Deprecate legacy api auth provider (#104409)

Co-authored-by: Franck Nijhof <git@frenck.dev>

homeassistant/auth/providers/legacy_api_password.py

@@ -10,10 +10,11 @@ from typing import Any, cast
 
 import voluptuous as vol
 
-from homeassistant.core import callback
+from homeassistant.core import async_get_hass, callback
 from homeassistant.data_entry_flow import FlowResult
 from homeassistant.exceptions import HomeAssistantError
 import homeassistant.helpers.config_validation as cv
+from homeassistant.helpers.issue_registry import IssueSeverity, async_create_issue
 
 from ..models import Credentials, UserMeta
 from . import AUTH_PROVIDER_SCHEMA, AUTH_PROVIDERS, AuthProvider, LoginFlow
@@ -21,10 +22,28 @@ from . import AUTH_PROVIDER_SCHEMA, AUTH_PROVIDERS, AuthProvider, LoginFlow
 AUTH_PROVIDER_TYPE = "legacy_api_password"
 CONF_API_PASSWORD = "api_password"
 
-CONFIG_SCHEMA = AUTH_PROVIDER_SCHEMA.extend(
+_CONFIG_SCHEMA = AUTH_PROVIDER_SCHEMA.extend(
     {vol.Required(CONF_API_PASSWORD): cv.string}, extra=vol.PREVENT_EXTRA
 )
 
+
+def _create_repair_and_validate(config: dict[str, Any]) -> dict[str, Any]:
+    async_create_issue(
+        async_get_hass(),
+        "auth",
+        "deprecated_legacy_api_password",
+        breaks_in_ha_version="2024.6.0",
+        is_fixable=False,
+        severity=IssueSeverity.WARNING,
+        translation_key="deprecated_legacy_api_password",
+    )
+
+    return _CONFIG_SCHEMA(config)  # type: ignore[no-any-return]
+
+
+CONFIG_SCHEMA = _create_repair_and_validate
+
+
 LEGACY_USER_NAME = "Legacy API password user"
 
 

homeassistant/components/auth/strings.json

@@ -31,5 +31,11 @@
         "invalid_code": "Invalid code, please try again."
       }
     }
+  },
+  "issues": {
+    "deprecated_legacy_api_password": {
+      "title": "The legacy API password is deprecated",
+      "description": "The legacy API password authentication provider is deprecated and will be removed. Please remove it from your YAML configuration and use the default Home Assistant authentication provider instead."
+    }
   }
 }

script/hassfest/translations.py

@@ -215,6 +215,29 @@ def gen_data_entry_schema(
     return vol.All(*validators)
 
 
+def gen_issues_schema(config: Config, integration: Integration) -> dict[str, Any]:
+    """Generate the issues schema."""
+    return {
+        str: vol.All(
+            cv.has_at_least_one_key("description", "fix_flow"),
+            vol.Schema(
+                {
+                    vol.Required("title"): translation_value_validator,
+                    vol.Exclusive(
+                        "description", "fixable"
+                    ): translation_value_validator,
+                    vol.Exclusive("fix_flow", "fixable"): gen_data_entry_schema(
+                        config=config,
+                        integration=integration,
+                        flow_title=UNDEFINED,
+                        require_step_title=False,
+                    ),
+                },
+            ),
+        )
+    }
+
+
 def gen_strings_schema(config: Config, integration: Integration) -> vol.Schema:
     """Generate a strings schema."""
     return vol.Schema(
@@ -266,25 +289,7 @@ def gen_strings_schema(config: Config, integration: Integration) -> vol.Schema:
             vol.Optional("application_credentials"): {
                 vol.Optional("description"): translation_value_validator,
             },
-            vol.Optional("issues"): {
+            vol.Optional("issues"): gen_issues_schema(config, integration),
-                str: vol.All(
-                    cv.has_at_least_one_key("description", "fix_flow"),
-                    vol.Schema(
-                        {
-                            vol.Required("title"): translation_value_validator,
-                            vol.Exclusive(
-                                "description", "fixable"
-                            ): translation_value_validator,
-                            vol.Exclusive("fix_flow", "fixable"): gen_data_entry_schema(
-                                config=config,
-                                integration=integration,
-                                flow_title=UNDEFINED,
-                                require_step_title=False,
-                            ),
-                        },
-                    ),
-                )
-            },
             vol.Optional("entity_component"): cv.schema_with_slug_keys(
                 {
                     vol.Optional("name"): str,
@@ -362,7 +367,8 @@ def gen_auth_schema(config: Config, integration: Integration) -> vol.Schema:
                     flow_title=REQUIRED,
                     require_step_title=True,
                 )
-            }
+            },
+            vol.Optional("issues"): gen_issues_schema(config, integration),
         }
     )
 

tests/auth/providers/test_legacy_api_password.py

@@ -5,6 +5,12 @@ from homeassistant import auth, data_entry_flow
 from homeassistant.auth import auth_store
 from homeassistant.auth.providers import legacy_api_password
 from homeassistant.core import HomeAssistant
+import homeassistant.helpers.issue_registry as ir
+from homeassistant.setup import async_setup_component
+
+from tests.common import ensure_auth_manager_loaded
+
+CONFIG = {"type": "legacy_api_password", "api_password": "test-password"}
 
 
 @pytest.fixture
@@ -16,9 +22,7 @@ def store(hass):
 @pytest.fixture
 def provider(hass, store):
     """Mock provider."""
-    return legacy_api_password.LegacyApiPasswordAuthProvider(
+    return legacy_api_password.LegacyApiPasswordAuthProvider(hass, store, CONFIG)
-        hass, store, {"type": "legacy_api_password", "api_password": "test-password"}
-    )
 
 
 @pytest.fixture
@@ -68,3 +72,15 @@ async def test_login_flow_works(hass: HomeAssistant, manager) -> None:
         flow_id=result["flow_id"], user_input={"password": "test-password"}
     )
     assert result["type"] == data_entry_flow.FlowResultType.CREATE_ENTRY
+
+
+async def test_create_repair_issue(hass: HomeAssistant):
+    """Test legacy api password auth provider creates a reapir issue."""
+    hass.auth = await auth.auth_manager_from_config(hass, [CONFIG], [])
+    ensure_auth_manager_loaded(hass.auth)
+    await async_setup_component(hass, "auth", {})
+    issue_registry: ir.IssueRegistry = ir.async_get(hass)
+
+    assert issue_registry.async_get_issue(
+        domain="auth", issue_id="deprecated_legacy_api_password"
+    )