diff --git a/homeassistant/components/auth/indieauth.py b/homeassistant/components/auth/indieauth.py index c845f230bf3b56714feba2f8da57cdacd01b9007..5915a4ec3013d2bad8daa7e0727c3dd9ebc95c5a 100644 --- a/homeassistant/components/auth/indieauth.py +++ b/homeassistant/components/auth/indieauth.py @@ -30,6 +30,14 @@ async def verify_redirect_uri(hass, client_id, redirect_uri): if is_valid: return True + # Whitelist the iOS and Android callbacks so that people can link apps + # without being connected to the internet. + if redirect_uri == "homeassistant://auth-callback" and client_id in ( + "https://home-assistant.io/android", + "https://home-assistant.io/iOS", + ): + return True + # IndieAuth 4.2.2 allows for redirect_uri to be on different domain # but needs to be specified in link tag when fetching `client_id`. redirect_uris = await fetch_redirect_uris(hass, client_id) diff --git a/tests/components/auth/test_indieauth.py b/tests/components/auth/test_indieauth.py index 8cfb573939ebc0e970c30daacb48aeb1b5e03931..ce8edae1466517c27ba9e4d63c383ebf551943dd 100644 --- a/tests/components/auth/test_indieauth.py +++ b/tests/components/auth/test_indieauth.py @@ -166,3 +166,24 @@ async def test_find_link_tag_max_size(hass, mock_session): redirect_uris = await indieauth.fetch_redirect_uris(hass, "http://127.0.0.1:8000") assert redirect_uris == ["http://127.0.0.1:8000/wine"] + + +@pytest.mark.parametrize( + "client_id", ["https://home-assistant.io/android", "https://home-assistant.io/iOS"] +) +async def test_verify_redirect_uri_android_ios(client_id): + """Test that we verify redirect uri correctly for Android/iOS.""" + with patch.object( + indieauth, "fetch_redirect_uris", side_effect=lambda *_: mock_coro([]) + ): + assert await indieauth.verify_redirect_uri( + None, client_id, "homeassistant://auth-callback" + ) + + assert not await indieauth.verify_redirect_uri( + None, client_id, "homeassistant://something-else" + ) + + assert not await indieauth.verify_redirect_uri( + None, "https://incorrect.com", "homeassistant://auth-callback" + )