homebridge-openwrt-control 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -9,6 +9,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - After update to v0.1.0 the plugin need to be reconfigured!
 
+## [0.3.9] - (23.09.2026)
+
+### Changes
+
+- fix: MQTT client had `protocolVersion: 5` hardcoded, so brokers that only support MQTT 3.1.1 (e.g. the ioBroker MQTT adapter) accepted the TCP connection, failed the handshake, and got disconnected every second forever, with nothing published and no error logged. Added a `Protocol Version` option (5.0 / 3.1.1) in the MQTT section, and a one-time warning if no successful connection is established within 30 seconds
+- readme update
+- sample config update
+
+## [0.3.8] - (23.09.2026)
+
+### Added
+
+- optional RESTful access `Token`. When set, every request (GET and POST) must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. Leaving it empty keeps the previous behaviour, so existing configs keep working
+- readme update
+
+## [0.3.7] - (13.09.2026)
+
+### Changes
+
+- bump dependencies
+
 ## [0.3.6] - (11.05.2026)
 
 ## Changes

package/README.md

@@ -99,12 +99,14 @@
 | `restFul{}` | RESTFul object. |
 | `restFul.enable` | If enabled, RESTful server will start automatically and respond to any path request. |
 | `restFul.port` | Here set the listening `Port` for RESTful server. |
+| `restFul.token` | Here optional set the access token. When set, every request must send the header `Authorization: Bearer <token>`, otherwise the server responds `401`. |
 | `mqtt{}` | MQTT object. |
 | `mqtt.enable` | If enabled, MQTT Broker will start automatically and publish all available data. |
 | `mqtt.host` | Here set the `IP Address` or `Hostname` for MQTT Broker. |
 | `mqtt.port` | Here set the `Port` for MQTT Broker, default 1883. |
 | `mqtt.clientId` | Here optional set the `Client Id` of MQTT Broker. |
 | `mqtt.prefix` | Here set the `Prefix` for `Topic` or leave empty. |
+| `mqtt.protocolVersion` | Here select the MQTT protocol version, `5.0` (default) or `3.1.1` for brokers that only support 3.1.1 (e.g. ioBroker MQTT adapter). |
 | `mqtt.auth{}` | MQTT authorization object. |
 | `mqtt.auth.enable` | Here enable authorization for MQTT Broker. |
 | `mqtt.auth.user` | Here set the MQTT Broker `Username`. |
@@ -113,6 +115,7 @@
 ### REST Integration
 
 REST POST calls must include a content-type header of `application/json`.
+If `Token` is set, every request (GET and POST) must send the header `Authorization: Bearer <token>`.
 Path `status` response all available paths.
 
 | Method | URL | Path | Response | Type |

package/config.schema.json

@@ -478,6 +478,16 @@
                   "condition": {
                     "functionBody": "return model.devices[arrayIndices].restFul.enable == true;"
                   }
+                },
+                "token": {
+                  "title": "Token",
+                  "type": "string",
+                  "placeholder": "optional",
+                  "description": "Optional access token. When set, every request must send the header 'Authorization: Bearer <token>'. Leave empty to keep the server open on the local network.",
+                  "format": "password",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].restFul.enable == true;"
+                  }
                 }
               }
             },
@@ -528,6 +538,25 @@
                     "functionBody": "return model.devices[arrayIndices].mqtt.enable == true;"
                   }
                 },
+                "protocolVersion": {
+                  "title": "Protocol Version",
+                  "type": "integer",
+                  "default": 5,
+                  "oneOf": [
+                    {
+                      "title": "5.0",
+                      "enum": [5]
+                    },
+                    {
+                      "title": "3.1.1",
+                      "enum": [4]
+                    }
+                  ],
+                  "description": "MQTT protocol version used to connect to the broker. Some brokers (e.g. the ioBroker MQTT adapter) only support 3.1.1 and will silently reject 5.0 connections.",
+                  "condition": {
+                    "functionBody": "return model.devices[arrayIndices].mqtt.enable == true;"
+                  }
+                },
                 "auth": {
                   "title": "Authorization",
                   "type": "object",
@@ -782,7 +811,8 @@
                           "title": "RESTFul",
                           "items": [
                             "devices[].restFul.enable",
-                            "devices[].restFul.port"
+                            "devices[].restFul.port",
+                            "devices[].restFul.token"
                           ]
                         },
                         {
@@ -794,6 +824,7 @@
                             "devices[].mqtt.port",
                             "devices[].mqtt.clientId",
                             "devices[].mqtt.prefix",
+                            "devices[].mqtt.protocolVersion",
                             {
                               "key": "devices[].mqtt.auth",
                               "title": "Authorization",

package/package.json

@@ -1,7 +1,7 @@
 {
     "displayName": "OpenWrt Control",
     "name": "homebridge-openwrt-control",
-    "version": "0.3.7",
+    "version": "0.3.9",
     "description": "Homebridge plugin to control OpenWrt flashed devices.",
     "license": "MIT",
     "author": "grzegorz914",

package/src/mqtt.js

@@ -8,35 +8,47 @@ class Mqtt extends EventEmitter {
 
         const url = `mqtt://${config.host}:${config.port}`;
         const subscribeTopic = `${config.prefix}/Set`;
+        const protocolVersion = config.protocolVersion === 4 ? 4 : 5;
+        const isV5 = protocolVersion === 5;
+        this.isV5 = isV5;
 
         const options = {
             clientId: config.clientId,
             username: config.user,
             password: config.passwd,
-            protocolVersion: 5,
-            clean: false,
-            properties: {
-                sessionExpiryInterval: 60 * 60,
-                userProperties: {
-                    source: 'node-client'
+            protocolVersion,
+            clean: !isV5,
+            ...(isV5 ? {
+                properties: {
+                    sessionExpiryInterval: 60 * 60,
+                    userProperties: {
+                        source: 'node-client'
+                    }
                 }
-            }
+            } : {})
         };
 
+        const startTime = Date.now();
+        let hasConnected = false;
+        let warnedStalled = false;
+
         this.mqttClient = connect(url, options)
             .on('connect', async () => {
-                this.emit('connected', 'MQTT v5 connected.');
+                hasConnected = true;
+                this.emit('connected', `MQTT v${protocolVersion} connected.`);
 
                 try {
                     await new Promise((resolve, reject) => {
                         this.mqttClient.subscribe(subscribeTopic,
                             {
                                 qos: 1,
-                                properties: {
-                                    userProperties: {
-                                        type: 'subscription'
+                                ...(isV5 ? {
+                                    properties: {
+                                        userProperties: {
+                                            type: 'subscription'
+                                        }
                                     }
-                                }
+                                } : {})
                             },
                             (error) => {
                                 if (error) return reject(error);
@@ -69,6 +81,10 @@ class Mqtt extends EventEmitter {
                 if (config.logDebug) this.emit('debug', 'MQTT Reconnecting...');
             })
             .on('close', () => {
+                if (!hasConnected && !warnedStalled && Date.now() - startTime > 30000) {
+                    warnedStalled = true;
+                    this.emit('warn', `MQTT has not connected after 30s of retries using protocol v${protocolVersion}. Check broker address, credentials, and whether the broker supports this MQTT protocol version.`);
+                }
                 if (config.logDebug) this.emit('debug', 'MQTT Connection closed.');
             });
     }
@@ -81,13 +97,15 @@ class Mqtt extends EventEmitter {
             this.mqttClient.publish(fullTopic, publishMessage,
                 {
                     qos: 1,
-                    properties: {
-                        contentType: 'application/json',
-                        userProperties: {
-                            source: 'node',
-                            action: 'set'
+                    ...(this.isV5 ? {
+                        properties: {
+                            contentType: 'application/json',
+                            userProperties: {
+                                source: 'node',
+                                action: 'set'
+                            }
                         }
-                    }
+                    } : {})
                 },
                 (error) => {
                     if (error) {

package/src/restful.js

@@ -1,5 +1,6 @@
 import express, { json } from 'express';
 import EventEmitter from 'events';
+import { createHash, timingSafeEqual } from 'crypto';
 
 const DEFAULT_MESSAGE = 'This data is not available at this time.';
 
@@ -7,6 +8,7 @@ class RestFul extends EventEmitter {
     constructor(config) {
         super();
         this.port = config.port;
+        this.token = typeof config.token === 'string' ? config.token.trim() : '';
         this.logWarn = config.logWarn;
         this.logDebug = config.logDebug;
 
@@ -23,6 +25,19 @@ class RestFul extends EventEmitter {
             app.set('json spaces', 2);
             app.use(json());
 
+            // Optional token auth, when a token is configured every route requires "Authorization: Bearer <token>"
+            if (this.token) {
+                app.use((req, res, next) => {
+                    const header = req.headers.authorization ?? '';
+                    const provided = header.startsWith('Bearer ') ? header.slice(7) : '';
+                    if (!this.tokenValid(provided)) {
+                        if (this.logWarn) this.emit('warn', `RESTFul Unauthorized request from: ${req.ip}, ${req.method} ${req.path}`);
+                        return res.status(401).json({ error: 'RESTFul Unauthorized' });
+                    }
+                    next();
+                });
+            }
+
             // Register GET routes for all keys
             for (const key of Object.keys(this.restFulData)) {
                 app.get(`/${key}`, (req, res) => {
@@ -71,6 +86,13 @@ class RestFul extends EventEmitter {
         }
     }
 
+    tokenValid(provided) {
+        // Compare fixed-length hashes so the check takes the same time regardless of token length or content
+        const a = createHash('sha256').update(provided).digest();
+        const b = createHash('sha256').update(this.token).digest();
+        return timingSafeEqual(a, b);
+    }
+
     update(path, data) {
         if (Object.hasOwn(this.restFulData, path)) {
             this.restFulData[path] = data;

package/src/router.js

@@ -185,6 +185,7 @@ class Router extends EventEmitter {
         if (this.restFul.enable) {
             this.restFul1 = new RestFul({
                 port: this.restFul.port || 3000,
+                token: this.restFul.token,
                 logWarn: this.logWarn,
                 logDebug: this.logDebug
             })
@@ -206,6 +207,7 @@ class Router extends EventEmitter {
                 port: this.mqtt.port || 1883,
                 clientId: `${this.name}_${Math.random().toString(16).slice(3)}`,
                 prefix: this.mqtt.prefix ? `${this.openWrtInfo.systemInfo.model}/${this.mqtt.prefix}/${this.name}` : `${this.openWrtInfo.systemInfo.model}/${this.name}`,
+                protocolVersion: this.mqtt.protocolVersion,
                 user: this.mqtt.auth?.user,
                 passwd: this.mqtt.auth?.passwd,
                 logWarn: this.logWarn,