boneio 1.6.0.dev12__tar.gz → 1.6.0.dev13__tar.gz

{boneio-1.6.0.dev12/boneio.egg-info → boneio-1.6.0.dev13}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev12
+Version: 1.6.0.dev13
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/core/security/posture.py

@@ -237,6 +237,7 @@ def evaluate(
     proxy_serving: bool | None = None,
     custom_certificate: bool = False,
     cloud_error: str | None = None,
+    service_password: str | None = None,
 ) -> Posture:
     """Work out what is still unlocked.
 
@@ -250,6 +251,9 @@ def evaluate(
             panel right now. None when nobody looked.
         custom_certificate: Whether an uploaded certificate is installed.
         cloud_error: What cloud registration last failed with, if anything.
+        service_password: How the boneio SSH login stands, from boneio-system:
+            ``locked``, ``empty``, ``shipped``, ``set`` or ``unknown``. None
+            when nobody could ask.
 
     Returns:
         The full set of checks.
@@ -354,6 +358,46 @@ def evaluate(
         )
     )
 
+    # The boneio login carries a password-gated (ALL:ALL) ALL, so its password
+    # is the root password. Images before 1.6 shipped it as "Black" on every
+    # unit, and that password is published; a device still using it can be
+    # taken over by anyone who reaches it over SSH first.
+    ssh_known = service_password in ("locked", "shipped", "empty", "set")
+    ssh_exposed = service_password in ("shipped", "empty")
+    checks.append(
+        Check(
+            id="ssh_password",
+            title="SSH login password",
+            severity=Severity.CRITICAL,
+            state=(
+                State.UNKNOWN
+                if not ssh_known
+                else State.FAILED
+                if ssh_exposed
+                else State.OK
+            ),
+            detail=(
+                "The boneio account logs in over SSH with the password shipped "
+                "on every unit, or with none. That account can become root, so "
+                "anyone who reaches this device over SSH can too."
+                if ssh_exposed
+                else "Could not ask how the SSH login stands."
+                if not ssh_known
+                else "The SSH login does not use the shipped password."
+            ),
+            # Not a button in the panel, on purpose: an operation that set this
+            # account's password from the panel whenever asked would be a way
+            # from the account to root. The first-run wizard sets it once; after
+            # that it is passwd, which asks for the current one.
+            remedy=(
+                "Log in over SSH as boneio and run passwd."
+                if ssh_exposed
+                else ""
+            ),
+            settings_section=None,
+        )
+    )
+
     web = config.get("web") if isinstance(config.get("web"), dict) else {}
     cloud_enabled = bool((web.get("cloud") or {}).get("enabled"))
     # Somebody said no to cloud registration and meant it. Registration

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/core/system_ops.py

@@ -180,6 +180,39 @@ def mqtt_password(account: str, password: str, timeout: int = 60) -> Result:
     return run("mqtt-password", account, timeout=timeout, stdin=f"{password}\n")
 
 
+def service_password_state(timeout: int = 30) -> str | None:
+    """How the boneio login stands: locked, empty, shipped, set or unknown.
+
+    Returns:
+        The state, or None when the helper is not there to ask.
+    """
+    result = run("service-password-state", timeout=timeout)
+    if not result.ok:
+        return None
+    parsed = result.json() or {}
+    state = parsed.get("state")
+    return state if isinstance(state, str) else None
+
+
+def service_password_init(password: str, timeout: int = 60) -> Result:
+    """Set the boneio login password, once.
+
+    The helper allows this only while the account is still in a state the
+    factory left — locked, on the shipped password, or with none — and only the
+    first time. Anything else is the owner's password, and changing it is
+    theirs to do with ``passwd``. The password goes over stdin, never as an
+    argument.
+
+    Args:
+        password: The password the owner chose.
+        timeout: Seconds to allow.
+
+    Returns:
+        The outcome.
+    """
+    return run("service-password-init", timeout=timeout, stdin=f"{password}\n")
+
+
 def mqtt_reload(timeout: int = 30) -> Result:
     """Have the broker re-read its password file."""
     return run("mqtt-reload", timeout=timeout)

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/migrations/assets/MANIFEST.sha256

@@ -11,7 +11,7 @@ bff00753c72fb17609a6f7b3a58ef78b7b394da12d19fd65b875f2889695e2b4  docker/nodered
 84fd30fddc0928e4f82c434d42555cc96d9ac56e60ecfb78372b1661816506c8  helpers/boneio-containers
 dff0cd02daad2cbd525a0535f8f3562bb742e7e737b24c69e5afa986415e67e4  helpers/boneio-helpers-heal
 e91a24a2cc3645d9b96c2574f6ce8c19de48e80251da127c8aed0c7f5c8357dd  helpers/boneio-migrate-v2
-9f9675297a2de2c708bb7cf72d96ecd18e58f97a9dc3eec3e2069bf1659f3fa5  helpers/boneio-system
+a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1  helpers/boneio-system
 f316c778b3125e4e992942c889c4082f8a12f578a6d68c4e7c79fa80e4cc94a1  issue.d/10-boneio.issue
 e6013f4fbf11693f39123b1e6159c7d7224a7c832e994722120980f64039c17e  journald/journald.conf
 d28f2e9336b881b102c42f4278ec9ddf046c83dab4469dc5be7326768e074cb6  kernel/postinst-boneio-overlay

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/migrations/assets/helpers/boneio-system

@@ -20,6 +20,8 @@ This replaces both with named operations:
     ntp-set <servers|default>      point systemd-timesyncd at given servers
     mqtt-password <account>        set a broker password, read from stdin
     mqtt-reload                    have the broker re-read its password file
+    service-password-state         is the boneio login locked, shipped or set
+    service-password-init          set it once, from stdin — see below
 
 Every argument is checked against a closed set before anything runs, and the
 uEnv.txt edit is done here with a compiled pattern rather than by handing a
@@ -44,6 +46,7 @@ import shutil
 import subprocess
 import sys
 import tempfile
+import time
 from pathlib import Path
 
 LOG_FILE = "/var/log/boneio-system.log"
@@ -108,6 +111,24 @@ MQTT_ACCOUNTS = ("boneio", "homeassistant", "mqtt")
 MOSQUITTO_PASSWD_MODE = 0o640
 MOSQUITTO_PASSWD_OWNER = ("root", "mosquitto")
 
+#: The login this helper serves, and the only account whose password it may
+#: touch. Not a parameter: a verb that set "an account's password" would be a
+#: way to give any local account a password its owner never chose.
+SERVICE_ACCOUNT = "boneio"
+SHADOW = Path("/etc/shadow")
+#: What every image before 1.6 shipped as that account's password, identical on
+#: every unit and published. Recognised so the panel can say it is still there;
+#: never written by this helper.
+SHIPPED_PASSWORD = "Black"
+#: Written once the owner's password has been set. Root-owned and outside the
+#: application's reach, so the one-shot cannot be re-armed by relocking the
+#: account — see _service_password_init.
+SERVICE_PASSWORD_FLAG = Path("/var/lib/boneio/service-password.set")
+#: Generous, and well above anything a person types. chpasswd has no limit of
+#: its own worth relying on, and a caller able to hand root a megabyte on stdin
+#: is a caller who should be told no.
+SERVICE_PASSWORD_MAX = 1024
+
 #: One DNS name. Addresses are validated with :mod:`ipaddress` instead, so this
 #: only has to cover hostnames.
 #:
@@ -126,6 +147,7 @@ VERBS = (
     "hostname-set",
     "ntp-get", "ntp-set",
     "mqtt-password", "mqtt-reload",
+    "service-password-state", "service-password-init",
 )
 
 
@@ -644,6 +666,176 @@ def _ntp_set(argument: str | None) -> int:
     return _run(["systemctl", "try-restart", "systemd-timesyncd"], tolerate=True)
 
 
+# ---------------------------------------------------------- service password
+#
+# The boneio account carries a password-gated (ALL:ALL) ALL, so its password is
+# the root password. Images before 1.6 shipped it as "Black" on every unit;
+# images from 1.6 ship it locked, and the owner's first password — the one they
+# give the first-run wizard — becomes it.
+#
+# Setting it is the one thing here that could undo F-04. This helper runs as
+# root, without a password, for anyone holding the boneio account. An operation
+# that sets that account's password whenever asked is boneio -> root in two
+# steps: set a password, then sudo with it. So it is allowed in exactly the two
+# states where it grants nothing new:
+#
+#   locked   nobody has chosen a password yet — the factory state.
+#   shipped  the password is "Black". Whoever holds boneio already has root,
+#            through sudo with a password everybody knows.
+#   empty    no password at all, which is the same thing without the typing.
+#
+# and never where the owner has chosen one. The flag makes it once-only even if
+# somebody later locks the account again by hand.
+
+
+def _shadow_hash(account: str = SERVICE_ACCOUNT) -> str | None:
+    """The password field of *account* in /etc/shadow, or None if absent.
+
+    Args:
+        account: The account to look up.
+
+    Returns:
+        The hash field, possibly empty or carrying a lock prefix.
+
+    Raises:
+        Refused: If the shadow file cannot be read.
+    """
+    try:
+        lines = SHADOW.read_text(encoding="utf-8").splitlines()
+    except OSError as exc:
+        raise Refused(f"cannot read {SHADOW}: {exc}") from exc
+    for line in lines:
+        name, _, rest = line.partition(":")
+        if name == account:
+            return rest.split(":", 1)[0]
+    return None
+
+
+def _crypt_matches(password: str, stored: str) -> bool | None:
+    """Whether *password* verifies against the crypt(3) hash *stored*.
+
+    Through libcrypt directly: Python 3.13 removed the crypt module, and the
+    alternatives — su, sudo -S, an expect script — all mean trying the password
+    against a live login and leaving a failed attempt in the log for every
+    check.
+
+    Returns:
+        True or False, or None when libcrypt cannot be used here.
+    """
+    import ctypes
+    import ctypes.util
+
+    name = ctypes.util.find_library("crypt") or "libcrypt.so.1"
+    try:
+        libcrypt = ctypes.CDLL(name)
+    except OSError:
+        return None
+    libcrypt.crypt.restype = ctypes.c_char_p
+    libcrypt.crypt.argtypes = (ctypes.c_char_p, ctypes.c_char_p)
+    result = libcrypt.crypt(password.encode(), stored.encode())
+    if not result:
+        return None
+    return result.decode(errors="replace") == stored
+
+
+def _service_password_state() -> str:
+    """Classify the boneio login.
+
+    Returns:
+        ``locked``, ``empty``, ``shipped``, ``set`` or ``unknown``.
+
+    Raises:
+        Refused: If the account does not exist.
+    """
+    stored = _shadow_hash()
+    if stored is None:
+        raise Refused(f"no {SERVICE_ACCOUNT} account in {SHADOW}")
+    if stored.startswith(("!", "*")):
+        return "locked"
+    if stored == "":
+        # An empty field is a login with no password at all.
+        return "empty"
+    matches = _crypt_matches(SHIPPED_PASSWORD, stored)
+    if matches is None:
+        return "unknown"
+    return "shipped" if matches else "set"
+
+
+def _service_password_state_verb() -> int:
+    """Print the state as JSON. Changes nothing.
+
+    Returns:
+        Process exit status.
+    """
+    state = _service_password_state()
+    print(json.dumps({"state": state, "initialised": SERVICE_PASSWORD_FLAG.exists()}))
+    return 0
+
+
+def _service_password_init() -> int:
+    """Set the boneio password once, from stdin.
+
+    Returns:
+        Process exit status.
+
+    Raises:
+        Refused: If a password has already been set this way, if the owner has
+            chosen one, or if the password on stdin is unusable.
+    """
+    if SERVICE_PASSWORD_FLAG.exists():
+        raise Refused(
+            "the service account password has already been set once; change it "
+            "with passwd, which asks for the current one"
+        )
+    state = _service_password_state()
+    if state not in ("locked", "shipped", "empty"):
+        raise Refused(
+            f"the service account password is {state!r}, not one the factory "
+            "left; it is the owner's to change, with passwd"
+        )
+
+    password = sys.stdin.read()
+    password = password[:-1] if password.endswith("\n") else password
+    if not password:
+        raise Refused("no password on stdin")
+    if "\n" in password or "\r" in password:
+        raise Refused("a password cannot contain a line break")
+    if len(password) > SERVICE_PASSWORD_MAX:
+        raise Refused(f"a password longer than {SERVICE_PASSWORD_MAX} characters")
+
+    try:
+        result = subprocess.run(
+            ["chpasswd"],
+            # chpasswd splits on the first colon, so one in the password is
+            # fine. Over stdin, never as an argument: ps would show it.
+            input=f"{SERVICE_ACCOUNT}:{password}\n",
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+    except (OSError, subprocess.SubprocessError) as exc:
+        raise Refused(f"cannot run chpasswd: {exc}") from exc
+    if result.returncode != 0:
+        _LOGGER.error("chpasswd failed for %s (rc=%d)", SERVICE_ACCOUNT, result.returncode)
+        return result.returncode
+
+    # A password set from the expired 1.6-era state would still demand a change
+    # at the first login; the owner has just chosen this one, so it is current.
+    subprocess.run(
+        ["chage", "-d", str(int(time.time()) // 86400), SERVICE_ACCOUNT],
+        capture_output=True,
+        timeout=30,
+    )
+
+    SERVICE_PASSWORD_FLAG.parent.mkdir(parents=True, exist_ok=True)
+    SERVICE_PASSWORD_FLAG.write_text(
+        f"set from state {state} at {int(time.time())}\n", encoding="utf-8"
+    )
+    os.chmod(SERVICE_PASSWORD_FLAG, 0o644)
+    _LOGGER.info("Service account password set (was %s)", state)
+    return 0
+
+
 # ----------------------------------------------------------------- selftest
 
 
@@ -660,6 +852,8 @@ def selftest() -> int:
         problems.append("hostnamectl is not installed")
     if shutil.which("systemctl") is None:
         problems.append("systemctl is not installed, so NTP servers cannot be applied")
+    if shutil.which("chpasswd") is None:
+        problems.append("chpasswd is not installed, so the service password cannot be set")
     try:
         _find_uenv()
     except Refused as exc:
@@ -727,6 +921,10 @@ def main(argv: list[str] | None = None) -> int:
             return _mqtt_password(args.argument)
         if args.verb == "mqtt-reload":
             return _mqtt_reload()
+        if args.verb == "service-password-state":
+            return _service_password_state_verb()
+        if args.verb == "service-password-init":
+            return _service_password_init()
         if args.verb == "hostname-set":
             return _hostname_set(args.argument)
         if args.verb == "ntp-get":

boneio-1.6.0.dev13/boneio/migrations/plans/1.6.17.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{},"validate":"python"},{"action":"install_file","dst":"/usr/sbin/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{},"validate":"python"}]

boneio-1.6.0.dev13/boneio/migrations/plans/1.6.17.sig

@@ -0,0 +1 @@
+P����{Pk�6���݅�r
[;����U�u7���K���������%�F.���<�
%i/�e

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/migrations/plans/1.6.5.json

@@ -1 +1 @@
-[{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-migrate-v2","expected_sha256":"e91a24a2cc3645d9b96c2574f6ce8c19de48e80251da127c8aed0c7f5c8357dd","group":"root","mode":493,"owner":"root","src":"helpers/boneio-migrate-v2","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-containers","expected_sha256":"84fd30fddc0928e4f82c434d42555cc96d9ac56e60ecfb78372b1661816506c8","group":"root","mode":493,"owner":"root","src":"helpers/boneio-containers","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-system","expected_sha256":"9f9675297a2de2c708bb7cf72d96ecd18e58f97a9dc3eec3e2069bf1659f3fa5","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-helpers-heal","expected_sha256":"dff0cd02daad2cbd525a0535f8f3562bb742e7e737b24c69e5afa986415e67e4","group":"root","mode":493,"owner":"root","src":"helpers/boneio-helpers-heal","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/sudoers-boneio-helpers","expected_sha256":"74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a","group":"root","mode":288,"owner":"root","src":"sudoers/boneio-helpers","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/migrations.pem","expected_sha256":"16a97c875edb68e19655b953b4baa773cc1a4e57810543cda646a3e3e83c0c0e","group":"root","mode":292,"owner":"root","src":"migrations.pem","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/migrations-recovery.pem","expected_sha256":"9681710e1a38b8ea7ba5558839e4ef8b5f01a75722dbf403913bad76437449ec","group":"root","mode":292,"owner":"root","src":"migrations-recovery.pem","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/docker-compose.yaml","expected_sha256":"c810560a25b1b393ab2602c3d81edcefdb7ce7d9f9d5bc2e799c43005ffd168a","group":"root","mode":420,"owner":"root","src":"docker/nodered/docker-compose.yaml","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/docker-compose-cloud.yaml","expected_sha256":"bf938ead2c25585a495fb3e79b27a73e7f3d7253f24896a2e779015273a7f22e","group":"root","mode":420,"owner":"root","src":"docker/nodered/docker-compose-cloud.yaml","template_vars":{}},{"action":"install_file","dst":"/etc/boneio/migrations.pem","expected_sha256":"16a97c875edb68e19655b953b4baa773cc1a4e57810543cda646a3e3e83c0c0e","group":"root","mode":292,"owner":"root","src":"migrations.pem","template_vars":{}},{"action":"install_file","dst":"/etc/boneio/migrations-recovery.pem","expected_sha256":"9681710e1a38b8ea7ba5558839e4ef8b5f01a75722dbf403913bad76437449ec","group":"root","mode":292,"owner":"root","src":"migrations-recovery.pem","template_vars":{}},{"action":"install_file","dst":"/usr/sbin/boneio-migrate-v2","expected_sha256":"e91a24a2cc3645d9b96c2574f6ce8c19de48e80251da127c8aed0c7f5c8357dd","group":"root","mode":493,"owner":"root","src":"helpers/boneio-migrate-v2","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/usr/sbin/boneio-containers","expected_sha256":"84fd30fddc0928e4f82c434d42555cc96d9ac56e60ecfb78372b1661816506c8","group":"root","mode":493,"owner":"root","src":"helpers/boneio-containers","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/usr/sbin/boneio-helpers-heal","expected_sha256":"dff0cd02daad2cbd525a0535f8f3562bb742e7e737b24c69e5afa986415e67e4","group":"root","mode":493,"owner":"root","src":"helpers/boneio-helpers-heal","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/etc/sudoers.d/boneio-helpers","expected_sha256":"74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a","group":"root","mode":288,"owner":"root","src":"sudoers/boneio-helpers","template_vars":{},"validate":"sudoers","validate_cmd":"visudo -cf"},{"action":"install_file","dst":"/etc/systemd/system/boneio-helpers-heal.service","expected_sha256":"d3feacddc720307c6ce739e21cb5ca79d90b05c7e1a1f3d9481cd9dbb071c2c6","group":"root","mode":420,"on_change":{"action":"systemctl_daemon_reload"},"owner":"root","src":"systemd/boneio-helpers-heal.service","template_vars":{}},{"action":"systemctl_enable","unit":"boneio-helpers-heal.service"},{"action":"set_file_permissions","group":"root","mode":420,"owner":"root","path":"/home/boneio/docker/nodered/docker-compose.yaml"}]
+[{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-migrate-v2","expected_sha256":"e91a24a2cc3645d9b96c2574f6ce8c19de48e80251da127c8aed0c7f5c8357dd","group":"root","mode":493,"owner":"root","src":"helpers/boneio-migrate-v2","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-containers","expected_sha256":"84fd30fddc0928e4f82c434d42555cc96d9ac56e60ecfb78372b1661816506c8","group":"root","mode":493,"owner":"root","src":"helpers/boneio-containers","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-helpers-heal","expected_sha256":"dff0cd02daad2cbd525a0535f8f3562bb742e7e737b24c69e5afa986415e67e4","group":"root","mode":493,"owner":"root","src":"helpers/boneio-helpers-heal","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/sudoers-boneio-helpers","expected_sha256":"74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a","group":"root","mode":288,"owner":"root","src":"sudoers/boneio-helpers","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/migrations.pem","expected_sha256":"16a97c875edb68e19655b953b4baa773cc1a4e57810543cda646a3e3e83c0c0e","group":"root","mode":292,"owner":"root","src":"migrations.pem","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/migrations-recovery.pem","expected_sha256":"9681710e1a38b8ea7ba5558839e4ef8b5f01a75722dbf403913bad76437449ec","group":"root","mode":292,"owner":"root","src":"migrations-recovery.pem","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/docker-compose.yaml","expected_sha256":"c810560a25b1b393ab2602c3d81edcefdb7ce7d9f9d5bc2e799c43005ffd168a","group":"root","mode":420,"owner":"root","src":"docker/nodered/docker-compose.yaml","template_vars":{}},{"action":"install_file","dst":"/usr/lib/boneio/trusted/docker-compose-cloud.yaml","expected_sha256":"bf938ead2c25585a495fb3e79b27a73e7f3d7253f24896a2e779015273a7f22e","group":"root","mode":420,"owner":"root","src":"docker/nodered/docker-compose-cloud.yaml","template_vars":{}},{"action":"install_file","dst":"/etc/boneio/migrations.pem","expected_sha256":"16a97c875edb68e19655b953b4baa773cc1a4e57810543cda646a3e3e83c0c0e","group":"root","mode":292,"owner":"root","src":"migrations.pem","template_vars":{}},{"action":"install_file","dst":"/etc/boneio/migrations-recovery.pem","expected_sha256":"9681710e1a38b8ea7ba5558839e4ef8b5f01a75722dbf403913bad76437449ec","group":"root","mode":292,"owner":"root","src":"migrations-recovery.pem","template_vars":{}},{"action":"install_file","dst":"/usr/sbin/boneio-migrate-v2","expected_sha256":"e91a24a2cc3645d9b96c2574f6ce8c19de48e80251da127c8aed0c7f5c8357dd","group":"root","mode":493,"owner":"root","src":"helpers/boneio-migrate-v2","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/usr/sbin/boneio-containers","expected_sha256":"84fd30fddc0928e4f82c434d42555cc96d9ac56e60ecfb78372b1661816506c8","group":"root","mode":493,"owner":"root","src":"helpers/boneio-containers","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/usr/sbin/boneio-helpers-heal","expected_sha256":"dff0cd02daad2cbd525a0535f8f3562bb742e7e737b24c69e5afa986415e67e4","group":"root","mode":493,"owner":"root","src":"helpers/boneio-helpers-heal","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/etc/sudoers.d/boneio-helpers","expected_sha256":"74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a","group":"root","mode":288,"owner":"root","src":"sudoers/boneio-helpers","template_vars":{},"validate":"sudoers","validate_cmd":"visudo -cf"},{"action":"install_file","dst":"/etc/systemd/system/boneio-helpers-heal.service","expected_sha256":"d3feacddc720307c6ce739e21cb5ca79d90b05c7e1a1f3d9481cd9dbb071c2c6","group":"root","mode":420,"on_change":{"action":"systemctl_daemon_reload"},"owner":"root","src":"systemd/boneio-helpers-heal.service","template_vars":{}},{"action":"systemctl_enable","unit":"boneio-helpers-heal.service"},{"action":"set_file_permissions","group":"root","mode":420,"owner":"root","path":"/home/boneio/docker/nodered/docker-compose.yaml"}]

boneio-1.6.0.dev13/boneio/migrations/plans/1.6.5.sig

@@ -0,0 +1 @@
+�����&�4=�(t�'��6�Qc`΁2-�pl�&�����`�B��-�\Js����[�PC�RW

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/migrations/plans/1.6.8.json

@@ -1 +1 @@
-[{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-system","expected_sha256":"9f9675297a2de2c708bb7cf72d96ecd18e58f97a9dc3eec3e2069bf1659f3fa5","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{}},{"action":"install_file","dst":"/usr/sbin/boneio-system","expected_sha256":"9f9675297a2de2c708bb7cf72d96ecd18e58f97a9dc3eec3e2069bf1659f3fa5","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/etc/sudoers.d/boneio-helpers","expected_sha256":"74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a","group":"root","mode":288,"owner":"root","src":"sudoers/boneio-helpers","template_vars":{},"validate":"sudoers","validate_cmd":"visudo -cf"}]
+[{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{}},{"action":"install_file","dst":"/usr/sbin/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"},{"action":"install_file","dst":"/etc/sudoers.d/boneio-helpers","expected_sha256":"74e8c1209b80519dc6e3db6c6d8e7ca02f01f8f618cee6f741e8400270d3b05a","group":"root","mode":288,"owner":"root","src":"sudoers/boneio-helpers","template_vars":{},"validate":"sudoers","validate_cmd":"visudo -cf"}]

boneio-1.6.0.dev13/boneio/migrations/plans/1.6.8.sig

@@ -0,0 +1 @@
+�
\''P��s�~�)	����Rs���Ժ�z��rg�#w�,Q�����aQ�#���'r����¿�

boneio-1.6.0.dev13/boneio/migrations/plans/1.6.9.json

@@ -0,0 +1 @@
+[{"action":"install_file","dst":"/usr/lib/boneio/trusted/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{}},{"action":"install_file","dst":"/usr/sbin/boneio-system","expected_sha256":"a12a773ace77b3ddfb4346f74f3df9a7ea059d0bbeb90035d5fd263481c619c1","group":"root","mode":493,"owner":"root","src":"helpers/boneio-system","template_vars":{},"validate":"python","validate_cmd":"python3 -m py_compile"}]

boneio-1.6.0.dev13/boneio/migrations/plans/1.6.9.sig

@@ -0,0 +1 @@
+t���[��/��0<�b��/K#�>�q�~:�z��r��WA�x4�H��Ķ�M�,�

{boneio-1.6.0.dev12 → boneio-1.6.0.dev13}/boneio/migrations/plans/manifest.json

@@ -1 +1 @@
-{"plans":{"1.3.0":"e251cb15b0603df5ba318eba03563757ef1401f577a25330aa135b11eb13156b","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"e26cc8089d6b6679a6ead60916e1a08ca281502ac7168bb740b4cd6aa0f5c6a9","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"2b9566e3e9dd6fde10fd36044707319abbe2283ec95b0422705d23d3dcca0c5f","1.6.16":"4a2fbf391def4497c0c98aafb5cf02ef4ce6f225c8b6fdc272b2fb78ebdadf9c","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"778ab437b7b62b8fa1cf48fa26beb801856c3b36015fbf699267e5156ac41de7","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"3cb85acc5ad0aa12dc447e2ff8d736b9980583fd2c50351f41cad4e70eb6043c","1.6.9":"732d5a9bcd2e496a260263a643c78a6346e9f3cef5b48fe59ac6b120bd03ba4e"},"release":"1.6.0.dev12"}
+{"plans":{"1.3.0":"e251cb15b0603df5ba318eba03563757ef1401f577a25330aa135b11eb13156b","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"e26cc8089d6b6679a6ead60916e1a08ca281502ac7168bb740b4cd6aa0f5c6a9","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.14":"f1f8b091d054a08665f047b5ad91f1f309f729a8aa30a2992d6ffdbd7f9fa7e4","1.6.15":"2b9566e3e9dd6fde10fd36044707319abbe2283ec95b0422705d23d3dcca0c5f","1.6.16":"4a2fbf391def4497c0c98aafb5cf02ef4ce6f225c8b6fdc272b2fb78ebdadf9c","1.6.17":"0fa5d642d4b60453f5125f61e62227a1b28a7a64acd85c5affd7e3a4c663c0ad","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"9e5b5bf2a2bb1acc58aab3a22d253b2bd4d7d3cb363c873a04913075c0221281","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"d619d4c3074a55511529f463b86d73ba0203abf43710d1e6c6753a7381d40dba","1.6.9":"ec354f9a2b8df176a097719b93e095dc290f5faca9de111435d9074614c09f29"},"release":"1.6.0.dev13"}

boneio-1.6.0.dev13/boneio/migrations/versions/v1_6_17_service_password.py

@@ -0,0 +1,73 @@
+"""Reinstall boneio-system, which can now set the SSH login password once.
+
+Images before 1.6 shipped the ``boneio`` account with the password ``Black``,
+the same on every unit and published. That account carries a password-gated
+``(ALL:ALL) ALL``, so its password is the root password — and expiring it, as
+1.6 images first did, only forced a change on whoever logged in first, which
+need not be the owner.
+
+Images from here on ship the account locked, and the owner's first password,
+typed into the first-run wizard, becomes it. That needs two operations in the
+privileged helper:
+
+  service-password-state  read-only: locked, empty, shipped, set
+  service-password-init   set it from stdin — once, and only while the
+                          account is locked, on the shipped password, or has
+                          none
+
+The limits are what keep this from reopening F-04. The helper runs as root for
+anyone holding ``boneio``; an operation that set that account's password
+whenever asked would be a way to root in two steps. In the states it allows,
+whoever holds the account either has no password to replace or already has
+root through the one everybody knows. A password the owner chose is refused,
+and a root-owned flag makes the operation once-only even if somebody locks the
+account again later.
+
+The pristine copy goes first for the same reason as in 1.6.16:
+``boneio-helpers-heal.service`` restores from it, and a stale one would put the
+old helper back at the next boot. ``validate="python"`` because a helper that
+does not compile would take CAN, the overlay, the hostname, NTP and the broker
+passwords down with it.
+
+A device already in the field keeps whatever SSH password it has. The security
+section says so when that is still ``Black``.
+
+To retry on a device, delete ``/var/lib/boneio/migrations.d/1.6.17.applied``
+and restart boneIO.
+"""
+
+from __future__ import annotations
+
+from boneio.migrations.actions import InstallFile, MigrationAction
+
+VERSION = "1.6.17"
+DESCRIPTION = "Let the first-run wizard set the SSH login password, once"
+REQUIRES_ROOT = True
+
+TRUSTED_DIR = "/usr/lib/boneio/trusted"
+
+
+def plan() -> list[MigrationAction]:
+    """Return the ordered list of migration actions.
+
+    Returns:
+        List of :class:`MigrationAction` to apply in order.
+    """
+    return [
+        InstallFile(
+            src="helpers/boneio-system",
+            dst=f"{TRUSTED_DIR}/boneio-system",
+            mode=0o755,
+            owner="root",
+            group="root",
+            validate="python",
+        ),
+        InstallFile(
+            src="helpers/boneio-system",
+            dst="/usr/sbin/boneio-system",
+            mode=0o755,
+            owner="root",
+            group="root",
+            validate="python",
+        ),
+    ]

boneio-1.6.0.dev13/boneio/version.py

@@ -0,0 +1,2 @@
+# flake8: noqa
+__version__ = "1.6.0.dev13"

boneio-1.6.0.dev12/boneio/webui/frontend-dist/assets/AccountsView-C8JbdcCe.js → boneio-1.6.0.dev13/boneio/webui/frontend-dist/assets/AccountsView-1zkEjqfK.js

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{Qt as t,Zt as n,an as r,in as i}from"./fa-DFicOgEn.js";import{n as a}from"./axios-DJBeJS4R.js";import{A as o,M as s,S as c,c as l,d as u,f as d,g as f,j as p,k as m}from"./index-BWIpETfX.js";var h=e(r(),1),g=i();function _(e,t){return e?.response?.data?.detail||t}function v(){let{t:e}=p(),{username:r,isAdmin:i}=s(),[v,y]=(0,h.useState)([]),[b,x]=(0,h.useState)(!0),[S,C]=(0,h.useState)(null),[w,T]=(0,h.useState)(null),[E,D]=(0,h.useState)(``),[O,k]=(0,h.useState)(``),[A,j]=(0,h.useState)(`viewer`),[M,N]=(0,h.useState)(!1),P=O?o(O,E):null,F=P?e(m[P],{min:8}):null,I=(0,h.useCallback)(async()=>{try{let{data:e}=await a.get(`/api/accounts`);y(e.accounts??[]),C(null)}catch(t){C(_(t,e(`accounts.load_failed`)))}finally{x(!1)}},[e]);(0,h.useEffect)(()=>{i&&I()},[i,I]);let L=async t=>{t.preventDefault(),C(null),T(null),N(!0);try{await a.post(`/api/accounts`,{username:E,password:O,role:A}),D(``),k(``),j(`viewer`),T(e(`accounts.created`)),await I()}catch(t){C(_(t,e(`accounts.create_failed`)))}finally{N(!1)}},R=async t=>{if(window.confirm(e(`accounts.confirm_delete`,{username:t.username}))){C(null),T(null);try{await a.delete(`/api/accounts/${encodeURIComponent(t.username)}`),T(e(`accounts.deleted`,{username:t.username})),await I()}catch(t){C(_(t,e(`accounts.delete_failed`)))}}},z=async(t,n)=>{C(null),T(null);try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await I()}catch(t){C(_(t,e(`accounts.role_failed`))),await I()}},B=async t=>{let n=window.prompt(e(`accounts.prompt_new_password`,{username:t.username}));if(!n)return;C(null),T(null);let r=o(n,t.username);if(r){C(e(m[r],{min:8}));return}try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/password`,{password:n}),T(e(`accounts.password_reset`,{username:t.username}))}catch(t){C(_(t,e(`accounts.password_failed`)))}};return i?(0,g.jsxs)(c,{width:`wide`,children:[S&&(0,g.jsx)(l,{variant:`error`,message:S}),w&&(0,g.jsx)(l,{variant:`success`,message:w}),(0,g.jsx)(f,{icon:(0,g.jsx)(t,{}),title:e(`accounts.title`),children:b?(0,g.jsx)(`div`,{className:`flex justify-center py-6`,children:(0,g.jsx)(`span`,{className:`loading loading-spinner loading-md text-primary`})}):(0,g.jsx)(`div`,{className:`stg-inset overflow-x-auto`,children:(0,g.jsxs)(`table`,{className:`table table-sm`,children:[(0,g.jsx)(`thead`,{children:(0,g.jsxs)(`tr`,{children:[(0,g.jsx)(`th`,{children:e(`accounts.username`)}),(0,g.jsx)(`th`,{children:e(`accounts.role`)}),(0,g.jsx)(`th`,{className:`text-right`,children:e(`accounts.actions`)})]})}),(0,g.jsx)(`tbody`,{children:v.map(t=>{let n=t.username.toLowerCase()===(r??``).toLowerCase();return(0,g.jsxs)(`tr`,{children:[(0,g.jsxs)(`td`,{children:[(0,g.jsx)(`span`,{className:`font-medium font-mono`,children:t.username}),n&&(0,g.jsx)(`span`,{className:`ml-2 badge badge-ghost badge-xs`,children:e(`accounts.you`)})]}),(0,g.jsx)(`td`,{children:(0,g.jsxs)(`select`,{className:`select select-xs select-bordered`,value:t.role,disabled:n,onChange:e=>z(t,e.target.value),children:[(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]})}),(0,g.jsxs)(`td`,{className:`text-right whitespace-nowrap`,children:[(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>B(t),children:e(`accounts.reset_password`)}),(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error ml-1`,disabled:n,onClick:()=>R(t),children:e(`accounts.delete`)})]})]},t.username)})})]})})}),(0,g.jsx)(`form`,{onSubmit:L,children:(0,g.jsx)(f,{icon:(0,g.jsx)(n,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,g.jsx)(u,{children:(0,g.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:M||!E||!O||!!F,children:[M&&(0,g.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,g.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,g.jsx)(d,{label:e(`accounts.username`),children:(0,g.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:E,onChange:e=>D(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.password`),error:F||void 0,children:(0,g.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${F?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":F?!0:void 0,"aria-describedby":F?`accounts-password-error`:void 0,value:O,onChange:e=>k(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,g.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})})]}):(0,g.jsx)(c,{width:`wide`,children:(0,g.jsx)(l,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{v as default};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{Qt as t,Zt as n,an as r,in as i}from"./fa-DFicOgEn.js";import{n as a}from"./axios-DJBeJS4R.js";import{A as o,M as s,S as c,c as l,d as u,f as d,g as f,j as p,k as m}from"./index-D8GaCUlC.js";var h=e(r(),1),g=i();function _(e,t){return e?.response?.data?.detail||t}function v(){let{t:e}=p(),{username:r,isAdmin:i}=s(),[v,y]=(0,h.useState)([]),[b,x]=(0,h.useState)(!0),[S,C]=(0,h.useState)(null),[w,T]=(0,h.useState)(null),[E,D]=(0,h.useState)(``),[O,k]=(0,h.useState)(``),[A,j]=(0,h.useState)(`viewer`),[M,N]=(0,h.useState)(!1),P=O?o(O,E):null,F=P?e(m[P],{min:8}):null,I=(0,h.useCallback)(async()=>{try{let{data:e}=await a.get(`/api/accounts`);y(e.accounts??[]),C(null)}catch(t){C(_(t,e(`accounts.load_failed`)))}finally{x(!1)}},[e]);(0,h.useEffect)(()=>{i&&I()},[i,I]);let L=async t=>{t.preventDefault(),C(null),T(null),N(!0);try{await a.post(`/api/accounts`,{username:E,password:O,role:A}),D(``),k(``),j(`viewer`),T(e(`accounts.created`)),await I()}catch(t){C(_(t,e(`accounts.create_failed`)))}finally{N(!1)}},R=async t=>{if(window.confirm(e(`accounts.confirm_delete`,{username:t.username}))){C(null),T(null);try{await a.delete(`/api/accounts/${encodeURIComponent(t.username)}`),T(e(`accounts.deleted`,{username:t.username})),await I()}catch(t){C(_(t,e(`accounts.delete_failed`)))}}},z=async(t,n)=>{C(null),T(null);try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await I()}catch(t){C(_(t,e(`accounts.role_failed`))),await I()}},B=async t=>{let n=window.prompt(e(`accounts.prompt_new_password`,{username:t.username}));if(!n)return;C(null),T(null);let r=o(n,t.username);if(r){C(e(m[r],{min:8}));return}try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/password`,{password:n}),T(e(`accounts.password_reset`,{username:t.username}))}catch(t){C(_(t,e(`accounts.password_failed`)))}};return i?(0,g.jsxs)(c,{width:`wide`,children:[S&&(0,g.jsx)(l,{variant:`error`,message:S}),w&&(0,g.jsx)(l,{variant:`success`,message:w}),(0,g.jsx)(f,{icon:(0,g.jsx)(t,{}),title:e(`accounts.title`),children:b?(0,g.jsx)(`div`,{className:`flex justify-center py-6`,children:(0,g.jsx)(`span`,{className:`loading loading-spinner loading-md text-primary`})}):(0,g.jsx)(`div`,{className:`stg-inset overflow-x-auto`,children:(0,g.jsxs)(`table`,{className:`table table-sm`,children:[(0,g.jsx)(`thead`,{children:(0,g.jsxs)(`tr`,{children:[(0,g.jsx)(`th`,{children:e(`accounts.username`)}),(0,g.jsx)(`th`,{children:e(`accounts.role`)}),(0,g.jsx)(`th`,{className:`text-right`,children:e(`accounts.actions`)})]})}),(0,g.jsx)(`tbody`,{children:v.map(t=>{let n=t.username.toLowerCase()===(r??``).toLowerCase();return(0,g.jsxs)(`tr`,{children:[(0,g.jsxs)(`td`,{children:[(0,g.jsx)(`span`,{className:`font-medium font-mono`,children:t.username}),n&&(0,g.jsx)(`span`,{className:`ml-2 badge badge-ghost badge-xs`,children:e(`accounts.you`)})]}),(0,g.jsx)(`td`,{children:(0,g.jsxs)(`select`,{className:`select select-xs select-bordered`,value:t.role,disabled:n,onChange:e=>z(t,e.target.value),children:[(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]})}),(0,g.jsxs)(`td`,{className:`text-right whitespace-nowrap`,children:[(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>B(t),children:e(`accounts.reset_password`)}),(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error ml-1`,disabled:n,onClick:()=>R(t),children:e(`accounts.delete`)})]})]},t.username)})})]})})}),(0,g.jsx)(`form`,{onSubmit:L,children:(0,g.jsx)(f,{icon:(0,g.jsx)(n,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,g.jsx)(u,{children:(0,g.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:M||!E||!O||!!F,children:[M&&(0,g.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,g.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,g.jsx)(d,{label:e(`accounts.username`),children:(0,g.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:E,onChange:e=>D(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.password`),error:F||void 0,children:(0,g.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${F?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":F?!0:void 0,"aria-describedby":F?`accounts-password-error`:void 0,value:O,onChange:e=>k(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,g.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})})]}):(0,g.jsx)(c,{width:`wide`,children:(0,g.jsx)(l,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{v as default};

boneio-1.6.0.dev12/boneio/webui/frontend-dist/assets/BackupSection-7aQpPnK6.js → boneio-1.6.0.dev13/boneio/webui/frontend-dist/assets/BackupSection-z_ahIzDh.js

@@ -1 +1 @@
-import{r as e}from"./rolldown-runtime-hePW80VL.js";import{A as t,It as n,Jt as r,N as i,R as a,Xt as o,Yt as s,an as c,in as l}from"./fa-DFicOgEn.js";import{a as u,i as d,n as f,o as p,t as m}from"./dialog-BHkRvqJ3.js";import{n as h}from"./axios-DJBeJS4R.js";import{S as g,c as _,d as v,g as y,j as b}from"./index-BWIpETfX.js";var x=e(c(),1),S=l();function C(){let{t:e}=b(),c=(0,x.useRef)(null),[l,C]=(0,x.useState)(!1),[w,T]=(0,x.useState)(!1),[E,D]=(0,x.useState)(null),[O,k]=(0,x.useState)(null),[A,j]=(0,x.useState)([]),[M,N]=(0,x.useState)(!1),[P,F]=(0,x.useState)(null),I=(0,x.useCallback)(async()=>{try{let{data:e}=await h.get(`/api/config/backups`);j(e.backups||[])}catch(e){console.error(`Error fetching available backups:`,e)}},[]);(0,x.useEffect)(()=>{I()},[I]);let L=async()=>{C(!0),k(null);try{let{data:e}=await h.post(`/api/config/create_backup`);e.status===`success`?(await I(),alert(e.message)):k(e.message)}catch(t){k(e(`backup.error`)),console.error(`Error creating backup:`,t)}finally{C(!1)}},R=async(t,n)=>{try{let e=(await h.get(`/api/config/download_backup?backup_path=${encodeURIComponent(t)}`,{responseType:`blob`})).data,r=window.URL.createObjectURL(e),i=document.createElement(`a`);i.href=r,i.download=n,document.body.appendChild(i),i.click(),window.URL.revokeObjectURL(r),document.body.removeChild(i)}catch(t){k(e(`backup.error`)),console.error(`Error downloading backup:`,t)}},z=async(t,n)=>{if(confirm(`${e(`device_management.confirm_delete_backup`)||`Delete backup`} ${n}?`))try{let{data:e}=await h.delete(`/api/config/delete_backup`,{data:{backup_path:t}});e.status===`success`?(await I(),alert(e.message)):k(e.message)}catch(t){k(e(`backup.error`)),console.error(`Error deleting backup:`,t)}},B=async t=>{t.status===`success`?(D(t),confirm(e(`device_management.restore_success_restart`))&&(await h.post(`/api/restart`),setTimeout(()=>window.location.reload(),3e3))):k(t.message||e(`device_management.restore_failed`))},V=async(t,n)=>{T(!0);try{let{data:e}=await h.post(`/api/config/restore_backup`,{backup_path:t,override_serial:n},{timeout:3e4});await B(e)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error restoring config:`,t)}finally{T(!1)}},H=async t=>{T(!0),k(null),D(null);try{let{data:n}=await h.post(`/api/config/inspect_backup_path`,{backup_path:t});n.serial_mismatch?F({backupMeta:n.backup_meta,currentSerial:n.current_serial,onConfirm:e=>{F(null),V(t,e)},onCancel:()=>{F(null),T(!1)}}):confirm(e(`device_management.confirm_restore`))?await V(t,!1):T(!1)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error inspecting backup path:`,t),T(!1)}},U=async()=>{C(!0),k(null);try{let e=await h.get(`/api/config/download`,{responseType:`blob`}),t=e.headers[`content-disposition`],n=`boneio_config.tar.gz`;if(t){let e=t.match(/filename=(.+)/);e&&(n=e[1])}let r=e.data,i=window.URL.createObjectURL(r),a=document.createElement(`a`);a.href=i,a.download=n,document.body.appendChild(a),a.click(),window.URL.revokeObjectURL(i),document.body.removeChild(a)}catch(t){k(e(`backup.error`)),console.error(`Error downloading config:`,t)}finally{C(!1)}},W=async(t,n)=>{T(!0);try{let e=new FormData;e.append(`file`,t),e.append(`override_serial`,n?`true`:`false`);let{data:r}=await h.post(`/api/config/restore`,e,{headers:{"Content-Type":`multipart/form-data`},timeout:3e4});await B(r)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error restoring config:`,t)}finally{T(!1)}};return(0,S.jsxs)(g,{width:`wide`,children:[O&&(0,S.jsx)(_,{variant:`error`,message:O,action:(0,S.jsx)(`button`,{className:`btn btn-ghost btn-xs btn-circle`,onClick:()=>k(null),children:`×`})}),(0,S.jsx)(y,{icon:(0,S.jsx)(t,{}),title:e(`device_management.configuration_backup`),description:e(`device_management.backup_description`),footer:(0,S.jsxs)(v,{children:[(0,S.jsx)(`button`,{className:`btn btn-primary btn-sm gap-2`,onClick:U,disabled:l||w,children:l?(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(n,{className:`animate-spin`}),e(`device_management.preparing`)]}):(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(t,{}),e(`device_management.download_config`)]})}),(0,S.jsx)(`button`,{className:`btn btn-outline btn-sm gap-2`,onClick:()=>c.current?.click(),disabled:l||w,children:w?(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(n,{className:`animate-spin`}),e(`device_management.restoring`)]}):(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(o,{}),e(`device_management.restore_config`)]})})]}),children:(0,S.jsxs)(`div`,{className:`space-y-3`,children:[(0,S.jsx)(`input`,{ref:c,type:`file`,accept:`.tar.gz,.tgz`,onChange:async t=>{let n=t.target.files?.[0];if(n){T(!0),k(null),D(null);try{let t=new FormData;t.append(`file`,n);let{data:r}=await h.post(`/api/config/inspect_backup_file`,t,{headers:{"Content-Type":`multipart/form-data`}});r.serial_mismatch?F({backupMeta:r.backup_meta,currentSerial:r.current_serial,onConfirm:e=>{F(null),W(n,e)},onCancel:()=>{F(null),T(!1)}}):confirm(e(`device_management.confirm_restore`))?await W(n,!1):T(!1)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error inspecting backup file:`,t),T(!1)}}c.current&&(c.current.value=``)},style:{display:`none`}}),(0,S.jsx)(_,{variant:`info`,message:(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(`span`,{className:`block`,children:e(`device_management.backup_info_1`)}),(0,S.jsx)(`span`,{className:`block`,children:e(`device_management.backup_info_2`)}),(0,S.jsx)(`span`,{className:`block font-semibold mt-1`,children:e(`device_management.restore_info`)})]})}),E&&(0,S.jsx)(_,{variant:E.validation_status===`success`?`success`:`warning`,message:(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(`span`,{className:`block`,children:E.message}),(0,S.jsxs)(`span`,{className:`block text-xs opacity-70 mt-1 break-all`,children:[e(`device_management.backup_created`),`: `,E.backup_path]}),E.validation_status===`warning`&&(0,S.jsx)(`span`,{className:`block text-xs mt-1`,children:E.validation_message})]})})]})}),(0,S.jsx)(y,{icon:(0,S.jsx)(a,{}),title:e(`device_management.config_backups`),collapsible:A.length>0,open:M,onOpenChange:e=>{N(e),e&&I()},summary:A.length,action:(0,S.jsx)(`button`,{className:`btn btn-primary btn-sm gap-2`,onClick:L,disabled:l||w,children:l?(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(n,{className:`animate-spin`}),e(`device_management.preparing`)]}):(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(a,{}),e(`device_management.create_backup`)||`Create Backup`]})}),children:(0,S.jsxs)(`div`,{className:`space-y-3`,children:[(0,S.jsx)(_,{variant:`neutral`,message:e(`device_management.backup_limit_info`)||`Maximum 10 backups are kept. Oldest backups are automatically removed when creating new ones.`}),M&&A.length>0&&(0,S.jsx)(`div`,{className:`stg-inset overflow-x-auto`,children:(0,S.jsxs)(`table`,{className:`table table-sm`,children:[(0,S.jsx)(`thead`,{children:(0,S.jsxs)(`tr`,{children:[(0,S.jsx)(`th`,{children:e(`device_management.version`)}),(0,S.jsx)(`th`,{children:e(`device_management.date`)}),(0,S.jsx)(`th`,{children:e(`device_management.files`)}),(0,S.jsx)(`th`,{className:`text-right`,children:e(`device_management.actions`)})]})}),(0,S.jsx)(`tbody`,{children:A.map(n=>(0,S.jsxs)(`tr`,{children:[(0,S.jsx)(`td`,{className:`font-mono`,children:n.version}),(0,S.jsx)(`td`,{className:`text-xs font-mono`,children:n.timestamp}),(0,S.jsxs)(`td`,{children:[n.file_count,` `,e(`device_management.yaml_files`)]}),(0,S.jsx)(`td`,{children:(0,S.jsxs)(`div`,{className:`flex gap-1 justify-end`,children:[(0,S.jsxs)(`button`,{className:`btn btn-warning btn-xs gap-1.5`,onClick:()=>H(n.path),disabled:w,title:e(`device_management.restore`),children:[(0,S.jsx)(s,{}),e(`device_management.restore`)]}),(0,S.jsx)(`button`,{className:`btn btn-ghost btn-xs btn-square`,onClick:()=>R(n.path,n.filename),title:e(`device_management.download_config`),children:(0,S.jsx)(t,{})}),(0,S.jsx)(`button`,{className:`btn btn-ghost btn-xs btn-square text-error`,onClick:()=>z(n.path,n.filename),title:e(`device_management.delete`)||`Delete`,children:(0,S.jsx)(r,{})})]})})]},n.path))})]})})]})}),P&&(0,S.jsx)(m,{open:!0,onOpenChange:e=>{e||P.onCancel()},children:(0,S.jsxs)(f,{className:`max-w-md`,children:[(0,S.jsx)(u,{children:(0,S.jsxs)(p,{className:`flex items-center gap-2 text-warning`,children:[(0,S.jsx)(i,{}),e(`device_management.serial_mismatch_title`)||`Serial Number Mismatch`]})}),(0,S.jsxs)(`div`,{className:`py-4 text-sm space-y-4`,children:[(0,S.jsx)(`p`,{children:e(`device_management.serial_mismatch_desc`)||`The uploaded configuration backup was created on a device with a different serial number:`}),(0,S.jsxs)(`div`,{className:`bg-base-300 p-3 rounded-lg font-mono text-xs space-y-1`,children:[(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.backup_serial`)||`Backup Serial`,`:`]}),` `,(0,S.jsx)(`span`,{className:`text-warning font-semibold`,children:P.backupMeta?.effective_serial||`Unknown`})]}),P.backupMeta?.hostname&&(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.backup_hostname`)||`Backup Hostname`,`:`]}),` `,(0,S.jsx)(`span`,{children:P.backupMeta.hostname})]}),P.backupMeta?.created_at&&(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.backup_created_at`)||`Created At`,`:`]}),` `,(0,S.jsx)(`span`,{children:new Date(P.backupMeta.created_at).toLocaleString()})]}),(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.current_serial`)||`Current Serial`,`:`]}),` `,(0,S.jsx)(`span`,{className:`text-info font-semibold`,children:P.currentSerial})]})]}),(0,S.jsxs)(`div`,{className:`alert alert-warning text-xs`,children:[(0,S.jsx)(i,{className:`shrink-0`}),(0,S.jsx)(`span`,{children:e(`device_management.serial_override_warning`)||`WARNING: If both controllers are running at the same time on the same MQTT broker with the same serial number, conflicts will occur!`})]})]}),(0,S.jsxs)(d,{className:`flex flex-col sm:flex-row gap-2`,children:[(0,S.jsx)(`button`,{className:`btn btn-warning btn-sm`,onClick:()=>P.onConfirm(!0),children:e(`device_management.keep_old_serial`)||`Keep Old Serial`}),(0,S.jsx)(`button`,{className:`btn btn-outline btn-sm`,onClick:()=>P.onConfirm(!1),children:e(`device_management.use_new_serial`)||`Use New Serial`}),(0,S.jsx)(`button`,{className:`btn btn-ghost btn-sm`,onClick:P.onCancel,children:e(`common.cancel`)||`Cancel`})]})]})})]})}export{C as default};
+import{r as e}from"./rolldown-runtime-hePW80VL.js";import{A as t,It as n,Jt as r,N as i,R as a,Xt as o,Yt as s,an as c,in as l}from"./fa-DFicOgEn.js";import{a as u,i as d,n as f,o as p,t as m}from"./dialog-BHkRvqJ3.js";import{n as h}from"./axios-DJBeJS4R.js";import{S as g,c as _,d as v,g as y,j as b}from"./index-D8GaCUlC.js";var x=e(c(),1),S=l();function C(){let{t:e}=b(),c=(0,x.useRef)(null),[l,C]=(0,x.useState)(!1),[w,T]=(0,x.useState)(!1),[E,D]=(0,x.useState)(null),[O,k]=(0,x.useState)(null),[A,j]=(0,x.useState)([]),[M,N]=(0,x.useState)(!1),[P,F]=(0,x.useState)(null),I=(0,x.useCallback)(async()=>{try{let{data:e}=await h.get(`/api/config/backups`);j(e.backups||[])}catch(e){console.error(`Error fetching available backups:`,e)}},[]);(0,x.useEffect)(()=>{I()},[I]);let L=async()=>{C(!0),k(null);try{let{data:e}=await h.post(`/api/config/create_backup`);e.status===`success`?(await I(),alert(e.message)):k(e.message)}catch(t){k(e(`backup.error`)),console.error(`Error creating backup:`,t)}finally{C(!1)}},R=async(t,n)=>{try{let e=(await h.get(`/api/config/download_backup?backup_path=${encodeURIComponent(t)}`,{responseType:`blob`})).data,r=window.URL.createObjectURL(e),i=document.createElement(`a`);i.href=r,i.download=n,document.body.appendChild(i),i.click(),window.URL.revokeObjectURL(r),document.body.removeChild(i)}catch(t){k(e(`backup.error`)),console.error(`Error downloading backup:`,t)}},z=async(t,n)=>{if(confirm(`${e(`device_management.confirm_delete_backup`)||`Delete backup`} ${n}?`))try{let{data:e}=await h.delete(`/api/config/delete_backup`,{data:{backup_path:t}});e.status===`success`?(await I(),alert(e.message)):k(e.message)}catch(t){k(e(`backup.error`)),console.error(`Error deleting backup:`,t)}},B=async t=>{t.status===`success`?(D(t),confirm(e(`device_management.restore_success_restart`))&&(await h.post(`/api/restart`),setTimeout(()=>window.location.reload(),3e3))):k(t.message||e(`device_management.restore_failed`))},V=async(t,n)=>{T(!0);try{let{data:e}=await h.post(`/api/config/restore_backup`,{backup_path:t,override_serial:n},{timeout:3e4});await B(e)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error restoring config:`,t)}finally{T(!1)}},H=async t=>{T(!0),k(null),D(null);try{let{data:n}=await h.post(`/api/config/inspect_backup_path`,{backup_path:t});n.serial_mismatch?F({backupMeta:n.backup_meta,currentSerial:n.current_serial,onConfirm:e=>{F(null),V(t,e)},onCancel:()=>{F(null),T(!1)}}):confirm(e(`device_management.confirm_restore`))?await V(t,!1):T(!1)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error inspecting backup path:`,t),T(!1)}},U=async()=>{C(!0),k(null);try{let e=await h.get(`/api/config/download`,{responseType:`blob`}),t=e.headers[`content-disposition`],n=`boneio_config.tar.gz`;if(t){let e=t.match(/filename=(.+)/);e&&(n=e[1])}let r=e.data,i=window.URL.createObjectURL(r),a=document.createElement(`a`);a.href=i,a.download=n,document.body.appendChild(a),a.click(),window.URL.revokeObjectURL(i),document.body.removeChild(a)}catch(t){k(e(`backup.error`)),console.error(`Error downloading config:`,t)}finally{C(!1)}},W=async(t,n)=>{T(!0);try{let e=new FormData;e.append(`file`,t),e.append(`override_serial`,n?`true`:`false`);let{data:r}=await h.post(`/api/config/restore`,e,{headers:{"Content-Type":`multipart/form-data`},timeout:3e4});await B(r)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error restoring config:`,t)}finally{T(!1)}};return(0,S.jsxs)(g,{width:`wide`,children:[O&&(0,S.jsx)(_,{variant:`error`,message:O,action:(0,S.jsx)(`button`,{className:`btn btn-ghost btn-xs btn-circle`,onClick:()=>k(null),children:`×`})}),(0,S.jsx)(y,{icon:(0,S.jsx)(t,{}),title:e(`device_management.configuration_backup`),description:e(`device_management.backup_description`),footer:(0,S.jsxs)(v,{children:[(0,S.jsx)(`button`,{className:`btn btn-primary btn-sm gap-2`,onClick:U,disabled:l||w,children:l?(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(n,{className:`animate-spin`}),e(`device_management.preparing`)]}):(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(t,{}),e(`device_management.download_config`)]})}),(0,S.jsx)(`button`,{className:`btn btn-outline btn-sm gap-2`,onClick:()=>c.current?.click(),disabled:l||w,children:w?(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(n,{className:`animate-spin`}),e(`device_management.restoring`)]}):(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(o,{}),e(`device_management.restore_config`)]})})]}),children:(0,S.jsxs)(`div`,{className:`space-y-3`,children:[(0,S.jsx)(`input`,{ref:c,type:`file`,accept:`.tar.gz,.tgz`,onChange:async t=>{let n=t.target.files?.[0];if(n){T(!0),k(null),D(null);try{let t=new FormData;t.append(`file`,n);let{data:r}=await h.post(`/api/config/inspect_backup_file`,t,{headers:{"Content-Type":`multipart/form-data`}});r.serial_mismatch?F({backupMeta:r.backup_meta,currentSerial:r.current_serial,onConfirm:e=>{F(null),W(n,e)},onCancel:()=>{F(null),T(!1)}}):confirm(e(`device_management.confirm_restore`))?await W(n,!1):T(!1)}catch(t){k(e(`device_management.restore_failed`)),console.error(`Error inspecting backup file:`,t),T(!1)}}c.current&&(c.current.value=``)},style:{display:`none`}}),(0,S.jsx)(_,{variant:`info`,message:(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(`span`,{className:`block`,children:e(`device_management.backup_info_1`)}),(0,S.jsx)(`span`,{className:`block`,children:e(`device_management.backup_info_2`)}),(0,S.jsx)(`span`,{className:`block font-semibold mt-1`,children:e(`device_management.restore_info`)})]})}),E&&(0,S.jsx)(_,{variant:E.validation_status===`success`?`success`:`warning`,message:(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(`span`,{className:`block`,children:E.message}),(0,S.jsxs)(`span`,{className:`block text-xs opacity-70 mt-1 break-all`,children:[e(`device_management.backup_created`),`: `,E.backup_path]}),E.validation_status===`warning`&&(0,S.jsx)(`span`,{className:`block text-xs mt-1`,children:E.validation_message})]})})]})}),(0,S.jsx)(y,{icon:(0,S.jsx)(a,{}),title:e(`device_management.config_backups`),collapsible:A.length>0,open:M,onOpenChange:e=>{N(e),e&&I()},summary:A.length,action:(0,S.jsx)(`button`,{className:`btn btn-primary btn-sm gap-2`,onClick:L,disabled:l||w,children:l?(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(n,{className:`animate-spin`}),e(`device_management.preparing`)]}):(0,S.jsxs)(S.Fragment,{children:[(0,S.jsx)(a,{}),e(`device_management.create_backup`)||`Create Backup`]})}),children:(0,S.jsxs)(`div`,{className:`space-y-3`,children:[(0,S.jsx)(_,{variant:`neutral`,message:e(`device_management.backup_limit_info`)||`Maximum 10 backups are kept. Oldest backups are automatically removed when creating new ones.`}),M&&A.length>0&&(0,S.jsx)(`div`,{className:`stg-inset overflow-x-auto`,children:(0,S.jsxs)(`table`,{className:`table table-sm`,children:[(0,S.jsx)(`thead`,{children:(0,S.jsxs)(`tr`,{children:[(0,S.jsx)(`th`,{children:e(`device_management.version`)}),(0,S.jsx)(`th`,{children:e(`device_management.date`)}),(0,S.jsx)(`th`,{children:e(`device_management.files`)}),(0,S.jsx)(`th`,{className:`text-right`,children:e(`device_management.actions`)})]})}),(0,S.jsx)(`tbody`,{children:A.map(n=>(0,S.jsxs)(`tr`,{children:[(0,S.jsx)(`td`,{className:`font-mono`,children:n.version}),(0,S.jsx)(`td`,{className:`text-xs font-mono`,children:n.timestamp}),(0,S.jsxs)(`td`,{children:[n.file_count,` `,e(`device_management.yaml_files`)]}),(0,S.jsx)(`td`,{children:(0,S.jsxs)(`div`,{className:`flex gap-1 justify-end`,children:[(0,S.jsxs)(`button`,{className:`btn btn-warning btn-xs gap-1.5`,onClick:()=>H(n.path),disabled:w,title:e(`device_management.restore`),children:[(0,S.jsx)(s,{}),e(`device_management.restore`)]}),(0,S.jsx)(`button`,{className:`btn btn-ghost btn-xs btn-square`,onClick:()=>R(n.path,n.filename),title:e(`device_management.download_config`),children:(0,S.jsx)(t,{})}),(0,S.jsx)(`button`,{className:`btn btn-ghost btn-xs btn-square text-error`,onClick:()=>z(n.path,n.filename),title:e(`device_management.delete`)||`Delete`,children:(0,S.jsx)(r,{})})]})})]},n.path))})]})})]})}),P&&(0,S.jsx)(m,{open:!0,onOpenChange:e=>{e||P.onCancel()},children:(0,S.jsxs)(f,{className:`max-w-md`,children:[(0,S.jsx)(u,{children:(0,S.jsxs)(p,{className:`flex items-center gap-2 text-warning`,children:[(0,S.jsx)(i,{}),e(`device_management.serial_mismatch_title`)||`Serial Number Mismatch`]})}),(0,S.jsxs)(`div`,{className:`py-4 text-sm space-y-4`,children:[(0,S.jsx)(`p`,{children:e(`device_management.serial_mismatch_desc`)||`The uploaded configuration backup was created on a device with a different serial number:`}),(0,S.jsxs)(`div`,{className:`bg-base-300 p-3 rounded-lg font-mono text-xs space-y-1`,children:[(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.backup_serial`)||`Backup Serial`,`:`]}),` `,(0,S.jsx)(`span`,{className:`text-warning font-semibold`,children:P.backupMeta?.effective_serial||`Unknown`})]}),P.backupMeta?.hostname&&(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.backup_hostname`)||`Backup Hostname`,`:`]}),` `,(0,S.jsx)(`span`,{children:P.backupMeta.hostname})]}),P.backupMeta?.created_at&&(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.backup_created_at`)||`Created At`,`:`]}),` `,(0,S.jsx)(`span`,{children:new Date(P.backupMeta.created_at).toLocaleString()})]}),(0,S.jsxs)(`div`,{children:[(0,S.jsxs)(`span`,{className:`opacity-60`,children:[e(`device_management.current_serial`)||`Current Serial`,`:`]}),` `,(0,S.jsx)(`span`,{className:`text-info font-semibold`,children:P.currentSerial})]})]}),(0,S.jsxs)(`div`,{className:`alert alert-warning text-xs`,children:[(0,S.jsx)(i,{className:`shrink-0`}),(0,S.jsx)(`span`,{children:e(`device_management.serial_override_warning`)||`WARNING: If both controllers are running at the same time on the same MQTT broker with the same serial number, conflicts will occur!`})]})]}),(0,S.jsxs)(d,{className:`flex flex-col sm:flex-row gap-2`,children:[(0,S.jsx)(`button`,{className:`btn btn-warning btn-sm`,onClick:()=>P.onConfirm(!0),children:e(`device_management.keep_old_serial`)||`Keep Old Serial`}),(0,S.jsx)(`button`,{className:`btn btn-outline btn-sm`,onClick:()=>P.onConfirm(!1),children:e(`device_management.use_new_serial`)||`Use New Serial`}),(0,S.jsx)(`button`,{className:`btn btn-ghost btn-sm`,onClick:P.onCancel,children:e(`common.cancel`)||`Cancel`})]})]})})]})}export{C as default};