Matysh 09b0ba41a5 fix v1.44.4: audit follow-up B2, B5, L4 sub-item ...

B2: the HTTP upload view failed OPEN when the config entry was
unavailable while the WS path failed closed — both now share one
may_write() policy helper (new auth.py) that denies non-admins when the
policy cannot be read.

B5: _finite now guards room rects, polygon vertices, view_box and
opening coordinates, not just layout positions; the declared
MAX_OPENINGS cap is finally enforced.

L4 (sub-item): every drag pipeline captures the pointer through the
tolerant helper (an inactive pointerId used to kill device/label/resize
drags); decor shapes gained a bounds clamp so they cannot be dragged far
outside the plan and persisted there.

+2 backend tests (16); both changelogs updated in this commit

2026-07-27 14:14:25 +03:00

..

conftest.py

ci: fix HA-harness tests — asyncio_mode=auto (pytest.ini), per-module enable_custom_integrations fixture instead of a global autouse that broke sync tests

2026-07-06 00:30:29 +03:00

test_ha_config_flow.py

tests: entry auto-loads after the config flow; traversal assertion checks path segments, not substrings

2026-07-06 00:35:36 +03:00

test_ha_setup.py

ci: fix HA-harness tests — asyncio_mode=auto (pytest.ini), per-module enable_custom_integrations fixture instead of a global autouse that broke sync tests

2026-07-06 00:30:29 +03:00

test_ha_upload.py

test: HA-harness expectations follow the authenticated content URLs (audit B1)

2026-07-27 11:23:39 +03:00

test_ha_websocket.py

fix v1.44.3: signed content paths — plans and PDFs load again (B1 regression)

2026-07-27 14:08:29 +03:00

test_validation.py

fix v1.44.4: audit follow-up B2, B5, L4 sub-item

2026-07-27 14:14:25 +03:00