Fix Nintendo parental-controls PIN service authorization (#177297)

homeassistant/components/nintendo_parental_controls/services.py

@@ -9,7 +9,11 @@ import voluptuous as vol
 from homeassistant.const import ATTR_DEVICE_ID, CONF_PIN
 from homeassistant.core import HomeAssistant, ServiceCall, callback
 from homeassistant.exceptions import ServiceValidationError
-from homeassistant.helpers import config_validation as cv, device_registry as dr
+from homeassistant.helpers import (
+    config_validation as cv,
+    device_registry as dr,
+    service,
+)
 
 from .const import ATTR_BONUS_TIME, DOMAIN
 from .coordinator import NintendoParentalControlsConfigEntry
@@ -40,11 +44,12 @@ def async_setup_services(
             }
         ),
     )
-    hass.services.async_register(
-        domain=DOMAIN,
-        service=NintendoParentalServices.UPDATE_PIN_CODE,
-        service_func=async_update_pin_code,
-        schema=vol.Schema(
+    service.async_register_admin_service(
+        hass,
+        DOMAIN,
+        NintendoParentalServices.UPDATE_PIN_CODE,
+        async_update_pin_code,
+        vol.Schema(
             {
                 vol.Required(ATTR_DEVICE_ID): cv.string,
                 vol.Required(CONF_PIN): cv.string,

tests/components/nintendo_parental_controls/test_services.py

@@ -13,13 +13,13 @@ from homeassistant.components.nintendo_parental_controls.services import (
     NintendoParentalServices,
 )
 from homeassistant.const import ATTR_DEVICE_ID, CONF_PIN
-from homeassistant.core import HomeAssistant
-from homeassistant.exceptions import ServiceValidationError
+from homeassistant.core import Context, HomeAssistant
+from homeassistant.exceptions import ServiceValidationError, Unauthorized
 from homeassistant.helpers import device_registry as dr
 
 from . import setup_integration
 
-from tests.common import MockConfigEntry
+from tests.common import MockConfigEntry, MockUser
 
 
 async def test_add_bonus_time(
@@ -163,3 +163,31 @@ async def test_update_pin_code(
         blocking=True,
     )
     assert len(mock_nintendo_device.set_new_pin.mock_calls) == 1
+
+
+async def test_update_pin_code_requires_admin(
+    hass: HomeAssistant,
+    device_registry: dr.DeviceRegistry,
+    hass_read_only_user: MockUser,
+    mock_config_entry: MockConfigEntry,
+    mock_nintendo_client: AsyncMock,
+    mock_nintendo_device: AsyncMock,
+) -> None:
+    """Test updating the PIN code requires administrator access."""
+    await setup_integration(hass, mock_config_entry)
+    device_entry = device_registry.async_get_device_by_identifier(
+        (DOMAIN, "testdevid"), mock_config_entry.entry_id
+    )
+    assert device_entry
+    with pytest.raises(Unauthorized):
+        await hass.services.async_call(
+            DOMAIN,
+            NintendoParentalServices.UPDATE_PIN_CODE,
+            {
+                ATTR_DEVICE_ID: device_entry.id,
+                CONF_PIN: "1234",
+            },
+            blocking=True,
+            context=Context(user_id=hass_read_only_user.id),
+        )
+    mock_nintendo_device.set_new_pin.assert_not_called()