Admin only access for Logbook and History menus

+1 for me as well! There’s no reason for every user to see all the data all the time. I agree it’s not explicitly a security issue but still seems like an oversight at this point to not offer the option.

Throwing in a +1. Ideally securing the API on a Admin vs User perspective would happen, but in the meantime, hiding tabs would be effective for many use cases.

1 Like

Solution (mostly): Custom components

The function that registers a component does have an “admin only” flag: github link

By copying a component and making some minor modifications, I was able to do this. For instance, copy the component to you’re custom components folder:

cp -a /usr/src/homeassistant/homeassistant/components/history /config/custom_components/history

Open up manifest.json and add a version string:

{
  "version": "2022.07.23",
  "domain": "history",
  ... etc

Then open __init__.py and change:

frontend.async_register_built_in_panel(hass, "history", "history", "hass:chart-box")

to

frontend.async_register_built_in_panel(hass, "history", "history", "hass:chart-box", None, None, True)

And restart. This will keep the History panel in for admins, but remove it for users. If a user tries to access the /history URL, it redirects them to their main panel. I do not know if it blocks the API, however.

I have tested this with:

  • History
  • Map
  • Media (media_source)

This will hold through upgrades, but if you want updates to the components, you may need to update them from source every now and again. I’ll probably write a script to automate this on upgrades.

7 Likes

Noob here, trying to replicate what @Fmstrat has explained, just need an extra push, can you explain a bit more from below & based around if I wanted to hide history, map, & media, also energy & logbook (if possible) from non admin users:

When I try this I cant seem to find this line:

Thanks in advance, user permissions as mentioned on various forums would be a god send but until it happens you seem to have a work around I hope.
Cheers!

1 Like

+1 from me

For anyone watching this thread This is What the Heck Month where the devs pay special attention to issues, feature requests etc. Please go to the What the Heck Post i just made and upvote it.

3 Likes

Apparently another WTH that already has a lot of traction so go vote for that one as well.

3 Likes

+1 from me!!!

1 Like

@Fmstrat - inspired idea…

unfortunately i did this today without any meaningful wins

no errors in the HA logging, just no change

does anyone have this solution working in Home Assistant 2023.1.2 Frontend 20230104.0 - latest

if i’m the muppet i’ll wear that :slight_smile:

1 Like

Please add this important feature +1

Still not there, please at this feature +1

1 Like

+1 for user permissions. Or at least proper admin / non-admin permissions.

Huge fan of Home Assistant here, the range of features is amazing. But now that everything works for me, I want to give access to family members and other devices.

The fact that there are no per user permissions just dumbfounded me. I’d happily forgo with any number of features as long as these basic security requirements are not met.

4 Likes

+1 very big security risk. Guests should not be able to access this kind of information

1 Like

+1 must have feature

1 Like

+1 Please add this important feature :slight_smile:

2 Likes

A very important feature, because I’m afraid to give artificial intelligence full access for HA)

1 Like

+1 Please add this important feature

1 Like

+1 This is for me the most important missing feature.

My use case is:

As a HA admin, I want to create a User that will have access exclusively to what is inside one particular Dashboard.

No other access to any entities outside the specific Dashboard.

2 Likes

Please add this +1

1 Like

Please implement a basic hiding function. This is the intention of the OP. Security is a different topic and should be handled separately.

1 Like