From ea9da7ec00a97f54c41dc2e1c7b99f4e6e3650ca Mon Sep 17 00:00:00 2001
From: dkanada <dkanada@users.noreply.github.com>
Date: Mon, 4 May 2026 12:23:47 +0900
Subject: [PATCH] add warning logs to authorization failure paths

---
 .../ConditionalAuthorizationHandler.cs                    | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Jellyfin.Api/Auth/ConditionalAuthorizationHandler/ConditionalAuthorizationHandler.cs b/Jellyfin.Api/Auth/ConditionalAuthorizationHandler/ConditionalAuthorizationHandler.cs
index 09d06908fc..eb896eae04 100644
--- a/Jellyfin.Api/Auth/ConditionalAuthorizationHandler/ConditionalAuthorizationHandler.cs
+++ b/Jellyfin.Api/Auth/ConditionalAuthorizationHandler/ConditionalAuthorizationHandler.cs
@@ -4,6 +4,7 @@ using MediaBrowser.Common.Api;
 using MediaBrowser.Controller.Configuration;
 using MediaBrowser.Model.Configuration;
 using Microsoft.AspNetCore.Authorization;
+using Microsoft.Extensions.Logging;
 
 namespace Jellyfin.Api.Auth.ConditionalAuthorizationHandler;
 
@@ -13,14 +14,17 @@ namespace Jellyfin.Api.Auth.ConditionalAuthorizationHandler;
 public class ConditionalAuthorizationHandler : AuthorizationHandler<ConditionalAuthorizationRequirement>
 {
     private readonly IServerConfigurationManager _configurationManager;
+    private readonly ILogger<ConditionalAuthorizationHandler> _logger;
 
     /// <summary>
     /// Initializes a new instance of the <see cref="ConditionalAuthorizationHandler"/> class.
     /// </summary>
     /// <param name="configurationManager">Instance of the <see cref="IServerConfigurationManager"/> interface.</param>
-    public ConditionalAuthorizationHandler(IServerConfigurationManager configurationManager)
+    /// <param name="logger">Instance of the <see cref="ILogger{TCategoryName}"/> interface.</param>
+    public ConditionalAuthorizationHandler(IServerConfigurationManager configurationManager, ILogger<ConditionalAuthorizationHandler> logger)
     {
         _configurationManager = configurationManager;
+        _logger = logger;
     }
 
     /// <inheritdoc />
@@ -39,10 +43,12 @@ public class ConditionalAuthorizationHandler : AuthorizationHandler<ConditionalA
 
         if (conditionalAuthorization && requiresElevation && !context.User.IsInRole(UserRoles.Administrator))
         {
+            _logger.LogWarning("administrator access currently required for this route due to {PolicyName} setting", requirement.PolicyName);
             context.Fail();
         }
         else if (conditionalAuthorization && !requiresElevation && !context.User.Identity!.IsAuthenticated)
         {
+            _logger.LogWarning("authentication currently required for this route due to {PolicyName} setting", requirement.PolicyName);
             context.Fail();
         }
         else