homebridge-melcloud-control 4.11.1 → 4.11.3

package/CHANGELOG.md

@@ -25,7 +25,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - For plugin < v4.6.0 use Homebridge UI <= v5.5.0
 - For plugin >= v4.6.0 use Homebridge UI >= v5.13.0
 
-## [4.11.0] - (23.09.2026)
+## [4.11.3] - (23.09.2026)
+
+### Changes
+
+- readme update, added `mqtt.protocolVersion`
+- sample config update, added `restFul.token` and `mqtt.protocolVersion`
+
+## [4.11.2] - (23.09.2026)
+
+### Changes
+
+- added: optional RESTful access `Token`. When set, every request (GET and POST) must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. Leaving it empty keeps the previous behaviour, so existing configs keep working
+- readme update
+
+## [4.11.1] - (23.09.2026)
 
 ### Changes
 

package/README.md

@@ -358,12 +358,14 @@
 | `log.debug` | This enable debug log will be displayed in console. |
 | `restFul{}` | RSTful object. |
 | `restFul.enable` | This enable RESTful server will start automatically and respond to any path request. |
+| `restFul.token` | Here optional set the access token. When set, every request must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. |
 | `mqtt{}` | MQTT object. |
 | `mqtt.enable` | This enable MQTT Broker will start automatically and publish all awailable PV data. |
 | `mqtt.host` | Here set the `IP Address` or `Hostname` for MQTT Broker. |
 | `mqtt.port` | Here set the `Port` for MQTT Broker, default 1883. |
 | `mqtt.clientId` | Here optional set the `Client Id` of MQTT Broker. |
 | `mqtt.prefix` | Here set the `Prefix` for `Topic` or leave empty. |
+| `mqtt.protocolVersion` | Here select the MQTT protocol version, `5.0` (default) or `3.1.1` for brokers that only support 3.1.1 (e.g. ioBroker MQTT adapter). |
 | `mqtt.auth{}` | MQTT authorization object. |
 | `mqtt.auth.enable` | Here enable authorization for MQTT Broker. |
 | `mqtt.auth.user` | Here set the MQTT Broker user. |
@@ -376,6 +378,7 @@
   * MELCLoud Home, start at `30000`, correct port is displayed in HB log during start.
 * POST data as a JSON Object `{OperationMode: 8}`.
 * Header content type must be `application/json`.
+* If `Token` is set, every request (GET and POST) must send the header `Authorization: Bearer <token>`.
 * Path `status` response all available paths.
 
 | Method | URL | Path | Response | Type |

package/config.schema.json

@@ -2362,6 +2362,16 @@
                   "type": "boolean",
                   "default": false,
                   "description": "This enable RESTful server."
+                },
+                "token": {
+                  "title": "Token",
+                  "type": "string",
+                  "placeholder": "optional",
+                  "description": "Optional access token. When set, every request must send the header 'Authorization: Bearer <token>'. Leave empty to keep the server open on the local network.",
+                  "format": "password",
+                  "condition": {
+                    "functionBody": "return model.accounts[arrayIndices[0]].restFul.enable === true;"
+                  }
                 }
               }
             },
@@ -3074,7 +3084,8 @@
                           "key": "accounts[].restFul",
                           "title": "RESTFul",
                           "items": [
-                            "accounts[].restFul.enable"
+                            "accounts[].restFul.enable",
+                            "accounts[].restFul.token"
                           ]
                         },
                         {

package/index.js

@@ -260,6 +260,7 @@ class MelCloudPlatform {
 					const timer = setTimeout(resolve, 5000);
 					state.restFul1 = new RestFul({
 						port: device.restFul.port,
+						token: device.restFul.token,
 						logWarn: logLevel.warn,
 						logDebug: logLevel.debug,
 					})

package/package.json

@@ -1,7 +1,7 @@
 {
   "displayName": "MELCloud Control",
   "name": "homebridge-melcloud-control",
-  "version": "4.11.1",
+  "version": "4.11.3",
   "description": "Homebridge plugin to control Mitsubishi Air Conditioner, Heat Pump and Energy Recovery Ventilation.",
   "license": "MIT",
   "author": "grzegorz914",

package/src/restful.js

@@ -1,5 +1,6 @@
 import express, { json } from 'express';
 import EventEmitter from 'events';
+import { createHash, timingSafeEqual } from 'crypto';
 
 const DEFAULT_MESSAGE = 'This data is not available at this time.';
 
@@ -7,6 +8,7 @@ class RestFul extends EventEmitter {
     constructor(config) {
         super();
         this.port = config.port;
+        this.token = typeof config.token === 'string' ? config.token.trim() : '';
         this.logWarn = config.logWarn;
         this.logDebug = config.logDebug;
 
@@ -24,6 +26,19 @@ class RestFul extends EventEmitter {
             app.set('json spaces', 2);
             app.use(json());
 
+            // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"
+            if (this.token) {
+                app.use((req, res, next) => {
+                    const header = req.headers.authorization ?? '';
+                    const provided = header.startsWith('Bearer ') ? header.slice(7) : '';
+                    if (!this.tokenValid(provided)) {
+                        if (this.logWarn) this.emit('warn', `RESTFul Unauthorized request from: ${req.ip}, ${req.method} ${req.path}`);
+                        return res.status(401).json({ error: 'RESTFul Unauthorized' });
+                    }
+                    next();
+                });
+            }
+
             // Register GET routes for all keys
             for (const key of Object.keys(this.restFulData)) {
                 app.get(`/${key}`, (req, res) => {
@@ -72,6 +87,13 @@ class RestFul extends EventEmitter {
         }
     }
 
+    tokenValid(provided) {
+        // Compare fixed-length hashes so the check takes the same time regardless of token length or content
+        const a = createHash('sha256').update(provided).digest();
+        const b = createHash('sha256').update(this.token).digest();
+        return timingSafeEqual(a, b);
+    }
+
     update(path, data) {
         if (this.restFulData.hasOwnProperty(path)) {
             this.restFulData[path] = data;