{{ t('settings.portal.trust_owner_mapping') }}
diff --git a/templates/pro/pages/smarthome.njk b/templates/pro/pages/smarthome.njk
index 31358655..7dc10070 100644
--- a/templates/pro/pages/smarthome.njk
+++ b/templates/pro/pages/smarthome.njk
@@ -20,6 +20,25 @@
{% include theme + "/partials/modals/smarthome-connect.njk" %}
+
+
+
+
{{ t('smarthome.owners.title') }}
+
+
+
+
+
+
{% endblock %}
{% block scripts %}
diff --git a/tests/portal_settings.test.js b/tests/portal_settings.test.js
index 6f2bc99f..68013f0f 100644
--- a/tests/portal_settings.test.js
+++ b/tests/portal_settings.test.js
@@ -22,7 +22,7 @@ after(teardown);
test('defaults: enabled, all widgets on', () => {
const c = portalCfg();
assert.equal(c.enabled, true);
- assert.deepEqual(c.widgets, { device: true, traffic: true, services: true, pihole: true, midea: true });
+ assert.deepEqual(c.widgets, { device: true, traffic: true, services: true, pihole: true, midea: true, smarthome: true });
});
test('a disabled widget is reflected', () => {
diff --git a/tests/smarthome_owners.test.js b/tests/smarthome_owners.test.js
new file mode 100644
index 00000000..9a4037ce
--- /dev/null
+++ b/tests/smarthome_owners.test.js
@@ -0,0 +1,73 @@
+// tests/smarthome_owners.test.js
+'use strict';
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const nodeCrypto = require('node:crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || nodeCrypto.randomBytes(32).toString('hex');
+const { setup, teardown } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
+
+let dev, owners;
+beforeEach(async () => {
+ await setup();
+ dev = require('../src/services/smarthome/smarthomeDevices');
+ owners = require('../src/services/smarthome/smarthomeOwners');
+});
+afterEach(async () => { await teardown(); });
+
+function mkUser(name) {
+ return Number(getDb().prepare("INSERT INTO users (username, password_hash, role) VALUES (?, 'x', 'user')").run(name).lastInsertRowid);
+}
+
+test('setOwners validates user existence, replaces set, ownersOf reflects it', () => {
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '1', deconz_type: 'lights', kind: 'light', name: 'L', capabilities: {} });
+ const u1 = mkUser('a'); const u2 = mkUser('b');
+ owners.setOwners(rid, [u1, u2]);
+ assert.deepEqual(owners.ownersOf(rid).map((o) => o.username).sort(), ['a', 'b']);
+ owners.setOwners(rid, [u1]); // replace
+ assert.deepEqual(owners.ownersOf(rid).map((o) => o.username), ['a']);
+ assert.throws(() => owners.setOwners(rid, [99999]), (e) => e.code === 'SMARTHOME_OWNER_UNKNOWN_USER');
+});
+
+test('setOwners works for plug kind (assignable)', () => {
+ const gw = dev.createGateway({ name: 'GWp', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '3', deconz_type: 'lights', kind: 'plug', name: 'Plug', capabilities: {} });
+ const u = mkUser('p');
+ owners.setOwners(rid, [u]);
+ assert.deepEqual(owners.ownersOf(rid).map((o) => o.username), ['p']);
+});
+
+test('setOwners refuses non-assignable kinds and missing resource', () => {
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ const sid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '2', deconz_type: 'sensors', kind: 'sensor', name: 'S', capabilities: {} });
+ assert.throws(() => owners.setOwners(sid, []), (e) => e.code === 'SMARTHOME_NOT_ASSIGNABLE');
+ assert.throws(() => owners.setOwners(99999, []), (e) => e.code === 'SMARTHOME_RESOURCE_NOT_FOUND');
+});
+
+test('resourcesOwnedBy includes scenes of owned groups; isOwner is direct-only', () => {
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ const grp = dev.upsertResource({ gateway_id: gw.id, deconz_id: '5', deconz_type: 'groups', kind: 'group', name: 'G', capabilities: {} });
+ const scn = dev.upsertResource({ gateway_id: gw.id, deconz_id: '5/1', deconz_type: 'scenes', kind: 'scene', name: 'G · S', capabilities: {} });
+ const u = mkUser('u');
+ owners.setOwners(grp, [u]);
+ const owned = owners.resourcesOwnedBy(u);
+ assert.ok(owned.includes(grp));
+ assert.ok(owned.includes(scn)); // inherited
+ assert.equal(owners.isOwner(scn, u), false); // no own record
+ assert.equal(owners.canAccess(scn, u), true); // inherited access
+ assert.deepEqual(owners.inheritedOwnersOf(dev.getResource(scn)).map((o) => o.username), ['u']);
+ assert.equal(owners.isOwner(grp, u), true);
+});
+
+test('removeAllForUser and removeAllForResource clear rows', () => {
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '1', deconz_type: 'lights', kind: 'light', name: 'L', capabilities: {} });
+ const u = mkUser('u');
+ owners.setOwners(rid, [u]);
+ owners.removeAllForUser(u);
+ assert.equal(owners.ownersOf(rid).length, 0);
+ owners.setOwners(rid, [u]);
+ owners.removeAllForResource(rid);
+ assert.equal(owners.ownersOf(rid).length, 0);
+});
diff --git a/tests/smarthome_owners_api.test.js b/tests/smarthome_owners_api.test.js
new file mode 100644
index 00000000..3afc3414
--- /dev/null
+++ b/tests/smarthome_owners_api.test.js
@@ -0,0 +1,42 @@
+'use strict';
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const nodeCrypto = require('node:crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || nodeCrypto.randomBytes(32).toString('hex');
+const { setup, teardown } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
+
+let app, agent, csrfToken;
+before(async () => {
+ ({ app, agent, csrfToken } = await setup());
+ require('../src/services/license')._overrideForTest({ smarthome: true });
+});
+after(async () => { await teardown(); });
+
+test('GET /resources includes owners array', async () => {
+ const dev = require('../src/services/smarthome/smarthomeDevices');
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ dev.upsertResource({ gateway_id: gw.id, deconz_id: '1', deconz_type: 'lights', kind: 'light', name: 'L', capabilities: {} });
+ const res = await agent.get('/api/v1/smarthome/resources').expect(200);
+ assert.ok(Array.isArray(res.body.resources));
+ assert.ok(Array.isArray(res.body.resources[0].owners));
+});
+
+test('PUT /resources/:id/owners sets owners; unknown user → 400; non-assignable → 400', async () => {
+ const dev = require('../src/services/smarthome/smarthomeDevices');
+ const gw = dev.createGateway({ name: 'GW2', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '9', deconz_type: 'lights', kind: 'light', name: 'L9', capabilities: {} });
+ const sid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '8', deconz_type: 'sensors', kind: 'sensor', name: 'S8', capabilities: {} });
+ const uid = Number(getDb().prepare("INSERT INTO users (username, password_hash, role) VALUES ('owner1', 'x', 'user')").run().lastInsertRowid);
+ const ok = await agent.put(`/api/v1/smarthome/resources/${rid}/owners`).set('x-csrf-token', csrfToken).send({ userIds: [uid] }).expect(200);
+ assert.deepEqual(ok.body.owners.map((o) => o.username), ['owner1']);
+ await agent.put(`/api/v1/smarthome/resources/${rid}/owners`).set('x-csrf-token', csrfToken).send({ userIds: [99999] }).expect(400);
+ await agent.put(`/api/v1/smarthome/resources/${sid}/owners`).set('x-csrf-token', csrfToken).send({ userIds: [uid] }).expect(400);
+});
+
+test('PUT /resources/:id/owners with non-array userIds → 400', async () => {
+ const dev = require('../src/services/smarthome/smarthomeDevices');
+ const gw = dev.createGateway({ name: 'GW3', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '4', deconz_type: 'lights', kind: 'light', name: 'L4', capabilities: {} });
+ await agent.put(`/api/v1/smarthome/resources/${rid}/owners`).set('x-csrf-token', csrfToken).send({ userIds: 'nope' }).expect(400);
+});
diff --git a/tests/smarthome_owners_cleanup.test.js b/tests/smarthome_owners_cleanup.test.js
new file mode 100644
index 00000000..f4723234
--- /dev/null
+++ b/tests/smarthome_owners_cleanup.test.js
@@ -0,0 +1,25 @@
+'use strict';
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const nodeCrypto = require('node:crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || nodeCrypto.randomBytes(32).toString('hex');
+const { setup, teardown } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
+
+let dev, owners, users;
+beforeEach(async () => {
+ await setup();
+ dev = require('../src/services/smarthome/smarthomeDevices');
+ owners = require('../src/services/smarthome/smarthomeOwners');
+ users = require('../src/services/users');
+});
+afterEach(async () => { await teardown(); });
+
+test('removing a user clears their smarthome ownership rows', () => {
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '1', deconz_type: 'lights', kind: 'light', name: 'L', capabilities: {} });
+ const uid = Number(getDb().prepare("INSERT INTO users (username, password_hash, role) VALUES ('victim', 'x', 'user')").run().lastInsertRowid);
+ owners.setOwners(rid, [uid]);
+ users.remove(uid);
+ assert.equal(getDb().prepare('SELECT COUNT(*) c FROM smarthome_resource_owners WHERE user_id = ?').get(uid).c, 0);
+});
diff --git a/tests/smarthome_portal_api.test.js b/tests/smarthome_portal_api.test.js
new file mode 100644
index 00000000..04eaf1fa
--- /dev/null
+++ b/tests/smarthome_portal_api.test.js
@@ -0,0 +1,53 @@
+// tests/smarthome_portal_api.test.js
+'use strict';
+const { test, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const nodeCrypto = require('node:crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || nodeCrypto.randomBytes(32).toString('hex');
+const { setup, teardown } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
+
+let app, agent, csrfToken;
+before(async () => {
+ ({ app, agent, csrfToken } = await setup());
+ require('../src/services/license')._overrideForTest({ smarthome: true });
+});
+after(async () => { await teardown(); });
+
+// NOTE: the default test agent is an authenticated admin session → portalLoggedIn true,
+// portalOwnerId = admin user id. Assign ownership to that same admin id.
+test('GET /portal/smarthome returns only owned controllable resources (redacted)', async () => {
+ const dev = require('../src/services/smarthome/smarthomeDevices');
+ const owners = require('../src/services/smarthome/smarthomeOwners');
+ const adminId = getDb().prepare("SELECT id FROM users WHERE role='admin' ORDER BY id LIMIT 1").get().id;
+ const gw = dev.createGateway({ name: 'GW', route_id: null, apiKey: 'K', enabled: true });
+ const owned = dev.upsertResource({ gateway_id: gw.id, deconz_id: '1', deconz_type: 'lights', kind: 'light', name: 'Mine', capabilities: { on: true }, state: { on: false } });
+ dev.upsertResource({ gateway_id: gw.id, deconz_id: '2', deconz_type: 'lights', kind: 'light', name: 'NotMine', capabilities: { on: true } });
+ owners.setOwners(owned, [adminId]);
+ const res = await agent.get('/api/v1/portal/smarthome').expect(200);
+ assert.ok(res.body.data && Array.isArray(res.body.data.devices));
+ const names = res.body.data.devices.map((d) => d.name);
+ assert.ok(names.includes('Mine'));
+ assert.ok(!names.includes('NotMine'));
+ const d = res.body.data.devices.find((x) => x.name === 'Mine');
+ assert.equal(d.gateway_id, undefined); // redacted
+ assert.equal(d.deconz_id, undefined); // redacted
+ assert.ok('state' in d);
+});
+
+test('POST /portal/smarthome/:id/state on a non-owned resource → 403', async () => {
+ const dev = require('../src/services/smarthome/smarthomeDevices');
+ const gw = dev.createGateway({ name: 'GW2', route_id: null, apiKey: 'K', enabled: true });
+ const other = dev.upsertResource({ gateway_id: gw.id, deconz_id: '7', deconz_type: 'lights', kind: 'light', name: 'Other', capabilities: { on: true } });
+ await agent.post(`/api/v1/portal/smarthome/${other}/state`).set('x-csrf-token', csrfToken).send({ patch: { on: true } }).expect(403);
+});
+
+test('POST /portal/smarthome/:id/state without login → login_required', async () => {
+ const supertest = require('supertest');
+ const anon = supertest(app);
+ const dev = require('../src/services/smarthome/smarthomeDevices');
+ const gw = dev.createGateway({ name: 'GWA', route_id: null, apiKey: 'K', enabled: true });
+ const rid = dev.upsertResource({ gateway_id: gw.id, deconz_id: '3', deconz_type: 'lights', kind: 'light', name: 'L', capabilities: {} });
+ const r = await anon.post(`/api/v1/portal/smarthome/${rid}/state`).send({ patch: { on: true } }).expect(200);
+ assert.equal(r.body.reason, 'login_required');
+});
diff --git a/tests/smarthome_portal_widget_flag.test.js b/tests/smarthome_portal_widget_flag.test.js
new file mode 100644
index 00000000..a6e2a8de
--- /dev/null
+++ b/tests/smarthome_portal_widget_flag.test.js
@@ -0,0 +1,15 @@
+'use strict';
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const nodeCrypto = require('node:crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || nodeCrypto.randomBytes(32).toString('hex');
+const { setup, teardown } = require('./helpers/setup');
+
+beforeEach(async () => { await setup(); });
+afterEach(async () => { await teardown(); });
+
+test('portalConfig exposes widgets.smarthome (default true)', () => {
+ const portalConfig = require('../src/services/portalConfig');
+ assert.equal(typeof portalConfig().widgets.smarthome, 'boolean');
+ assert.equal(portalConfig().widgets.smarthome, true);
+});