mirror of
https://github.com/Matysh/houseplan-card
synced 2026-07-31 08:28:31 +00:00
Matysh
260615a63f
HP-1454-01 (high, release blocker): an uploaded SVG plan opened directly is a top-level document of Home Assistant's own origin, so a <script> inside it reaches the session's localStorage and API. Uploading needs write access, which by default every authenticated user has. SVG responses now carry a sandbox CSP; only SVG, because a CSP on a PDF can break the browser's viewer and a raster image has nothing to disable. Verified in Chromium both ways: the script runs without the header and does not with it. HP-1454-02: attachment uploads wrote straight to <marker>/<filename>, outside the config transaction — a cancelled dialog or a rejected save left the stored url serving new bytes, and every new icon shared one 'new' folder, so two of them attaching manual.pdf pointed at one file. Uploads take a free name, a new icon gets a per-dialog staging folder promoted on an accepted save, and config/set collects superseded and aged-orphan attachments like it does plans. HP-1454-03: the debounce spaced out the starts of a write, not the writes. A save slower than 500 ms let the next edit go out with the same expected_rev; the server accepted the first, rejected the second, and the conflict handler reloaded over the local copy. Writes are chained now — one in flight, each with the revision the previous returned. HP-1454-04: _openPairsCache keyed on room ids and links only, so an aspect change or a dragged vertex left open boundaries and their glow cuts at old coordinates. It keys on the rendered model object now — the same invalidation the model cache already has, not a second strategy. The fingerprint also gained an O(1) geometry roll-up per room. HP-1454-05: outer collections were capped, inner ones were not. Limits for poly points, open_to, controls, pdfs, text and url lengths, plus a total serialized size cap; legacy is dropped server-side. HP-1454-06: upload streams to a temp file and downloads use FileResponse, so a 50 MB manual no longer costs ~100 MB of RSS per transfer. HP-1454-07: spaceModels() dropped room.settings, so the static card ignored the per-room fill override. HP-1454-08: layout had no revision on point-wise writes and no event, leaving static cards stale forever; it now keeps a revision, returns it and fires houseplan_layout_updated. HP-1454-09: repair cleanup only walked existing spaces, so a deleted space kept its warning. HP-1454-10: serialize-javascript pinned past two advisories. Tests: smoke_svg_sandbox (proves both directions), smoke_config_writer and smoke_render_parity (both verified failing against a v1.45.4 build), six pure tests for attachment collection and inner limits, four HA-harness tests for the CSP, non-overwriting uploads, the size cap and layout revisions. Docs: CHANGELOG.md + CHANGELOG.ru.md + ARCHITECTURE.md + TESTING.md + STATUS.md.
34 lines
1.2 KiB
Python
Executable File
34 lines
1.2 KiB
Python
Executable File
"""Constants of the House Plan integration."""
|
|
|
|
DOMAIN = "houseplan"
|
|
STORAGE_KEY = f"{DOMAIN}.layout"
|
|
STORAGE_CONFIG_KEY = f"{DOMAIN}.config"
|
|
STORAGE_VERSION = 1
|
|
STORAGE_MINOR_VERSION = 1
|
|
FRONTEND_URL = "/houseplan_files/houseplan-card.js"
|
|
PLANS_URL = "/houseplan_files/plans"
|
|
PLANS_DIR = "houseplan/plans" # relative to the HA configuration directory
|
|
FILES_URL = "/houseplan_files/files"
|
|
# authenticated read path (audit B1): /api/houseplan/content/<plans|files>/<sub>/<name>
|
|
CONTENT_URL = "/api/houseplan/content"
|
|
|
|
# How many paths one houseplan/content/sign call may carry. The card batches to
|
|
# the same number; a client that sends more used to get a partial answer with no
|
|
# way to tell which paths were dropped (review R2-2).
|
|
MAX_SIGN_PATHS = 200
|
|
|
|
# An uploaded plan that no accepted configuration references is collected only
|
|
# once it is this old. Age is a race guard, not a policy: a plan uploaded
|
|
# seconds ago may belong to another client's transaction that has not written
|
|
# its configuration yet (review R3-1).
|
|
PLAN_ORPHAN_TTL_S = 3600
|
|
FILES_DIR = "houseplan/files"
|
|
CONF_ADMIN_ONLY = "admin_only"
|
|
VERSION = "1.46.0"
|
|
|
|
DEFAULT_CONFIG: dict = {
|
|
"spaces": [],
|
|
"markers": [],
|
|
"settings": {},
|
|
}
|