german/houseplan-card
1
0
Fork 0
mirror of https://github.com/Matysh/houseplan-card synced 2026-07-31 08:28:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

refactor+fix v1.10.0: аудит — гонки записи (asyncio.Lock, атомарный rev), точечный layout/update вместо layout/set (анти last-writer-wins), layout/delete, safeUrl против XSS в link/pdfs, fetchWithAuth, KEY_HASS, стриминговый лимит upload, модульность (styles/types/devices), динамические пространства в GUI-редакторе, чистка мёртвого кода (file/set, GROUP_TITLES)

Browse Source
This commit is contained in:
Matysh
2026-07-05 20:58:33 +03:00
parent 7cd9a56f5a
commit e7cf0416be
16 changed files with 1991 additions and 1874 deletions
Download Patch File Download Diff File Expand all files Collapse all files
custom_components/houseplan/const.py
+1 -1
View File
@@ -10,7 +10,7 @@ PLANS_DIR = "houseplan/plans" # относительно каталога ко
FILES_URL = "/houseplan_files/files"
FILES_DIR = "houseplan/files"
CONF_ADMIN_ONLY = "admin_only"
VERSION = "1.9.3"
VERSION = "1.10.0"
DEFAULT_CONFIG: dict = {
"spaces": [],
custom_components/houseplan/frontend/houseplan-card.js
+316 -316
View File
File diff suppressed because one or more lines are too long
custom_components/houseplan/http_api.py
+28 -9
View File
@@ -11,6 +11,11 @@ from pathlib import Path
from aiohttp import web
from homeassistant.components.http import HomeAssistantView
try: # KEY_HASS — современный доступ к hass из aiohttp-приложения
from homeassistant.components.http import KEY_HASS
except ImportError: # старые версии HA
KEY_HASS = "hass" # type: ignore[assignment]
from homeassistant.core import HomeAssistant
from .const import CONF_ADMIN_ONLY, DOMAIN, FILES_DIR, FILES_URL
@@ -24,6 +29,8 @@ from .validation import (
_LOGGER = logging.getLogger(__name__)
_CHUNK = 64 * 1024
class HouseplanUploadView(HomeAssistantView):
"""POST /api/houseplan/upload — сохранить файл маркера, вернуть URL."""
@@ -33,7 +40,7 @@ class HouseplanUploadView(HomeAssistantView):
requires_auth = True
async def post(self, request: web.Request) -> web.Response:
hass: HomeAssistant = request.app["hass"]
hass: HomeAssistant = request.app[KEY_HASS]
entry = hass.data.get(DOMAIN, {}).get("entry")
admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
if admin_only:
@@ -44,6 +51,7 @@ class HouseplanUploadView(HomeAssistantView):
marker_id = "misc"
filename: str | None = None
blob: bytes | None = None
too_large = False
try:
reader = await request.multipart()
async for part in reader:
@@ -51,11 +59,26 @@ class HouseplanUploadView(HomeAssistantView):
marker_id = sanitize_marker_id(await part.text())
elif part.name == "file":
filename = part.filename or "file"
blob = await part.read(decode=False)
# читаем чанками с обрывом по лимиту, а не весь файл в память
chunks: list[bytes] = []
size = 0
while chunk := await part.read_chunk(_CHUNK):
size += len(chunk)
if size > MAX_FILE_BYTES:
too_large = True
break
chunks.append(chunk)
if too_large:
break
blob = b"".join(chunks)
except Exception as err: # noqa: BLE001
_LOGGER.warning("House Plan upload: ошибка чтения multipart: %s", err)
return web.json_response({"error": "bad_request"}, status=400)
if too_large:
return web.json_response(
{"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024}, status=413
)
if blob is None or not filename:
return web.json_response({"error": "no_file"}, status=400)
ext = file_ext(filename)
@@ -63,21 +86,17 @@ class HouseplanUploadView(HomeAssistantView):
return web.json_response(
{"error": "bad_ext", "allowed": sorted(FILE_EXTENSIONS)}, status=400
)
if len(blob) > MAX_FILE_BYTES:
return web.json_response(
{"error": "too_large", "max_mb": MAX_FILE_BYTES // 1024 // 1024}, status=413
)
safe_name = sanitize_filename(filename)
target_dir = Path(hass.config.path(FILES_DIR)) / marker_id
path = target_dir / safe_name
def _write() -> None:
def _write() -> int:
target_dir.mkdir(parents=True, exist_ok=True)
path.write_bytes(blob)
return int(path.stat().st_mtime)
await hass.async_add_executor_job(_write)
mtime = int(path.stat().st_mtime)
mtime = await hass.async_add_executor_job(_write)
return web.json_response(
{"ok": True, "url": f"{FILES_URL}/{marker_id}/{safe_name}?v={mtime}", "name": filename}
)
custom_components/houseplan/manifest.json
+1 -1
View File
@@ -15,5 +15,5 @@
"iot_class": "local_push",
"issue_tracker": "https://github.com/Matysh/houseplan-card/issues",
"requirements": [],
"version": "1.9.3"
"version": "1.10.0"
}
custom_components/houseplan/websocket_api.py
+57 -66
View File
@@ -1,6 +1,7 @@
"""WS-команды House Plan: раскладка, конфигурация пространств, загрузка планов."""
from __future__ import annotations
import asyncio
import base64
import binascii
from pathlib import Path
@@ -13,25 +14,24 @@ from homeassistant.core import HomeAssistant, callback
from .const import (
CONF_ADMIN_ONLY, DEFAULT_CONFIG, DOMAIN,
FILES_DIR, FILES_URL, PLANS_DIR, PLANS_URL,
PLANS_DIR, PLANS_URL,
)
from .validation import (
CONFIG_SCHEMA, FILE_EXTENSIONS, LAYOUT_SCHEMA, MAX_FILE_BYTES, MAX_PLAN_BYTES,
PLAN_EXTENSIONS, POS_SCHEMA, file_ext, sanitize_filename, sanitize_marker_id, valid_space_id,
CONFIG_SCHEMA, LAYOUT_SCHEMA, MAX_PLAN_BYTES,
PLAN_EXTENSIONS, POS_SCHEMA, valid_space_id,
)
@callback
def async_register(hass: HomeAssistant) -> None:
"""Регистрация WS-команд."""
websocket_api.async_register_command(hass, ws_layout_get)
websocket_api.async_register_command(hass, ws_layout_set)
websocket_api.async_register_command(hass, ws_layout_update)
websocket_api.async_register_command(hass, ws_layout_delete)
websocket_api.async_register_command(hass, ws_config_get)
websocket_api.async_register_command(hass, ws_config_set)
websocket_api.async_register_command(hass, ws_plan_set)
websocket_api.async_register_command(hass, ws_file_set)
def _store(hass: HomeAssistant):
@@ -42,6 +42,15 @@ def _config_store(hass: HomeAssistant):
return hass.data[DOMAIN]["config_store"]
def _write_lock(hass: HomeAssistant) -> asyncio.Lock:
"""Единый лок на цикл load→modify→save обоих хранилищ.
Без него параллельные WS-вызовы теряют изменения (last-writer-wins),
а проверка expected_rev неатомарна.
"""
return hass.data[DOMAIN].setdefault("write_lock", asyncio.Lock())
def _check_write(hass: HomeAssistant, connection) -> bool:
entry = hass.data[DOMAIN].get("entry")
admin_only = bool(entry and entry.options.get(CONF_ADMIN_ONLY, False))
@@ -68,7 +77,8 @@ async def ws_layout_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
if not _check_write(hass, connection):
connection.send_error(msg["id"], "unauthorized", "Правка раскладки разрешена только администраторам")
return
await _store(hass).async_save({"layout": msg["layout"]})
async with _write_lock(hass):
await _store(hass).async_save({"layout": msg["layout"]})
connection.send_result(msg["id"], {"ok": True})
@@ -86,10 +96,33 @@ async def ws_layout_update(hass: HomeAssistant, connection, msg: dict[str, Any])
connection.send_error(msg["id"], "unauthorized", "Правка раскладки разрешена только администраторам")
return
store = _store(hass)
data = await store.async_load() or {}
layout = data.get("layout", {})
layout[msg["device_id"]] = msg["pos"]
await store.async_save({"layout": layout})
async with _write_lock(hass):
data = await store.async_load() or {}
layout = data.get("layout", {})
layout[msg["device_id"]] = msg["pos"]
await store.async_save({"layout": layout})
connection.send_result(msg["id"], {"ok": True})
@websocket_api.websocket_command(
{
vol.Required("type"): "houseplan/layout/delete",
vol.Required("device_id"): str,
}
)
@websocket_api.async_response
async def ws_layout_delete(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
"""Удалить позицию одного устройства (чистка при удалении маркера)."""
if not _check_write(hass, connection):
connection.send_error(msg["id"], "unauthorized", "Правка раскладки разрешена только администраторам")
return
store = _store(hass)
async with _write_lock(hass):
data = await store.async_load() or {}
layout = data.get("layout", {})
if msg["device_id"] in layout:
del layout[msg["device_id"]]
await store.async_save({"layout": layout})
connection.send_result(msg["id"], {"ok": True})
@@ -124,16 +157,17 @@ async def ws_config_set(hass: HomeAssistant, connection, msg: dict[str, Any]) ->
connection.send_error(msg["id"], "unauthorized", "Правка конфигурации разрешена только администраторам")
return
store = _config_store(hass)
data = await store.async_load() or {}
current_rev = data.get("rev", 0)
if "expected_rev" in msg and msg["expected_rev"] != current_rev:
connection.send_error(
msg["id"], "conflict",
f"Конфигурация изменена в другом окне (rev {current_rev} != {msg['expected_rev']})",
)
return
new_rev = current_rev + 1
await store.async_save({"config": msg["config"], "rev": new_rev})
async with _write_lock(hass):
data = await store.async_load() or {}
current_rev = data.get("rev", 0)
if "expected_rev" in msg and msg["expected_rev"] != current_rev:
connection.send_error(
msg["id"], "conflict",
f"Конфигурация изменена в другом окне (rev {current_rev} != {msg['expected_rev']})",
)
return
new_rev = current_rev + 1
await store.async_save({"config": msg["config"], "rev": new_rev})
hass.bus.async_fire("houseplan_config_updated", {"rev": new_rev})
connection.send_result(msg["id"], {"ok": True, "rev": new_rev})
@@ -171,7 +205,7 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
plans_dir = Path(hass.config.path(PLANS_DIR))
path = plans_dir / f"{space_id}.{msg['ext']}"
def _write() -> None:
def _write() -> int:
plans_dir.mkdir(parents=True, exist_ok=True)
# убрать старые варианты с другим расширением
for old_ext in PLAN_EXTENSIONS:
@@ -179,52 +213,9 @@ async def ws_plan_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> N
if old_ext != msg["ext"] and old.exists():
old.unlink()
path.write_bytes(raw)
return int(path.stat().st_mtime)
await hass.async_add_executor_job(_write)
mtime = int(path.stat().st_mtime)
mtime = await hass.async_add_executor_job(_write)
connection.send_result(
msg["id"], {"ok": True, "url": f"{PLANS_URL}/{space_id}.{msg['ext']}?v={mtime}"}
)
@websocket_api.websocket_command(
{
vol.Required("type"): "houseplan/file/set",
vol.Required("marker_id"): str,
vol.Required("filename"): str,
vol.Required("data"): str, # base64
}
)
@websocket_api.async_response
async def ws_file_set(hass: HomeAssistant, connection, msg: dict[str, Any]) -> None:
"""Загрузить файл-инструкцию (PDF и т.п.) для маркера; вернуть URL."""
if not _check_write(hass, connection):
connection.send_error(msg["id"], "unauthorized", "Загрузка файлов разрешена только администраторам")
return
marker_id = sanitize_marker_id(msg["marker_id"])
raw_name = msg["filename"].rsplit("/", 1)[-1].rsplit("\\", 1)[-1]
ext = file_ext(raw_name)
if ext not in FILE_EXTENSIONS:
connection.send_error(msg["id"], "bad_ext", f"Разрешены: {', '.join(sorted(FILE_EXTENSIONS))}")
return
safe_name = sanitize_filename(raw_name)
try:
blob = base64.b64decode(msg["data"], validate=True)
except (binascii.Error, ValueError):
connection.send_error(msg["id"], "invalid_data", "data должен быть корректным base64")
return
if len(blob) > MAX_FILE_BYTES:
connection.send_error(msg["id"], "too_large", f"Файл больше {MAX_FILE_BYTES // 1024 // 1024} МБ")
return
target_dir = Path(hass.config.path(FILES_DIR)) / marker_id
path = target_dir / safe_name
def _write() -> None:
target_dir.mkdir(parents=True, exist_ok=True)
path.write_bytes(blob)
await hass.async_add_executor_job(_write)
mtime = int(path.stat().st_mtime)
connection.send_result(
msg["id"], {"ok": True, "url": f"{FILES_URL}/{marker_id}/{safe_name}?v={mtime}", "name": raw_name}
)