Expand description
WebSocket handler — /api/websocket. ADR-130 §2.2 P2 command subset.
Protocol mirrors HA’s WS API:
server → {"type":"auth_required","ha_version":"<v>"}
client → {"type":"auth","access_token":"<token>"}
server → {"type":"auth_ok","ha_version":"<v>"}
client → {"id":1,"type":"get_states"}
server → {"id":1,"type":"result","success":true,"result":[...]}
ha_version is the homecore version string — see ADR-130 Q1 for the
companion-app feature-detect concern.
§Security (ADR-161)
The auth token is validated against crate::tokens::LongLivedTokenStore
via state.tokens().is_valid() — the same store the REST path uses
(auth::BearerAuth). A wrong token receives auth_invalid and the socket
is closed. (HC-WS-01 closed the prior bypass where any non-empty token was
accepted.) Command replies are transmitted by a dedicated writer task that
drains the response channel onto the socket (HC-WS-02 closed the prior
reply-theater where responses were logged and discarded).
Functions§
- websocket_
handler - WebSocket upgrade entry point. Mounted on
/api/websocket.