Root cause
UpdateUserAsync only writes to the database. Jellyfin's runtime in-memory user state was not refreshed, so the session token minted by AuthenticateDirect encoded admin=false even though the database had admin=true.
Fix
- Switch to
UpdatePolicyAsyncwhich goes through Jellyfin's full policy update path and refreshes the runtime user state - Move RBAC application back to before
AuthenticateDirectso the session token is created after the runtime state reflects the correct admin flag
Full Changelog: v1.0.2.1...v1.0.2.2