2 Commits

Include renames

Author	SHA1	Message	Date
Cursor AgentandMatysh	e6579f1e55	fix(dev): audit P0/P3 — write policy, README diff, validation ... - Default admin_only on; config/get returns can_write; card editors follow it and fail closed without hass.user (P0-4). - README EN/RU differentiation vs GUI draw cards / easy-floorplan (P0-3). - Tighten marker binding, ripple_color, decor extents, space id (P3-4). - quality_scale test path + deprecated card tap_action note (P3-5). - Demo hass.user + can_write; unique marker id in upload overwrite test. Co-authored-by: Matysh <Matysh@users.noreply.github.com>	2026-08-05 08:10:51 +00:00
Matysh	09b0ba41a5	fix v1.44.4: audit follow-up B2, B5, L4 sub-item ... B2: the HTTP upload view failed OPEN when the config entry was unavailable while the WS path failed closed — both now share one may_write() policy helper (new auth.py) that denies non-admins when the policy cannot be read. B5: _finite now guards room rects, polygon vertices, view_box and opening coordinates, not just layout positions; the declared MAX_OPENINGS cap is finally enforced. L4 (sub-item): every drag pipeline captures the pointer through the tolerant helper (an inactive pointerId used to kill device/label/resize drags); decor shapes gained a bounds clamp so they cannot be dragged far outside the plan and persisted there. +2 backend tests (16); both changelogs updated in this commit	2026-07-27 14:14:25 +03:00