kleidos/test/web/test_admin_sd_handlers/ at main · jmrp.io/kleidos · Tangled

jmrp.io / kleidos

0

[READ-ONLY] Mirror of https://github.com/jmrplens/kleidos. Kleidos — Hardware BLE password manager for ESP32-S3 (M5StickC Plus2, StickS3, M5Stack Gray, T-Deck, Cardputer) jmrplens.github.io/kleidos/

0

kleidos / test / web / test_admin_sd_handlers /

at main 13 files

José M. Requena Plens Extend the record to its final shape, revive the dead panels, honor the index 5w ago

admin_sd_handlers_amalgam.cpp

Extend the record to its final shape, revive the dead panels, honor the index Three firmware waves of the gap-report program, built in parallel worktrees against the same tip and integrated with both-sides conflict resolution (two stitch errors — an unopened Doxygen comment and a lost closing brace — were caught by the compiler, as intended). Wave 1 — the record's final shape. CredentialRecord gains flags (bit0 = auto-submit: username, TAB, password, ENTER as one BLE action — and the trailing ENTER is now conditional where it used to be unconditional), three typed custom fields (label/value/hidden — hidden values ride behind the same plaintext-consent header as passwords), a group id, and TOTP entries gain an account label plus the algorithm byte everywhere. Groups are a 100-slot encrypted name table (one littlefs block) managed over GET/POST/DELETE /api/groups — deleting a group only clears labels, never credentials. The index row carries group, a derived domain column and real mtime, with names widened to 32 chars; brand is populated at save time from the url, ending the per-row decrypt the device paid for logos. URL capacity rises to 192 (the owner's real data maxed at 190), and every save/import reports per-field truncation instead of silently clamping. Backup, restore, the normalized importer and the CSV importer round-trip all of it; the importer maps 1Password vaults and CSV folder/tags/vault columns into groups server-side. Wave 2 — six dead routes live: /api/ota/status (the whole Firmware panel keyed on it), /api/vault/reindex, /api/time/diag (RTC coin-cell health), the GPS trio (gated to boards that have one), NTP-sync-on-exit through the AdminMode teardown choke point, and the staged-SD firmware apply behind the confirm gate. Both full-replace restores now demand the unlock secret (X-Unlock-Secret) — a backup passphrase proves nothing about owning the live vault — and the restore body cap is computed from the device's own backup bound instead of a 64 KB literal. Wave 3 — the UI stops lying: the audit export honors Accept: text/csv with real CSV, the web CSV importer honors the type column (Bitwarden non-logins skipped and counted), LastPass and Proton Pass get real header signatures, /api/runtime-stats is gone, AutoLockMode appears on the six boards that hid a working handler, and the device vault lists honor favorite-first plus manual order with an allocation-free comparator. Integration extras: the index envelope buffers and the rekey crypto scratch now live on the heap (the rekey frame was already past the 32 KB worker stack at the current 200-slot caps — the latent overflow the dimensioning study flagged); core2_v13's capacity-scaled view-cache block moves to PSRAM .ext_ram.bss (keys and passwords stay in internal DRAM), un-breaking its 48-byte link margin; the groups list distinguishes a corrupt table from an empty one; custom:null is refused rather than destructive; and the three amalgam suites learned the new seams, including rebasing an unreachable handler-413 assertion onto the gate-logic suite that actually pins the bound. Builds: sticks3_debug, tdeck, cardputer, m5stickc_plus1_debug, core2_v13_debug (now with SPIRAM bss). Native: full suite green with nine new suites registered. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

1 month ago

credential_repository_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

device_stubs.cpp

Extend the record to its final shape, revive the dead panels, honor the index Three firmware waves of the gap-report program, built in parallel worktrees against the same tip and integrated with both-sides conflict resolution (two stitch errors — an unopened Doxygen comment and a lost closing brace — were caught by the compiler, as intended). Wave 1 — the record's final shape. CredentialRecord gains flags (bit0 = auto-submit: username, TAB, password, ENTER as one BLE action — and the trailing ENTER is now conditional where it used to be unconditional), three typed custom fields (label/value/hidden — hidden values ride behind the same plaintext-consent header as passwords), a group id, and TOTP entries gain an account label plus the algorithm byte everywhere. Groups are a 100-slot encrypted name table (one littlefs block) managed over GET/POST/DELETE /api/groups — deleting a group only clears labels, never credentials. The index row carries group, a derived domain column and real mtime, with names widened to 32 chars; brand is populated at save time from the url, ending the per-row decrypt the device paid for logos. URL capacity rises to 192 (the owner's real data maxed at 190), and every save/import reports per-field truncation instead of silently clamping. Backup, restore, the normalized importer and the CSV importer round-trip all of it; the importer maps 1Password vaults and CSV folder/tags/vault columns into groups server-side. Wave 2 — six dead routes live: /api/ota/status (the whole Firmware panel keyed on it), /api/vault/reindex, /api/time/diag (RTC coin-cell health), the GPS trio (gated to boards that have one), NTP-sync-on-exit through the AdminMode teardown choke point, and the staged-SD firmware apply behind the confirm gate. Both full-replace restores now demand the unlock secret (X-Unlock-Secret) — a backup passphrase proves nothing about owning the live vault — and the restore body cap is computed from the device's own backup bound instead of a 64 KB literal. Wave 3 — the UI stops lying: the audit export honors Accept: text/csv with real CSV, the web CSV importer honors the type column (Bitwarden non-logins skipped and counted), LastPass and Proton Pass get real header signatures, /api/runtime-stats is gone, AutoLockMode appears on the six boards that hid a working handler, and the device vault lists honor favorite-first plus manual order with an allocation-free comparator. Integration extras: the index envelope buffers and the rekey crypto scratch now live on the heap (the rekey frame was already past the 32 KB worker stack at the current 200-slot caps — the latent overflow the dimensioning study flagged); core2_v13's capacity-scaled view-cache block moves to PSRAM .ext_ram.bss (keys and passwords stay in internal DRAM), un-breaking its 48-byte link margin; the groups list distinguishes a corrupt table from an empty one; custom:null is refused rather than destructive; and the three amalgam suites learned the new seams, including rebasing an unreachable handler-413 assertion onto the gate-logic suite that actually pins the bound. Builds: sticks3_debug, tdeck, cardputer, m5stickc_plus1_debug, core2_v13_debug (now with SPIRAM bss). Native: full suite green with nine new suites registered. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

1 month ago

group_table_amalgam.cpp

Extend the record to its final shape, revive the dead panels, honor the index Three firmware waves of the gap-report program, built in parallel worktrees against the same tip and integrated with both-sides conflict resolution (two stitch errors — an unopened Doxygen comment and a lost closing brace — were caught by the compiler, as intended). Wave 1 — the record's final shape. CredentialRecord gains flags (bit0 = auto-submit: username, TAB, password, ENTER as one BLE action — and the trailing ENTER is now conditional where it used to be unconditional), three typed custom fields (label/value/hidden — hidden values ride behind the same plaintext-consent header as passwords), a group id, and TOTP entries gain an account label plus the algorithm byte everywhere. Groups are a 100-slot encrypted name table (one littlefs block) managed over GET/POST/DELETE /api/groups — deleting a group only clears labels, never credentials. The index row carries group, a derived domain column and real mtime, with names widened to 32 chars; brand is populated at save time from the url, ending the per-row decrypt the device paid for logos. URL capacity rises to 192 (the owner's real data maxed at 190), and every save/import reports per-field truncation instead of silently clamping. Backup, restore, the normalized importer and the CSV importer round-trip all of it; the importer maps 1Password vaults and CSV folder/tags/vault columns into groups server-side. Wave 2 — six dead routes live: /api/ota/status (the whole Firmware panel keyed on it), /api/vault/reindex, /api/time/diag (RTC coin-cell health), the GPS trio (gated to boards that have one), NTP-sync-on-exit through the AdminMode teardown choke point, and the staged-SD firmware apply behind the confirm gate. Both full-replace restores now demand the unlock secret (X-Unlock-Secret) — a backup passphrase proves nothing about owning the live vault — and the restore body cap is computed from the device's own backup bound instead of a 64 KB literal. Wave 3 — the UI stops lying: the audit export honors Accept: text/csv with real CSV, the web CSV importer honors the type column (Bitwarden non-logins skipped and counted), LastPass and Proton Pass get real header signatures, /api/runtime-stats is gone, AutoLockMode appears on the six boards that hid a working handler, and the device vault lists honor favorite-first plus manual order with an allocation-free comparator. Integration extras: the index envelope buffers and the rekey crypto scratch now live on the heap (the rekey frame was already past the 32 KB worker stack at the current 200-slot caps — the latent overflow the dimensioning study flagged); core2_v13's capacity-scaled view-cache block moves to PSRAM .ext_ram.bss (keys and passwords stay in internal DRAM), un-breaking its 48-byte link margin; the groups list distinguishes a corrupt table from an empty one; custom:null is refused rather than destructive; and the three amalgam suites learned the new seams, including rebasing an unreachable handler-413 assertion onto the gate-logic suite that actually pins the bound. Builds: sticks3_debug, tdeck, cardputer, m5stickc_plus1_debug, core2_v13_debug (now with SPIRAM bss). Native: full suite green with nine new suites registered. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

1 month ago

sd_vault_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

test_admin_sd_handlers.cpp

Finish the admin portal surface and give destruction one bar everywhere The six endpoint groups the portal rendered nothing for are now firmware, one module per file, each behind the auth policy its usage demands (polled reads are SessionReadOnly so a dashboard cannot hold the radio up): - admin_system_api: /api/system{,/partitions,/hardware}, selftest, beep, reboot and sleep through the FSM flag seam. Hardware rows carry PROBED chip identities published from Core 1 through atomics — a build flag selects a code path, it does not name a part (the StickS3 PMIC lesson). - admin_totp_api: live one-time codes gated on clock trust before any vault I/O, answering the whole validity window (remaining_s) so the page polls once per period instead of once per second. - admin_credentials_api: the list gains user/favorite/order/hasTotp, and every delete — single or batch — is prepare (unlock secret) → commit (one-shot nonce), executed as ONE meta commit and ONE index rewrite by VaultStore::deleteCredentialBatch. The bare DELETE route is gone. - admin_ble_api: device name + per-bond rename (POST, not PATCH — the HTTP facade deliberately stays GET/POST/DELETE), with a bounded name-store flush so a rename survives a power cycle. - SD restore wizard: stage → gated commit (unlock secret + imported PIN + X-Confirm-Restore) → idempotent abort, with foreign work factors clamped to [1000, 4x local] and session teardown on any failure past the point of no return. The ungated one-shot import route is removed. - admin_telemetry_api: on-demand battery sampler with a columnar chunked body, ownership-guarded so a portal claim can never stop a debug-console capture, drained on the UI core with a bounded loop. Destruction now has one bar everywhere: credentials, TOTP entries (new), SD keyfile/format, wipe, factory reset and the restore commit all demand proof of the unlock secret through admin_confirm.h. BLE bonds stay the deliberate exception — re-pairing is recoverable. The device side gains the owner-facing half of the pinned admin network: a "Fixed admin network" toggle (OptionId::AdminNetworkFixed, key ap_fixed) that arms a pin request; the password is still drawn only in generateApPassword(), before esp_wifi_start(), where the bootloader entropy source is sound — the toggle records intent, the draw stays in its one proven-safe place. The SPA follows every contract (columnar telemetry, the restore 401-with- restored:true success screen, per-id delete outcomes), the mock mirrors them, and portal_checks gains seven second-wave HIL checks including "the retired routes stay retired" and "secretless destruction is refused before any KDF". The batch pays its own DRAM bill: the fleet build caught core2_v13_debug overflowing dram0 by 344 bytes (classic-ESP32 debug links with a few hundred bytes of headroom). Three trims inside the new modules return ~405 bytes of permanent .bss: the telemetry channel registry is sized to what the fleet registers (8 slots, not 24), the staged delete batch is heap-allocated on first use, and the device-information observations (power snapshot, chip probes, storage figures) live in one heap block allocated on first touch — they are session observations, not boot state. The 32 KB vault state and 12.5 KB app context stay deliberately static: key material must not reach PSRAM, and their fixed reservation is the linker's honest canary. Native: 2705/2705. Builds: full 43-env fleet (the two native test envs that pio run cannot build alone are the known Unity flake), then core2_v13_debug, sticks3_debug, m5stickc_plus1_debug and core2_v13 re-verified after the DRAM trims. Guards and pre-commit hooks all green. Claude-Session: https://claude.ai/code/session_01Q2J5gQSFMTDLVzPUYog51r

1 month ago

totp_repository_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_backup_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_import_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_index_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_rekey_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

vault_store_amalgam.cpp

Refresh RTC docs and consolidate the native test amalgams Docs: re-sync every stale file:line cite in rtc-internal.md to durable symbol anchors, document the R1 atomic setDateTime + cached trust reads, add the RC-drift consequence for TOTP and the DST transition-window caveat for the set-clock flow, rewrite the HIL section for the NAV SETCLOCK / TOTPCODE hooks, and describe the R4 shared clock-chip widget. Fix the stale line refs and the pre-WS-A lockout wording in pin-and-bruteforce.md. Tests: consolidate the 88 duplicate *_amalgam.cpp bodies into 8 shared .inc files under test/support/amalgams/ (per-suite TUs stay as 3-line shims so each suite binary still links its own copy); the 5 unique amalgams are untouched. Native suite unchanged: 1633/1633. Doxygen: list the clock-chip widget in the ui_widgets group and join set_clock_controller.h to the states group via the @addtogroup wrap. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago

wifi_repository_amalgam.cpp

Add the WiFi-station store and NTP clock-sync backend From Settings (vault unlocked) the device can join a saved WiFi network as a station, sync the clock via one-shot SNTP against trusted public NTP servers, and always disconnect. Servers are LITERAL IPv4 only — never a hostname, never DNS (esp_sntp is fed parsed addresses; a strict dotted-quad validator gates every entry). Defaults are Cloudflare (162.159.200.1, 162.159.200.123), Google (216.239.35.0) and NIST (132.163.97.1), tried in order; the user can persist an override list of up to four IPs so dead defaults never require a firmware update. Saved networks (SSID+PSK, max 8) and the NTP server list live in a new wifi.bin vault module using the standard envelope (AES-256-CBC + HMAC-SHA256, encrypt-then-MAC, verify-before-decrypt, type-bound), only readable with the vault unlocked, staged through the crash-safe rekey, and crypto-erased by wipeAll. PSKs are zeroized after use and never logged or echoed. The sync engine runs on a Core-0 worker: BLE off, join the strongest saved network, query servers in order, sanity-clamp the epoch and never step backward past an armed lockout, commit via the rtc facade with a new display-only src=ntp tag — clock TRUST is never elevated (NTP is unauthenticated; the forward-jump lockout fail-closed model is the spoofing defense) — then a RAII station guard tears WiFi down and restores BLE on every exit path. The station facade stays a generic transport for future consumers (on-device OTA). Debug console gains WIFISCAN / WIFIADD / WIFILIST / WIFIDEL, NTPSYNC (GPSSYNC-style blocking flow with machine-checkable teardown acks) and NTPSERVERS? / NTPSERVERSET / NTPSERVERCLEAR — all DEBUG_SERIAL_BUTTONS gated. HIL-verified end to end on the StickS3: real sync against the default servers, user-list precedence across reboot, TEST-NET failure paths, trust unchanged, BLE restored, store left clean. Claude-Session: https://claude.ai/code/session_01SV58JXhfxhhc9DC6vdjBo4

2 months ago