boneio 1.6.0.dev6__tar.gz → 1.6.0.dev7__tar.gz

{boneio-1.6.0.dev6/boneio.egg-info → boneio-1.6.0.dev7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boneio
-Version: 1.6.0.dev6
+Version: 1.6.0.dev7
 Summary: Python App for BoneIO
 Author-email: Paweł Szafer <pszafer@gmail.com>
 License: GNU General Public License v3.0

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/const.py

@@ -97,6 +97,14 @@ HOST = "host"
 USERNAME = "username"
 PASSWORD = "password"
 PORT = "port"
+
+#: The port the device's built-in reverse proxy publishes HTTPS on.
+#:
+#: Set in docker-compose.yaml as HTTPS_PORT and defaulted there too; this is
+#: the same number, for the parts of the application that need to name the
+#: proxy without reading the compose file. It lives here rather than beside the
+#: web server so that core can use it without importing the web layer.
+DEFAULT_PROXY_PORT = 8443
 ONLINE = "online"
 OFFLINE = "offline"
 TOPIC = "topic"

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/core/cloud/registration.py

@@ -27,6 +27,7 @@ from boneio.core.cloud.secrets import MASTER_SECRET as DEFAULT_MASTER_SECRET
 from boneio.core.system.monitor import get_network_info
 
 from boneio.core import containers
+from boneio.core.system.monitor import get_network_info
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -688,8 +689,6 @@ async def set_enabled(config_helper, enabled: bool, local_ip: str | None = None)
     serial = getattr(config_helper, "serial_number", None)
     if not local_ip:
         try:
-            from boneio.core.system.monitor import get_network_info
-
             local_ip = (get_network_info() or {}).get("ip", "")
         except Exception as err:  # noqa: BLE001
             _LOGGER.warning("Could not read this device's address: %s", err)

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/core/config/config_helper.py

@@ -15,6 +15,8 @@ from boneio.const import (
     ALARM_CONTROL_PANEL,
     BINARY_SENSOR,
     BONEIO,
+    DEFAULT_PROXY_PORT,
+    IP,
     BUTTON,
     CLIMATE,
     COVER,
@@ -45,6 +47,7 @@ class ConfigHelper:
         is_web_active: bool = False,
         web_port: int = 8090,
         proxy_port: int | None = None,
+        expose: str = "all",
         config_file_path: str | None = None,
         send_boneio_autodiscovery: bool = True,
         receive_boneio_autodiscovery: bool = True,
@@ -98,6 +101,7 @@ class ConfigHelper:
         self._device_type = device_type
         self._web_port = web_port
         self._proxy_port = proxy_port
+        self._expose = expose
         self._fetch_old_discovery = None
 
         self._autodiscovery_messages = {
@@ -183,12 +187,54 @@ class ConfigHelper:
 
     @property
     def http_proto(self) -> str:
-        return "https" if self._proxy_port else "http"
+        """The scheme anything linking to this panel should use."""
+        return "https" if self._behind_proxy else "http"
+
+    @property
+    def _behind_proxy(self) -> bool:
+        """Whether the panel is reached through the reverse proxy.
+
+        Either because somebody named its port, or because the panel's own
+        port has been taken off the network and the proxy is the only way in.
+        """
+        return bool(self._proxy_port) or self._expose == "proxy"
+
+    @property
+    def configuration_url(self) -> str | None:
+        """The address anything linking to this panel should use.
+
+        Home Assistant puts this on the device page, and the panel shows it so
+        an operator can see what was published without opening Home Assistant.
+        Both read it here rather than each deciding for itself: the wording in
+        the panel drifted away from what discovery actually sends within a day
+        of being written, because it described the rule instead of asking.
+
+        Returns:
+            The URL, or None when there is no address to build one from.
+        """
+        if self._cloud_registration and self.serial_number:
+            # Registered with the cloud: a real certificate on a public name,
+            # pointing at the local address. Nothing else can beat that.
+            return f"https://{self.serial_number}.black.boneio.app:{DEFAULT_PROXY_PORT}"
+        address = (self._network_info or {}).get(IP)
+        if not (self._is_web_active and address):
+            return None
+        return f"{self.http_proto}://{address}:{self.web_configuration_port}"
 
     @property
     def web_configuration_port(self) -> int:
-        """Get port for HA discovery URL. Uses proxy_port if set, otherwise web_port."""
-        return self._proxy_port if self._proxy_port else self._web_port
+        """The port to put in a link to this panel.
+
+        The configured proxy port when there is one. Otherwise the panel's own
+        port — unless that port has been taken off the network, in which case
+        it answers nothing and linking to it would hand Home Assistant a dead
+        address. Then it is the port the built-in proxy serves on.
+        """
+        if self._proxy_port:
+            return self._proxy_port
+        if self._expose == "proxy":
+            return DEFAULT_PROXY_PORT
+        return self._web_port
 
     @property
     def topic_prefix(self) -> str:

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/core/security/posture.py

@@ -64,6 +64,14 @@ class Check:
     state: State
     detail: str
     remedy: str = ""
+    #: A fact about this device that belongs with the finding and must not be
+    #: translated away: the error a service reported, a name, a path.
+    #:
+    #: The panel replaces title, detail and remedy with its own wording, keyed
+    #: by check id — so anything the backend varies at runtime is lost the
+    #: moment somebody writes a translation for it. This is shown verbatim
+    #: underneath instead.
+    context: str = ""
     #: Where in the panel this is fixed, when it can be fixed there. A bare
     #: name is a Settings section; ``system:<anchor>`` is the System page.
     #: None means there is no control — the remedy is a file or a shell.
@@ -82,6 +90,7 @@ class Check:
             "state": str(self.state),
             "detail": self.detail,
             "remedy": self.remedy,
+            "context": self.context,
             "settings_section": self.settings_section,
         }
 
@@ -213,6 +222,9 @@ def evaluate(
     anonymous_allowed: bool,
     auth_required: bool,
     cloud_active: bool,
+    proxy_serving: bool | None = None,
+    custom_certificate: bool = False,
+    cloud_error: str | None = None,
 ) -> Posture:
     """Work out what is still unlocked.
 
@@ -222,6 +234,10 @@ def evaluate(
         anonymous_allowed: Whether the anonymous opt-out is set.
         auth_required: Whether requests currently need a token.
         cloud_active: Whether cloud registration is serving a real certificate.
+        proxy_serving: Whether the reverse proxy is answering for this
+            panel right now. None when nobody looked.
+        custom_certificate: Whether an uploaded certificate is installed.
+        cloud_error: What cloud registration last failed with, if anything.
 
     Returns:
         The full set of checks.
@@ -269,20 +285,35 @@ def evaluate(
         Check(
             id="web_exposed_in_clear",
             title="Panel served in the clear",
-            severity=Severity.WARNING,
+            # Three states, not two. Telling somebody to move the panel behind
+            # a proxy that is not serving it is advice we would then refuse to
+            # carry out, and they would find that out by clicking. Where the
+            # proxy is not answering this drops to advice and points at the
+            # proxy instead of at the panel.
+            severity=Severity.WARNING if proxy_serving is not False else Severity.INFO,
             state=State.OK if behind_proxy else State.FAILED,
             detail=(
-                "The panel answers on its own port on every network interface, "
-                "without TLS. Anyone who can see the traffic sees the login "
-                "form, the token it hands back, and a configuration that "
-                "carries passwords."
-                if not behind_proxy
-                else "The panel is reachable only through the encrypted proxy."
+                "The panel is reachable only through the encrypted proxy."
+                if behind_proxy
+                else (
+                    "The panel answers on its own port on every network "
+                    "interface, without TLS. Anyone who can see the traffic "
+                    "sees the login form, the token it hands back, and a "
+                    "configuration that carries passwords."
+                    if proxy_serving is not False
+                    else "The panel answers on its own port on every network "
+                    "interface, without TLS — and the proxy that would replace "
+                    "it is not serving this panel, so closing that port now "
+                    "would leave the device reachable on nothing."
+                )
             ),
             remedy=(
-                "Move it behind the proxy from the Security section. The panel "
-                "then answers on https and through an SSH tunnel, and not on "
-                "the local network in the clear."
+                "Move it behind the proxy. It then answers over HTTPS and "
+                "through an SSH tunnel, and not on the local network in the "
+                "clear."
+                if proxy_serving is not False
+                else "Get the proxy serving this panel first — check that "
+                "HTTPS answers on its port — and this becomes one click."
             ),
             settings_section="security",
         )
@@ -312,6 +343,7 @@ def evaluate(
     )
 
     web = config.get("web") if isinstance(config.get("web"), dict) else {}
+    cloud_enabled = bool((web.get("cloud") or {}).get("enabled"))
     has_legacy = _legacy_web_auth(config)
     checks.append(
         Check(
@@ -342,15 +374,42 @@ def evaluate(
             id="certificate",
             title="HTTPS certificate",
             severity=Severity.INFO,
-            state=State.OK if cloud_active else State.FAILED,
+            # Four states. This used to have two, and told an operator to
+            # enable cloud registration on a device where it was already on and
+            # failing with an error the application had in hand — while a
+            # second route to a trusted certificate, uploading one, had been
+            # added and this check knew nothing about it.
+            state=State.OK if (custom_certificate or cloud_active) else State.FAILED,
             detail=(
-                "Served with a certificate browsers trust."
+                "Served with the certificate you uploaded."
+                if custom_certificate
+                else "Served with a certificate browsers trust."
                 if cloud_active
-                else "Served with a self-signed certificate, so browsers warn "
-                "on every visit and people learn to click through the warning."
+                else (
+                    "Cloud registration is switched on but is not serving a "
+                    "certificate, so the panel is still served with a "
+                    "self-signed one."
+                    if cloud_enabled and cloud_error
+                    else "Cloud registration is switched on but has not "
+                    "produced a certificate yet, so the panel is still served "
+                    "with a self-signed one."
+                    if cloud_enabled
+                    else "Served with a self-signed certificate, so browsers "
+                    "warn on every visit and people learn to click through the "
+                    "warning."
+                )
             ),
-            remedy="Enable boneIO Cloud registration to get a trusted certificate.",
-            settings_section="web",
+            remedy=(
+                ""
+                if custom_certificate or cloud_active
+                else "Sort out the registration error, or upload a certificate "
+                "of your own below."
+                if cloud_enabled
+                else "Enable boneIO Cloud registration, or upload a certificate "
+                "of your own below."
+            ),
+            context=cloud_error or "",
+            settings_section="security",
         )
     )
 

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/integration/homeassistant.py

@@ -82,11 +82,9 @@ def ha_availabilty_message(
     topic = config_helper.topic_prefix if topic is None else topic
     device_name = config_helper.name if device_name is None else device_name
     model = f"boneIO Black {config_helper.device_type.title().replace('X', 'x')}"
-    if config_helper.cloud_registration and config_helper.serial_number:
-        # PWA-registered device: use the public PWA domain with TLS
-        web_url = f"https://{config_helper.serial_number}.black.boneio.app:8443"
-    elif config_helper.is_web_active and config_helper.network_info and IP in config_helper.network_info:
-        web_url = f"{config_helper.http_proto}://{config_helper.network_info[IP]}:{config_helper.web_configuration_port}"
+    # Decided in one place, which the panel reads too. Built here, the panel's
+    # description of it drifted out of date within a day.
+    web_url = config_helper.configuration_url or web_url
     
     web_url_dict = {
         "configuration_url": web_url

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/migrations/plans/manifest.json

@@ -1 +1 @@
-{"plans":{"1.3.0":"3199d74a6dda33162bbee4fc650a5a0d70d5372258f3305ad92501215e22a7fd","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"27ebf198e03c882c21572a9be02f63e8ffe6a610f6f395d7116ad9e258b4dac7","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"035a0d32c891746e315fd228f8107680c856d9d128e3b4a19f6629256b3ef9b1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"358dacbc8d16b1b665167de3bc1c42d101d82733502048f345184d1841ce03f2","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"7175f827b99c602df80436db588c87277ce50f2734051a444163b048f5d0b23e","1.6.9":"732d5a9bcd2e496a260263a643c78a6346e9f3cef5b48fe59ac6b120bd03ba4e"},"release":"1.6.0.dev6"}
+{"plans":{"1.3.0":"3199d74a6dda33162bbee4fc650a5a0d70d5372258f3305ad92501215e22a7fd","1.3.1":"580381a4f6f40fc1bd4e903e591ad0d5c1db27daaccafc6f79dabf8c3b84259a","1.3.2":"7a69ffaf0c41438be25a656dcdc87783daac0eae79218d023648ef9d708e373f","1.4.0":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.4.3":"a8cfbabff09d21944a822c4a70f23a7ee14960c4054de151c9fbc7cdb29adff5","1.4.4":"27ebf198e03c882c21572a9be02f63e8ffe6a610f6f395d7116ad9e258b4dac7","1.5.0":"52d9d118da099abda0e0153cd16892e201681f6e4d3c6e5790284d1ac469a407","1.5.1":"d283cb8c01024338fb614ae2199744d883379f59579423e4eb9234f5c59ebdd8","1.5.10":"889e2f12614e6e67d342571c1c3bab8940659bfbbf43fa30a6847e73decb85d1","1.5.11":"4906e4de2b3a9c2f0b0181817c9dc168cb910ba6941691d4e86b8387802b624a","1.5.12":"c0a0dc085bb33d9718e869ed5effc2c1581deffd7ed0d5adc119b94312181625","1.5.13":"bfe58c8756f9b5f5e55d5acbb6f7cfc469d201004d312c14e022eb7c52369b7d","1.5.14":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.15":"0687a735cb4aaf8f8f74ad6e228ca1b14e045cba8821991c7d19fc9beaeac766","1.5.16":"3544ac754f39d56ecf2b06300b7cca1b6f8723f99885cd11bd690f1a704d3728","1.5.17":"cf1e9e0ff6812cb7092a82dd588392d625decbe3680fe003dfc554f9045809d3","1.5.18":"1fd873effa66b632217d674745722f712a48b36bb79957fefae722757a74bc30","1.5.2":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.3":"39fccb7582e13e7e3436861fde7b83ddb8057788cbde792f2f0cf7003f068850","1.5.4":"e86174ba5aff6f257f8a3f4721c7942885cd203469a9d8ddc15dbe6c704e0f45","1.5.5":"f93ed2d4342e447eb9900a0150331113918f2a8b3baeeb795c07231d80f0337c","1.5.6":"e3d90e6ceb20d760f1e9fa63224c5a070a16b3ca6e7dc4cc2c594138e929cce8","1.5.7":"a0464f11e05128cba8881e6295e591fce1ed1e8d43ab0e16710effb8e543d810","1.5.8":"f075b84fb04f4043658a28402d963494dd58481f164c0b371cec94322fe6d131","1.5.9":"ac170fc924019fc2acd69a90a82ba5c2552dce7a2c01a05e5407443e7a9e5af7","1.6.0":"c8286514d1a4f1805e727e13d3c350bb390378c6f31ad6920030412d61ec9b3f","1.6.1":"aa1d3934091853fc21208993930c1bf92e17136428d1d0baaefabfa65d13e7fa","1.6.10":"41c3a16e7819857a4b826e944fcfb4f79c58e7192cb151b106a3acd7487d5771","1.6.11":"d136203e08e3b052254403815d4ccedb555b0a297686fe97952d275eb1f322eb","1.6.12":"c328d4e36bd6277e01cef0140993e23970f4dff84425f3eba236cdd9a8954355","1.6.13":"035a0d32c891746e315fd228f8107680c856d9d128e3b4a19f6629256b3ef9b1","1.6.2":"6ef96b5e00a04a929d16f0e4a136bfcc5b8132a466d6907a99b2c8516a8952d5","1.6.3":"5c10db827bcb92b9322d4aa5751076b825da87c6d18d6953847ba72317cca862","1.6.4":"baf2bb1c2ec7c1bfccfc514ef1cef67907e056e4f7153bb5932ecb835c9cff78","1.6.5":"358dacbc8d16b1b665167de3bc1c42d101d82733502048f345184d1841ce03f2","1.6.6":"535bb041b99d5ac1bc9028ea88bc2fbf3dbadc80ea8dea236cc219123c194114","1.6.7":"d59af413e270e6f34b1b9a1c8c4acef35328f00e26fad447cfe214545af78d8f","1.6.8":"7175f827b99c602df80436db588c87277ce50f2734051a444163b048f5d0b23e","1.6.9":"732d5a9bcd2e496a260263a643c78a6346e9f3cef5b48fe59ac6b120bd03ba4e"},"release":"1.6.0.dev7"}

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/runner.py

@@ -212,6 +212,7 @@ async def async_run(
         is_web_active=web_active,
         web_port=web_config.get("port", 8090),
         proxy_port=web_config.get("proxy_port"),
+        expose=web_config.get("expose", "all"),
         ha_discovery=mqtt_config.get(HA_DISCOVERY, {}).get(ENABLED, False),
         ha_discovery_prefix=mqtt_config.get(HA_DISCOVERY, {}).get(TOPIC_PREFIX, "homeassistant"),
         config_file_path=config_file,

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/schema/schema.yaml

@@ -203,12 +203,18 @@ web:
       default: 8090
       meta:
         label: Port to run web server
+    # Not offered in the panel any more. It only ever chose the port in the
+    # link Home Assistant shows, the built-in proxy answers on 8443 either
+    # way, and a device reachable only through that proxy derives the port by
+    # itself. Kept here because the validator purges unknown keys: removing it
+    # would delete the setting from the config.yaml of the few people who have
+    # one, and change where their Home Assistant link points, silently.
     proxy_port:
       required: False
       type: integer
       nullable: True
       meta:
-        label: Reverse proxy port (used in HA discovery URL). If not set, uses 'port' value.
+        label: Reverse proxy port for the Home Assistant link. Advanced; set it only when your own proxy fronts this panel on another port.
     expose:
       required: False
       type: string

boneio-1.6.0.dev7/boneio/version.py

@@ -0,0 +1,2 @@
+# flake8: noqa
+__version__ = "1.6.0.dev7"

{boneio-1.6.0.dev6 → boneio-1.6.0.dev7}/boneio/webui/bind.py

@@ -18,7 +18,16 @@ belongs to Docker and an operator can change it in daemon.json.
 
 from __future__ import annotations
 
+import json
 import logging
+import ssl
+import time
+import urllib.error
+import urllib.request
+
+import psutil
+
+from boneio.const import DEFAULT_PROXY_PORT
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -50,8 +59,6 @@ def docker_bridge_addresses() -> list[str]:
     """
     addresses: list[str] = []
     try:
-        import psutil
-
         for name, addrs in psutil.net_if_addrs().items():
             if not name.startswith(_BRIDGE_PREFIXES):
                 continue
@@ -87,8 +94,6 @@ def _wait_for_a_bridge(timeout: float) -> list[str]:
     Returns:
         The addresses found, possibly empty.
     """
-    import time
-
     deadline = time.monotonic() + timeout
     waited = False
     while True:
@@ -140,10 +145,6 @@ def binds_for(exposure: str, port: int, wait: float = BRIDGE_WAIT_SECONDS) -> li
     return [f"{host}:{port}" for host in hosts]
 
 
-#: Where Caddy publishes HTTPS when nothing says otherwise.
-DEFAULT_PROXY_PORT = 8443
-
-
 def proxy_is_serving(port: int = DEFAULT_PROXY_PORT, timeout: float = 5.0) -> tuple[bool, str]:
     """Whether the reverse proxy is answering for this device right now.
 
@@ -163,11 +164,6 @@ def proxy_is_serving(port: int = DEFAULT_PROXY_PORT, timeout: float = 5.0) -> tu
     Returns:
         Whether it is serving, and a short reason when it is not.
     """
-    import json
-    import ssl
-    import urllib.error
-    import urllib.request
-
     # The certificate is the device's own, usually from Caddy's internal CA,
     # and this request never leaves the machine. What is being tested is
     # whether the proxy reaches the application, not who signed the key.
@@ -191,3 +187,44 @@ def proxy_is_serving(port: int = DEFAULT_PROXY_PORT, timeout: float = 5.0) -> tu
     if "version" not in body:
         return False, f"port {port} is serving something else"
     return True, ""
+
+
+#: The last probe, as ``(port, asked_at, answer)``.
+_last_probe: tuple[int, float, bool] | None = None
+
+#: How long an answer stands. Long enough that the security page's probe is
+#: still good when somebody reads it and presses the button; short enough that
+#: a proxy just repaired shows as repaired.
+PROBE_TTL = 30.0
+
+
+def proxy_is_serving_cached(port: int = DEFAULT_PROXY_PORT, max_age: float = PROBE_TTL) -> tuple[bool, str]:
+    """:func:`proxy_is_serving`, reusing a recent answer.
+
+    The first probe of a device's life is slow in a way the timeout alone
+    cannot fix: Caddy issues its internal certificates on demand, and a
+    connection to 127.0.0.1 carries no SNI, so the first one makes it mint a
+    certificate for that address before answering. On a BeagleBone that takes
+    seconds — long enough that the browser gave up on the save that was waiting
+    for it, while the save itself went through.
+
+    Sharing one answer between the page that displays the posture and the save
+    that acts on it means the slow probe happens while somebody is reading,
+    not while they are waiting for a button.
+
+    Args:
+        port: The port the proxy publishes HTTPS on.
+        max_age: How old an answer may be and still be used.
+
+    Returns:
+        Whether it is serving, and a short reason when it is not.
+    """
+    global _last_probe
+
+    now = time.monotonic()
+    if _last_probe and _last_probe[0] == port and now - _last_probe[1] < max_age:
+        return (_last_probe[2], "" if _last_probe[2] else "the proxy was not serving a moment ago")
+
+    serving, reason = proxy_is_serving(port)
+    _last_probe = (port, now, serving)
+    return serving, reason

boneio-1.6.0.dev6/boneio/webui/frontend-dist/assets/AccountsView-CtAKf-Jh.js → boneio-1.6.0.dev7/boneio/webui/frontend-dist/assets/AccountsView-BUm_P1Uw.js

@@ -1 +1 @@
-import{r as e}from"./chunk-QTnfLwEv.js";import{Qt as t,Zt as n,an as r,in as i}from"./fa-BEzM11bH.js";import{n as a}from"./axios-uEi8e3Ln.js";import{F as o,I as s,L as c,P as l,c as u,d,h as f,u as p,x as m}from"./index-B6IpVqZQ.js";var h=e(r(),1),g=i();function _(e,t){return e?.response?.data?.detail||t}function v(){let{t:e}=s(),{username:r,isAdmin:i}=c(),[v,y]=(0,h.useState)([]),[b,x]=(0,h.useState)(!0),[S,C]=(0,h.useState)(null),[w,T]=(0,h.useState)(null),[E,D]=(0,h.useState)(``),[O,k]=(0,h.useState)(``),[A,j]=(0,h.useState)(`viewer`),[M,N]=(0,h.useState)(!1),P=O?o(O,E):null,F=P?e(l[P],{min:8}):null,I=(0,h.useCallback)(async()=>{try{let{data:e}=await a.get(`/api/accounts`);y(e.accounts??[]),C(null)}catch(t){C(_(t,e(`accounts.load_failed`)))}finally{x(!1)}},[e]);(0,h.useEffect)(()=>{i&&I()},[i,I]);let L=async t=>{t.preventDefault(),C(null),T(null),N(!0);try{await a.post(`/api/accounts`,{username:E,password:O,role:A}),D(``),k(``),j(`viewer`),T(e(`accounts.created`)),await I()}catch(t){C(_(t,e(`accounts.create_failed`)))}finally{N(!1)}},R=async t=>{if(window.confirm(e(`accounts.confirm_delete`,{username:t.username}))){C(null),T(null);try{await a.delete(`/api/accounts/${encodeURIComponent(t.username)}`),T(e(`accounts.deleted`,{username:t.username})),await I()}catch(t){C(_(t,e(`accounts.delete_failed`)))}}},z=async(t,n)=>{C(null),T(null);try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await I()}catch(t){C(_(t,e(`accounts.role_failed`))),await I()}},B=async t=>{let n=window.prompt(e(`accounts.prompt_new_password`,{username:t.username}));if(!n)return;C(null),T(null);let r=o(n,t.username);if(r){C(e(l[r],{min:8}));return}try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/password`,{password:n}),T(e(`accounts.password_reset`,{username:t.username}))}catch(t){C(_(t,e(`accounts.password_failed`)))}};return i?(0,g.jsxs)(m,{width:`wide`,children:[S&&(0,g.jsx)(u,{variant:`error`,message:S}),w&&(0,g.jsx)(u,{variant:`success`,message:w}),(0,g.jsx)(f,{icon:(0,g.jsx)(t,{}),title:e(`accounts.title`),children:b?(0,g.jsx)(`div`,{className:`flex justify-center py-6`,children:(0,g.jsx)(`span`,{className:`loading loading-spinner loading-md text-primary`})}):(0,g.jsx)(`div`,{className:`stg-inset overflow-x-auto`,children:(0,g.jsxs)(`table`,{className:`table table-sm`,children:[(0,g.jsx)(`thead`,{children:(0,g.jsxs)(`tr`,{children:[(0,g.jsx)(`th`,{children:e(`accounts.username`)}),(0,g.jsx)(`th`,{children:e(`accounts.role`)}),(0,g.jsx)(`th`,{className:`text-right`,children:e(`accounts.actions`)})]})}),(0,g.jsx)(`tbody`,{children:v.map(t=>{let n=t.username.toLowerCase()===(r??``).toLowerCase();return(0,g.jsxs)(`tr`,{children:[(0,g.jsxs)(`td`,{children:[(0,g.jsx)(`span`,{className:`font-medium font-mono`,children:t.username}),n&&(0,g.jsx)(`span`,{className:`ml-2 badge badge-ghost badge-xs`,children:e(`accounts.you`)})]}),(0,g.jsx)(`td`,{children:(0,g.jsxs)(`select`,{className:`select select-xs select-bordered`,value:t.role,disabled:n,onChange:e=>z(t,e.target.value),children:[(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]})}),(0,g.jsxs)(`td`,{className:`text-right whitespace-nowrap`,children:[(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>B(t),children:e(`accounts.reset_password`)}),(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error ml-1`,disabled:n,onClick:()=>R(t),children:e(`accounts.delete`)})]})]},t.username)})})]})})}),(0,g.jsx)(`form`,{onSubmit:L,children:(0,g.jsx)(f,{icon:(0,g.jsx)(n,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,g.jsx)(p,{children:(0,g.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:M||!E||!O||!!F,children:[M&&(0,g.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,g.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,g.jsx)(d,{label:e(`accounts.username`),children:(0,g.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:E,onChange:e=>D(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.password`),error:F||void 0,children:(0,g.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${F?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":F?!0:void 0,"aria-describedby":F?`accounts-password-error`:void 0,value:O,onChange:e=>k(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,g.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})})]}):(0,g.jsx)(m,{width:`wide`,children:(0,g.jsx)(u,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{v as default};
+import{r as e}from"./chunk-QTnfLwEv.js";import{Qt as t,Zt as n,an as r,in as i}from"./fa-BEzM11bH.js";import{n as a}from"./axios-uEi8e3Ln.js";import{F as o,I as s,L as c,P as l,c as u,d,h as f,u as p,x as m}from"./index-DTsVYLUw.js";var h=e(r(),1),g=i();function _(e,t){return e?.response?.data?.detail||t}function v(){let{t:e}=s(),{username:r,isAdmin:i}=c(),[v,y]=(0,h.useState)([]),[b,x]=(0,h.useState)(!0),[S,C]=(0,h.useState)(null),[w,T]=(0,h.useState)(null),[E,D]=(0,h.useState)(``),[O,k]=(0,h.useState)(``),[A,j]=(0,h.useState)(`viewer`),[M,N]=(0,h.useState)(!1),P=O?o(O,E):null,F=P?e(l[P],{min:8}):null,I=(0,h.useCallback)(async()=>{try{let{data:e}=await a.get(`/api/accounts`);y(e.accounts??[]),C(null)}catch(t){C(_(t,e(`accounts.load_failed`)))}finally{x(!1)}},[e]);(0,h.useEffect)(()=>{i&&I()},[i,I]);let L=async t=>{t.preventDefault(),C(null),T(null),N(!0);try{await a.post(`/api/accounts`,{username:E,password:O,role:A}),D(``),k(``),j(`viewer`),T(e(`accounts.created`)),await I()}catch(t){C(_(t,e(`accounts.create_failed`)))}finally{N(!1)}},R=async t=>{if(window.confirm(e(`accounts.confirm_delete`,{username:t.username}))){C(null),T(null);try{await a.delete(`/api/accounts/${encodeURIComponent(t.username)}`),T(e(`accounts.deleted`,{username:t.username})),await I()}catch(t){C(_(t,e(`accounts.delete_failed`)))}}},z=async(t,n)=>{C(null),T(null);try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/role`,{role:n}),await I()}catch(t){C(_(t,e(`accounts.role_failed`))),await I()}},B=async t=>{let n=window.prompt(e(`accounts.prompt_new_password`,{username:t.username}));if(!n)return;C(null),T(null);let r=o(n,t.username);if(r){C(e(l[r],{min:8}));return}try{await a.put(`/api/accounts/${encodeURIComponent(t.username)}/password`,{password:n}),T(e(`accounts.password_reset`,{username:t.username}))}catch(t){C(_(t,e(`accounts.password_failed`)))}};return i?(0,g.jsxs)(m,{width:`wide`,children:[S&&(0,g.jsx)(u,{variant:`error`,message:S}),w&&(0,g.jsx)(u,{variant:`success`,message:w}),(0,g.jsx)(f,{icon:(0,g.jsx)(t,{}),title:e(`accounts.title`),children:b?(0,g.jsx)(`div`,{className:`flex justify-center py-6`,children:(0,g.jsx)(`span`,{className:`loading loading-spinner loading-md text-primary`})}):(0,g.jsx)(`div`,{className:`stg-inset overflow-x-auto`,children:(0,g.jsxs)(`table`,{className:`table table-sm`,children:[(0,g.jsx)(`thead`,{children:(0,g.jsxs)(`tr`,{children:[(0,g.jsx)(`th`,{children:e(`accounts.username`)}),(0,g.jsx)(`th`,{children:e(`accounts.role`)}),(0,g.jsx)(`th`,{className:`text-right`,children:e(`accounts.actions`)})]})}),(0,g.jsx)(`tbody`,{children:v.map(t=>{let n=t.username.toLowerCase()===(r??``).toLowerCase();return(0,g.jsxs)(`tr`,{children:[(0,g.jsxs)(`td`,{children:[(0,g.jsx)(`span`,{className:`font-medium font-mono`,children:t.username}),n&&(0,g.jsx)(`span`,{className:`ml-2 badge badge-ghost badge-xs`,children:e(`accounts.you`)})]}),(0,g.jsx)(`td`,{children:(0,g.jsxs)(`select`,{className:`select select-xs select-bordered`,value:t.role,disabled:n,onChange:e=>z(t,e.target.value),children:[(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)}),(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)})]})}),(0,g.jsxs)(`td`,{className:`text-right whitespace-nowrap`,children:[(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs`,onClick:()=>B(t),children:e(`accounts.reset_password`)}),(0,g.jsx)(`button`,{className:`btn btn-ghost btn-xs text-error ml-1`,disabled:n,onClick:()=>R(t),children:e(`accounts.delete`)})]})]},t.username)})})]})})}),(0,g.jsx)(`form`,{onSubmit:L,children:(0,g.jsx)(f,{icon:(0,g.jsx)(n,{}),title:e(`accounts.add_title`),description:e(`accounts.add_intro`),footer:(0,g.jsx)(p,{children:(0,g.jsxs)(`button`,{type:`submit`,className:`btn btn-primary btn-sm gap-2`,disabled:M||!E||!O||!!F,children:[M&&(0,g.jsx)(`span`,{className:`loading loading-spinner loading-xs`}),e(`accounts.add_button`)]})}),children:(0,g.jsxs)(`div`,{className:`grid grid-cols-1 sm:grid-cols-[1fr_1fr_auto] gap-3`,children:[(0,g.jsx)(d,{label:e(`accounts.username`),children:(0,g.jsx)(`input`,{type:`text`,className:`input input-bordered w-full font-mono`,placeholder:e(`accounts.username`),autoComplete:`off`,required:!0,value:E,onChange:e=>D(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.password`),error:F||void 0,children:(0,g.jsx)(`input`,{type:`password`,className:`input input-bordered w-full font-mono ${F?`input-error`:``}`,placeholder:e(`accounts.password`),autoComplete:`new-password`,required:!0,minLength:8,"aria-invalid":F?!0:void 0,"aria-describedby":F?`accounts-password-error`:void 0,value:O,onChange:e=>k(e.target.value)})}),(0,g.jsx)(d,{label:e(`accounts.role`),className:`sm:w-40`,children:(0,g.jsxs)(`select`,{className:`select select-bordered w-full`,value:A,onChange:e=>j(e.target.value),children:[(0,g.jsx)(`option`,{value:`viewer`,children:e(`accounts.role_viewer`)}),(0,g.jsx)(`option`,{value:`admin`,children:e(`accounts.role_admin`)})]})})]})})})]}):(0,g.jsx)(m,{width:`wide`,children:(0,g.jsx)(u,{variant:`warning`,message:e(`accounts.admin_only`)})})}export{v as default};