noiwid/HAFamilyLink v2.1.0

on GitHub

Screen time per device, and the services now check who is calling. Update through HACS; a restart is needed as usual.

Added

• Screen time per device (#174, thanks to @zupis for the contribution). Every supervised device gets a sensor.<device>_daily_screen_time, in minutes, with the per-app breakdown of that device in its attributes, and unknown rather than a misleading zero while the data is missing. The child's sensor.<child>_daily_screen_time gains a by_device attribute keyed by device id, with the name, minutes, seconds and formatted time of each device; its apps attribute keeps its shape, so existing cards and automations are unaffected. Google reports every usage session with the device it happened on, verified on an account with a phone and a tablet.

Security

• The familylink.* services now check who is calling (#177, raised in #169). Home Assistant evaluates entity permissions on entity actions (switches, buttons, numbers, times) but not on domain services, so the services taking a raw child_id or device_id, or no target at all, could be called by any authenticated user, administrator or not, including a supervised child with a Home Assistant account. From now on:

  Caller	Result
  Automation or system script (no user in the context)	Allowed, unchanged
  Administrator	Allowed, any target
  Non-administrator with an entity_id they may control, and nothing else	Allowed, as if they had toggled that entity
  Non-administrator with a raw identifier, no target, or an entity_id mixed with a raw identifier	Refused with Unauthorized and a warning in the log

  If a dashboard used by a non-administrator calls a service with a raw device_id or child_id, switch it to the matching entity_id. An entity permission policy (for example one written with ha-rbac) now applies to the services too. Details in SERVICES.md.

Notes

• Recent Home Assistant versions build the id of a newly created entity from its device's area as well: a phone placed in an area named "Kids" gets sensor.kids_<device>_daily_screen_time. Display names are unchanged. This is Home Assistant's behaviour, mentioned here because the new per-device sensor is the first entity many installs will create on such a version.
• The API notes now document the deviceMudId and modeType fields of usage sessions.