plc-checkweigher 1.29.0 → 1.30.0

package/bin/plc_checkweigher

@@ -586,6 +586,30 @@ smb-config)
     prompt_smb_config
     ;;
 
+# ─────────────────────────────────────────────────────────────────────────────
+# CONSOLE-PASSWD — set / change the web maintenance terminal access code
+# ─────────────────────────────────────────────────────────────────────────────
+console-passwd)
+    banner "Maintenance Console Access Code"
+    echo ""
+    info "Required by the dashboard terminal (>_ button). Stored as SHA-256."
+    echo ""
+    mkdir -p "${DATA_DIR}" 2>/dev/null || true
+    while true; do
+        read -r -s -p "  New access code: " _PW </dev/tty; echo ""
+        if [[ -z "$_PW" ]]; then err "Cannot be empty"; continue; fi
+        read -r -s -p "  Confirm:         " _PW2 </dev/tty; echo ""
+        [[ "$_PW" == "$_PW2" ]] && break
+        warn "Codes do not match — try again"
+    done
+    printf '%s' "$_PW" | sha256sum | cut -d' ' -f1 > "${DATA_DIR}/console_passwd"
+    chmod 600 "${DATA_DIR}/console_passwd" 2>/dev/null || true
+    echo ""
+    ok "Console access code updated — active immediately, no restart needed"
+    info "Existing browser sessions stay signed in until they expire (8 h)."
+    echo ""
+    ;;
+
 # ─────────────────────────────────────────────────────────────────────────────
 # FIX — auto-detect and repair common issues
 # Usage: fix [-wifi] [-health] [-programs] [-errors]   (no flags = run all)
@@ -1450,6 +1474,16 @@ PYEOF
         ulog "CONFIG: journal OK"
     fi
 
+    # 9a. Console password present (web terminal is fail-closed without it)
+    spin_start "Console access code"
+    if [[ -f "${DATA_DIR}/console_passwd" ]]; then
+        spin_ok "Console access code set"
+        ulog "CONFIG: console password OK"
+    else
+        spin_warn "Not set — web terminal locked. Run: plc_checkweigher console-passwd"
+        ulog "WARN: console password not set"
+    fi
+
     # 9b. Web maintenance sudoers rule (dashboard terminal)
     spin_start "Web maintenance sudoers rule"
     _SUDOERS_F="/etc/sudoers.d/010_plc-web-fix"
@@ -1801,6 +1835,7 @@ help|--help|-h)
     echo ""
     echo -e "  ${W}Configuration${NC}"
     echo "    smb-config                 Interactively update SMB delivery target"
+    echo "    console-passwd             Set/change web maintenance terminal access code"
     echo "    push-test                  Push latest PDF to SMB target now"
     echo "    update                     Pull latest code from GitHub and restart services"
     echo ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plc-checkweigher",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "One-command installer for the PLC Check-Weigher system on Raspberry Pi (PREEMPT_RT kernel, Python stack, WiFi, SMB, systemd RT services)",
   "scripts": {
     "postinstall": "node bin/cli.js"

package/setup.sh

@@ -277,6 +277,27 @@ setup_wifi() {
     fi
 }
 
+# ── 6b. Web maintenance terminal access code ─────────────────────────────────
+setup_console_passwd() {
+    step "Maintenance console access code ..."
+    echo "  The dashboard's maintenance terminal (>_ button) requires an"
+    echo "  access code. It is stored as a SHA-256 hash, never in plain text."
+    echo ""
+    local PW PW2
+    while true; do
+        read -r -s -p "  Set console access code: " PW </dev/tty; echo ""
+        if [[ -z "$PW" ]]; then echo "  Cannot be empty — try again."; continue; fi
+        read -r -s -p "  Confirm access code:     " PW2 </dev/tty; echo ""
+        [[ "$PW" == "$PW2" ]] && break
+        echo "  Codes do not match — try again."
+    done
+    mkdir -p "${DATA_DIR}"
+    printf '%s' "$PW" | sha256sum | cut -d' ' -f1 > "${DATA_DIR}/console_passwd"
+    chown "${PI_USER}:${PI_USER}" "${DATA_DIR}/console_passwd"
+    chmod 600 "${DATA_DIR}/console_passwd"
+    ok "Console access code set  (change later: plc_checkweigher console-passwd)"
+}
+
 # ── 6. SMB file sharing — interactive ────────────────────────────────────────
 setup_smb() {
     step "SMB File Sharing Setup"
@@ -892,6 +913,7 @@ main() {
     install_cli               # 5  — plc_checkweigher status command
     setup_wifi                # 6  — interactive WiFi picker
     setup_smb                 # 7  — interactive SMB config → smb_config.py
+    setup_console_passwd      # 7b — web maintenance terminal access code
     setup_network_online      # 8
     install_services          # 9
     setup_boot_logo           # 10 — Plymouth: logo + "Sai Samarth Engineering"