feat: Track last cast IP and validate stop requests

Co-authored-by: aider (gemini/gemini-2.5-pro) <aider@aider.chat>

main.py

@@ -21,11 +21,12 @@ def cast_spell():
         logging.warning(f"Invalid or missing ip_address parameter: {ip_address}")
         return f"Invalid or missing 'ip_address' parameter.", 400
 
-    global auto_stop_timer
+    global auto_stop_timer, LAST_CAST_ADDRESS
 
     logging.info(f"Casting to {ip_address}.")
     kill_vnc()  # Kill any existing VNC session first
     cast_machine(ip_address)
+    LAST_CAST_ADDRESS = ip_address
     # Restart auto-stop timer
     if auto_stop_timer is not None and auto_stop_timer.is_alive():
         auto_stop_timer.cancel()
@@ -37,8 +38,17 @@ def cast_spell():
 
 @app.route('/stop', methods=['POST'])
 def stop_cast():
-    global auto_stop_timer
-    logging.info("Received POST request on /stop.")
+    global auto_stop_timer, LAST_CAST_ADDRESS
+    ip_address = request.form.get('ip_address')
+    logging.info(f"Received POST request on /stop for ip_address: {ip_address}")
+
+    if not ip_address:
+        logging.warning(f"Invalid or missing ip_address parameter: {ip_address}")
+        return f"Invalid or missing 'ip_address' parameter.", 400
+
+    if ip_address != LAST_CAST_ADDRESS:
+        logging.warning(f"Stop request for {ip_address} does not match last cast address {LAST_CAST_ADDRESS}.")
+        return f"Stop request for {ip_address} does not match last cast address.", 403
 
     if auto_stop_timer is not None and auto_stop_timer.is_alive():
         auto_stop_timer.cancel()
@@ -46,6 +56,7 @@ def stop_cast():
         logging.info("Manual stop: auto-stop timer cancelled.")
     
     kill_vnc()
+    LAST_CAST_ADDRESS = None
     return "Attempted to stop VNC viewers.", 200
 
 def _auto_stop_vnc():