fix(streamystats): derive control enablement from the effective server URL

A setting that was always locked then unlocked showed the app's hardcoded
default instead of the plugin's configured default: the unlocked branch
treated the persisted app default as a meaningful user value, so the plugin
value was effectively dead code for any key with a non-empty app default.

Keep the user's value only when it diverges from the app default; otherwise
the plugin (admin) default wins over the hardcoded app default. Shared via
useSettings, so mobile and TV are both fixed.

app/(auth)/(tabs)/(home)/settings/plugins/jellyseerr/page.tsx

@@ -1,11 +1,8 @@
-import { ScrollView } from "react-native";
+import { ScrollView, View } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
-import DisabledSetting from "@/components/settings/DisabledSetting";
 import { JellyseerrSettings } from "@/components/settings/Jellyseerr";
-import { useSettings } from "@/utils/atoms/settings";
 
 export default function JellyseerrPluginPage() {
-  const { pluginSettings } = useSettings();
   const insets = useSafeAreaInsets();
 
   return (
@@ -16,12 +13,9 @@ export default function JellyseerrPluginPage() {
         paddingRight: insets.right,
       }}
     >
-      <DisabledSetting
-        disabled={pluginSettings?.jellyseerrServerUrl?.locked === true}
-        className='p-4'
-      >
+      <View className='p-4'>
         <JellyseerrSettings />
-      </DisabledSetting>
+      </View>
     </ScrollView>
   );
 }

app/(auth)/(tabs)/(home)/settings/plugins/kefinTweaks/page.tsx

@@ -1,11 +1,8 @@
-import { ScrollView } from "react-native";
+import { ScrollView, View } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
-import DisabledSetting from "@/components/settings/DisabledSetting";
 import { KefinTweaksSettings } from "@/components/settings/KefinTweaks";
-import { useSettings } from "@/utils/atoms/settings";
 
 export default function KefinTweaksPage() {
-  const { pluginSettings } = useSettings();
   const insets = useSafeAreaInsets();
 
   return (
@@ -16,12 +13,9 @@ export default function KefinTweaksPage() {
         paddingRight: insets.right,
       }}
     >
-      <DisabledSetting
-        disabled={pluginSettings?.useKefinTweaks?.locked === true}
-        className='p-4'
-      >
+      <View className='px-4'>
         <KefinTweaksSettings />
-      </DisabledSetting>
+      </View>
     </ScrollView>
   );
 }

app/(auth)/(tabs)/(home)/settings/plugins/marlin-search/page.tsx

@@ -1,5 +1,5 @@
 import { useNavigation } from "expo-router";
-import { useEffect, useMemo, useState } from "react";
+import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   Linking,
@@ -14,22 +14,22 @@ import { toast } from "sonner-native";
 import { Text } from "@/components/common/Text";
 import { ListGroup } from "@/components/list/ListGroup";
 import { ListItem } from "@/components/list/ListItem";
-import DisabledSetting from "@/components/settings/DisabledSetting";
 import { useNetworkAwareQueryClient } from "@/hooks/useNetworkAwareQueryClient";
 import { useSettings } from "@/utils/atoms/settings";
 
 export default function MarlinSearchPage() {
   const navigation = useNavigation();
-
   const { t } = useTranslation();
-
   const insets = useSafeAreaInsets();
-
   const { settings, updateSettings, pluginSettings } = useSettings();
   const queryClient = useNetworkAwareQueryClient();
 
   const [value, setValue] = useState<string>(settings?.marlinServerUrl || "");
 
+  const searchEngineLocked = pluginSettings?.searchEngine?.locked === true;
+  const marlinUrlLocked = pluginSettings?.marlinServerUrl?.locked === true;
+  const hasStreamystats = !!pluginSettings?.streamyStatsServerUrl?.value;
+
   const onSave = (val: string) => {
     updateSettings({
       marlinServerUrl: !val.endsWith("/") ? val : val.slice(0, -1),
@@ -41,15 +41,8 @@ export default function MarlinSearchPage() {
     Linking.openURL("https://github.com/fredrikburmester/marlin-search");
   };
 
-  const disabled = useMemo(() => {
-    return (
-      pluginSettings?.searchEngine?.locked === true &&
-      pluginSettings?.marlinServerUrl?.locked === true
-    );
-  }, [pluginSettings]);
-
   useEffect(() => {
-    if (!pluginSettings?.marlinServerUrl?.locked) {
+    if (!marlinUrlLocked) {
       navigation.setOptions({
         headerRight: () => (
           <TouchableOpacity onPress={() => onSave(value)} className='px-2'>
@@ -60,7 +53,7 @@ export default function MarlinSearchPage() {
         ),
       });
     }
-  }, [navigation, value, pluginSettings?.marlinServerUrl?.locked, t]);
+  }, [navigation, value, marlinUrlLocked, t]);
 
   if (!settings) return null;
 
@@ -72,19 +65,15 @@ export default function MarlinSearchPage() {
         paddingRight: insets.right,
       }}
     >
-      <DisabledSetting disabled={disabled} className='px-4'>
+      <View className='px-4'>
         <ListGroup>
-          <DisabledSetting
-            disabled={
-              pluginSettings?.searchEngine?.locked === true ||
-              !!pluginSettings?.streamyStatsServerUrl?.value
-            }
-            showText={!pluginSettings?.marlinServerUrl?.locked}
-          >
+          {/* disabledByAdmin renders the "Disabled by admin" notice as the row's
+              subtitle (same pattern as the Streamystats settings) — no clipping. */}
           <ListItem
             title={t(
               "home.settings.plugins.marlin_search.enable_marlin_search",
             )}
+            disabledByAdmin={searchEngineLocked}
             onPress={() => {
               updateSettings({ searchEngine: "Jellyfin" });
               queryClient.invalidateQueries({ queryKey: ["search"] });
@@ -92,32 +81,23 @@ export default function MarlinSearchPage() {
           >
             <Switch
               value={settings.searchEngine === "Marlin"}
-                disabled={!!pluginSettings?.streamyStatsServerUrl?.value}
-                onValueChange={(value) => {
-                  updateSettings({
-                    searchEngine: value ? "Marlin" : "Jellyfin",
-                  });
+              disabled={searchEngineLocked || hasStreamystats}
+              onValueChange={(val) => {
+                updateSettings({ searchEngine: val ? "Marlin" : "Jellyfin" });
                 queryClient.invalidateQueries({ queryKey: ["search"] });
               }}
             />
           </ListItem>
-          </DisabledSetting>
         </ListGroup>
 
-        <DisabledSetting
-          disabled={pluginSettings?.marlinServerUrl?.locked === true}
-          showText={!pluginSettings?.searchEngine?.locked}
-          className='mt-2 flex flex-col rounded-xl overflow-hidden pl-4 bg-neutral-900 px-4'
+        <ListGroup className='mt-2'>
+          <ListItem
+            title={t("home.settings.plugins.marlin_search.url")}
+            disabledByAdmin={marlinUrlLocked}
           >
-          <View
-            className={"flex flex-row items-center bg-neutral-900 h-11 pr-4"}
-          >
-            <Text className='mr-4'>
-              {t("home.settings.plugins.marlin_search.url")}
-            </Text>
             <TextInput
-              editable={settings.searchEngine === "Marlin"}
-              className='text-white'
+              editable={!marlinUrlLocked && settings.searchEngine === "Marlin"}
+              className='text-white text-right flex-1'
               placeholder={t(
                 "home.settings.plugins.marlin_search.server_url_placeholder",
               )}
@@ -128,15 +108,16 @@ export default function MarlinSearchPage() {
               textContentType='URL'
               onChangeText={(text) => setValue(text)}
             />
-          </View>
-        </DisabledSetting>
+          </ListItem>
+        </ListGroup>
+
         <Text className='px-4 text-xs text-neutral-500 mt-1'>
           {t("home.settings.plugins.marlin_search.marlin_search_hint")}{" "}
           <Text className='text-blue-500' onPress={handleOpenLink}>
             {t("home.settings.plugins.marlin_search.read_more_about_marlin")}
           </Text>
         </Text>
-      </DisabledSetting>
+      </View>
     </ScrollView>
   );
 }

app/(auth)/(tabs)/(home)/settings/plugins/page.tsx

@@ -1,9 +1,21 @@
-import { Platform, ScrollView, View } from "react-native";
+import { useCallback } from "react";
+import { useTranslation } from "react-i18next";
+import { Platform, ScrollView, TouchableOpacity, View } from "react-native";
 import { useSafeAreaInsets } from "react-native-safe-area-context";
+import { toast } from "sonner-native";
+import { Text } from "@/components/common/Text";
 import { PluginSettings } from "@/components/settings/PluginSettings";
+import { useSettings } from "@/utils/atoms/settings";
 
 export default function PluginsPage() {
   const insets = useSafeAreaInsets();
+  const { t } = useTranslation();
+  const { refreshStreamyfinPluginSettings } = useSettings();
+
+  const handleRefreshFromServer = useCallback(async () => {
+    await refreshStreamyfinPluginSettings();
+    toast.success(t("home.settings.plugins.streamystats.toasts.refreshed"));
+  }, [refreshStreamyfinPluginSettings, t]);
 
   return (
     <ScrollView
@@ -18,6 +30,17 @@ export default function PluginsPage() {
         style={{ paddingTop: Platform.OS === "android" ? 10 : 0 }}
       >
         <PluginSettings />
+
+        {/* Pulls the centralised Streamyfin plugin settings for every plugin,
+            so it lives on the plugins index rather than inside Streamystats. */}
+        <TouchableOpacity
+          onPress={handleRefreshFromServer}
+          className='py-3 rounded-xl bg-neutral-800'
+        >
+          <Text className='text-center text-blue-500'>
+            {t("home.settings.plugins.streamystats.refresh_from_server")}
+          </Text>
+        </TouchableOpacity>
       </View>
     </ScrollView>
   );

app/(auth)/(tabs)/(home)/settings/plugins/streamystats/page.tsx

@@ -22,12 +22,7 @@ export default function StreamystatsPage() {
   const navigation = useNavigation();
   const insets = useSafeAreaInsets();
 
-  const {
-    settings,
-    updateSettings,
-    pluginSettings,
-    refreshStreamyfinPluginSettings,
-  } = useSettings();
+  const { settings, updateSettings, pluginSettings } = useSettings();
   const queryClient = useNetworkAwareQueryClient();
 
   // Local state for all editable fields
@@ -49,7 +44,21 @@ export default function StreamystatsPage() {
   );
 
   const isUrlLocked = pluginSettings?.streamyStatsServerUrl?.locked === true;
-  const isStreamystatsEnabled = !!url;
+  const searchLocked = pluginSettings?.searchEngine?.locked === true;
+  const movieRecsLocked =
+    pluginSettings?.streamyStatsMovieRecommendations?.locked === true;
+  const seriesRecsLocked =
+    pluginSettings?.streamyStatsSeriesRecommendations?.locked === true;
+  const promotedWatchlistsLocked =
+    pluginSettings?.streamyStatsPromotedWatchlists?.locked === true;
+  const hideWatchlistsTabLocked =
+    pluginSettings?.hideWatchlistsTab?.locked === true;
+  // The input renders the locked admin URL; enablement must follow the same
+  // effective value or every toggle stays disabled until local state syncs.
+  const effectiveUrl = isUrlLocked
+    ? (settings?.streamyStatsServerUrl ?? "")
+    : url;
+  const isStreamystatsEnabled = !!effectiveUrl;
 
   const onSave = useCallback(() => {
     const cleanUrl = url.endsWith("/") ? url.slice(0, -1) : url;
@@ -113,17 +122,6 @@ export default function StreamystatsPage() {
     Linking.openURL("https://github.com/fredrikburmester/streamystats");
   };
 
-  const handleRefreshFromServer = useCallback(async () => {
-    const newPluginSettings = await refreshStreamyfinPluginSettings();
-    // Update local state with new values
-    const newUrl = newPluginSettings?.streamyStatsServerUrl?.value || "";
-    setUrl(newUrl);
-    if (newUrl) {
-      setUseForSearch(true);
-    }
-    toast.success(t("home.settings.plugins.streamystats.toasts.refreshed"));
-  }, [refreshStreamyfinPluginSettings, t]);
-
   if (!settings) return null;
 
   return (
@@ -146,7 +144,7 @@ export default function StreamystatsPage() {
               placeholder={t(
                 "home.settings.plugins.streamystats.server_url_placeholder",
               )}
-              value={url}
+              value={effectiveUrl}
               keyboardType='url'
               returnKeyType='done'
               autoCapitalize='none'
@@ -171,11 +169,18 @@ export default function StreamystatsPage() {
         >
           <ListItem
             title={t("home.settings.plugins.streamystats.enable_search")}
-            disabledByAdmin={pluginSettings?.searchEngine?.locked === true}
+            disabledByAdmin={searchLocked}
           >
+            {/* Locked controls show the live admin value and can't be toggled —
+                local form state would let the switch flip while the write guard
+                drops the change. */}
             <Switch
-              value={useForSearch}
-              disabled={!isStreamystatsEnabled}
+              value={
+                searchLocked
+                  ? settings?.searchEngine === "Streamystats"
+                  : useForSearch
+              }
+              disabled={!isStreamystatsEnabled || searchLocked}
               onValueChange={setUseForSearch}
             />
           </ListItem>
@@ -183,52 +188,62 @@ export default function StreamystatsPage() {
             title={t(
               "home.settings.plugins.streamystats.enable_movie_recommendations",
             )}
-            disabledByAdmin={
-              pluginSettings?.streamyStatsMovieRecommendations?.locked === true
-            }
+            disabledByAdmin={movieRecsLocked}
           >
             <Switch
-              value={movieRecs}
+              value={
+                movieRecsLocked
+                  ? (settings?.streamyStatsMovieRecommendations ?? false)
+                  : movieRecs
+              }
               onValueChange={setMovieRecs}
-              disabled={!isStreamystatsEnabled}
+              disabled={!isStreamystatsEnabled || movieRecsLocked}
             />
           </ListItem>
           <ListItem
             title={t(
               "home.settings.plugins.streamystats.enable_series_recommendations",
             )}
-            disabledByAdmin={
-              pluginSettings?.streamyStatsSeriesRecommendations?.locked === true
-            }
+            disabledByAdmin={seriesRecsLocked}
           >
             <Switch
-              value={seriesRecs}
+              value={
+                seriesRecsLocked
+                  ? (settings?.streamyStatsSeriesRecommendations ?? false)
+                  : seriesRecs
+              }
               onValueChange={setSeriesRecs}
-              disabled={!isStreamystatsEnabled}
+              disabled={!isStreamystatsEnabled || seriesRecsLocked}
             />
           </ListItem>
           <ListItem
             title={t(
               "home.settings.plugins.streamystats.enable_promoted_watchlists",
             )}
-            disabledByAdmin={
-              pluginSettings?.streamyStatsPromotedWatchlists?.locked === true
-            }
+            disabledByAdmin={promotedWatchlistsLocked}
           >
             <Switch
-              value={promotedWatchlists}
+              value={
+                promotedWatchlistsLocked
+                  ? (settings?.streamyStatsPromotedWatchlists ?? false)
+                  : promotedWatchlists
+              }
               onValueChange={setPromotedWatchlists}
-              disabled={!isStreamystatsEnabled}
+              disabled={!isStreamystatsEnabled || promotedWatchlistsLocked}
             />
           </ListItem>
           <ListItem
             title={t("home.settings.plugins.streamystats.hide_watchlists_tab")}
-            disabledByAdmin={pluginSettings?.hideWatchlistsTab?.locked === true}
+            disabledByAdmin={hideWatchlistsTabLocked}
           >
             <Switch
-              value={hideWatchlistsTab}
+              value={
+                hideWatchlistsTabLocked
+                  ? (settings?.hideWatchlistsTab ?? false)
+                  : hideWatchlistsTab
+              }
               onValueChange={setHideWatchlistsTab}
-              disabled={!isStreamystatsEnabled}
+              disabled={!isStreamystatsEnabled || hideWatchlistsTabLocked}
             />
           </ListItem>
         </ListGroup>
@@ -236,15 +251,6 @@ export default function StreamystatsPage() {
           {t("home.settings.plugins.streamystats.home_sections_hint")}
         </Text>
 
-        <TouchableOpacity
-          onPress={handleRefreshFromServer}
-          className='mt-6 py-3 rounded-xl bg-neutral-800'
-        >
-          <Text className='text-center text-blue-500'>
-            {t("home.settings.plugins.streamystats.refresh_from_server")}
-          </Text>
-        </TouchableOpacity>
-
         {/* Disable button - only show if URL is not locked and Streamystats is enabled */}
         {!isUrlLocked && isStreamystatsEnabled && (
           <TouchableOpacity

app/_layout.tsx

@@ -11,7 +11,6 @@ import { Image } from "expo-image";
 import { DarkTheme, ThemeProvider } from "expo-router/react-navigation";
 import { Platform } from "react-native";
 import { GlobalModal } from "@/components/GlobalModal";
-import { PendingAccountSaveModal } from "@/components/PendingAccountSaveModal";
 import { enableTVMenuKeyInterception } from "@/hooks/useTVBackHandler";
 import i18n from "@/i18n";
 import { DownloadProvider } from "@/providers/DownloadProvider";
@@ -548,7 +547,6 @@ function Layout() {
                                   closeButton
                                 />
                                 {!Platform.isTV && <GlobalModal />}
-                                {!Platform.isTV && <PendingAccountSaveModal />}
                               </ThemeProvider>
                             </IntroSheetProvider>
                           </BottomSheetModalProvider>

components/PendingAccountSaveModal.tsx

@@ -1,45 +0,0 @@
-import { useAtom, useAtomValue } from "jotai";
-import type React from "react";
-import { useEffect } from "react";
-import { Platform } from "react-native";
-import { SaveAccountModal } from "@/components/SaveAccountModal";
-import {
-  pendingAccountSaveAtom,
-  useJellyfin,
-  userAtom,
-} from "@/providers/JellyfinProvider";
-
-/**
- * Post-login save-account prompt. Login flows (password or Quick Connect)
- * only flag the intent via pendingAccountSaveAtom; the protection picker
- * shows here, AFTER the session is authorized — the login screen itself
- * unmounts as soon as the user is set, so it can't host the modal.
- */
-export const PendingAccountSaveModal: React.FC = () => {
-  const [pending, setPending] = useAtom(pendingAccountSaveAtom);
-  const user = useAtomValue(userAtom);
-  const { saveCurrentAccount } = useJellyfin();
-
-  // A logout before answering drops the intent — it must not resurface on
-  // the next (possibly different) login.
-  useEffect(() => {
-    if (!user && pending) setPending(null);
-  }, [user, pending, setPending]);
-
-  if (Platform.isTV) return null;
-
-  return (
-    <SaveAccountModal
-      visible={!!pending && !!user}
-      username={user?.Name ?? ""}
-      onClose={() => setPending(null)}
-      onSave={(securityType, pinCode) => {
-        const serverName = pending?.serverName;
-        setPending(null);
-        saveCurrentAccount({ securityType, pinCode, serverName }).catch(
-          (error) => console.warn("Failed to save account:", error),
-        );
-      }}
-    />
-  );
-};

components/home/Home.tsx

@@ -39,11 +39,7 @@ import { useRefreshLibraryOnFocus } from "@/hooks/useRefreshLibraryOnFocus";
 import { useInvalidatePlaybackProgressCache } from "@/hooks/useRevalidatePlaybackProgressCache";
 import { useDownload } from "@/providers/DownloadProvider";
 import { useIntroSheet } from "@/providers/IntroSheetProvider";
-import {
-  apiAtom,
-  pendingAccountSaveAtom,
-  userAtom,
-} from "@/providers/JellyfinProvider";
+import { apiAtom, userAtom } from "@/providers/JellyfinProvider";
 import { SortByOption, SortOrderOption } from "@/utils/atoms/filters";
 import { useSettings } from "@/utils/atoms/settings";
 import { eventBus } from "@/utils/eventBus";
@@ -93,9 +89,6 @@ const HomeMobile = () => {
   const invalidateCache = useInvalidatePlaybackProgressCache();
   const [loadedSections, setLoadedSections] = useState<Set<string>>(new Set());
   const { showIntro } = useIntroSheet();
-  // Gate the intro so it can't steal presentation from the post-login
-  // save-account sheet (both are BottomSheetModals): wait until no save is pending.
-  const pendingAccountSave = useAtomValue(pendingAccountSaveAtom);
 
   // Fallback refresh for newly added content when returning to the home screen
   // (primary path is the LibraryChanged WebSocket event).
@@ -104,9 +97,7 @@ const HomeMobile = () => {
   // Show intro modal on first launch
   useEffect(() => {
     const hasShownIntro = storage.getBoolean("hasShownIntro");
-    // Defer while the save-account sheet is up; this effect re-runs and schedules
-    // the intro once the sheet is dismissed (pendingAccountSaveAtom cleared).
-    if (!hasShownIntro && !pendingAccountSave) {
+    if (!hasShownIntro) {
       const timer = setTimeout(() => {
         showIntro();
       }, 1000);
@@ -115,7 +106,7 @@ const HomeMobile = () => {
         clearTimeout(timer);
       };
     }
-  }, [showIntro, pendingAccountSave]);
+  }, [showIntro]);
 
   useEffect(() => {
     if (isConnected && !prevIsConnected.current) {

components/login/Login.tsx

@@ -3,7 +3,7 @@ import type { PublicSystemInfo } from "@jellyfin/sdk/lib/generated-client";
 import { Image } from "expo-image";
 import { useLocalSearchParams, useNavigation } from "expo-router";
 import { t } from "i18next";
-import { useAtomValue, useSetAtom } from "jotai";
+import { useAtomValue } from "jotai";
 import { useCallback, useEffect, useState } from "react";
 import {
   Alert,
@@ -21,14 +21,13 @@ import { Input } from "@/components/common/Input";
 import { Text } from "@/components/common/Text";
 import JellyfinServerDiscovery from "@/components/JellyfinServerDiscovery";
 import { PreviousServersList } from "@/components/PreviousServersList";
+import { SaveAccountModal } from "@/components/SaveAccountModal";
 import { Colors } from "@/constants/Colors";
-import {
-  apiAtom,
-  pendingAccountSaveAtom,
-  useJellyfin,
-  userAtom,
-} from "@/providers/JellyfinProvider";
-import type { SavedServer } from "@/utils/secureCredentials";
+import { apiAtom, useJellyfin } from "@/providers/JellyfinProvider";
+import type {
+  AccountSecurityType,
+  SavedServer,
+} from "@/utils/secureCredentials";
 
 const CredentialsSchema = z.object({
   username: z.string().min(1, t("login.username_required")),
@@ -36,7 +35,6 @@ const CredentialsSchema = z.object({
 
 export const Login: React.FC = () => {
   const api = useAtomValue(apiAtom);
-  const user = useAtomValue(userAtom);
   const navigation = useNavigation();
   const params = useLocalSearchParams();
   const {
@@ -47,7 +45,6 @@ export const Login: React.FC = () => {
     loginWithSavedCredential,
     loginWithPassword,
   } = useJellyfin();
-  const setPendingAccountSave = useSetAtom(pendingAccountSaveAtom);
 
   const {
     apiUrl: _apiUrl,
@@ -67,24 +64,13 @@ export const Login: React.FC = () => {
     password: _password || "",
   });
 
-  // Save account state — only the intent lives here; the protection picker is
-  // the global PendingAccountSaveModal, shown after the login succeeds.
+  // Save account state
   const [saveAccount, setSaveAccount] = useState(false);
-
-  // Tracks an in-flight Quick Connect attempt (code issued, provider polling).
-  const [quickConnectActive, setQuickConnectActive] = useState(false);
-
-  // A Quick Connect login with "save account" on flags the post-login save:
-  // the protection picker shows globally once the session exists (this screen
-  // unmounts on login, so it can't host the modal).
-  useEffect(() => {
-    if (user) {
-      if (quickConnectActive && saveAccount) {
-        setPendingAccountSave({ serverName });
-      }
-      setQuickConnectActive(false);
-    }
-  }, [user]);
+  const [showSaveModal, setShowSaveModal] = useState(false);
+  const [pendingLogin, setPendingLogin] = useState<{
+    username: string;
+    password: string;
+  } | null>(null);
 
   // Handle URL params for server connection
   useEffect(() => {
@@ -131,22 +117,29 @@ export const Login: React.FC = () => {
     const result = CredentialsSchema.safeParse(credentials);
     if (!result.success) return;
 
-    const ok = await performLogin(credentials.username, credentials.password);
-    // The protection picker shows AFTER a successful login (global modal) —
-    // never for a failed one.
-    if (ok && saveAccount) {
-      setPendingAccountSave({ serverName });
+    if (saveAccount) {
+      setPendingLogin({
+        username: credentials.username,
+        password: credentials.password,
+      });
+      setShowSaveModal(true);
+    } else {
+      await performLogin(credentials.username, credentials.password);
     }
   };
 
   const performLogin = async (
     username: string,
     password: string,
-  ): Promise<boolean> => {
+    options?: {
+      saveAccount?: boolean;
+      securityType?: AccountSecurityType;
+      pinCode?: string;
+    },
+  ) => {
     setLoading(true);
     try {
-      await login(username, password, serverName);
-      return true;
+      await login(username, password, serverName, options);
     } catch (error) {
       if (error instanceof Error) {
         Alert.alert(t("login.connection_failed"), error.message);
@@ -156,9 +149,23 @@ export const Login: React.FC = () => {
           t("login.an_unexpected_error_occured"),
         );
       }
-      return false;
     } finally {
       setLoading(false);
+      setPendingLogin(null);
+    }
+  };
+
+  const handleSaveAccountConfirm = async (
+    securityType: AccountSecurityType,
+    pinCode?: string,
+  ) => {
+    setShowSaveModal(false);
+    if (pendingLogin) {
+      await performLogin(pendingLogin.username, pendingLogin.password, {
+        saveAccount: true,
+        securityType,
+        pinCode,
+      });
     }
   };
 
@@ -252,7 +259,6 @@ export const Login: React.FC = () => {
     try {
       const code = await initiateQuickConnect();
       if (code) {
-        setQuickConnectActive(true);
         Alert.alert(
           t("login.quick_connect"),
           t("login.enter_code_to_login", { code: code }),
@@ -437,6 +443,16 @@ export const Login: React.FC = () => {
           </View>
         )}
       </KeyboardAvoidingView>
+
+      <SaveAccountModal
+        visible={showSaveModal}
+        onClose={() => {
+          setShowSaveModal(false);
+          setPendingLogin(null);
+        }}
+        onSave={handleSaveAccountConfirm}
+        username={pendingLogin?.username || credentials.username}
+      />
     </SafeAreaView>
   );
 };

components/settings/Jellyseerr.tsx

@@ -20,7 +20,10 @@ export const JellyseerrSettings = () => {
   const { t } = useTranslation();
 
   const [user] = useAtom(userAtom);
-  const { settings, updateSettings } = useSettings();
+  const { settings, updateSettings, pluginSettings } = useSettings();
+  // Only the server URL is admin-lockable — the password stays editable so
+  // the user can still sign in to the admin-pinned Jellyseerr server.
+  const urlLocked = pluginSettings?.jellyseerrServerUrl?.locked === true;
 
   const [jellyseerrPassword, setJellyseerrPassword] = useState<
     string | undefined
@@ -115,6 +118,7 @@ export const JellyseerrSettings = () => {
           </>
         ) : (
           <View className='flex flex-col rounded-xl overflow-hidden p-4 bg-neutral-900'>
+            <View style={{ opacity: urlLocked ? 0.5 : 1 }}>
               <Text className='font-bold mb-1'>
                 {t("home.settings.plugins.jellyseerr.server_url")}
               </Text>
@@ -128,7 +132,11 @@ export const JellyseerrSettings = () => {
                 placeholder={t(
                   "home.settings.plugins.jellyseerr.server_url_placeholder",
                 )}
-              value={jellyseerrServerUrl ?? settings?.jellyseerrServerUrl}
+                value={
+                  urlLocked
+                    ? settings?.jellyseerrServerUrl
+                    : (jellyseerrServerUrl ?? settings?.jellyseerrServerUrl)
+                }
                 defaultValue={
                   settings?.jellyseerrServerUrl ?? jellyseerrServerUrl
                 }
@@ -137,8 +145,14 @@ export const JellyseerrSettings = () => {
                 autoCapitalize='none'
                 textContentType='URL'
                 onChangeText={setjellyseerrServerUrl}
-              editable={!loginToJellyseerrMutation.isPending}
+                editable={!urlLocked && !loginToJellyseerrMutation.isPending}
               />
+              {urlLocked && (
+                <Text className='text-xs text-red-600 mb-2'>
+                  Disabled by admin
+                </Text>
+              )}
+            </View>
             <View>
               <Text className='font-bold mb-2'>
                 {t("home.settings.plugins.jellyseerr.password")}

components/settings/KefinTweaks.tsx

@@ -1,33 +1,28 @@
 import { useTranslation } from "react-i18next";
-import { Switch, Text, View } from "react-native";
+import { Switch } from "react-native";
 import { useSettings } from "@/utils/atoms/settings";
+import { ListGroup } from "../list/ListGroup";
+import { ListItem } from "../list/ListItem";
 
 export const KefinTweaksSettings = () => {
-  const { settings, updateSettings } = useSettings();
+  const { settings, updateSettings, pluginSettings } = useSettings();
   const { t } = useTranslation();
 
   const isEnabled = settings?.useKefinTweaks ?? false;
+  const locked = pluginSettings?.useKefinTweaks?.locked === true;
 
   return (
-    <View className=''>
-      <View className='flex flex-col rounded-xl overflow-hidden p-4 bg-neutral-900'>
-        <Text className='text-xs text-red-600 mb-2'>
-          {t("home.settings.plugins.kefinTweaks.watchlist_enabler")}
-        </Text>
-
-        <View className='flex flex-row items-center justify-between mt-2'>
-          <Text className='text-white'>
-            {isEnabled ? t("Watchlist On") : t("Watchlist Off")}
-          </Text>
-
+    <ListGroup>
+      <ListItem
+        title={t("home.settings.plugins.kefinTweaks.watchlist_enabler")}
+        disabledByAdmin={locked}
+      >
         <Switch
           value={isEnabled}
+          disabled={locked}
           onValueChange={(value) => updateSettings({ useKefinTweaks: value })}
-            trackColor={{ false: "#555", true: "purple" }}
-            thumbColor={isEnabled ? "#fff" : "#ccc"}
         />
-        </View>
-      </View>
-    </View>
+      </ListItem>
+    </ListGroup>
   );
 };

components/settings/PluginSettings.tsx

@@ -20,12 +20,7 @@ export const PluginSettings = () => {
     >
       <ListItem
         onPress={() => router.push("/settings/plugins/jellyseerr/page")}
-        title={"Jellyseerr"}
-        showArrow
-      />
-      <ListItem
-        onPress={() => router.push("/settings/plugins/marlin-search/page")}
-        title='Marlin Search'
+        title='Jellyseerr'
         showArrow
       />
       <ListItem
@@ -33,6 +28,11 @@ export const PluginSettings = () => {
         title='Streamystats'
         showArrow
       />
+      <ListItem
+        onPress={() => router.push("/settings/plugins/marlin-search/page")}
+        title='Marlin Search'
+        showArrow
+      />
       <ListItem
         onPress={() => router.push("/settings/plugins/kefinTweaks/page")}
         title='KefinTweaks'

providers/JellyfinProvider.tsx

@@ -15,7 +15,6 @@ import {
   useContext,
   useEffect,
   useMemo,
-  useRef,
   useState,
 } from "react";
 import { useTranslation } from "react-i18next";
@@ -92,12 +91,6 @@ export const apiAtom = atom<Api | null>(initialApi);
 export const userAtom = atom<UserDto | null>(initialUser);
 export const wsAtom = atom<WebSocket | null>(null);
 export const cacheVersionAtom = atom<number>(0);
-// Set by a login flow that wants the account saved: the protection picker
-// shows AFTER the session is authorized (the login screen unmounts on
-// success, so the modal lives at the root — see PendingAccountSaveModal).
-export const pendingAccountSaveAtom = atom<{ serverName?: string } | null>(
-  null,
-);
 
 interface LoginOptions {
   saveAccount?: boolean;
@@ -115,11 +108,6 @@ interface JellyfinContextValue {
     serverName?: string,
     options?: LoginOptions,
   ) => Promise<void>;
-  saveCurrentAccount: (options?: {
-    securityType?: AccountSecurityType;
-    pinCode?: string;
-    serverName?: string;
-  }) => Promise<void>;
   logout: () => Promise<void>;
   initiateQuickConnect: () => Promise<string | undefined>;
   stopQuickConnectPolling: () => void;
@@ -177,46 +165,6 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
   const { clearAllJellyseerData, setJellyseerrUser } = useJellyseerr();
   const queryClient = useQueryClient();
 
-  // --- Session-expiry handling ----------------------------------------------
-  // When the server revokes the token (e.g. the device/session is deleted), a
-  // 401 can surface from any authenticated request. Without central handling
-  // the dead token stays in storage, so every reload re-fires authed calls →
-  // 401 spam + uncaught rejections, and the app lingers in a half-authenticated
-  // state. A single response interceptor on the authenticated api clears the
-  // session on the first 401 so the app drops cleanly to the login screen.
-  const sessionExpiredRef = useRef(false);
-
-  const handleSessionExpired = useCallback(() => {
-    if (sessionExpiredRef.current) return; // run once per session
-    sessionExpiredRef.current = true;
-    storage.remove("token");
-    storage.remove("user");
-    setUser(null);
-    setApi(null);
-    queryClient.clear();
-    storage.remove("REACT_QUERY_OFFLINE_CACHE");
-    // Saved credentials are kept so the user can quick-login again.
-  }, [setUser, setApi, queryClient]);
-
-  useEffect(() => {
-    // Only guard an authenticated session. A pre-auth api (login screen) keeps
-    // its own handling — a wrong-password 401 is not a session expiry.
-    if (!api?.accessToken) return;
-    sessionExpiredRef.current = false; // re-arm for this fresh session
-    const interceptorId = api.axiosInstance.interceptors.response.use(
-      (response) => response,
-      (error) => {
-        if (error?.response?.status === 401) {
-          handleSessionExpired();
-        }
-        return Promise.reject(error);
-      },
-    );
-    return () => {
-      api.axiosInstance.interceptors.response.eject(interceptorId);
-    };
-  }, [api, handleSessionExpired]);
-
   const headers = useMemo(() => {
     if (!deviceId) return {};
     return {
@@ -359,37 +307,6 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     },
   });
 
-  // Persist the CURRENT session to secure storage — used by the post-login
-  // save-account modal (the protection picker shows AFTER a successful
-  // login, for both the password and Quick Connect flows).
-  const saveCurrentAccount = useCallback(
-    async (options?: {
-      securityType?: AccountSecurityType;
-      pinCode?: string;
-      serverName?: string;
-    }) => {
-      const token = storage.getString("token");
-      if (!api?.basePath || !user?.Id || !user.Name || !token) return;
-      const securityType = options?.securityType || "none";
-      let pinHash: string | undefined;
-      if (securityType === "pin" && options?.pinCode) {
-        pinHash = await hashPIN(options.pinCode);
-      }
-      await saveAccountCredential({
-        serverUrl: api.basePath,
-        serverName: options?.serverName || "",
-        token,
-        userId: user.Id,
-        username: user.Name,
-        savedAt: Date.now(),
-        securityType,
-        pinHash,
-        primaryImageTag: user.PrimaryImageTag ?? undefined,
-      });
-    },
-    [api?.basePath, user],
-  );
-
   const loginMutation = useMutation({
     mutationFn: async ({
       username,
@@ -592,9 +509,7 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
       }
     },
     onError: (error) => {
-      // Expected, handled case (e.g. revoked token → "Session Expired", or
-      // server unreachable): the UI surfaces the message, so warn, don't error.
-      console.warn("Quick login failed:", error);
+      console.error("Quick login failed:", error);
     },
   });
 
@@ -705,14 +620,12 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
             setUser(storedUser);
           }
 
-          // Validate the token and refresh user data in the background. Do NOT
-          // await this: the Jellyfin SDK axios instance has no timeout, so when
-          // offline this call hangs for the full OS TCP timeout (75-120s) and
-          // blocks splash dismissal. The cached storedUser (set above) is enough
-          // to render; on success we just refresh it.
-          getUserApi(apiInstance)
-            .getCurrentUser()
-            .then(async (response) => {
+          // Dismiss splash screen with cached data immediately,
+          // fetch fresh user data in the background
+          setInitialLoaded(true);
+
+          try {
+            const response = await getUserApi(apiInstance).getCurrentUser();
             setUser(response.data);
 
             // Migrate current session to secure storage if not already saved
@@ -746,21 +659,15 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
                 });
               }
             }
-            })
-            .catch((e) => {
-              // Expected, handled case (offline, or a token the server rejects —
-              // the UI prompts re-login): warn, don't error. Log only
-              // status/message — never the raw error (axios errors carry the
-              // request config incl. the Authorization header / token).
-              console.warn(
-                "Background user validation failed:",
-                e?.response?.status ?? e?.message ?? "unknown error",
-              );
-            });
+          } catch (e) {
+            // Background fetch failed — app already rendered with cached data
+            console.warn("Background user fetch failed, using cached data:", e);
+          }
+        } else {
+          setInitialLoaded(true);
         }
       } catch (e) {
         console.error(e);
-      } finally {
         setInitialLoaded(true);
       }
     };
@@ -774,7 +681,6 @@ export const JellyfinProvider: React.FC<{ children: ReactNode }> = ({
     removeServer: () => removeServerMutation.mutateAsync(),
     login: (username, password, serverName, options) =>
       loginMutation.mutateAsync({ username, password, serverName, options }),
-    saveCurrentAccount,
     logout: () => logoutMutation.mutateAsync(),
     initiateQuickConnect,
     stopQuickConnectPolling,

utils/atoms/settings.ts

@@ -449,11 +449,6 @@ export const pluginSettingsAtom = atom<PluginLockableSettings | undefined>(
 const hasMeaningfulSettingValue = (value: unknown) =>
   value !== undefined && value !== null && value !== "";
 
-const getEffectiveSettingValue = <K extends keyof Settings>(
-  settings: Partial<Settings> | null | undefined,
-  settingsKey: K,
-) => settings?.[settingsKey] ?? defaultValues[settingsKey];
-
 export const useSettings = () => {
   const api = useAtomValue(apiAtom);
   const [_settings, setSettings] = useAtom(settingsAtom);
@@ -510,7 +505,17 @@ export const useSettings = () => {
     if (!_settings) {
       return;
     }
-    const hasChanges = Object.entries(update).some(
+    // Admin-locked settings are enforced at write time too: a control that
+    // isn't disabled in the UI must not persist a value the admin pinned.
+    // The read memo already overrides locked keys, but without this guard the
+    // write would silently land in user storage and resurface once unlocked.
+    const sanitizedUpdate = Object.fromEntries(
+      Object.entries(update).filter(
+        ([key]) => pluginSettings?.[key as keyof Settings]?.locked !== true,
+      ),
+    ) as Partial<Settings>;
+
+    const hasChanges = Object.entries(sanitizedUpdate).some(
       ([key, value]) => _settings[key as keyof Settings] !== value,
     );
 
@@ -519,7 +524,7 @@ export const useSettings = () => {
       const newSettings = {
         ...defaultValues,
         ..._settings,
-        ...update,
+        ...sanitizedUpdate,
       } as Settings;
       setSettings(newSettings);
       saveSettings(newSettings);
@@ -542,13 +547,24 @@ export const useSettings = () => {
         // Normalize object-typed settings from plugin (plain primitive → { key, value })
         value = normalizePluginValue(settingsKey, value);
 
-        const effectiveValue = getEffectiveSettingValue(_settings, settingsKey);
+        // When unlocked, keep the user's value only if they explicitly diverged
+        // from the app default. Otherwise the plugin value is the admin's
+        // default and must win over the hardcoded app default — e.g. a toggle
+        // that was always locked then unlocked should reflect the plugin
+        // default, not the app's `false`. Object-typed settings compare by
+        // reference, so their behaviour is unchanged.
+        const userValue = _settings?.[settingsKey];
+        const userDiverged =
+          hasMeaningfulSettingValue(userValue) &&
+          userValue !== defaultValues[settingsKey];
 
         (acc as any)[settingsKey] = locked
           ? value
-          : hasMeaningfulSettingValue(effectiveValue)
-            ? effectiveValue
-            : value;
+          : userDiverged
+            ? userValue
+            : hasMeaningfulSettingValue(value)
+              ? value
+              : defaultValues[settingsKey];
       }
       return acc;
     }, {});