Add labs_updated event to subscription allowlist #157552

Copilot · 2025-11-29T20:45:36Z

Breaking change

Proposed change

Non-admin users (e.g., kiosk/dashboard users) cannot subscribe to labs_updated event, causing authorization errors in beta 2025.12.0b2:

Refusing to allow DASHTAB to subscribe to event labs_updated

Add EVENT_LABS_UPDATED constant to homeassistant/const.py and include it in the SUBSCRIBE_ALLOWLIST in homeassistant/auth/permissions/events.py. The event only contains feature status metadata (domain, feature name, enabled state) - no sensitive data.

The constant is defined in homeassistant/const.py to avoid circular import issues, and the labs integration imports it directly from there.

Type of change

Dependency upgrade
Bugfix (non-breaking change which fixes an issue)
New integration (thank you!)
New feature (which adds functionality to an existing integration)
Deprecation (breaking change to happen in the future)
Breaking change (fix/feature causing existing functionality to break)
Code quality improvements to existing code or addition of tests

Additional information

This PR fixes or closes issue: fixes Beta causing error on authorization kiosk_mode #157525
This PR is related to issue:
Link to documentation pull request:
Link to developer documentation pull request:
Link to frontend pull request:

Checklist

I understand the code I am submitting and can explain how it works.
The code change is tested and works locally.
Local tests pass. Your PR cannot be merged unless tests pass
There is no commented out code in this PR.
I have followed the development checklist
I have followed the perfect PR recommendations
The code has been formatted using Ruff (ruff format homeassistant tests)
Tests have been added to verify that the new code works.
Any generated code has been carefully reviewed for correctness and compliance with project standards.

If user exposed functionality or configuration variables are added/changed:

Documentation added/updated for www.home-assistant.io

If the code communicates with devices, web services, or third-party tools:

The manifest file has all fields filled out correctly.
Updated and included derived files by running: python3 -m script.hassfest.
New or updated dependencies have been added to requirements_all.txt.
Updated by running python3 -m script.gen_requirements_all.
For the updated dependencies - a link to the changelog, or at minimum a diff between library versions is added to the PR description.

To help with the load of incoming pull requests:

I have reviewed two other open pull requests in this repository.

Original prompt

This section details on the original issue you should resolve

<issue_title>Beta causing error on authorization kiosk_mode</issue_title>
<issue_description>### The problem

I have two tablets running fully kiosk and showing a dedicated dashboard for them. I made a user for that dashboard as non-admin and set kiosk_mode to display NO sidebar etc. Since latest beta update (dont know if Labs related) the following error shows up for both tablets.

What version of Home Assistant Core has the issue?

core-2025.12.0b2

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

kiosk_mode / Fully Kiosk

Link to integration documentation on our website

No response

Diagnostics information

cant, throws 404 error

Example YAML snippet
Anything in the logs that might be useful for us?
Additional information

There have been more users that reported this issue on HA discord beta channel</issue_description>

<agent_instructions>Add the labs_updated constant to https://github.com/home-assistant/core/blob/dev/homeassistant/auth/permissions/events.py#L31</agent_instructions>

Comments on the Issue (you are @copilot in this section)
@karwosts This comes from here: https://github.com/home-assistant/frontend/issues/28230
(nothing related to kiosk). </comment_new>
<comment_new>@balloob
We should add the labs_updated event to https://github.com/home-assistant/core/blob/dev/homeassistant/auth/permissions/events.py#L31</comment_new>

Fixes Beta causing error on authorization kiosk_mode #157525

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

This fixes the authorization error for non-admin users subscribing to the labs_updated event, which was causing issues with kiosk mode and dedicated dashboards in the beta version. Fixes #145771 Co-authored-by: balloob <[email protected]>

balloob · 2025-11-30T03:58:10Z

homeassistant/auth/permissions/events.py


 from typing import Any, Final

+from homeassistant.components.labs.const import EVENT_LABS_UPDATED


@copilot W7424: Import should be using the component root (hass-component-root-import)

Fixed in 299c1a9 - now importing from homeassistant.components.labs instead of the submodule.

Import EVENT_LABS_UPDATED from homeassistant.components.labs instead of homeassistant.components.labs.const per hass-component-root-import rule. Co-authored-by: balloob <[email protected]>

balloob · 2025-11-30T04:14:45Z

homeassistant/auth/permissions/events.py


 from typing import Any, Final

+from homeassistant.components.labs import EVENT_LABS_UPDATED


@copilot can you move the constant to homeassistant/const.py to avoid circular import.

Done in 512cbd1 - moved EVENT_LABS_UPDATED to homeassistant/const.py and updated both labs/const.py (re-exports with noqa) and events.py to import from there.

Move the constant to the central const.py file to avoid circular import issues. Update labs/const.py to re-export from homeassistant.const and update events.py to import from homeassistant.const directly. Co-authored-by: balloob <[email protected]>

balloob · 2025-11-30T04:19:07Z

homeassistant/components/labs/const.py


 from __future__ import annotations

+from homeassistant.const import EVENT_LABS_UPDATED  # noqa: F401


@copilot don't do this. Just import it whenever the labs integration needs it from homeassistant.const. Don't have it remain defined in labs/const.py

Done in 3bae776 - removed the re-export from labs/const.py and updated both labs/__init__.py and labs/websocket_api.py to import EVENT_LABS_UPDATED directly from homeassistant.const.

Import EVENT_LABS_UPDATED directly from homeassistant.const in labs/__init__.py and labs/websocket_api.py instead of re-exporting from labs/const.py. Co-authored-by: balloob <[email protected]>

Copilot

Pull request overview

This PR fixes an authorization issue where non-admin users cannot subscribe to the labs_updated event. The fix adds EVENT_LABS_UPDATED to the SUBSCRIBE_ALLOWLIST in the events permissions module, allowing all authenticated users to receive notifications when lab preview features are toggled.

Key changes:

Import EVENT_LABS_UPDATED from the labs component
Add the constant to SUBSCRIBE_ALLOWLIST to permit non-admin subscriptions

homeassistant/auth/permissions/events.py

MartinHjelmare · 2025-12-01T07:03:20Z

The wrong issue is linked in the PR description.

emontnemery · 2025-12-01T07:01:44Z

homeassistant/const.py

 EVENT_HOMEASSISTANT_FINAL_WRITE: EventType[NoEventData] = EventType(
    "homeassistant_final_write"
 )
+EVENT_LABS_UPDATED: Final = "labs_updated"


There's a non-merged proposal to add a labs-helper #157315 where importing EVENT_LABS_UPDATED on module level does not cause circular imports, should we consider that again?

emontnemery · 2025-12-01T07:02:46Z

homeassistant/components/labs/const.py

 STORAGE_KEY = "core.labs"
 STORAGE_VERSION = 1

-EVENT_LABS_UPDATED = "labs_updated"


I don't think moving integration's event definitions here is a pattern we should encourage.
Why do we move this constant instead of just importing it locally in auth/permissions/events.py?

A solution could be to add a function async_create_allowlist to homeassistant/auth/permissions/events.py which is called early.

I didn' want to do a refactor but instead follow the pattern that we've been using. Agree that it's unfortunate to move things to main const file for this reason.

balloob · 2025-12-02T05:01:02Z

@MartinHjelmare the linked issue was the issue that showed the permission error and made me realize what was wrong.

@emontnemery I don't feel strongly either way. Just put up a solution

emontnemery

Let's merge this solution, we can consider doing something more complicated in a follow-up

MartinHjelmare · 2025-12-02T07:02:40Z

@balloob I edited the description yesterday and changed the wrong issue to the correct one.

Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: balloob <[email protected]>

Initial plan

550ef72

Copilot AI assigned Copilot and balloob Nov 29, 2025

Copilot started work on behalf of balloob November 29, 2025 20:45 View session

Copilot AI changed the title ~~[WIP] Fix beta causing error on authorization in kiosk mode~~ Add labs_updated event to subscription allowlist Nov 29, 2025

Copilot AI requested a review from balloob November 29, 2025 20:53

Copilot finished work on behalf of balloob November 29, 2025 20:53

balloob reviewed Nov 30, 2025

View reviewed changes

Copilot started work on behalf of balloob November 30, 2025 03:58 View session

balloob added the bugfix label Nov 30, 2025

balloob added this to the 2025.12.0 milestone Nov 30, 2025

Fix import to use component root instead of submodule

299c1a9

Import EVENT_LABS_UPDATED from homeassistant.components.labs instead of homeassistant.components.labs.const per hass-component-root-import rule. Co-authored-by: balloob <[email protected]>

Copilot AI requested a review from balloob November 30, 2025 04:01

Copilot finished work on behalf of balloob November 30, 2025 04:01

balloob marked this pull request as ready for review November 30, 2025 04:11

balloob requested a review from a team as a code owner November 30, 2025 04:11

Copilot AI review requested due to automatic review settings November 30, 2025 04:11

Copilot started reviewing on behalf of balloob November 30, 2025 04:12 View session

Copilot finished reviewing on behalf of balloob November 30, 2025 04:13

balloob reviewed Nov 30, 2025

View reviewed changes

Copilot started work on behalf of balloob November 30, 2025 04:15 View session

balloob reviewed Nov 30, 2025

View reviewed changes

Copilot AI requested a review from balloob November 30, 2025 04:19

Copilot finished work on behalf of balloob November 30, 2025 04:19

Copilot started work on behalf of balloob November 30, 2025 04:19 View session

Remove EVENT_LABS_UPDATED re-export from labs/const.py

3bae776

Import EVENT_LABS_UPDATED directly from homeassistant.const in labs/__init__.py and labs/websocket_api.py instead of re-exporting from labs/const.py. Co-authored-by: balloob <[email protected]>

Copilot AI reviewed Nov 30, 2025

View reviewed changes

homeassistant/auth/permissions/events.py Show resolved Hide resolved

Copilot finished work on behalf of balloob November 30, 2025 04:23

MartinHjelmare marked this pull request as draft December 1, 2025 07:03

emontnemery reviewed Dec 1, 2025

View reviewed changes

emontnemery marked this pull request as ready for review December 2, 2025 06:34

emontnemery approved these changes Dec 2, 2025

View reviewed changes

emontnemery merged commit b8829b6 into dev Dec 2, 2025
122 of 144 checks passed

emontnemery deleted the copilot/fix-beta-authorization-error branch December 2, 2025 06:35

frenck added the cherry-picked label Dec 2, 2025

frenck pushed a commit that referenced this pull request Dec 2, 2025

Add labs_updated event to subscription allowlist (#157552)

81cdbdd

Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: balloob <[email protected]>

frenck mentioned this pull request Dec 2, 2025

Refusing to subscribe to event labs_updated #157459

Closed

github-actions bot locked and limited conversation to collaborators Dec 3, 2025


		from typing import Any, Final

		from homeassistant.components.labs.const import EVENT_LABS_UPDATED


		from typing import Any, Final

		from homeassistant.components.labs import EVENT_LABS_UPDATED


		from __future__ import annotations

		from homeassistant.const import EVENT_LABS_UPDATED # noqa: F401

Uh oh!

Add labs_updated event to subscription allowlist #157552

Add labs_updated event to subscription allowlist #157552

Uh oh!

Conversation

Copilot AI commented Nov 29, 2025 • edited by MartinHjelmare Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Breaking change

Proposed change

Type of change

Additional information

Checklist

What version of Home Assistant Core has the issue?

What was the last working version of Home Assistant Core?

What type of installation are you running?

Integration causing the issue

Link to integration documentation on our website

Diagnostics information

Example YAML snippet

Anything in the logs that might be useful for us?

Additional information

Comments on the Issue (you are @copilot in this section)

Uh oh!

balloob Nov 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

Uh oh!

balloob Nov 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

Uh oh!

balloob Nov 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 30, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

MartinHjelmare commented Dec 1, 2025

Uh oh!

emontnemery Dec 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

emontnemery Dec 1, 2025

Choose a reason for hiding this comment

Uh oh!

balloob Dec 2, 2025

Choose a reason for hiding this comment

Uh oh!

balloob commented Dec 2, 2025

Uh oh!

emontnemery left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MartinHjelmare commented Dec 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Copilot AI commented Nov 29, 2025 •

edited by MartinHjelmare

Loading

emontnemery Dec 1, 2025 •

edited

Loading

emontnemery left a comment •

edited

Loading