Repository navigation
Enforce admin-only characteristic access - #538
Merged
Merged
Conversation
Add the eight services and 27 characteristics of Apple's HomeKit Secure Video Open Source Compatibility Guide (Developer Preview 1.0) to the loader resources. Two of them, Contributing Sensors and Motion Enabled, also become optional characteristics of the Motion Sensor service. Timed write is advertised where the guide requires it. Writes to Motion Enabled and Streaming Enabled are marked admin only with an "AdminOnlyAccess": ["write"] catalog property. It is not part of the HAP representation and not enforced yet. Camera Recording Management keeps the characteristics classic recording relies on.
Third Party Camera Active is state the camera reports, so controllers read and subscribe to it but do not write it. Night Vision and Camera Operating Mode Indicator are written with timed writes. The Camera Global Operating Mode service of HKSV 17.99 uses all three. This matches the definitions in HAP-NodeJS.
The catalog can mark a characteristic with "AdminOnlyAccess" (Motion Enabled and Streaming Enabled list "write"), but nothing checked it. Pass the controller of the session from the HAP handler to the driver and refuse a write, or a read when the list contains "read", with -70401 unless the controller is a paired admin. A request without a known controller is refused too. This follows adminOnlyAccess in HAP-NodeJS. Characteristics without the property are not affected.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #538 +/- ##
==========================================
+ Coverage 91.71% 91.73% +0.01%
==========================================
Files 27 27
Lines 4335 4342 +7
Branches 553 554 +1
==========================================
+ Hits 3976 3983 +7
Misses 251 251
Partials 108 108
🚀 New features to boost your workflow:
|
# Conflicts: # pyhap/resources/characteristics.json
RaHehl
marked this pull request as ready for review
November 10, 2026 13:13
ikalchev#535 adds client_addr as the second argument of get_characteristics, so a positional client_uuid could end up as the address once both are in. Also note why privileges are checked before availability.
The catalog tests came with the old catalog commits and are not about admin-only access.
Owner
|
@RaHehl Can you resolve the merge conflicts here as well and in the other PRs? |
# Conflicts: # pyhap/accessory_driver.py # pyhap/hap_handler.py # tests/test_loader.py
Contributor
Author
|
@ikalchev done |
Owner
|
@RaHehl Conflicted again :/ |
# Conflicts: # pyhap/accessory_driver.py # pyhap/hap_handler.py
Also say in the catalog generator that the driver enforces admin-only writes.
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on the catalog from #539, which marks Motion Enabled and Streaming Enabled with
"AdminOnlyAccess": ["write"]. Nothing checked that property so far.This PR enforces
AdminOnlyAccessfor writes. The HAP handler now passes the controller of the session to the write path. A write that contains a value, also null, to a characteristic whoseAdminOnlyAccesscontains"write"is refused with -70401 unless the controller is a paired admin. A call without a known controller is refused as well. The check runs before the pw and tw checks from #535 and #536, so a controller without the privilege learns nothing else about the characteristic. Writes without a value, i.e. event subscriptions, stay allowed. Admin rights are checked per request, so a controller that is demoted or removed is refused on its next write.Reads, the accessory database and events are not restricted. No catalog characteristic restricts reads. Characteristics without the property behave as before, so existing accessories are not affected. The new
client_uuidargument ofset_characteristicsis optional and keyword-only, so it can't be mixed up withclient_addr.AI use: written with the help of an AI coding assistant (Opus 5.5). I reviewed and tested the changes myself (pytest, ruff, ty).