noiwid/HAFamilyLink v1.2.7

v1.2.7 - School/Bedtime "today" controls, device ring, security & resilience

on GitHub

First stable release consolidating the v1.2.7-rc1 → rc5 line, plus a new "ring a device" feature and a security/perf/cleanup pass.

Full changelog: v1.2.6...v1.2.7

✨ New

• Ring a device (#118) - a per-device button.<device>_ring (🔔) and a familylink.ring_device action make a child device sound, to help locate it (mirrors the Family Link app's "ring" feature). Uses the devices/{id}:executeRemoteAction endpoint. Thanks to @brmo for the request.

🐛 Fixed

• School time switch now actually locks/unlocks the device (#111) - switch.<child>_school_time and enable_school_time / disable_school_time now post a daily override (timeLimitOverrides:batchCreate) for today, mirroring the web app's "Today" toggle. The old timeLimit:update-only approach had no effect on days outside a weekly slot (e.g. Saturday on a Mon-Fri schedule).

• Bedtime switch now reaches the device (#113) - same daily-override pattern applied to bedtime: the switch/services flip the weekly policy and post a per-day override using today's actual bedtime hours.

• Switches reflect the effective "today" state (#114) - is_on now reads the combined weekly-policy + daily-override state (appliedTimeLimits), so the switch no longer snaps back to its weekly value after a "today only" toggle.

• Bedtime/school-time schedules are now parsed from the API (#113) - the parser was looking one array level too deep and reading the wrong indices, so every fetch silently returned zero schedules and fell back to a hardcoded 21:30-07:00. Overrides now use your real configured hours.

• Resilience to Google's transient API errors (#117, thanks @Naumsede) - Google's API regularly returns 503/500 (especially on appsandusage), which used to drop every sensor to unavailable. The integration now serves the last successful data during transient errors, with per-endpoint fallbacks; the cache clears on restart.

• Misc setup-time fixes: shared dir created before the encryption key; defensive status polling after session cleanup; safer unload; pending-state clearing.

🔒 Security

• /api/cookies always requires an API key. Without it, any device on the LAN (including a supervised child) could fetch the parent's full Google session cookies. A key is auto-generated on first add-on start (0600), or set via the API_KEY env var. On HA OS / Supervised this is zero-config - the integration reads the key automatically.

• All IDs interpolated into Google API URLs are validated (prevents path injection via service calls); API-key comparison uses secrets.compare_digest.

⚡ Performance

• Reuses the appsandusage payload to compute daily screen time instead of re-fetching it - roughly halves the heaviest call per child per cycle.

• Cookies load in a single round-trip; device lock/unlock no longer triggers a redundant second refresh.

🧹 Cleanup

• Removed ~270 lines of dead sensor code (never-instantiated Bedtime/SchoolTime schedule and DailyLimit sensors) and other dead paths. No user-facing entities are removed.

⚠️ Behavior change

The bedtime/school-time switches now control today's effective state, not the persistent weekly schedule. Toggling the switch no longer rewrites your weekly policy - it applies a daily override, matching the Family Link app's "Today" behavior and user expectation ("I toggled it, it should lock/unlock now").

📦 Companion add-on

The Google Family Link Auth add-on is bumped to 1.7.0 (auto-generated API key for the protected cookie endpoint, first-start dir-creation fix, auth UI fixes with API_KEY set). Update it from the add-on store after upgrading.

⬆️ Upgrade

Update via HACS, then restart Home Assistant. If you use the add-on, update it to 1.7.0 as well - no reconfiguration needed on HA OS / Supervised.