smart-home-engine 1.1.18 → 1.1.20

package/dist/web/assets/{tsMode-BrUIFGM6.js → tsMode-HtyxY0LK.js}

@@ -1,4 +1,4 @@
-import{m as O}from"./monaco-langs-BW2J83t5.js";import{t as I}from"./index-BH6XhdRK.js";/*!-----------------------------------------------------------------------------
+import{m as O}from"./monaco-langs-BW2J83t5.js";import{t as I}from"./index-BIDlQXlY.js";/*!-----------------------------------------------------------------------------
  * Copyright (c) Microsoft Corporation. All rights reserved.
  * Version: 0.52.2(404545bded1df6ffa41ea0af4e8ddb219018c6c1)
  * Released under the MIT license

package/dist/web/index.html

@@ -172,7 +172,7 @@
                 }
             })();
         </script>
-      <script type="module" crossorigin src="/assets/index-BH6XhdRK.js"></script>
+      <script type="module" crossorigin src="/assets/index-BIDlQXlY.js"></script>
       <link rel="modulepreload" crossorigin href="/assets/monaco-langs-BW2J83t5.js">
       <link rel="stylesheet" crossorigin href="/assets/monaco-langs-DyX1CsEw.css">
       <link rel="stylesheet" crossorigin href="/assets/index-b3gdLMp3.css">

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "smart-home-engine",
-    "version": "1.1.18",
+    "version": "1.1.20",
     "description": "Node.js based script runner for use in MQTT based Smart Home environments",
     "main": "src/index.js",
     "scripts": {

package/src/lib/dynsec.js

@@ -34,6 +34,10 @@ const _queue = [];
 let _inflight = false;
 let _inflightResolve = null;
 
+// $SYS topic cache — populated by the she-admin MQTT connection which has
+// the admin role and therefore $SYS/# subscribe + publishClientReceive ACLs.
+const _sysData = {};
+
 function _drain() {
     if (_inflight || _queue.length === 0 || !_connected) return;
 
@@ -145,6 +149,12 @@ function init(config, log) {
                 });
             }
         });
+        // The admin role has subscribePattern + publishClientReceive for $SYS/#.
+        // Subscribe here so the broker status endpoint always has fresh $SYS data
+        // even when the main MQTT client lacks the necessary ACL permissions.
+        _client.subscribe('$SYS/#', (err) => {
+            if (err) _log.debug('dynsec: $SYS/# subscription failed (not critical):', err.message);
+        });
     });
 
     _client.on('close', () => {
@@ -160,6 +170,13 @@ function init(config, log) {
     });
 
     _client.on('message', (topic, payload) => {
+        if (topic.startsWith('$SYS/')) {
+            const val = payload.toString();
+            const now = Date.now();
+            const prev = _sysData[topic];
+            _sysData[topic] = { val, ts: now, lc: prev && prev.val !== val ? now : (prev ? prev.lc : now) };
+            return;
+        }
         if (topic !== RESPONSE_TOPIC) return;
         let msg;
         try {
@@ -192,6 +209,8 @@ function stop() {
     _configured = false;
     _connected = false;
     _dynsecReady = false;
+    // Clear $SYS cache
+    Object.keys(_sysData).forEach((k) => delete _sysData[k]);
     // Reject any in-flight / queued requests
     if (_inflight && _inflightResolve) {
         _inflightResolve = null;
@@ -223,11 +242,11 @@ function setClientPassword(username, password) {
 }
 
 function listClients(verbose = false) {
-    return _request('listClients', { verbose }).then((r) => r.clients || []);
+    return _request('listClients', { verbose }).then((r) => r.data?.clients ?? r.clients ?? []);
 }
 
 function getClient(username) {
-    return _request('getClient', { username }).then((r) => r.client);
+    return _request('getClient', { username }).then((r) => r.data?.client ?? r.client);
 }
 
 // ── Role management ────────────────────────────────────────────────────────────
@@ -241,11 +260,11 @@ function deleteRole(rolename) {
 }
 
 function listRoles(verbose = false) {
-    return _request('listRoles', { verbose }).then((r) => r.roles || []);
+    return _request('listRoles', { verbose }).then((r) => r.data?.roles ?? r.roles ?? []);
 }
 
 function getRole(rolename) {
-    return _request('getRole', { rolename }).then((r) => r.role);
+    return _request('getRole', { rolename }).then((r) => r.data?.role ?? r.role);
 }
 
 /**
@@ -286,11 +305,11 @@ function deleteGroup(groupname) {
 }
 
 function listGroups(verbose = false) {
-    return _request('listGroups', { verbose }).then((r) => r.groups || []);
+    return _request('listGroups', { verbose }).then((r) => r.data?.groups ?? r.groups ?? []);
 }
 
 function getGroup(groupname) {
-    return _request('getGroup', { groupname }).then((r) => r.group);
+    return _request('getGroup', { groupname }).then((r) => r.data?.group ?? r.group);
 }
 
 function addGroupClient(groupname, username, priority = -1) {
@@ -312,7 +331,12 @@ function removeGroupRole(groupname, rolename) {
 // ── Default ACL access ─────────────────────────────────────────────────────────
 
 function getDefaultACLAccess() {
-    return _request('getDefaultACLAccess').then((r) => r.acls || []);
+    return _request('getDefaultACLAccess').then((r) => r.data?.acls ?? r.acls ?? []);
+}
+
+/** Returns the $SYS topic cache collected by the she-admin MQTT client. */
+function getSysData() {
+    return { ..._sysData };
 }
 
 function setDefaultACLAccess(acls) {
@@ -322,6 +346,7 @@ function setDefaultACLAccess(acls) {
 module.exports = {
     init,
     getStatus,
+    getSysData,
     stop,
     // Users
     createClient,

package/src/web/broker-api.js

@@ -79,11 +79,16 @@ function handleError(res, err) {
 router.get('/status', (req, res) => {
     const ds = dynsec.getStatus();
 
-    const sys = {};
+    // Prefer $SYS data from the she-admin MQTT client: it has admin role ACLs
+    // that explicitly allow $SYS/# even when the main client is denied by
+    // default-deny subscribe ACLs.
+    const sys = dynsec.getSysData();
+    // Fall back to the main MQTT client's state store for any topics not yet
+    // received by the dynsec client (e.g. when dynsec is not configured).
     if (_store) {
         const sysPrefixes = ['$SYS/broker/version', '$SYS/broker/uptime', '$SYS/broker/clients/', '$SYS/broker/messages/'];
         for (const [topic, entry] of _store.mqttEntries()) {
-            if (sysPrefixes.some((p) => topic.startsWith(p))) {
+            if (!sys[topic] && sysPrefixes.some((p) => topic.startsWith(p))) {
                 sys[topic] = entry;
             }
         }
@@ -801,6 +806,15 @@ router.post('/wizard/bootstrap', async (req, res) => {
 
         if (isRemote) {
             // mosquitto_ctrl must run on the broker host — invoke it via SSH.
+            // Delete any existing file first: mosquitto_ctrl init refuses to overwrite
+            // an existing file, which would leave the old credentials in place while
+            // config.json now holds new ones, causing "not authorised" on reconnect.
+            try {
+                await sshDeploy.runCommand(bc.ssh, `sudo rm -f "${dynSecPath}"`);
+                _log?.debug(`broker: removed existing ${dynSecPath} on remote (if any)`);
+            } catch (e) {
+                _log?.warn(`broker: could not remove existing ${dynSecPath} on remote: ${e.message}`);
+            }
             const ctrlCmd = `mosquitto_ctrl dynsec init "${dynSecPath}" "${username}" "${password}"`;
             _log?.debug(`broker: SSH mosquitto_ctrl on ${bc.ssh.host}: mosquitto_ctrl dynsec init "${dynSecPath}" "${username}" ***`);
             try {
@@ -876,6 +890,13 @@ router.post('/wizard/bootstrap', async (req, res) => {
         } else {
             // Local mode: run mosquitto_ctrl on this host.
             fs.mkdirSync(configDir, { recursive: true });
+            // Delete any existing file first so mosquitto_ctrl always writes fresh credentials.
+            try {
+                fs.rmSync(dynSecPath, { force: true });
+                _log?.debug(`broker: removed existing ${dynSecPath} on local host (if any)`);
+            } catch (e) {
+                _log?.warn(`broker: could not remove existing ${dynSecPath}: ${e.message}`);
+            }
             _log?.debug(`broker: local mosquitto_ctrl dynsec init ${dynSecPath} ${username} ***`);
             try {
                 const r = await execFileAsync('mosquitto_ctrl', ['dynsec', 'init', dynSecPath, username, password], { timeout: 10000 });