Requiring PIN With Local Assist

[sinful fulcrum]

I recently got my first Home Assistant Voice PE, and so I've been exploring Assist's voice control capabilities a lot more. However, I noticed something that seems (in my opinion) to be a flaw. For my front door lock, the voice assistant settings allows me to require a PIN for Google Assistant, but I can't require a PIN for Assist. This seems like a real security vulnerability because I can just say "Hey Jarvis, unlock the front door," and it unlocks without asking for any kind of PIN. Am I just crazy and not looking in the right place?

[stray comet]

so this is something that is not supported directly.
however you could build a solution to do this.
remove the lock entity from being exposed directly so assist cant control it.
then create an automation triggered by a custom sentence to unlock the door.
then you could have "Hey Jarvis, Unlock the door one two three four" trigger the unlock.
depending on your exact setup you could probably set it up as a back and forth with "unlock" "pin please" "one two three four" but its probably just easier to have it on the one sentence trigger.

[placid bramble]

I've been trying to find anything about that back & forth suggestion, but haven't seen any docs. Do you have a reference you could point me at?

[stray comet]

you would have to use the ask question satellite action then deal with the response. I am pretty sure you could build something but its not something I have tried.

or if you have a llm connected you could probably built it into the prompt

just having a basic custom sentence trigger with the pin built into it would be the easy solution

then you could have a trigger for "unlock the door" which gets the response "access denied" but have the trigger "unlock the door one two three four" which does unlock it.

[placid bramble]

Thanks for the pointer at the ask question. I got it all to work. For the OP, here is my automation:

description: ""
triggers:
  - trigger: conversation
    command: Unlock the front door
conditions: []
actions:
  - variables:
      voice_code_response: null
  - action: assist_satellite.ask_question
    metadata: {}
    data:
      question: What is the voice code?
      preannounce: false
      entity_id: "{{ trigger.satellite_id }}"
    response_variable: voice_code_response
  - choose:
      - conditions:
          - condition: template
            value_template: |-
              {% set raw = voice_code_response.sentence | default('') %}
              {% set numbers_only = raw | regex_replace('[^0-9]', '') %}

              {{ numbers_only == '1234' }}
        sequence:
          - alias: Announce unlocking
            action: assist_satellite.announce
            metadata: {}
            target:
              entity_id: "{{ trigger.satellite_id }}"
            data:
              message: Unlocking the front door.
              preannounce: false
          - action: lock.unlock
            metadata: {}
            target:
              entity_id: lock.front_door_lock
            data: {}
        alias: Correct Code
    default:
      - alias: Announce invalid code
        action: assist_satellite.announce
        metadata: {}
        target:
          entity_id: "{{ trigger.satellite_id }}"
        data:
          message: Invalid code.
          preannounce: false
mode: single

[stray comet]

no worries, this was more or less what I was envisioning in concept. the regex replace to solve the STT returning words is a great solution.

[placid bramble]

Yeah, during initial testing, it wanted to include other things like punctuation.

Now, just to figure out if I can somehow replace the default intent_script for this to then apply for all locks. I'm still digging on that, but my initial hope was dashed when I saw it uses the turn on/off intent...

[stray comet]

You could move the logic to a script.
then call the script from an automation with variables.

trigger: unlock xyz door
call unlock-script with variables: "door=xyz" "sattelite=abc"

then you just add your door specific configs to the script.

[placid bramble]

Yeah, I'm more trying streamline the intent approach so that the locks just need to be "exposed" to Assist.

[stray comet]

gotcha, having the option to add some level of security to specific intents would be something that would be useful.

[sinful fulcrum]

Y'all rock, thank you so much for the help. I'll test it out for myself!

What would be the best way to debug this in my system? I keep getting an invalid code response, but I'm not seeing the STT transcription in the debug menu for my voice satellite to check what it thinks I'm saying... (I'm pretty new to all the voice stuff admittedly)

[stray comet]

what are you using for STT?
are you looking at the debug trace of the correct pipeline? what is it actually showing?

[sinful fulcrum]

Ah, sorry I found it in the traces. It's an issue with background noise being picked up as speech. Need to duck my media in the room more agressively.

[stray comet]

yeah, that's a thing. better filtering is one of the big things that the open voice stack really needs.

[sinful fulcrum]

Do you know what the right way would be to trim any blank spaces from the code input would be? I just tried again, and this time I had an issue where it seems that the transcription included a space before the first number.