From 6817d27c91c0b59941b757d62a3b2598e90359c2 Mon Sep 17 00:00:00 2001
From: Dermot Duffy <dermot.duffy@gmail.com>
Date: Thu, 23 Jul 2026 09:42:05 -0700
Subject: [PATCH] fix: Guard the ha provider MJPEG stream URL against a missing
 access_token (#2602)

- Closes: #2601
---
 src/patches/ha-camera-stream.ts | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/src/patches/ha-camera-stream.ts b/src/patches/ha-camera-stream.ts
index 2878244c..609ddb23 100644
--- a/src/patches/ha-camera-stream.ts
+++ b/src/patches/ha-camera-stream.ts
@@ -56,8 +56,10 @@ void customElements.whenDefined('ha-camera-stream').then(() => {
   // - https://github.com/home-assistant/frontend/blob/dev/src/common/entity/compute_state_name.ts
   // - https://github.com/home-assistant/frontend/blob/dev/src/common/entity/compute_object_id.ts
   // ========================================================================================
-  const computeMJPEGStreamUrl = (entity: CameraEntity): string =>
-    `/api/camera_proxy_stream/${entity.entity_id}?token=${entity.attributes.access_token}`;
+  const computeMJPEGStreamUrl = (entity: CameraEntity): string | undefined =>
+    entity.attributes.access_token
+      ? `/api/camera_proxy_stream/${entity.entity_id}?token=${entity.attributes.access_token}`
+      : undefined;
 
   const STREAM_TYPE_HLS = 'hls';
   const STREAM_TYPE_WEB_RTC = 'web_rtc';
@@ -188,15 +190,23 @@ void customElements.whenDefined('ha-camera-stream').then(() => {
         return nothing;
       }
       if (stream.type === STREAM_TYPE_MJPEG) {
+        // A missing `access_token` (e.g. transient token rotation) yields no
+        // URL; render nothing rather than a broken `token=undefined` image.
+        const url =
+          typeof this._connected == 'undefined' || this._connected
+            ? computeMJPEGStreamUrl(this.stateObj)
+            : this._posterUrl;
+        if (!url) {
+          return nothing;
+        }
+
         return html`
           <advanced-camera-card-image-player
             .targetID=${this.targetID}
             @advanced-camera-card:media:loaded=${(
               ev: CustomEvent<MediaLoadedInfoEventDetail>,
             ) => this._captureInnerLoad(STREAM_TYPE_MJPEG, ev)}
-            url=${typeof this._connected == 'undefined' || this._connected
-              ? computeMJPEGStreamUrl(this.stateObj)
-              : this._posterUrl || ''}
+            url=${url}
             technology="mjpeg"
             class="player"
           ></advanced-camera-card-image-player>