noiwid/HAFamilySafety v2.0.3

v2.0.3 - Fix schedule loss on unlock and undetected session expiry

on GitHub

Fixes a way the account lock could replace a child's real schedule with a default one, and a session expiry that was never reported.

Fixed

• Unlock no longer overwrites the schedule with a 2h/day default. Account ids are integers on one Microsoft API and strings on the other, and storage keys are always strings, so a restore point saved before a restart became invisible afterwards. The lock switch then showed no saved policy, and unlocking wrote the integration's own default over the real schedule. Keys are normalised everywhere now. Two related gaps went with it: saving no longer overwrites the stored file with an empty in-memory copy after a reload, and unlocking with nothing to restore refuses instead of inventing a schedule.
• An expired web session is detected again. A rejected Family request left the captured session marked valid, which skipped the check that detects an expired login. The session could expire and nothing would say so: screen-time entities simply stayed unknown. A rejection now invalidates that context and forgets the rejected token, so the next update either refreshes it silently or asks you to re-authenticate.
• Akamai bot-manager cookies are no longer stored or replayed. bm_sv and ak_bmsc are tied to the browser that obtained them. Replayed from Home Assistant, Microsoft stopped answering entirely until the request timed out, which hid the expired session behind timeouts and 30 minute backoffs.
• Lock and unlock stop at the first network failure instead of waiting out a timeout for each of the seven days, and keep the saved schedule for a retry.
• Locking an account that already reads all zeros, with nothing saved, is refused rather than leaving it locked with nothing to restore.
• Error messages now name the real cause: an expired session, a network error, or an active backoff, and follow the switch you actually used.

Housekeeping

• Removed a transport patch that never ran and an attribute that was always None.
• Documentation now describes how the security-filter bypass really works. It previously described the approach that broke every setup in 2.0.0.

Note

If your screen-time entities have been unknown for a while, update and reload: the re-authentication prompt will finally appear.