From 600b8b097ba70af520e25057b9ef8a932858d270 Mon Sep 17 00:00:00 2001 From: Barely Removable Date: Tue, 29 Sep 2026 11:00:39 -0700 Subject: [PATCH] Let the HA iPad dashboard read /api/status The wall dashboard's Ombi tab now shows a lunch panel with pull time and next scheduled run. It's served from Home Assistant (:8123), a different origin, so allow that one origin to read the one read-only endpoint. Co-Authored-By: Claude Opus 5.5 --- CLAUDE.md | 8 ++++++++ app.py | 12 ++++++++++++ 2 files changed, 20 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 8a93c8f..dd8bf45 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -123,6 +123,14 @@ pre-2026-09-08 app. a weekend, so that's a misread date (seen once: Fri 9/25's menu landed on Sat 9/26). Whatever month is live at the permalink is what gets read — there's no logic forcing "next month specifically." +- **iPad dashboard reads `/api/status` (2026-09-29).** The HA iPad wall + dashboard's Ombi tab shows a lunch panel: today's menu (read from the HA + calendar, not this app) plus pull time / next scheduled from + `/api/status`. That page is served from HA (`http://192.168.86.207:8123`), + a different origin, so `_cors_for_dashboard` adds + `Access-Control-Allow-Origin` for that one origin on that one read-only + endpoint. Changing `/api/status`'s shape (`next_calendar_run`) breaks + that panel; moving HA's address means updating `DASHBOARD_ORIGIN`. - **Manual actions:** "Push This Month to Calendar" (`POST /api/push-calendar` → `push_month_to_calendar()`, same function the schedule calls — so it also pushes only today onward and skips weekend misreads) and diff --git a/app.py b/app.py index 279f9ad..3dedf03 100644 --- a/app.py +++ b/app.py @@ -223,6 +223,18 @@ def api_integrations(): }) +# The Home Assistant iPad wall dashboard (served from HA at :8123, a different +# origin) reads /api/status for its lunch summary panel. Allow that one +# origin to read that one read-only endpoint; everything else stays same-origin. +DASHBOARD_ORIGIN = "http://192.168.86.207:8123" + +@app.after_request +def _cors_for_dashboard(resp): + if request.path == "/api/status": + resp.headers["Access-Control-Allow-Origin"] = DASHBOARD_ORIGIN + return resp + + @app.route("/api/status") def api_status(): return jsonify({