Repository navigation
Accept any HTTPS origin with optional port as public URL - #3
Merged
Merged
Conversation
public_base() was limited to *.ui.nabu.casa on port 443. Allow any DNS hostname with an optional port so the connector works behind a self-hosted HTTPS endpoint (e.g. https://example.org:8125). IP literals, userinfo, path, query and fragment are still rejected. Update error texts and tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
public_base()currently accepts onlyhttps://<name>.ui.nabu.casaon port 443. This PR lets the public URL be any HTTPS origin with a DNS hostname and an optional port, for examplehttps://ha.example.org:8125, so the connector also works with a self-hosted HTTPS endpoint.Changes
security.py:public_base()accepts a DNS hostname and an optional port. The port is kept in the returned origin, so the issuer, resource URL andOrigincheck stay consistent.:443is normalised away.localhost, userinfo, path, query, fragment and invalid ports.strings.jsonand all five translations (en, cs, de, pl, sk) no longer mention Nabu Casa only.tests/test_security.py: the Nabu-only test is replaced by one covering the new accept/reject cases.Testing
python -m unittest discover -s testspasses (77 tests) andpython tools/check_package.pypasses.Notes
I could not find a stated reason for the Nabu Casa restriction, so I treated it as a scope limit rather than a security requirement. If it was meant as a safeguard, I am happy to put this behind an option or adjust it. README and
docs/still describe Nabu Casa and are unchanged in this PR.