Bulk deletion only possible with "All libraries" permission deletion

[Wobwobwob]

Describe The Bug

A user that's not admin cannot select and then delete multiple items at once. The same user can delete the items separately via the items context menu though.

Steps To Reproduce

1. Login to a non-admin user.
2. Go to a collection and select a video.
3. In the top right corner click on the 3-dots.
4. No "Delete" option is there.

To verify the user can delete:

1. as above
2. Go to a collection.
3. Click 3-dots on a video.
4. Select "Delete media"

Expected Behavior

A "Delete" option to be there which deletes all selected items.

System (please complete the following information):

• Platform: Windows Firefox and Android App (2.6.2)
• Jellyfin Version: 10.10.1

Additional Context

[Dan-613]

Should non-admin users be able to delete items at all?

[Wobwobwob]

Should non-admin users be able to delete items at all?

Yes, there's an explicit setting for that in the user settings. If that was turned off, the user could not delete single items. So this is not about whether deletion should be possible, it's about the bulk deletion (not possible) being inconsistent with single item deletion (possible).

[Dan-613]

Can you confirm that you are using v10.10.1?
Also, please can you screenshot the non-admin user permissions to make sure I'm matching your permissions properly?

I've tried out the steps you mentioned in your report.

When I log in as a non-admin who has permission to delete media, I can select media and then I get the "delete" option.

[Wobwobwob]

Thanks for trying to reproduce, Dan. I'm on 10.10.1, but my steps above seem incomplete as I couldn't reproduce them myself just now. I tested some more on the android app and I think I found two issues:

Bulk delete option is only loaded at app start time

If we change deletion permissions the bulk deletion option will be outdated:

1. User is allowed to delete media from "all libraries"
2. Navigate on user to library, both delete actions appear.
3. Keep the app with the user open and remove its deletion rights from another device/browser.
4. On the user, the single-item deletion option will correctly no longer appear. But if you select the same item, the bulk-delete option will still appear. If selected it will return an error ("Please check that Jellyfin has write access to the media folder.")
5. Kill and restart app, the bulk-delete option will no longer appear.

Bulk deletion only appears on permission "All libraries"

This means a user cannot bulk delete in a library it can delete from, unless it can delete from "All libraries". With all libraries being selected not being "All libraries" and not allowing bulk deletion.

1. Have more than one library (likely optional, but I have more than one).
2. In user settings "Allow media deletion from" deselect "All libraries", select all libraries separately instead.
3. Restart user app to reload bulk deletion option.
4. Navigate to any library, single item deletion appears, bulk deletion does not (we expect it to).
5. Enable "All libraries" again.
6. Restart user app.
7. Bulk deletion option appears again.

[Dan-613]

I'll test it again shortly using your updated steps, but just thinking....

The Bulk Delete option in Collections can only appear when All Libraries permission is given, because media in a collection could potentially originate from multiple libraries, some of which the user may not have permission to delete from.

[Wobwobwob]

The Bulk Delete option in Collections can only appear when All Libraries permission is given, because media in a collection could potentially originate from multiple libraries, some of which the user may not have permission to delete from.

Technically it could check if the user has permission to delete each item and then show up or don't, but maybe that's not feasible. If we're not gonna change that behavior, we could add an information to the deletion permission that unchecking "All libraries" will remove the bulk deletion option.

Btw, I don't consider the "Bulk delete option is only loaded at app start time" issue very bad or important, since the permissions are rarely changing. However, depending on how this works internally maybe we could solve both at the same time (by making the check whether the option appears dynamic, but again, I don't know if that's feasible or proportional).