@homebridge-plugins/homebridge-eufy-security 4.7.1 → 5.0.0-beta.0

package/homebridge-ui/public/views/unsupported-detail.js

@@ -1,296 +0,0 @@
-/**
- * Unsupported Device Detail View — shows device info dump and guided CTA
- * for requesting support via GitHub.
- */
-// eslint-disable-next-line no-unused-vars
-const UnsupportedDetailView = {
-
-  _container: null,
-
-  /**
-   * @param {HTMLElement} container
-   * @param {string} id - uniqueId / serial number
-   */
-  async render(container, id) {
-    this._container = container;
-    container.innerHTML = '';
-
-    const accessory = this._findAccessory(id);
-
-    if (!accessory) {
-      container.innerHTML = `
-        <div class="text-center text-muted py-5">
-          <p>Device not found.</p>
-          <button class="btn btn-outline-secondary btn-sm" id="btn-back">Back to Dashboard</button>
-        </div>`;
-      container.querySelector('#btn-back').addEventListener('click', () => App.navigate('dashboard'));
-      return;
-    }
-
-    // Header (no image for unsupported)
-    this._renderHeader(container, accessory);
-
-    // Main content
-    const content = document.createElement('div');
-    await this._renderDetail(content, accessory);
-    container.appendChild(content);
-  },
-
-  // ===== Header =====
-  _renderHeader(container, accessory) {
-    const header = document.createElement('div');
-    header.className = 'detail-header';
-
-    const backBtn = document.createElement('button');
-    backBtn.className = 'btn btn-link p-0';
-    backBtn.innerHTML = '← Back';
-    backBtn.style.textDecoration = 'none';
-    backBtn.addEventListener('click', () => App.navigate('dashboard'));
-
-    const info = document.createElement('div');
-    info.className = 'detail-header__info';
-    info.innerHTML = `
-      <h5>${Helpers.escHtml(accessory.displayName)}</h5>
-      <small>${accessory.typename || ('Type ' + accessory.type)} · ${accessory.uniqueId}</small>
-    `;
-
-    header.appendChild(backBtn);
-    header.appendChild(info);
-    container.appendChild(header);
-  },
-
-  // ===== Detail Content =====
-  async _renderDetail(content, accessory) {
-    const REPO = 'homebridge-plugins/homebridge-eufy-security';
-    const LABEL = 'device-support';
-    const COMPAT_URL = 'https://bropat.github.io/eufy-security-client/#/supported_devices';
-
-    const section = document.createElement('div');
-    section.className = 'detail-section unsupported-detail';
-
-    // Description
-    const desc = document.createElement('p');
-    desc.className = 'text-muted';
-    desc.innerHTML =
-      '<strong>' + Helpers.iconHtml('info.svg') + ' This device was detected but is not yet supported.</strong><br />' +
-      'New device support must first be added to the eufy-security-client library. ' +
-      'If your device is not on the compatibility list, please <strong>search for existing issues first</strong> before opening a new one.';
-    section.appendChild(desc);
-
-    // Device info dump — all available data in one box
-    const props = accessory.properties || {};
-
-    // Load raw intel from unsupported.json (served via /unsupportedDevices endpoint)
-    let unsupportedIntel = null;
-    try {
-      const unsupportedData = await Api.loadUnsupportedDevices();
-      const entries = unsupportedData.devices || [];
-      unsupportedIntel = entries.find(e => e.uniqueId === accessory.uniqueId) || null;
-    } catch (e) {
-      // ignore — will fall back to basic properties
-    }
-
-    const deviceInfo = {
-      uniqueId: accessory.uniqueId,
-      displayName: accessory.displayName,
-      type: accessory.type,
-      typename: accessory.typename || undefined,
-      ...props,
-      ...(unsupportedIntel ? {
-        rawDevice: unsupportedIntel.rawDevice,
-        rawProperties: unsupportedIntel.rawProperties,
-      } : {}),
-    };
-    // Remove potentially large/sensitive fields
-    delete deviceInfo.picture;
-
-    // CTA stepper + buttons
-    const stepsWrap = document.createElement('div');
-    stepsWrap.className = 'unsupported-detail__steps';
-
-    // Stepper frieze
-    const stepper = document.createElement('div');
-    stepper.className = 'unsupported-stepper';
-    const steps = [
-      { num: '1', label: 'Check', color: 'success' },
-      { num: '2', label: 'Search', color: 'primary' },
-      { num: '3', label: 'Copy', color: 'warning' },
-      { num: '4', label: 'Create', color: 'danger' },
-    ];
-    steps.forEach((step, i) => {
-      const stepEl = document.createElement('div');
-      stepEl.className = 'unsupported-stepper__step';
-      stepEl.innerHTML = `<span class="unsupported-stepper__circle unsupported-stepper__circle--${step.color}">${step.num}</span><span class="unsupported-stepper__label">${step.label}</span>`;
-      stepper.appendChild(stepEl);
-      if (i < steps.length - 1) {
-        const line = document.createElement('div');
-        line.className = 'unsupported-stepper__line';
-        stepper.appendChild(line);
-      }
-    });
-    stepsWrap.appendChild(stepper);
-
-    // Buttons row
-    const btnGroup = document.createElement('div');
-    btnGroup.className = 'unsupported-detail__actions';
-
-    // 1) Check compatibility list
-    const compatBtn = document.createElement('a');
-    compatBtn.href = COMPAT_URL;
-    compatBtn.target = '_blank';
-    compatBtn.rel = 'noopener noreferrer';
-    compatBtn.className = 'btn btn-success';
-    compatBtn.textContent = 'Check Compatibility ↗';
-    btnGroup.appendChild(compatBtn);
-
-    // 2) Search existing issues with label
-    const searchQuery = encodeURIComponent(`is:issue label:${LABEL} ${accessory.type}`);
-    const searchBtn = document.createElement('a');
-    searchBtn.href = `https://github.com/${REPO}/issues?q=${searchQuery}`;
-    searchBtn.target = '_blank';
-    searchBtn.rel = 'noopener noreferrer';
-    searchBtn.className = 'btn btn-outline-primary';
-    searchBtn.textContent = 'Search Existing Issues ↗';
-    btnGroup.appendChild(searchBtn);
-
-    // 3) Copy device JSON to clipboard
-    const deviceDump = JSON.stringify(deviceInfo, null, 2);
-    const copyJsonBtn = document.createElement('button');
-    copyJsonBtn.className = 'btn btn-outline-warning';
-    copyJsonBtn.textContent = 'Copy Device Info';
-    copyJsonBtn.addEventListener('click', () => {
-      this._copyToClipboard(deviceDump).then(() => {
-        copyJsonBtn.textContent = '✓ Copied!';
-        setTimeout(() => { copyJsonBtn.textContent = 'Copy Device Info'; }, 2000);
-      });
-    });
-    btnGroup.appendChild(copyJsonBtn);
-
-    // 4) Create new issue (without embedding JSON — user pastes it)
-    const model = props.model || accessory.type;
-    const issueTitle = encodeURIComponent(`[Device Support] ${model} (Type ${accessory.type})`);
-    const templateParams = [
-      `template=device_support.yml`,
-      `title=${issueTitle}`,
-      `labels=${LABEL}`,
-    ].join('&');
-    const createBtn = document.createElement('a');
-    createBtn.href = `https://github.com/${REPO}/issues/new?${templateParams}`;
-    createBtn.target = '_blank';
-    createBtn.rel = 'noopener noreferrer';
-    createBtn.className = 'btn btn-outline-danger';
-    createBtn.textContent = 'Create an Issue ↗';
-    btnGroup.appendChild(createBtn);
-
-    stepsWrap.appendChild(btnGroup);
-
-    // Paste reminder note
-    const pasteNote = document.createElement('p');
-    pasteNote.className = 'unsupported-detail__paste-note';
-    pasteNote.innerHTML = Helpers.iconHtml('info.svg', 14) +
-      ' Copy the <strong>Device Information</strong> below first, then paste it into the issue form on GitHub.';
-    stepsWrap.appendChild(pasteNote);
-
-    section.appendChild(stepsWrap);
-
-    // External links note
-    const extNote = document.createElement('p');
-    extNote.className = 'text-muted';
-    extNote.style.cssText = 'font-size: 0.75rem; text-align: right;';
-    extNote.textContent = '↗ These links open in a new browser tab on GitHub.';
-    section.appendChild(extNote);
-
-    const infoTitle = document.createElement('div');
-    infoTitle.className = 'detail-section__title';
-    infoTitle.textContent = 'Device Information';
-    section.appendChild(infoTitle);
-
-    const infoNote = document.createElement('p');
-    infoNote.className = 'text-muted';
-    infoNote.style.cssText = 'font-size: 0.75rem;';
-    infoNote.textContent = 'Diagnostic information below includes raw device properties from the client library.';
-    section.appendChild(infoNote);
-
-    // JSON dump with copy button overlay
-    const dumpWrap = document.createElement('div');
-    dumpWrap.className = 'unsupported-detail__dump-wrap';
-
-    const copyBtn = document.createElement('button');
-    copyBtn.className = 'unsupported-detail__copy-btn';
-
-    const _setCopyLabel = (text) => {
-      copyBtn.innerHTML = '';
-      copyBtn.appendChild(Helpers.icon('copy.svg'));
-      copyBtn.append(' ' + text);
-    };
-    _setCopyLabel('Copy');
-
-    copyBtn.addEventListener('click', () => {
-      this._copyToClipboard(pre.textContent).then(() => {
-        copyBtn.textContent = '✓ Copied!';
-        setTimeout(() => { _setCopyLabel('Copy'); }, 2000);
-      });
-    });
-
-    const pre = document.createElement('pre');
-    pre.className = 'unsupported-detail__dump';
-    pre.textContent = JSON.stringify(deviceInfo, null, 2);
-
-    dumpWrap.appendChild(copyBtn);
-    dumpWrap.appendChild(pre);
-    section.appendChild(dumpWrap);
-
-    content.appendChild(section);
-  },
-
-  // ===== Helpers =====
-
-  /**
-   * Copy text to clipboard with fallback for non-secure contexts (e.g. Homebridge iframe).
-   * @param {string} text
-   * @returns {Promise<void>}
-   */
-  _copyToClipboard(text) {
-    if (navigator.clipboard && navigator.clipboard.writeText) {
-      return navigator.clipboard.writeText(text).catch(() => this._copyFallback(text));
-    }
-    return this._copyFallback(text);
-  },
-
-  _copyFallback(text) {
-    return new Promise((resolve, reject) => {
-      const textarea = document.createElement('textarea');
-      textarea.value = text;
-      textarea.style.cssText = 'position:fixed;left:-9999px;top:-9999px;opacity:0';
-      document.body.appendChild(textarea);
-      textarea.select();
-      try {
-        document.execCommand('copy') ? resolve() : reject(new Error('execCommand failed'));
-      } catch (err) {
-        reject(err);
-      } finally {
-        document.body.removeChild(textarea);
-      }
-    });
-  },
-
-  /**
-   * Find an accessory (device or station) by uniqueId across all stations.
-   * For standalone devices the station and device share the same uniqueId —
-   * prefer the device because it carries richer data.
-   * @param {string} id
-   * @returns {object|null}
-   */
-  _findAccessory(id) {
-    const stations = App.state.stations || [];
-    for (const s of stations) {
-      // Check devices first — standalone devices have the same uniqueId as their station
-      // but carry richer data
-      for (const d of s.devices || []) {
-        if (d.uniqueId === id) return d;
-      }
-      if (s.uniqueId === id) return s;
-    }
-    return null;
-  },
-};

package/scripts/decrypt-diagnostics.mjs

@@ -1,257 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Decrypt and extract an encrypted diagnostics archive produced by the plugin.
- *
- * Usage:
- *   node decrypt-diagnostics.mjs <encrypted-file.tar.gz> [private-key.pem]
- *
- * If the private key is omitted, the script looks for it in the keys/
- * directory next to itself (keys/diagnostics_private.pem).
- *
- * The archive is decrypted and extracted into a folder next to the input file,
- * named after the archive (e.g. diagnostics-2026-03-02-11-25-31/).
- *
- * File format (the .tar.gz is actually encrypted, not a plain gzip):
- *   [4 bytes]  – magic: "DIAG"
- *   [1 byte]   – format version (currently 0x01)
- *   [8 bytes]  – creation timestamp (BigUInt64BE, ms since Unix epoch)
- *   [2 bytes]  – big-endian uint16: length of the encrypted AES key
- *   [N bytes]  – RSA-OAEP encrypted AES-256 key
- *   [12 bytes] – AES-GCM initialisation vector
- *   [16 bytes] – AES-GCM authentication tag
- *   [rest]     – AES-256-GCM ciphertext
- *
- * AAD (Additional Authenticated Data) covers bytes 0 through the end of the
- * encrypted AES key.  GCM verifies this automatically during decryption.
- */
-
-import crypto from 'node:crypto';
-import fs from 'node:fs';
-import path from 'node:path';
-import { execFileSync, spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DEFAULT_KEY = path.join(__dirname, '..', 'keys', 'diagnostics_private.pem');
-
-/** Maximum allowed .enc file size (140 MB). */
-const MAX_ENC_SIZE = 140 * 1024 * 1024;
-
-/** Maximum number of entries allowed in the archive. */
-const MAX_ENTRIES = 100;
-
-/** Only these file extensions are expected in a legitimate diagnostics archive. */
-const ALLOWED_EXTENSIONS = new Set(['.log', '.gz', '.json']);
-
-/** Archives older than this are flagged with a warning (90 days). */
-const EXPIRY_MS = 90 * 24 * 60 * 60 * 1000;
-
-function main() {
-  const args = process.argv.slice(2);
-
-  if (args.length < 1) {
-    console.error('Usage: node decrypt-diagnostics.mjs <encrypted-file.tar.gz> [private-key.pem]');
-    process.exit(1);
-  }
-
-  const encFile = path.resolve(args[0]);
-  let keyFile = args[1] ? path.resolve(args[1]) : DEFAULT_KEY;
-
-  if (!fs.existsSync(keyFile)) {
-    console.error(`Private key not found: ${keyFile}`);
-    process.exit(1);
-  }
-
-  // Read inputs
-  const encBuffer = fs.readFileSync(encFile);
-
-  // Reject oversized files
-  if (encBuffer.length > MAX_ENC_SIZE) {
-    console.error(`File too large (${(encBuffer.length / 1024 / 1024).toFixed(1)} MB) — max allowed is ${MAX_ENC_SIZE / 1024 / 1024} MB.`);
-    process.exit(1);
-  }
-
-  const privateKey = fs.readFileSync(keyFile, 'utf-8');
-
-  // Validate minimum size: 4 (magic) + 1 (version) + 8 (timestamp) + 2 (keyLen) + 512 (RSA-4096 encrypted key) + 12 (IV) + 16 (tag) + 1 (min ciphertext)
-  const MIN_SIZE = 4 + 1 + 8 + 2 + 512 + 12 + 16 + 1;
-  if (encBuffer.length < MIN_SIZE) {
-    console.error(`File too small (${encBuffer.length} bytes) — not a valid encrypted diagnostics archive.`);
-    process.exit(1);
-  }
-
-  // Verify magic header and version
-  let offset = 0;
-
-  const magic = encBuffer.subarray(offset, offset + 4).toString();
-  offset += 4;
-  if (magic !== 'DIAG') {
-    console.error(`Invalid file — expected magic "DIAG", got "${magic}".`);
-    process.exit(1);
-  }
-
-  const version = encBuffer[offset];
-  offset += 1;
-  if (version !== 0x01) {
-    console.error(`Unsupported format version ${version} — this script supports version 1.`);
-    process.exit(1);
-  }
-
-  // Parse the envelope
-  const createdAtMs = Number(encBuffer.readBigUInt64BE(offset));
-  offset += 8;
-  const createdAt = new Date(createdAtMs);
-
-  if (Number.isNaN(createdAt.getTime())) {
-    console.error('Invalid timestamp in archive header — file may be corrupted or tampered.');
-    process.exit(1);
-  }
-
-  console.log(`Archive created: ${createdAt.toISOString()}`);
-
-  const ageMs = Date.now() - createdAtMs;
-  if (ageMs > EXPIRY_MS) {
-    const ageDays = Math.round(ageMs / (24 * 60 * 60 * 1000));
-    console.warn(`⚠️  WARNING: This archive is ${ageDays} days old (created ${createdAt.toISOString()}).`);
-  }
-  if (createdAtMs > Date.now() + 24 * 60 * 60 * 1000) {
-    console.warn('⚠️  WARNING: Archive timestamp is in the future — clock skew or tampering?');
-  }
-
-  const keyLen = encBuffer.readUInt16BE(offset);
-  offset += 2;
-
-  if (offset + keyLen + 12 + 16 > encBuffer.length) {
-    console.error('Malformed archive — encrypted key length exceeds file size.');
-    process.exit(1);
-  }
-
-  const encryptedKey = encBuffer.subarray(offset, offset + keyLen);
-  offset += keyLen;
-
-  // The AAD covers everything from byte 0 through the end of encryptedKey
-  // (magic + version + timestamp + keyLen + encryptedKey)
-  const aadEnd = 4 + 1 + 8 + 2 + keyLen;
-  const aad = encBuffer.subarray(0, aadEnd);
-
-  const iv = encBuffer.subarray(offset, offset + 12);
-  offset += 12;
-
-  const authTag = encBuffer.subarray(offset, offset + 16);
-  offset += 16;
-
-  const ciphertext = encBuffer.subarray(offset);
-
-  // Unwrap the AES key with the private RSA key
-  let aesKey;
-  try {
-    aesKey = crypto.privateDecrypt(
-      {
-        key: privateKey,
-        padding: crypto.constants.RSA_PKCS1_OAEP_PADDING,
-        oaepHash: 'sha256',
-      },
-      encryptedKey,
-    );
-  } catch (err) {
-    console.error('Failed to decrypt AES key — wrong private key?', err.message);
-    process.exit(2);
-  }
-
-  // Decrypt the payload
-  const decipher = crypto.createDecipheriv('aes-256-gcm', aesKey, iv);
-  aesKey.fill(0); // scrub key from memory
-  decipher.setAAD(aad);
-  decipher.setAuthTag(authTag);
-
-  let decrypted;
-  try {
-    decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  } catch (err) {
-    console.error('Decryption failed — data may be corrupted.', err.message);
-    process.exit(3);
-  }
-
-  // Determine output directory next to the .enc file
-  const encDir = path.dirname(encFile);
-  const baseName = path.basename(encFile)
-    .replace(/\.tar\.gz(?:\.enc)?$/, '');
-  const outDir = path.join(encDir, baseName);
-
-  // --- Safety: inspect tar contents before extracting (piped via stdin, no temp file) ---
-  const listResult = spawnSync('tar', ['tzf', '-'], { input: decrypted, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
-  if (listResult.status !== 0) {
-    console.error('Failed to list archive contents:', listResult.stderr?.trim() || 'unknown error');
-    process.exit(4);
-  }
-
-  const listing = listResult.stdout.trim().split('\n');
-
-  // Reject archives with too many entries (tar bomb protection)
-  if (listing.length > MAX_ENTRIES) {
-    console.error(`BLOCKED: archive contains ${listing.length} entries (max ${MAX_ENTRIES}).`);
-    console.error('This file may be a tar bomb. Aborting.');
-    process.exit(5);
-  }
-
-  for (const entry of listing) {
-    const normalised = path.normalize(entry);
-
-    // Path traversal / absolute path check
-    if (path.isAbsolute(normalised) || normalised.startsWith('..')) {
-      console.error(`BLOCKED: archive contains path-traversal entry: "${entry}"`);
-      console.error('This file may be maliciously crafted. Aborting.');
-      process.exit(5);
-    }
-
-    // Extension allowlist (skip directory entries ending with /)
-    if (!entry.endsWith('/')) {
-      const ext = path.extname(entry).toLowerCase();
-      // Handle compound extensions like .log.gz
-      const doubleExt = path.extname(entry.slice(0, -ext.length)).toLowerCase() + ext;
-      if (!ALLOWED_EXTENSIONS.has(ext) && !ALLOWED_EXTENSIONS.has(doubleExt)) {
-        console.error(`BLOCKED: archive contains file with disallowed extension: "${entry}"`);
-        console.error(`Only ${[...ALLOWED_EXTENSIONS].join(', ')} files are allowed.`);
-        process.exit(5);
-      }
-    }
-  }
-
-  // Check for symlinks inside the archive
-  const verboseResult = spawnSync('tar', ['tvzf', '-'], { input: decrypted, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
-  if (verboseResult.status === 0) {
-    for (const line of verboseResult.stdout.trim().split('\n')) {
-      if (line.startsWith('l') || line.includes(' -> ')) {
-        console.error(`BLOCKED: archive contains a symlink: "${line.trim()}"`);
-        console.error('This file may be maliciously crafted. Aborting.');
-        process.exit(5);
-      }
-    }
-  }
-
-  // --- Safe to extract (piped via stdin, no temp file on disk) ---
-  fs.mkdirSync(outDir, { recursive: true });
-  const extractResult = spawnSync('tar', ['xzf', '-', '-C', outDir], { input: decrypted, stdio: ['pipe', 'inherit', 'inherit'] });
-  if (extractResult.status !== 0) {
-    console.error('Failed to extract archive.');
-    process.exit(4);
-  }
-
-  // Strip execute permissions from all extracted files
-  const files = fs.readdirSync(outDir);
-  for (const f of files) {
-    const filePath = path.join(outDir, f);
-    try {
-      fs.chmodSync(filePath, 0o644);
-    } catch {
-      // Ignore permission errors on platforms that don't support chmod
-    }
-  }
-
-  console.log(`Decrypted and extracted to: ${outDir}/`);
-  console.log(`${files.length} file(s):`);
-  files.forEach(f => console.log(`  ${f}`));
-}
-
-main();