homebridge-lgwebos-tv 4.3.13 → 4.3.14

package/CHANGELOG.md

@@ -15,6 +15,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - For plugin < v4.1.0 use Homebridge UI <= v5.5.0
 - For plugin >= v4.1.0 use Homebridge UI >= v5.13.0
 
+## [4.3.14] - (23.09.2026)
+
+### Added
+
+- optional RESTful access `Token`. When set, every request (GET and POST) must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. Leaving it empty keeps the previous behaviour, so existing configs keep working
+- readme update
+
 ## [4.3.13] - (13.09.2026)
 
 ## Changes

package/README.md

@@ -137,6 +137,7 @@
 | `restFul{}` | RESTFul object. |
 | `restFul.enable` | If enabled, RESTful server will start automatically and respond to any path request. |
 | `restFul.port` | Here set the listening `Port` for RESTful server. |
+| `restFul.token` | Here optional set the access token. When set, every request must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. |
 | `mqtt{}` | MQTT object. |
 | `mqtt.enable` | If enabled, MQTT Broker will start automatically and publish all awailable PV data. |
 | `mqtt.host` | Here set the `IP Address` or `Hostname` for MQTT Broker. |
@@ -152,6 +153,7 @@
 ### RESTFul Integration
 
 * POST data as a JSON Object `{Power: true}`, content type must be `application/json`
+* If `Token` is set, every request (GET and POST) must send the header `Authorization: Bearer <token>`.
 * Path `status` response all available paths.
 * References:
   * Picture Mode - `cinema`, `eco`, `expert1`, `expert2`, `game`, `normal`, `photo`, `sports`, `technicolor`, `vivid`, `hdrEffect`, `hdrFilmMaker`, `hdrCinema`, `hdrCinemaBright`, `hdrStandard`, `hdrEffect`, `hdrGame`, `hdrVivid`, `hdrTechnicolor`, `hdrExternal`, `dolbyHdrCinema`, `dolbyHdrCinemaBright`, `dolbyHdrDarkAmazon`, `dolbyHdrStandard`, `dolbyHdrGame`, `dolbyHdrVivid`.

package/config.schema.json

@@ -1728,6 +1728,16 @@
                   "condition": {
                     "functionBody": "return model.devices[arrayIndices].restFul.enable === true;"
                   }
+                },
+                "token": {
+                  "title": "Token",
+                  "type": "string",
+                  "placeholder": "optional",
+                  "description": "Optional access token. When set, every request must send the header 'Authorization: Bearer <token>'. Leave empty to keep the server open on the local network.",
+                  "format": "password",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].restFul.enable === true;"
+                  }
                 }
               }
             },
@@ -2107,7 +2117,8 @@
                           "title": "RESTFul",
                           "items": [
                             "devices[].restFul.enable",
-                            "devices[].restFul.port"
+                            "devices[].restFul.port",
+                            "devices[].restFul.token"
                           ]
                         },
                         {

package/index.js

@@ -112,6 +112,7 @@ class LgWebOsPlatform {
 					const timer = setTimeout(resolve, 5000);
 					restFul1 = new RestFul({
 						port: device.restFul.port || 3000,
+						token: device.restFul.token,
 						logWarn: logLevel.warn,
 						logDebug: logLevel.debug,
 					})

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "LG webOS TV",
   "name": "homebridge-lgwebos-tv",
-  "version": "4.3.13",
+  "version": "4.3.14",
   "description": "Homebridge plugin to control LG webOS TV.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/restful.js

@@ -1,5 +1,6 @@
 import express, { json } from 'express';
 import EventEmitter from 'events';
+import { createHash, timingSafeEqual } from 'crypto';
 
 const DEFAULT_MESSAGE = 'This data is not available at this time.';
 
@@ -7,6 +8,7 @@ class RestFul extends EventEmitter {
     constructor(config) {
         super();
         this.port = config.port;
+        this.token = typeof config.token === 'string' ? config.token.trim() : '';
         this.logWarn = config.logWarn;
         this.logDebug = config.logDebug;
 
@@ -35,6 +37,19 @@ class RestFul extends EventEmitter {
             app.set('json spaces', 2);
             app.use(json());
 
+            // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"
+            if (this.token) {
+                app.use((req, res, next) => {
+                    const header = req.headers.authorization ?? '';
+                    const provided = header.startsWith('Bearer ') ? header.slice(7) : '';
+                    if (!this.tokenValid(provided)) {
+                        if (this.logWarn) this.emit('warn', `RESTFul Unauthorized request from: ${req.ip}, ${req.method} ${req.path}`);
+                        return res.status(401).json({ error: 'RESTFul Unauthorized' });
+                    }
+                    next();
+                });
+            }
+
             // Register GET routes for all keys
             for (const key of Object.keys(this.data)) {
                 app.get(`/${key}`, (req, res) => {
@@ -83,6 +98,13 @@ class RestFul extends EventEmitter {
         }
     }
 
+    tokenValid(provided) {
+        // Compare fixed-length hashes so the check takes the same time regardless of token length or content
+        const a = createHash('sha256').update(provided).digest();
+        const b = createHash('sha256').update(this.token).digest();
+        return timingSafeEqual(a, b);
+    }
+
     update(path, data) {
         if (this.data.hasOwnProperty(path)) {
             this.data[path] = data;