web: use manifest_hash and effective_url when triggering an install

This ensures that the exact bundle (content) that the user agreed to
install is actually installed.

Signed-off-by: Leonard Göhrs <[email protected]>

Author: hnez

web/src/TacComponents.tsx

@@ -115,6 +115,8 @@ type Duration = {
 type UpstreamBundle = {
   compatible: string;
   version: string;
+  manifest_hash: string;
+  effective_url: string;
   newer_than_installed: boolean;
 };
 
@@ -129,6 +131,11 @@ type Channel = {
   bundle?: UpstreamBundle;
 };
 
+type UpdateRequest = {
+  manifest_hash: string;
+  url: string;
+};
+
 interface SlotStatusProps {
   setCmdHint: (hint: React.ReactNode | null) => void;
 }
@@ -402,11 +409,16 @@ export function UpdateChannels(props: UpdateChannelsProps) {
               return "Up to date";
             }
 
+            const request: UpdateRequest = {
+              manifest_hash: e.bundle.manifest_hash,
+              url: e.bundle.effective_url,
+            };
+
             return (
               <MqttButton
                 iconName="download"
                 topic="/v1/tac/update/install"
-                send={e.url}
+                send={request}
               >
                 Upgrade
               </MqttButton>
@@ -539,7 +551,16 @@ export function UpdateNotification() {
   if (channels !== undefined) {
     for (let ch of channels) {
       if (ch.enabled && ch.bundle && ch.bundle.newer_than_installed) {
-        updates.push(ch);
+        const request: UpdateRequest = {
+          manifest_hash: ch.bundle.manifest_hash,
+          url: ch.bundle.effective_url,
+        };
+
+        updates.push({
+          name: ch.name,
+          display_name: ch.display_name,
+          request: request,
+        });
       }
     }
   }
@@ -549,7 +570,7 @@ export function UpdateNotification() {
       key={u.name}
       iconName="download"
       topic="/v1/tac/update/install"
-      send={u.url}
+      send={u.request}
     >
       Install new {u.display_name} bundle
     </MqttButton>