v2.5.4 — bug fix release. Resolves issue #35 (Snerillinn / Cloudflare Tunnel re-block after legit 2FA login), plus the Jellyfin 10.11.10 SDK bump with adapted reflection shim, plus minor dependency bumps.
Issue #35 — bypass paths now MarkTokenVerified
Cloudflare Tunnel and reverse-proxy users were intermittently re-blocked with [2FA] BLOCKED … — 2FA not completed several minutes after a successful passkey/2FA login, locking them out of the UI until a fresh re-auth.
Root cause: AuthenticationEventHandler's four legitimate-bypass branches (IsDevicePreVerified, ConsumeQuickConnectPending, userDataPaired, BypassEvaluator.IsBypassed) called ChallengeStore.ApproveToken() to clear the 10-minute BlockToken TTL but did not call MarkTokenVerified() to set the 30-day verified flag. Subsequent SessionStarted events fire on every websocket reconnect, new browser tab, and idle-resume — and when those fire from a proxy IP that no longer matches the original bypass condition (very common behind Cloudflare Tunnel where the upstream IP can rotate), BypassEvaluator returns false on the second look, the handler walks the normal challenge path, and re-blocks the same token that was already legitimately approved minutes earlier.
Fix: all four bypass branches now also MarkTokenVerified(token), so the 30-day verified flag short-circuits any later SessionStarted re-evaluation regardless of which proxy IP the reconnect arrives from.
Jellyfin 10.11.10 SDK bump
Bumps Jellyfin.Controller + Jellyfin.Model targets from 10.11.8 → 10.11.10. 10.11.10 renamed IUserManager.Users (property) → GetUsers() (method). Adapted the existing reflection shim at three callsites (TwoFactorAuthController.EnumerateAllUsers, StatsService.EnumerateUsers, SecurityScoreService.EnumerateUsers) to prefer typeof(IUserManager).GetMethod("GetUsers") at runtime with fallback to the legacy property via string-named GetProperty. The same DLL still loads cleanly on 10.11.0–10.11.9 — the reflection bypasses static IL binding so future return-type refactors in 10.11.11+ are also tolerated.
Minor dependency bumps
- MailKit 4.16.0 → 4.17.0 (upstream SMTP fixes)
- MaxMind.Db 5.0.0 → 5.1.0 (GeoLite2 reader perf)
- CI workflow bumps:
actions/setup-dotnet5.2→5.3,actions/upload-artifact5.0→7.0.1,github/codeql-action4.35.5→4.36.1,actions/stale10.2→10.3,ossf/scorecard-action2.4.0→2.4.3,oss-fuzz-base/base-builderdigest pin - Test/fuzz lock files regenerated to match
Verification
254/254 tests pass. Clean build with TreatWarningsAsErrors=true. Smoke-tested on a live 10.11.10 host behind Cloudflare Tunnel: plugin loads as 2.5.4.0, admin Security Dashboard renders, login → 2FA → idle 5 min no spurious re-block.