Skoda backlog: render image host + portal widget admin toggle - #225
Merged
Conversation
…mage fetch The real Skoda render CDN is iprenders.blob.core.windows.net (Azure blob), which the SSRF allowlist correctly rejected — so vehicle images never stored. Pin the exact host and fetch without the Authorization header (live-confirmed 200 without it; sending the Skoda token to a third-party CDN would leak it).
Mirrors the midea/smarthome portal-widget toggle: PUT branch, toggle in all three settings themes, settings.js wiring, i18n label. Flag still defaults on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Zwei kleine Backlog-Punkte aus der Skoda-Initiative:
1. Renderbild wird jetzt gespeichert (Bugfix)
Der echte Skoda-Render-CDN ist
iprenders.blob.core.windows.net(Azure Blob) — die SSRF-Allowlist (aus der Fixture geraten: azureedge/skoda-auto) hat ihn korrekt abgelehnt, weshalb nie ein Fahrzeugbild gespeichert wurde. Fix: den exakten Host pinnen (nicht ganz*.blob.core.windows.net) und denAuthorization-Header beim Bildabruf weglassen — live bestätigt:200 image/pngohne Token; den Skoda-Token an einen Fremd-CDN zu senden wäre ein Token-Leak. Test deckt beides ab (allowlist + kein Auth-Header).2. Admin-Toggle fürs Portal-Widget (Feature)
Das Flag
widgets.skodawar nur lesbar (kein Schreibpfad) → Widget nicht per UI abschaltbar. Jetzt Toggle „Fahrzeuge" in allen 3 Settings-Themes, gespiegelt am Midea/Smart-Home-Schalter (PUT-Zweig, settings.js-Wiring, i18n de/en). Default bleibt AN.Beide live gegen die echten Fahrzeuge verifiziert (Renderbild: Abruf ohne Auth → 200/1 MB PNG).
🤖 Generated with Claude Code
https://claude.ai/code/session_01NACNfM9Uv6hwZwzXpEkHXQ