From 07563f4fd21d697a7f10075576bb446d0057ca98 Mon Sep 17 00:00:00 2001
From: Erik Montnemery <erik@montnemery.com>
Date: Wed, 26 Jan 2022 18:55:30 +0100
Subject: [PATCH] Disable google_assistant local SDK if SSL is enabled (#64983)

---
 .../components/google_assistant/helpers.py    | 15 +++++---
 .../google_assistant/test_helpers.py          | 34 +++++++++++++++++--
 2 files changed, 42 insertions(+), 7 deletions(-)

diff --git a/homeassistant/components/google_assistant/helpers.py b/homeassistant/components/google_assistant/helpers.py
index 84b1446f9de..b2201196917 100644
--- a/homeassistant/components/google_assistant/helpers.py
+++ b/homeassistant/components/google_assistant/helpers.py
@@ -275,13 +275,18 @@ class AbstractConfig(ABC):
     @callback
     def async_enable_local_sdk(self):
         """Enable the local SDK."""
-        setup_successfull = True
+        setup_successful = True
         setup_webhook_ids = []
 
+        # Don't enable local SDK if ssl is enabled
+        if self.hass.config.api and self.hass.config.api.use_ssl:
+            self._local_sdk_active = False
+            return
+
         for user_agent_id, _ in self._store.agent_user_ids.items():
 
             if (webhook_id := self.get_local_webhook_id(user_agent_id)) is None:
-                setup_successfull = False
+                setup_successful = False
                 break
 
             try:
@@ -300,17 +305,17 @@ class AbstractConfig(ABC):
                     webhook_id,
                     user_agent_id,
                 )
-                setup_successfull = False
+                setup_successful = False
                 break
 
-        if not setup_successfull:
+        if not setup_successful:
             _LOGGER.warning(
                 "Local fulfillment failed to setup, falling back to cloud fulfillment"
             )
             for setup_webhook_id in setup_webhook_ids:
                 webhook.async_unregister(self.hass, setup_webhook_id)
 
-        self._local_sdk_active = setup_successfull
+        self._local_sdk_active = setup_successful
 
     @callback
     def async_disable_local_sdk(self):
diff --git a/tests/components/google_assistant/test_helpers.py b/tests/components/google_assistant/test_helpers.py
index 2dbf43b7d1a..ff441e44f25 100644
--- a/tests/components/google_assistant/test_helpers.py
+++ b/tests/components/google_assistant/test_helpers.py
@@ -30,7 +30,7 @@ from tests.common import (
 async def test_google_entity_sync_serialize_with_local_sdk(hass):
     """Test sync serialize attributes of a GoogleEntity."""
     hass.states.async_set("light.ceiling_lights", "off")
-    hass.config.api = Mock(port=1234, use_ssl=True)
+    hass.config.api = Mock(port=1234, use_ssl=False)
     await async_process_ha_core_config(
         hass,
         {"external_url": "https://hostname:1234"},
@@ -58,7 +58,7 @@ async def test_google_entity_sync_serialize_with_local_sdk(hass):
         assert serialized["otherDeviceIds"] == [{"deviceId": "light.ceiling_lights"}]
         assert serialized["customData"] == {
             "httpPort": 1234,
-            "httpSSL": True,
+            "httpSSL": False,
             "proxyDeviceId": "mock-user-id",
             "webhookId": "mock-webhook-id",
             "baseUrl": "https://hostname:1234",
@@ -153,10 +153,12 @@ async def test_config_local_sdk_if_disabled(hass, hass_client):
         },
         enabled=False,
     )
+    assert not config.is_local_sdk_active
 
     client = await hass_client()
 
     config.async_enable_local_sdk()
+    assert config.is_local_sdk_active
 
     resp = await client.post(
         "/api/webhook/mock-webhook-id", json={"requestId": "mock-req-id"}
@@ -169,6 +171,7 @@ async def test_config_local_sdk_if_disabled(hass, hass_client):
     }
 
     config.async_disable_local_sdk()
+    assert not config.is_local_sdk_active
 
     # Webhook is no longer active
     resp = await client.post("/api/webhook/mock-webhook-id")
@@ -176,6 +179,33 @@ async def test_config_local_sdk_if_disabled(hass, hass_client):
     assert await resp.read() == b""
 
 
+async def test_config_local_sdk_if_ssl_enabled(hass, hass_client):
+    """Test the local SDK is not enabled when SSL is enabled."""
+    assert await async_setup_component(hass, "webhook", {})
+    hass.config.api.use_ssl = True
+
+    config = MockConfig(
+        hass=hass,
+        agent_user_ids={
+            "mock-user-id": {
+                STORE_GOOGLE_LOCAL_WEBHOOK_ID: "mock-webhook-id",
+            },
+        },
+        enabled=False,
+    )
+    assert not config.is_local_sdk_active
+
+    client = await hass_client()
+
+    config.async_enable_local_sdk()
+    assert not config.is_local_sdk_active
+
+    # Webhook should not be activated
+    resp = await client.post("/api/webhook/mock-webhook-id")
+    assert resp.status == HTTPStatus.OK
+    assert await resp.read() == b""
+
+
 async def test_agent_user_id_storage(hass, hass_storage):
     """Test a disconnect message."""