From a334abd523684394a76131b7ff5a92de8c37a59a Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Mon, 19 Oct 2026 11:14:56 +0200 Subject: [PATCH] =?UTF-8?q?docs(changelog):=20record=20T-1=20=E2=80=94=20c?= =?UTF-8?q?aller=20auth,=20locked=20housekeeping=20reads,=20the=20Book?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 09a31ac..83cf770 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,31 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [Unreleased] + +### Added + +- **Caller auth** (`src/domains/auth/callers.py`) - the first thing in this repo + that reads a service key. `require_caller()` resolves a static office/tatlock/ + scheduler key (constant-time compare, checked before any JWT parsing) or falls + through to the existing OIDC path. New settings: `office_service_key`, + `tatlock_service_key`, `scheduler_service_key`, `book_timezone`. +- **The Book** (`src/domains/book/`) - Notes, Tasks, Decisions, Questions and + Rejected options (workspace D-68/D-69/D-70). Routes: `add`, `show`, `list`, + `find`, `change`, `close`, `link`/`unlink`, `tag`/`untag`, `history`, all under + `/book/*`, behind `require_caller("office", "user")`. Migration 005 creates the + whole schema: `book_records`, `book_tags`, `book_record_links`, + `book_attachments`, `book_events` (append-only, DB trigger-enforced). + +### Changed + +- **Housekeeping reads are locked** - `GET /housekeeping/*` (health, devices, + areas, scenes, scripts, automations, history) now require a caller + (`office`, `tatlock`, or `user`) instead of being unauthenticated. Writes are + unchanged (`get_admin_user`). `api.schweitz.net` carries no forward-auth, so + this was an open read of the house's device list once Home Assistant's token + is restored (T-1 / D-68). + ## [1.11.0] - 2026-01-08 ### Added