python-aidot-cameras 0.12.2__tar.gz → 0.12.4__tar.gz

{python_aidot_cameras-0.12.2/python_aidot_cameras.egg-info → python_aidot_cameras-0.12.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.12.2
+Version: 0.12.4
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/aidot_cameras/camera/client.py

@@ -11,6 +11,7 @@ from typing import Any, Callable, List, Optional
 from ..exceptions import AidotCameraBusy, AidotCameraNotReady
 from ..const import APP_ID as _AIDOT_APP_ID
 from ..const import (
+    LOGIN_INFO_MQTT_PASSWORD_KEYS,
     LOGIN_INFO_PERSISTENT_MQTT_KEY,
     LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY,
 )
@@ -141,6 +142,11 @@ _DTLS_SERVE_OPEN_TIMEOUT_S = _parse_env_float("AIDOT_DTLS_SERVE_OPEN_TIMEOUT_S",
 # discarded task can be garbage-collected mid-flight. Discarded on completion.
 _BG_TASKS: set = set()
 
+# Minimum gap between MQTT credential refetches after the broker refused one.
+# One rotation is normal (another login happened); a second refusal that fast
+# means refetching is not helping, so back off rather than loop.
+_MQTT_CREDENTIAL_REFETCH_FLOOR = 30.0
+
 
 def _spawn_bg(coro):
     _t = asyncio.ensure_future(coro)
@@ -656,6 +662,11 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
     # Optional LAN control client; when attached, attribute writes go local-first.
     _lan_client = None
 
+    # MQTT credential state, defaulted at class level so the credential path is
+    # safe on any client whose __init__ did not run to completion.
+    _mqtt_credential_refresh_cb = None
+    _mqtt_refused_at = 0.0
+
     def attach_lan_client(self, lan_client) -> None:
         """Route camera attribute writes through ``lan_client`` (local-first,
         cloud-fallback).  Pass an ``aidot.camera.lan_control.CameraLanClient``."""
@@ -709,6 +720,15 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         # updates the shared login_info in place, so camera HTTP calls can recover
         # from a 21026 "Please login again" instead of failing silently.
         self._token_refresh_cb: "Optional[Callable]" = None
+        # Async callback (set by AidotClient) that fetches a fresh MQTT password
+        # into the shared login_info.  The password is deliberately never
+        # persisted (it rotates on every account login), so on a restart from a
+        # stored token there is none until this runs - see
+        # _async_get_smarthome_auth, which calls it before consulting login_info.
+        self._mqtt_credential_refresh_cb: "Optional[Callable]" = None
+        # Loop timestamp of the last broker credential refusal, for the refetch
+        # floor in _async_refresh_mqtt_credential.
+        self._mqtt_refused_at: float = 0.0
         # Raw device dict retained for transport-type detection (isDTLS field)
         self._raw_device: dict = device
 
@@ -945,6 +965,49 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         """Register the AidotClient coroutine that refreshes the access token."""
         self._token_refresh_cb = cb
 
+    def set_mqtt_credential_refresh_cb(self, cb: "Callable") -> None:
+        """Register the AidotClient coroutine that re-fetches the MQTT password."""
+        self._mqtt_credential_refresh_cb = cb
+
+    def _shared_mqtt_password(self) -> Optional[str]:
+        """The account's current MQTT password, or None if it holds none.
+
+        Read from the shared ``login_info`` dict, which is the single source of
+        truth: it is what the fetch writes and what a broker refusal clears.
+        """
+        li = self._user_info if isinstance(self._user_info, dict) else {}
+        for key in LOGIN_INFO_MQTT_PASSWORD_KEYS:
+            val = li.get(key)
+            if val:
+                return val
+        return None
+
+    async def _async_refresh_mqtt_credential(self) -> None:
+        """Ask the account client for a fresh MQTT password, if it can supply one.
+
+        Never raises: every caller has fallback strategies, so a failed fetch
+        should degrade rather than break a stream open.
+        """
+        cb = self._mqtt_credential_refresh_cb
+        if cb is None:
+            return
+        # Floor between attempts.  If the freshly fetched password is refused too
+        # - another login rotated again, or the endpoint hands back the same value
+        # - every stream open would otherwise cost another credential request and
+        # another refused connection.  Better to fail this open and let the next
+        # one try than to hammer the vendor's endpoint.
+        since = asyncio.get_running_loop().time() - self._mqtt_refused_at
+        if self._mqtt_refused_at and since < _MQTT_CREDENTIAL_REFETCH_FLOOR:
+            _LOGGER.debug(
+                "skipping MQTT credential refetch: only %.1fs since the last "
+                "refusal (floor %ss)", since, _MQTT_CREDENTIAL_REFETCH_FLOOR,
+            )
+            return
+        try:
+            await cb()
+        except Exception as exc:
+            _LOGGER.debug("MQTT credential refresh failed: %s", exc)
+
     @staticmethod
     def _is_auth_error(data: Any) -> bool:
         """True if a smarthome response means the token is stale (re-login)."""
@@ -1186,15 +1249,35 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
         """Fetch MQTT credentials (mqttUser + mqttPassword) for the Arnoo broker.
 
         Strategy order - stops at first success:
-          0. Already cached
-          1. mqttPassword already in AiDot login_info (from _async_fetch_user_config)
+          0. Already cached, and still agreeing with the account-shared login_info
+          1. mqttPassword in AiDot login_info, fetching it first if absent
           2. GET /user/getUser  <- documented SDK step (reqUserAuthInfoWithCallback)
              Returns LDSAuthInfo {userId, mqttUser, mqttPassword, ...}
           3. getServerUrlConfig response side-effect (if MQTT URL not yet fetched)
           4. accessToken as MQTT password (Arnoo broker fallback)
         """
-        if self._smarthome_auth and self._smarthome_auth.get("mqttPassword"):
+        # Strategy 0.  This cache is per device client but the credential is per
+        # account, so the shared login_info wins any disagreement: when a broker
+        # refusal cleared or replaced the account's password, a sibling camera's
+        # cache still holds the dead one, and trusting it would refuse again on
+        # every camera in turn.  Treating the cache as cold whenever it disagrees
+        # makes login_info the single source of truth.
+        _cached_pwd = (self._smarthome_auth or {}).get("mqttPassword")
+        if _cached_pwd and _cached_pwd == self._shared_mqtt_password():
+            return self._smarthome_auth
+        # An empty login_info is not automatically "nothing to disagree with": it
+        # is exactly the post-invalidation state, since a refusal pops the shared
+        # password but can only null the cache on the ONE client whose connection
+        # was refused.  So a cache that CAME from login_info is stale here, while
+        # one from /user/getUser or the accessToken fallback is per client and has
+        # no shared counterpart to compare against.  Strategy 1 stamps its source
+        # precisely so the two can be told apart.
+        _cached_src = ((self._smarthome_auth or {}).get("raw") or {}).get("source") or ""
+        _from_shared = _cached_src.startswith("login_info.")
+        if _cached_pwd and self._shared_mqtt_password() is None and not _from_shared:
             return self._smarthome_auth
+        if _cached_pwd:
+            self._smarthome_auth = None
 
         import aiohttp
 
@@ -1205,9 +1288,15 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
             or str(self.user_id)
         )
 
-        # --- Strategy 1: mqttPassword already in AiDot login_info ---
-        # _async_fetch_user_config() stores it under "mqttPassword" or "mqttPwd".
-        for key in ("mqttPassword", "mqttPwd"):
+        # --- Strategy 1: mqttPassword in AiDot login_info, fetched if absent ---
+        # The password is never persisted (it rotates on every account login), so
+        # login_info has none after a restart from a stored token, and a broker
+        # refusal clears it deliberately.  Fetch before reading, or the strategies
+        # below shadow the absence: strategy 4 always "succeeds" with the access
+        # token, which the broker then refuses, and the retry loops forever.
+        if self._shared_mqtt_password() is None:
+            await self._async_refresh_mqtt_credential()
+        for key in LOGIN_INFO_MQTT_PASSWORD_KEYS:
             val = self._user_info.get(key)
             if val:
                 self._smarthome_auth = {
@@ -3271,16 +3360,27 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
     def _resolve_sdes_serve_audio(self) -> bool:
         """Whether to include audio in the SDES camera serve.
 
-        **Default ON** for app-parity (the official app plays camera audio). The
-        serve feeds the AAC encoder a continuous silence base (anullsrc + amix) so
-        sparse battery PCMA streams cleanly through the mpegts mux. Per-camera
-        ``sdes_audio`` (via ``start_keepalive``) wins; else the
-        ``AIDOT_SDES_SERVE_AUDIO`` env (falsy = 0/false/no/off disables)."""
+        **Default OFF**, because including it can cost the video entirely.  The
+        mpegts mux writes its PAT/PMT only once EVERY mapped stream has produced a
+        packet, and ``amix`` does not emit until every one of its inputs has
+        delivered a frame - so on a camera that sends no PCMA, the AAC encoder
+        never produces, the PMT is never written, and a consumer gets an accepted
+        connection and then zero bytes.  The continuous ``anullsrc`` silence base
+        was meant to prevent exactly that and does not: verified live on a battery
+        camera, audio on gave 0 bytes across 45 consecutive attach attempts while
+        audio off gave 303 KB of 1280x960 H.264 from the same session, and
+        reordering the mix so the silence drives it did not help.
+
+        Missing audio is a worse experience than the app; NO VIDEO is a broken
+        integration, so video wins the tie.  Turn audio back on per camera with
+        ``sdes_audio`` (via ``start_keepalive``), or globally with
+        ``AIDOT_SDES_SERVE_AUDIO=1`` - on a camera that does send audio steadily
+        it works, which is why this stays an option rather than being removed."""
         opt = getattr(self, "_sdes_audio_opt", None)
         if opt is not None:
             return bool(opt)
-        return os.environ.get("AIDOT_SDES_SERVE_AUDIO", "").strip().lower() not in (
-            "0", "false", "no", "off")
+        return os.environ.get("AIDOT_SDES_SERVE_AUDIO", "").strip().lower() in (
+            "1", "true", "yes", "on")
 
     def _resolve_sdes_audio_gain_db(self) -> float:
         """Gain (dB) applied to the served SDES audio (the camera mic runs hot).
@@ -3403,26 +3503,55 @@ class CameraMixin(_CameraControlsMixin, _WebRTCOpenMixin, _SdesOpenMixin):
                 return None
             from .protocol import _PersistentMqtt
 
+            # paho fires on_connect on its own network thread; every mutation
+            # below has to be ordered against the get-or-create above, so it is
+            # hopped onto this loop and taken under the same account lock.
+            _loop = asyncio.get_running_loop()
+
             def _invalidate_mqtt_credentials(rc) -> None:
-                """Drop the cached MQTT password so the next use re-fetches it.
+                """Retire the refused client and drop the credential it used.
 
                 The broker rotates this password on every account login and
                 allows one connection at a time, so any other login (the phone
                 app, a second Home Assistant, a script) invalidates ours.  The
                 cached copy lives in login_info, where it short-circuits the
                 credential fetch, so it has to be cleared or every retry reuses
-                the dead password.  The persistent client itself is dropped too,
-                so the next request rebuilds it with fresh credentials.
+                the dead password.
+
+                Runs on paho's network thread, so it only schedules the work: the
+                mutations must be ordered against a concurrent get-or-create, and
+                ``retire()`` calls ``loop_stop()``, which raises if called from
+                the very thread it would join.
                 """
-                for key in ("mqttPassword", "mqttPwd"):
+                _loop.call_soon_threadsafe(_spawn_bg, _retire_and_invalidate(rc))
+
+            async def _retire_and_invalidate(rc) -> None:
+                # Deliberately outside the lock.  These are plain dict writes with
+                # no ordering requirement, and a sibling can be holding the lock
+                # across an HTTP credential fetch - taking it here would stall the
+                # invalidation behind that request's timeout for no benefit.
+                for key in LOGIN_INFO_MQTT_PASSWORD_KEYS:
                     if li.pop(key, None) is not None:
                         _LOGGER.warning(
                             "cleared the cached MQTT password after the broker "
                             "rejected it (rc=%s); it will be re-fetched", rc,
                         )
                 self._smarthome_auth = None
-                if li.get(LOGIN_INFO_PERSISTENT_MQTT_KEY) is pm:
-                    li.pop(LOGIN_INFO_PERSISTENT_MQTT_KEY, None)
+                # The URL response is the one that can carry a server-issued
+                # password (strategy 3); leaving it cached would skip that
+                # fallback entirely on the recovery path.
+                self._mqtt_url = None
+                # Note the refusal so a second failure in quick succession backs
+                # off instead of hammering the credential endpoint.
+                self._mqtt_refused_at = _loop.time()
+                # This one DOES need the lock: it is a compare-and-pop against the
+                # get-or-create above, and without it a rebuild that already read
+                # the slot could have its replacement removed instead of ours.
+                async with lock:
+                    if li.get(LOGIN_INFO_PERSISTENT_MQTT_KEY) is pm:
+                        li.pop(LOGIN_INFO_PERSISTENT_MQTT_KEY, None)
+                # Outside the lock: retire() blocks briefly joining paho's thread.
+                await _loop.run_in_executor(None, pm.retire)
 
             pm = _PersistentMqtt(mqtt_url, mqtt_user, mqtt_pwd, client_id,
                                  on_auth_failure=_invalidate_mqtt_credentials)

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/aidot_cameras/camera/protocol.py

@@ -1434,6 +1434,17 @@ class _PersistentMqtt:
         # the owner can invalidate its cache and re-authenticate.
         self._on_auth_failure = on_auth_failure
         self._auth_failed_reported = False
+        # Latched by the owner when it retires this instance after a refusal.  A
+        # retired client must stop reconnecting: paho's own retry loop would keep
+        # offering the dead password to the vendor's broker for the life of the
+        # process, and callers still holding it would block on a _connected event
+        # that can never set.
+        self._retired = False
+        # Set when the broker refuses our credentials.  Waiters check it so they
+        # fail fast instead of sitting out a 15s timeout on a connection that is
+        # never coming, and _connected stays clear so nothing publishes into a
+        # socket the broker rejected.
+        self._auth_refused = threading.Event()
         self._client = None
         self._host = None
         self._port = None
@@ -1492,7 +1503,11 @@ class _PersistentMqtt:
             self._connected.set()
         elif rc in self._AUTH_REFUSAL_RCS:
             # Stale credential: paho would retry this password forever.  Tell the
-            # owner once so it can invalidate its cache and re-authenticate.
+            # owner once so it can invalidate its cache, retire this client and
+            # re-authenticate.  Unblock anyone waiting on _connected first - they
+            # would otherwise sit out their full timeout for a connection that is
+            # never coming.
+            self._auth_refused.set()
             _LOGGER.warning(
                 "persistent mqtt: broker rejected our credentials (rc=%s) - the "
                 "MQTT password has almost certainly been rotated by another "
@@ -1527,6 +1542,12 @@ class _PersistentMqtt:
                 _LOGGER.debug("persistent mqtt: handler raised", exc_info=True)
 
     def _ensure_started_sync(self, timeout=15.0):
+        # A retired instance must never rebuild: retire() nulls _client, which on
+        # its own would look exactly like "not started yet" and reconnect with the
+        # credential the broker just refused.  Callers still holding a retired
+        # client get a clean False and fall back to a per-op session.
+        if self._retired:
+            return False
         with self._lock:
             if self._client is None:
                 self._client = self._build()
@@ -1538,7 +1559,18 @@ class _PersistentMqtt:
                     return False
                 self._client.loop_start()  # drives keepalive + auto-reconnect
                 self._started = True
-        return self._connected.wait(timeout)
+        # Wait for either outcome.  paho retries a refused CONNACK on its own
+        # schedule, so without watching _auth_refused every caller would burn the
+        # full timeout before the owner gets a chance to re-authenticate.
+        import time as _time
+        deadline = _time.monotonic() + timeout
+        while True:
+            if self._connected.wait(0.1):
+                return True
+            if self._auth_refused.is_set() or self._retired:
+                return False
+            if _time.monotonic() >= deadline:
+                return False
 
     def _subscribe_sync(self, topics):
         new = []
@@ -1646,6 +1678,24 @@ class _PersistentMqtt:
         loop = asyncio.get_running_loop()
         return await loop.run_in_executor(None, functools.partial(_pub))
 
+    def retire(self):
+        """Permanently shut this client down after a credential refusal.
+
+        ``close()`` alone is not enough from the owner's side: paho's retry loop
+        was configured with ``reconnect_delay_set(max_delay=30)``, so a refused
+        client keeps re-offering the dead password to the vendor's broker for the
+        life of the process - and ``_auth_failed_reported`` latches, so it does so
+        silently.  Latching ``_retired`` also releases anyone still waiting on
+        this instance instead of leaving them blocked on a timeout.
+
+        Must not be called from paho's network thread: ``loop_stop()`` there
+        raises ``cannot join current thread``.  The owner schedules it onto the
+        event loop with ``call_soon_threadsafe``.
+        """
+        self._retired = True
+        self._on_auth_failure = None
+        self.close()
+
     def close(self):
         c = self._client
         self._client = None

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/aidot_cameras/client.py

@@ -14,7 +14,8 @@ camera layer and the CLI depend on and upstream does not provide:
 
 * a stable, mutable ``login_info`` dict (see the property below);
 * ``serializable_login_info()`` for persisting it;
-* ``_async_fetch_user_config()``, which fetches the MQTT password cameras need;
+* ``async_ensure_mqtt_credential()``, which fetches the MQTT password cameras
+  need (never persisted - it rotates on every account login);
 * ``async_ensure_token()``, the refresh hook camera HTTP calls invoke on a
   21026 "Please login again";
 * ``async_get_all_device()`` returning cameras (upstream filters them out);
@@ -62,6 +63,10 @@ _LOGGER = logging.getLogger(__name__)
 # other cloud API calls that use owner+token headers.
 _CLOUD_APP_ID = "68"
 
+# Every key /commons/userConfig has been seen to return the MQTT password under.
+# The typo'd "mqqtPwd" is the vendor's, not ours - see the read below.
+_MQTT_PASSWORD_RESPONSE_KEYS = ("mqttPassword", "mqqtPwd", "mqttPwd")
+
 # Strong refs to fire-and-forget tasks: asyncio only keeps weak refs, so a
 # discarded task can be garbage-collected mid-flight (see camera/client.py).
 _BG_TASKS: set = set()
@@ -130,6 +135,26 @@ def _upstream_can_build(device: dict[str, Any]) -> bool:
     return not _aes_key_is_null(device)
 
 
+def _without_mqtt_password(data: Any) -> Any:
+    """A copy of a userConfig response with every MQTT password removed.
+
+    The password is runtime-only by design (it rotates on every account login),
+    so it must not survive inside a nested blob that IS persisted.
+    """
+    if not isinstance(data, dict):
+        return data
+    out = {k: v for k, v in data.items() if k not in _MQTT_PASSWORD_RESPONSE_KEYS}
+    mqtt_block = out.get("mqtt")
+    if isinstance(mqtt_block, dict):
+        out["mqtt"] = {
+            k: v for k, v in mqtt_block.items() if k not in ("password", "pwd")
+        }
+    elif isinstance(mqtt_block, str):
+        # An opaque JSON string that may embed the password; nothing reads it.
+        out.pop("mqtt", None)
+    return out
+
+
 async def _prefetch_ice_config(dc: "CameraDeviceClient") -> None:
     """Background task: warm the HTTP ICE config cache for a camera."""
     try:
@@ -159,6 +184,9 @@ class CameraClient(_UpstreamAidotClient):
         # Single-flight guard so a burst of camera 21026s (all pollers at once)
         # coalesces into ONE token refresh / re-login instead of many.
         self._ensure_token_inflight: "Optional[asyncio.Future]" = None
+        # Same single-flight idiom for the MQTT credential fetch - see
+        # async_ensure_mqtt_credential().
+        self._user_config_inflight: "Optional[asyncio.Future]" = None
         # Upstream keeps the session inside CloudApi only; the camera-side
         # /commons/userConfig fetch needs it directly.
         self.session = session
@@ -180,9 +208,10 @@ class CameraClient(_UpstreamAidotClient):
                 stored = stored.get(CONF_LOGIN_INFO) or {}
             # UserInformation is a strict dataclass: update_from_json() drops
             # any key it has no field for, which is every camera-only key
-            # (mqttPassword, mqttClientId, _userConfigRaw).  Carry them across
-            # a restart on the login_info dict instead, or every reload would
-            # re-fetch MQTT credentials it had already persisted.
+            # (mqttClientId, _userConfigRaw).  Carry those across a restart on
+            # the login_info dict instead.  The MQTT password is deliberately
+            # NOT among them - it is runtime-only, so it is neither written nor
+            # read back, and a camera fetches a fresh one on first use.
             self._login_info.update(
                 {
                     k: v
@@ -210,8 +239,10 @@ class CameraClient(_UpstreamAidotClient):
         Upstream's ``login_info`` is ``user_info.to_dict()``, i.e. a fresh
         ``asdict()`` copy per access, and ``UserInformation`` silently drops any
         key it has no dataclass field for.  The camera layer needs the opposite
-        on both counts: it stores camera-only keys here (mqttPassword,
-        mqttClientId) and it shares ONE dict across every device client on the
+        on both counts: it stores camera-only keys here (mqttClientId, and the
+        rotating mqttPassword, which never leaves memory - see
+        ``serializable_login_info``) and it shares ONE dict across every device
+        client on the
         account so a single persistent-MQTT connection can be cached on it (see
         ``camera/client.py``'s ``_get_persistent_mqtt``).
 
@@ -240,12 +271,23 @@ class CameraClient(_UpstreamAidotClient):
         Anything that persists ``login_info`` - this library's own standalone
         CLI, or an integration's config-entry storage - should call this instead
         of serializing ``login_info`` directly.
+
+        The MQTT password is stripped here rather than only where it is fetched.
+        Confirmed live on a real account: an entry written by an earlier version
+        still had the credential nested inside ``_userConfigRaw``, and that blob
+        is loaded back verbatim from the stored token, so sanitizing only on the
+        way in would carry an already-leaked password forward for the life of the
+        install.  Stripping on the way out is the one choke point every persist
+        goes through.
         """
-        return {
+        out = {
             k: v
             for k, v in self.login_info.items()
             if k not in RUNTIME_ONLY_LOGIN_INFO_KEYS
         }
+        if "_userConfigRaw" in out:
+            out["_userConfigRaw"] = _without_mqtt_password(out["_userConfigRaw"])
+        return out
 
     # ---------------------------------------------------------------- #
     # token lifecycle
@@ -371,6 +413,39 @@ class CameraClient(_UpstreamAidotClient):
         self._schedule_proactive_refresh(self._token_ttl())
         return self.login_info
 
+    async def async_ensure_mqtt_credential(self) -> None:
+        """Fetch a fresh MQTT password, coalescing concurrent callers into one call.
+
+        Camera clients call this whenever the shared ``login_info`` holds no MQTT
+        password, which is the normal state after a restart from a stored token
+        (the password is never persisted) and after the broker refused the one we
+        had.  Several cameras can hit that at once - a stream open racing a
+        command publish - and only the ``_get_persistent_mqtt`` path holds a lock,
+        so without coalescing they would each fire their own ``userConfig``
+        request and each rotate the credential out from under the others.
+        """
+        fut = self._user_config_inflight
+        if fut is not None:
+            await asyncio.shield(fut)
+            return
+        loop = asyncio.get_running_loop()
+        fut = self._user_config_inflight = loop.create_future()
+        try:
+            await self._async_fetch_user_config()
+            if not fut.done():
+                fut.set_result(None)
+        except BaseException as exc:
+            if not fut.done():
+                fut.set_exception(exc)
+            raise
+        finally:
+            if self._user_config_inflight is fut:
+                self._user_config_inflight = None
+            # Nobody may have joined this flight, in which case the exception is
+            # never retrieved and asyncio logs about it at GC time.  Consume it.
+            if fut.done() and not fut.cancelled():
+                fut.exception()
+
     async def _async_fetch_user_config(self) -> None:
         """Fetch /commons/userConfig and store mqttPassword in login_info.
 
@@ -411,8 +486,12 @@ class CameraClient(_UpstreamAidotClient):
             data = body if isinstance(body, dict) else {}
             if isinstance(data.get("data"), dict):
                 data = data["data"]
-            # Always store the raw response for the camera clients to inspect.
-            login_info["_userConfigRaw"] = data
+            # Always store the raw response for the camera clients to inspect -
+            # minus the credential.  Only mqttClientId is ever read back out of
+            # it, and this dict IS persisted (it is not a runtime-only key), so
+            # keeping the password here would write it to storage one level below
+            # the key that was deliberately stripped.
+            login_info["_userConfigRaw"] = _without_mqtt_password(data)
             # Password may be at top level OR nested under an 'mqtt' subkey.
             mqtt_block = data.get("mqtt") or {}
             if isinstance(mqtt_block, str):
@@ -568,6 +647,12 @@ class CameraClient(_UpstreamAidotClient):
             # Let the camera HTTP calls force a token refresh on 21026
             # ("Please login again") and retry.
             device_client.set_token_refresh_cb(self.async_ensure_token)
+            # And let them fetch an MQTT password on demand.  It is never
+            # persisted (it rotates on every account login), so on a restart from
+            # a stored token nothing has fetched one yet.
+            device_client.set_mqtt_credential_refresh_cb(
+                self.async_ensure_mqtt_credential
+            )
             self._device_clients[_device.id] = device_client
             # Pre-warm the ICE config cache so stream open does not block on it.
             _spawn_bg(_prefetch_ice_config(device_client))

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/aidot_cameras/const.py

@@ -54,6 +54,18 @@ BASE_URL = API_URL_TEMPLATE.format(region=DEFAULT_REGION)
 # exclude them first - see CameraClient.serializable_login_info().
 LOGIN_INFO_PERSISTENT_MQTT_KEY = "_persistent_mqtt"
 LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY = "_persistent_mqtt_lock"
+
+# The MQTT password is a CACHE, not state, and must never be persisted.  The
+# broker issues a new one on every account login and allows a single connection,
+# so a stored copy is stale the moment anything else logs in (the phone app is
+# enough).  Persisting it made the failure survive restarts: the credential
+# fetch prefers the cached value, so a stale one was reloaded from disk on every
+# start and the broker refused it forever (rc=134), which killed camera
+# signaling while snapshots kept working.  Keeping it runtime-only means each
+# start fetches a fresh one - a single extra HTTP call.
+LOGIN_INFO_MQTT_PASSWORD_KEYS = ("mqttPassword", "mqttPwd")
+
 RUNTIME_ONLY_LOGIN_INFO_KEYS = frozenset(
-    {LOGIN_INFO_PERSISTENT_MQTT_KEY, LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY}
+    {LOGIN_INFO_PERSISTENT_MQTT_KEY, LOGIN_INFO_PERSISTENT_MQTT_LOCK_KEY,
+     *LOGIN_INFO_MQTT_PASSWORD_KEYS}
 )

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/aidot_cameras/device_client.py

@@ -21,6 +21,7 @@ import logging
 from typing import Any, Optional
 
 from aidot.device_client import DeviceClient as _UpstreamDeviceClient
+from aidot.device_client import DeviceState as _UpstreamDeviceState
 from aidot.device_client import DeviceInformation as _UpstreamDeviceInformation
 from aidot.device_client import DeviceStatusData as _UpstreamDeviceStatusData
 from aidot.models.auth_model import UserInformation
@@ -53,6 +54,11 @@ _LOGGER = logging.getLogger(__name__)
 # undeclared transitive dependency.  This is upstream's class, not a subclass.
 DeviceClient = _UpstreamDeviceClient
 
+# Same reasoning for the LAN session state enum: a consumer that wants to know
+# whether a device client is authenticated has to compare against it, and
+# reaching into `aidot` for it means depending on a package it never declared.
+DeviceState = _UpstreamDeviceState
+
 
 class DeviceStatusData(_UpstreamDeviceStatusData):
     """Upstream status plus the carried `active_color_mode` tracking."""

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "python-aidot-cameras"
-version = "0.12.2"
+version = "0.12.4"
 description = "Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)"
 readme = "README.md"
 license = "MIT"

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4/python_aidot_cameras.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-aidot-cameras
-Version: 0.12.2
+Version: 0.12.4
 Summary: Control AiDot/Leedarson WiFi lights and cameras (WebRTC streaming, two-way audio, PTZ, controls)
 Author-email: cbrightly <chris.brightly@gmail.com>
 License-Expression: MIT

{python_aidot_cameras-0.12.2 → python_aidot_cameras-0.12.4}/python_aidot_cameras.egg-info/SOURCES.txt

@@ -91,7 +91,9 @@ tests/test_light_active_color_mode.py
 tests/test_live_stream_param.py
 tests/test_logging_caps.py
 tests/test_motion_poll.py
+tests/test_mqtt_credential_refetch.py
 tests/test_mqtt_credential_self_heal.py
+tests/test_mqtt_password_not_persisted.py
 tests/test_mqtt_session_reconnect.py
 tests/test_narrow_pc_ice.py
 tests/test_no_undefined_names.py