Merge branch 'jellyfin:master' into master

1 files changed, 460 insertions, 462 deletions

diff --git a/Jellyfin.Api/Controllers/UserController.cs b/Jellyfin.Api/Controllers/UserController.cs
index 568224a42..530bd9603 100644
--- a/Jellyfin.Api/Controllers/UserController.cs
+++ b/Jellyfin.Api/Controllers/UserController.cs
@@ -15,6 +15,7 @@ using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Controller.Devices;
 using MediaBrowser.Controller.Library;
 using MediaBrowser.Controller.Net;
+using MediaBrowser.Controller.Playlists;
 using MediaBrowser.Controller.QuickConnect;
 using MediaBrowser.Controller.Session;
 using MediaBrowser.Model.Configuration;
@@ -25,564 +26,561 @@ using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Logging;
 
-namespace Jellyfin.Api.Controllers
+namespace Jellyfin.Api.Controllers;
+
+/// <summary>
+/// User controller.
+/// </summary>
+[Route("Users")]
+public class UserController : BaseJellyfinApiController
 {
+    private readonly IUserManager _userManager;
+    private readonly ISessionManager _sessionManager;
+    private readonly INetworkManager _networkManager;
+    private readonly IDeviceManager _deviceManager;
+    private readonly IAuthorizationContext _authContext;
+    private readonly IServerConfigurationManager _config;
+    private readonly ILogger _logger;
+    private readonly IQuickConnect _quickConnectManager;
+    private readonly IPlaylistManager _playlistManager;
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="UserController"/> class.
+    /// </summary>
+    /// <param name="userManager">Instance of the <see cref="IUserManager"/> interface.</param>
+    /// <param name="sessionManager">Instance of the <see cref="ISessionManager"/> interface.</param>
+    /// <param name="networkManager">Instance of the <see cref="INetworkManager"/> interface.</param>
+    /// <param name="deviceManager">Instance of the <see cref="IDeviceManager"/> interface.</param>
+    /// <param name="authContext">Instance of the <see cref="IAuthorizationContext"/> interface.</param>
+    /// <param name="config">Instance of the <see cref="IServerConfigurationManager"/> interface.</param>
+    /// <param name="logger">Instance of the <see cref="ILogger"/> interface.</param>
+    /// <param name="quickConnectManager">Instance of the <see cref="IQuickConnect"/> interface.</param>
+    /// <param name="playlistManager">Instance of the <see cref="IPlaylistManager"/> interface.</param>
+    public UserController(
+        IUserManager userManager,
+        ISessionManager sessionManager,
+        INetworkManager networkManager,
+        IDeviceManager deviceManager,
+        IAuthorizationContext authContext,
+        IServerConfigurationManager config,
+        ILogger<UserController> logger,
+        IQuickConnect quickConnectManager,
+        IPlaylistManager playlistManager)
+    {
+        _userManager = userManager;
+        _sessionManager = sessionManager;
+        _networkManager = networkManager;
+        _deviceManager = deviceManager;
+        _authContext = authContext;
+        _config = config;
+        _logger = logger;
+        _quickConnectManager = quickConnectManager;
+        _playlistManager = playlistManager;
+    }
+
+    /// <summary>
+    /// Gets a list of users.
+    /// </summary>
+    /// <param name="isHidden">Optional filter by IsHidden=true or false.</param>
+    /// <param name="isDisabled">Optional filter by IsDisabled=true or false.</param>
+    /// <response code="200">Users returned.</response>
+    /// <returns>An <see cref="IEnumerable{UserDto}"/> containing the users.</returns>
+    [HttpGet]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public ActionResult<IEnumerable<UserDto>> GetUsers(
+        [FromQuery] bool? isHidden,
+        [FromQuery] bool? isDisabled)
+    {
+        var users = Get(isHidden, isDisabled, false, false);
+        return Ok(users);
+    }
+
     /// <summary>
-    /// User controller.
+    /// Gets a list of publicly visible users for display on a login screen.
     /// </summary>
-    [Route("Users")]
-    public class UserController : BaseJellyfinApiController
+    /// <response code="200">Public users returned.</response>
+    /// <returns>An <see cref="IEnumerable{UserDto}"/> containing the public users.</returns>
+    [HttpGet("Public")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public ActionResult<IEnumerable<UserDto>> GetPublicUsers()
     {
-        private readonly IUserManager _userManager;
-        private readonly ISessionManager _sessionManager;
-        private readonly INetworkManager _networkManager;
-        private readonly IDeviceManager _deviceManager;
-        private readonly IAuthorizationContext _authContext;
-        private readonly IServerConfigurationManager _config;
-        private readonly ILogger _logger;
-        private readonly IQuickConnect _quickConnectManager;
-
-        /// <summary>
-        /// Initializes a new instance of the <see cref="UserController"/> class.
-        /// </summary>
-        /// <param name="userManager">Instance of the <see cref="IUserManager"/> interface.</param>
-        /// <param name="sessionManager">Instance of the <see cref="ISessionManager"/> interface.</param>
-        /// <param name="networkManager">Instance of the <see cref="INetworkManager"/> interface.</param>
-        /// <param name="deviceManager">Instance of the <see cref="IDeviceManager"/> interface.</param>
-        /// <param name="authContext">Instance of the <see cref="IAuthorizationContext"/> interface.</param>
-        /// <param name="config">Instance of the <see cref="IServerConfigurationManager"/> interface.</param>
-        /// <param name="logger">Instance of the <see cref="ILogger"/> interface.</param>
-        /// <param name="quickConnectManager">Instance of the <see cref="IQuickConnect"/> interface.</param>
-        public UserController(
-            IUserManager userManager,
-            ISessionManager sessionManager,
-            INetworkManager networkManager,
-            IDeviceManager deviceManager,
-            IAuthorizationContext authContext,
-            IServerConfigurationManager config,
-            ILogger<UserController> logger,
-            IQuickConnect quickConnectManager)
+        // If the startup wizard hasn't been completed then just return all users
+        if (!_config.Configuration.IsStartupWizardCompleted)
         {
-            _userManager = userManager;
-            _sessionManager = sessionManager;
-            _networkManager = networkManager;
-            _deviceManager = deviceManager;
-            _authContext = authContext;
-            _config = config;
-            _logger = logger;
-            _quickConnectManager = quickConnectManager;
+            return Ok(Get(false, false, false, false));
         }
 
-        /// <summary>
-        /// Gets a list of users.
-        /// </summary>
-        /// <param name="isHidden">Optional filter by IsHidden=true or false.</param>
-        /// <param name="isDisabled">Optional filter by IsDisabled=true or false.</param>
-        /// <response code="200">Users returned.</response>
-        /// <returns>An <see cref="IEnumerable{UserDto}"/> containing the users.</returns>
-        [HttpGet]
-        [Authorize(Policy = Policies.DefaultAuthorization)]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public ActionResult<IEnumerable<UserDto>> GetUsers(
-            [FromQuery] bool? isHidden,
-            [FromQuery] bool? isDisabled)
+        return Ok(Get(false, false, true, true));
+    }
+
+    /// <summary>
+    /// Gets a user by Id.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <response code="200">User returned.</response>
+    /// <response code="404">User not found.</response>
+    /// <returns>An <see cref="UserDto"/> with information about the user or a <see cref="NotFoundResult"/> if the user was not found.</returns>
+    [HttpGet("{userId}")]
+    [Authorize(Policy = Policies.IgnoreParentalControl)]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public ActionResult<UserDto> GetUserById([FromRoute, Required] Guid userId)
+    {
+        var user = _userManager.GetUserById(userId);
+
+        if (user is null)
         {
-            var users = Get(isHidden, isDisabled, false, false);
-            return Ok(users);
+            return NotFound("User not found");
         }
 
-        /// <summary>
-        /// Gets a list of publicly visible users for display on a login screen.
-        /// </summary>
-        /// <response code="200">Public users returned.</response>
-        /// <returns>An <see cref="IEnumerable{UserDto}"/> containing the public users.</returns>
-        [HttpGet("Public")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public ActionResult<IEnumerable<UserDto>> GetPublicUsers()
+        var result = _userManager.GetUserDto(user, HttpContext.GetNormalizedRemoteIp().ToString());
+        return result;
+    }
+
+    /// <summary>
+    /// Deletes a user.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <response code="204">User deleted.</response>
+    /// <response code="404">User not found.</response>
+    /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="NotFoundResult"/> if the user was not found.</returns>
+    [HttpDelete("{userId}")]
+    [Authorize(Policy = Policies.RequiresElevation)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult> DeleteUser([FromRoute, Required] Guid userId)
+    {
+        var user = _userManager.GetUserById(userId);
+        if (user is null)
         {
-            // If the startup wizard hasn't been completed then just return all users
-            if (!_config.Configuration.IsStartupWizardCompleted)
-            {
-                return Ok(Get(false, false, false, false));
-            }
+            return NotFound();
+        }
+
+        await _sessionManager.RevokeUserTokens(user.Id, null).ConfigureAwait(false);
+        await _playlistManager.RemovePlaylistsAsync(userId).ConfigureAwait(false);
+        await _userManager.DeleteUserAsync(userId).ConfigureAwait(false);
+        return NoContent();
+    }
+
+    /// <summary>
+    /// Authenticates a user.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <param name="pw">The password as plain text.</param>
+    /// <response code="200">User authenticated.</response>
+    /// <response code="403">Sha1-hashed password only is not allowed.</response>
+    /// <response code="404">User not found.</response>
+    /// <returns>A <see cref="Task"/> containing an <see cref="AuthenticationResult"/>.</returns>
+    [HttpPost("{userId}/Authenticate")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    [Obsolete("Authenticate with username instead")]
+    public async Task<ActionResult<AuthenticationResult>> AuthenticateUser(
+        [FromRoute, Required] Guid userId,
+        [FromQuery, Required] string pw)
+    {
+        var user = _userManager.GetUserById(userId);
 
-            return Ok(Get(false, false, true, true));
+        if (user is null)
+        {
+            return NotFound("User not found");
         }
 
-        /// <summary>
-        /// Gets a user by Id.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <response code="200">User returned.</response>
-        /// <response code="404">User not found.</response>
-        /// <returns>An <see cref="UserDto"/> with information about the user or a <see cref="NotFoundResult"/> if the user was not found.</returns>
-        [HttpGet("{userId}")]
-        [Authorize(Policy = Policies.IgnoreParentalControl)]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public ActionResult<UserDto> GetUserById([FromRoute, Required] Guid userId)
+        AuthenticateUserByName request = new AuthenticateUserByName
         {
-            var user = _userManager.GetUserById(userId);
+            Username = user.Username,
+            Pw = pw
+        };
+        return await AuthenticateUserByName(request).ConfigureAwait(false);
+    }
 
-            if (user is null)
+    /// <summary>
+    /// Authenticates a user by name.
+    /// </summary>
+    /// <param name="request">The <see cref="AuthenticateUserByName"/> request.</param>
+    /// <response code="200">User authenticated.</response>
+    /// <returns>A <see cref="Task"/> containing an <see cref="AuthenticationRequest"/> with information about the new session.</returns>
+    [HttpPost("AuthenticateByName")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public async Task<ActionResult<AuthenticationResult>> AuthenticateUserByName([FromBody, Required] AuthenticateUserByName request)
+    {
+        var auth = await _authContext.GetAuthorizationInfo(Request).ConfigureAwait(false);
+
+        try
+        {
+            var result = await _sessionManager.AuthenticateNewSession(new AuthenticationRequest
             {
-                return NotFound("User not found");
-            }
+                App = auth.Client,
+                AppVersion = auth.Version,
+                DeviceId = auth.DeviceId,
+                DeviceName = auth.Device,
+                Password = request.Pw,
+                RemoteEndPoint = HttpContext.GetNormalizedRemoteIp().ToString(),
+                Username = request.Username
+            }).ConfigureAwait(false);
 
-            var result = _userManager.GetUserDto(user, HttpContext.GetNormalizedRemoteIp().ToString());
             return result;
         }
-
-        /// <summary>
-        /// Deletes a user.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <response code="204">User deleted.</response>
-        /// <response code="404">User not found.</response>
-        /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="NotFoundResult"/> if the user was not found.</returns>
-        [HttpDelete("{userId}")]
-        [Authorize(Policy = Policies.RequiresElevation)]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
-        [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public async Task<ActionResult> DeleteUser([FromRoute, Required] Guid userId)
+        catch (SecurityException e)
         {
-            var user = _userManager.GetUserById(userId);
-            await _sessionManager.RevokeUserTokens(user.Id, null).ConfigureAwait(false);
-            await _userManager.DeleteUserAsync(userId).ConfigureAwait(false);
-            return NoContent();
+            // rethrow adding IP address to message
+            throw new SecurityException($"[{HttpContext.GetNormalizedRemoteIp()}] {e.Message}", e);
         }
+    }
 
-        /// <summary>
-        /// Authenticates a user.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <param name="pw">The password as plain text.</param>
-        /// <response code="200">User authenticated.</response>
-        /// <response code="403">Sha1-hashed password only is not allowed.</response>
-        /// <response code="404">User not found.</response>
-        /// <returns>A <see cref="Task"/> containing an <see cref="AuthenticationResult"/>.</returns>
-        [HttpPost("{userId}/Authenticate")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        [ProducesResponseType(StatusCodes.Status404NotFound)]
-        [Obsolete("Authenticate with username instead")]
-        public async Task<ActionResult<AuthenticationResult>> AuthenticateUser(
-            [FromRoute, Required] Guid userId,
-            [FromQuery, Required] string pw)
+    /// <summary>
+    /// Authenticates a user with quick connect.
+    /// </summary>
+    /// <param name="request">The <see cref="QuickConnectDto"/> request.</param>
+    /// <response code="200">User authenticated.</response>
+    /// <response code="400">Missing token.</response>
+    /// <returns>A <see cref="Task"/> containing an <see cref="AuthenticationRequest"/> with information about the new session.</returns>
+    [HttpPost("AuthenticateWithQuickConnect")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public ActionResult<AuthenticationResult> AuthenticateWithQuickConnect([FromBody, Required] QuickConnectDto request)
+    {
+        try
         {
-            var user = _userManager.GetUserById(userId);
-
-            if (user is null)
-            {
-                return NotFound("User not found");
-            }
-
-            AuthenticateUserByName request = new AuthenticateUserByName
-            {
-                Username = user.Username,
-                Pw = pw
-            };
-            return await AuthenticateUserByName(request).ConfigureAwait(false);
+            return _quickConnectManager.GetAuthorizedRequest(request.Secret);
         }
-
-        /// <summary>
-        /// Authenticates a user by name.
-        /// </summary>
-        /// <param name="request">The <see cref="AuthenticateUserByName"/> request.</param>
-        /// <response code="200">User authenticated.</response>
-        /// <returns>A <see cref="Task"/> containing an <see cref="AuthenticationRequest"/> with information about the new session.</returns>
-        [HttpPost("AuthenticateByName")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public async Task<ActionResult<AuthenticationResult>> AuthenticateUserByName([FromBody, Required] AuthenticateUserByName request)
+        catch (SecurityException e)
         {
-            var auth = await _authContext.GetAuthorizationInfo(Request).ConfigureAwait(false);
+            // rethrow adding IP address to message
+            throw new SecurityException($"[{HttpContext.GetNormalizedRemoteIp()}] {e.Message}", e);
+        }
+    }
 
-            try
-            {
-                var result = await _sessionManager.AuthenticateNewSession(new AuthenticationRequest
-                {
-                    App = auth.Client,
-                    AppVersion = auth.Version,
-                    DeviceId = auth.DeviceId,
-                    DeviceName = auth.Device,
-                    Password = request.Pw,
-                    RemoteEndPoint = HttpContext.GetNormalizedRemoteIp().ToString(),
-                    Username = request.Username
-                }).ConfigureAwait(false);
-
-                return result;
-            }
-            catch (SecurityException e)
-            {
-                // rethrow adding IP address to message
-                throw new SecurityException($"[{HttpContext.GetNormalizedRemoteIp()}] {e.Message}", e);
-            }
+    /// <summary>
+    /// Updates a user's password.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <param name="request">The <see cref="UpdateUserPassword"/> request.</param>
+    /// <response code="204">Password successfully reset.</response>
+    /// <response code="403">User is not allowed to update the password.</response>
+    /// <response code="404">User not found.</response>
+    /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="ForbidResult"/> or a <see cref="NotFoundResult"/> on failure.</returns>
+    [HttpPost("{userId}/Password")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public async Task<ActionResult> UpdateUserPassword(
+        [FromRoute, Required] Guid userId,
+        [FromBody, Required] UpdateUserPassword request)
+    {
+        if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
+        {
+            return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the password.");
         }
 
-        /// <summary>
-        /// Authenticates a user with quick connect.
-        /// </summary>
-        /// <param name="request">The <see cref="QuickConnectDto"/> request.</param>
-        /// <response code="200">User authenticated.</response>
-        /// <response code="400">Missing token.</response>
-        /// <returns>A <see cref="Task"/> containing an <see cref="AuthenticationRequest"/> with information about the new session.</returns>
-        [HttpPost("AuthenticateWithQuickConnect")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public ActionResult<AuthenticationResult> AuthenticateWithQuickConnect([FromBody, Required] QuickConnectDto request)
+        var user = _userManager.GetUserById(userId);
+
+        if (user is null)
         {
-            try
-            {
-                return _quickConnectManager.GetAuthorizedRequest(request.Secret);
-            }
-            catch (SecurityException e)
-            {
-                // rethrow adding IP address to message
-                throw new SecurityException($"[{HttpContext.GetNormalizedRemoteIp()}] {e.Message}", e);
-            }
+            return NotFound("User not found");
         }
 
-        /// <summary>
-        /// Updates a user's password.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <param name="request">The <see cref="UpdateUserPassword"/> request.</param>
-        /// <response code="204">Password successfully reset.</response>
-        /// <response code="403">User is not allowed to update the password.</response>
-        /// <response code="404">User not found.</response>
-        /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="ForbidResult"/> or a <see cref="NotFoundResult"/> on failure.</returns>
-        [HttpPost("{userId}/Password")]
-        [Authorize(Policy = Policies.DefaultAuthorization)]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public async Task<ActionResult> UpdateUserPassword(
-            [FromRoute, Required] Guid userId,
-            [FromBody, Required] UpdateUserPassword request)
+        if (request.ResetPassword)
+        {
+            await _userManager.ResetPassword(user).ConfigureAwait(false);
+        }
+        else
         {
-            if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
+            if (!User.IsInRole(UserRoles.Administrator) || User.GetUserId().Equals(userId))
             {
-                return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the password.");
+                var success = await _userManager.AuthenticateUser(
+                    user.Username,
+                    request.CurrentPw ?? string.Empty,
+                    request.CurrentPw ?? string.Empty,
+                    HttpContext.GetNormalizedRemoteIp().ToString(),
+                    false).ConfigureAwait(false);
+
+                if (success is null)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, "Invalid user or password entered.");
+                }
             }
 
-            var user = _userManager.GetUserById(userId);
-
-            if (user is null)
-            {
-                return NotFound("User not found");
-            }
+            await _userManager.ChangePassword(user, request.NewPw ?? string.Empty).ConfigureAwait(false);
 
-            if (request.ResetPassword)
-            {
-                await _userManager.ResetPassword(user).ConfigureAwait(false);
-            }
-            else
-            {
-                if (!User.IsInRole(UserRoles.Administrator))
-                {
-                    var success = await _userManager.AuthenticateUser(
-                        user.Username,
-                        request.CurrentPw,
-                        request.CurrentPw,
-                        HttpContext.GetNormalizedRemoteIp().ToString(),
-                        false).ConfigureAwait(false);
-
-                    if (success is null)
-                    {
-                        return StatusCode(StatusCodes.Status403Forbidden, "Invalid user or password entered.");
-                    }
-                }
+            var currentToken = User.GetToken();
 
-                await _userManager.ChangePassword(user, request.NewPw).ConfigureAwait(false);
+            await _sessionManager.RevokeUserTokens(user.Id, currentToken).ConfigureAwait(false);
+        }
 
-                var currentToken = User.GetToken();
+        return NoContent();
+    }
 
-                await _sessionManager.RevokeUserTokens(user.Id, currentToken).ConfigureAwait(false);
-            }
+    /// <summary>
+    /// Updates a user's easy password.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <param name="request">The <see cref="UpdateUserEasyPassword"/> request.</param>
+    /// <response code="204">Password successfully reset.</response>
+    /// <response code="403">User is not allowed to update the password.</response>
+    /// <response code="404">User not found.</response>
+    /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="ForbidResult"/> or a <see cref="NotFoundResult"/> on failure.</returns>
+    [HttpPost("{userId}/EasyPassword")]
+    [Obsolete("Use Quick Connect instead")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    [ProducesResponseType(StatusCodes.Status404NotFound)]
+    public ActionResult UpdateUserEasyPassword(
+        [FromRoute, Required] Guid userId,
+        [FromBody, Required] UpdateUserEasyPassword request)
+    {
+        return Forbid();
+    }
 
-            return NoContent();
+    /// <summary>
+    /// Updates a user.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <param name="updateUser">The updated user model.</param>
+    /// <response code="204">User updated.</response>
+    /// <response code="400">User information was not supplied.</response>
+    /// <response code="403">User update forbidden.</response>
+    /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="BadRequestResult"/> or a <see cref="ForbidResult"/> on failure.</returns>
+    [HttpPost("{userId}")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult> UpdateUser(
+        [FromRoute, Required] Guid userId,
+        [FromBody, Required] UserDto updateUser)
+    {
+        var user = _userManager.GetUserById(userId);
+        if (user is null)
+        {
+            return NotFound();
         }
 
-        /// <summary>
-        /// Updates a user's easy password.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <param name="request">The <see cref="UpdateUserEasyPassword"/> request.</param>
-        /// <response code="204">Password successfully reset.</response>
-        /// <response code="403">User is not allowed to update the password.</response>
-        /// <response code="404">User not found.</response>
-        /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="ForbidResult"/> or a <see cref="NotFoundResult"/> on failure.</returns>
-        [HttpPost("{userId}/EasyPassword")]
-        [Authorize(Policy = Policies.DefaultAuthorization)]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        [ProducesResponseType(StatusCodes.Status404NotFound)]
-        public async Task<ActionResult> UpdateUserEasyPassword(
-            [FromRoute, Required] Guid userId,
-            [FromBody, Required] UpdateUserEasyPassword request)
+        if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
         {
-            if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
-            {
-                return StatusCode(StatusCodes.Status403Forbidden, "User is not allowed to update the easy password.");
-            }
+            return StatusCode(StatusCodes.Status403Forbidden, "User update not allowed.");
+        }
 
-            var user = _userManager.GetUserById(userId);
+        if (!string.Equals(user.Username, updateUser.Name, StringComparison.Ordinal))
+        {
+            await _userManager.RenameUser(user, updateUser.Name).ConfigureAwait(false);
+        }
 
-            if (user is null)
-            {
-                return NotFound("User not found");
-            }
+        await _userManager.UpdateConfigurationAsync(user.Id, updateUser.Configuration).ConfigureAwait(false);
 
-            if (request.ResetPassword)
-            {
-                await _userManager.ResetEasyPassword(user).ConfigureAwait(false);
-            }
-            else
-            {
-                await _userManager.ChangeEasyPassword(user, request.NewPw, request.NewPassword).ConfigureAwait(false);
-            }
+        return NoContent();
+    }
 
-            return NoContent();
+    /// <summary>
+    /// Updates a user policy.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <param name="newPolicy">The new user policy.</param>
+    /// <response code="204">User policy updated.</response>
+    /// <response code="400">User policy was not supplied.</response>
+    /// <response code="403">User policy update forbidden.</response>
+    /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="BadRequestResult"/> or a <see cref="ForbidResult"/> on failure..</returns>
+    [HttpPost("{userId}/Policy")]
+    [Authorize(Policy = Policies.RequiresElevation)]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult> UpdateUserPolicy(
+        [FromRoute, Required] Guid userId,
+        [FromBody, Required] UserPolicy newPolicy)
+    {
+        var user = _userManager.GetUserById(userId);
+        if (user is null)
+        {
+            return NotFound();
         }
 
-        /// <summary>
-        /// Updates a user.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <param name="updateUser">The updated user model.</param>
-        /// <response code="204">User updated.</response>
-        /// <response code="400">User information was not supplied.</response>
-        /// <response code="403">User update forbidden.</response>
-        /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="BadRequestResult"/> or a <see cref="ForbidResult"/> on failure.</returns>
-        [HttpPost("{userId}")]
-        [Authorize(Policy = Policies.DefaultAuthorization)]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
-        [ProducesResponseType(StatusCodes.Status400BadRequest)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        public async Task<ActionResult> UpdateUser(
-            [FromRoute, Required] Guid userId,
-            [FromBody, Required] UserDto updateUser)
+        // If removing admin access
+        if (!newPolicy.IsAdministrator && user.HasPermission(PermissionKind.IsAdministrator))
         {
-            if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
+            if (_userManager.Users.Count(i => i.HasPermission(PermissionKind.IsAdministrator)) == 1)
             {
-                return StatusCode(StatusCodes.Status403Forbidden, "User update not allowed.");
+                return StatusCode(StatusCodes.Status403Forbidden, "There must be at least one user in the system with administrative access.");
             }
+        }
 
-            var user = _userManager.GetUserById(userId);
+        // If disabling
+        if (newPolicy.IsDisabled && user.HasPermission(PermissionKind.IsAdministrator))
+        {
+            return StatusCode(StatusCodes.Status403Forbidden, "Administrators cannot be disabled.");
+        }
 
-            if (!string.Equals(user.Username, updateUser.Name, StringComparison.Ordinal))
+        // If disabling
+        if (newPolicy.IsDisabled && !user.HasPermission(PermissionKind.IsDisabled))
+        {
+            if (_userManager.Users.Count(i => !i.HasPermission(PermissionKind.IsDisabled)) == 1)
             {
-                await _userManager.RenameUser(user, updateUser.Name).ConfigureAwait(false);
+                return StatusCode(StatusCodes.Status403Forbidden, "There must be at least one enabled user in the system.");
             }
 
-            await _userManager.UpdateConfigurationAsync(user.Id, updateUser.Configuration).ConfigureAwait(false);
-
-            return NoContent();
+            var currentToken = User.GetToken();
+            await _sessionManager.RevokeUserTokens(user.Id, currentToken).ConfigureAwait(false);
         }
 
-        /// <summary>
-        /// Updates a user policy.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <param name="newPolicy">The new user policy.</param>
-        /// <response code="204">User policy updated.</response>
-        /// <response code="400">User policy was not supplied.</response>
-        /// <response code="403">User policy update forbidden.</response>
-        /// <returns>A <see cref="NoContentResult"/> indicating success or a <see cref="BadRequestResult"/> or a <see cref="ForbidResult"/> on failure..</returns>
-        [HttpPost("{userId}/Policy")]
-        [Authorize(Policy = Policies.RequiresElevation)]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
-        [ProducesResponseType(StatusCodes.Status400BadRequest)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        public async Task<ActionResult> UpdateUserPolicy(
-            [FromRoute, Required] Guid userId,
-            [FromBody, Required] UserPolicy newPolicy)
-        {
-            var user = _userManager.GetUserById(userId);
+        await _userManager.UpdatePolicyAsync(userId, newPolicy).ConfigureAwait(false);
 
-            // If removing admin access
-            if (!newPolicy.IsAdministrator && user.HasPermission(PermissionKind.IsAdministrator))
-            {
-                if (_userManager.Users.Count(i => i.HasPermission(PermissionKind.IsAdministrator)) == 1)
-                {
-                    return StatusCode(StatusCodes.Status403Forbidden, "There must be at least one user in the system with administrative access.");
-                }
-            }
+        return NoContent();
+    }
 
-            // If disabling
-            if (newPolicy.IsDisabled && user.HasPermission(PermissionKind.IsAdministrator))
-            {
-                return StatusCode(StatusCodes.Status403Forbidden, "Administrators cannot be disabled.");
-            }
+    /// <summary>
+    /// Updates a user configuration.
+    /// </summary>
+    /// <param name="userId">The user id.</param>
+    /// <param name="userConfig">The new user configuration.</param>
+    /// <response code="204">User configuration updated.</response>
+    /// <response code="403">User configuration update forbidden.</response>
+    /// <returns>A <see cref="NoContentResult"/> indicating success.</returns>
+    [HttpPost("{userId}/Configuration")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status204NoContent)]
+    [ProducesResponseType(StatusCodes.Status403Forbidden)]
+    public async Task<ActionResult> UpdateUserConfiguration(
+        [FromRoute, Required] Guid userId,
+        [FromBody, Required] UserConfiguration userConfig)
+    {
+        if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
+        {
+            return StatusCode(StatusCodes.Status403Forbidden, "User configuration update not allowed");
+        }
 
-            // If disabling
-            if (newPolicy.IsDisabled && !user.HasPermission(PermissionKind.IsDisabled))
-            {
-                if (_userManager.Users.Count(i => !i.HasPermission(PermissionKind.IsDisabled)) == 1)
-                {
-                    return StatusCode(StatusCodes.Status403Forbidden, "There must be at least one enabled user in the system.");
-                }
+        await _userManager.UpdateConfigurationAsync(userId, userConfig).ConfigureAwait(false);
 
-                var currentToken = User.GetToken();
-                await _sessionManager.RevokeUserTokens(user.Id, currentToken).ConfigureAwait(false);
-            }
+        return NoContent();
+    }
 
-            await _userManager.UpdatePolicyAsync(userId, newPolicy).ConfigureAwait(false);
+    /// <summary>
+    /// Creates a user.
+    /// </summary>
+    /// <param name="request">The create user by name request body.</param>
+    /// <response code="200">User created.</response>
+    /// <returns>An <see cref="UserDto"/> of the new user.</returns>
+    [HttpPost("New")]
+    [Authorize(Policy = Policies.RequiresElevation)]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public async Task<ActionResult<UserDto>> CreateUserByName([FromBody, Required] CreateUserByName request)
+    {
+        var newUser = await _userManager.CreateUserAsync(request.Name).ConfigureAwait(false);
 
-            return NoContent();
+        // no need to authenticate password for new user
+        if (request.Password is not null)
+        {
+            await _userManager.ChangePassword(newUser, request.Password).ConfigureAwait(false);
         }
 
-        /// <summary>
-        /// Updates a user configuration.
-        /// </summary>
-        /// <param name="userId">The user id.</param>
-        /// <param name="userConfig">The new user configuration.</param>
-        /// <response code="204">User configuration updated.</response>
-        /// <response code="403">User configuration update forbidden.</response>
-        /// <returns>A <see cref="NoContentResult"/> indicating success.</returns>
-        [HttpPost("{userId}/Configuration")]
-        [Authorize(Policy = Policies.DefaultAuthorization)]
-        [ProducesResponseType(StatusCodes.Status204NoContent)]
-        [ProducesResponseType(StatusCodes.Status403Forbidden)]
-        public async Task<ActionResult> UpdateUserConfiguration(
-            [FromRoute, Required] Guid userId,
-            [FromBody, Required] UserConfiguration userConfig)
-        {
-            if (!RequestHelpers.AssertCanUpdateUser(_userManager, User, userId, true))
-            {
-                return StatusCode(StatusCodes.Status403Forbidden, "User configuration update not allowed");
-            }
+        var result = _userManager.GetUserDto(newUser, HttpContext.GetNormalizedRemoteIp().ToString());
 
-            await _userManager.UpdateConfigurationAsync(userId, userConfig).ConfigureAwait(false);
+        return result;
+    }
 
-            return NoContent();
-        }
+    /// <summary>
+    /// Initiates the forgot password process for a local user.
+    /// </summary>
+    /// <param name="forgotPasswordRequest">The forgot password request containing the entered username.</param>
+    /// <response code="200">Password reset process started.</response>
+    /// <returns>A <see cref="Task"/> containing a <see cref="ForgotPasswordResult"/>.</returns>
+    [HttpPost("ForgotPassword")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public async Task<ActionResult<ForgotPasswordResult>> ForgotPassword([FromBody, Required] ForgotPasswordDto forgotPasswordRequest)
+    {
+        var ip = HttpContext.GetNormalizedRemoteIp();
+        var isLocal = HttpContext.IsLocal()
+                      || _networkManager.IsInLocalNetwork(ip);
 
-        /// <summary>
-        /// Creates a user.
-        /// </summary>
-        /// <param name="request">The create user by name request body.</param>
-        /// <response code="200">User created.</response>
-        /// <returns>An <see cref="UserDto"/> of the new user.</returns>
-        [HttpPost("New")]
-        [Authorize(Policy = Policies.RequiresElevation)]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public async Task<ActionResult<UserDto>> CreateUserByName([FromBody, Required] CreateUserByName request)
+        if (isLocal)
         {
-            var newUser = await _userManager.CreateUserAsync(request.Name).ConfigureAwait(false);
+            _logger.LogWarning("Password reset process initiated from outside the local network with IP: {IP}", ip);
+        }
 
-            // no need to authenticate password for new user
-            if (request.Password is not null)
-            {
-                await _userManager.ChangePassword(newUser, request.Password).ConfigureAwait(false);
-            }
+        var result = await _userManager.StartForgotPasswordProcess(forgotPasswordRequest.EnteredUsername, isLocal).ConfigureAwait(false);
 
-            var result = _userManager.GetUserDto(newUser, HttpContext.GetNormalizedRemoteIp().ToString());
+        return result;
+    }
 
-            return result;
+    /// <summary>
+    /// Redeems a forgot password pin.
+    /// </summary>
+    /// <param name="forgotPasswordPinRequest">The forgot password pin request containing the entered pin.</param>
+    /// <response code="200">Pin reset process started.</response>
+    /// <returns>A <see cref="Task"/> containing a <see cref="PinRedeemResult"/>.</returns>
+    [HttpPost("ForgotPassword/Pin")]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    public async Task<ActionResult<PinRedeemResult>> ForgotPasswordPin([FromBody, Required] ForgotPasswordPinDto forgotPasswordPinRequest)
+    {
+        var result = await _userManager.RedeemPasswordResetPin(forgotPasswordPinRequest.Pin).ConfigureAwait(false);
+        return result;
+    }
+
+    /// <summary>
+    /// Gets the user based on auth token.
+    /// </summary>
+    /// <response code="200">User returned.</response>
+    /// <response code="400">Token is not owned by a user.</response>
+    /// <returns>A <see cref="UserDto"/> for the authenticated user.</returns>
+    [HttpGet("Me")]
+    [Authorize]
+    [ProducesResponseType(StatusCodes.Status200OK)]
+    [ProducesResponseType(StatusCodes.Status400BadRequest)]
+    public ActionResult<UserDto> GetCurrentUser()
+    {
+        var userId = User.GetUserId();
+        if (userId.Equals(default))
+        {
+            return BadRequest();
         }
 
-        /// <summary>
-        /// Initiates the forgot password process for a local user.
-        /// </summary>
-        /// <param name="forgotPasswordRequest">The forgot password request containing the entered username.</param>
-        /// <response code="200">Password reset process started.</response>
-        /// <returns>A <see cref="Task"/> containing a <see cref="ForgotPasswordResult"/>.</returns>
-        [HttpPost("ForgotPassword")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public async Task<ActionResult<ForgotPasswordResult>> ForgotPassword([FromBody, Required] ForgotPasswordDto forgotPasswordRequest)
+        var user = _userManager.GetUserById(userId);
+        if (user is null)
         {
-            var ip = HttpContext.GetNormalizedRemoteIp();
-            var isLocal = HttpContext.IsLocal()
-                          || _networkManager.IsInLocalNetwork(ip);
+            return BadRequest();
+        }
 
-            if (isLocal)
-            {
-                _logger.LogWarning("Password reset process initiated from outside the local network with IP: {IP}", ip);
-            }
+        return _userManager.GetUserDto(user);
+    }
 
-            var result = await _userManager.StartForgotPasswordProcess(forgotPasswordRequest.EnteredUsername, isLocal).ConfigureAwait(false);
+    private IEnumerable<UserDto> Get(bool? isHidden, bool? isDisabled, bool filterByDevice, bool filterByNetwork)
+    {
+        var users = _userManager.Users;
 
-            return result;
+        if (isDisabled.HasValue)
+        {
+            users = users.Where(i => i.HasPermission(PermissionKind.IsDisabled) == isDisabled.Value);
         }
 
-        /// <summary>
-        /// Redeems a forgot password pin.
-        /// </summary>
-        /// <param name="forgotPasswordPinRequest">The forgot password pin request containing the entered pin.</param>
-        /// <response code="200">Pin reset process started.</response>
-        /// <returns>A <see cref="Task"/> containing a <see cref="PinRedeemResult"/>.</returns>
-        [HttpPost("ForgotPassword/Pin")]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        public async Task<ActionResult<PinRedeemResult>> ForgotPasswordPin([FromBody, Required] ForgotPasswordPinDto forgotPasswordPinRequest)
+        if (isHidden.HasValue)
         {
-            var result = await _userManager.RedeemPasswordResetPin(forgotPasswordPinRequest.Pin).ConfigureAwait(false);
-            return result;
+            users = users.Where(i => i.HasPermission(PermissionKind.IsHidden) == isHidden.Value);
         }
 
-        /// <summary>
-        /// Gets the user based on auth token.
-        /// </summary>
-        /// <response code="200">User returned.</response>
-        /// <response code="400">Token is not owned by a user.</response>
-        /// <returns>A <see cref="UserDto"/> for the authenticated user.</returns>
-        [HttpGet("Me")]
-        [Authorize(Policy = Policies.DefaultAuthorization)]
-        [ProducesResponseType(StatusCodes.Status200OK)]
-        [ProducesResponseType(StatusCodes.Status400BadRequest)]
-        public ActionResult<UserDto> GetCurrentUser()
+        if (filterByDevice)
         {
-            var userId = User.GetUserId();
-            if (userId.Equals(default))
-            {
-                return BadRequest();
-            }
+            var deviceId = User.GetDeviceId();
 
-            var user = _userManager.GetUserById(userId);
-            if (user is null)
+            if (!string.IsNullOrWhiteSpace(deviceId))
             {
-                return BadRequest();
+                users = users.Where(i => _deviceManager.CanAccessDevice(i, deviceId));
             }
-
-            return _userManager.GetUserDto(user);
         }
 
-        private IEnumerable<UserDto> Get(bool? isHidden, bool? isDisabled, bool filterByDevice, bool filterByNetwork)
+        if (filterByNetwork)
         {
-            var users = _userManager.Users;
-
-            if (isDisabled.HasValue)
+            if (!_networkManager.IsInLocalNetwork(HttpContext.GetNormalizedRemoteIp()))
             {
-                users = users.Where(i => i.HasPermission(PermissionKind.IsDisabled) == isDisabled.Value);
-            }
-
-            if (isHidden.HasValue)
-            {
-                users = users.Where(i => i.HasPermission(PermissionKind.IsHidden) == isHidden.Value);
-            }
-
-            if (filterByDevice)
-            {
-                var deviceId = User.GetDeviceId();
-
-                if (!string.IsNullOrWhiteSpace(deviceId))
-                {
-                    users = users.Where(i => _deviceManager.CanAccessDevice(i, deviceId));
-                }
-            }
-
-            if (filterByNetwork)
-            {
-                if (!_networkManager.IsInLocalNetwork(HttpContext.GetNormalizedRemoteIp()))
-                {
-                    users = users.Where(i => i.HasPermission(PermissionKind.EnableRemoteAccess));
-                }
+                users = users.Where(i => i.HasPermission(PermissionKind.EnableRemoteAccess));
             }
+        }
 
-            var result = users
-                .OrderBy(u => u.Username)
-                .Select(i => _userManager.GetUserDto(i, HttpContext.GetNormalizedRemoteIp().ToString()));
+        var result = users
+            .OrderBy(u => u.Username)
+            .Select(i => _userManager.GetUserDto(i, HttpContext.GetNormalizedRemoteIp().ToString()));
 
-            return result;
-        }
+        return result;
     }
 }