Breaking Changes

http.api_password config is deprecated, please add legacy_api_password auth provider if you still want to use api_password as authentication.

For example, if you have following configuration in previous release

# prior 0.90
homeassistant:
  auth_providers:
   - type: homeassistant
   - type: legacy_api_password
http:
  api_password: 12345678

You will get invalid configuration error in 0.90, because api_password config is required options for legacy_api_password auth provider now. You need to change your configuration.yaml to

# after 0.90
homeassistant:
  auth_providers:
   - type: homeassistant
   - type: legacy_api_password
     api_password: 12345678
http:

However, if you don't have auth_providers under your homeassistant configuration section, for example

# prior 0.90
homeassistant:

http:
  api_password: 12345678

We will give your more time to migrate your configuration, your HA system can still start up, we will load a legacy_api_password auth provider with api_password for you. However, you will receive a warning message to remind you change to the new configuration.

Please note, api_password authentication will eventually be removed, we advise user change to use one of other authentication methods.

Description:

This PR is one more step towards our goal to remove api_password entirely. Now, api_password no long lives in http component, all logic moved to legacy_api_password auth provider.

This PR does not change the way we do authentication, use api_password in query or header is still valid method, but we will print out INFO level log to remind user move away from those method. I am planning increase them to WARN level maybe in 0.91 release.

Detail changes

• rewrote http auth middleware, better code structure, no function changes
• deprecated http.api_password
• removed hass.confg.api.api_password
• removed password from hassio /homeassistant/options command's payload
• add few AuthManager helper functions
• some house clean up

Related issue (if applicable): fixes #

Pull request in home-assistant.io with documentation (if applicable): home-assistant/home-assistant.io#8894

Example entry for configuration.yaml (if applicable):

homeassistant:
  auth_providers:
   - type: homeassistant
   - type: legacy_api_password
      api_password: 12345678
http:

Checklist:

• The code change is tested and works locally.
• Local tests pass with tox. Your PR cannot be merged unless tests pass
• There is no commented out code in this PR.

If user exposed functionality or configuration variables are added/changed:

• Documentation added/updated in home-assistant.io

If the code does not interact with devices:

• Tests have been added to verify that the new code works.