boneio 1.6.0.dev14__tar.gz → 1.6.0.dev15__tar.gz

{boneio-1.6.0.dev14/boneio.egg-info → boneio-1.6.0.dev15}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev14
+Version: 1.6.0.dev15
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/components/template/alarm_panel.py

@@ -11,6 +11,7 @@ from __future__ import annotations
 import asyncio
 import contextlib
 import hashlib
+import hmac
 import json
 import logging
 import time
@@ -49,6 +50,22 @@ OUTPUT_NOTIFICATION = "notification"
 OUTPUT_LIGHT = "light"
 OUTPUT_CUSTOM = "custom"
 
+# Outcome of a command that needed a code; the web API maps these to HTTP.
+CODE_OK = "ok"
+CODE_INVALID = "invalid_code"
+CODE_MISSING = "code_required"
+CODE_LOCKED = "locked"
+
+# Wrong-code throttling (PLAN_OSDP §7.2 pt 1). A four-digit PIN is 10 000
+# guesses; unthrottled, a script over the API or MQTT runs through them in
+# minutes. After this many wrong codes in a row every code is refused, the
+# right one included, for a pause that doubles with each further run of
+# failures. It throttles and never locks for good — the same rule as
+# webui/rate_limit.py: the worst a guesser can do is make the owner wait.
+CODE_MAX_FAILURES = 5
+CODE_LOCKOUT_BASE_S = 30.0
+CODE_LOCKOUT_MAX_S = 900.0
+
 # Input wiring types
 NORMALLY_CLOSED = "normally_closed"
 NORMALLY_OPEN = "normally_open"
@@ -199,7 +216,9 @@ class AlarmPinCode:
         Returns:
             True if the PIN matches.
         """
-        return self._hash == self.hash_code(plain_code)
+        # Constant-time: `==` on the digests leaks, through timing, how much of
+        # a guess matched (PLAN_OSDP §7.2 pt 3).
+        return hmac.compare_digest(self._hash, self.hash_code(plain_code))
 
     @staticmethod
     def hash_code(plain: str) -> str:
@@ -291,11 +310,21 @@ class BoneIOAlarmPanel:
         self._state_topic = f"{topic_prefix}/alarm/{id}/{STATE}"
         self._cmd_topic = f"{topic_prefix}/cmd/alarm/{id}/set"
         self._attributes_topic = f"{topic_prefix}/alarm/{id}/attributes"
+        # The "codes locked" binary_sensor in HA, for automations.
+        self._code_lock_topic = f"{topic_prefix}/alarm/{id}/code_lock"
 
         # Track triggered inputs for logging
         self._triggered_zone: str | None = None
         self._triggered_input: str | None = None
 
+        # Wrong-code throttling. One counter for the panel, whatever the code
+        # came through — HA, the web UI, a keypad — so switching paths does
+        # not buy a guesser a fresh allowance.
+        self._code_failures = 0
+        self._code_lockouts = 0
+        self._code_locked_until: float | None = None
+        self._code_unlock_timer: asyncio.TimerHandle | None = None
+
         _LOGGER.info(
             "Initialized BoneIOAlarmPanel: id=%s, zones=%d, outputs=%d, "
             "codes=%d, arming=%.0fs, delay=%.0fs, trigger=%.0fs",
@@ -359,6 +388,21 @@ class BoneIOAlarmPanel:
         remaining = self._arming_time_s - elapsed
         return max(0.0, round(remaining, 1))
 
+    @property
+    def code_failed_attempts(self) -> int:
+        """Wrong codes entered in a row since the last right one."""
+        return self._code_failures
+
+    @property
+    def code_locked_remaining_s(self) -> float | None:
+        """Seconds until codes are checked again, or None when not locked."""
+        if self._code_locked_until is None:
+            return None
+        remaining = self._code_locked_until - time.monotonic()
+        if remaining <= 0:
+            return None
+        return round(remaining, 1)
+
     # -- State persistence ----------------------------------------------------
 
     _PERSIST_ATTR_TYPE = ALARM_CONTROL_PANEL
@@ -396,34 +440,98 @@ class BoneIOAlarmPanel:
 
     # -- PIN code validation -------------------------------------------------
 
-    def _validate_code(self, code: str | None, action: str) -> tuple[bool, str | None]:
-        """Validate a PIN code against configured codes.
+    def _validate_code(self, code: str | None, action: str) -> tuple[str, str | None]:
+        """Validate a PIN code against configured codes, with throttling.
 
         Args:
             code: The PIN code to validate (None if not provided).
             action: The action being performed (for logging).
 
         Returns:
-            Tuple of (is_valid, user_name). If no codes are configured,
-            always returns (True, None).
+            Tuple of (outcome, user_name): outcome is CODE_OK, CODE_MISSING,
+            CODE_INVALID or CODE_LOCKED. If no codes are configured, always
+            (CODE_OK, None).
         """
         if not self._codes:
-            return True, None
+            return CODE_OK, None
+
+        # Refused unchecked while locked — checking would let a guesser keep
+        # going and only hide which guess was right.
+        locked_s = self.code_locked_remaining_s
+        if locked_s is not None:
+            _LOGGER.warning(
+                "Alarm %s: %s rejected — codes locked for %.0fs after %d wrong codes",
+                self._id, action, locked_s, self._code_failures,
+            )
+            return CODE_LOCKED, None
 
         if not code:
+            # Not a guess, so not counted: HA sends a bare command when the
+            # user taps a button before typing anything.
             _LOGGER.warning("Alarm %s: %s rejected — no code provided", self._id, action)
-            return False, None
+            return CODE_MISSING, None
 
         for pin in self._codes:
-            if pin.verify(code):
-                return True, pin.name
+            if pin.verify(str(code)):
+                if self._code_failures:
+                    self._code_failures = 0
+                    self._code_lockouts = 0
+                    self._code_locked_until = None
+                    self._publish_attributes()
+                return CODE_OK, pin.name
+
+        self._code_failures += 1
+        _LOGGER.warning(
+            "Alarm %s: %s rejected — invalid code (%d in a row)",
+            self._id, action, self._code_failures,
+        )
+        if self._code_failures % CODE_MAX_FAILURES == 0:
+            lock_s = min(CODE_LOCKOUT_MAX_S, CODE_LOCKOUT_BASE_S * (2 ** self._code_lockouts))
+            self._code_lockouts += 1
+            self._code_locked_until = time.monotonic() + lock_s
+            _LOGGER.warning(
+                "Alarm %s: %d wrong codes in a row — codes locked for %.0fs",
+                self._id, self._code_failures, lock_s,
+            )
+            self._publish_code_lock(True)
+            self._schedule_code_unlock(lock_s)
+            self._publish_attributes()
+            return CODE_LOCKED, None
+        self._publish_attributes()
+        return CODE_INVALID, None
+
+    def _publish_code_lock(self, locked: bool) -> None:
+        """Publish the "codes locked" binary_sensor state (retained)."""
+        self._message_bus.send_message(
+            topic=self._code_lock_topic,
+            payload="ON" if locked else "OFF",
+            retain=True,
+        )
+
+    def _schedule_code_unlock(self, delay_s: float) -> None:
+        """Turn the binary_sensor off again when the lockout runs out.
+
+        The lockout itself needs no timer — it is a deadline checked on the
+        next code — but HA only learns it ended if something says so.
+        """
+        if self._code_unlock_timer is not None:
+            self._code_unlock_timer.cancel()
+        try:
+            loop = asyncio.get_running_loop()
+        except RuntimeError:
+            return
+        self._code_unlock_timer = loop.call_later(delay_s, self._on_code_unlock)
 
-        _LOGGER.warning("Alarm %s: %s rejected — invalid code", self._id, action)
-        return False, None
+    def _on_code_unlock(self) -> None:
+        """Lockout over: tell HA, and refresh the attributes it reads."""
+        self._code_unlock_timer = None
+        _LOGGER.info("Alarm %s: code lockout ended", self._id)
+        self._publish_code_lock(False)
+        self._publish_attributes()
 
     # -- MQTT command handler ------------------------------------------------
 
-    async def handle_command(self, _topic: str, payload: str) -> None:
+    async def handle_command(self, _topic: str, payload: str) -> str:
         """Handle alarm command from HA.
 
         Payload can be a plain command string (ARM_HOME, DISARM, etc.)
@@ -433,6 +541,11 @@ class BoneIOAlarmPanel:
         Args:
             _topic: MQTT topic (unused).
             payload: Command string or JSON payload.
+
+        Returns:
+            CODE_OK when the command was accepted, otherwise why the code was
+            refused (CODE_MISSING, CODE_INVALID, CODE_LOCKED). MQTT ignores
+            it; the web API turns it into a status code.
         """
         code: str | None = None
         command: str
@@ -452,17 +565,17 @@ class BoneIOAlarmPanel:
                       self._id, command, self._state)
 
         if command == CMD_DISARM:
-            valid, user_name = self._validate_code(code, "DISARM")
-            if not valid:
-                return
+            outcome, user_name = self._validate_code(code, "DISARM")
+            if outcome != CODE_OK:
+                return outcome
             if user_name:
                 _LOGGER.info("Alarm %s disarmed by %s", self._id, user_name)
             await self._disarm()
         elif command in (CMD_ARM_HOME, CMD_ARM_AWAY, CMD_ARM_NIGHT):
             if self._code_arm_required:
-                valid, user_name = self._validate_code(code, command)
-                if not valid:
-                    return
+                outcome, user_name = self._validate_code(code, command)
+                if outcome != CODE_OK:
+                    return outcome
                 if user_name:
                     _LOGGER.info("Alarm %s armed (%s) by %s", self._id, command, user_name)
             target = {
@@ -475,6 +588,7 @@ class BoneIOAlarmPanel:
             await self._trigger("manual", "manual")
         else:
             _LOGGER.warning("Unknown alarm command: %s", command)
+        return CODE_OK
 
     # -- Input event handler -------------------------------------------------
 
@@ -776,6 +890,9 @@ class BoneIOAlarmPanel:
         attrs: dict[str, Any] = {
             "triggered_zone": self._triggered_zone,
             "triggered_input": self._triggered_input,
+            # For an HA automation that tells someone their PIN is being guessed.
+            "code_failed_attempts": self._code_failures,
+            "code_locked_s": self.code_locked_remaining_s,
         }
         if blocking_inputs is not None:
             attrs["blocking_inputs"] = blocking_inputs
@@ -793,11 +910,18 @@ class BoneIOAlarmPanel:
             self._cmd_topic, self.handle_command
         )
         self._publish_state()
+        # A lockout lives in memory only, so after a restart codes are open —
+        # say so, rather than leave a retained ON from before the restart.
+        if self._codes:
+            self._publish_code_lock(False)
         _LOGGER.info("Alarm panel %s started", self._id)
 
     async def stop(self) -> None:
         """Stop alarm panel — cancel timers and unsubscribe."""
         self._cancel_all_timers()
+        if self._code_unlock_timer is not None:
+            self._code_unlock_timer.cancel()
+            self._code_unlock_timer = None
         await self._deactivate_outputs()
         with contextlib.suppress(Exception):
             await self._message_bus.unsubscribe_and_stop_listen(self._cmd_topic)

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/const.py

@@ -194,6 +194,7 @@ cover_actions = {
     "TOGGLE_OPEN": "toggle_open",
     "TOGGLE_CLOSE": "toggle_close",
     "SMART_TOGGLE": "smart_toggle",
+    "SET_POSITION": "set_cover_position",
     "TILT": "set_tilt",
     "TILT_OPEN": "tilt_open",
     "TILT_CLOSE": "tilt_close",

boneio-1.6.0.dev15/boneio/core/atomic_file.py

@@ -0,0 +1,113 @@
+"""Replace a file's content without ever leaving half of it on disk.
+
+The controller has no UPS and runs from an SD card or eMMC. A plain
+``open(path, "w")`` truncates the file first, so power lost during the write
+leaves ``config.yaml`` cut short — and a controller that no longer boots.
+Writing next to the target and renaming over it means a reader, or the next
+boot, sees either the old file or the new one, never a mix.
+
+Kept free of heavy imports: the recovery app uses it too.
+"""
+
+from __future__ import annotations
+
+import glob
+import os
+import tempfile
+import time
+from pathlib import Path
+
+
+#: A temp file this old was left by a writer that died: a save takes well
+#: under a second, and one still running must not lose its file.
+_STALE_TEMP_SECONDS = 60
+#: What tempfile.mkstemp appends to the prefix.
+_TEMP_SUFFIX_LEN = 8
+
+
+def _remove_stale_temps(target: Path) -> None:
+    """Delete temp files left by writes that never reached the rename.
+
+    Nothing can clean up after a power cut or SIGKILL mid-write, so without
+    this they pile up in the config directory, one per interrupted save.
+    """
+    prefix = f".{target.name}."
+    cutoff = time.time() - _STALE_TEMP_SECONDS
+    try:
+        candidates = list(target.parent.glob(f"{glob.escape(prefix)}*"))
+    except OSError:
+        return
+    for candidate in candidates:
+        if len(candidate.name) != len(prefix) + _TEMP_SUFFIX_LEN:
+            continue
+        try:
+            if candidate.lstat().st_mtime < cutoff:
+                candidate.unlink()
+        except OSError:
+            continue
+
+
+def _new_file_mode() -> int:
+    """What ``open(path, "w")`` would have given a new file under our umask.
+
+    Read from /proc rather than with os.umask(), which can only be read by
+    setting it, and would briefly change it for every other thread.
+    """
+    try:
+        with open("/proc/self/status", encoding="ascii") as f:
+            for line in f:
+                if line.startswith("Umask:"):
+                    return 0o666 & ~int(line.split()[1], 8)
+    except (OSError, ValueError, IndexError):
+        pass
+    return 0o644
+
+
+def write_atomically(
+    path: str | os.PathLike[str], content: str | bytes, mode: int | None = None
+) -> None:
+    """Write ``content`` to ``path`` atomically.
+
+    Keeps the original's permission bits: an included file that holds a broker
+    password is often 0600, and a rewrite must not widen that. A symlink is
+    followed, so the file it points to is replaced rather than the link.
+
+    Args:
+        path: File to write. Its directory must exist.
+        content: New content; ``str`` is written as UTF-8.
+        mode: Permission bits to set. Defaults to the existing file's, or what
+            the process umask gives a new one.
+    """
+    target = Path(os.path.realpath(path))
+    if mode is None:
+        try:
+            mode = target.stat().st_mode & 0o777
+        except FileNotFoundError:
+            mode = _new_file_mode()
+
+    fd, tmp = tempfile.mkstemp(dir=target.parent, prefix=f".{target.name}.")
+    try:
+        with os.fdopen(fd, "wb") as f:
+            f.write(content.encode("utf-8") if isinstance(content, str) else content)
+            f.flush()
+            os.fsync(f.fileno())
+        os.chmod(tmp, mode)
+        os.replace(tmp, target)
+    except BaseException:
+        Path(tmp).unlink(missing_ok=True)
+        raise
+
+    _remove_stale_temps(target)
+
+    # The rename lives in the directory entry; without this a power cut right
+    # after it can still bring back the old file.
+    try:
+        dir_fd = os.open(target.parent, os.O_RDONLY)
+    except OSError:
+        return
+    try:
+        os.fsync(dir_fd)
+    except OSError:
+        pass
+    finally:
+        os.close(dir_fd)

{boneio-1.6.0.dev14/boneio/migrations/assets/docker/nodered → boneio-1.6.0.dev15/boneio/core/cloud/data}/docker-compose.yaml

@@ -17,7 +17,7 @@ services:
     networks:
       - edge
   caddy:
-    image: caddy:2-alpine
+    image: caddy:2.11.4-alpine@sha256:6aeddd44c3078b0f9a35206472a11420648a79c184603ef95957d0a20044cb2b
     restart: unless-stopped
     hostname: ${HOSTNAME:-boneio}
     ports:

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/migrations/__init__.py

@@ -14,6 +14,8 @@ import re
 from collections.abc import Callable
 from dataclasses import dataclass, field
 
+from boneio.core.atomic_file import write_atomically
+
 _LOGGER = logging.getLogger(__name__)
 
 # Current schema version — bump this when adding new migrations
@@ -308,8 +310,7 @@ def _persist_config_version(config_file: str, version: int) -> None:
         indent = " " * (boneio_indent + 2)
         updated_lines.append(f"{indent}config_version: {version}\n")
 
-    with open(config_file, "w", encoding="utf-8") as f:
-        f.writelines(updated_lines)
+    write_atomically(config_file, "".join(updated_lines))
 
     _LOGGER.info("Persisted config_version: %d to %s", version, config_file)
 

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/migrations/v1_proxy_port.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import logging
 import re
 
+from boneio.core.atomic_file import write_atomically
 from boneio.core.config.migrations import register_migration
 
 _LOGGER = logging.getLogger(__name__)
@@ -41,8 +42,7 @@ def _persist_proxy_port(config_file: str) -> None:
             updated_lines.append(line)
 
     if updated:
-        with open(config_file, "w", encoding="utf-8") as f:
-            f.writelines(updated_lines)
+        write_atomically(config_file, "".join(updated_lines))
 
 
 @register_migration(

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/migrations/v2_transition.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import logging
 import re
 
+from boneio.core.atomic_file import write_atomically
 from boneio.core.config.migrations import register_migration
 
 _LOGGER = logging.getLogger(__name__)
@@ -52,8 +53,7 @@ def _persist_transition(config_file: str) -> None:
             updated_lines.append(line)
 
     if updated:
-        with open(config_file, "w", encoding="utf-8") as f:
-            f.writelines(updated_lines)
+        write_atomically(config_file, "".join(updated_lines))
 
 
 @register_migration(

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/migrations/v4_wled_cache.py

@@ -16,6 +16,7 @@ import logging
 import re
 from pathlib import Path
 
+from boneio.core.atomic_file import write_atomically
 from boneio.core.config.migrations import register_migration
 
 _LOGGER = logging.getLogger(__name__)
@@ -200,8 +201,7 @@ def _strip_wled_fields_from_file(
         content = pattern.sub("", content)
 
     if content != original_content:
-        with open(yaml_path, "w", encoding="utf-8") as f:
-            f.write(content)
+        write_atomically(yaml_path, content)
         _LOGGER.info(
             "Stripped WLED cache fields from %s (saved %d bytes)",
             yaml_path.name,

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/migrations/v5_ina_screen.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import logging
 import re
 
+from boneio.core.atomic_file import write_atomically
 from boneio.core.config.migrations import register_migration
 
 _LOGGER = logging.getLogger(__name__)
@@ -42,8 +43,7 @@ def _persist_ina_screen(config_file: str) -> None:
             updated_lines.append(line)
 
     if updated:
-        with open(config_file, "w", encoding="utf-8") as f:
-            f.writelines(updated_lines)
+        write_atomically(config_file, "".join(updated_lines))
 
 
 @register_migration(

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/migrations/v6_input_keys.py

@@ -27,6 +27,7 @@ import logging
 import re
 from pathlib import Path
 
+from boneio.core.atomic_file import write_atomically
 from boneio.core.config.migrations import register_migration
 
 _LOGGER = logging.getLogger(__name__)
@@ -116,7 +117,7 @@ def strip_item_keys(config_file: str, sections: tuple[str, ...], keys: tuple[str
     flush()
 
     if main_removed:
-        main.write_text("".join(out), encoding="utf-8")
+        write_atomically(main, "".join(out))
         _LOGGER.info("Removed %d deprecated line(s) from %s", main_removed, main)
 
 
@@ -128,7 +129,7 @@ def _strip_file(path: Path, keys: tuple[str, ...]) -> None:
     lines = path.read_text(encoding="utf-8").splitlines(keepends=True)
     cleaned, removed = _strip_key_lines(lines, keys)
     if removed:
-        path.write_text("".join(cleaned), encoding="utf-8")
+        write_atomically(path, "".join(cleaned))
         _LOGGER.info("Removed %d deprecated line(s) from %s", removed, path)
 
 

boneio-1.6.0.dev15/boneio/core/config/write_lock.py

@@ -0,0 +1,16 @@
+"""One lock for every read-modify-write of the configuration files.
+
+Each save reads a whole file, edits it in memory and writes it back. Two of
+them running side by side — a section save from the panel in an executor
+thread and a password change in another — each write back the file as they
+read it, and the later one silently undoes the earlier.
+
+Reentrant, so a route can hold it across a read, a backup and a write while
+the functions it calls take it again.
+"""
+
+from __future__ import annotations
+
+import threading
+
+CONFIG_WRITE_LOCK = threading.RLock()

{boneio-1.6.0.dev14 → boneio-1.6.0.dev15}/boneio/core/config/yaml_patch.py

@@ -12,9 +12,15 @@ survives the trip back through the parser.
 
 from __future__ import annotations
 
+import functools
 import logging
 import re
+from collections.abc import Callable
 from pathlib import Path
+from typing import ParamSpec, TypeVar
+
+from boneio.core.atomic_file import write_atomically
+from boneio.core.config.write_lock import CONFIG_WRITE_LOCK
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -26,6 +32,21 @@ class YamlPatchError(Exception):
     """Raised when the file cannot be edited safely."""
 
 
+_P = ParamSpec("_P")
+_R = TypeVar("_R")
+
+
+def _locked(func: Callable[_P, _R]) -> Callable[_P, _R]:
+    """Run a read-modify-write under the lock every config save takes."""
+
+    @functools.wraps(func)
+    def wrapper(*args: _P.args, **kwargs: _P.kwargs) -> _R:
+        with CONFIG_WRITE_LOCK:
+            return func(*args, **kwargs)
+
+    return wrapper
+
+
 def quote_scalar(value: str) -> str:
     """Render a string so YAML reads it back unchanged.
 
@@ -94,6 +115,7 @@ def _line_key(line: str) -> tuple[str, int, str] | None:
     return key.strip(), len(line) - len(line.lstrip()), rest.strip()
 
 
+@_locked
 def set_block_list(
     config_file: str | Path, path: tuple[str, ...], field: str, items: list[str]
 ) -> None:
@@ -172,7 +194,7 @@ def set_block_list(
     else:
         lines[start : (end if end is not None else len(lines))] = [block]
 
-    file_path.write_text("".join(lines), encoding="utf-8")
+    write_atomically(file_path, "".join(lines))
     _LOGGER.info("Wrote %s.%s (%d entries)", ".".join(path), field, len(items))
 
 
@@ -199,6 +221,7 @@ def _section_body_start(lines: list[str], path: tuple[str, ...]) -> int:
     return len(lines)
 
 
+@_locked
 def ensure_section(config_file: str | Path, path: tuple[str, ...]) -> bool:
     """Make sure a nested mapping exists, creating the missing levels.
 
@@ -257,7 +280,7 @@ def ensure_section(config_file: str | Path, path: tuple[str, ...]) -> bool:
         f"{INDENT * (depth + offset)}{key}:\n" for offset, key in enumerate(missing)
     )
     lines.insert(insert_at, block)
-    file_path.write_text("".join(lines), encoding="utf-8")
+    write_atomically(file_path, "".join(lines))
     _LOGGER.info("Created section '%s' in %s", ".".join(path), file_path)
     return True
 
@@ -310,6 +333,7 @@ def has_section(config_file: str | Path, path: tuple[str, ...]) -> bool:
     return _find_section_line(lines, path) is not None
 
 
+@_locked
 def remove_section(config_file: str | Path, path: tuple[str, ...]) -> bool:
     """Delete a nested mapping key and everything under it.
 
@@ -379,7 +403,7 @@ def remove_section(config_file: str | Path, path: tuple[str, ...]) -> bool:
         break
 
     del lines[start:end]
-    file_path.write_text("".join(lines), encoding="utf-8")
+    write_atomically(file_path, "".join(lines))
     return True
 
 
@@ -479,6 +503,7 @@ def secret_reference(config_file: str | Path, path: tuple[str, ...]) -> str | No
     return match.group(1) if match else None
 
 
+@_locked
 def set_scalar(config_file: str | Path, path: tuple[str, ...], value: str) -> None:
     """Write a single value, creating the field if it is not there.
 
@@ -525,11 +550,12 @@ def set_scalar(config_file: str | Path, path: tuple[str, ...], value: str) -> No
             lines[-1] += "\n"
         lines.append(line)
 
-    file_path.write_text("".join(lines), encoding="utf-8")
+    write_atomically(file_path, "".join(lines))
     # The value is the point of this function and stays out of the log.
     _LOGGER.info("Wrote %s in %s", ".".join(path), file_path.name)
 
 
+@_locked
 def set_secret(secrets_file: str | Path, name: str, value: str) -> None:
     """Store a value in secrets.yaml, leaving every other secret alone.
 
@@ -559,5 +585,5 @@ def set_secret(secrets_file: str | Path, name: str, value: str) -> None:
             lines[-1] += "\n"
         lines.append(line)
 
-    file_path.write_text("".join(lines), encoding="utf-8")
+    write_atomically(file_path, "".join(lines))
     _LOGGER.info("Wrote the secret %s", name)