From 3875d29d16838cf1f9e7f0bcb97407e074cdf3b7 Mon Sep 17 00:00:00 2001
From: bahmcloud <r.bachmann@bahmcloud.de>
Date: Wed, 14 Jan 2026 18:39:52 +0000
Subject: [PATCH] custom_components/bahmcloud_store/store.py aktualisiert

---
 custom_components/bahmcloud_store/store.py | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/custom_components/bahmcloud_store/store.py b/custom_components/bahmcloud_store/store.py
index 7be0ead..b7d9e92 100644
--- a/custom_components/bahmcloud_store/store.py
+++ b/custom_components/bahmcloud_store/store.py
@@ -233,15 +233,17 @@ class BahmcloudStore:
 
 class _StaticView(HomeAssistantView):
     """
-    Serves panel assets from: custom_components/bahmcloud_store/panel/
+    IMPORTANT:
+    Custom Panel JS modules are loaded WITHOUT Authorization headers.
+    Therefore static panel assets must be publicly accessible (no auth).
 
-    URLs:
+    Serves:
       /api/bahmcloud_store_static/index.html
       /api/bahmcloud_store_static/panel.js
       /api/bahmcloud_store_static/app.js
       /api/bahmcloud_store_static/styles.css
     """
-    requires_auth = True
+    requires_auth = False
     name = "bahmcloud_store_static"
     url = "/api/bahmcloud_store_static/{path:.*}"
 
@@ -268,6 +270,10 @@ class _StaticView(HomeAssistantView):
 
 
 class _APIListView(HomeAssistantView):
+    """
+    Store API MUST stay protected.
+    UI loads data via fetch() with HA auth handled by frontend.
+    """
     requires_auth = True
     name = "bahmcloud_store_api"
     url = "/api/bahmcloud_store"