Lovelace Restriction Card - Client-side Security

iantrich · April 19, 2021, 2:29pm

however, just to be sure, please let me ask: this makes the pin text appear first, and, after successfully entering the code, makes the confirm text appear. Which is the other way round from what I expected

The design is to use one restriction. The example is just for show. Sounds pretty unfriendly to put so many clicks in the way. The the order is what it is, I have no intention of changing it.

in the repo, there’s an ‘Invalid pin entered’ dialogue video, but no instruction how to do that… Would anyone know which confirmation text that is? Right now, with the above code, simply nothing happens except for the icon to flash.

That was removed

the last_changed isnt displayed on the entity. Since there is plenty space, that can’t be it. Does the lock overlay prevent displaying secondary_info ? Would be really appreciated if this could be done.

No, it doesn’t. You are not using the correct option; last-changed

Though I realize we can set the position of the icon in a theme, and I do use the relative setting to do so, I need the lock to be on a different spot using the cover, than when using eg a single toggle.

I will not be changing it

btw, I also added the restriction on a core entity card, but that seems futile, because clicking that simply opens the more-info, where the lock is not displayed?

I’m not following what you’re saying here

Mariusthvdb · April 19, 2021, 3:00pm

yes! thank you for spotting that…

I tried the lock on

      - type: entity
        entity: cover.garage_deur

but it didnt work, probably because of a wrong config, didnt see an error though, just the more info clicking the entity. Using:

      - type: custom:restriction-card
        <<: *restrict
        card:
          type: entity
          entity: cover.garage_deur

now makes it happen.

was only asking, so cool, not an issue at all. thanks for your time and effort replying in such short notice!

Ildar_Gabdullin · May 27, 2021, 10:15am

Good day!
Started testing this card.

Questions:

Regarding "restrictions::hide".
Here is a card:

type: vertical-stack
cards:
  - type: entities
    entities:
      - entity: sun.sun
      - type: 'custom:restriction-card'
        restrictions:
          hide:
            condition:
              entity: input_boolean.test_boolean_4
              operator: ==
              value: 'on'
        action: hold
        row: true
        card:
          entity: sun.sun
      - type: 'custom:restriction-card'
        action: hold
        duration: 10
        row: true
        card:
          entity: sun.sun
  - type: entities
    entities:
      - entity: input_boolean.test_boolean_4
        name: hide

There are 3 entity rows:

1st - not restricted
2nd - restricted with the "hide" option;
3nd - restricted.

If the toggle button ("input_boolean.test_boolean_4") is ON then the 2nd row is supposed to be hidden.
But it happens only after manual refresh (F5):

Is it a bug?

The restriction card is supposed to be used in different places of HA GUI.
That is why it is better to have a PIN defined in one place.
I tried to specify smth like "pin: !secret my_pin" (no success).
What is the best practice of storing the PIN ?
The same question about user id.

Of course, there is a walkaround - we can create a "decluttering-card" template for this:

  decl_restriction_card_row:
    default:
      - VALUE_ROW: false
    card:
      type: 'custom:restriction-card'
      restrictions:
        pin:
          code: 1234
          text: Введите PIN для разблокировки
          retry_delay: 3
          max_retries: 3
          max_retries_delay: 10
      action: hold
      duration: 10
      row: '[[VALUE_ROW]]'
      card: '[[CARD_OR_ROW]]'

The idea is to define a restriction-card with required settings (presumably same settings for all HA views) in ONE place (with specified pin & user id data) and then use this template in all views.
How to use the template for a row:

type: entities
entities:
  - type: 'custom:decluttering-card'
    template: decl_restriction_card_row
    variables:
      - VALUE_ROW: true
      - CARD_OR_ROW:
          entity: sun.sun

How to use the template for a card:

type: 'custom:decluttering-card'
template: decl_restriction_card_row
variables:
  - CARD_OR_ROW:
      type: entities
      entities:
        - entity: input_boolean.test_boolean

iantrich · May 27, 2021, 1:54pm

Yeah, I see the bug right away in restriction-card/restriction-card.ts at 1f56db9270450cb717c4e2819a10c411b77f6a64 · iantrich/restriction-card · GitHub and I’m really surprised no one has came across it till now
I do not have a recommendation on storing your pin.

Ildar_Gabdullin · May 27, 2021, 3:00pm

Hello Ian, thank you very much for your card and a quick reply!

Great that you found a reason of that behaviour. Looking forward for an update, will test it when released. Probably this “hide” option could be useful.
Every time I start learning a new card, I am usually trying to test it with some test cases (may find some new issues).
Regarding PIN - basically this is not about a privacy (“someone can steal my PIN !!!”), this is about reducing a code (“define it in one place, call it from many places”).
So I will proceed (and recommend it to other people) with decluttering-card. Together these two cards will help a lot.

Ildar_Gabdullin · May 27, 2021, 11:15pm

Some card-mod styling (including for "decluttering-card") is described here.

Dal · June 28, 2021, 9:59am

How do change the placement of the lock, or what color it has?
I have this code:

type: custom:restriction-card
restrictions:
  confirm:
    text: Sikker??
card:
  type: entities
  entities:
    - switch.05301030f4cfa2341de5
  state_color: true

And it looks like this:

But no matter where I put lines like:
restriction-regular-lock-color
or
restriction-lock-margin-left

Nothing seems to change.

So what am I doing wrong?

Thanks.

tom_l · June 28, 2021, 10:12am

The theming options, surprisingly enough, go in your theme. Not the card.

Dal · June 28, 2021, 10:29am

I’m assuming this is an answer to me.
And yes, this is the question.
I don’t understand where to put / configure the Theme Variables.
I haven’t found one example that can tell me this.

tom_l · June 28, 2021, 10:31am

Dal · June 28, 2021, 12:33pm

Thanks for answering, but these are not really answers at all.
First, I have never heard of themes before, and therefore I had no configuration for it.
And how is it logical to assume that configuration that applies to this specific card only goes into a global configuration file?

It is ok not to answer questions. Better that, than to “answer” questions.

tom_l · June 28, 2021, 12:41pm

I had a feeling that you may not be aware of themes after you ignored the first link I made to help you that linked to this (emphasis mine):

The following variables are available and can be set in your theme to change the appearance of the lock. Can be specified by color name, hexadecimal, rgb, rgba, hsl, hsla, basically anything supported by CSS.

So I linked to the Home Assistant themes document for you. Where you could read all about them.

Apologies if that was not clear enough for you.

Dal · July 3, 2021, 10:38am

Since you apparently have a card like this configured, why don’t you just copy / paste a few lines from that config, and this would have been answered a long time ago.

Thanks.

tom_l · July 3, 2021, 11:23am

Because as I said many times already it does not go in the card, it goes in your theme. And as my theme makes extensive use of card mod it would just be confusing. But sure, here you go: Day and Night - #29 by tom_l

sparkydave · November 10, 2021, 4:18am

I just discovered by accident that this card seems to have a bug. If I hover my mouse slightly above the locked entity switch I get control.

Has anyone else noticed this?

tom_l · November 10, 2021, 4:52am

Yeah I see that too. If you get it just on the edge of the touch radius:

Untitled

e-raser · November 13, 2021, 3:10pm

Here´s the issue you created

github.com/iantrich/restriction-card

Restriction bypassed by clicking above locked entity

opened 04:23AM - 10 Nov 21 UTC

sparkydave1981

bug

**Checklist:** - [x ] I updated to the latest version available - [x ] I cleared the cache of my browser **Release with the issue:** HA 2021.11.2 **Last working release (if known):** **Browser and Operating System:** Chrome, Windows 8  **Description of problem:**  If the mouse is clicked / tap is done above the locked entity then the restriction is bypassed and the entity can still be controlled. ![image](https://user-images.githubusercontent.com/7628509/141049312-13af71bd-ab78-4e74-b4c1-e89e871ee302.png) **Javascript errors shown in the web inspector (if applicable):** ``` ``` **Additional information:**

e-raser · November 13, 2021, 3:12pm

I was wondering if I can apply restrictions to a button card with restriction card. Whenever trying I get something weird looking like this:

Therefore: which types of cards are supported @iantrich ?

tom_l · November 13, 2021, 3:52pm

All of them.

e-raser · November 13, 2021, 4:15pm

So how can I add it to a button card? Everything I tried ended up in… (see screenshot above Lovelace Restriction Card - Client-side Security - #138 by e-raser).

I never saw an example of restriction-card applied to a button card.