markandClaude Fable 5
f2bf565623
* docs: add Home Assistant 0.4.0 hardening roadmap * fix: protect media credentials and resume state * feat: authenticate RelayTV API operations * fix: make targeting and media state reliable * test: add Home Assistant integration CI * fix: validate API credentials during setup * release: prepare HACS 0.4.0 * fix: align pytest dependency pin * fix: close URL sanitizer gaps and correct player state reporting Sync the sensitive-query-key list with the RelayTV server (adds auth, exp, jwt, X-Emby-Token, X-Jellyfin-Token), filter query credentials from relative URLs instead of returning them verbatim, and preserve brackets around IPv6 literal hosts. Also report volume on RelayTV's 0-100 scale unconditionally (a raw 1 is 1%, not full volume) and give the coordinator its own position_updated_at stamp — the base DataUpdateCoordinator has no last_update_success_time, so media_position_updated_at silently fell back to now() on every read and the seek bar never extrapolated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
48 lines
2.2 KiB
Markdown
48 lines
2.2 KiB
Markdown
# RelayTV HA 0.4.0
|
|
|
|
This release hardens the Home Assistant integration for credential safety,
|
|
authenticated RelayTV servers, and dependable multi-server control. It
|
|
requires Home Assistant 2026.7 or newer.
|
|
|
|
## Highlights
|
|
|
|
- Playback URLs are sanitized before being exposed as media-player state or
|
|
used as persisted resume keys.
|
|
- Legacy resume data is migrated automatically, deduplicated, and capped at
|
|
500 entries.
|
|
- Optional `RELAYTV_API_TOKEN` bearer authentication can be configured with a
|
|
masked field and recovered through Home Assistant reauthentication.
|
|
- RelayTV API failures now surface as real Home Assistant action errors.
|
|
- Explicit service targets can no longer fall back to another TV.
|
|
- Sidebar target selection survives multi-entry startup ordering.
|
|
- The media player adds native mute, correct zero-valued position/duration,
|
|
and a stable Home Assistant device with a configuration link.
|
|
- Automated coverage now includes configuration flows, setup authentication,
|
|
URL/storage migration, targeting, panel persistence, API failures,
|
|
coordinator deduplication, and media properties.
|
|
|
|
## Security migration
|
|
|
|
The integration migrates its own resume store on first startup. Home Assistant
|
|
recorder history from an older release is intentionally left untouched. If an
|
|
old media identifier included a Jellyfin/Emby API key, bearer token, or signed
|
|
stream credential:
|
|
|
|
1. Rotate the affected upstream credential.
|
|
2. Purge old recorder history for the RelayTV media-player entity if required
|
|
by your security policy.
|
|
3. Update the RelayTV server to the companion release that redacts private
|
|
playback fields from public status, SSE, queue, and history responses.
|
|
|
|
The companion server update also adds `POST /auth/check` for non-mutating token
|
|
validation and cross-origin headers for Home Assistant thumbnail rendering.
|
|
Older unprotected RelayTV servers remain compatible, but the current server is
|
|
strongly recommended.
|
|
|
|
## Upgrade
|
|
|
|
Install 0.4.0 through HACS, restart Home Assistant, and use **Reconfigure** on
|
|
the RelayTV integration entry if the server has `RELAYTV_API_TOKEN` enabled.
|
|
The HACS archive remains flat, with `manifest.json` directly at the archive
|
|
root as required for `/config/custom_components/relaytv/` installation.
|