{{ t('settings.portal.trust_owner_mapping') }}
diff --git a/templates/default/pages/settings.njk b/templates/default/pages/settings.njk
index 15cce550..d9ef4b4a 100644
--- a/templates/default/pages/settings.njk
+++ b/templates/default/pages/settings.njk
@@ -1157,6 +1157,10 @@
{{ t('settings.portal.widget_smarthome') }}
+
{{ t('settings.portal.trust_owner_mapping') }}
diff --git a/templates/pro/pages/settings.njk b/templates/pro/pages/settings.njk
index 3afc00e2..643c7c95 100644
--- a/templates/pro/pages/settings.njk
+++ b/templates/pro/pages/settings.njk
@@ -1044,6 +1044,10 @@
{{ t('settings.portal.widget_smarthome') }}
+
{{ t('settings.portal.trust_owner_mapping') }}
diff --git a/tests/skoda_client.test.js b/tests/skoda_client.test.js
index c0b1e8e5..61ce6c28 100644
--- a/tests/skoda_client.test.js
+++ b/tests/skoda_client.test.js
@@ -94,9 +94,21 @@ test('renderImage rejects non-allowlisted or non-https hosts', async () => {
const { client } = makeClient([]);
await assert.rejects(client.renderImage('https://evil.example/x.png'), (e) => e.code === 'SKODA_API_ERROR');
await assert.rejects(client.renderImage('http://ip-modcwp.azureedge.net/x.png'), (e) => e.code === 'SKODA_API_ERROR');
+ await assert.rejects(client.renderImage('https://evil.blob.core.windows.net/x.png'), (e) => e.code === 'SKODA_API_ERROR');
await assert.rejects(client.renderImage('nicht-mal-eine-url'), (e) => e.code === 'SKODA_API_ERROR');
});
+test('renderImage fetches the real Skoda blob host WITHOUT sending the auth token', async () => {
+ const png = new TextEncoder().encode('PNG').buffer;
+ const { client, calls } = makeClient([
+ ['iprenders.blob.core.windows.net', { status: 200, ok: true, headers: new Headers(), arrayBuffer: async () => png }],
+ ]);
+ const buf = await client.renderImage('https://iprenders.blob.core.windows.net/renders/car.png');
+ assert.ok(Buffer.isBuffer(buf));
+ // the Skoda access token must never be sent to the third-party CDN
+ assert.equal(calls[calls.length - 1].auth, undefined);
+});
+
test('normalizeVehicleState tolerates missing parts with nulls', () => {
const state = normalizeVehicleState({ status: null, drivingRange: null, charging: null, airConditioning: null, position: null, health: null, maintenance: null });
assert.equal(state.locked, null);
diff --git a/tests/skoda_portal_setting.test.js b/tests/skoda_portal_setting.test.js
new file mode 100644
index 00000000..113aab85
--- /dev/null
+++ b/tests/skoda_portal_setting.test.js
@@ -0,0 +1,27 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+
+let portalConfig, settings;
+beforeEach(async () => {
+ await setup();
+ portalConfig = require('../src/services/portalConfig');
+ settings = require('../src/services/settings');
+});
+afterEach(() => teardown());
+
+test('widgets.skoda defaults to true', () => {
+ assert.equal(portalConfig().widgets.skoda, true);
+});
+test('widgets.skoda reflects the setting', () => {
+ settings.set('portal.widget.skoda', '0');
+ assert.equal(portalConfig().widgets.skoda, false);
+});
+test('settings API persists widgets.skoda', async () => {
+ const agent = getAgent(); const csrf = getCsrf();
+ await agent.put('/api/v1/settings/portal').set('X-CSRF-Token', csrf).send({ widgets: { skoda: false } }).expect(200);
+ assert.equal(settings.get('portal.widget.skoda', '1'), '0');
+});