feat: add managed Emby library publishing

app/Filament/GuestPanel/Resources/DvrRecordings/GuestDvrRecordingResource.php

@@ -168,6 +168,14 @@ public static function getEloquentQuery(): Builder
 
         $currentAuth = static::getCurrentPlaylistAuth();
 
+        // A null $currentAuth is only safe to treat as "the playlist owner"
+        // when isOwnerAuth() confirms it — otherwise (a guest session that
+        // failed to resolve) ->where('playlist_auth_id', null) would become
+        // whereNull() and leak the owner's recordings to that guest.
+        if (! $currentAuth && ! static::isOwnerAuth()) {
+            return parent::getEloquentQuery()->whereRaw('1 = 0');
+        }
+
         return parent::getEloquentQuery()
             ->with(['channel', 'playlistAuth', 'dvrSetting.playlist', 'dvrSetting.customPlaylist', 'dvrSetting.mergedPlaylist'])
             ->where('dvr_setting_id', $dvrSetting->id)

app/Filament/GuestPanel/Resources/DvrRules/GuestDvrRuleResource.php

@@ -119,6 +119,14 @@ public static function getEloquentQuery(): Builder
 
         $currentAuth = static::getCurrentPlaylistAuth();
 
+        // A null $currentAuth is only safe to treat as "the playlist owner"
+        // when isOwnerAuth() confirms it — otherwise (a guest session that
+        // failed to resolve) ->where('playlist_auth_id', null) would become
+        // whereNull() and leak the owner's rules to that guest.
+        if (! $currentAuth && ! static::isOwnerAuth()) {
+            return parent::getEloquentQuery()->whereRaw('1 = 0');
+        }
+
         return parent::getEloquentQuery()
             ->with(['channel', 'playlistAuth'])
             ->where('dvr_setting_id', $dvrSetting->id)

app/Filament/GuestPanel/Widgets/GuestScheduledSeriesWidget.php

@@ -28,6 +28,14 @@ public function getSeriesRules(): Collection
 
         $currentAuth = static::getCurrentPlaylistAuth();
 
+        // A null $currentAuth is only safe to treat as "the playlist owner"
+        // when isOwnerAuth() confirms it — otherwise (a guest session that
+        // failed to resolve) ->where('playlist_auth_id', null) would become
+        // whereNull() and leak the owner's series rules to that guest.
+        if (! $currentAuth && ! static::isOwnerAuth()) {
+            return new Collection;
+        }
+
         return DvrRecordingRule::with(['channel'])
             ->where('dvr_setting_id', $dvrSetting->id)
             ->where('type', DvrRuleType::Series)

app/Filament/Resources/MediaServerIntegrations/MediaServerIntegrationResource.php

@@ -1695,6 +1695,7 @@ public static function getRelations(): array
             RelationManagers\SeriesRelationManager::class,
             RelationManagers\AioStreamsMoviesRelationManager::class,
             RelationManagers\AioStreamsSeriesRelationManager::class,
+            RelationManagers\EmbyLibraryMappingsRelationManager::class,
         ];
     }
 

app/Filament/Resources/PlaylistAuths/PlaylistAuthResource.php

@@ -301,6 +301,20 @@ public static function getForm(): array
             ->collapsible()
             ->collapsed(fn ($record) => ! ($record?->aiostreams_enabled));
 
+        $libraryPublishingSection = Section::make(__('Library Publishing Access'))
+            ->description(__('Allow this credential to read managed Emby publishing catalogs and report sync results.'))
+            ->compact()
+            ->hidden(fn () => ! (auth()->user()?->canUseIntegrations() ?? false))
+            ->schema([
+                Toggle::make('library_publishing_enabled')
+                    ->label(__('Enable Library Publishing'))
+                    ->default(false)
+                    ->columnSpan(2),
+            ])
+            ->columns(2)
+            ->collapsible()
+            ->collapsed(fn ($record) => ! ($record?->library_publishing_enabled));
+
         return [
             Grid::make()
                 ->schema([
@@ -475,6 +489,7 @@ public static function getForm(): array
             $requestsSection,
             $dvrSection,
             $aiostreamsSection,
+            $libraryPublishingSection,
         ];
     }
 }