boneio 1.6.0.dev1__tar.gz → 1.6.0.dev2__tar.gz

boneio-1.6.0.dev2/MANIFEST.in

@@ -0,0 +1,11 @@
+include README.md
+include requirements.txt
+include LICENSE
+recursive-include boneio *.yaml
+recursive-include boneio *.json
+recursive-include boneio *.ttf
+recursive-include boneio/webui/frontend-dist *
+# Signing key and migration plan signatures — the helper refuses to run
+# without them, so a wheel built without these is useless on a device.
+recursive-include boneio *.pem
+recursive-include boneio *.sig

{boneio-1.6.0.dev1/boneio.egg-info → boneio-1.6.0.dev2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev1
+Version: 1.6.0.dev2
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0
@@ -33,7 +33,7 @@ Requires-Dist: qrcode==8.2
 Requires-Dist: gpiod==2.3.0
 Requires-Dist: requests==2.32.5
 Requires-Dist: packaging==25.0
-Requires-Dist: aioesphomeapi>=29.0.0
+Requires-Dist: aioesphomeapi>=45.0.0
 Requires-Dist: zeroconf>=0.148.0
 Requires-Dist: canopen-asyncio>=2.4.1
 Dynamic: license-file

{boneio-1.6.0.dev1 → boneio-1.6.0.dev2}/boneio/bonecli.py

@@ -37,6 +37,11 @@ def get_arguments() -> argparse.Namespace:
         description="boneIO app for BeagleBone Black.",
     )
     subparsers = parser.add_subparsers(dest=ACTION, required=True)
+
+    from boneio.core.auth.cli import add_accounts_parser
+
+    add_accounts_parser(subparsers)
+
     run_parser = subparsers.add_parser("run")
     run_parser.add_argument(
         "--debug",
@@ -258,9 +263,6 @@ def run(
         from boneio.const import ACTION
         _LOGGER.debug("[RUNNER IMPORT] boneio.const: %.2fs", _time.monotonic() - _t_a)
         _t_a = _time.monotonic()
-        from boneio.core.cloud import CloudRegistration
-        _LOGGER.debug("[RUNNER IMPORT] boneio.core.cloud: %.2fs", _time.monotonic() - _t_a)
-        _t_a = _time.monotonic()
         from boneio.core.manager import Manager
         _LOGGER.debug("[RUNNER IMPORT] boneio.core.manager: %.2fs", _time.monotonic() - _t_a)
         _t_a = _time.monotonic()
@@ -388,6 +390,10 @@ def main() -> int:
             mqttpassword=args.mqttpassword,
             debug=debug,
         )
+    elif args.action == "accounts":
+        from boneio.core.auth.cli import run_accounts_command
+
+        exit_code = run_accounts_command(args=args)
     elif args.action == "modbus":
         _LOGGER.info("BoneIO Modbus helper %s .", __version__)
         exit_code = run_modbus_command(

{boneio-1.6.0.dev1 → boneio-1.6.0.dev2}/boneio/components/cover/time_based.py

@@ -61,6 +61,20 @@ class TimeBasedCover(BaseCover):
         else:
             return
 
+        if duration == 0:
+            # A zero open_time/close_time makes movement impossible: the guard
+            # below returns before relay.turn_on(), so the relay is never
+            # energised and the motor never gets voltage — while the cover still
+            # reports IDLE and publishes state, so the UI looks like it worked.
+            # This is always a misconfiguration, never a normal outcome.
+            _LOGGER.error(
+                "Cover %s cannot move %s: %s_time is 0. The relay will NOT be "
+                "switched. Set a non-zero time in the cover configuration.",
+                self._id,
+                direction,
+                "open" if direction == OPEN else "close",
+            )
+
         if total_steps == 0 or duration == 0:
             self._current_operation = IDLE
             with suppress(RuntimeError):

{boneio-1.6.0.dev1 → boneio-1.6.0.dev2}/boneio/components/cover/venetian.py

@@ -93,6 +93,20 @@ class VenetianCover(BaseCover, BaseVenetianCoverABC):
             else:
                 total_steps = 1
 
+        if duration == 0:
+            # A zero open_time/close_time makes movement impossible: the guard
+            # below returns before relay.turn_on(), so the relay is never
+            # energised and the motor never gets voltage — while the cover still
+            # reports IDLE and publishes state, so the UI looks like it worked.
+            # This is always a misconfiguration, never a normal outcome.
+            _LOGGER.error(
+                "Cover %s cannot move %s: %s_time is 0. The relay will NOT be "
+                "switched. Set a non-zero time in the cover configuration.",
+                self._id,
+                direction,
+                "open" if direction == OPEN else "close",
+            )
+
         if total_steps == 0 or duration == 0:
             self._current_operation = IDLE
             self._loop.call_soon_threadsafe(self.send_state, self.state, self.json_position)

{boneio-1.6.0.dev1 → boneio-1.6.0.dev2}/boneio/components/irrigation/controller.py

@@ -1010,6 +1010,13 @@ class IrrigationController:
             await self.next_valve()
 
     async def handle_zone_command(self, zone_id: str, payload: str) -> None:
+        """Handle ON/OFF command for a specific zone.
+
+        ON starts the zone in single-zone mode (shutting down any running cycle first).
+        OFF only shuts down the controller if ``zone_id`` matches the currently
+        active zone — this prevents HA state-sync messages (OFF for inactive
+        zones) from killing a running cycle.
+        """
         upper = payload.strip().upper()
         _LOGGER.debug(
             "Irrigation %s handle_zone_command: zone='%s' payload='%s' → upper='%s'", self.id, zone_id, payload, upper
@@ -1017,7 +1024,28 @@ class IrrigationController:
         if upper == ON:
             await self.start_single_zone(zone_id)
         elif upper == OFF:
-            await self.shutdown()
+            # Only shutdown if this zone is the one currently running.
+            # HA sends OFF to all zone switches when one is activated,
+            # so we must NOT shutdown the controller for inactive zones.
+            if self._state == ControllerState.IDLE:
+                return
+            active_zone = (
+                self._zones[self._active_zone_idx]
+                if self._active_zone_idx is not None and self._active_zone_idx < len(self._zones)
+                else None
+            )
+            if active_zone is not None and active_zone.id == zone_id:
+                _LOGGER.info(
+                    "Irrigation %s: OFF received for active zone '%s' — shutting down",
+                    self.id, zone_id,
+                )
+                await self.shutdown()
+            else:
+                _LOGGER.debug(
+                    "Irrigation %s: ignoring OFF for zone '%s' (active zone is '%s')",
+                    self.id, zone_id,
+                    active_zone.id if active_zone else "none",
+                )
 
     async def handle_zone_duration_command(self, zone_id: str, payload: str) -> None:
         """Handle duration change from HA (value in minutes)."""

boneio-1.6.0.dev2/boneio/core/auth/__init__.py

@@ -0,0 +1,24 @@
+"""Account model, password hashing and persistence for boneIO web accounts."""
+
+from boneio.core.auth.hashing import hash_password, needs_rehash, verify_password
+from boneio.core.auth.models import Role, User
+from boneio.core.auth.store import (
+    USERS_FILENAME,
+    UserStore,
+    UserStoreError,
+    normalize_username,
+    validate_password,
+)
+
+__all__ = [
+    "USERS_FILENAME",
+    "Role",
+    "User",
+    "UserStore",
+    "UserStoreError",
+    "hash_password",
+    "needs_rehash",
+    "normalize_username",
+    "validate_password",
+    "verify_password",
+]

boneio-1.6.0.dev2/boneio/core/auth/cli.py

@@ -0,0 +1,242 @@
+"""``boneio accounts`` — manage web UI accounts from the shell.
+
+This is the recovery path. A device whose administrator password is lost has no
+other way back in: there is no email to send a link to, and wiping
+``users.json`` by hand would take every other account with it.
+
+It is also how a controller gets an account without a browser, which makes
+provisioning scriptable and means a freshly flashed device does not have to be
+clicked through the wizard.
+
+Passwords are never taken from the command line. An argument is visible in
+``ps`` to every user on the box and lands in shell history, so they are always
+prompted for, with echo off.
+
+Changes take effect immediately: the running web server notices that
+``users.json`` changed and re-reads it, so recovering a password does not mean
+restarting a controller in the middle of whatever it is automating.
+"""
+
+from __future__ import annotations
+
+import argparse
+import getpass
+import logging
+import os
+import sys
+from pathlib import Path
+
+from boneio.core.auth.models import Role
+from boneio.core.auth.store import UserStore, UserStoreError, validate_password
+
+_LOGGER = logging.getLogger(__name__)
+
+
+def _prompt_password(prompt: str, username: str | None = None) -> str | None:
+    """Ask for a password twice, with echo off.
+
+    Args:
+        prompt: Text for the first prompt.
+        username: Account the password is for, so the same policy the store
+            applies is reported here rather than after the second prompt.
+
+    Returns:
+        The password, or None if the two entries differed, it was empty, or the
+        policy rejected it.
+    """
+    first = getpass.getpass(f"{prompt}: ")
+    if not first:
+        print("Aborted: empty password.", file=sys.stderr)
+        return None
+
+    try:
+        validate_password(first, username)
+    except UserStoreError as err:
+        print(f"Rejected: {err}", file=sys.stderr)
+        return None
+
+    second = getpass.getpass("Repeat password: ")
+    if first != second:
+        print("Aborted: the passwords do not match.", file=sys.stderr)
+        return None
+
+    return first
+
+
+def _warn_on_ownership(store: UserStore, config_path: Path) -> None:
+    """Warn when the file was written as the wrong user.
+
+    Running this under ``sudo`` leaves ``users.json`` owned by root, and the
+    service — which runs as the ``boneio`` user — then cannot rewrite it. The
+    failure would only show up later, when someone changes a password from the
+    web UI and it silently fails, so it is called out here instead.
+
+    Args:
+        store: The account store just written.
+        config_path: Path to config.yaml, used as the reference owner.
+    """
+    try:
+        written_uid = store.path.stat().st_uid
+        expected_uid = config_path.stat().st_uid
+    except OSError:
+        return
+
+    if written_uid != expected_uid:
+        print(
+            f"WARNING: {store.path} is now owned by uid {written_uid}, but "
+            f"{config_path} belongs to uid {expected_uid}. The boneIO service "
+            f"probably cannot write it. Fix with:\n"
+            f"  sudo chown {expected_uid} {store.path}",
+            file=sys.stderr,
+        )
+
+
+def run_accounts_command(args: argparse.Namespace) -> int:
+    """Execute an ``accounts`` subcommand.
+
+    Args:
+        args: Parsed arguments, carrying ``accounts_action``, ``config`` and,
+            depending on the subcommand, ``username`` and ``role``.
+
+    Returns:
+        Process exit code.
+    """
+    config_path = Path(args.config).expanduser()
+    if not config_path.exists():
+        print(f"No config file at {config_path}", file=sys.stderr)
+        return 1
+
+    store = UserStore.for_config_file(config_path)
+    try:
+        store.load()
+    except UserStoreError as err:
+        print(f"Cannot read the account store: {err}", file=sys.stderr)
+        return 1
+
+    action = args.accounts_action
+
+    if action == "list":
+        users = store.list_users()
+        if not users:
+            print(f"No accounts yet ({store.path} does not exist).")
+            print("Create one with:  boneio accounts add <username> --role admin")
+            return 0
+        width = max(len(user.username) for user in users)
+        for user in users:
+            print(f"{user.username:<{width}}  {user.role}  created {user.created_at}")
+        return 0
+
+    if action == "add":
+        password = _prompt_password(
+            f"New password for '{args.username}'", args.username
+        )
+        if password is None:
+            return 1
+        try:
+            user = store.add_user(args.username, password, Role(args.role))
+        except UserStoreError as err:
+            print(f"Could not create the account: {err}", file=sys.stderr)
+            return 1
+        _warn_on_ownership(store, config_path)
+        print(f"Created {user.role} account '{user.username}'.")
+        return 0
+
+    if action == "reset":
+        if store.get_user(args.username) is None:
+            print(f"No such account: {args.username}", file=sys.stderr)
+            return 1
+        password = _prompt_password(
+            f"New password for '{args.username}'", args.username
+        )
+        if password is None:
+            return 1
+        try:
+            store.set_password(args.username, password)
+        except UserStoreError as err:
+            print(f"Could not change the password: {err}", file=sys.stderr)
+            return 1
+        _warn_on_ownership(store, config_path)
+        print(f"Password changed for '{args.username}'. It takes effect immediately.")
+        return 0
+
+    if action == "delete":
+        try:
+            store.delete_user(args.username)
+        except UserStoreError as err:
+            print(f"Could not delete the account: {err}", file=sys.stderr)
+            return 1
+        print(f"Deleted account '{args.username}'.")
+        return 0
+
+    print(f"Unknown accounts action: {action}", file=sys.stderr)
+    return 1
+
+
+def add_accounts_parser(subparsers: argparse._SubParsersAction) -> None:
+    """Register the ``accounts`` subcommand.
+
+    Args:
+        subparsers: The top-level subparser collection from bonecli.
+    """
+    accounts_parser = subparsers.add_parser(
+        "accounts",
+        help="Manage web UI accounts (create, reset a password, list, delete)",
+        description=(
+            "Manage the accounts in users.json. This is the recovery path when "
+            "an administrator password is lost, and the way to provision a "
+            "device without a browser. Passwords are always prompted for, "
+            "never passed as arguments."
+        ),
+    )
+    # bonecli's main() reads args.debug before dispatching, so every subcommand
+    # has to carry one.
+    accounts_parser.set_defaults(debug=0)
+    accounts_parser.add_argument(
+        "-c",
+        "--config",
+        metavar="path_to_config",
+        default=os.environ.get("BONEIO_CONFIG", "./config.yaml"),
+        help="boneIO config file; users.json lives next to it",
+    )
+
+    actions = accounts_parser.add_subparsers(dest="accounts_action", required=True)
+
+    def _with_config(parser: argparse.ArgumentParser) -> argparse.ArgumentParser:
+        """Accept -c after the subcommand as well as before it.
+
+        argparse only looks for an option on the parser that is parsing at the
+        time, so `accounts add pawel -c cfg.yaml` — the order everyone reaches
+        for — is rejected unless each action accepts it too. SUPPRESS keeps the
+        action's default from overwriting a value already given to `accounts`.
+
+        Args:
+            parser: Action subparser to extend.
+
+        Returns:
+            The same parser, for chaining.
+        """
+        parser.add_argument(
+            "-c",
+            "--config",
+            metavar="path_to_config",
+            default=argparse.SUPPRESS,
+            help="boneIO config file; users.json lives next to it",
+        )
+        return parser
+
+    _with_config(actions.add_parser("list", help="List accounts and their roles"))
+
+    add_action = _with_config(actions.add_parser("add", help="Create an account"))
+    add_action.add_argument("username", help="Username to create")
+    add_action.add_argument(
+        "--role",
+        choices=[str(Role.ADMIN), str(Role.VIEWER)],
+        default=str(Role.VIEWER),
+        help="Role to grant (default: viewer)",
+    )
+
+    reset_action = _with_config(actions.add_parser("reset", help="Set a new password"))
+    reset_action.add_argument("username", help="Account to change")
+
+    delete_action = _with_config(actions.add_parser("delete", help="Remove an account"))
+    delete_action.add_argument("username", help="Account to remove")

boneio-1.6.0.dev2/boneio/core/auth/hashing.py

@@ -0,0 +1,182 @@
+"""Password hashing for boneIO web accounts.
+
+Uses scrypt from the standard library, so no new dependency is pulled onto the
+BeagleBone. Parameters live inside the encoded string, which means the cost can
+be raised in a later release without invalidating existing accounts: verify
+still reads the old parameters, and :func:`needs_rehash` tells the caller the
+stored hash is below the current policy so it can be upgraded on next login.
+
+The encoding is PHC-inspired and self-describing::
+
+    $scrypt$n=16384,r=8,p=1$<salt-b64>$<hash-b64>
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import secrets
+
+# Cost parameters. n=2**14 with r=8 needs 128 * n * r = 16 MiB of memory per
+# hash. Measured at ~0.9 s per hash on a BeagleBone Black (armv7l) — slow enough
+# to hurt an offline cracker, and only paid at login: a successful login issues
+# a JWT good for weeks (see TOKEN_TTL_DAYS), so the cost is not on the hot path.
+_SCRYPT_N = 2**14
+_SCRYPT_R = 8
+_SCRYPT_P = 1
+_SALT_BYTES = 16
+_KEY_BYTES = 32
+
+_PREFIX = "$scrypt$"
+
+
+def _b64(raw: bytes) -> str:
+    """Encode without padding, so the '=' never collides with the k=v syntax."""
+    return base64.b64encode(raw).decode("ascii").rstrip("=")
+
+
+def _unb64(text: str) -> bytes:
+    """Decode a padding-stripped base64 string."""
+    return base64.b64decode(text + "=" * (-len(text) % 4))
+
+
+def hash_password(password: str) -> str:
+    """Hash a password with a fresh random salt.
+
+    Args:
+        password: Plain-text password.
+
+    Returns:
+        Self-describing encoded hash, safe to store as-is.
+
+    Raises:
+        ValueError: If the password is empty.
+    """
+    if not password:
+        raise ValueError("Password must not be empty")
+
+    salt = secrets.token_bytes(_SALT_BYTES)
+    derived = hashlib.scrypt(
+        password.encode("utf-8"),
+        salt=salt,
+        n=_SCRYPT_N,
+        r=_SCRYPT_R,
+        p=_SCRYPT_P,
+        dklen=_KEY_BYTES,
+        maxmem=_maxmem(_SCRYPT_N, _SCRYPT_R, _SCRYPT_P),
+    )
+    params = f"n={_SCRYPT_N},r={_SCRYPT_R},p={_SCRYPT_P}"
+    return f"{_PREFIX}{params}${_b64(salt)}${_b64(derived)}"
+
+
+def _maxmem(n: int, r: int, p: int) -> int:
+    """Memory ceiling for :func:`hashlib.scrypt`.
+
+    OpenSSL defaults to a 32 MiB ceiling and refuses anything above it, so the
+    limit is computed from the parameters instead of hardcoded — otherwise
+    raising the cost in a later release would fail at runtime rather than in a
+    test. The formula is scrypt's own footprint plus headroom for the internal
+    buffers.
+
+    Args:
+        n: CPU/memory cost.
+        r: Block size.
+        p: Parallelisation.
+
+    Returns:
+        Byte ceiling to hand to :func:`hashlib.scrypt`.
+    """
+    return 128 * n * r + 128 * r * p + (1 << 20)
+
+
+def _parse(encoded: str) -> tuple[dict[str, int], bytes, bytes]:
+    """Split an encoded hash into its parameters, salt and digest.
+
+    Args:
+        encoded: String produced by :func:`hash_password`.
+
+    Returns:
+        Tuple of (parameters, salt, digest).
+
+    Raises:
+        ValueError: If the string is not a well-formed scrypt hash.
+    """
+    if not encoded.startswith(_PREFIX):
+        raise ValueError("Unsupported password hash format")
+
+    try:
+        _, algo, params_text, salt_text, hash_text = encoded.split("$")
+    except ValueError as err:
+        raise ValueError("Malformed password hash") from err
+
+    if algo != "scrypt":
+        raise ValueError(f"Unsupported password hash algorithm: {algo}")
+
+    params: dict[str, int] = {}
+    for item in params_text.split(","):
+        key, _, value = item.partition("=")
+        try:
+            params[key] = int(value)
+        except ValueError as err:
+            raise ValueError(f"Malformed hash parameter: {item}") from err
+
+    if not {"n", "r", "p"} <= params.keys():
+        raise ValueError("Password hash is missing scrypt parameters")
+
+    return params, _unb64(salt_text), _unb64(hash_text)
+
+
+def verify_password(password: str, encoded: str) -> bool:
+    """Check a password against a stored hash in constant time.
+
+    A malformed or unreadable stored hash is treated as a failed verification
+    rather than an error: a corrupted ``users.json`` entry must lock that
+    account out, not crash the login route for everyone.
+
+    Args:
+        password: Plain-text password supplied by the client.
+        encoded: Stored hash to check against.
+
+    Returns:
+        True if the password matches.
+    """
+    if not password or not encoded:
+        return False
+
+    try:
+        params, salt, expected = _parse(encoded)
+        derived = hashlib.scrypt(
+            password.encode("utf-8"),
+            salt=salt,
+            n=params["n"],
+            r=params["r"],
+            p=params["p"],
+            dklen=len(expected),
+            maxmem=_maxmem(params["n"], params["r"], params["p"]),
+        )
+    except (ValueError, KeyError, TypeError):
+        return False
+
+    return hmac.compare_digest(derived, expected)
+
+
+def needs_rehash(encoded: str) -> bool:
+    """Report whether a stored hash is weaker than the current policy.
+
+    Args:
+        encoded: Stored hash.
+
+    Returns:
+        True if the hash should be replaced next time the password is known.
+    """
+    try:
+        params, _, _ = _parse(encoded)
+    except ValueError:
+        return True
+
+    return (
+        params["n"] < _SCRYPT_N
+        or params["r"] < _SCRYPT_R
+        or params["p"] < _SCRYPT_P
+    )