esp-rainmaker-cli 1.13.1__tar.gz → 1.14.1__tar.gz

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: esp-rainmaker-cli
-Version: 1.13.1
+Version: 1.14.1
 Summary: A python utility to perform host based claiming
 Home-page: https://github.com/espressif/esp-rainmaker-cli
 Author: Espressif Systems
@@ -122,6 +122,26 @@ Changelog
 
 All major changes to ESP RainMaker CLI will be documented in this file.
 
+## [1.14.1] - 05-Jun-2026
+### Bugfixes
+- Security 2 fixes across provisioning and local control:
+  - Provisioning auto-detect now reads `prov.sec_ver` from device capabilities
+    (was forcing sec1 on sec2 devices, causing firmware "Security version mismatch")
+  - `sec_patch_ver` discovered from device capabilities / `esp_local_ctrl/version`,
+    enabling the counter-in-IV scheme on ESP-IDF v5.4+ firmware
+  - `--sec2_username` option added to `--local` commands (`getnodeconfig`,
+    `getparams`, `setparams`); defaults to `wifiprov`, picks up cached
+    `local_control_username` from cloud params; `--pop` used as the SRP6a password
+  - QR code `username` / `password` fields now honoured by `provision`
+  - `Security2.serialize`/`deserialize` for local-control session resume parity with Security 1
+
+## [1.14.0] - 24-Apr-2026
+### Added
+- New `group sharing` subcommand for sharing device groups / Matter fabrics between users:
+  - `add`, `remove`, `list`, `list-requests`, `accept`, `decline`, `cancel` operations
+  - Supports primary/secondary roles, sub-roles (1-4), metadata, and ownership transfer (`--transfer`, `--new-role`)
+  - Parsed, human-readable output by default; pass `--raw` on any operation to get the underlying JSON response
+
 ## [1.13.1] - 23-Apr-2026
 ### Added
 - Node sharing enhancements:

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/esp_rainmaker_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: esp-rainmaker-cli
-Version: 1.13.1
+Version: 1.14.1
 Summary: A python utility to perform host based claiming
 Home-page: https://github.com/espressif/esp-rainmaker-cli
 Author: Espressif Systems
@@ -122,6 +122,26 @@ Changelog
 
 All major changes to ESP RainMaker CLI will be documented in this file.
 
+## [1.14.1] - 05-Jun-2026
+### Bugfixes
+- Security 2 fixes across provisioning and local control:
+  - Provisioning auto-detect now reads `prov.sec_ver` from device capabilities
+    (was forcing sec1 on sec2 devices, causing firmware "Security version mismatch")
+  - `sec_patch_ver` discovered from device capabilities / `esp_local_ctrl/version`,
+    enabling the counter-in-IV scheme on ESP-IDF v5.4+ firmware
+  - `--sec2_username` option added to `--local` commands (`getnodeconfig`,
+    `getparams`, `setparams`); defaults to `wifiprov`, picks up cached
+    `local_control_username` from cloud params; `--pop` used as the SRP6a password
+  - QR code `username` / `password` fields now honoured by `provision`
+  - `Security2.serialize`/`deserialize` for local-control session resume parity with Security 1
+
+## [1.14.0] - 24-Apr-2026
+### Added
+- New `group sharing` subcommand for sharing device groups / Matter fabrics between users:
+  - `add`, `remove`, `list`, `list-requests`, `accept`, `decline`, `cancel` operations
+  - Supports primary/secondary roles, sub-roles (1-4), metadata, and ownership transfer (`--transfer`, `--new-role`)
+  - Parsed, human-readable output by default; pass `--raw` on any operation to get the underlying JSON response
+
 ## [1.13.1] - 23-Apr-2026
 ### Added
 - Node sharing enhancements:

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/rainmaker/rainmaker.py

@@ -15,7 +15,12 @@ from rmaker_cmd.cmd_response import get_cmd_requests, create_cmd_request
 from rmaker_cmd.provision import provision
 from rmaker_cmd.test import test
 from rmaker_lib.logger import log
-from rmaker_cmd.group import group_add, group_remove, group_edit, group_list, group_show, group_add_nodes, group_remove_nodes, group_list_nodes
+from rmaker_cmd.group import (group_add, group_remove, group_edit, group_list,
+                              group_show, group_add_nodes, group_remove_nodes,
+                              group_list_nodes, group_sharing_add,
+                              group_sharing_remove, group_sharing_list,
+                              group_sharing_list_requests, group_sharing_accept,
+                              group_sharing_decline, group_sharing_cancel)
 from rmaker_cmd.automation import automation_add, automation_edit, automation_remove, automation_get
 from rmaker_cmd.cache import cache_manage
 from rmaker_cmd.stream import stream_video
@@ -280,6 +285,10 @@ def main():
                                      choices=[0, 1, 2],
                                      default=None,
                                      help='Security version for local control (default: 1)')
+    getnodeconfig_parser.add_argument('--sec2_username',
+                                     type=str,
+                                     default=None,
+                                     help='SRP6a username for Security 2 local control. Defaults to the username cached from cloud params, else \'wifiprov\'. --pop is used as the password.')
     getnodeconfig_parser.add_argument('--local-raw',
                                      action='store_true',
                                      help='Use local control via raw endpoints (get_config with fragmentation) instead of esp_local_ctrl')
@@ -350,6 +359,10 @@ def main():
                                  choices=[0, 1, 2],
                                  default=None,
                                  help='Security version for local control (default: 1)')
+    setparams_parser.add_argument('--sec2_username',
+                                 type=str,
+                                 default=None,
+                                 help='SRP6a username for Security 2 local control. Defaults to the username cached from cloud params, else \'wifiprov\'. --pop is used as the password.')
     setparams_parser.add_argument('--local-raw',
                                  action='store_true',
                                  help='Use local control via raw endpoints (get_params/set_params) instead of esp_local_ctrl')
@@ -393,6 +406,10 @@ def main():
                                  choices=[0, 1, 2],
                                  default=None,
                                  help='Security version for local control (default: 1)')
+    getparams_parser.add_argument('--sec2_username',
+                                 type=str,
+                                 default=None,
+                                 help='SRP6a username for Security 2 local control. Defaults to the username cached from cloud params, else \'wifiprov\'. --pop is used as the password.')
     getparams_parser.add_argument('--local-raw',
                                  action='store_true',
                                  help='Use local control via raw endpoints (get_params/set_params) instead of esp_local_ctrl')
@@ -934,6 +951,127 @@ def main():
     add_profile_argument(group_list_nodes_parser)
     group_list_nodes_parser.set_defaults(func=group_list_nodes)
 
+    # group sharing
+    group_sharing_parser = group_subparsers.add_parser(
+        'sharing',
+        help='Share groups / matter fabrics between users',
+        formatter_class=argparse.RawTextHelpFormatter,
+        description='Share groups or matter fabrics with other users.\n'
+                    'Primary users can share groups; secondary users can view '
+                    'their sharing or leave groups they have access to.')
+    group_sharing_parser.set_defaults(
+        func=lambda vars=None: group_sharing_parser.print_help())
+    group_sharing_subparsers = group_sharing_parser.add_subparsers(
+        dest='sharing_command', help='Group sharing operations')
+
+    # group sharing add
+    gs_add_parser = group_sharing_subparsers.add_parser(
+        'add', help='Share group(s) with a user (or add self-sharing without --user)',
+        formatter_class=argparse.RawTextHelpFormatter)
+    gs_add_parser.add_argument('--groups', type=str, required=True,
+                               metavar='<group_ids>',
+                               help='Comma separated group ids (max 10)')
+    gs_add_parser.add_argument('--user', type=str, metavar='<user_name>',
+                               help='User name (email) to share with. Optional.')
+    gs_add_parser.add_argument('--primary', action='store_true',
+                               help='Share with primary access (default: secondary)')
+    gs_add_parser.add_argument('--sub-role', type=int, choices=range(1, 5),
+                               metavar='<1-4>',
+                               help='Custom sub role (1-4)')
+    gs_add_parser.add_argument('--metadata', type=str, metavar='<json>',
+                               help='Custom metadata as a JSON string')
+    gs_add_parser.add_argument('--transfer', action='store_true',
+                               help='Transfer ownership of the group(s) to the user')
+    gs_add_parser.add_argument('--new-role', type=str, choices=['secondary'],
+                               help='Role to assign to self after transfer '
+                                    '(only valid with --transfer)')
+    gs_add_parser.add_argument('--raw', action='store_true',
+                               help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_add_parser)
+    gs_add_parser.set_defaults(func=group_sharing_add)
+
+    # group sharing remove
+    gs_remove_parser = group_sharing_subparsers.add_parser(
+        'remove', help='Remove group sharing with a user',
+        formatter_class=argparse.RawTextHelpFormatter)
+    gs_remove_parser.add_argument('--groups', type=str, required=True,
+                                  metavar='<group_ids>',
+                                  help='Comma separated group ids')
+    gs_remove_parser.add_argument('--user', type=str, required=True,
+                                  metavar='<user_name>',
+                                  help='User name (email) to unshare with')
+    gs_remove_parser.add_argument('--raw', action='store_true',
+                                  help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_remove_parser)
+    gs_remove_parser.set_defaults(func=group_sharing_remove)
+
+    # group sharing list
+    gs_list_parser = group_sharing_subparsers.add_parser(
+        'list', help='Show sharing details for groups / matter fabrics',
+        formatter_class=argparse.RawTextHelpFormatter)
+    gs_list_parser.add_argument('--group-id', type=str, metavar='<group_id>',
+                                help='Fetch sharing details for a single group')
+    gs_list_parser.add_argument('--sub-groups', action='store_true',
+                                help='Include sharing details of sub-groups')
+    gs_list_parser.add_argument('--parent-groups', action='store_true',
+                                help='Include sharing details of parent groups')
+    gs_list_parser.add_argument('--metadata', action='store_true',
+                                help='Include metadata set during sharing')
+    gs_list_parser.add_argument('--raw', action='store_true',
+                                help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_list_parser)
+    gs_list_parser.set_defaults(func=group_sharing_list)
+
+    # group sharing list-requests
+    gs_list_req_parser = group_sharing_subparsers.add_parser(
+        'list-requests', help='List pending group sharing requests',
+        formatter_class=argparse.RawTextHelpFormatter,
+        description='List pending group sharing requests.\n'
+                    'Use --primary-user to list requests raised by you.\n'
+                    'Without the flag, lists requests you have received.')
+    gs_list_req_parser.add_argument('--id', type=str, metavar='<request_id>',
+                                    help='Fetch a specific request by id')
+    gs_list_req_parser.add_argument('--primary-user', action='store_true',
+                                    help='List requests raised by current user '
+                                         '(default: requests received)')
+    gs_list_req_parser.add_argument('--raw', action='store_true',
+                                    help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_list_req_parser)
+    gs_list_req_parser.set_defaults(func=group_sharing_list_requests)
+
+    # group sharing accept
+    gs_accept_parser = group_sharing_subparsers.add_parser(
+        'accept', help='Accept a pending group sharing request')
+    gs_accept_parser.add_argument('--id', type=str, required=True,
+                                  metavar='<request_id>',
+                                  help='Id of the sharing request')
+    gs_accept_parser.add_argument('--raw', action='store_true',
+                                  help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_accept_parser)
+    gs_accept_parser.set_defaults(func=group_sharing_accept)
+
+    # group sharing decline
+    gs_decline_parser = group_sharing_subparsers.add_parser(
+        'decline', help='Decline a pending group sharing request')
+    gs_decline_parser.add_argument('--id', type=str, required=True,
+                                   metavar='<request_id>',
+                                   help='Id of the sharing request')
+    gs_decline_parser.add_argument('--raw', action='store_true',
+                                   help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_decline_parser)
+    gs_decline_parser.set_defaults(func=group_sharing_decline)
+
+    # group sharing cancel
+    gs_cancel_parser = group_sharing_subparsers.add_parser(
+        'cancel', help='Cancel a pending group sharing request (primary side)')
+    gs_cancel_parser.add_argument('--id', type=str, required=True,
+                                  metavar='<request_id>',
+                                  help='Id of the sharing request')
+    gs_cancel_parser.add_argument('--raw', action='store_true',
+                                  help='Print the raw JSON response instead of parsed output')
+    add_profile_argument(gs_cancel_parser)
+    gs_cancel_parser.set_defaults(func=group_sharing_cancel)
+
     # Automation Management
     automation_parser = subparsers.add_parser('automations',
                                               help='Manage automation triggers')

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/rainmaker/version.py

@@ -5,4 +5,4 @@
 # SPDX-License-Identifier: Apache-2.0
 
 # This file contains the version information for the ESP RainMaker CLI
-VERSION = "1.13.1"
+VERSION = "1.14.1"

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/rmaker_cmd/group.py

@@ -3,8 +3,17 @@
 # SPDX-License-Identifier: Apache-2.0
 
 from rmaker_lib.profile_utils import get_session_with_profile
+import datetime
 import json
-from rmaker_cmd.node import _print_node_details
+import sys
+from rmaker_cmd.node import (
+    _get_description,
+    _get_request_expiration,
+    _get_request_id,
+    _get_status,
+    _print_api_error,
+    _print_node_details,
+)
 
 
 def _handle_error(e, operation):
@@ -249,4 +258,211 @@ def group_list_nodes(vars=None):
                     else:
                         print(f"{idx}. {name} (ID: {group_id})")
     except Exception as e:
-        _handle_error(e, "list nodes in group")
+        _handle_error(e, "list nodes in group")
+
+
+def _split_groups(groups_arg):
+    return [g.strip() for g in groups_arg.split(',') if g.strip()]
+
+
+def _print_group_sharing_request_details(resp, is_primary_user=False):
+    requests_in_resp = resp.get('sharing_requests') or []
+    if not requests_in_resp:
+        print("No pending requests")
+        return
+    request_exists = False
+    for request in requests_in_resp:
+        if request.get('request_status', '').lower() == 'declined':
+            continue
+        request_exists = True
+        print("\n{:<15}: {}".format('Request Id', request['request_id']))
+        print("{:<15}: {}".format('Group Id(s)', ','.join(request.get('group_ids', []))))
+        group_names = request.get('group_names') or []
+        if group_names:
+            print("{:<15}: {}".format('Group Name(s)', ','.join(group_names)))
+        if is_primary_user:
+            if 'user_name' in request and request['user_name']:
+                print("{:<15}: {}".format('Shared with', request['user_name']))
+        else:
+            if 'primary_user_name' in request and request['primary_user_name']:
+                print("{:<15}: {}".format('Shared by', request['primary_user_name']))
+        if 'user_role' in request and request['user_role']:
+            print("{:<15}: {}".format('Role', request['user_role']))
+        print(_get_request_expiration(request))
+
+    if not request_exists:
+        print("No pending requests")
+
+
+def _print_group_sharing_details(resp):
+    try:
+        groups_in_resp = resp.get('group_sharing') or []
+        if not groups_in_resp:
+            print("No shared groups")
+            return
+        for group in groups_in_resp:
+            print("\nGroup Id: {}".format(group.get('group_id', '')))
+            users = group.get('users') or {}
+            primary_users = ','.join(users.get('primary') or [])
+            secondary_users = ','.join(users.get('secondary') or [])
+            print("{:<7}: {:<9}: {}".format('Users', 'Primary', primary_users), end='')
+            if secondary_users:
+                print("\n{:>18}: {}".format('Secondary', secondary_users), end='')
+            print()
+    except KeyError:
+        print("Error in displaying details...Please check API Json...Exiting...")
+        sys.exit(0)
+
+
+def _emit(resp, raw, render):
+    if raw:
+        print(json.dumps(resp, indent=2))
+        return
+    if isinstance(resp, dict) and resp.get('status', '').lower() != 'success' and 'error_code' in resp:
+        _print_api_error(resp)
+        return
+    render(resp)
+
+
+def group_sharing_add(vars=None):
+    try:
+        s = get_session_with_profile(vars or {})
+        groups = _split_groups(vars['groups'])
+        if not groups:
+            print("At least one group id must be provided in --groups")
+            return
+        user = vars.get('user')
+        primary = vars.get('primary') if vars.get('primary') else None
+        sub_role = vars.get('sub_role')
+        transfer = vars.get('transfer') if vars.get('transfer') else None
+        new_role = vars.get('new_role')
+        metadata = None
+        metadata_arg = vars.get('metadata')
+        if metadata_arg:
+            try:
+                metadata = json.loads(metadata_arg)
+            except Exception as e:
+                print("Invalid JSON for --metadata:", e)
+                return
+        print("Sharing group(s) with user")
+        resp = s.add_user_group_sharing(
+            groups=groups,
+            user_name=user,
+            primary=primary,
+            sub_role=sub_role,
+            metadata=metadata,
+            transfer=transfer,
+            new_role=new_role,
+        )
+
+        def render(r):
+            if r.get('status', '').lower() == 'success':
+                print("{:<11}: {}".format('Status', _get_status(r)))
+                print("{:<11}: {}".format('Description', _get_description(r)))
+                if 'request_id' in r:
+                    print("{:<11}: {}".format('Request Id', _get_request_id(r)))
+
+        _emit(resp, vars.get('raw', False), render)
+    except Exception as e:
+        _handle_error(e, "add group sharing")
+
+
+def group_sharing_remove(vars=None):
+    try:
+        s = get_session_with_profile(vars or {})
+        groups = _split_groups(vars['groups'])
+        if not groups:
+            print("At least one group id must be provided in --groups")
+            return
+        print("Removing group sharing")
+        resp = s.remove_user_group_sharing(
+            groups=','.join(groups),
+            user_name=vars['user'],
+        )
+
+        def render(r):
+            if r.get('status', '').lower() == 'success':
+                print("{}: {}".format(_get_status(r), _get_description(r)))
+
+        _emit(resp, vars.get('raw', False), render)
+    except Exception as e:
+        _handle_error(e, "remove group sharing")
+
+
+def group_sharing_list(vars=None):
+    try:
+        s = get_session_with_profile(vars or {})
+        resp = s.get_user_group_sharing(
+            group_id=vars.get('group_id'),
+            sub_groups=vars.get('sub_groups', False),
+            parent_groups=vars.get('parent_groups', False),
+            metadata=vars.get('metadata', False),
+        )
+
+        def render(r):
+            print("Displaying group sharing details")
+            _print_group_sharing_details(r)
+
+        _emit(resp, vars.get('raw', False), render)
+    except Exception as e:
+        _handle_error(e, "list group sharing")
+
+
+def group_sharing_list_requests(vars=None):
+    try:
+        s = get_session_with_profile(vars or {})
+        is_primary = vars.get('primary_user', False)
+        resp = s.get_user_group_sharing_requests(
+            request_id=vars.get('id'),
+            primary_user=is_primary,
+        )
+
+        def render(r):
+            print("Displaying pending group sharing requests")
+            print("Current (logged-in) user is set as {} user".format(
+                'Primary' if is_primary else 'Secondary'))
+            _print_group_sharing_request_details(r, is_primary_user=is_primary)
+
+        _emit(resp, vars.get('raw', False), render)
+    except Exception as e:
+        _handle_error(e, "list group sharing requests")
+
+
+def _respond_group_sharing(vars, accept):
+    action = 'accept' if accept else 'decline'
+    try:
+        s = get_session_with_profile(vars or {})
+        resp = s.respond_user_group_sharing_request(
+            request_id=vars['id'], accept=accept)
+
+        def render(r):
+            if r.get('status', '').lower() == 'success':
+                print("{:<11}: {}".format('Status', _get_status(r)))
+                print("{:<11}: {}".format('Description', _get_description(r)))
+
+        _emit(resp, vars.get('raw', False), render)
+    except Exception as e:
+        _handle_error(e, "{} group sharing request".format(action))
+
+
+def group_sharing_accept(vars=None):
+    _respond_group_sharing(vars, accept=True)
+
+
+def group_sharing_decline(vars=None):
+    _respond_group_sharing(vars, accept=False)
+
+
+def group_sharing_cancel(vars=None):
+    try:
+        s = get_session_with_profile(vars or {})
+        print("Cancelling request")
+        resp = s.remove_user_group_sharing_request(request_id=vars['id'])
+
+        def render(r):
+            if r.get('status', '').lower() == 'success':
+                print("{}: {}".format(_get_status(r), _get_description(r)))
+
+        _emit(resp, vars.get('raw', False), render)
+    except Exception as e:
+        _handle_error(e, "cancel group sharing request")

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/rmaker_cmd/node.py

@@ -78,6 +78,9 @@ def _build_local_options_with_cache(vars_dict, node_cache=None, session_store=No
     sec_ver = raw_sec_ver if raw_sec_ver is not None else 1
     nodeid = vars_dict.get('nodeid', '')
 
+    user_sec2_username = vars_dict.get('sec2_username')  # None => not supplied
+    sec2_username = user_sec2_username
+
     if node_cache and not pop:
         capability = node_cache.get_local_control_capability(nodeid)
         if capability:
@@ -99,6 +102,9 @@ def _build_local_options_with_cache(vars_dict, node_cache=None, session_store=No
                 log.debug(f"Using cached POP for node {nodeid}")
                 if lc_info.get('sec_ver') is not None and not explicit_sec_ver:
                     sec_ver = lc_info['sec_ver']
+                if sec2_username is None and lc_info.get('username'):
+                    sec2_username = lc_info['username']
+                    log.debug(f"Using cached sec2 username for node {nodeid}")
 
         if not pop and not explicit_sec_ver:
             try:
@@ -114,15 +120,23 @@ def _build_local_options_with_cache(vars_dict, node_cache=None, session_store=No
                         pop = lc_info.get('pop', '')
                         if lc_info.get('sec_ver') is not None:
                             sec_ver = lc_info['sec_ver']
+                        if sec2_username is None and lc_info.get('username'):
+                            sec2_username = lc_info['username']
                         log.debug(f"Resolved POP from cloud for node {nodeid}")
             except Exception as e:
                 log.debug(f"Failed to auto-resolve POP from cloud: {e}")
 
+    if not sec2_username:
+        sec2_username = 'wifiprov'
+        if sec_ver == 2:
+            print(f"Using default Security 2 username '{sec2_username}'")
+
     local_options = {
         'pop': pop,
         'transport': vars_dict.get('transport', 'http'),
         'port': vars_dict.get('port', 8080),
         'sec_ver': sec_ver,
+        'sec2_username': sec2_username,
         'local_raw': vars_dict.get('local_raw', False),
         'device_name': vars_dict.get('device_name', None),
         'node_cache': node_cache,
@@ -1259,6 +1273,7 @@ def get_node_config(vars=None):
                     'transport': vars.get('transport', 'ble'),
                     'port': vars.get('port', 8080),
                     'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 1,
+                    'sec2_username': vars.get('sec2_username', 'wifiprov') or 'wifiprov',
                     'device_name': vars.get('device_name', None),
                     'timestamp': timestamp
                 }
@@ -1312,7 +1327,8 @@ def get_node_config(vars=None):
                         'pop': vars.get('pop', ''),
                         'transport': vars.get('transport', 'http'),
                         'port': vars.get('port', 8080),
-                        'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 1
+                        'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 1,
+                        'sec2_username': vars.get('sec2_username', 'wifiprov') or 'wifiprov',
                     }
 
                     node_config = run_local_control_operation(
@@ -1326,7 +1342,8 @@ def get_node_config(vars=None):
                         'pop': vars.get('pop', ''),
                         'transport': vars.get('transport', 'http'),
                         'port': vars.get('port', 8080),
-                        'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 0
+                        'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 0,
+                        'sec2_username': vars.get('sec2_username', 'wifiprov') or 'wifiprov',
                     }
 
                     log.info("Using simplified local control (security level 0)")
@@ -1567,6 +1584,7 @@ def set_params(vars=None):
                     'transport': vars.get('transport', 'http'),
                     'port': vars.get('port', 8080),
                     'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 0,
+                    'sec2_username': vars.get('sec2_username', 'wifiprov') or 'wifiprov',
                     'local_raw': vars.get('local_raw', False),
                     'device_name': vars.get('device_name', None)
                 }
@@ -1753,6 +1771,7 @@ def get_params(vars=None):
                         'transport': vars.get('transport', 'http'),
                         'port': vars.get('port', 8080),
                         'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 1,
+                        'sec2_username': vars.get('sec2_username', 'wifiprov') or 'wifiprov',
                         'local_raw': vars.get('local_raw', False),
                         'device_name': vars.get('device_name', None),
                         'timestamp': timestamp if not (proxy_report and vars.get('local_raw', False) and not timestamp_explicitly_provided) else timestamp,
@@ -1779,6 +1798,7 @@ def get_params(vars=None):
                         'transport': vars.get('transport', 'http'),
                         'port': vars.get('port', 8080),
                         'sec_ver': vars.get('sec_ver') if vars.get('sec_ver') is not None else 0,
+                        'sec2_username': vars.get('sec2_username', 'wifiprov') or 'wifiprov',
                         'local_raw': vars.get('local_raw', False),
                         'device_name': vars.get('device_name', None),
                         'timestamp': timestamp if not (proxy_report and vars.get('local_raw', False) and not timestamp_explicitly_provided) else timestamp,

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/rmaker_cmd/provision.py

@@ -117,8 +117,15 @@ def provision(vars=None):
             raise ValueError("Proof of possession (pop) may be required depending on security scheme. "
                            "Use --pop, provide via --qrcode, or specify --sec_ver to skip pop requirement "
                            "(Security 0 and 2 don't require pop).")
-        sec2_username = vars.get('sec2_username', '')
-        sec2_password = vars.get('sec2_password', '')
+
+        # sec2 credentials: explicit options override QR code values.
+        # QR code fields: 'username' and 'password' (sec2 SRP6a credentials).
+        sec2_username = (vars.get('sec2_username')
+                         or qrcode_data.get('username')
+                         or '')
+        sec2_password = (vars.get('sec2_password')
+                         or qrcode_data.get('password')
+                         or '')
         ssid = vars.get('ssid')
         passphrase = vars.get('passphrase')
         no_wifi = vars.get('no_wifi', False)

{esp_rainmaker_cli-1.13.1 → esp_rainmaker_cli-1.14.1}/rmaker_lib/node_cache.py

@@ -56,7 +56,7 @@ def _get_cache_base_dir(profile_config=None):
 
 def extract_local_control_info(params_or_details):
     """
-    Extract local control info (POP, sec_ver, transport, port) from
+    Extract local control info (POP, sec_ver, username, transport, port) from
     node params or node details response data.
 
     Scans for a service/device named "Local Control" or similar that
@@ -74,6 +74,9 @@ def extract_local_control_info(params_or_details):
             lower_key = key.lower().replace(' ', '_').replace('-', '_')
             if lower_key in ('pop', 'proof_of_possession'):
                 info['pop'] = str(value)
+            elif lower_key in ('username', 'user_name', 'local_control_username'):
+                if value:
+                    info['username'] = str(value)
             elif lower_key == 'sec_ver':
                 try:
                     info['sec_ver'] = int(value)