julian
3294f188dd
Secure the device→backend input push, and configure it automatically when the
admin assigns the device (no manual URL/secret entry).
Auth — HTTP Digest (chosen by hardware testing: the device can't push to a
self-signed HTTPS backend, but does Digest correctly; a URL token is sniffable/
logged):
- digest-auth.ts: MD5 qop=auth challenge/verify, single-use nonces (replay
resistance). Password never crosses the wire.
- push route: Digest + source-IP allowlist; per-device pushUser/pushPassword from
lane_devices. Still not behind the SPA cookie/CSRF auth (machine call). The
signed event log remains the real anti-fraud guarantee.
Auto-config on assign:
- setup assign: for push-capable devices, generate Digest creds, call
configureInputPush to write them + the push URLs to the device, store the creds
(password not echoed back). net.ts derives the backend IP on the device's
subnet (BACKEND_HOST_IP override).
- driver configureInputPush sets auth=2 + creds; PushConfig carries the creds.
- removed the earlier URL-token approach.
Two hard-won device-write bugs fixed in the driver:
- configApi now sets an explicit Content-Length — the device silently ignores
chunked request bodies (Node's default without Content-Length), so every config
write looked successful ({"status":0}) but did nothing. This was the root cause
of the session's "writes don't apply" mystery.
- #writeConfig polls until the change is verified, retrying (the device reboots on
apply; back-to-back writes were lost). The `pass` field caps at 31 chars, so the
generated password is 24 hex chars.
Verified on hardware: assign auto-configures the device; all 4 inputs then push
with Digest auth, zero failures. wiki/device-input-flow updated.
83 lines
2.9 KiB
TypeScript
83 lines
2.9 KiB
TypeScript
import type { FastifyInstance, FastifyReply, FastifyRequest } from "fastify";
|
|
import { eq, laneDevices, type Db } from "@parking/db";
|
|
import { deviceEvents } from "../device-events.js";
|
|
import { verifyDigest } from "../digest-auth.js";
|
|
|
|
// Inbound device push endpoints. The Dingtian board's "Input Link URL" feature
|
|
// HTTP-calls us when an input (button) fires — no polling. We translate the
|
|
// push into an internal device event; the entry flow decides what to do
|
|
// (print a ticket, then command the relay). See wiki/concepts/device-input-flow.md.
|
|
//
|
|
// AUTH: HTTP Digest (the device can do Digest but not HTTPS-to-self-signed —
|
|
// both tested on hardware). The password is never sent on the wire; the secret
|
|
// is NOT in the URL. Per-device credentials live in lane_devices (written on
|
|
// assign). This is defence-in-depth on a flat network; the signed event log is
|
|
// the real anti-fraud guarantee (an open with no matching signed event is an
|
|
// anomaly). Source-IP is also checked. NOT behind the SPA cookie/CSRF auth
|
|
// (machine call from the device).
|
|
|
|
interface InputParams {
|
|
deviceId: string;
|
|
n: string;
|
|
edge: string;
|
|
}
|
|
|
|
interface DingtianDeviceConfig {
|
|
host?: string;
|
|
pushUser?: string;
|
|
pushPassword?: string;
|
|
}
|
|
|
|
function clientIp(req: FastifyRequest): string {
|
|
return req.ip.replace(/^::ffff:/, "");
|
|
}
|
|
|
|
export async function deviceRoutes(app: FastifyInstance, db: Db): Promise<void> {
|
|
const handle = async (req: FastifyRequest<{ Params: InputParams }>, reply: FastifyReply) => {
|
|
const { deviceId, n, edge } = req.params;
|
|
|
|
const row = await db.select().from(laneDevices).where(eq(laneDevices.id, deviceId)).get();
|
|
const cfg = row?.config as DingtianDeviceConfig | undefined;
|
|
|
|
// Unknown device / not a dingtian / no push creds / wrong source IP → 404.
|
|
if (
|
|
!row ||
|
|
row.driverId !== "dingtian" ||
|
|
!cfg?.pushUser ||
|
|
!cfg.pushPassword ||
|
|
!cfg.host ||
|
|
clientIp(req) !== cfg.host
|
|
) {
|
|
app.log.warn(`rejected device push: device=${deviceId} ip=${clientIp(req)}`);
|
|
return reply.code(404).send({ error: "not found" });
|
|
}
|
|
|
|
// Digest auth — issues a 401 challenge on first hit; the device retries with
|
|
// the hashed response (verifyDigest sends the challenge + returns false).
|
|
if (!verifyDigest(req, reply, { user: cfg.pushUser, password: cfg.pushPassword })) {
|
|
return; // 401 already sent
|
|
}
|
|
|
|
const input = Number(n);
|
|
const ed = edge === "off" ? "off" : "on";
|
|
app.log.info(`[dingtian:${deviceId}] input ${input} ${ed} (push)`);
|
|
deviceEvents.emitInput({
|
|
driverId: "dingtian",
|
|
deviceId,
|
|
input,
|
|
edge: ed,
|
|
at: new Date().toISOString(),
|
|
source: "push",
|
|
});
|
|
return { ok: true };
|
|
};
|
|
|
|
for (const method of ["GET", "POST"] as const) {
|
|
app.route({
|
|
method,
|
|
url: "/api/devices/dingtian/:deviceId/input/:n/:edge",
|
|
handler: handle,
|
|
});
|
|
}
|
|
}
|