Can't get my add-on to update itself via the Supervisor API

klinquist · March 16, 2025, 5:35pm

Hi,

I developed my own add-on with an API that calls HomeAssistant’s supervisor API.

I’m trying to POST http://supervisor/store/addons/self/update with the SUPERVISOR_TOKEN, but I keep getting a 403.

I can successfully call the supervisor API /core/info, /host/info, etc.

My config.yaml contains the following:

privileged:
    - SYS_ADMIN
permissions:
    - 'addons:restart'
    - 'addons:update'
homeassistant_api: true
hassio_api: true
auth_api: true
update: true

Any ideas what other permissions I need to call this endpoint?

Thanks!

klinquist · March 16, 2025, 5:46pm

Hm, is the problem that add-ons can’t update themselves?

github.com/home-assistant/supervisor

supervisor/api/store.py

cc7483111


      
          def addons_addon_install(self, request: web.Request) -> Awaitable[None]:
              """Install add-on."""
              addon = self._extract_addon(request)
              return asyncio.shield(self.sys_addons.install(addon.slug))
          
          @api_process
          async def addons_addon_update(self, request: web.Request) -> None:
              """Update add-on."""
              addon = self._extract_addon(request, installed=True)
              if addon == request.get(REQUEST_FROM):
                  raise APIForbidden(f"Add-on {addon.slug} can't update itself!")
          
              body = await api_validate(SCHEMA_UPDATE, request)
          
              if start_task := await asyncio.shield(
                  self.sys_addons.update(addon.slug, backup=body.get(ATTR_BACKUP))
              ):
                  await start_task
          
          @api_process
          async def addons_addon_info(self, request: web.Request) -> dict[str, Any]:

danieldotnl · March 16, 2025, 7:41pm

Makes sense to me. Updating your own plugin without user intervention sounds undesirable, especially but not only, from a security perspective.