fix: replace requires_admin with explicit user.is_admin check in delete/export/ignore_list handlers — v4.0.4

requires_admin is not a HomeAssistantView attribute and was silently ignored.
All three destructive endpoints now explicitly check:
  user = request.get('hass_user')
  if user is None or not user.is_admin: return 403
Using the safer 'is None or not is_admin' shape as suggested by @frenck.

Author: Franz646

custom_components/orphan_cleaner/const.py

@@ -47,4 +47,4 @@
 PANEL_ICON = "mdi:broom"
 
 # Versione corrente (usata per cache-busting)
-VERSION = "4.0.3"
+VERSION = "4.0.4"

custom_components/orphan_cleaner/manifest.json

@@ -13,5 +13,5 @@
   "iot_class": "local_push",
   "issue_tracker": "https://github.com/Franz646/orphan-cleaner/issues",
   "requirements": [],
-  "version": "4.0.3"
+  "version": "4.0.4"
 }

custom_components/orphan_cleaner/panel_api.py

@@ -4,7 +4,7 @@
 Tutte le route sono registrate tramite HomeAssistantView, che applica
 l'autenticazione di Home Assistant per default (requires_auth = True).
 Gli endpoint che leggono o modificano lo stato del registry richiedono
-inoltre privilegi di amministratore (requires_admin = True).
+inoltre un controllo esplicito su user.is_admin nel handler.
 """
 from __future__ import annotations
 
@@ -153,13 +153,16 @@ async def get(self, request: web.Request) -> web.Response:
 class OrphanCleanerDeleteView(HomeAssistantView):
     """POST /api/orphan_cleaner/delete - elimina le entità specificate. Richiede admin."""
 
-    url            = "/api/orphan_cleaner/delete"
-    name           = "api:orphan_cleaner:delete"
-    requires_auth  = True
-    requires_admin = True
+    url           = "/api/orphan_cleaner/delete"
+    name          = "api:orphan_cleaner:delete"
+    requires_auth = True
 
     async def post(self, request: web.Request) -> web.Response:
         hass: HomeAssistant = request.app["hass"]
+        user = request.get("hass_user")
+        if user is None or not user.is_admin:
+            return web.Response(status=403, content_type="application/json",
+                                text='{"error":"Admin privileges required"}')
         try:
             body = await request.json()
         except Exception:
@@ -188,16 +191,19 @@ async def post(self, request: web.Request) -> web.Response:
 
 
 class OrphanCleanerExportView(HomeAssistantView):
-    """POST /api/orphan_cleaner/export - salva un backup JSON. Richiede admin
-    perché scrive un file nella directory di configurazione."""
+    """POST /api/orphan_cleaner/export - salva un backup JSON.
+    Richiede admin perché scrive un file nella directory di configurazione."""
 
-    url            = "/api/orphan_cleaner/export"
-    name           = "api:orphan_cleaner:export"
-    requires_auth  = True
-    requires_admin = True
+    url           = "/api/orphan_cleaner/export"
+    name          = "api:orphan_cleaner:export"
+    requires_auth = True
 
     async def post(self, request: web.Request) -> web.Response:
         hass: HomeAssistant = request.app["hass"]
+        user = request.get("hass_user")
+        if user is None or not user.is_admin:
+            return web.Response(status=403, content_type="application/json",
+                                text='{"error":"Admin privileges required"}')
         try:
             body = await request.json()
         except Exception:
@@ -251,7 +257,7 @@ async def get(self, request: web.Request) -> web.Response:
     async def post(self, request: web.Request) -> web.Response:
         hass: HomeAssistant = request.app["hass"]
         user = request.get("hass_user")
-        if user is not None and not user.is_admin:
+        if user is None or not user.is_admin:
             return web.Response(status=403, content_type="application/json",
                                 text='{"error":"Admin privileges required"}')
         try: