Access Supervisor API?

[joachimtingvold]

First I thought issue #67 seemed to be not solved. Then I see that the app indeed seems to have the relevant configuration needed (as per the documentation);

[…]
hassio_api: true
services:
  - mysql:want
  - mqtt:want
homeassistant_api: true
[…]

However, spinning up a default instance of this addon, and then trying to access the Supervisor API, yields the following;

[core-ssh ~]$ echo $SUPERVISOR_TOKEN
19c[…]
[core-ssh ~]$
[core-ssh ~]$ curl -X GET -H "Authorization: Bearer ${SUPERVISOR_TOKEN}" -H "Content-Type: application/json" http://supervisor/core/api/config
401: Unauthorized
[core-ssh ~]$
[core-ssh ~]$ curl -X GET -H "Authorization: Bearer ${SUPERVISOR_TOKEN}" -H "Content-Type: application/json" http://supervisor/services/mqtt
{"result": "error", "message": "No access to mqtt service!"}
[core-ssh ~]$

I'd expect both these API endpoints to work. But maybe I'm missing something?

[frenck]

Not sure 🤷

I'm also not sure how this is a question for the community SSH add-on?

[joachimtingvold]

Well, the API endpoints seems to work for other addons, so first impression it seems to be isolated to the SSH addon.

[joachimtingvold]

I'll probably have to debug further (see how the tokens are registered, what scope they get, why we get 401, etc), but just wanted to verify if this was intended to work out of the box or not. Currently it does not seem to, but ye.

[frenck]

The SSH add-on uses it itself:

https://github.com/hassio-addons/addon-ssh/blob/main/ssh/rootfs/etc/cont-init.d/mosquitto.sh

[joachimtingvold]

The if statement in that is never triggered (since bashio doesn't list mqtt as a service). This is probably due to the same reason we're getting 401 error.

The token works;

[core-ssh ~]$ curl -X GET -H "Content-Type: application/json" http://supervisor/info
401: Unauthorized
[core-ssh ~]$
[core-ssh ~]$ curl -X GET -H "Authorization: Bearer ${SUPERVISOR_TOKEN}" -H "Content-Type: application/json" http://supervisor/info
{"result": "ok", "data": […] }

... but it does not have access to the endpoints it should have. Some addons would not work if they did not have access to these endpoints (but they work), so the error seems to be related to what access is granted to the SSH addon token. If this is caused by the SSH addon config and/or code, I do not know yet (but it seems to be likely).