julian
9a4c7ee27b
Correction before schema work: the events table conflated the anti-fraud business ledger with device telemetry. Decision: ledger_events (signed, chained, reconciled) holds only business facts; device_events (unsigned, prunable) holds relay/printer/camera/reader/input telemetry. A raw button press is telemetry; the entry flow mints a signed vehicle_entry. Drops input_received-as-signed-event. New: decisions/event-streams-split, concepts/device-events; updated append-only-event-chain, index, log.
102 lines
7.0 KiB
Markdown
102 lines
7.0 KiB
Markdown
---
|
|
type: overview
|
|
tags: [parking, index]
|
|
updated: 2026-06-14
|
|
---
|
|
|
|
# Index
|
|
|
|
Content catalog for the wiki. Start at [[overview]]. Maintained on every ingest.
|
|
Counts: 1 source · 18 entities · 23 concepts · 5 decision records.
|
|
|
|
## Overview & navigation
|
|
- [[overview]] — the top-level synthesis and entry point.
|
|
- [[index]] — this catalog.
|
|
- `log.md` — chronological record of ingests/queries/lints.
|
|
|
|
## Sources
|
|
- [[parking-system-architecture]] — design notes: stack, threat model, devices, UHPPOTE, ESP32, readers, BOM, open decisions.
|
|
|
|
## Entities — technology stack
|
|
- [[technology-stack]] — the full stack table; all MIT/Apache/BSD, chosen to avoid lock-in.
|
|
- [[fastify]] — Node backend; hosts device-driver plugins + auth; serves the SPA.
|
|
- [[sqlite]] — local single-writer DB (WAL); limits & why it fits.
|
|
- [[drizzle-orm]] — ORM; schemas port to PostgreSQL for remote sync.
|
|
- [[turborepo]] — monorepo tool.
|
|
- [[react-vite-spa]] — React/Vite frontend served by Fastify.
|
|
- [[local-jwt-auth]] — fully local auth (JWT + bcrypt + role guard); forced by offline-first.
|
|
|
|
## Entities — rejected alternatives
|
|
- [[payload-cms]] — strong, but rejected over BSL license shift (the rug-pull cautionary case).
|
|
- [[refine]] — dropped for plain React; UI too simple to justify a framework.
|
|
- [[logto-zitadel-oidc]] — OIDC providers ruled out by offline-first.
|
|
|
|
## Entities — hardware & devices
|
|
- [[uhppote-controller]] — ❌ rejected/historical; firmware auto-open blocker drove the switch to Dingtian.
|
|
- [[esp32-custom-controller]] — prevention-grade upgrade; device-level auth.
|
|
- [[atecc608]] — secure element; non-extractable signing key (host events + controller auth).
|
|
- [[wiegand]] — reader standard feeding the controller directly (autonomous permit-holder path).
|
|
- [[lpr-camera]] — edge-AI plate recognition; host-side casual-identity source.
|
|
- [[zkteco-controller]] — ❌ rejected/historical; aux-input path was a contender, not pursued.
|
|
- [[dingtian-relay]] — ✅ CHOSEN access controller; decoupled inputs solve the button blocker (driver verified on hardware).
|
|
- [[rongta-printer]] — ✅ CHOSEN 80mm thermal printer; ESC/POS over raw TCP 9100; driver written, one unit reachable at 10.0.10.6.
|
|
- [[bom]] — reference bill of materials (barrier, loops, controller, readers, payment, host, network).
|
|
|
|
## Concepts — foundational forces
|
|
- [[offline-first]] — no network dependency in core operation; what it forces (and doesn't).
|
|
- [[threat-model]] — the operator-at-the-booth reframing; why encryption defends the wrong threat.
|
|
|
|
## Concepts — integrity & anti-fraud
|
|
- [[append-only-event-chain]] — append-only + hash chain + ATECC608 signing = unforgeable log.
|
|
- [[reconciliation]] — the real anti-fraud control; what remote sync actually is.
|
|
- [[disk-os-hardening]] — LUKS/GRUB/Secure Boot; worthwhile but not the main event.
|
|
|
|
## Concepts — device architecture & safety
|
|
- [[device-adapter-pattern]] — business logic talks to interfaces; swap hardware → new adapter.
|
|
- [[device-registry]] — catalog of selectable drivers per category (admin-configurable).
|
|
- [[first-run-setup]] — admin assigns devices per lane from the catalog at install.
|
|
- [[device-input-flow]] — button → device push → backend decides → relay; backend is source of truth.
|
|
- [[device-discovery]] — optional driver capability to scan the LAN (no current driver uses it; UHPPOTE was the example).
|
|
- [[barrier-not-a-door]] — never timed-close a barrier; safety lives in barrier firmware.
|
|
- [[printer-roles-failover]] — ≥2 printers per lane by role; entry ticket falls back outside→booth.
|
|
- [[printer-status-monitoring]] — live poll of paper/cover/cutter/offline via the device's status page; SSE to the booth UI.
|
|
- [[trust-boundary]] — the core fork: network vs. device; auditable vs. unforgeable.
|
|
- [[fail-state-safety]] — entry fails closed, exit fails open; manual override; watchdog.
|
|
|
|
## Concepts — access control
|
|
- [[uhppote-udp-protocol]] — open UDP weakness + the unauthenticated commands that undermine the log.
|
|
- [[network-isolation]] — mandatory VLAN isolation; the network as security boundary.
|
|
- [[event-log-ingestion]] — host-side index tracking that makes the UHPPOTE log trustworthy.
|
|
- [[challenge-response-auth]] — asymmetric nonce scheme for the ESP32 (auth + anti-replay).
|
|
- [[entry-exit-readers]] — two populations, two integration paths; both can share a relay.
|
|
- [[uhppote-vs-esp32]] — comparison: detection vs. prevention.
|
|
|
|
## Concepts — business domain
|
|
- [[parking-session]] — the core domain entity; a projection over the signed log, never a mutable table.
|
|
- [[tariff]] — fee model; pure, data-driven, offline; pay-on-foot adds a walk-back grace window.
|
|
- [[shift]] — manned-only accountability period; explicit Start/End (not time-based); End → signed + printed Z-report (cash + POS).
|
|
- [[capacity-occupancy]] — live count = open sessions; refuse entry + FULL sign when full; exit never blocked.
|
|
- [[validation-discounts]] — merchant validates a ticket → signed discount event applied at fee time.
|
|
- [[reporting-analytics]] — revenue/occupancy/stay reports + plate-search, all projections over the signed log.
|
|
- [[clock-integrity]] — fees depend on the host clock; detect/flag backdating on an offline box.
|
|
- [[ticket-encoding]] — transient ticket id as QR; printed at entry, scanned at pay station + exit; plate-as-ticket alt.
|
|
- [[anti-passback]] — block/flag one id entering twice without an exit; fold over open sessions.
|
|
- [[device-events]] — unsigned hardware telemetry (relay/printer/camera/reader/input); separate from the signed ledger.
|
|
- [[permit]] — subscription; RF/QR or plate identity, registered-cars + max-concurrent, host-in-loop; short-circuits payment.
|
|
- [[opencv-anpr-service]] — host-side vision microservice: ANPR (plate identity) + vehicle verification (anti-plate-spoofing witness).
|
|
- [[blocklist]] — barred plates/cards refused at entry (never at exit); signed, attributed.
|
|
|
|
## Dev environment (reference)
|
|
- [[local-dev-workflow]] — running the stack locally; setup, the dev-hang gotchas, seed:admin.
|
|
- [[wsl-dev-networking]] — WSL2 NAT blocks device broadcast; use mirrored mode + the gotchas after.
|
|
|
|
## Decisions
|
|
- [[standing-decisions]] — settled decisions (stack, platform, integrity, access control, readers).
|
|
- [[open-questions]] — 9 open items (procurement + JWT key + FX + pay-station money corners); ESP32 device auth deferred.
|
|
- [[access-controller-button-flow]] — ✅ RESOLVED: Dingtian decoupled inputs enable ticket-first entry (was a UHPPOTE/ZKTeco blocker).
|
|
- [[autonomous-direction]] — roadmap: toward fully unmanned (no booth); reshapes threat model + fail-state.
|
|
- [[dingtian-vs-mqtt]] — transport choice: direct HTTP/UDP now, MQTT parked until multi-lane scale.
|
|
- [[session-model]] — business layer start: session = projection; transient-first; pay-on-foot. New event types.
|
|
- [[vision-service]] — build a host-side ANPR + vehicle-verification service; replaces edge-LPR; scoped AGPL exception.
|
|
- [[event-streams-split]] — split the signed business ledger (ledger_events) from unsigned device telemetry (device_events).
|