Allow checking entity permissions based on devices (#19007)

* Allow checking entity permissions based on devices

* Fix tests

tests/auth/permissions/test_entities.py

@@ -4,12 +4,16 @@ import voluptuous as vol
 
 from homeassistant.auth.permissions.entities import (
   compile_entities, ENTITY_POLICY_SCHEMA)
+from homeassistant.auth.permissions.models import PermissionLookup
+from homeassistant.helpers.entity_registry import RegistryEntry
+
+from tests.common import mock_registry
 
 
 def test_entities_none():
     """Test entity ID policy."""
     policy = None
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is False
 
 
@@ -17,7 +21,7 @@ def test_entities_empty():
     """Test entity ID policy."""
     policy = {}
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is False
 
 
@@ -32,7 +36,7 @@ def test_entities_true():
     """Test entity ID policy."""
     policy = True
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
 
 
@@ -42,7 +46,7 @@ def test_entities_domains_true():
         'domains': True
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
 
 
@@ -54,7 +58,7 @@ def test_entities_domains_domain_true():
         }
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
     assert compiled('switch.kitchen', 'read') is False
 
@@ -76,7 +80,7 @@ def test_entities_entity_ids_true():
         'entity_ids': True
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
 
 
@@ -97,7 +101,7 @@ def test_entities_entity_ids_entity_id_true():
         }
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
     assert compiled('switch.kitchen', 'read') is False
 
@@ -123,7 +127,7 @@ def test_entities_control_only():
         }
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
     assert compiled('light.kitchen', 'control') is False
     assert compiled('light.kitchen', 'edit') is False
@@ -140,7 +144,7 @@ def test_entities_read_control():
         }
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
     assert compiled('light.kitchen', 'control') is True
     assert compiled('light.kitchen', 'edit') is False
@@ -152,7 +156,7 @@ def test_entities_all_allow():
         'all': True
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
     assert compiled('light.kitchen', 'control') is True
     assert compiled('switch.kitchen', 'read') is True
@@ -166,7 +170,7 @@ def test_entities_all_read():
         }
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is True
     assert compiled('light.kitchen', 'control') is False
     assert compiled('switch.kitchen', 'read') is True
@@ -180,8 +184,40 @@ def test_entities_all_control():
         }
     }
     ENTITY_POLICY_SCHEMA(policy)
-    compiled = compile_entities(policy)
+    compiled = compile_entities(policy, None)
     assert compiled('light.kitchen', 'read') is False
     assert compiled('light.kitchen', 'control') is True
     assert compiled('switch.kitchen', 'read') is False
     assert compiled('switch.kitchen', 'control') is True
+
+
+def test_entities_device_id_boolean(hass):
+    """Test entity ID policy applying control on device id."""
+    registry = mock_registry(hass, {
+        'test_domain.allowed': RegistryEntry(
+            entity_id='test_domain.allowed',
+            unique_id='1234',
+            platform='test_platform',
+            device_id='mock-allowed-dev-id'
+        ),
+        'test_domain.not_allowed': RegistryEntry(
+            entity_id='test_domain.not_allowed',
+            unique_id='5678',
+            platform='test_platform',
+            device_id='mock-not-allowed-dev-id'
+        ),
+    })
+
+    policy = {
+        'device_ids': {
+            'mock-allowed-dev-id': {
+                'read': True,
+            }
+        }
+    }
+    ENTITY_POLICY_SCHEMA(policy)
+    compiled = compile_entities(policy, PermissionLookup(registry))
+    assert compiled('test_domain.allowed', 'read') is True
+    assert compiled('test_domain.allowed', 'control') is False
+    assert compiled('test_domain.not_allowed', 'read') is False
+    assert compiled('test_domain.not_allowed', 'control') is False

tests/auth/permissions/test_system_policies.py

@@ -8,7 +8,7 @@ def test_admin_policy():
     # Make sure it's valid
     POLICY_SCHEMA(system_policies.ADMIN_POLICY)
 
-    perms = PolicyPermissions(system_policies.ADMIN_POLICY)
+    perms = PolicyPermissions(system_policies.ADMIN_POLICY, None)
     assert perms.check_entity('light.kitchen', 'read')
     assert perms.check_entity('light.kitchen', 'control')
     assert perms.check_entity('light.kitchen', 'edit')
@@ -19,7 +19,7 @@ def test_read_only_policy():
     # Make sure it's valid
     POLICY_SCHEMA(system_policies.READ_ONLY_POLICY)
 
-    perms = PolicyPermissions(system_policies.READ_ONLY_POLICY)
+    perms = PolicyPermissions(system_policies.READ_ONLY_POLICY, None)
     assert perms.check_entity('light.kitchen', 'read')
     assert not perms.check_entity('light.kitchen', 'control')
     assert not perms.check_entity('light.kitchen', 'edit')

tests/auth/test_models.py

@@ -5,7 +5,12 @@ from homeassistant.auth import models, permissions
 def test_owner_fetching_owner_permissions():
     """Test we fetch the owner permissions for an owner user."""
     group = models.Group(name="Test Group", policy={})
-    owner = models.User(name="Test User", groups=[group], is_owner=True)
+    owner = models.User(
+        name="Test User",
+        perm_lookup=None,
+        groups=[group],
+        is_owner=True
+    )
     assert owner.permissions is permissions.OwnerPermissions
 
 
@@ -25,7 +30,11 @@ def test_permissions_merged():
             }
         }
     })
-    user = models.User(name="Test User", groups=[group, group2])
+    user = models.User(
+        name="Test User",
+        perm_lookup=None,
+        groups=[group, group2]
+    )
     # Make sure we cache instance
     assert user.permissions is user.permissions