Verify behavioural changes on the VM. If the release changes enforcement,
deploy the changed files to the test instance and re-run the relevant check
before tagging — a green suite is not the finish line for this project. The
test box is the OrbStack machine hassio13; the integration lives in the
homeassistant container at /config/custom_components/ha_rbac, mounted on
the host at /var/lib/homeassistant/homeassistant/custom_components/ha_rbac.
Deploy a file and restart:
cat custom_components/ha_rbac/decide.py | \
orb -m hassio13 bash -c 'sudo tee /var/lib/homeassistant/homeassistant/custom_components/ha_rbac/decide.py >/dev/null'
orb -m hassio13 bash -c 'sudo docker restart homeassistant'
A config-entry reload is not enough — Python caches the imported modules, so
code changes need a full HA restart to take effect.
Frontend changes need the manifest version bumped too, or you are testing
the old panel. __init__.py registers the panel as
ha-rbac-panel.js?v={integration.version}, so the browser keys its cache on
the version in manifest.json — which on the VM is whatever was last
installed there, not what you just deployed. Deploying the JS alone leaves
the URL unchanged and the browser serves the cached copy forever. A restart
does not help; neither does a normal reload. Bump it before testing:
orb -m hassio13 bash -c 'sudo python3 -c "
import json; p=\"/var/lib/homeassistant/homeassistant/custom_components/ha_rbac/manifest.json\"
d=json.load(open(p)); d[\"version\"]=\"0.0.0-test\"; json.dump(d,open(p,\"w\"),indent=2)"'
Then confirm what is actually being served before believing any UI result:
orb -m hassio13 bash -c 'sudo grep -c "<a string only your change contains>" \
/var/lib/homeassistant/homeassistant/custom_components/ha_rbac/frontend/ha-rbac-panel.js'
This has burned a whole debugging session: a panel fix was deployed, restarted
and declared broken three times while the browser ran a build from 0.11.0.
To drive the panel in a browser, mint a token — do not try to log in. The
owner's refresh tokens are in .storage/auth; exchange one for an access
token and write hassTokens into the origin's localStorage. The clientId
must match the origin you are browsing (http://192.168.139.96:8123/), not
127.0.0.1, or the frontend rejects it. Note the panel refuses
ha_rbac/roles/list for any non-admin, so a Guest session shows an error card
and no editor — check which user the session belongs to before concluding
anything about the UI.