Google Assistant: Track if request is local

homeassistant/components/cloud/client.py

@@ -11,7 +11,7 @@
     errors as alexa_errors,
     smart_home as alexa_sh,
 )
-from homeassistant.components.google_assistant import smart_home as ga
+from homeassistant.components.google_assistant import const as gc, smart_home as ga
 from homeassistant.core import Context, callback
 from homeassistant.helpers.dispatcher import async_dispatcher_send
 from homeassistant.helpers.typing import HomeAssistantType
@@ -160,7 +160,7 @@ async def async_google_message(self, payload: Dict[Any, Any]) -> Dict[Any, Any]:
         gconf = await self.get_google_config()
 
         return await ga.async_handle_message(
-            self._hass, gconf, gconf.cloud_user, payload
+            self._hass, gconf, gconf.cloud_user, payload, gc.SOURCE_CLOUD
         )
 
     async def async_webhook_message(self, payload: Dict[Any, Any]) -> Dict[Any, Any]:

homeassistant/components/google_assistant/const.py

@@ -143,3 +143,6 @@
 CHALLENGE_FAILED_PIN_NEEDED = "challengeFailedPinNeeded"
 
 STORE_AGENT_USER_IDS = "agent_user_ids"
+
+SOURCE_CLOUD = "cloud"
+SOURCE_LOCAL = "local"

homeassistant/components/google_assistant/helpers.py

@@ -28,6 +28,7 @@
     DOMAIN,
     DOMAIN_TO_GOOGLE_TYPES,
     ERR_FUNCTION_NOT_SUPPORTED,
+    SOURCE_LOCAL,
     STORE_AGENT_USER_IDS,
 )
 from .error import SmartHomeError
@@ -232,7 +233,7 @@ async def _handle_local_webhook(self, hass, webhook_id, request):
             return json_response(smart_home.turned_off_response(payload))
 
         result = await smart_home.async_handle_message(
-            self.hass, self, self.local_sdk_user_id, payload
+            self.hass, self, self.local_sdk_user_id, payload, SOURCE_LOCAL
         )
 
         if _LOGGER.isEnabledFor(logging.DEBUG):
@@ -286,15 +287,22 @@ def __init__(
         self,
         config: AbstractConfig,
         user_id: str,
+        source: str,
         request_id: str,
         devices: Optional[List[dict]],
     ):
         """Initialize the request data."""
         self.config = config
+        self.source = source
         self.request_id = request_id
         self.context = Context(user_id=user_id)
         self.devices = devices
 
+    @property
+    def is_local_request(self):
+        """Return if this is a local request."""
+        return self.source == SOURCE_LOCAL
+
 
 def get_google_type(domain, device_class):
     """Google type based on domain and device class."""
@@ -354,6 +362,9 @@ def might_2fa(self) -> bool:
         features = state.attributes.get(ATTR_SUPPORTED_FEATURES, 0)
         device_class = state.attributes.get(ATTR_DEVICE_CLASS)
 
+        if not self.config.should_2fa(state):
+            return False
+
         return any(
             trait.might_2fa(domain, features, device_class) for trait in self.traits()
         )

homeassistant/components/google_assistant/http.py

@@ -30,6 +30,7 @@
     HOMEGRAPH_TOKEN_URL,
     REPORT_STATE_BASE_URL,
     REQUEST_SYNC_BASE_URL,
+    SOURCE_CLOUD,
 )
 from .helpers import AbstractConfig
 from .smart_home import async_handle_message
@@ -238,6 +239,10 @@ async def post(self, request: Request) -> Response:
         """Handle Google Assistant requests."""
         message: dict = await request.json()
         result = await async_handle_message(
-            request.app["hass"], self.config, request["hass_user"].id, message
+            request.app["hass"],
+            self.config,
+            request["hass_user"].id,
+            message,
+            SOURCE_CLOUD,
         )
         return self.json(result)

homeassistant/components/google_assistant/smart_home.py

@@ -21,9 +21,11 @@
 _LOGGER = logging.getLogger(__name__)
 
 
-async def async_handle_message(hass, config, user_id, message):
+async def async_handle_message(hass, config, user_id, message, source):
     """Handle incoming API messages."""
-    data = RequestData(config, user_id, message["requestId"], message.get("devices"))
+    data = RequestData(
+        config, user_id, source, message["requestId"], message.get("devices")
+    )
 
     response = await _process(hass, data, message)
 
@@ -75,7 +77,9 @@ async def async_devices_sync(hass, data, payload):
     https://developers.google.com/assistant/smarthome/develop/process-intents#SYNC
     """
     hass.bus.async_fire(
-        EVENT_SYNC_RECEIVED, {"request_id": data.request_id}, context=data.context
+        EVENT_SYNC_RECEIVED,
+        {"request_id": data.request_id, "source": data.source},
+        context=data.context,
     )
 
     agent_user_id = data.config.get_agent_user_id(data.context)
@@ -108,7 +112,11 @@ async def async_devices_query(hass, data, payload):
 
         hass.bus.async_fire(
             EVENT_QUERY_RECEIVED,
-            {"request_id": data.request_id, ATTR_ENTITY_ID: devid},
+            {
+                "request_id": data.request_id,
+                ATTR_ENTITY_ID: devid,
+                "source": data.source,
+            },
             context=data.context,
         )
 
@@ -142,6 +150,7 @@ async def handle_devices_execute(hass, data, payload):
                     "request_id": data.request_id,
                     ATTR_ENTITY_ID: entity_id,
                     "execution": execution,
+                    "source": data.source,
                 },
                 context=data.context,
             )
@@ -234,7 +243,9 @@ async def async_devices_reachable(hass, data: RequestData, payload):
         "devices": [
             entity.reachable_device_serialize()
             for entity in async_get_entities(hass, data.config)
-            if entity.entity_id in google_ids and entity.should_expose()
+            if entity.entity_id in google_ids
+            and entity.should_expose()
+            and not entity.might_2fa()
         ]
     }
 

homeassistant/components/google_assistant/trait.py

@@ -1447,6 +1447,8 @@ def _verify_pin_challenge(data, state, challenge):
 
 
 def _verify_ack_challenge(data, state, challenge):
-    """Verify a pin challenge."""
+    """Verify an ack challenge."""
+    if not data.config.should_2fa(state):
+        return
     if not challenge or not challenge.get("ack"):
         raise ChallengeNeeded(CHALLENGE_ACK_NEEDED)

tests/components/google_assistant/__init__.py

@@ -22,6 +22,7 @@ def __init__(
         *,
         secure_devices_pin=None,
         should_expose=None,
+        should_2fa=None,
         entity_config=None,
         hass=None,
         local_sdk_webhook_id=None,