From 9b569268abc1cc5eda7e525d76540db7284e9134 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Joakim=20S=C3=B8rensen?= <joasoe@gmail.com>
Date: Thu, 25 Feb 2021 23:29:39 +0100
Subject: [PATCH] Fix add-on updates (#2632)

* Fix add-on updates

* Add to security role
---
 supervisor/api/addons.py   | 12 ------------
 supervisor/api/security.py |  1 +
 supervisor/api/store.py    | 15 ++++++++++-----
 3 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/supervisor/api/addons.py b/supervisor/api/addons.py
index 7b590e60f..df94467b3 100644
--- a/supervisor/api/addons.py
+++ b/supervisor/api/addons.py
@@ -387,12 +387,6 @@ class APIAddons(CoreSysAttributes):
             ATTR_BLK_WRITE: stats.blk_write,
         }
 
-    @api_process
-    def install(self, request: web.Request) -> Awaitable[None]:
-        """Install add-on."""
-        addon = self._extract_addon(request)
-        return asyncio.shield(addon.install())
-
     @api_process
     def uninstall(self, request: web.Request) -> Awaitable[None]:
         """Uninstall add-on."""
@@ -411,12 +405,6 @@ class APIAddons(CoreSysAttributes):
         addon = self._extract_addon_installed(request)
         return asyncio.shield(addon.stop())
 
-    @api_process
-    def update(self, request: web.Request) -> Awaitable[None]:
-        """Update add-on."""
-        addon: Addon = self._extract_addon_installed(request)
-        return asyncio.shield(addon.update())
-
     @api_process
     def restart(self, request: web.Request) -> Awaitable[None]:
         """Restart add-on."""
diff --git a/supervisor/api/security.py b/supervisor/api/security.py
index 2677c5abf..7352a5ff6 100644
--- a/supervisor/api/security.py
+++ b/supervisor/api/security.py
@@ -99,6 +99,7 @@ ADDONS_ROLE_ACCESS = {
         r"|/os/.+"
         r"|/resolution/.+"
         r"|/snapshots.*"
+        r"|/store.*"
         r"|/supervisor/.+"
         r")$"
     ),
diff --git a/supervisor/api/store.py b/supervisor/api/store.py
index 6631df520..d231833ea 100644
--- a/supervisor/api/store.py
+++ b/supervisor/api/store.py
@@ -4,6 +4,7 @@ from typing import Any, Awaitable, Dict, List
 
 from aiohttp import web
 
+from ..addons import AnyAddon
 from ..api.utils import api_process
 from ..const import (
     ATTR_ADDONS,
@@ -36,12 +37,18 @@ from ..store.repository import Repository
 class APIStore(CoreSysAttributes):
     """Handle RESTful API for store functions."""
 
-    def _extract_addon(self, request: web.Request) -> AddonStore:
+    def _extract_addon(self, request: web.Request, installed=False) -> AnyAddon:
         """Return add-on, throw an exception it it doesn't exist."""
         addon_slug: str = request.match_info.get("addon")
         addon_version: str = request.match_info.get("version", "latest")
 
-        addon = self.sys_addons.store.get(addon_slug)
+        if installed:
+            addon = self.sys_addons.local.get(addon_slug)
+            if addon is None or not addon.is_installed:
+                raise APIError(f"Addon {addon_slug} is not installed")
+        else:
+            addon = self.sys_addons.store.get(addon_slug)
+
         if not addon:
             raise APIError(
                 f"Addon {addon_slug} with version {addon_version} does not exist in the store"
@@ -128,9 +135,7 @@ class APIStore(CoreSysAttributes):
     @api_process
     def addons_addon_update(self, request: web.Request) -> Awaitable[None]:
         """Update add-on."""
-        addon = self._extract_addon(request)
-        if not addon.is_installed:
-            raise APIError(f"Addon {addon.slug} is not installed")
+        addon = self._extract_addon(request, installed=True)
         return asyncio.shield(addon.update())
 
     @api_process