1 files changed, 19 insertions, 6 deletions
diff --git a/Jellyfin.Api/Auth/UserPermissionPolicy/UserPermissionHandler.cs b/Jellyfin.Api/Auth/UserPermissionPolicy/UserPermissionHandler.cs
index e72bec46f..764c0a435 100644
--- a/Jellyfin.Api/Auth/UserPermissionPolicy/UserPermissionHandler.cs
+++ b/Jellyfin.Api/Auth/UserPermissionPolicy/UserPermissionHandler.cs
@@ -1,5 +1,6 @@
 using System.Threading.Tasks;
 using Jellyfin.Api.Extensions;
+using Jellyfin.Extensions;
 using MediaBrowser.Common.Extensions;
 using MediaBrowser.Controller.Library;
 using Microsoft.AspNetCore.Authorization;
@@ -25,15 +26,27 @@ namespace Jellyfin.Api.Auth.UserPermissionPolicy
         /// <inheritdoc />
         protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, UserPermissionRequirement requirement)
         {
-            var user = _userManager.GetUserById(context.User.GetUserId());
-            if (user is null)
+            // Api keys have global permissions, so just succeed the requirement.
+            if (context.User.GetIsApiKey())
             {
-                throw new ResourceNotFoundException();
+                context.Succeed(requirement);
             }
-
-            if (user.HasPermission(requirement.RequiredPermission))
+            else
             {
-                context.Succeed(requirement);
+                var userId = context.User.GetUserId();
+                if (!userId.IsEmpty())
+                {
+                    var user = _userManager.GetUserById(context.User.GetUserId());
+                    if (user is null)
+                    {
+                        throw new ResourceNotFoundException();
+                    }
+
+                    if (user.HasPermission(requirement.RequiredPermission))
+                    {
+                        context.Succeed(requirement);
+                    }
+                }
             }
 
             return Task.CompletedTask;