v0.14.15

src/api/system.rs

@@ -107,15 +107,32 @@ struct BootstrapResponse {
     system: SystemInfoResponse,
 }
 
-async fn health(State(state): State<AppState>) -> Json<Value> {
-    Json(json!({
+async fn health(
+    State(state): State<AppState>,
+    request: Request,
+) -> Result<Json<Value>, AppError> {
+    if home_assistant::supervisor_token_detected() {
+        let trusted_supervisor = request
+            .extensions()
+            .get::<ConnectInfo<SocketAddr>>()
+            .map(|info| home_assistant::is_supervisor_ingress_peer(info.0.ip()))
+            .unwrap_or(false);
+        if !trusted_supervisor {
+            let expected = state.config.app_token.trim();
+            if expected.is_empty() || request_token(&request).as_deref() != Some(expected) {
+                return Err(AppError::Unauthorized);
+            }
+        }
+    }
+
+    Ok(Json(json!({
         "status": "ok",
         "name": "gree-controller",
         "version": env!("CARGO_PKG_VERSION"),
         "uptime_seconds": state.started.elapsed().as_secs(),
         "control_ready": state.initial_device_sync_complete.load(Ordering::Acquire),
         "time": Utc::now(),
-    }))
+    })))
 }
 
 async fn bootstrap(State(state): State<AppState>) -> Result<Json<BootstrapResponse>, AppError> {
@@ -162,7 +179,7 @@ fn build_system_info(state: &AppState, devices: &[Device]) -> SystemInfoResponse
     SystemInfoResponse {
         version: env!("CARGO_PKG_VERSION"),
         uptime_seconds: state.started.elapsed().as_secs(),
-        auth_required: !state.config.app_token.trim().is_empty(),
+        auth_required: !state.config.app_token.trim().is_empty() || home_assistant::supervisor_token_detected(),
         control_ready: state.initial_device_sync_complete.load(Ordering::Acquire),
         database: state.config.database.display().to_string(),
         device_count: devices.len(),