Add Tesla Fleet Energy Site read-only profile - #181366
Draft
WhiteStoneTak wants to merge 1 commit into
Draft
Conversation
![home-assistant[bot]](https://avatars.githubusercontent.com/in/97978?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
It seems you haven't yet signed a CLA. Please do so here.
Once you do that we will be able to review and accept this pull request.
Thanks!
Contributor
|
Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍 |
Contributor
|
Hey there @Bre77, mind taking a look at this pull request as it has been labeled with an integration ( Code owner commandsCode owners of
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The read-only completion path needs public config-flow coverage; documentation, description, and reauthentication messaging also need updates.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds a Tesla Fleet Energy Site read-only authorization profile with restricted scopes and telemetry-only entities.
Changes:
- Adds profile selection and OAuth scope validation.
- Restricts read-only entries to energy telemetry APIs and platforms.
- Adds setup, reauthentication, and validation tests.
File summaries
| File | Description |
|---|---|
tests/components/tesla_fleet/test_init.py |
Tests restricted setup behavior. |
tests/components/tesla_fleet/test_config_flow.py |
Tests profile OAuth and reauthentication flows. |
tests/components/tesla_fleet/conftest.py |
Adds read-only test fixtures. |
homeassistant/components/tesla_fleet/strings.json |
Adds profile UI strings and errors. |
homeassistant/components/tesla_fleet/oauth.py |
Validates exact read-only scopes. |
homeassistant/components/tesla_fleet/models.py |
Adds the read-only Energy Site facade. |
homeassistant/components/tesla_fleet/const.py |
Defines profiles and scope mappings. |
homeassistant/components/tesla_fleet/config_flow.py |
Adds profile selection and OAuth handling. |
homeassistant/components/tesla_fleet/__init__.py |
Enforces profile restrictions during setup. |
Review details
Suppressed comments (2)
homeassistant/components/tesla_fleet/strings.json:6
- Use an abort message that also applies during reauthentication. This reason is returned for both initial setup and
SOURCE_REAUTH, so “No integration entry was created” is false when an existing read-only entry fails reauthentication.
"invalid_energy_site_read_only_scopes": "Tesla did not grant exactly the scopes required by the Energy Site read-only profile. No integration entry was created.",
homeassistant/components/tesla_fleet/strings.json:77
- Add and link the required documentation update for this user-facing profile. The new selection changes requested permissions and available devices/entities, but the PR description leaves the documentation link blank, so users will have no integration documentation for choosing or understanding it.
"description": "The **Standard** profile supports vehicles and energy sites, including commands and settings. The **Energy Site read-only** profile requests Energy telemetry only. It cannot access vehicles or change Energy settings.",
- Files reviewed: 9/9 changed files
- Comments generated: 2
- Review effort level: Balanced
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+470
to
+474
| flow = OAuth2FlowHandler() | ||
| flow.hass = hass | ||
| flow.api = AsyncMock() | ||
| flow.api.private_key = Mock() | ||
| flow.api.public_uncompressed_point = "expected-public-key" |
Comment on lines
+313
to
+316
| async def async_step_user( | ||
| self, user_input: dict[str, Any] | None = None | ||
| ) -> ConfigFlowResult: | ||
| """Select an authorization profile before starting OAuth.""" |
home-assistant
Bot
added
cla-recheck
cla-signed
and removed
cla-recheck
cla-needed
labels
Contributor
|
I thought if you simply don't provide energy commands when connecting Tesla the integration should work and respect that choice. Is that not the case? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed change
Add an authorization-profile choice to Tesla Fleet before OAuth. The existing Standard profile remains the default and preserves the current scope request and runtime behavior, including for existing entries that do not have a stored profile. The new Energy Site read-only profile requests exactly
openid,offline_access, andenergy_device_data; it does not requestenergy_cmdsor any vehicle scope.The selected profile is stored in the config entry and retained during reauthentication. Energy Site read-only tokens are validated after OAuth, during setup, and whenever the current access token is obtained. This profile does not construct vehicle clients or coordinators, forwards only sensor and binary sensor platforms, and retains only a narrow Energy API facade for site information, live status, and energy history. It exposes no writable Energy path. Energy history retains the integration's existing five-minute cadence and existing Energy Site sensor behavior.
Local validation passed: all 193 Tesla Fleet tests and 425 snapshots, Ruff check and format, hassfest, full Core and Tesla Fleet component mypy, and change-scoped hooks. No real Tesla OAuth or production deployment was performed.
Type of change
Additional information
Checklist
ruff format homeassistant tests)If user exposed functionality or configuration variables are added/changed:
If the code communicates with devices, web services, or third-party tools:
Updated and included derived files by running:
python3 -m script.hassfest.requirements_all.txt.Updated by running:
python3 -m script.gen_requirements_all.To help with the load of incoming pull requests: