Users, sharing and parental controls

Everyone who uses your server has an account on it, created by you or by an invitation you send. You decide, library by library, what each account can reach, and the server enforces it everywhere: in every app, in search and on a direct link, not just in the menus.

Accounts are managed under Admin → People (the avatar menu at the top right, then Admin).

#Roles

A role sets the most an account can ever do. The library grid, further down, decides what it actually gets.

Child and guest accounts can do the same things; the role tells you who the account is for. Age limits, viewing hours and labels work on any account. Only an admin can change someone's role or restrictions, and nobody can change their own role or switch off their own account.

#Inviting someone

An invitation is a link that creates one account with the access you choose. Pass the link on yourself, or, when your server sends email (see Email below), type their address and tick Email them the link.

1. In Admin → People, choose Invite someone.
2. Pick a role and, if you like, an age limit, whether they may download, how many streams they may run at once and a remote bandwidth cap.
3. Tick the libraries they may see.
4. Choose Make the link and copy it. It is shown only once, works once, and lasts seven days.
5. Send it to them.

The link is built from your server's public address (PUBLIC_URL), so set that before inviting anyone outside your home; see Remote access. Opening it shows your server's name, who sent it, the role and every library with its download and age limits, before the person chooses a username and a password of ten characters or more, and, if they like, an email address. The email box starts with the address you sent the invitation to, if you gave one; it stays on your server, and they need no Collectoh account. Accepting creates the account and signs them in, and you get a notification. They can also paste the link, or the code at the end of it, under Create an account on the sign-in page.

The email box is optional. Whatever you type becomes the new account's email address, which is what signing in with Google, Apple or OpenID Connect is matched against.

Open invitations are listed with their expiry dates, and Revoke takes one back. To create an account yourself instead, choose New account, then Edit it to give it libraries.

#Choosing what an account can see

Choose Edit beside an account. Its Libraries grid has a row per library:

Save permissions applies the grid as a whole: what you save replaces what was there. Taking anything away (a library, downloads, a stricter limit) signs the person out and stops whatever they are watching, so the change holds at once. Admins see every library, so the grid does not apply to them.

A library you switch off (untick Enabled in its settings under Admin → Libraries) disappears for everyone; its grants return when you switch it back on.

#Age limits and unrated content

Ratings from your metadata are sorted into five bands, so a British 12A and an American PG-13 count the same:

A rating between bands counts as the higher one. Set Age limit across every library in the account's editor, and a stricter limit for particular libraries in the grid; the stricter of the two applies.

Restricted items are hidden, not greyed out. They do not appear in browsing, search, related rows or the home screen, and a direct link to one answers as if it did not exist.

When an account has an age limit, anything without a rating is hidden from it as well, including items marked NR or Unrated: a missing rating is no proof that something is suitable. Tick May see unrated content to allow them.

#Sharing part of a library with labels

Labels let you share only the films labelled Family, say, or everything except what is labelled Scary.

1. Label the items: in a library, choose Select, tick them and choose Labels…, or use Labels… in a single item's menu.
2. In an account's grid, open the Labels cell for that library and tick labels under Only these or Never these.

A label on a show covers its seasons and episodes. Labels, further down Admin → People, lists every label with how many items carry it, for renaming or deleting. A label that an account is held to on its own cannot be deleted until you change that account's grid.

#Viewing hours

Tick Limit viewing hours in an account's editor and add one or more windows: some days of the week, a start and an end. A window that ends before it starts runs past midnight, so Friday 22:00 to 01:00 covers the small hours of Saturday.

The hours are checked whenever something starts playing, in every app. Outside them, playback is refused with a message saying when viewing opens again; anything already playing when a window closes may finish. The hours follow the server's clock, so set TZ for your server. The standard compose file uses UTC otherwise.

#Downloads, transcoding and other limits

These are in the account's editor; the first three can be set on an invitation as well.

• May download: off, the account cannot download anything, whatever its grid says.
• Streams at once: how many streams it may run together. Starting something on a device that is already playing replaces that stream rather than counting twice.
• Remote bandwidth cap (kbps): applies only away from home. A stream over the cap is converted down rather than refused.
• May transcode: off, anything that would need converting for the device is refused with a message; files the device plays as they are still play.
• Photo locations: whether the account sees where photos were taken (coordinates and the map, place names only, or nothing).

What counts as home is set under Admin → Settings → Network; see Remote access.

#Profiles and PINs

On a shared device, such as the living-room television, people can switch accounts without typing passwords.

1. In each switchable account's editor, set a Profile PIN of four to six digits.
2. On the device, open the avatar menu and choose Switch profile. Who's watching? lists the accounts that have a PIN.
3. Pick one and type its PIN.

Switching into any profile takes that profile's PIN, including switching back to a parent's, so give your own account one too. A PIN keeps profiles apart. It is not a password, and a child's restrictions are enforced by the server whichever device they use.

#Signing in

Passwords need ten characters or more, with no rules about symbols or digits. After ten attempts in a minute from one address, or at one username, sign-in makes you wait; twenty wrong passwords in a row lock the account for fifteen minutes.

Forgotten passwords. When your server sends email, Forgot password? on the sign-in page emails a reset link to the account's address. Without email, an admin makes one with Reset link beside the account and hands it over. Either way it works once, for an hour, shows whose account it is, and signs out everything that used the old password.

Two-factor authentication. On your Account page (the avatar menu, then Settings):

1. Choose Set up two-factor authentication.
2. On a phone, tap Open in an authenticator app; elsewhere, type the secret into your authenticator app.
3. Enter the six-digit code and choose Turn it on.
4. Keep the ten recovery codes somewhere safe. Each works once, and they get you in if you lose your phone.

Signing in then asks for a code after your password, and turning it off needs your password. To insist on it for administrators, switch on Require two-factor authentication of administrators under Admin → Settings → Security. An admin without it can still sign in and watch, but every administrative action is refused until they set it up. That includes switching the rule off, so set up your own first.

Continue with Collectoh. Anyone whose account on your server has the same email as their Collectoh account can sign in with it: Continue with Collectoh on the sign-in page. The first time, collectoh.com asks them whether to allow your server, at the address they're using; after that, a browser that's signed in at collectoh.com, or on the Collectoh community forum, is signed in to your server as soon as it opens. Signing out of your server stays signed out until they sign in again. An account's email is set under Admin → Users, or comes with the invitation. To turn it off, set SIGN_IN_COLLECTOH=false.

Google, Apple or OpenID Connect. Give the server a client id and secret (GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET, APPLE_CLIENT_ID and APPLE_CLIENT_SECRET, or OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET and an optional OIDC_LABEL) and the sign-in page offers Continue with… for each. Register <PUBLIC_URL>/api/v1/auth/sign-in/google/callback (or apple, or oidc) with the provider as the redirect address. It signs in the account whose email matches the address the provider has verified, and never creates one: anyone without an account is told to ask for an invitation.

Trusted networks. A device on a network range you name can be signed in as one chosen account without a password, but never as an owner or an admin. See Remote access. Televisions that speak only DLNA see what one chosen account can see; see DLNA.

#Email

Your server can email invitations, reset links, alerts and a weekly digest of what's new. Set it up in Admin → Settings → Email:

• Your own mail server. Tick Send through my own mail server and give its address, port and security (TLS on 465, STARTTLS on 587), the username and password (for Gmail, Zoho or Outlook, an app password), and the address emails come from. The password is never shown again.
• Through collectoh.com. A server linked to a Collectoh account (Admin → Settings → Collectoh account) with no mail server of its own sends through collectoh.com instead, in your server's name, up to 100 emails a day.

Send test checks it. Below that you choose what's sent: reset links people ask for themselves (on unless you switch it off), alerts to you and your admins (a scan that didn't finish, a storage gone or back, a disk nearly full, a failed maintenance task or backup, a new version; each off until you tick it), and the weekly digest, on the day you pick. People ask for the digest themselves under Email on their Account page, which also shows the address on their account; each one lists only what that person can see, and has a link at the foot that stops it.

#Sessions and devices

A device stays signed in while it is used; one left alone for 30 days has to sign in again.

• Admin → Sessions shows everything playing now. End stops a stream at once, with an optional message to the viewer.
• An account's editor lists its Devices, and Sign out ends a device's sign-in.
• A new password, a changed role, unticking Account is active or taking access away signs the account out everywhere.
• Changing your own password on your Account page signs out your other devices.

#A record of changes

Changes to an account's role, restrictions and limits are written to the server's activity log, with who made each change and the values before and after. So are accounts an admin creates or deletes, and every change to library access. A PIN is recorded only as whether there is one.