zwave-js / zwave-js-ui / 29565083724

push

github

feat: support trusted API on separate network/IP/port (#4717)

This PR adds support for two environment variables that let a host
application like Home Assistant establish a secure channel to Z-Wave JS
UI's API, without interfering with the user's auth configuration.

This is done by specifying a network/IP/port on which a second API
server is started, and an IP allowlist (which IPs may use this). The
configuration works entirely through environment variables:
- `TRUSTED_API_LISTEN`: Enables the trusted listener. Three forms are
accepted:
- An absolute path starting with `/`: bind a unix socket at that path.
Access control is left to filesystem permissions. A stale socket file
from an unclean shutdown is removed automatically on startup.
- `host:port` with a literal IP (IPv6 in brackets, e.g.
`[fd00::1]:8092`): bind exactly that address.
- `cidr:port` (e.g. `172.30.32.0/23:8092`): resolve the local interface
address inside that network at startup and bind to it. This lets the
host name a (docker) network without either side knowing the container's
dynamic IP. Startup fails if no (or more than one) local address
matches.
- `TRUSTED_API_ALLOWED_IPS`: Comma-separated list of IPs/CIDRs (e.g.
`172.30.32.2,127.0.0.1`) allowed to connect to a TCP binding. **Required
for TCP bindings** — startup fails without it. Ignored for unix sockets.

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

479 of 4395 branches covered (10.9%)

Branch coverage included in aggregate %.

172 of 207 new or added lines in 4 files covered. (83.09%)

901 of 6763 relevant lines covered (13.32%)

2.15 hits per line