node-red-contrib-ccu 4.6.2 → 4.7.1

package/nodes/lib/initretry.js

@@ -5,8 +5,13 @@
  * addon started before the interfaces, a daemon restart) used to leave the
  * interface without events: rpcCheckInit only runs with cached devices and
  * then waits pingTimeout (600 s for HmIP-RF). Now a failed init schedules its
- * own retry, 1 s, 2 s, 4 s, 8 s and then every 15 s (task 12), until it
- * succeeds or the node is closed.
+ * own retry (task 12) until it succeeds or the node is closed: every 3 s for
+ * the first 90 s after the interface was first missed (the start, or the
+ * moment a connected process went away), then every 15 s (task 17 - the
+ * 1/2/4/8/15 s steps of before hit hmipserver's ready moment, ~50-55 s after
+ * an openccu-lite boot, only at their 61 s tick). When one interface appears
+ * the others that are waiting are tried at once (poke): rfd and hmipserver
+ * come up close together.
  *
  * While the process is unreachable the interface is "waiting": one line, then
  * debug. Before the interface was ever connected, a refused connection is
@@ -17,20 +22,22 @@
  * distinct fault.
  */
 
-const RETRY_DELAYS = [1000, 2000, 4000, 8000];
+const RETRY_INTERVAL = 3000;
+const RETRY_WINDOW = 90000;
 const RETRY_MAX_DELAY = 15000;
 
 /**
- * The delay before the next attempt.
- * @param {number} failures failed attempts so far (1 after the first failure)
- * @returns {number} milliseconds
+ * The delay before the next attempt (task 17).
+ * @param {number} elapsed milliseconds since the interface was first missed
+ * @returns {number} milliseconds: 3 s within the first 90 s, then 15 s
  */
-function retryDelay(failures) {
-    if (failures >= 1 && failures <= RETRY_DELAYS.length) {
-        return RETRY_DELAYS[failures - 1];
-    }
+function retryDelay(elapsed) {
+    return elapsed < RETRY_WINDOW ? RETRY_INTERVAL : RETRY_MAX_DELAY;
+}
 
-    return RETRY_MAX_DELAY;
+/** @param {number} ms @returns {string} seconds with one decimal, e.g. "54.0 s" */
+function seconds(ms) {
+    return (Math.max(0, ms) / 1000).toFixed(1) + ' s';
 }
 
 /**
@@ -92,14 +99,19 @@ class InitRetry {
      * @param {object} options.logger {debug, info, warn, error}
      * @param {function(string)} options.onState 'waiting' | 'failed' | 'connected'
      * @param {object} [options.timers] {setTimeout, clearTimeout}, for tests
+     * @param {function(): number} [options.now] the clock, for tests
+     * @param {number} [options.startedAt] when the program (the connection node) started, for the log line
      */
-    constructor({iface, attempt, logger, onState, timers}) {
+    constructor({iface, attempt, logger, onState, timers, now, startedAt}) {
         this.iface = iface;
         this.attempt = attempt;
         this.logger = logger;
         this.onState = onState || (() => {});
         this.timers = timers || {setTimeout, clearTimeout};
+        this.now = now || Date.now;
+        this.startedAt = startedAt === undefined ? this.now() : startedAt;
         this.timer = null;
+        this.running = false;
         this.stopped = false;
         this.everConnected = false;
         this.reset();
@@ -109,6 +121,8 @@ class InitRetry {
         this.failures = 0;
         this.warned = false;
         this.faults = new Set();
+        // task 17: when the process was first missed - the 90 s of 3 s steps count from here
+        this.missedAt = null;
     }
 
     /** true while a retry is scheduled */
@@ -125,8 +139,12 @@ class InitRetry {
             return;
         }
 
+        if (this.failures === 0) {
+            this.missedAt = this.now();
+        }
+
         this.failures += 1;
-        const delay = retryDelay(this.failures);
+        const delay = retryDelay(this.now() - this.missedAt);
         const seconds = delay / 1000;
         const reason = describeError(error);
         if (isFault(error)) {
@@ -177,14 +195,38 @@ class InitRetry {
             return Promise.resolve();
         }
 
+        this.running = true;
         return Promise.resolve()
             .then(() => this.attempt())
             .then(
-                () => this.succeeded(),
-                (error) => this.failed(error),
+                () => {
+                    this.running = false;
+                    this.succeeded();
+                },
+                (error) => {
+                    this.running = false;
+                    this.failed(error);
+                },
             );
     }
 
+    /**
+     * task 17: another interface just appeared - try this one now instead of at its timer
+     * (rfd and hmipserver come up close together). Nothing while an attempt is running or
+     * none is scheduled.
+     * @returns {boolean} whether an attempt was started
+     */
+    poke() {
+        if (this.stopped || this.running || this.timer === null) {
+            return false;
+        }
+
+        this.clear();
+        this.logger.debug(this.iface + ': another interface appeared, trying now');
+        this.run();
+        return true;
+    }
+
     /** an init attempt succeeded */
     succeeded() {
         if (this.stopped) {
@@ -193,7 +235,11 @@ class InitRetry {
 
         this.clear();
         if (this.failures > 0) {
-            this.logger.info(this.iface + ' connected after ' + (this.failures + 1) + ' attempts');
+            // task 17: one line with the time, so a log shows how close the start got to the process's ready moment
+            const since = this.everConnected
+                ? seconds(this.now() - this.missedAt) + ' after it went missing'
+                : seconds(this.now() - this.startedAt) + ' after the start';
+            this.logger.info(this.iface + ' connected after ' + (this.failures + 1) + ' attempts, ' + since);
         }
 
         this.everConnected = true;
@@ -215,4 +261,13 @@ class InitRetry {
     }
 }
 
-module.exports = {InitRetry, retryDelay, isFault, isRefused, describeError, RETRY_DELAYS, RETRY_MAX_DELAY};
+module.exports = {
+    InitRetry,
+    retryDelay,
+    isFault,
+    isRefused,
+    describeError,
+    RETRY_INTERVAL,
+    RETRY_WINDOW,
+    RETRY_MAX_DELAY,
+};

package/nodes/lib/lite.js

@@ -0,0 +1,363 @@
+/*
+ * task 14: the interfaces of an openccu-lite system through its lite-rpc, with occulite-client,
+ * instead of XML-RPC/BIN-RPC clients and callback servers of our own.
+ *
+ * One client per connection node: the requests go to /api/rpc/v1 with the credential, the events
+ * come from the stream the client opens (resumed after a break, re-read after a restart of the
+ * system), and `callbackEvents` turns them into the very calls a callback server would make -
+ * event, system.multicall, newDevices, deleteDevices, updateDevice, replaceDevice, readdedDevice
+ * with the same argument lists - so the connection's rpcMethods table feeds from it unchanged.
+ * No init, no ping, no callback ports for these interfaces. CUxD and CCU-Jack are not carried by
+ * lite-rpc and keep their own clients.
+ *
+ * The credential: the openccu-lite token of the connection node, else the addon's own token the
+ * system mints for RedMatic from its manifest (/run/occulite/addon-tokens/redmatic.api). The local
+ * token (meta:read alone) is no credential for lite-rpc.
+ *
+ * occulite-client is ESM; it is loaded here, lazily, so a CCU user never loads it and a Node too
+ * old for require(esm) gets a message instead of a crash (B-32's lesson).
+ */
+
+const fs = require('fs');
+
+const LITE_INTERFACES = ['BidCos-RF', 'BidCos-Wired', 'HmIP-RF', 'VirtualDevices'];
+const ADDON_TOKEN_FILE = '/run/occulite/addon-tokens/redmatic.api';
+
+/** the stream's events as the callback server's methods, see callbackEvents() */
+const CALLBACK_METHODS = [
+    'event',
+    'system.multicall',
+    'newDevices',
+    'deleteDevices',
+    'updateDevice',
+    'replaceDevice',
+    'readdedDevice',
+];
+
+let modules = null;
+
+/**
+ * occulite-client, loaded once. Throws with a readable message where it cannot be loaded.
+ * @returns {{OccuLite: Function, callbackEvents: Function, nodeTransport: Function}}
+ */
+function load() {
+    if (!modules) {
+        try {
+            const {OccuLite} = require('occulite-client');
+            const {callbackEvents} = require('occulite-client/callbacks');
+            const {nodeTransport} = require('occulite-client/node');
+            modules = {OccuLite, callbackEvents, nodeTransport};
+        } catch (error) {
+            throw new Error(
+                'occulite-client cannot be loaded (' +
+                    (error.message || error) +
+                    '): lite-rpc needs Node.js 20.19, 22.12 or newer; the direct connection is used instead',
+            );
+        }
+    }
+
+    return modules;
+}
+
+/**
+ * The addon's own token on an openccu-lite system (RedMatic's, minted from its manifest), or
+ * undefined where there is none.
+ * @param {string} [file] the token file, for tests
+ * @returns {string|undefined}
+ */
+function readAddonToken(file = module.exports.ADDON_TOKEN_FILE) {
+    try {
+        const token = fs.readFileSync(file, 'utf8').trim();
+        return token === '' ? undefined : token;
+    } catch {
+        return undefined;
+    }
+}
+
+/**
+ * Whether an error of the client is an RPC fault of the interface process (the process answered).
+ * @param {*} error
+ * @returns {boolean}
+ */
+function isFault(error) {
+    return kindOf(error) === 'rpc-fault' && error.faultCode !== undefined;
+}
+
+/**
+ * The client's error kind: occulite-client's OccuLiteError carries it as `code` (rpc-fault,
+ * forbidden, timeout ...); `kind` is ours, on an error translated before. A Node system error's
+ * `code` (ECONNREFUSED ...) is not a kind.
+ * @param {*} error
+ * @returns {string|undefined}
+ */
+function kindOf(error) {
+    if (!error) {
+        return undefined;
+    }
+
+    if (error.kind) {
+        return error.kind;
+    }
+
+    return error.name === 'OccuLiteError' && typeof error.code === 'string' ? error.code : undefined;
+}
+
+/**
+ * The client's error as the connection reports it: a fault keeps its code and string, a refused
+ * scope says which, everything else its kind.
+ * @param {*} error
+ * @returns {Error}
+ */
+function translateError(error) {
+    if (isFault(error)) {
+        const fault = new Error(error.faultString || error.message);
+        fault.faultCode = error.faultCode;
+        fault.faultString = error.faultString || error.message;
+        return fault;
+    }
+
+    const kind = kindOf(error);
+    if (kind === 'forbidden') {
+        const refused = new Error(
+            'the openccu-lite token may not call this method' + (error.scope ? ' (needs ' + error.scope + ')' : ''),
+        );
+        refused.kind = 'forbidden';
+        refused.scope = error.scope;
+        return refused;
+    }
+
+    if (kind) {
+        const translated = new Error(error.message || kind);
+        translated.kind = kind;
+        return translated;
+    }
+
+    return error instanceof Error ? error : new Error(String(error));
+}
+
+/**
+ * B-41: cast.js marks a FLOAT as homematic-xmlrpc's `{explicitDouble: n}` (the XML-RPC client's
+ * `<double>`). lite-rpc's JSON path does not know that marker and would hand the process a struct
+ * where a double belongs - hs485d and hmipserver refuse it. Its own marker is `{double: n}`
+ * (capability `json_double`); a system without it gets the plain number. Walks the whole
+ * parameter list: the top level, structs and paramsets, a multicall's calls.
+ * @param {*} value
+ * @param {boolean} jsonDouble whether the system announces `json_double`
+ * @returns {*} the value for lite-rpc
+ */
+function liteValue(value, jsonDouble) {
+    if (Array.isArray(value)) {
+        return value.map((item) => liteValue(item, jsonDouble));
+    }
+
+    if (value && typeof value === 'object' && Object.getPrototypeOf(value) === Object.prototype) {
+        const keys = Object.keys(value);
+        if (keys.length === 1 && keys[0] === 'explicitDouble') {
+            const number = Number(value.explicitDouble);
+            return jsonDouble ? {double: number} : number;
+        }
+
+        const out = {};
+        keys.forEach((key) => {
+            out[key] = liteValue(value[key], jsonDouble);
+        });
+        return out;
+    }
+
+    return value;
+}
+
+const RPC_TIERS = ['rpc:operate', 'rpc:configure', 'rpc:admin'];
+
+/**
+ * occulite-client B-3: the client decides "names only" from the literal `rpc:read` in
+ * GET /api/auth/v1/state, but a token made with a higher tier (rpc:admin, say) carries that tier
+ * alone - the system includes the lower ones. The transport spells `rpc:read` out for the client
+ * where a tier implies it. Goes once the package fixes it.
+ * @param {object} transport occulite-client's Transport
+ * @returns {object} the same transport
+ */
+function tierAwareTransport(transport) {
+    return {
+        request: (method, url, headers, body, signal) =>
+            transport.request(method, url, headers, body, signal).then((response) => {
+                if (response.status !== 200 || !/\/api\/auth\/v1\/state(\?|$)/.test(String(url))) {
+                    return response;
+                }
+
+                let parsed;
+                try {
+                    parsed = JSON.parse(response.body);
+                } catch {
+                    return response;
+                }
+
+                const scopes = Array.isArray(parsed && parsed.scopes) ? parsed.scopes : [];
+                if (scopes.includes('rpc:read') || !scopes.some((scope) => RPC_TIERS.includes(scope))) {
+                    return response;
+                }
+
+                return {...response, body: JSON.stringify({...parsed, scopes: [...scopes, 'rpc:read']})};
+            }),
+        stream: (url, headers, signal) => transport.stream(url, headers, signal),
+    };
+}
+
+class LiteConnection {
+    /**
+     * @param {object} options
+     * @param {string} options.url the system, scheme and authority
+     * @param {string} options.token the credential
+     * @param {boolean} [options.insecure] accept any certificate
+     * @param {string[]} options.interfaces the interfaces to follow (the enabled ones lite-rpc carries)
+     * @param {function(string): string} options.initId the init id the connection's callback table expects per interface
+     * @param {function(string, *, Array, Function)} options.onCallback (method, err, params, answer): a callback server's call
+     * @param {function(string, string)} options.onInterface (iface, state): up | down | restarted | added | removed
+     * @param {function(string)} options.onStatus the client's state: connecting | ready | degraded | offline | closed
+     * @param {function(Map)} [options.onValues] box.values once ready (the state store's picture)
+     * @param {object} options.logger {debug, info, warn, error}
+     * @param {number} [options.timeout] per request, ms
+     * @param {Function} [options.createClient] for tests, in place of new OccuLite()
+     */
+    constructor(options) {
+        this.options = options;
+        this.interfaces = [...options.interfaces];
+        this.logger = options.logger;
+        this.box = null;
+        this.server = null;
+        this.closed = false;
+        this.ready = false;
+    }
+
+    /**
+     * @param {string} iface
+     * @returns {boolean} whether this interface goes through lite-rpc
+     */
+    has(iface) {
+        return this.interfaces.includes(iface);
+    }
+
+    /**
+     * Opens the client. Resolves once the first picture is loaded, rejects with the client's
+     * reason (unauthenticated, forbidden, unreachable, timeout ...); the stream keeps trying by
+     * itself afterwards.
+     * @returns {Promise<void>}
+     */
+    start() {
+        const {OccuLite, callbackEvents, nodeTransport} = load();
+        const debug = (message) => this.logger.debug('occulite-client: ' + message);
+        const clientOptions = {
+            url: this.options.url,
+            auth: {token: this.options.token},
+            transport: tierAwareTransport(nodeTransport(this.options.insecure ? {insecure: true} : {})),
+            interfaces: this.interfaces,
+            values: true,
+            meta: false,
+            devices: true,
+            timeout: this.options.timeout || 30000,
+            log: {debug, info: debug, warn: debug, error: debug},
+        };
+        const box = this.options.createClient ? this.options.createClient(clientOptions) : new OccuLite(clientOptions);
+        this.box = box;
+        box.on('status', (event) => {
+            if (this.closed || this.box !== box) {
+                return;
+            }
+
+            const state = event && event.state ? event.state : event;
+            this.ready = state === 'ready';
+            this.options.onStatus(state);
+        });
+        box.on('interface', (event) => {
+            if (!this.closed && this.box === box) {
+                this.options.onInterface(event.interface, event.state);
+            }
+        });
+        box.on('resync', () => {
+            if (!this.closed && this.box === box && this.options.onValues) {
+                this.options.onValues(box.values);
+            }
+        });
+        // the stream's events as a callback server's calls, into the connection's own table
+        this.server = callbackEvents(box, {initId: this.options.initId});
+        CALLBACK_METHODS.forEach((method) => {
+            this.server.on(method, (err, parameters, callback) => {
+                if (this.closed || this.box !== box) {
+                    callback(null, '');
+                    return;
+                }
+
+                this.options.onCallback(method, err, parameters, callback);
+            });
+        });
+
+        return box.ready().then(() => {
+            if (this.closed || this.box !== box) {
+                return;
+            }
+
+            this.ready = true;
+            if (this.options.onValues) {
+                this.options.onValues(box.values);
+            }
+        });
+    }
+
+    /**
+     * Any method of an interface process through lite-rpc; the credential's tier decides.
+     * @param {string} iface
+     * @param {string} method
+     * @param {Array} parameters
+     * @returns {Promise<*>}
+     */
+    call(iface, method, parameters) {
+        if (!this.box) {
+            return Promise.reject(new Error('lite-rpc client not started'));
+        }
+
+        const jsonDouble = Boolean(this.box.capabilities && this.box.capabilities.json_double);
+        return this.box.call(iface, method, liteValue(parameters || [], jsonDouble)).then(
+            (result) => (result === null || result === undefined ? '' : result),
+            (error) => {
+                throw translateError(error);
+            },
+        );
+    }
+
+    /**
+     * Whether the system says this interface runs (the client's live list).
+     * @param {string} iface
+     * @returns {boolean|undefined} undefined while the list is not known
+     */
+    running(iface) {
+        if (!this.box || !Array.isArray(this.box.interfaces)) {
+            return undefined;
+        }
+
+        const entry = this.box.interfaces.find((info) => info.name === iface);
+        return entry ? entry.running !== false : false;
+    }
+
+    /** Closes the stream; nothing is de-registered, because nothing was registered. */
+    close() {
+        this.closed = true;
+        this.ready = false;
+        if (this.box) {
+            this.box.close();
+            this.box = null;
+        }
+    }
+}
+
+module.exports = {
+    LiteConnection,
+    LITE_INTERFACES,
+    ADDON_TOKEN_FILE,
+    CALLBACK_METHODS,
+    readAddonToken,
+    liteValue,
+    tierAwareTransport,
+    translateError,
+    isFault,
+    load,
+};

package/nodes/locales/de/ccu-connection.html

@@ -33,6 +33,7 @@
                         <li>VirtualDevices: Heizungsgruppen, in CCU eingebundene Systeme wie Osram Lightify</li>
                         <li>CUxD</li>
                         <li>CCU-Jack: XMLRPC-Schnittstelle des <a href="https://github.com/mdzio/ccu-jack" target="_blank">CCU-Jack</a> Addons (Port konfigurierbar, Standard 2121 bzw. 2122 mit TLS)</li>
+                        <li>Das Portfeld neben jeder Schnittstelle: leer ist der Port der CCU für den Transport (2001/42001 usw., die 3xxxx-Ports auf der CCU selbst); eine Zahl ersetzt ihn, etwa für eine CCU hinter einer Portweiterleitung oder einen Simulator auf einem anderen Port.</li>
                     </ul>
 
                 </li>
@@ -65,6 +66,7 @@ Weiteres unter <a target="_blank" href="https://nodered.org/docs/user-guide/cont
             </ul>
             <ul>
                 <li><b>openccu-lite Port</b>: Nur nötig, wenn der Webserver des Systems nicht auf Port 80 bzw. 443 (TLS) läuft.</li>
+                <li><b>openccu-lite Schnittstellen</b>: Wie die Schnittstellenprozesse auf einem openccu-lite-System erreicht werden. <i>auto</i> (Voreinstellung) geht dort über das <b>lite-rpc</b> des Systems - die Aufrufe über seinen Webport, die Ereignisse aus einem Stream, den dieser Node öffnet; ein Abonnent an den Prozessen für alle Programme auf dem System, die Ereignisse werden nach einer Unterbrechung nachgeliefert, kein eigener Callback-Server und kein eigenes <code>init</code> - und auf einer CCU, RaspberryMatic oder OpenCCU den CCU-Weg. Das Zugangsmerkmal ist das openccu-lite-Token oben, auf dem System selbst das eigene Token von RedMatic, das das System dafür erzeugt; ohne eines wird die direkte Verbindung benutzt, das Log sagt es. <i>CCU</i> behält auch auf openccu-lite die direkte Verbindung mit Rückrufen (CUxD geht immer so; lite-rpc trägt es nicht). Ein Flow aus einer Version vor 4.7.0 wird beim ersten Start auf openccu-lite einmal auf lite-rpc umgestellt - das Log sagt es - und eine hier getroffene Wahl ändert keine spätere Version mehr. Die Nodes sysvar, program, script und poll bleiben auf openccu-lite so oder so ohne Funktion.</li>
             </ul>
             <ul>
                 <li><b>Device data / Re-read device data</b>: Liest die Geräteliste jeder verbundenen Schnittstelle neu ein.
@@ -91,7 +93,7 @@ Weiteres unter <a target="_blank" href="https://nodered.org/docs/user-guide/cont
                     solange die CCU ihr selbst ausgestelltes Zertifikat verwendet.</li>
                     <li>Username: Ein Benutzer der sich an der CCU anmelden darf.</li>
                     <li>Password: Das Passwort des Benutzers. Es wird in den Node-RED-Credentials gespeichert
-                    (verschlüsselt in <code>flows_cred.json</code>), nicht im Flow. Ein Flow aus einer Version vor 4.4.6,
+                    (verschlüsselt in <code>flows_cred.json</code>), nicht im Flow. Ein Flow aus einer Version vor 4.5.0,
                     der es noch im Klartext enthält, wird beim ersten Start übernommen; der nächste Deploy entfernt es aus
                     <code>flows.json</code>.</li>
                 </ul>

package/nodes/locales/en-US/ccu-connection.html

@@ -18,6 +18,7 @@
                 <li>VirtualDevices: heating groups and systems the CCU integrates, such as Osram Lightify</li>
                 <li>CUxD</li>
                 <li>CCU-Jack: the XML-RPC interface of the <a href="https://github.com/mdzio/ccu-jack" target="_blank">CCU-Jack</a> addon (port configurable, 2121 by default, 2122 with TLS)</li>
+                <li>The port field beside each interface: blank is the CCU's port for the transport (2001/42001 and so on, the 3xxxx ports on the CCU itself); a number replaces it, for a CCU behind port forwarding or a simulator on another port.</li>
             </ul>
         </li>
         <li><b>RPC ping</b> and <b>RPC ping timeout (s)</b>: How often the connection to the interface processes is checked with a ping, and after how many seconds without an answer it subscribes again. Off means no pings and no timeout-triggered re-init for this connection.</li>
@@ -27,6 +28,7 @@
         <li><b>Context Store</b>: The Node-RED context store the states of all devices and variables are kept in. See <a target="_blank" href="https://nodered.org/docs/user-guide/context">Working with context</a> in the Node-RED documentation.</li>
         <li><b>openccu-lite token</b>: Only for <a href="https://github.com/hobbyquaker/openccu-lite" target="_blank">openccu-lite</a>, a CCU firmware without ReGaHSS. Names, rooms and functions come from the system's metadata API there, which needs a token made under <i>Users</i> on the system. When Node-RED runs on the system itself (RedMatic) the field stays empty: the local token is read automatically. The token is kept, like the password, in Node-RED's credentials (encrypted in <code>flows_cred.json</code>, never in the flow, never in an export). A CCU, RaspberryMatic or OpenCCU ignores the field. openccu-lite has no system variables, programs or HM-Script; those nodes stay in the flow and report an error per message.</li>
         <li><b>openccu-lite port</b>: Only needed when the system's web server is not on port 80 (443 with TLS).</li>
+        <li><b>openccu-lite interfaces</b>: How the interface processes are reached on an openccu-lite system. <i>auto</i> (the default) goes through the system's <b>lite-rpc</b> there - the requests over its web port, the events from a stream this node opens, one subscriber at the processes for every program on the system, the events replayed after a break, no callback server and no <code>init</code> of its own - and the CCU way on a CCU, RaspberryMatic or OpenCCU. The credential is the openccu-lite token above, or on the system itself RedMatic's own token, which the system mints for it; without one the direct connection is used and the log says so. <i>CCU</i> keeps the direct connection with callbacks on openccu-lite as well (CUxD always goes that way; lite-rpc does not carry it). A flow from before 4.7.0 is moved to lite-rpc once at its first start on openccu-lite - the log says so - and a choice made here is never changed by a later version. The sysvar, program, script and poll nodes stay unavailable on openccu-lite either way.</li>
         <li><b>Device data / Re-read device data</b>: Reads the device list of every connected interface again. New and changed devices (a channel whose type changed, say) get their datapoints fetched anew, removed ones leave the table. A device the CCU reports with a changed type or version is re-read without the button as well. The button needs a deployed connection.</li>
         <li><b>Authentication</b>: Encryption and login for a CCU on the network (Node-RED not on the CCU). Both belong to the CCU's web server, which fronts the interface processes: on a CCU3 TLS and authentication are switched on in the firewall settings, on openccu-lite under <i>Remote access</i> (classic RPC). When Node-RED runs on the system itself (RedMatic; address <code>localhost</code> / <code>127.0.0.1</code>) the processes are reached directly on the loopback, BidCos over BIN-RPC, without TLS and without a login; these settings are then not used.
             <ul>
@@ -34,7 +36,7 @@
                 <li>TLS/SSL: Transport encryption. The interfaces are reached over the CCU's TLS ports (42000, 42001, 42010, 49292, ReGaHSS 48181, CCU-Jack 2122), openccu-lite's metadata API over 443. BIN-RPC has no TLS: with TLS on, BidCos-RF always goes over XML-RPC.</li>
                 <li>Ignore invalid TLS Certificates: Node-RED accepts an untrusted certificate too. Needed as long as the CCU uses its self-signed certificate.</li>
                 <li>Username: A user allowed to log in to the CCU.</li>
-                <li>Password: The user's password. It is kept in Node-RED's credentials (encrypted in <code>flows_cred.json</code>), not in the flow. A flow from a version before 4.4.6 that still carries it in plain text is taken over at the first start; the next deploy removes it from <code>flows.json</code>.</li>
+                <li>Password: The user's password. It is kept in Node-RED's credentials (encrypted in <code>flows_cred.json</code>), not in the flow. A flow from a version before 4.5.0 that still carries it in plain text is taken over at the first start; the next deploy removes it from <code>flows.json</code>.</li>
             </ul>
             The other direction stays unencrypted: the CCU sends its events to the XML-RPC or BIN-RPC server Node-RED opens for it (<i>Listen Address</i>, <i>BINRPC</i> and <i>XMLRPC listening port</i>) without TLS and without a login - it cannot log in there or verify our certificate. Those ports should be open in the Node-RED host's firewall for the CCU only.</li>
     </ul>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "node-red-contrib-ccu",
-  "version": "4.6.2",
+  "version": "4.7.1",
   "license": "MIT",
   "main": "none",
   "keywords": [
@@ -53,7 +53,8 @@
     "binrpc": "^4.3.0",
     "homematic-rega": "^2.0.1",
     "homematic-xmlrpc": "^2.0.0",
-    "mqtt-wildcard": "^3.0.9"
+    "mqtt-wildcard": "^3.0.9",
+    "occulite-client": "^0.3.0"
   },
   "deprecated": false,
   "description": "Node-RED Nodes for the Homematic CCU",
@@ -64,7 +65,7 @@
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-html": "^8.2.0",
     "globals": "^16.5.0",
-    "hm-simulator": "^1.3.1",
+    "hm-simulator": "^1.4.0",
     "mocha": "^11.7.1",
     "node-red": "^4.1.0",
     "node-red-node-test-helper": "^0.3.6",