fix v1.43.0: external audit P0 — data loss, split geometry, auth, dialog zombies

L2 (silent data loss): debounce gains flush()/pending(); _reloadConfigOnly
flushes a pending write and defers while one is in flight; conflict path
forces; failed reload now toasts instead of an empty catch; teardown flushes.

G1 (split corruption): same-edge cuts carve the niche properly instead of
walking the outline twice; partition invariant (parts sum to the original)
rejects anything else; +1 unit test covering 5 niche shapes and both legacy
cut shapes.

B1 (unauthenticated content): plans and marker files move to
HouseplanContentView (/api/houseplan/content/..., requires_auth); only the
card bundle stays static; contentUrl() rewrites legacy URLs on read (no
storage migration); repairs.py accepts both prefixes; +1 unit test.

L3 (dialog zombies): all four save catch-blocks guard against a closed
dialog; the card no longer blanks when a save fails after Esc.

smokes: smoke_save_race, smoke_dialog_zombie; docs (TESTING/CHANGELOG/
ARCHITECTURE incl. the optimistic-UI note) same-commit

custom_components/houseplan/__init__.py

@@ -28,9 +28,10 @@ async def async_setup(hass: HomeAssistant, config) -> bool:
     """Register global handlers (survive config-entry reloads): WS commands, HTTP view."""
     hass.data.setdefault(DOMAIN, {})
     hp_ws.async_register(hass)
-    from .http_api import HouseplanUploadView
+    from .http_api import HouseplanContentView, HouseplanUploadView
 
     hass.http.register_view(HouseplanUploadView())
+    hass.http.register_view(HouseplanContentView())
     return True
 
 
@@ -61,14 +62,14 @@ async def async_setup_entry(hass: HomeAssistant, entry: HouseplanConfigEntry) ->
 
             if card_path.exists():
                 static_paths.append(StaticPathConfig(FRONTEND_URL, str(card_path), cache_headers=False))
-            static_paths.append(StaticPathConfig(PLANS_URL, str(plans_path), cache_headers=True))
-            static_paths.append(StaticPathConfig(FILES_URL, str(files_path), cache_headers=True))
-            await hass.http.async_register_static_paths(static_paths)
+            # NOTE (audit B1): plans and marker files are NO LONGER static.
+            # They are served by HouseplanContentView, which requires auth.
+            # Only the card bundle stays public — Lovelace resources must be.
+            if static_paths:
+                await hass.http.async_register_static_paths(static_paths)
         except ImportError:  # very old HA versions
             if card_path.exists():
                 hass.http.register_static_path(FRONTEND_URL, str(card_path), cache_headers=False)
-            hass.http.register_static_path(PLANS_URL, str(plans_path), cache_headers=True)
-            hass.http.register_static_path(FILES_URL, str(files_path), cache_headers=True)
 
     if not card_path.exists():
         _LOGGER.warning("houseplan-card.js not found next to the integration: %s", card_path)

custom_components/houseplan/const.py

@@ -9,9 +9,11 @@ FRONTEND_URL = "/houseplan_files/houseplan-card.js"
 PLANS_URL = "/houseplan_files/plans"
 PLANS_DIR = "houseplan/plans"  # relative to the HA configuration directory
 FILES_URL = "/houseplan_files/files"
+# authenticated read path (audit B1): /api/houseplan/content/<plans|files>/<sub>/<name>
+CONTENT_URL = "/api/houseplan/content"
 FILES_DIR = "houseplan/files"
 CONF_ADMIN_ONLY = "admin_only"
-VERSION = "1.42.2"
+VERSION = "1.43.0"
 
 DEFAULT_CONFIG: dict = {
     "spaces": [],

custom_components/houseplan/http_api.py

@@ -18,7 +18,7 @@ except ImportError:  # older HA versions
     KEY_HASS = "hass"  # type: ignore[assignment]
 from homeassistant.core import HomeAssistant
 
-from .const import CONF_ADMIN_ONLY, FILES_DIR, FILES_URL
+from .const import CONF_ADMIN_ONLY, CONTENT_URL, FILES_DIR, FILES_URL, PLANS_DIR
 from .store import get_entry
 from .validation import (
     FILE_EXTENSIONS,
@@ -32,6 +32,59 @@ _LOGGER = logging.getLogger(__name__)
 
 _CHUNK = 64 * 1024
 
+_MIME = {
+    ".pdf": "application/pdf",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".svg": "image/svg+xml",
+    ".webp": "image/webp",
+    ".gif": "image/gif",
+    ".txt": "text/plain",
+}
+
+
+class HouseplanContentView(HomeAssistantView):
+    """Authenticated read access to plans and marker files (audit B1).
+
+    The directories used to be exposed as unauthenticated static paths, so
+    anyone who could reach the HA endpoint could pull floor plans and uploaded
+    manuals without logging in. This view keeps the same URLs but requires a
+    Home Assistant session (or a signed path, which the frontend uses for
+    <image href> inside the SVG).
+    """
+
+    url = "/api/houseplan/content/{kind}/{sub}/{name}"
+    name = "api:houseplan:content"
+    requires_auth = True
+
+    async def get(self, request: web.Request, kind: str, sub: str, name: str) -> web.StreamResponse:
+        hass: HomeAssistant = request.app[KEY_HASS]
+        if kind not in ("plans", "files"):
+            return web.Response(status=404)
+        safe_sub = sanitize_marker_id(sub)
+        safe_name = sanitize_filename(name)
+        if not safe_sub or not safe_name:
+            return web.Response(status=404)
+        base = Path(hass.config.path(PLANS_DIR if kind == "plans" else FILES_DIR)).resolve()
+        # plans live flat in one directory: the sub segment is a placeholder ("_")
+        path = (base / safe_name if kind == "plans" else base / safe_sub / safe_name).resolve()
+        # defence in depth: the sanitizers already strip separators
+        if not str(path).startswith(str(base)):
+            return web.Response(status=404)
+
+        def _read() -> bytes | None:
+            return path.read_bytes() if path.is_file() else None
+
+        blob = await hass.async_add_executor_job(_read)
+        if blob is None:
+            return web.Response(status=404)
+        return web.Response(
+            body=blob,
+            content_type=_MIME.get(path.suffix.lower(), "application/octet-stream"),
+            headers={"Cache-Control": "private, max-age=3600"},
+        )
+
 
 class HouseplanUploadView(HomeAssistantView):
     """POST /api/houseplan/upload — save a marker file, return its URL."""
@@ -99,5 +152,5 @@ class HouseplanUploadView(HomeAssistantView):
 
         mtime = await hass.async_add_executor_job(_write)
         return web.json_response(
-            {"ok": True, "url": f"{FILES_URL}/{marker_id}/{safe_name}?v={mtime}", "name": filename}
+            {"ok": True, "url": f"{CONTENT_URL}/files/{marker_id}/{safe_name}?v={mtime}", "name": filename}
         )

custom_components/houseplan/manifest.json

@@ -16,5 +16,5 @@
   "issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
   "requirements": [],
   "single_config_entry": true,
-  "version": "1.42.2"
+  "version": "1.43.0"
 }

custom_components/houseplan/repairs.py

@@ -11,7 +11,7 @@ from pathlib import Path
 from homeassistant.core import HomeAssistant
 from homeassistant.helpers import issue_registry as ir
 
-from .const import DOMAIN, PLANS_DIR, PLANS_URL
+from .const import CONTENT_URL, DOMAIN, PLANS_DIR, PLANS_URL
 from .store import HouseplanConfigEntry
 
 
@@ -25,9 +25,15 @@ async def async_check_plan_files(hass: HomeAssistant, entry: HouseplanConfigEntr
         res = []
         for sp in spaces:
             url = sp.get("plan_url") or ""
-            if not url.startswith(PLANS_URL + "/"):
+            # both the legacy static URL and the authenticated content URL
+            prefix = None
+            if url.startswith(PLANS_URL + "/"):
+                prefix = PLANS_URL + "/"
+            elif url.startswith(CONTENT_URL + "/plans/_/"):
+                prefix = CONTENT_URL + "/plans/_/"
+            if prefix is None:
                 continue  # external/legacy URL — not ours to verify
-            fname = url[len(PLANS_URL) + 1 :].split("?", 1)[0]
+            fname = url[len(prefix) :].split("?", 1)[0]
             if not (plans_dir / fname).is_file():
                 res.append((sp.get("id", "?"), fname))
         return res

custom_components/houseplan/websocket_api.py

@@ -13,7 +13,7 @@ from homeassistant.core import HomeAssistant, callback
 
 from .const import (
     CONF_ADMIN_ONLY, DEFAULT_CONFIG,
-    PLANS_DIR, PLANS_URL,
+    CONTENT_URL, PLANS_DIR, PLANS_URL,
 )
 from .store import HouseplanData, get_data, get_entry
 from .validation import (
@@ -290,5 +290,5 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
 
     mtime = await hass.async_add_executor_job(_write)
     connection.send_result(
-        msg["id"], {"ok": True, "url": f"{PLANS_URL}/{space_id}.{msg['ext']}?v={mtime}"}
+        msg["id"], {"ok": True, "url": f"{CONTENT_URL}/plans/_/{space_id}.{msg['ext']}?v={mtime}"}
     )