[Bug] WebSocket subscribe to `alertticker_sync` fails with "Unauthorized" for non-admin users (regression in 1.3.9.9.5)

[Petarkir2000]

AlertTicker Card version

1.3.9.9.5

Home Assistant version

2026.8.0

Browser

Chrome (desktop)

Describe the bug

Description
When a non-admin Home Assistant user has an AlertTicker Card dashboard open, HA logs two related errors even though the user's session/login is completely valid:

1. homeassistant.components.websocket_api.http.connection (connection.py:331):
   Error handling message: Unauthorized (unauthorized) <user> from <IP> (...)

2. homeassistant.components.websocket_api.commands (commands.py:195):
   Refusing to allow <user> to subscribe to event alertticker_sync

Regression
Confirmed this does not happen on 1.3.9.9.4. First appeared after updating to 1.3.9.9.5. No relevant fix/change is mentioned in the visible changelog for this jump, so it looks like an unintentional side effect of another change (possibly related to the sync mechanism between tabs/devices).

Cause (as far as I can tell)
Home Assistant's WebSocket API restricts subscribe_events for any event type not in the built-in allow-list (e.g. state_changed) to admin/owner users only. Since the card subscribes directly to a custom event (alertticker_sync) — presumably for cross-tab/cross-device sync — this fails for any dashboard user who isn't a HA administrator, regardless of correct authentication.

Steps to reproduce

1. Update AlertTicker Card from 1.3.9.9.4 to 1.3.9.9.5.
2. Add AlertTicker Card to a dashboard.
3. Open the dashboard as a HA user who is not an administrator.
4. Check Settings → System → Logs.
5. See the two errors above appear (once per session/reconnect).

Expected behavior
The card should either:

• Not require a non-admin user to subscribe to a custom event type (e.g. use a state-backed helper entity instead of a raw custom event for sync), or
• Fail silently / handle the Unauthorized response gracefully without generating repeated log errors, or
• Document that the sync feature requires admin rights, so users can knowingly disable it instead of suppressing the errors via automation.

Environment

• Home Assistant Core: 2026.6.5
• AlertTicker Card: 1.3.9.9.5 (bug not present in 1.3.9.9.4)
• User involved: non-admin dashboard user

Workaround currently in use
Filtering out these two specific log lines via a system_log_event automation, matching on logger prefix websocket_api + message containing the username + alertticker_sync/unauthorized. This hides the noise but doesn't fix the underlying subscribe failure.

Your card YAML config

cycle_interval: 5
show_when_clear: false
clear_message: ''
clear_theme: success
alerts:
  - entity: sensor.0x449fdafffe078972_battery
    operator: <
    state: '85'
    message: SNZB-02P Dad 2Z Battery ({state})
    priority: 2
    theme: battery
    icon: 🔋
  - entity: sensor.0x048727fffeaa8c92_battery
    operator: <
    state: '85'
    message: SNZB-02P Dad Z Battery ({state})
    priority: 2
    theme: battery
    icon: 🔋
type: custom:alert-ticker-card
cycle_animation: fold
swipe_to_snooze: true
text_align: center
tts_enabled: false

Screenshots or video (optional but helpful)

No response

Browser console errors (optional)

Before submitting

• I searched existing issues and could not find a duplicate.
• I have cleared the browser cache after updating.

[djdevil]

Hi @Petarkir2000 👋

Genuinely thank you for this report — your diagnosis is spot-on, and the level of detail you provided (log lines, HA version, exact regression range, workaround, and even the security-model explanation) turned this into a 5-minute fix. This is the kind of bug report every maintainer wishes for. 🙏

What happened

Confirmed: the v1.3.9.9.5 cross-device sync feature (#210) calls subscribe_events on a custom event type (alertticker_sync) to propagate snooze/dismiss actions across devices in real time. As you correctly noted, Home Assistant's WebSocket API restricts custom-event subscriptions (and fire_event) to admin/owner users only — my implementation subscribed unconditionally.

The fix

The next release adds a simple hass.user.is_admin guard before both subscribe_events and fire_event. For non-admin users the card now:

• Skips subscribing silently — no Unauthorized log spam
• Skips firing sync events — same reason
• Falls back to local-only snooze/dismiss — the exact behaviour they had before v1.3.9.9.5 (no regression)

Admin users continue to enjoy full cross-device sync as before.

Documented the restriction in the README's Cross-device sync section so future users know that if they want the feature to work for a specific dashboard user, that user needs the admin role.

Coming in the next release

You can drop your log-filter automation once you update — the errors won't be generated in the first place.

I'll ping this thread the moment the release is out.

[djdevil]

🎉 Released in v1.3.9.9.6!

Update via HACS and clear the browser cache. Your log-filter workaround can be removed after this update — the Unauthorized errors are no longer generated (the card now checks hass.user.is_admin before subscribing/firing sync events).

Thanks again for the crisp bug report! 🙏

[Petarkir2000]

Updated to ...6. No new errors reported. Thank you for your quick response!