From 5d35543444fd99e218ff824cdde5540ecb62762d Mon Sep 17 00:00:00 2001
From: HomeCore <admin@home-core.co.uk>
Date: Wed, 16 Sep 2026 11:26:12 +0000
Subject: [PATCH] HomeCore Controller v0.1.4 fix ingress commissioning

---
 homecore_controller/CHANGELOG.md |  8 ++++++
 homecore_controller/app/main.py  | 43 ++++++++++++++++++++++++++++----
 homecore_controller/config.yaml  |  2 +-
 3 files changed, 47 insertions(+), 6 deletions(-)

diff --git a/homecore_controller/CHANGELOG.md b/homecore_controller/CHANGELOG.md
index 9e9b561..bc65cdd 100644
--- a/homecore_controller/CHANGELOG.md
+++ b/homecore_controller/CHANGELOG.md
@@ -1,5 +1,13 @@
 # HomeCore Controller Changelog
 
+## 0.1.4
+
+- Fixed Home Assistant Ingress commissioning form routing.
+- Login and property-selection forms now submit to the ingress root.
+- Removed dependency on generated Home Assistant sidebar URL prefixes.
+- Preserves Admin-controlled automatic update system.
+- Preserves Owner-only existing-home selection and permanent controller binding.
+
 ## 0.1.3
 
 - Fixed HomeCore commissioning page startup syntax error.
diff --git a/homecore_controller/app/main.py b/homecore_controller/app/main.py
index fdc1886..3833a0d 100644
--- a/homecore_controller/app/main.py
+++ b/homecore_controller/app/main.py
@@ -16,7 +16,7 @@ from cryptography.hazmat.primitives import serialization
 import uvicorn
 from updater import start_update_manager
 
-VERSION = "0.1.3"
+VERSION = "0.1.4"
 
 DATA = Path("/config")
 DATA.mkdir(parents=True, exist_ok=True)
@@ -280,8 +280,8 @@ def setup_page():
         '<p>Sign in with the customer\'s HomeCore Owner account. '
         'You will then choose one of the homes already created in HomeCore.</p>'
 
-        '<form method="post" '
-        "onsubmit=\"return homecoreAction(this,'select-property')\">"
+        '<form method="post" action="">'
+        '<input type="hidden" name="stage" value="select-property">'
 
         '<label>Owner email</label>'
         '<input name="email" type="email" autocomplete="email" required>'
@@ -297,6 +297,39 @@ def setup_page():
         '</p>'
     )
 
+
+@app.post("/", response_class=HTMLResponse)
+def ingress_form_submit(
+    stage: str = Form(...),
+    email: str = Form(""),
+    password: str = Form(""),
+    nonce: str = Form(""),
+    property_id: str = Form(""),
+):
+    """
+    All commissioning forms submit to the ingress root.
+
+    This deliberately avoids nested browser paths because Home Assistant
+    Ingress owns the external URL prefix.
+    """
+
+    if stage == "select-property":
+        return select_property(
+            email=email,
+            password=password,
+        )
+
+    if stage == "bind":
+        return bind(
+            nonce=nonce,
+            property_id=property_id,
+        )
+
+    return error_page(
+        "Unknown HomeCore setup step."
+    )
+
+
 @app.post("/select-property", response_class=HTMLResponse)
 def select_property(
     email: str = Form(...),
@@ -368,8 +401,8 @@ def select_property(
         '<h2>Select the customer home</h2>'
         '<p>Only homes owned by this HomeCore account can be connected.</p>'
 
-        '<form method="post" '
-        "onsubmit=\"return homecoreAction(this,'bind')\">"
+        '<form method="post" action="">'
+        '<input type="hidden" name="stage" value="bind">'
 
         f'<input type="hidden" name="nonce" value="{html.escape(nonce)}">'
 
diff --git a/homecore_controller/config.yaml b/homecore_controller/config.yaml
index 76d9af5..5e50625 100644
--- a/homecore_controller/config.yaml
+++ b/homecore_controller/config.yaml
@@ -1,5 +1,5 @@
 name: HomeCore Controller
-version: "0.1.3"
+version: "0.1.4"
 slug: homecore_controller
 description: HomeCore local controller agent for Home Assistant Green.
 url: https://homecore.home-core.co.uk