From fb748e78e8784fc3f4e916bd88046c8558f9a7fd Mon Sep 17 00:00:00 2001
From: legop3 <minecratfd8@gmail.com>
Date: Fri, 21 Nov 2025 03:14:25 -0500
Subject: [PATCH] try to block admins from home assistant

---
 plans/nicknames_and_chat_outline.md         |  3 +++
 server/src/services/homeAssistantService.js | 10 ++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 plans/nicknames_and_chat_outline.md

diff --git a/plans/nicknames_and_chat_outline.md b/plans/nicknames_and_chat_outline.md
new file mode 100644
index 00000000..af48a5a1
--- /dev/null
+++ b/plans/nicknames_and_chat_outline.md
@@ -0,0 +1,3 @@
+# general idea:
+- users will be able to have and set nicknames
+- a user's nickname will store in the browser cookie system
\ No newline at end of file
diff --git a/server/src/services/homeAssistantService.js b/server/src/services/homeAssistantService.js
index 4cbb76e7..b57c4a33 100644
--- a/server/src/services/homeAssistantService.js
+++ b/server/src/services/homeAssistantService.js
@@ -4,6 +4,8 @@ const { createConnection, subscribeEntities, callService, Auth } = require('home
 const io = require('../globals/io');
 const logger = require('../globals/logger').child('homeAssistantService');
 const { loadConfig } = require('../helpers/configLoader');
+const { getMode } = require('./modeManager');
+const { isAdmin } = require('./roleService');
 
 // home-assistant-js-websocket expects a global WebSocket in Node.
 if (!global.WebSocket) {
@@ -229,6 +231,10 @@ connect();
 
 io.on('connection', (socket) => {
   socket.on('homeAssistant:toggle', async ({ entityId } = {}, cb = () => {}) => {
+    if ((getMode() === 'admin' || getMode() === 'lockdown') && isAdmin(socket) !== true) {
+      return cb({ error: 'Insufficient permissions to control Home Assistant' });
+    }
+    
     try {
       if (!entityId) throw new Error('entityId required');
       await toggleEntity(entityId);
@@ -239,6 +245,10 @@ io.on('connection', (socket) => {
   });
 
   socket.on('homeAssistant:setState', async ({ entityId, state } = {}, cb = () => {}) => {
+    if ((getMode() === 'admin' || getMode() === 'lockdown') && isAdmin(socket) !== true) {
+      return cb({ error: 'Insufficient permissions to control Home Assistant' });
+    }
+
     try {
       if (!entityId) throw new Error('entityId required');
       await setEntityState(entityId, state);