homebridge-tuya-plus 3.14.0-dev.5 → 3.14.0-pr.59.7

package/Changelog.md

@@ -9,6 +9,8 @@ All notable changes to this project will be documented in this file. This projec
   * Works with both **Custom** and **Smart Home** Cloud projects (the latter via app-account login).
   * The existing **IrrigationSystem** accessory works unchanged over the cloud — its data-points are simply addressed by Tuya "code" (e.g. `switch_1`, `battery_percentage`) instead of a numeric id; the device logs its codes on startup. Battery-only controllers with no rain sensor: set `"noRainSensor": true`.
   * See the wiki: **[Tuya Cloud Setup](https://github.com/adrianjagielak/homebridge-tuya-plus/blob/main/wiki/Tuya-Cloud-Setup.md)**.
+* [*] **Fix realtime (MQTT) cloud updates being silently dropped** — external changes (physical buttons, the Tuya app, the device's own timers) now show up in HomeKit within a second or two. The decryptor was verifying the AES-GCM auth tag (`decipher.final()`), but Tuya's real status frames don't carry a tag that verifies against the documented AAD, so every realtime message was being thrown away. Now decrypts with `update()` only, matching the official `tuya/tuya-homebridge` and `0x5e/homebridge-tuya-platform` implementations.
+* [*] **Fix cloud irrigation valves that could be turned on but not off** — the per-zone write coalescer was dropping any command that matched the last-known `device.state`. Cloud devices never optimistically advance `state` (it only moves once the realtime stream confirms the device), so an "off" issued before the "on" was echoed matched the stale "off" and was discarded — HomeKit showed the zone closed while it kept running. Queued commands are now sent as-is (callers already queue only genuine changes).
 
 ## 2.0.1 (2021-03-25)
 This update includes the following changes:

package/lib/IrrigationSystemAccessory.js

@@ -614,16 +614,19 @@ class IrrigationSystemAccessory extends BaseAccessory {
             return;
         }
 
-        const dps = {};
-        let count = 0;
-        Object.keys(pending.dps).forEach(dp => {
-            if (pending.dps[dp] !== this.device.state[dp]) {
-                dps[dp] = pending.dps[dp];
-                count++;
-            }
-        });
-
-        if (count) this.device.update(dps);
+        // Send exactly what was queued. We deliberately do NOT drop data-points
+        // that appear to already match `device.state`: cloud devices never
+        // optimistically advance `state` (it only moves when the realtime/refresh
+        // stream confirms the device), so comparing against it would silently
+        // swallow a genuine command. The most visible symptom was a valve that
+        // could be turned on but never off — the "off" matched the stale "off"
+        // still in `state` (the "on" hadn't been echoed back yet) and was
+        // discarded, so HomeKit showed the zone closed while it kept running.
+        // Callers (_setValveActive, _setSystemActive, the auto-shutoff timers)
+        // already queue only real changes, judged against the HomeKit state the
+        // user sees, so there is nothing left to de-dupe here.
+        const dps = pending.dps;
+        if (Object.keys(dps).length) this.device.update(dps);
     }
 
     _valveService(cfg) {

package/lib/TuyaCloudMessaging.js

@@ -145,12 +145,12 @@ class TuyaCloudMessaging extends EventEmitter {
             envelope = JSON.parse(payload.toString());
         } catch (_) { return; }
 
-        const {protocol, data, t} = envelope;
+        const {protocol, data} = envelope;
         if (!data) return;
 
         let plaintext;
         try {
-            plaintext = this._decrypt(data, this.config && this.config.password, t);
+            plaintext = this._decrypt(data, this.config && this.config.password);
         } catch (ex) {
             this.log.debug(`Tuya Cloud realtime decrypt failed: ${ex.message}`);
             return;
@@ -179,26 +179,31 @@ class TuyaCloudMessaging extends EventEmitter {
     // Decrypt the MQTT `data` field. msg_encrypted_version 2.0 → AES-128-GCM,
     // 1.0 → AES-128-ECB. The AES key is the middle 16 chars of the broker
     // password (NOT the project Access Secret).
-    _decrypt(data, password, t) {
+    //
+    // The GCM auth tag is intentionally NOT verified: Tuya's real status frames
+    // do not carry a tag that verifies against the documented AAD, so calling
+    // `decipher.final()` would throw on every genuine message and silently drop
+    // all realtime updates. AES-GCM is a stream cipher, so `update()` alone
+    // recovers the plaintext correctly regardless of the tag; a wrong key just
+    // yields garbage that the subsequent JSON.parse rejects. Both the official
+    // `tuya/tuya-homebridge` and `0x5e/homebridge-tuya-platform` decrypt with
+    // `update()` only, for exactly this reason — `final()` here was the bug that
+    // stopped external changes (physical buttons, the Tuya app) from showing up.
+    _decrypt(data, password) {
         const key = Buffer.from(('' + (password || '')).substring(8, 24), 'utf8');
         const buf = Buffer.from(data, 'base64');
 
         // GCM (v2.0) layout: [ivLen(4) BE][iv(ivLen)][ciphertext][tag(16)].
-        // Try it first; if the header doesn't look like a sane IV length, or
-        // auth fails, fall back to ECB (v1.0).
+        // Try it first; if the header doesn't look like a sane IV length, fall
+        // back to ECB (v1.0).
         if (buf.length > 4 + GCM_TAG_LENGTH) {
             const ivLen = buf.readUIntBE(0, 4);
             if (ivLen >= 12 && ivLen <= 16 && (4 + ivLen + GCM_TAG_LENGTH) <= buf.length) {
                 try {
                     const iv = buf.slice(4, 4 + ivLen);
                     const ciphertext = buf.slice(4 + ivLen, buf.length - GCM_TAG_LENGTH);
-                    const tag = buf.slice(buf.length - GCM_TAG_LENGTH);
                     const decipher = crypto.createDecipheriv('aes-128-gcm', key, iv);
-                    decipher.setAuthTag(tag);
-                    const aad = Buffer.allocUnsafe(6);
-                    aad.writeUIntBE(Number(t) || 0, 0, 6);
-                    decipher.setAAD(aad);
-                    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+                    return decipher.update(ciphertext).toString('utf8');
                 } catch (gcmEx) {
                     // fall through to ECB
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "homebridge-tuya-plus",
-  "version": "3.14.0-dev.5",
+  "version": "3.14.0-pr.59.7",
   "description": "A community-maintained Homebridge plugin for controlling Tuya devices locally over LAN. Includes new features, fixes, and updated device support.",
   "main": "index.js",
   "scripts": {

package/test/IrrigationSystemAccessory.test.js

@@ -492,4 +492,36 @@ describe('IrrigationSystemAccessory — cloud mode (data-points keyed by code)',
         jest.advanceTimersByTime(500);
         expect(device.update).toHaveBeenCalledWith({ zone_b: true });
     });
+
+    test('turning a zone off still writes false when the cloud never echoed the "on"', () => {
+        // The real cloud device never optimistically advances `state`; it only
+        // moves when the realtime stream confirms the device. Emulate that by
+        // making update() a no-op on state. A follow-up "off" must STILL be sent
+        // — otherwise the valve stays open while HomeKit shows it closed (the
+        // exact "can turn on but not off" report).
+        const { accessory, device } = makeHarness(cloudState(), { ...cloudCtx, defaultDuration: 0 });
+        device.update.mockImplementation(() => true); // writes never touch state
+        const v = valve(accessory, 'switch_1');
+
+        v.getCharacteristic(Characteristic.Active).triggerSet(1);
+        jest.advanceTimersByTime(500);
+        expect(device.update).toHaveBeenLastCalledWith({ switch_1: true });
+
+        v.getCharacteristic(Characteristic.Active).triggerSet(0);
+        jest.advanceTimersByTime(500);
+        expect(device.update).toHaveBeenLastCalledWith({ switch_1: false });
+    });
+
+    test('master OFF closes zones the cloud has not echoed as open', () => {
+        const { accessory, device } = makeHarness(cloudState(), { ...cloudCtx, defaultDuration: 0 });
+        device.update.mockImplementation(() => true); // writes never touch state
+
+        valve(accessory, 'switch_1').getCharacteristic(Characteristic.Active).triggerSet(1);
+        valve(accessory, 'switch_2').getCharacteristic(Characteristic.Active).triggerSet(1);
+        jest.advanceTimersByTime(500);
+
+        irrigation(accessory).getCharacteristic(Characteristic.Active).triggerSet(0);
+        jest.advanceTimersByTime(500);
+        expect(device.update).toHaveBeenLastCalledWith({ switch_1: false, switch_2: false });
+    });
 });

package/test/TuyaCloudMessaging.test.js

@@ -56,6 +56,30 @@ describe('TuyaCloudMessaging — decryption + dispatch', () => {
         expect(received[0]).toEqual([{code: 'switch_1', value: true, t}, {code: 'battery_percentage', value: 80, t}]);
     });
 
+    test('decrypts a GCM frame even when the auth tag does not verify (Tuya quirk)', () => {
+        // Real Tuya status frames carry a GCM tag that does NOT verify against
+        // the documented AAD. We must decrypt with update() only (no final(),
+        // no tag check) or every realtime update is silently dropped — which is
+        // exactly what stopped external changes from reaching HomeKit. Simulate
+        // it by clobbering the trailing 16-byte tag: the plaintext must still
+        // come through.
+        const mq = makeIdle();
+        const received = [];
+        mq.subscribeDevice('DEV1', status => received.push(status));
+
+        const t = Date.now();
+        const raw = Buffer.from(
+            encryptGCM(JSON.stringify({devId: 'DEV1', status: [{code: 'switch_1', value: true}]}), mq.config.password, t),
+            'base64'
+        );
+        crypto.randomBytes(16).copy(raw, raw.length - 16); // corrupt the auth tag
+
+        mq._onMessage('topic', Buffer.from(JSON.stringify({protocol: 4, data: raw.toString('base64'), t})));
+
+        expect(received).toHaveLength(1);
+        expect(received[0]).toEqual([{code: 'switch_1', value: true}]);
+    });
+
     test('decrypts a legacy ECB (v1.0) frame too', () => {
         const mq = makeIdle();
         const received = [];