Harden RelayTV integration and prepare HACS 0.4.0 (#2)
* docs: add Home Assistant 0.4.0 hardening roadmap * fix: protect media credentials and resume state * feat: authenticate RelayTV API operations * fix: make targeting and media state reliable * test: add Home Assistant integration CI * fix: validate API credentials during setup * release: prepare HACS 0.4.0 * fix: align pytest dependency pin * fix: close URL sanitizer gaps and correct player state reporting Sync the sensitive-query-key list with the RelayTV server (adds auth, exp, jwt, X-Emby-Token, X-Jellyfin-Token), filter query credentials from relative URLs instead of returning them verbatim, and preserve brackets around IPv6 literal hosts. Also report volume on RelayTV's 0-100 scale unconditionally (a raw 1 is 1%, not full volume) and give the coordinator its own position_updated_at stamp — the base DataUpdateCoordinator has no last_update_success_time, so media_position_updated_at silently fell back to now() on every read and the seek bar never extrapolated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
+38
-41
@@ -1,50 +1,47 @@
|
||||
# RelayTV HA 0.3.12
|
||||
# RelayTV HA 0.4.0
|
||||
|
||||
## HACS Install Layout Fix
|
||||
This release hardens the Home Assistant integration for credential safety,
|
||||
authenticated RelayTV servers, and dependable multi-server control. It
|
||||
requires Home Assistant 2026.7 or newer.
|
||||
|
||||
This release fixes the HACS `relaytv.zip` package layout. Version `0.3.11` packaged the integration inside an extra top-level `relaytv/` directory, which could install as:
|
||||
## Highlights
|
||||
|
||||
```text
|
||||
/config/custom_components/relaytv/relaytv/manifest.json
|
||||
```
|
||||
- Playback URLs are sanitized before being exposed as media-player state or
|
||||
used as persisted resume keys.
|
||||
- Legacy resume data is migrated automatically, deduplicated, and capped at
|
||||
500 entries.
|
||||
- Optional `RELAYTV_API_TOKEN` bearer authentication can be configured with a
|
||||
masked field and recovered through Home Assistant reauthentication.
|
||||
- RelayTV API failures now surface as real Home Assistant action errors.
|
||||
- Explicit service targets can no longer fall back to another TV.
|
||||
- Sidebar target selection survives multi-entry startup ordering.
|
||||
- The media player adds native mute, correct zero-valued position/duration,
|
||||
and a stable Home Assistant device with a configuration link.
|
||||
- Automated coverage now includes configuration flows, setup authentication,
|
||||
URL/storage migration, targeting, panel persistence, API failures,
|
||||
coordinator deduplication, and media properties.
|
||||
|
||||
Home Assistant expects:
|
||||
## Security migration
|
||||
|
||||
```text
|
||||
/config/custom_components/relaytv/manifest.json
|
||||
```
|
||||
The integration migrates its own resume store on first startup. Home Assistant
|
||||
recorder history from an older release is intentionally left untouched. If an
|
||||
old media identifier included a Jellyfin/Emby API key, bearer token, or signed
|
||||
stream credential:
|
||||
|
||||
Updating to `0.3.12` restores the correct flat zip layout for HACS installs and updates. Restart Home Assistant after updating.
|
||||
1. Rotate the affected upstream credential.
|
||||
2. Purge old recorder history for the RelayTV media-player entity if required
|
||||
by your security policy.
|
||||
3. Update the RelayTV server to the companion release that redacts private
|
||||
playback fields from public status, SSE, queue, and history responses.
|
||||
|
||||
## Companion App Share Automation
|
||||
The companion server update also adds `POST /auth/check` for non-mutating token
|
||||
validation and cross-origin headers for Home Assistant thumbnail rendering.
|
||||
Older unprotected RelayTV servers remain compatible, but the current server is
|
||||
strongly recommended.
|
||||
|
||||
This release continues to highlight the Home Assistant Companion App share automation flow. You can share URLs or text from the Home Assistant mobile app and send them directly to RelayTV with `relaytv.smart_url`.
|
||||
## Upgrade
|
||||
|
||||
```yaml
|
||||
alias: RelayTV - Smart play from share
|
||||
description: Opens shared URLs/text in RelayTV via relaytv.smart_url
|
||||
triggers:
|
||||
- event_type: mobile_app.share
|
||||
trigger: event
|
||||
conditions:
|
||||
- condition: template
|
||||
value_template: "{{ shared | trim | length > 0 }}"
|
||||
actions:
|
||||
- data:
|
||||
url: "{{ shared | trim }}"
|
||||
action: relaytv.smart_url
|
||||
mode: single
|
||||
variables:
|
||||
shared: |-
|
||||
{{ trigger.event.data.url
|
||||
if trigger.event.data.url is defined else
|
||||
(trigger.event.data.text if trigger.event.data.text is defined else '') }}
|
||||
```
|
||||
|
||||
## HACS Display Assets
|
||||
|
||||
- Keeps integration brand assets under `custom_components/relaytv/brand/`.
|
||||
- Keeps root-level `icon.png` and `logo.png` fallbacks for repository/HACS renderers that look at the repository root.
|
||||
- Uses the README screenshot hosted from GitHub raw content for reliable rendering in HACS.
|
||||
|
||||
Note: HACS' integration list icon is ultimately loaded from `brands.home-assistant.io` for integration domains. If the RelayTV icon still appears generic in the list, the remaining durable step is submitting `relaytv` to the Home Assistant Brands repository.
|
||||
Install 0.4.0 through HACS, restart Home Assistant, and use **Reconfigure** on
|
||||
the RelayTV integration entry if the server has `RELAYTV_API_TOKEN` enabled.
|
||||
The HACS archive remains flat, with `manifest.json` directly at the archive
|
||||
root as required for `/config/custom_components/relaytv/` installation.
|
||||
|
||||
Reference in New Issue
Block a user