fix: add translations/en.json to resolve 500 on options flow

V2.5.0   improvements and tweaks

README.md

@@ -1,33 +1,98 @@
-## 1. Installation (HACS)
+# Shopping List Manager Integration for Home Assistant
 
-### Recommended
+The backend integration that powers the Shopping List Manager. Provides persistent multi-list storage, a 500+ product catalog, real-time WebSocket events, and a full API for the Lovelace card — all running natively inside Home Assistant.
+
+> **Pair with the [Shopping List Manager Card](https://github.com/thekiwismarthome/shopping-list-manager-card)** for the full UI experience.
 
 [![Open your Home Assistant instance and open this repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=thekiwismarthome&repository=shopping-list-manager&category=integration)
 
-1. Click the button above.
-2. Confirm adding the repository to HACS.
-3. Install **Shopping List Manager** from **HACS → Integrations**.
-4. Restart Home Assistant.
+---
+
+## Features
+
+### 🛒 Multi-List Management
+- Create and manage multiple shopping lists
+- Private or shared lists with per-member access control
+- Active list state shared across all connected devices and users
+- List total price calculation
+
+### 📦 Items
+- Add, update, check, and delete items with quantity and unit
+- Atomic quantity increment / decrement
+- Bulk check and clear checked items
+- Per-item pricing, notes, and category assignment
+
+### 🔍 Product Catalog
+- **500+ products** (NZ-focused, extensible to AU, US, GB, CA)
+- Fuzzy search with alias matching
+- Recently-used product suggestions
+- Custom product creation
+- Allergen filtering and product substitute groups
+- Product images (WebP, 200×200px, optimised)
+
+### 🗂️ Categories
+- 13 default categories — Produce, Dairy, Meat, Bakery, Pantry, Frozen, Beverages, Snacks, Household, Health, Pet, Baby, Other
+- Category colour coding and emoji icons
+- Per-list category ordering
+
+### 💳 Loyalty Cards
+- Store loyalty and rewards card data
+- Private or shared card access per user
+
+### 🔄 Real-Time Events
+- All changes fire events on the Home Assistant bus
+- Custom WebSocket subscription proxy so **non-admin users** receive live updates without requiring HA admin privileges
 
 ---
 
-### Manual Repository URL
+## Requirements
 
-https://github.com/thekiwismarthome/shopping-list-manager
-
-Repository type: **Integration**
+| Component | Minimum Version |
+|---|---|
+| Home Assistant | 2024.1 |
+| HACS | 2.x |
 
 ---
 
-## 2. Manual Installation (Optional)
+## Installation
 
-1. Copy the folder:
-custom_components/shopping_list_manager
+### Via HACS (Recommended)
 
-2. Paste it into:
-/config/custom_components/
+[![Open your Home Assistant instance and open this repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=thekiwismarthome&repository=shopping-list-manager&category=integration)
 
-3. Restart Home Assistant.
+1. Click the button above
+2. Confirm adding the repository to HACS
+3. Install **Shopping List Manager** from **HACS → Integrations**
+4. Restart Home Assistant
+5. Go to **Settings → Devices & Services → Add Integration** and search for **Shopping List Manager**
+
+### Manual Installation
+
+1. Copy the `custom_components/shopping_list_manager/` folder into your HA `/config/custom_components/` directory
+2. Restart Home Assistant
+3. Go to **Settings → Devices & Services → Add Integration** and search for **Shopping List Manager**
+
+---
+
+## Lovelace Card
+
+Install the companion card to get the full shopping UI:
 
-## 3. Shopping List Card to go with this Integration
 [![Open your Home Assistant instance and open this repository inside the Home Assistant Community Store.](https://my.home-assistant.io/badges/hacs_repository.svg)](https://my.home-assistant.io/redirect/hacs_repository/?owner=thekiwismarthome&repository=shopping-list-manager-card&category=plugin)
+
+---
+
+## Documentation
+
+Full documentation is available in the [Wiki](https://github.com/thekiwismarthome/shopping-list-manager/wiki).
+
+## Support & Feedback
+
+- [Open an Issue](https://github.com/thekiwismarthome/shopping-list-manager/issues)
+- [Home Assistant Community Forum](https://community.home-assistant.io)
+
+---
+
+## License
+
+MIT — see [LICENSE](LICENSE) for details.

custom_components/shopping_list_manager/__init__.py

@@ -171,6 +171,14 @@ async def _async_register_websocket_handlers(
     )
     
     # Products handlers
+    websocket_api.async_register_command(
+        hass,
+        handlers.websocket_download_product_image,
+    )
+    websocket_api.async_register_command(
+        hass,
+        handlers.websocket_search_by_barcode,
+    )
     websocket_api.async_register_command(
         hass,
         handlers.websocket_search_products,
@@ -192,11 +200,21 @@ async def _async_register_websocket_handlers(
         hass,
         handlers.websocket_update_product,
     )
+    websocket_api.async_register_command(
+        hass,
+        handlers.websocket_delete_product,
+    )
     websocket_api.async_register_command(
         hass,
         handlers.websocket_get_product_substitutes,
     )
     
+    # OpenFoodFacts proxy
+    websocket_api.async_register_command(
+        hass,
+        handlers.websocket_off_fetch,
+    )
+
     # Categories handlers
     websocket_api.async_register_command(
         hass,

custom_components/shopping_list_manager/const.py

@@ -76,7 +76,10 @@ IMAGE_FORMAT = "webp"
 IMAGE_SIZE = 200  # 200x200px
 IMAGE_QUALITY = 85
 IMAGE_MAX_SIZE_KB = 15
-IMAGES_LOCAL_DIR = "www/shopping_list_manager/images"
+IMAGES_LOCAL_DIR = "www/images/shopping_list_manager"
+LEGACY_IMAGES_LOCAL_DIR = "www/shopping_list_manager/images"
+LOCAL_IMAGE_URL_PREFIX = "/local/images/shopping_list_manager/"
+LEGACY_IMAGE_URL_PREFIX = "/local/shopping_list_manager/images/"
 
 # Placeholder image (inline SVG)
 PLACEHOLDER_IMAGE = "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='200' height='200'%3E%3Crect width='200' height='200' fill='%23f0f0f0'/%3E%3Ctext x='50%25' y='50%25' dominant-baseline='middle' text-anchor='middle' font-family='Arial' font-size='16' fill='%23999'%3ENo Image%3C/text%3E%3C/svg%3E"

custom_components/shopping_list_manager/storage.py

@@ -2,7 +2,9 @@
 import json
 import logging
 import os
+import shutil
 from datetime import datetime, timezone
+from pathlib import Path
 from typing import Dict, List, Optional, Any
 from .utils.search import ProductSearch
 from homeassistant.core import HomeAssistant
@@ -15,6 +17,10 @@ from .const import (
     STORAGE_KEY_PRODUCTS,
     STORAGE_KEY_CATEGORIES,
     STORAGE_KEY_LOYALTY_CARDS,
+    IMAGES_LOCAL_DIR,
+    LEGACY_IMAGES_LOCAL_DIR,
+    LOCAL_IMAGE_URL_PREFIX,
+    LEGACY_IMAGE_URL_PREFIX,
 )
 from .data.catalog_loader import load_product_catalog
 from .models import ShoppingList, Item, Product, Category, LoyaltyCard, generate_id
@@ -49,6 +55,8 @@ class ShoppingListStorage:
         self._categories: List[Category] = []
         self._loyalty_cards: Dict[str, LoyaltyCard] = {}
         self._search_engine: Optional[ProductSearch] = None
+        self._images_dir = Path(hass.config.path(IMAGES_LOCAL_DIR))
+        self._legacy_images_dir = Path(hass.config.path(LEGACY_IMAGES_LOCAL_DIR))
     
     async def async_load(self) -> None:
         """Load data from storage."""
@@ -89,6 +97,10 @@ class ShoppingListStorage:
                 for product_id, product_data in products_data.items()
             }
             _LOGGER.debug("Loaded %d products", len(self._products))
+
+        # Ensure image directory exists and migrate legacy image paths/URLs.
+        self._images_dir.mkdir(parents=True, exist_ok=True)
+        await self._migrate_legacy_images_and_urls()
         
         # Load categories
         categories_data = await self._store_categories.async_load()
@@ -419,6 +431,56 @@ class ShoppingListStorage:
         """Save products to storage."""
         data = {product_id: product.to_dict() for product_id, product in self._products.items()}
         await self._store_products.async_save(data)
+
+    async def _migrate_legacy_images_and_urls(self) -> None:
+        """Move old image files and rewrite stored URLs to the new path."""
+        moved_files = 0
+        updated_product_urls = 0
+        updated_item_urls = 0
+
+        if self._legacy_images_dir.exists() and self._legacy_images_dir != self._images_dir:
+            for src in self._legacy_images_dir.glob("*"):
+                if not src.is_file():
+                    continue
+                dest = self._images_dir / src.name
+                if dest.exists():
+                    continue
+                try:
+                    shutil.move(str(src), str(dest))
+                    moved_files += 1
+                except Exception as err:
+                    _LOGGER.debug("Could not move legacy image %s: %s", src, err)
+
+        for product in self._products.values():
+            image_url = product.image_url or ""
+            if image_url.startswith(LEGACY_IMAGE_URL_PREFIX):
+                product.image_url = image_url.replace(
+                    LEGACY_IMAGE_URL_PREFIX, LOCAL_IMAGE_URL_PREFIX, 1
+                )
+                updated_product_urls += 1
+
+        for items in self._items.values():
+            for item in items:
+                image_url = item.image_url or ""
+                if image_url.startswith(LEGACY_IMAGE_URL_PREFIX):
+                    item.image_url = image_url.replace(
+                        LEGACY_IMAGE_URL_PREFIX, LOCAL_IMAGE_URL_PREFIX, 1
+                    )
+                    updated_item_urls += 1
+
+        if updated_product_urls:
+            await self._save_products()
+        if updated_item_urls:
+            await self._save_items()
+
+        if moved_files or updated_product_urls or updated_item_urls:
+            _LOGGER.info(
+                "Migrated shopping list images to %s (moved_files=%d, updated_product_urls=%d, updated_item_urls=%d)",
+                IMAGES_LOCAL_DIR,
+                moved_files,
+                updated_product_urls,
+                updated_item_urls,
+            )
     
     def get_products(self) -> List[Product]:
         """Get all products."""
@@ -556,6 +618,18 @@ class ShoppingListStorage:
         _LOGGER.info("Reloaded catalog for %s: %d products imported", country_code, count)
         return count
 
+    async def delete_product(self, product_id: str) -> bool:
+        """Delete a product from the catalog."""
+        if product_id not in self._products:
+            return False
+        del self._products[product_id]
+        await self._save_products()
+        # Rebuild search engine so the product is no longer searchable
+        products_dict = {pid: p.to_dict() for pid, p in self._products.items()}
+        self._search_engine = ProductSearch(products_dict)
+        _LOGGER.debug("Deleted product: %s", product_id)
+        return True
+
     async def update_product(self, product_id: str, **kwargs) -> Optional[Product]:
         """Update a product."""
         if product_id not in self._products:

custom_components/shopping_list_manager/translations/en.json

@@ -0,0 +1,33 @@
+{
+  "config": {
+    "step": {
+      "user": {
+        "title": "Shopping List Manager",
+        "description": "Set up the Shopping List Manager integration. Country and other settings can be configured after setup via the Configure button."
+      }
+    },
+    "abort": {
+      "single_instance_allowed": "Only a single instance of Shopping List Manager is allowed."
+    }
+  },
+  "options": {
+    "step": {
+      "init": {
+        "title": "Shopping List Manager Options",
+        "description": "Changing country will reload the product catalog on next restart.",
+        "data": {
+          "country": "Country",
+          "enable_price_tracking": "Enable price tracking",
+          "enable_image_search": "Enable image search",
+          "metric_units_only": "Metric units only"
+        },
+        "data_description": {
+          "country": "Used to localise product catalog and pricing.",
+          "enable_price_tracking": "Track and display product prices.",
+          "enable_image_search": "Search for product images automatically.",
+          "metric_units_only": "Show only metric units (g, kg, ml, L)."
+        }
+      }
+    }
+  }
+}

custom_components/shopping_list_manager/utils/images.py

@@ -1,9 +1,15 @@
 """Image handling utilities for Shopping List Manager."""
 import logging
-import os
+import shutil
 from pathlib import Path
 from typing import Optional
 
+from ..const import (
+    IMAGES_LOCAL_DIR,
+    LEGACY_IMAGES_LOCAL_DIR,
+    LOCAL_IMAGE_URL_PREFIX,
+)
+
 _LOGGER = logging.getLogger(__name__)
 
 
@@ -18,11 +24,28 @@ class ImageHandler:
             config_path: Path to HA config directory
         """
         self.hass = hass
-        # Images stored in /config/www/shopping_list_manager/images/
-        self._local_images_dir = Path(config_path) / "www" / "shopping_list_manager" / "images"
+        # Images stored in /config/www/images/shopping_list_manager/
+        self._local_images_dir = Path(hass.config.path(IMAGES_LOCAL_DIR))
+        self._legacy_images_dir = Path(hass.config.path(LEGACY_IMAGES_LOCAL_DIR))
         self._local_images_dir.mkdir(parents=True, exist_ok=True)
+        self._migrate_legacy_files()
         
         _LOGGER.info("Image directory: %s", self._local_images_dir)
+
+    def _migrate_legacy_files(self) -> None:
+        """Move legacy image files to the new standardized directory."""
+        if not self._legacy_images_dir.exists() or self._legacy_images_dir == self._local_images_dir:
+            return
+        for src in self._legacy_images_dir.glob("*"):
+            if not src.is_file():
+                continue
+            dest = self._local_images_dir / src.name
+            if dest.exists():
+                continue
+            try:
+                shutil.move(str(src), str(dest))
+            except Exception as err:
+                _LOGGER.debug("Could not move legacy image %s: %s", src, err)
     
     def get_image_url(self, product_name: str, external_url: Optional[str] = None) -> str:
         """Get image URL for a product.
@@ -73,11 +96,11 @@ class ImageHandler:
             # Check exact match
             image_file = self._local_images_dir / f"{normalized_name}{ext}"
             if image_file.exists():
-                return f"/local/shopping_list_manager/images/{normalized_name}{ext}"
+                return f"{LOCAL_IMAGE_URL_PREFIX}{normalized_name}{ext}"
             
             # Check for files starting with the product name
             for file in self._local_images_dir.glob(f"{normalized_name}*{ext}"):
-                return f"/local/shopping_list_manager/images/{file.name}"
+                return f"{LOCAL_IMAGE_URL_PREFIX}{file.name}"
         
         return None
     

custom_components/shopping_list_manager/websocket/handlers.py

@@ -1,14 +1,24 @@
 """WebSocket API handlers for Shopping List Manager."""
+import io
 import logging
+import re
+from pathlib import Path
 from typing import Any, Dict
 
 import voluptuous as vol
+from aiohttp import ClientTimeout
+from PIL import Image
 
 from homeassistant.components import websocket_api
 from homeassistant.core import HomeAssistant, callback
+from homeassistant.helpers.aiohttp_client import async_get_clientsession
 from ..const import DOMAIN
 
 from ..const import (
+    IMAGE_SIZE,
+    IMAGE_QUALITY,
+    IMAGES_LOCAL_DIR,
+    LOCAL_IMAGE_URL_PREFIX,
     WS_TYPE_LISTS_GET_ALL,
     WS_TYPE_LISTS_CREATE,
     WS_TYPE_LISTS_UPDATE,
@@ -29,6 +39,8 @@ from ..const import (
     WS_TYPE_PRODUCTS_SUGGESTIONS,
     WS_TYPE_PRODUCTS_ADD,
     WS_TYPE_PRODUCTS_UPDATE,
+    WS_TYPE_PRODUCTS_DELETE,
+    WS_TYPE_OFF_FETCH,
     WS_TYPE_CATEGORIES_GET_ALL,
     WS_TYPE_LOYALTY_GET_ALL,
     WS_TYPE_LOYALTY_ADD,
@@ -48,6 +60,62 @@ from .. import get_storage
 _LOGGER = logging.getLogger(__name__)
 
 
+# =============================================================================
+# ACCESS-CHECK HELPERS
+# =============================================================================
+
+def _user_can_access_list(lst, user) -> bool:
+    """Return True if the user may read or write to this list.
+
+    Global lists (owner_id=None) are accessible to everyone.
+    Private lists are accessible to their owner, anyone in allowed_users, and admins.
+    """
+    if lst.owner_id is None:
+        return True
+    if user is None:
+        return False
+    if user.is_admin or user.id == lst.owner_id:
+        return True
+    return user.id in (lst.allowed_users or [])
+
+
+def _check_list_access(storage, connection, msg, list_id, require_owner=False):
+    """Verify the connected user may access list_id.
+
+    Sends the appropriate WebSocket error if access is denied.
+    Returns the ShoppingList object on success, or None if an error was sent.
+
+    Args:
+        require_owner: When True, only the list owner (or an admin) is allowed.
+                       Use for destructive/administrative operations.
+    """
+    lst = storage.get_list(list_id)
+    if lst is None:
+        connection.send_error(msg["id"], "not_found", "List not found")
+        return None
+
+    user = connection.user
+    if require_owner:
+        if lst.owner_id is not None and not (user and (user.is_admin or user.id == lst.owner_id)):
+            connection.send_error(msg["id"], "forbidden", "Only the list owner can perform this action")
+            return None
+    else:
+        if not _user_can_access_list(lst, user):
+            connection.send_error(msg["id"], "forbidden", "You do not have access to this list")
+            return None
+
+    return lst
+
+
+def _find_item_list_id(storage, item_id):
+    """Return the list_id that contains item_id, or None if not found."""
+    for list_id, items in storage._items.items():
+        for item in items:
+            if item.id == item_id:
+                return list_id
+    return None
+
+
 # =============================================================================
 # LIST HANDLERS
 # =============================================================================
@@ -62,16 +130,28 @@ async def websocket_subscribe(
     msg: dict,
 ) -> None:
     """Subscribe to shopping list manager events via WebSocket."""
-    
+    storage = get_storage(hass)
+
     @callback
     def forward_event(event):
-        """Forward HA bus event to WebSocket connection."""
+        """Forward HA bus event to WebSocket connection.
+
+        Events that reference a list_id are only forwarded if the connected
+        user has access to that list, preventing cross-user data leakage.
+        """
+        data = event.data
+        list_id = data.get("list_id")
+        if list_id:
+            lst = storage.get_list(list_id)
+            if lst and not _user_can_access_list(lst, connection.user):
+                return  # skip — user cannot see this list
+
         connection.send_message(
             websocket_api.event_message(
                 msg["id"],
                 {
                     "event_type": event.event_type,
-                    "data": event.data,
+                    "data": data,
                 }
             )
         )
@@ -248,7 +328,10 @@ async def websocket_update_list(
     """Handle update list command."""
     storage = get_storage(hass)
     list_id = msg["list_id"]
-    
+
+    if _check_list_access(storage, connection, msg, list_id, require_owner=True) is None:
+        return
+
     # Build update kwargs
     update_data = {}
     if "name" in msg:
@@ -334,7 +417,10 @@ async def websocket_set_active_list(
     """Handle set active list command."""
     storage = get_storage(hass)
     list_id = msg["list_id"]
-    
+
+    if _check_list_access(storage, connection, msg, list_id) is None:
+        return
+
     success = await storage.set_active_list(list_id)
     
     if not success:
@@ -369,7 +455,10 @@ def websocket_get_items(
     """Handle get items command."""
     storage = get_storage(hass)
     list_id = msg["list_id"]
-    
+
+    if _check_list_access(storage, connection, msg, list_id) is None:
+        return
+
     items = storage.get_items(list_id)
     
     connection.send_result(
@@ -385,7 +474,7 @@ def websocket_get_items(
         vol.Required("type"): WS_TYPE_ITEMS_ADD,
         vol.Required("list_id"): str,
         vol.Required("name"): str,
-        vol.Required("category_id"): str,
+        vol.Optional("category_id", default="other"): str,
         vol.Optional("product_id"): str,
         vol.Optional("quantity", default=1): vol.Coerce(float),
         vol.Optional("unit", default="units"): str,
@@ -404,7 +493,10 @@ async def websocket_add_item(
     """Handle add item command."""
     storage = get_storage(hass)
     list_id = msg["list_id"]
-    
+
+    if _check_list_access(storage, connection, msg, list_id) is None:
+        return
+
     # Build item data
     item_data = {
         "name": msg["name"],
@@ -463,7 +555,14 @@ async def websocket_update_item(
     """Handle update item command."""
     storage = get_storage(hass)
     item_id = msg["item_id"]
-    
+
+    list_id = _find_item_list_id(storage, item_id)
+    if list_id is None:
+        connection.send_error(msg["id"], "not_found", "Item not found")
+        return
+    if _check_list_access(storage, connection, msg, list_id) is None:
+        return
+
     # Build update data
     update_data = {}
     update_fields = ["name", "quantity", "unit", "note", "price", "category_id", "image_url"]
@@ -548,7 +647,14 @@ async def websocket_delete_item(
     """Handle delete item command."""
     storage = get_storage(hass)
     item_id = msg["item_id"]
-    
+
+    list_id = _find_item_list_id(storage, item_id)
+    if list_id is None:
+        connection.send_error(msg["id"], "not_found", "Item not found")
+        return
+    if _check_list_access(storage, connection, msg, list_id) is None:
+        return
+
     success = await storage.delete_item(item_id)
     
     if not success:
@@ -688,6 +794,87 @@ def websocket_get_list_total(
 # PRODUCT HANDLERS
 # =============================================================================
 
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "shopping_list_manager/products/download_image",
+        vol.Required("image_url"): str,
+        vol.Required("product_name"): str,
+    }
+)
+@websocket_api.async_response
+async def websocket_download_product_image(
+    hass: HomeAssistant,
+    connection: websocket_api.ActiveConnection,
+    msg: Dict[str, Any],
+) -> None:
+    """Download a remote image and save it as WebP to the local images directory."""
+    raw_url: str = msg["image_url"]
+    product_name: str = msg["product_name"]
+
+    safe_stem = re.sub(r"[^a-z0-9_]", "", product_name.lower().replace(" ", "_")) or "product"
+    filename = f"{safe_stem}.webp"
+    images_dir = Path(hass.config.path(IMAGES_LOCAL_DIR))
+    images_dir.mkdir(parents=True, exist_ok=True)
+    dest = images_dir / filename
+
+    try:
+        session = async_get_clientsession(hass)
+        headers = {"User-Agent": "Mozilla/5.0 (compatible; HomeAssistant/ShoppingListManager)"}
+        async with session.get(raw_url, timeout=ClientTimeout(total=15), headers=headers) as resp:
+            if resp.status != 200:
+                connection.send_error(msg["id"], "download_failed", f"HTTP {resp.status}")
+                return
+            raw = await resp.read()
+    except Exception as exc:  # noqa: BLE001
+        connection.send_error(msg["id"], "download_failed", str(exc))
+        return
+
+    try:
+        img = Image.open(io.BytesIO(raw))
+        # Convert to RGB for reliable lossy WebP encoding
+        # (RGBA, palette, grayscale modes can fail or produce oversized files)
+        if img.mode == "RGBA":
+            bg = Image.new("RGB", img.size, (255, 255, 255))
+            bg.paste(img, mask=img.split()[3])
+            img = bg
+        elif img.mode != "RGB":
+            img = img.convert("RGB")
+        img.thumbnail((IMAGE_SIZE, IMAGE_SIZE), Image.LANCZOS)
+        out = io.BytesIO()
+        img.save(out, format="WEBP", quality=IMAGE_QUALITY)
+        dest.write_bytes(out.getvalue())
+    except Exception as exc:  # noqa: BLE001
+        connection.send_error(msg["id"], "conversion_failed", str(exc))
+        return
+
+    connection.send_result(
+        msg["id"],
+        {"local_url": f"{LOCAL_IMAGE_URL_PREFIX}{filename}"},
+    )
+
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): "shopping_list_manager/products/search_by_barcode",
+        vol.Required("barcode"): str,
+    }
+)
+@callback
+def websocket_search_by_barcode(
+    hass: HomeAssistant,
+    connection: websocket_api.ActiveConnection,
+    msg: Dict[str, Any],
+) -> None:
+    """Find a single product by exact barcode match."""
+    storage = get_storage(hass)
+    barcode = msg["barcode"].strip()
+    match = next(
+        (p for p in storage._products.values() if p.barcode and p.barcode == barcode),
+        None,
+    )
+    connection.send_result(msg["id"], {"product": match.to_dict() if match else None})
+
+
 @websocket_api.websocket_command(
     {
         vol.Required("type"): "shopping_list_manager/products/substitutes",
@@ -872,6 +1059,27 @@ async def websocket_update_product(
     )
 
 
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): WS_TYPE_PRODUCTS_DELETE,
+        vol.Required("product_id"): str,
+    }
+)
+@websocket_api.async_response
+async def websocket_delete_product(
+    hass: HomeAssistant,
+    connection: websocket_api.ActiveConnection,
+    msg: Dict[str, Any],
+) -> None:
+    """Handle delete product command."""
+    storage = get_storage(hass)
+    deleted = await storage.delete_product(msg["product_id"])
+    if not deleted:
+        connection.send_error(msg["id"], "not_found", "Product not found")
+        return
+    connection.send_result(msg["id"], {"deleted": True})
+
+
 # =============================================================================
 # CATEGORY HANDLERS
 # =============================================================================
@@ -899,6 +1107,64 @@ def websocket_get_categories(
     )
 
 
+# =============================================================================
+# OPENFOODFACTS PROXY HANDLERS
+# =============================================================================
+
+@websocket_api.websocket_command(
+    {
+        vol.Required("type"): WS_TYPE_OFF_FETCH,
+        vol.Optional("query"): str,
+        vol.Optional("barcode"): str,
+        vol.Optional("page_size", default=5): int,
+    }
+)
+@websocket_api.async_response
+async def websocket_off_fetch(
+    hass: HomeAssistant,
+    connection: websocket_api.ActiveConnection,
+    msg: Dict[str, Any],
+) -> None:
+    """Proxy OpenFoodFacts requests through HA to avoid browser CORS restrictions."""
+    from homeassistant.helpers.aiohttp_client import async_get_clientsession
+    from aiohttp import ClientTimeout
+
+    session = async_get_clientsession(hass)
+    headers = {"User-Agent": "HomeAssistant/ShoppingListManager (contact@homeassistant.io)"}
+
+    try:
+        if msg.get("barcode"):
+            barcode = msg["barcode"]
+            fields = "product_name,categories_tags,image_front_thumb_url,image_front_url,image_url,price"
+            url = f"https://world.openfoodfacts.org/api/v2/product/{barcode}.json?fields={fields}"
+            async with session.get(url, timeout=ClientTimeout(total=10), headers=headers) as resp:
+                if not resp.ok:
+                    connection.send_result(msg["id"], {"status": 0})
+                    return
+                data = await resp.json(content_type=None)
+                connection.send_result(msg["id"], {
+                    "status": data.get("status", 0),
+                    "product": data.get("product"),
+                })
+        else:
+            query = msg.get("query", "")
+            page_size = msg.get("page_size", 5)
+            fields = "product_name,categories_tags,image_front_thumb_url,image_front_url,image_url,price"
+            url = (
+                f"https://world.openfoodfacts.org/api/v2/search"
+                f"?search_terms={query}&fields={fields}&page_size={page_size}"
+            )
+            async with session.get(url, timeout=ClientTimeout(total=10), headers=headers) as resp:
+                if not resp.ok:
+                    connection.send_result(msg["id"], {"products": []})
+                    return
+                data = await resp.json(content_type=None)
+                connection.send_result(msg["id"], {"products": data.get("products", [])})
+    except Exception as err:
+        _LOGGER.warning("OpenFoodFacts proxy request failed: %s", err)
+        connection.send_error(msg["id"], "fetch_failed", str(err))
+
+
 # =============================================================================
 # INTEGRATION SETTINGS HANDLERS
 # =============================================================================
@@ -931,10 +1197,12 @@ def websocket_get_integration_settings(
     )
 
 
+_VALID_COUNTRIES = ["NZ", "AU", "US", "GB", "CA"]
+
 @websocket_api.websocket_command(
     {
         vol.Required("type"): "shopping_list_manager/set_country",
-        vol.Required("country"): str,
+        vol.Required("country"): vol.In(_VALID_COUNTRIES),
     }
 )
 @websocket_api.async_response