feat(homeassistant): an admin signs in to Home Assistant, with nothing added to it (#6355)

Replaces the read-only token and the webhook automation, which every install
would have had to paste into its own Home Assistant. Connect now goes to Home
Assistant's own sign-in page, and Steward keeps the refresh token that comes
back, encrypted, and calls backup.create_automatic and update.install directly.

The connection page warns that the stored credential has the same access as
the user who signed in, and recommends a service account so Steward's actions
are easy to tell apart in Home Assistant's logs. A user who isn't an
administrator gets the status page and no Install.

Those actions answer only when finished, so a request cut off once sent counts
as sent and the outcome is read from the entities. Removing the connection, or
signing in again, ends the old sign-in on Home Assistant.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/homeassistant/models.py

@@ -13,19 +13,23 @@ from steward.models.base import Base
 class HomeAssistantConnection(Base):
     """The Home Assistant instance Steward looks after; at most one row.
 
-    The token is a read-only user's and the webhook id can only reach the
-    maintenance automation, so nothing stored here can act on the house. Both
-    are encrypted. The last_* columns and `updates` and `backup` are the newest
-    poll's outcome, which the pages read. `refused` stops all polling until
-    someone saves the connection or tries again: Home Assistant bans an address
-    after a few refused requests.
+    `refresh_token` is what Home Assistant's sign-in gave Steward, encrypted. It
+    has the same access as the user who signed in, whatever that is: Home
+    Assistant has no narrower permission. `can_install` is whether that user was
+    an administrator, which backups need. The last_* columns and `updates` and
+    `backup` are the newest poll's outcome, which the pages read. `refused` stops
+    all polling until someone signs in again or tries again: Home Assistant bans
+    an address after a few refused requests.
     """
     __tablename__ = "homeassistant_connection"
 
     id: Mapped[str] = mapped_column(String(36), primary_key=True, default=time_ordered_id)
     url: Mapped[str] = mapped_column(String(500), nullable=False)
-    token: Mapped[str] = mapped_column(Text, nullable=False)
-    webhook_id: Mapped[str] = mapped_column(Text, nullable=False)
+    client_id: Mapped[str] = mapped_column(String(500), nullable=False)
+    refresh_token: Mapped[str] = mapped_column(Text, nullable=False)
+    can_install: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+    signed_in_by: Mapped[str] = mapped_column(String(100), nullable=False, default="")
+    signed_in_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     verify_tls: Mapped[bool] = mapped_column(Boolean, nullable=False, default=True)
     refused: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
     last_polled_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
@@ -33,7 +37,6 @@ class HomeAssistantConnection(Base):
     last_error: Mapped[str | None] = mapped_column(Text, nullable=True)
     updates: Mapped[list] = mapped_column(JSON, nullable=False, default=list)
     backup: Mapped[dict] = mapped_column(JSON, nullable=False, default=dict)
-    automation: Mapped[str | None] = mapped_column(String(20), nullable=True)
 
 
 class HomeAssistantUpdate(Base):
@@ -62,7 +65,6 @@ class HomeAssistantUpdate(Base):
         DateTime(timezone=True), nullable=False, default=lambda: datetime.now(timezone.utc))
     backup_before: Mapped[str | None] = mapped_column(String(64), nullable=True)
     backup_event_before: Mapped[str | None] = mapped_column(String(64), nullable=True)
-    triggered_before: Mapped[str | None] = mapped_column(String(64), nullable=True)
     backup_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     install_sent_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
     finished_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)