homebridge-melcloud-control 4.11.0 → 4.11.2

package/CHANGELOG.md

@@ -25,7 +25,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - For plugin < v4.6.0 use Homebridge UI <= v5.5.0
 - For plugin >= v4.6.0 use Homebridge UI >= v5.13.0
 
-## [4.11.0] - (23.09.2026)
+## [4.11.2] - (23.09.2026)
+
+### Changes
+
+- added: optional RESTful access `Token`. When set, every request (GET and POST) must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. Leaving it empty keeps the previous behaviour, so existing configs keep working
+- readme update
+
+## [4.11.1] - (23.09.2026)
 
 ### Changes
 

package/README.md

@@ -358,6 +358,7 @@
 | `log.debug` | This enable debug log will be displayed in console. |
 | `restFul{}` | RSTful object. |
 | `restFul.enable` | This enable RESTful server will start automatically and respond to any path request. |
+| `restFul.token` | Here optional set the access token. When set, every request must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. |
 | `mqtt{}` | MQTT object. |
 | `mqtt.enable` | This enable MQTT Broker will start automatically and publish all awailable PV data. |
 | `mqtt.host` | Here set the `IP Address` or `Hostname` for MQTT Broker. |
@@ -376,6 +377,7 @@
   * MELCLoud Home, start at `30000`, correct port is displayed in HB log during start.
 * POST data as a JSON Object `{OperationMode: 8}`.
 * Header content type must be `application/json`.
+* If `Token` is set, every request (GET and POST) must send the header `Authorization: Bearer <token>`.
 * Path `status` response all available paths.
 
 | Method | URL | Path | Response | Type |

package/config.schema.json

@@ -2362,6 +2362,16 @@
                   "type": "boolean",
                   "default": false,
                   "description": "This enable RESTful server."
+                },
+                "token": {
+                  "title": "Token",
+                  "type": "string",
+                  "placeholder": "optional",
+                  "description": "Optional access token. When set, every request must send the header 'Authorization: Bearer <token>'. Leave empty to keep the server open on the local network.",
+                  "format": "password",
+                  "condition": {
+                    "functionBody": "return model.accounts[arrayIndices[0]].restFul.enable === true;"
+                  }
                 }
               }
             },
@@ -3074,7 +3084,8 @@
                           "key": "accounts[].restFul",
                           "title": "RESTFul",
                           "items": [
-                            "accounts[].restFul.enable"
+                            "accounts[].restFul.enable",
+                            "accounts[].restFul.token"
                           ]
                         },
                         {

package/index.js

@@ -260,6 +260,7 @@ class MelCloudPlatform {
 					const timer = setTimeout(resolve, 5000);
 					state.restFul1 = new RestFul({
 						port: device.restFul.port,
+						token: device.restFul.token,
 						logWarn: logLevel.warn,
 						logDebug: logLevel.debug,
 					})

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "MELCloud Control",
   "name": "homebridge-melcloud-control",
-  "version": "4.11.0",
+  "version": "4.11.2",
   "description": "Homebridge plugin to control Mitsubishi Air Conditioner, Heat Pump and Energy Recovery Ventilation.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/melcloudata.js

@@ -344,7 +344,7 @@ class MelCloudAta extends EventEmitter {
                     }
 
                     //send payload
-                    if (!this.logDebug) this.emit('debug', `Send data: ${JSON.stringify(payload, null, 2)}`);
+                    if (this.logDebug) this.emit('debug', `Send data: ${JSON.stringify(payload, null, 2)}`);
                     await this.client(path, { method: method, data: payload });
                     return true;
                 default:

package/src/restful.js

@@ -1,5 +1,6 @@
 import express, { json } from 'express';
 import EventEmitter from 'events';
+import { createHash, timingSafeEqual } from 'crypto';
 
 const DEFAULT_MESSAGE = 'This data is not available at this time.';
 
@@ -7,6 +8,7 @@ class RestFul extends EventEmitter {
     constructor(config) {
         super();
         this.port = config.port;
+        this.token = typeof config.token === 'string' ? config.token.trim() : '';
         this.logWarn = config.logWarn;
         this.logDebug = config.logDebug;
 
@@ -24,6 +26,19 @@ class RestFul extends EventEmitter {
             app.set('json spaces', 2);
             app.use(json());
 
+            // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"
+            if (this.token) {
+                app.use((req, res, next) => {
+                    const header = req.headers.authorization ?? '';
+                    const provided = header.startsWith('Bearer ') ? header.slice(7) : '';
+                    if (!this.tokenValid(provided)) {
+                        if (this.logWarn) this.emit('warn', `RESTFul Unauthorized request from: ${req.ip}, ${req.method} ${req.path}`);
+                        return res.status(401).json({ error: 'RESTFul Unauthorized' });
+                    }
+                    next();
+                });
+            }
+
             // Register GET routes for all keys
             for (const key of Object.keys(this.restFulData)) {
                 app.get(`/${key}`, (req, res) => {
@@ -72,6 +87,13 @@ class RestFul extends EventEmitter {
         }
     }
 
+    tokenValid(provided) {
+        // Compare fixed-length hashes so the check takes the same time regardless of token length or content
+        const a = createHash('sha256').update(provided).digest();
+        const b = createHash('sha256').update(this.token).digest();
+        return timingSafeEqual(a, b);
+    }
+
     update(path, data) {
         if (this.restFulData.hasOwnProperty(path)) {
             this.restFulData[path] = data;