From 56a5dcc7fb4791bd7505590a8768b6b4a4555d0d Mon Sep 17 00:00:00 2001
From: aL1aL7 <38977615+aL1aL7@users.noreply.github.com>
Date: Mon, 26 Oct 2020 11:54:21 +0100
Subject: [PATCH] alexa: fix device discovery / state callback

alexa device discovery/state calls use URL of type
/api/hash_id_key_whatever/lights

This is blocked when API is disabled and fails
also when http API is enabled because no apikey is
sent by amazon calls

This commit grabs the "whatever Amazon Hash" during
device recognition and save it. All requets to URLS
starting with /api/hash_id_key_whatever are now
passing the auth check
---
 code/espurna/api.cpp | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/code/espurna/api.cpp b/code/espurna/api.cpp
index 3dfa355404..1e28954af0 100644
--- a/code/espurna/api.cpp
+++ b/code/espurna/api.cpp
@@ -223,8 +223,37 @@ bool _apiRequestCallback(AsyncWebServerRequest* request) {
         return true;
     }
 
+    bool needAuth = true;
+    if ( getSetting("alexaEnabled", 1 == ALEXA_ENABLED) )
+    {
+        String alexaHash = getSetting("alexaHash", "none");
+        if ( (url.startsWith("/api/" + alexaHash)) && (alexaHash != "none") )
+        {
+
+            needAuth = false;
+        } else
+        {
+            if (url.equals("/description.xml")) {
+                if ( alexaHash != "in_progress" )
+                {
+                    setSetting("alexaHash", "in_progress");
+                }
+            } else if ( (url.startsWith("/api/")) && (url.endsWith("/lights")) && (alexaHash == "in_progress") )
+            {
+                alexaHash = url;
+                alexaHash.remove(alexaHash.length()-7,7); // strip "/lights"
+                alexaHash.remove(0,5); // strip "/api/"
+                setSetting("alexaHash", alexaHash);
+                needAuth = false;
+            } else if (alexaHash == "in_progress")
+            {
+                setSetting("alexaHash", "none");
+            }
+        }
+    }
+
     if (!url.startsWith("/api/")) return false;
-    if (!apiAuthenticate(request)) return false;
+    if (needAuth && !apiAuthenticate(request)) return false;
 
     return _apiDispatchRequest(url, request);