Overwork Services/Discovery (#725)

* Update homeassistant.py

* Update validate.py

* Update exceptions.py

* Update services.py

* Update discovery.py

* fix gitignore

* Fix handling for discovery

* use object in ref

* lock down discovery API

* fix api

* Design

* Fix API

* fix lint

* fix

* Fix security layer

* add provide layer

* fix access

* change rating

* fix rights

* Fix API error handling

* raise error

* fix rights

* api

* fix handling

* fix

* debug

* debug json

* Fix validator

* fix error

* new url

* fix schema

hassio/api/discovery.py

@@ -3,15 +3,18 @@ import voluptuous as vol
 
 from .utils import api_process, api_validate
 from ..const import (
-    ATTR_PROVIDER, ATTR_UUID, ATTR_COMPONENT, ATTR_PLATFORM, ATTR_CONFIG,
-    ATTR_DISCOVERY, REQUEST_FROM)
+    ATTR_ADDON, ATTR_UUID, ATTR_COMPONENT, ATTR_PLATFORM, ATTR_CONFIG,
+    ATTR_DISCOVERY, ATTR_SERVICE, REQUEST_FROM)
 from ..coresys import CoreSysAttributes
+from ..exceptions import APIError, APIForbidden
+from ..services.validate import SERVICE_ALL
 
 
 SCHEMA_DISCOVERY = vol.Schema({
+    vol.Required(ATTR_SERVICE): vol.In(SERVICE_ALL),
     vol.Required(ATTR_COMPONENT): vol.Coerce(str),
-    vol.Optional(ATTR_PLATFORM): vol.Any(None, vol.Coerce(str)),
-    vol.Optional(ATTR_CONFIG): vol.Any(None, dict),
+    vol.Optional(ATTR_PLATFORM): vol.Maybe(vol.Coerce(str)),
+    vol.Optional(ATTR_CONFIG): vol.Maybe(dict),
 })
 
 
@@ -22,16 +25,24 @@ class APIDiscovery(CoreSysAttributes):
         """Extract discovery message from URL."""
         message = self.sys_discovery.get(request.match_info.get('uuid'))
         if not message:
-            raise RuntimeError("Discovery message not found")
+            raise APIError("Discovery message not found")
         return message
 
+    def _check_permission_ha(self, request):
+        """Check permission for API call / Home Assistant."""
+        if request[REQUEST_FROM] != self.sys_homeassistant:
+            raise APIForbidden("Only HomeAssistant can use this API!")
+
     @api_process
     async def list(self, request):
         """Show register services."""
+        self._check_permission_ha(request)
+
         discovery = []
         for message in self.sys_discovery.list_messages:
             discovery.append({
-                ATTR_PROVIDER: message.provider,
+                ATTR_ADDON: message.addon,
+                ATTR_SERVICE: message.service,
                 ATTR_UUID: message.uuid,
                 ATTR_COMPONENT: message.component,
                 ATTR_PLATFORM: message.platform,
@@ -44,8 +55,14 @@ class APIDiscovery(CoreSysAttributes):
     async def set_discovery(self, request):
         """Write data into a discovery pipeline."""
         body = await api_validate(SCHEMA_DISCOVERY, request)
-        message = self.sys_discovery.send(
-            provider=request[REQUEST_FROM], **body)
+        addon = request[REQUEST_FROM]
+
+        # Access?
+        if body[ATTR_SERVICE] not in addon.discovery:
+            raise APIForbidden(f"Can't use discovery!")
+
+        # Process discovery message
+        message = self.sys_discovery.send(addon, **body)
 
         return {ATTR_UUID: message.uuid}
 
@@ -54,8 +71,12 @@ class APIDiscovery(CoreSysAttributes):
         """Read data into a discovery message."""
         message = self._extract_message(request)
 
+        # HomeAssistant?
+        self._check_permission_ha(request)
+
         return {
-            ATTR_PROVIDER: message.provider,
+            ATTR_ADDON: message.addon,
+            ATTR_SERVICE: message.service,
             ATTR_UUID: message.uuid,
             ATTR_COMPONENT: message.component,
             ATTR_PLATFORM: message.platform,
@@ -66,6 +87,11 @@ class APIDiscovery(CoreSysAttributes):
     async def del_discovery(self, request):
         """Delete data into a discovery message."""
         message = self._extract_message(request)
+        addon = request[REQUEST_FROM]
+
+        # Permission
+        if message.addon != addon.slug:
+            raise APIForbidden(f"Can't remove discovery message")
 
         self.sys_discovery.remove(message)
         return True