Advanced: Access Control

This guide explains modern access-control patterns for ChoreOps v1.0.x+, including Kiosk Mode for shared devices.

---

Warning

ChoreOps does enforce access control. If users are not linked to matching Home Assistant users, and Kiosk Mode is not enabled for shared-device assignee actions, you should expect authorization issues.

This matters most on shared devices such as wall tablets, where multiple people may be using the same Home Assistant session.

---

✅ Recommended Approach: Kiosk Mode (Primary)

If your assignees use a shared tablet (for example, a wall-mounted dashboard), the easiest setup is Kiosk Mode.

What it does

When enabled, Kiosk Mode allows specific assignee-facing dashboard actions without requiring the logged-in HA user to match the assignee’s linked ha_user_id.

• ✅ Assignee chore claim button can be used from shared dashboard sessions
• ✅ Assignee reward redeem/request button can be used from shared dashboard sessions
• ✅ Assignee chore disapprove can act as undo from an anonymous kiosk session when the chore is currently claimed
• ❌ Assignee reward disapprove still requires assignee identity match (or approver authorization path)
• ❌ Approve/disapprove authorization for approver/admin actions is unchanged
• ❌ Service-level authorization is unchanged

Where to enable it

• Open Options Flow → General Options
• Enable "Enable Kiosk Mode for Assignee Claims"

Security considerations

• Anyone with access to that shared device can submit assignee claims
• If sibling buttons are visible, sibling claims (and chore-undo presses) are possible
• Keep approver/admin dashboards and services separated from shared assignee devices

🔁 Alternative Approach: Shared Assignee User (Secondary)

If you prefer not to use Kiosk Mode, you can still use the older shared-account pattern.

How it works

• Create one HA account used by assignees on the shared device
• Link that account in user configuration where needed

Trade-offs

• Works for basic claim flows
• Can be harder to manage cleanly for multi-user households
• Also increases risk of sibling claims when all buttons are visible

🚦 Approval rules

Regardless of Kiosk Mode:

• ✅ Admin users can approve and disapprove chores/rewards across all assignees when the admin approval option is enabled
• ✅ Non-admin approvers can approve and disapprove chores/rewards only for assignees explicitly linked in their associated_user_ids
• ⚠️ Assignees can disapprove their own claimed items as undo
• ⚠️ With Kiosk Mode enabled, anonymous chore disapprove can trigger assignee undo for that button target
• ❌ Assignees cannot approve their own or sibling items

Admin approval option

In Options Flow → General Options, ChoreOps now includes Allow Home Assistant Admin Accounts to Approve.

• Default: enabled
• Enabled: Home Assistant admins keep the legacy behavior and can approve any assignee without an explicit approver link
• Disabled: Home Assistant admin accounts cannot use approval actions just because they are Home Assistant admins

Linked approver scope

For non-admin approval actions, ChoreOps now requires both of the following:

• The acting user record must have can_approve = true
• The target assignee must appear in that approver's associated assignee list

This means a non-admin user with approval capability is no longer treated as a global approver by default.

Important

Potential breaking change: if your setup previously relied on a non-admin approver having can_approve enabled without specific assignee links, that user will no longer be able to approve anyone until you add the intended assignee links in the Users configuration.

If you disable the admin approval option, Home Assistant admin accounts will no longer be able to approve chores or rewards through ChoreOps until you re-enable that option.

---

🧩 Suggested Setup Patterns

Single shared wall tablet (recommended):

• Use Kiosk Mode
• Restrict dashboard to assignee claim/redeem/undo cards only
• Keep approver/admin cards on approver-only dashboards/devices

Mixed personal devices + one family tablet:

• Keep normal user-linking for personal devices
• Enable Kiosk Mode for convenience on the family tablet
• Preserve approver-only access for approvals/services

---

🔍 Quick Comparison

Approach	Setup effort	Shared-device usability	Security control
Kiosk Mode	Low	High	Medium (device trust required)
Shared User	Medium	Medium	Medium (account visibility required)

---

Best Practices

• Use Kiosk Mode only on physically trusted devices
• Limit what shared dashboards can display and control
• Keep approver/service access on separate accounts and views
• Prefer unique user accounts when practical

---

Basic troubleshooting

If claim, redeem, or authorization errors appear in the Home Assistant UI:

1. Confirm the ChoreOps user is linked to the correct Home Assistant user for personal-device use.
2. If the dashboard is on a shared device like a wall tablet, enable Kiosk Mode for assignee claim and redeem convenience.
3. If Kiosk Mode is intentionally off on a shared device, expect assignee authorization problems unless the active Home Assistant session matches the linked user.
4. Verify the action matches the role. Kiosk Mode helps with assignee actions on shared devices, but it does not grant approver or admin permissions.
5. For non-admin approvers, confirm the target assignee is explicitly linked to that approver in the Users configuration.
6. If admin approvals unexpectedly fail, check whether Allow Home Assistant Admin Accounts to Approve is disabled in General Options.
7. If the issue still does not make sense, review Getting Started: Quick Start, Frequently asked questions (FAQ), and Technical: Troubleshooting.

Which document should I read next?

• Need the minimum setup path: Getting Started: Quick Start
• Need fast troubleshooting for common access problems: Frequently asked questions (FAQ)
• Need the broader technical troubleshooting flow: Technical: Troubleshooting

For legacy behavior notes, see Frequently asked questions (FAQ).