markandClaude Fable 5
f2bf565623
* docs: add Home Assistant 0.4.0 hardening roadmap * fix: protect media credentials and resume state * feat: authenticate RelayTV API operations * fix: make targeting and media state reliable * test: add Home Assistant integration CI * fix: validate API credentials during setup * release: prepare HACS 0.4.0 * fix: align pytest dependency pin * fix: close URL sanitizer gaps and correct player state reporting Sync the sensitive-query-key list with the RelayTV server (adds auth, exp, jwt, X-Emby-Token, X-Jellyfin-Token), filter query credentials from relative URLs instead of returning them verbatim, and preserve brackets around IPv6 literal hosts. Also report volume on RelayTV's 0-100 scale unconditionally (a raw 1 is 1%, not full volume) and give the coordinator its own position_updated_at stamp — the base DataUpdateCoordinator has no last_update_success_time, so media_position_updated_at silently fell back to now() on every read and the seek bar never extrapolated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2.2 KiB
RelayTV HA 0.4.0
This release hardens the Home Assistant integration for credential safety, authenticated RelayTV servers, and dependable multi-server control. It requires Home Assistant 2026.7 or newer.
Highlights
- Playback URLs are sanitized before being exposed as media-player state or used as persisted resume keys.
- Legacy resume data is migrated automatically, deduplicated, and capped at 500 entries.
- Optional
RELAYTV_API_TOKENbearer authentication can be configured with a masked field and recovered through Home Assistant reauthentication. - RelayTV API failures now surface as real Home Assistant action errors.
- Explicit service targets can no longer fall back to another TV.
- Sidebar target selection survives multi-entry startup ordering.
- The media player adds native mute, correct zero-valued position/duration, and a stable Home Assistant device with a configuration link.
- Automated coverage now includes configuration flows, setup authentication, URL/storage migration, targeting, panel persistence, API failures, coordinator deduplication, and media properties.
Security migration
The integration migrates its own resume store on first startup. Home Assistant recorder history from an older release is intentionally left untouched. If an old media identifier included a Jellyfin/Emby API key, bearer token, or signed stream credential:
- Rotate the affected upstream credential.
- Purge old recorder history for the RelayTV media-player entity if required by your security policy.
- Update the RelayTV server to the companion release that redacts private playback fields from public status, SSE, queue, and history responses.
The companion server update also adds POST /auth/check for non-mutating token
validation and cross-origin headers for Home Assistant thumbnail rendering.
Older unprotected RelayTV servers remain compatible, but the current server is
strongly recommended.
Upgrade
Install 0.4.0 through HACS, restart Home Assistant, and use Reconfigure on
the RelayTV integration entry if the server has RELAYTV_API_TOKEN enabled.
The HACS archive remains flat, with manifest.json directly at the archive
root as required for /config/custom_components/relaytv/ installation.