The AI-authored settings UI added a web interface for per-tool controls, but mounted its routes both under the MCP secret path and at the bare published port (:9583). The root-mounted routes perform no auth (no secret, Origin, or CSRF), so any client reaching :9583 can invoke them.

     @mcp.custom_route("/settings", methods=["GET"])     async def _settings_page(_: Request) -> HTMLResponse:         return HTMLResponse(_SETTINGS_HTML)

 hassio_role: default

 import time import uuid+from collections.abc import Awaitable, Callable from pathlib import Path from typing import TYPE_CHECKING, Any, Literal, NamedTuple, NotRequired, TypedDict  import httpx from starlette.requests import Request-from starlette.responses import HTMLResponse, JSONResponse+from starlette.responses import HTMLResponse, JSONResponse, Response  from ._version import get_version, is_running_in_addon from .backup_manager import get_backup_manager@@ -2956,6 +2958,65 @@ async def _save_backup_config(request: Request) -> JSONResponse:     return handlers  +# Home Assistant proxies every ingress request ("Open Web UI") from the+# Supervisor's fixed network address. Per the add-on ingress contract+# (https://developers.home-assistant.io/docs/add-ons/presentation/#ingress —+# "Only connections from 172.30.32.2 must be allowed") the app must reject+# every other source. This holds under host_network too: ingress proxies to+# http://{app.ip_address}:{ingress_port}/, and for a host-network add-on+# app.ip_address is the hassio bridge gateway 172.30.32.1 — the DESTINATION the+# Supervisor dials (supervisor/docker/app.py ip_address(): host_network ->+# network.gateway). The Supervisor opens that connection from its own container+# address 172.30.32.2, so the transport peer the add-on sees is 172.30.32.2 for+# genuine ingress and some other address (a LAN host, the cloudflared tunnel at+# 172.30.33.x, another add-on) for a direct port-9583 hit. Verified live via+# netstat during an "Open Web UI" click.+SUPERVISOR_INGRESS_IP = "172.30.32.2"++# A settings-UI route handler: async (Request) -> Response.+_SettingsRoute = Callable[[Request], Awaitable[Response]]+++def _ingress_only(handler: _SettingsRoute) -> _SettingsRoute:+    """Wrap a root-mounted add-on route so only HA ingress can reach it.++    Add-on root routes carry no MCP secret, so without this guard a direct+    caller on the published port — a LAN peer, a reverse proxy / tunnel+    forwarding the bare root, or a CSRF POST from a LAN browser — could+    rewrite tool config, flip the tool-security-policy, or restart the+    add-on with no authentication. We gate on the *transport* peer+    (``request.client.host``), never ``X-Forwarded-For`` (which a caller can+    forge). The same handlers stay reachable under ``secret_prefix``, where+    the MCP secret path is the auth for direct/remote access.+    """++    @functools.wraps(handler)+    async def _guarded(request: Request) -> Response:+        peer = request.client.host if request.client else None+        if peer != SUPERVISOR_INGRESS_IP:+            logger.warning(+                "Blocked non-ingress request to add-on root route %s from "+                "peer %r (only the Supervisor at %s may reach root routes; "+                "use the MCP secret path for direct/remote access).",+                request.url.path,+                peer,+                SUPERVISOR_INGRESS_IP,+            )+            return JSONResponse(+                {+                    "error": (+                        "This endpoint is only reachable through Home "+                        "Assistant ingress. For direct or remote access, use "+                        "the settings UI under your MCP secret path."+                    )+                },+                status_code=403,+            )+        return await handler(request)++    return _guarded++ def register_settings_routes(     mcp: FastMCP,     server: HomeAssistantSmartMCPServer,@@ -3030,18 +3091,26 @@ def register_settings_routes(         ("/api/policy/value-source", ["GET"], "policy_get_value_source"),     ]

+    _ingress_only,     apply_tool_visibility,     load_tool_config,     register_settings_routes,@@ -517,7 +519,11 @@ def _capture_handler(self, monkeypatch) -> SaveHandler:          def custom_route_factory(path, methods):             def decorator(fn):-                if path == "/api/settings/tools" and "POST" in methods:+                # Match both the root and secret-path mounts; the secret mount+                # registers last, so `captured["save"]` ends up the unguarded+                # handler (the root mount is wrapped in _ingress_only). This+                # test exercises body validation, not the ingress gate.+                if path.endswith("/api/settings/tools") and "POST" in methods:                     captured["save"] = fn                 return fn @@ -3228,3 +3234,164 @@ async def test_save_features_master_off_applied_dict_contains_only_master(             assert sub not in applied         get_data_dir.cache_clear()         _reset_global_settings()+++def _http_request(+    peer_ip: str | None,+    path: str = "/api/policy/config",+    headers: list[tuple[bytes, bytes]] | None = None,+) -> Request:+    """Build a minimal Starlette Request with a controllable transport peer.++    ``client`` is the ASGI peer tuple uvicorn fills from the real TCP+    connection — the transport-level signal the ingress guard checks (the real+    TCP peer, not ``X-Forwarded-For``-forgeable). ``None`` models a connection+    with no peer info. ``headers`` lets a test attach request headers (e.g. a+    forged ``X-Forwarded-For``) to prove they cannot influence the gate.+    """+    scope = {+        "type": "http",+        "method": "GET",+        "path": path,+        "headers": headers or [],+        "query_string": b"",+        "client": (peer_ip, 51234) if peer_ip is not None else None,+    }+    return Request(scope)+++class TestIngressOnlyGuard:+    """`_ingress_only` admits only the Supervisor (HA ingress) source IP."""++    @pytest.mark.asyncio+    async def test_blocks_non_supervisor_peer(self):+        called = False++        async def inner(_request):+            nonlocal called+            called = True+            return JSONResponse({"ok": True})++        resp = await _ingress_only(inner)(_http_request("192.168.1.50"))+        assert resp.status_code == 403+        # The wrapped handler must never run for a rejected peer.+        assert called is False++    @pytest.mark.asyncio+    async def test_allows_supervisor_peer(self):+        async def inner(_request):+            return JSONResponse({"ok": True}, status_code=200)++        resp = await _ingress_only(inner)(_http_request(SUPERVISOR_INGRESS_IP))+        assert resp.status_code == 200+        assert json.loads(resp.body) == {"ok": True}++    @pytest.mark.asyncio+    async def test_blocks_missing_client(self):+        async def inner(_request):+            return JSONResponse({"ok": True})++        resp = await _ingress_only(inner)(_http_request(None))+        assert resp.status_code == 403++    @pytest.mark.asyncio