diff --git a/custom_components/bahmcloud_store/views.py b/custom_components/bahmcloud_store/views.py index 2cd498e..b5e974f 100644 --- a/custom_components/bahmcloud_store/views.py +++ b/custom_components/bahmcloud_store/views.py @@ -11,10 +11,6 @@ if TYPE_CHECKING: class StaticAssetsView(HomeAssistantView): - """ - Static panel assets MUST be public (no auth), because Home Assistant loads - custom panel JS modules without auth headers. - """ requires_auth = False name = "bahmcloud_store_static" url = "/api/bahmcloud_store_static/{path:.*}" @@ -26,7 +22,6 @@ class StaticAssetsView(HomeAssistantView): f = (base / path).resolve() - # Prevent path traversal if not str(f).startswith(str(base)) or not f.exists() or not f.is_file(): return web.Response(status=404, text="Not found") @@ -42,11 +37,6 @@ class StaticAssetsView(HomeAssistantView): class BCSApiView(HomeAssistantView): - """ - BCS API (auth required) - - GET /api/bcs - - POST /api/bcs (op=add_custom_repo) - """ requires_auth = True name = "bcs_api" url = "/api/bcs" @@ -55,9 +45,7 @@ class BCSApiView(HomeAssistantView): self.core = core async def get(self, request): - # Refresh on-demand so the UI "Refresh" button updates immediately. await self.core.refresh() - return self.json( { "repos": self.core.list_repos_public(),