feat(smarthome): Sensoren read-only im Portal - #212
Merged
Conversation
sensor became assignable in this branch, so the admin owners-API test's 'non-assignable → 400' case must use switch (still non-assignable) to keep its intent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ziel
Sensoren read-only im Portal — Folge-Teilprojekt nach TP1/TP2/TP3. Ein Admin weist Sensoren einzelnen Nutzern zu (wie Geräte); eingeloggte und Trust-Nutzer sehen im Portal-Widget
c-smarthomeihre zugewiesenen Sensoren als read-only Karten mit formatiertem Messwert. Keine Steuerung. Hinter Pro-Keysmarthome.Spec:
docs/superpowers/specs/2026-07-01-smarthome-portal-sensors-design.md(§1–§9)Änderungen
smarthomeOwners.js):ASSIGNABLE+=sensor.switchbleibt nicht-zuweisbar.resourcesOwnedByunverändert.routes/api/portal.js):GET /smarthomeliefert redigiertessensors[]nebendevices;SH_STATE_KEYS+=type,value;no_datanur noch wenndevicesundsensorsleer (frühes Return entfernt → Sensor-only-Owner korrekt);POST /smarthome/:id/statelehntsensor/switchhart mit400 SMARTHOME_NOT_CONTROLLABLEab (vor jeder Mutation).portal.njk,portal.js,portal.css,en/de.json): read-only Sensoren-Sektion +formatSensor(Unknown-Type → „—"); portal-i18n-Keys en+de.smarthome.js): Owner-Picker (Chips + „verwalten") auf Sensorkarten; Schalter bleiben außen vor.Sicherheit
{id,kind,name,capabilities,state}, state-Allowlist{on,bri,reachable,type,value}— keine Gateway-/deCONZ-/Route-Internas.setResourceState).req.portalOwnerId(Middleware) — kein IDOR.Tests
tests/smarthome_owners.test.js:setOwnersakzeptiertsensor;switchwirft weiterhin.tests/smarthome_portal_api.test.js: Sensor imsensors[](redigiert), nicht-besessener Sensor ausgeschlossen, Sensor-only-Owner ≠no_data,POSTauf Sensor → 400. Bestands-devices-Assertions ungebrochen.Nicht enthalten (bewusst)
Schalter im Portal (TP3-Thema), WebSocket-Live-Push, Sensor-Steuerung/Schwellen-Alarme (YAGNI).
Hinweis
Portal-Routen ohne CSRF ist bekannt/bewusst (CodeQL Alert #6, non-blocking — Widget sendet keinen Token, wie TP2/midea).