🔒 Security fix (please update)
Before v1.5.1, every admin endpoint was protected only by [Authorize] — meaning any authenticated Jellyfin user could POST to them. A regular user on your server could create custom badges, set webhooks, reset other users' badges, toggle UI features, etc. All admin endpoints now require the RequiresElevation policy, same as Jellyfin's own admin endpoints.
What's new
Prestige + score bank + combos
- Every playback earns 5 base points into a per-user score bank
- Consecutive watches within 15 minutes stack a combo multiplier (+10% per combo, up to 2x)
- At Legend rank (12000 score) you can prestige — reset badges to earn a prestige star while keeping lifetime score
- Spend score bank to buy a locked badge
- Gift score to another user
Daily quests
Rotating daily quest shared across all users. 8 quest templates. Completing rewards the score bank.
Chase the badge / recommendations
New endpoints that return the actual items from your library you'd need to watch to make progress on a specific badge. Smart filtering per metric (e.g. Era Hopper only suggests movies from decades you haven't seen).
Admin power features
- Visual badge editor — form-based creation, no more JSON
- Challenge templates — 1-click add for Monthly Movie Marathon, October Horror, New Year's Resolution, Summer Blockbuster
- Export/Import profile JSON — migrate progress between servers
- Per-badge reset — wipe a single badge without nuking the whole profile
- Inject counters — set arbitrary counter values for testing / gifting
- Audit log — last 5000 unlock events viewable in admin panel
Stats tab
Genre radar chart, watch heatmap placeholder, score histogram.
Rank-based themes
The achievements page changes its hero gradient / border / background as you climb ranks. Full gold immortal theme at the top tier.
Slack webhook format
Auto-detected from URL. If the webhook URL contains hooks.slack.com, the plugin sends Slack's {text} format; otherwise it uses Discord's {content} format.
What I cut from the feature list
I had to skip these because they'd need significant extra infrastructure or are too fragile to do well in one pass:
- WebSocket toasts — keeping polling for now (polls every 30s via v1.5.0's enhance.js). Good enough.
- Team challenges — groups infrastructure is a whole thing
- Watch together bonus — needs session intersection logic across users, too complex
- Weekly family leaderboard email — would need SMTP config + scheduled task wiring
- Custom badge icons upload — file upload handler + security sandboxing
- Avatar frames (CSS injection on profile pic) — fragile, Jellyfin's avatar markup changes between builds
- Badge sound effects — purely cosmetic, deferrable
- PNG profile cards — sticking with the HTML card from v1.5.0. SkiaSharp isn't guaranteed in all Jellyfin distros and adding a hard dep is risky
All of these are in the "v1.5.2 / later" pile if you want them.
Test plan
- Update + restart — check the log for
Loaded plugin: "Achievement Badges" "1.5.1". - Confirm admin auth fix — log in as a non-admin user and try to hit
Plugins/AchievementBadges/admin/custom-badges— it should return 403 Forbidden. - Re-run Scan watch history — recompute with combo multipliers + score bank accrual.
- Play a few items back-to-back — verify score bank grows and combo counter increments.
- Stats tab — check the bank, prestige, daily quest, and charts render.
- Visual badge editor — create a test badge, confirm it appears in your profile.
- Challenge templates — click "Load templates", add one, verify it shows up for users.
- Audit log — unlock a badge, confirm the entry appears.
- Chase the badge — GET
/users/{id}/chase/{badgeId}to see recommendations.