be used right now, for instance
+' outside the hours of its access schedule, and gives no reason beyond that. A wrong password is
+' a 401, but the account is checked first, so such an account gets this for any password.
+function signInRefusedMessage() as string
+    return tr("This account can't sign in right now. It may be outside its allowed hours, locked or disabled. Try again later or ask an administrator.")
+end function
+
 function passwordLoginError(status as integer) as string
     if status = 401 or status = 403
         if isEmbyServer() then return tr("Emby server rejected the login. Use the local server account, or choose Emby Connect for your Emby account.")
+        if status = 403 then return signInRefusedMessage()
         return tr("Username or password is incorrect, or access is denied.")
     end if
     if status = 0 then return tr("The server did not respond. Check the connection and try again.")
@@ -248,23 +256,24 @@ function checkQuickConnect(secret)
     return false
 end function
 
-function AuthenticateViaQuickConnect(secret)
-    params = {
-        secret: secret
-    }
-    req = APIRequest("Users/AuthenticateWithQuickConnect")
-    jsonResponse = postJson(req, FormatJson(params))
-    if jsonResponse <> invalid and jsonResponse.AccessToken <> invalid and jsonResponse.User <> invalid
-        userdata = CreateObject("roSGNode", "UserData")
-        userdata.json = jsonResponse
-        session.user.Update("id", jsonResponse.User.Id)
-        session.user.Update("authToken", jsonResponse.AccessToken)
-        userdata.callFunc("saveToRegistry")
-
-        return true
-    end if
+' Exchanges an approved Quick Connect secret for a session. refused is true when the server turned
+' the account away, which it does with a 403 and nothing in the body.
+function AuthenticateViaQuickConnect(secret) as object
+    serverUrl = get_url()
+    header = buildAuthHeaderForServer({ serverUrl: serverUrl, userId: "", authToken: "" })
+    headers = { "Content-Type": "application/json", "Authorization": header }
+    if isEmbyServer(serverUrl) then headers["X-Emby-Authorization"] = header
+    url = buildURLForServer(serverUrl, "Users/AuthenticateWithQuickConnect", {})
+    response = embyConnect.Request(url, "POST", FormatJson({ secret: secret }), headers)
+    if not validPasswordLogin(response) then return { ok: false, refused: response.status = 403 }
 
-    return false
+    jsonResponse = response.data
+    userdata = CreateObject("roSGNode", "UserData")
+    userdata.json = jsonResponse
+    session.user.Update("id", jsonResponse.User.Id)
+    session.user.Update("authToken", jsonResponse.AccessToken)
+    userdata.callFunc("saveToRegistry")
+    return { ok: true, refused: false }
 end function
 
 sub forgetServerIdentity(serverUrl as dynamic, removedUserId as string)
diff --git a/test/server-compatibility.bs b/test/server-compatibility.bs
index 43d812f49..0d825dfa5 100644
--- a/test/server-compatibility.bs
+++ b/test/server-compatibility.bs
@@ -133,6 +133,7 @@ sub Main()
     testReviewRegressions()
     testAccentFolding()
     testQuickConnectUrl()
+    testSignInRefused()
     testLogRedaction()
     testYoutubeTrailer()
     testPlaybackFallback()
diff --git a/test/server-compatibility.mjs b/test/server-compatibility.mjs
index 11c1e0c5d..236af5f91 100644
--- a/test/server-compatibility.mjs
+++ b/test/server-compatibility.mjs
@@ -91,7 +91,7 @@ const selections = {
     'components/captionTask.bs': ['trackAddress'],
     'components/ItemGrid/LoadVideoContentTask.bs': ['playbackResourceURL', 'resolvePlaybackURL', 'playbackPort', 'normalizedPlaybackPort', 'playbackUsesServerAuth', 'isHTTPStream', 'getTranscodeReasons', 'addVideoContentURL', 'addSourceCodecs', 'shouldBurnInSubtitle', 'transcodeCopiesVideo', 'audioPlaysDirect', 'containersOverlap'],
     'components/ItemGrid/LoadItemsTask2.bs': ['getTargetImageURL', 'getTargetServerUrl', 'isUsingRemoteServer'],
-    'source/api/userauth.bs': ['passwordLoginRequest', 'validPasswordLogin', 'passwordLoginError'],
+    'source/api/userauth.bs': ['passwordLoginRequest', 'validPasswordLogin', 'passwordLoginError', 'signInRefusedMessage', 'AuthenticateViaQuickConnect'],
     'source/utils/config.bs': ['current_user_id', 'get_user_setting'],
     'source/utils/misc.bs': ['isLocalhost', 'isSupportedMediaServer', 'urlCandidates', 'isValid', 'isAllValid', 'isStringEqual', 'isChainValid', 'chainLookupReturn', 'chainLookup', 'isValidAndNotEmpty', 'serverVersionMeetsMinimumRequirements', 'playlistRenumbersAfterDelete', 'toString', 'getHomeBackdropBlurAmount', 'inArray', 'guidKey', 'isString', 'toBoolean', 'leftPad'],
     'source/ShowScenes.bs': ['ServerVersionCheck', 'startDetailExtras'],
@@ -131,6 +131,7 @@ source += '\n' + await readFile('test/server-compatibility.bs', 'utf8');
 source += '\n' + await readFile('test/review-regressions.bs', 'utf8');
 source += '\n' + await readFile('test/accent-folding.bs', 'utf8');
 source += '\n' + await readFile('test/quick-connect-url.bs', 'utf8');
+source += '\n' + await readFile('test/sign-in-refused.bs', 'utf8');
 source += '\n' + await readFile('test/log-redaction.bs', 'utf8');
 source += '\n' + await readFile('test/youtube-trailer.bs', 'utf8');
 source += '\n' + await readFile('test/playback-fallback.bs', 'utf8');
diff --git a/test/sign-in-refused.bs b/test/sign-in-refused.bs
new file mode 100644
index 000000000..f2af55e64
--- /dev/null
+++ b/test/sign-in-refused.bs
@@ -0,0 +1,21 @@
+sub testSignInRefused()
+    m.global.session.server = { url: "https://jellyfin.test", serverType: "jellyfin" }
+    refused = signInRefusedMessage()
+    assertEqual(passwordLoginError(403), refused, "A 403 from Jellyfin says the account can't sign in right now")
+    assertEqual(passwordLoginError(401) <> refused, true, "A wrong password keeps its own message")
+    assertEqual(passwordLoginError(500).Instr("500") >= 0, true, "Other failures keep their messages")
+    assertEqual(refused.Instr("allowed hours") >= 0, true, "The message names the schedule as one possible reason")
+
+    m.requests = []
+    m.responses = [{ status: 403, data: invalid }]
+    result = AuthenticateViaQuickConnect("secret")
+    assertEqual(result.refused, true, "A refused Quick Connect exchange is reported as refused")
+    assertEqual(result.ok, false, "A refused Quick Connect exchange does not sign in")
+    assertEqual(m.requests[0].url, "https://jellyfin.test/Users/AuthenticateWithQuickConnect", "The exchange goes to the Quick Connect route")
+    assertEqual(ParseJson(m.requests[0].body).secret, "secret", "The exchange sends the approved secret")
+
+    m.responses = [{ status: 500, data: invalid }]
+    result = AuthenticateViaQuickConnect("secret")
+    assertEqual(result.refused, false, "A server error is not a refusal")
+    assertEqual(result.ok, false, "A server error does not sign in")
+end sub