From 9302fc9a5184b45d1d57d5cc7de12019c85e050f Mon Sep 17 00:00:00 2001
From: Alexandre <44178713+alexbelgium@users.noreply.github.com>
Date: Wed, 19 Aug 2026 07:30:47 +0200
Subject: [PATCH] fix(komga): keep the reader inside the ingress panel (#2995)

* fix(komga): keep the reader inside the ingress panel

Komga's ui opens the reader with window.open(url, '_blank'). The Home
Assistant companion apps hand such a popup to an external browser, which
carries no ingress session cookie, so Home Assistant answers 401 before
Komga is reached.

Nginx now injects a small script into the ui shell that turns same origin
popups into a navigation in the current tab. The OAuth2 login popup, which
passes a window name and a feature string, and cross origin links are left
untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(komga): only intercept popups when resourceBaseUrl is known

Review feedback : the '/' fallback meant that if Komga ever stopped
setting window.resourceBaseUrl, every same origin _blank popup would be
captured -- and ingress shares the Home Assistant origin. Require the
base, and give it a trailing slash so a sibling path such as
<entry>/komgaX is not treated as being below <entry>/komga.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
---
 komga/CHANGELOG.md                          |  5 ++++-
 komga/config.yaml                           |  2 +-
 komga/rootfs/etc/nginx/servers/ingress.conf | 19 +++++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/komga/CHANGELOG.md b/komga/CHANGELOG.md
index e622104830..17f70745fa 100644
--- a/komga/CHANGELOG.md
+++ b/komga/CHANGELOG.md
@@ -1,4 +1,7 @@
- 
+## 1.26.3.1 (19-08-2026)
+
+- Fix : tapping `Read` in the Home Assistant companion app opened the reader in an external browser, which carries no ingress session cookie, so Home Assistant answered `401 Unauthorized` before Komga was reached ([#2994](https://github.com/alexbelgium/hassio-addons/issues/2994)). Komga opens the reader with `window.open(url, '_blank')` ; nginx now injects a script that turns that popup into a navigation of the ingress panel itself. Only http(s) urls below Komga's own base path are affected, so the OAuth2 login popup and links out of Komga keep their own window
+
 ## 1.26.3 (2026-08-13)
 - Update to latest version from gotson/komga (changelog : https://github.com/gotson/komga/releases)
 ## 1.26.1.4 (12-08-2026)
diff --git a/komga/config.yaml b/komga/config.yaml
index f7fb64f383..f5cb95baf8 100644
--- a/komga/config.yaml
+++ b/komga/config.yaml
@@ -101,4 +101,4 @@ schema:
 slug: komga
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/komga
-version: "1.26.3"
+version: "1.26.3.1"
diff --git a/komga/rootfs/etc/nginx/servers/ingress.conf b/komga/rootfs/etc/nginx/servers/ingress.conf
index 8a3d6d4b88..e38d69867b 100644
--- a/komga/rootfs/etc/nginx/servers/ingress.conf
+++ b/komga/rootfs/etc/nginx/servers/ingress.conf
@@ -60,6 +60,25 @@ server {
         # Only the json/xml document types are added here, so book pages are
         # never scanned.
         sub_filter "http://127.0.0.1:25600/komga" "%%ingress_entry%%/komga";
+
+        # Komga opens the reader with window.open(url, '_blank'). In the Home
+        # Assistant companion apps the ingress panel is a webview, which hands
+        # such a popup to an external browser : that browser carries no ingress
+        # session cookie, so Home Assistant answers 401 before Komga is even
+        # reached. Turn that popup into a navigation of the panel itself, but
+        # only for the call shape Komga uses (name _blank, no feature string)
+        # and only for http(s) urls below window.resourceBaseUrl. That leaves
+        # the OAuth2 login popup (window.open(url, 'oauth2Login', '<features>'),
+        # which needs its own window), blob urls and links out of Komga alone,
+        # and if Komga ever stopped setting resourceBaseUrl the popup is left
+        # untouched rather than widened to the whole Home Assistant origin,
+        # which ingress shares. Anchored on the single page app mount point :
+        # both Komga ui shells carry it once, and only a book served as
+        # text/html rather than the xhtml the epub spec mandates could collide
+        # with it -- the same exposure the /komga filter above already has, and
+        # Komga sends script-src 'none' on that endpoint.
+        sub_filter "<div id=\"app\">" "<script>(function(){var o=window.open;window.open=function(u,n,f){try{var b=window.resourceBaseUrl;if(u&&n==='_blank'&&!f&&b){if(b.slice(-1)!=='/')b+='/';var t=new URL(u,location.href);if((t.protocol==='http:'||t.protocol==='https:')&&t.origin===location.origin&&t.pathname.indexOf(b)===0){location.assign(t.href);return window}}}catch(e){}return o.apply(window,arguments)}})();</script><div id=\"app\">";
+
         sub_filter_types application/json application/webpub+json
                          application/divina+json application/opds+json
                          application/atom+xml;