homebridge-openwrt-control 0.3.6 → 0.3.8

package/CHANGELOG.md

@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - After update to v0.1.0 the plugin need to be reconfigured!
 
+## [0.3.8] - (23.09.2026)
+
+### Added
+
+- optional RESTful access `Token`. When set, every request (GET and POST) must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. Leaving it empty keeps the previous behaviour, so existing configs keep working
+- readme update
+
 ## [0.3.6] - (11.05.2026)
 
 ## Changes

package/README.md

@@ -99,6 +99,7 @@
 | `restFul{}` | RESTFul object. |
 | `restFul.enable` | If enabled, RESTful server will start automatically and respond to any path request. |
 | `restFul.port` | Here set the listening `Port` for RESTful server. |
+| `restFul.token` | Here optional set the access token. When set, every request must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. |
 | `mqtt{}` | MQTT object. |
 | `mqtt.enable` | If enabled, MQTT Broker will start automatically and publish all available data. |
 | `mqtt.host` | Here set the `IP Address` or `Hostname` for MQTT Broker. |
@@ -113,6 +114,7 @@
 ### REST Integration
 
 REST POST calls must include a content-type header of `application/json`.
+If `Token` is set, every request (GET and POST) must send the header `Authorization: Bearer <token>`.
 Path `status` response all available paths.
 
 | Method | URL | Path | Response | Type |

package/config.schema.json

@@ -478,6 +478,16 @@
                   "condition": {
                     "functionBody": "return model.devices[arrayIndices].restFul.enable == true;"
                   }
+                },
+                "token": {
+                  "title": "Token",
+                  "type": "string",
+                  "placeholder": "optional",
+                  "description": "Optional access token. When set, every request must send the header 'Authorization: Bearer <token>'. Leave empty to keep the server open on the local network.",
+                  "format": "password",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].restFul.enable == true;"
+                  }
                 }
               }
             },
@@ -782,7 +792,8 @@
                           "title": "RESTFul",
                           "items": [
                             "devices[].restFul.enable",
-                            "devices[].restFul.port"
+                            "devices[].restFul.port",
+                            "devices[].restFul.token"
                           ]
                         },
                         {

package/package.json

@@ -1,7 +1,7 @@
 {
     "displayName": "OpenWrt Control",
     "name": "homebridge-openwrt-control",
-    "version": "0.3.6",
+    "version": "0.3.8",
     "description": "Homebridge plugin to control OpenWrt flashed devices.",
     "license": "MIT",
     "author": "grzegorz914",
@@ -34,8 +34,8 @@
         "node": "^20 || ^22 || ^24 || ^25 || ^26"
     },
     "dependencies": {
-        "mqtt": "^5.15.1",
-        "axios": "^1.16.0",
+        "mqtt": "^5.15.2",
+        "axios": "^1.20.0",
         "express": "^5.2.1"
     },
     "keywords": [

package/src/restful.js

@@ -1,5 +1,6 @@
 import express, { json } from 'express';
 import EventEmitter from 'events';
+import { createHash, timingSafeEqual } from 'crypto';
 
 const DEFAULT_MESSAGE = 'This data is not available at this time.';
 
@@ -7,6 +8,7 @@ class RestFul extends EventEmitter {
     constructor(config) {
         super();
         this.port = config.port;
+        this.token = typeof config.token === 'string' ? config.token.trim() : '';
         this.logWarn = config.logWarn;
         this.logDebug = config.logDebug;
 
@@ -23,6 +25,19 @@ class RestFul extends EventEmitter {
             app.set('json spaces', 2);
             app.use(json());
 
+            // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"
+            if (this.token) {
+                app.use((req, res, next) => {
+                    const header = req.headers.authorization ?? '';
+                    const provided = header.startsWith('Bearer ') ? header.slice(7) : '';
+                    if (!this.tokenValid(provided)) {
+                        if (this.logWarn) this.emit('warn', `RESTFul Unauthorized request from: ${req.ip}, ${req.method} ${req.path}`);
+                        return res.status(401).json({ error: 'RESTFul Unauthorized' });
+                    }
+                    next();
+                });
+            }
+
             // Register GET routes for all keys
             for (const key of Object.keys(this.restFulData)) {
                 app.get(`/${key}`, (req, res) => {
@@ -71,6 +86,13 @@ class RestFul extends EventEmitter {
         }
     }
 
+    tokenValid(provided) {
+        // Compare fixed-length hashes so the check takes the same time regardless of token length or content
+        const a = createHash('sha256').update(provided).digest();
+        const b = createHash('sha256').update(this.token).digest();
+        return timingSafeEqual(a, b);
+    }
+
     update(path, data) {
         if (Object.hasOwn(this.restFulData, path)) {
             this.restFulData[path] = data;

package/src/router.js

@@ -185,6 +185,7 @@ class Router extends EventEmitter {
         if (this.restFul.enable) {
             this.restFul1 = new RestFul({
                 port: this.restFul.port || 3000,
+                token: this.restFul.token,
                 logWarn: this.logWarn,
                 logDebug: this.logDebug
             })