MikeFaith/pi-pm3
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Phase 4 enhancements: WebSocket auth, HTTPS UI, plugin hooks, build fixes

Browse Source 
Security:
- Add token-based WebSocket authentication (closes critical security gap)
  - In-memory token store with 24h TTL (token_store.py)
  - POST /api/auth/token exchanges Basic Auth for WS token
  - GET /api/auth/status public endpoint for auth check
  - WebSocket validates token query param, rejects with close code 4401
  - Frontend LoginPrompt modal for credential entry
  - WebSocket manager handles full auth flow with auth_required state
  - No-op when AUTH_ENABLED=false (preserves existing behavior)

HTTPS:
- Wire HTTPS toggle in Settings UI (POST /api/system/ssl/toggle)
- Add certificate regeneration button
- Display SSL info (expiration, SANs, SHA256 fingerprint)

Plugins:
- Wire trigger_hook("pm3_command") in PM3 service
- Wire trigger_hook("update_check") in update manager

Build/Infrastructure:
- Enable NetworkManager in pi-gen AP setup stage
- Add HF booster board detection patch for Proxmark3
- Update LED PWM control patch
- Fix BLE adapter, UPS drivers, WiFi manager improvements
- Update HTTPS support stage script

Documentation:
- Update PROJECT_STATUS.md and IMPLEMENTATION_PRIORITIES.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
michael
2026-03-03 11:45:11 -08:00
parent 4f35df1781
commit 2ec89041ef
24 changed files with 1249 additions and 362 deletions
Download Patch File Download Diff File Expand all files Collapse all files

299
IMPLEMENTATION_PRIORITIES.md
View File

@@ -1,239 +1,144 @@
# Implementation Priorities - Updated
**Date**: 2025-11-26
**Status**: Active Development
**Date**: 2026-03-03
**Status**: Active Development - Phase 4 Enhancement
---
## 🔴 PRIORITY 1: Power Management (BEFORE PI TESTING)
## 📊 Current Feature Status (2026-03-03)
**Why Critical**: System behavior must be defined for UPS-present and UPS-absent scenarios before deploying to hardware.
### Tasks
#### 1.1 UPS Manager - Power Restrictions Method ⚠️ CRITICAL
- **File**: `app/backend/managers/ups_manager.py`
- **Action**: Add `get_power_restrictions()` method
- **Estimated Time**: 30 minutes
- **Blocks**: All hardware testing
**Implementation**:
```python
def get_power_restrictions(self) -> Dict[str, Any]:
"""Get current power restrictions based on hardware state."""
# See POWER_MANAGEMENT_POLICY.md for full implementation
```
#### 1.2 System API - Power Restrictions Endpoint
- **File**: `app/backend/api/system.py`
- **Action**: Add `GET /api/system/power/restrictions` endpoint
- **Estimated Time**: 15 minutes
- **Depends on**: 1.1
**Implementation**:
```python
@router.get("/power/restrictions")
async def get_power_restrictions():
"""Get current power restrictions."""
# See POWER_MANAGEMENT_POLICY.md
```
#### 1.3 Header Widget - UPS Missing Warning
- **File**: Multiple (plugin_manager, ups_manager)
- **Action**: Register widget when UPS not detected
- **Estimated Time**: 20 minutes
- **Depends on**: Header widget system (can defer to Phase 2)
#### 1.4 Documentation Update
- **Files**:
- `README.md` - Add power management section
- `GETTING_STARTED.md` - Mention UPS optional
- `PROJECT_STATUS.md` - Update status
- **Estimated Time**: 15 minutes
**Total Time**: ~1.5 hours for Phase 1 (core functionality)
| Feature | Status | Notes |
|---------|--------|-------|
| **HTTPS** | ✅ 100% | Toggle, cert info, regenerate all working |
| **Authentication** | 40% | Basic + WS token auth done; JWT/RBAC remaining |
| **Plugin System** | 85% | Hooks wired; remote install remaining |
---
## 🟡 PRIORITY 2: Header Widget System (OPTIONAL FOR TESTING)
## ✅ COMPLETED: Quick Wins (Done 2026-03-03)
**Why Important**: Good UX, but not required for basic Pi testing
### ~~1.1 HTTPS Settings UI~~ ✅ DONE
- [x] Enable/Disable toggle via `POST /api/system/ssl/toggle`
- [x] Regenerate Certificate button
- [x] SSL info display (expiration, SANs, SHA256 fingerprint)
### Tasks
#### 2.1 Backend Widget Infrastructure
- Add `HeaderWidget` dataclass to plugin_manager
- Add widget registry methods
- Add dismissed widgets tracking
- **Estimated Time**: 1 hour
#### 2.2 API Endpoints
- `GET /api/system/widgets`
- `POST /api/system/widgets/{id}/dismiss`
- **Estimated Time**: 30 minutes
#### 2.3 Frontend Component
- Create `HeaderWidgets.tsx`
- Add CSS styles
- Integrate into `root.tsx`
- **Estimated Time**: 1.5 hours
#### 2.4 UPS Integration
- Register widget on missing hardware
- Register widget on low battery
- **Estimated Time**: 30 minutes
**Total Time**: ~3.5 hours
### ~~1.2 Plugin Hook Wiring~~ ✅ DONE
- [x] `trigger_hook("pm3_command", command)` in `pm3_service.py`
- [x] `trigger_hook("update_check")` in `update_manager.py`
---
## 🟢 PRIORITY 3: Pi-gen Build Testing (READY TO GO)
## ✅ ~~PRIORITY 2: WebSocket Security~~ DONE (2026-03-03)
**Status**: Scripts complete, ready for build
### Tasks
#### 3.1 Test Build
- Run `./build-image.sh quick`
- Verify PM3 client builds
- Verify Python bindings work
- **Estimated Time**: 30 minutes (build time 5-10 min)
#### 3.2 Fix Issues
- Address any build failures
- Update scripts as needed
- **Estimated Time**: Variable
#### 3.3 Full Build
- Run `./build-image.sh full`
- Create complete bootable image
- **Estimated Time**: 1-2 hours (build time)
**Total Time**: 2-3 hours
- [x] Token store with 24h TTL (`app/backend/api/token_store.py`)
- [x] `POST /api/auth/token` - exchanges Basic Auth for WS token
- [x] `GET /api/auth/status` - public endpoint to check if auth enabled
- [x] WebSocket validates token query param, closes with 4401 if invalid
- [x] Frontend fetches token, passes as `?token=` on WS URL
- [x] LoginPrompt modal shown when WS returns auth_required
- [x] No-op when AUTH_ENABLED=false (existing behavior preserved)
---
## 🔵 PRIORITY 4: Hardware Testing
## 🟢 PRIORITY 3: Full Authentication System (~3-4 weeks)
**Prerequisites**: Priorities 1 & 3 complete
**Why Important:** Required for production deployment, but large effort.
### 4.1 Deploy to Pi Zero 2 W
- Flash SD card with custom image
- Boot and verify services start
- Test web interface access
### Phase A: JWT Implementation (~3-5 days)
- [ ] Implement JWT token generation/validation
- [ ] Create `/api/auth/login` endpoint
- [ ] Create `/api/auth/logout` endpoint
- [ ] Token refresh mechanism
### 4.2 Test Without UPS
- Verify power restrictions return "assumed AC"
- Verify header widget shows warning
- Verify no unexpected restrictions
### Phase B: Login UI (~2-3 days)
- [ ] Create login page (`app/frontend/app/routes/login.tsx`)
- [ ] Auth context/state management
- [ ] Protected route handling
- [ ] 401 error handling and redirect
### 4.3 Test With UPS (if available)
- Connect UPS HAT
- Verify battery monitoring works
- Test power restrictions on battery
- Test AC power detection
### Phase C: User Management (~3-5 days)
- [ ] User database schema
- [ ] Password hashing (bcrypt/argon2)
- [ ] User CRUD endpoints
- [ ] Multi-user support
### 4.4 Test PM3 Operations
- Connect PM3 device
- Execute commands
- Test multi-device (if available)
**Total Time**: 2-4 hours
### Phase D: RBAC (~3-5 days)
- [ ] Role definitions (admin, user, guest)
- [ ] Permission system
- [ ] Endpoint-level authorization
---
## 🟣 PRIORITY 5: Future Enhancements (POST-MVP)
## 🔵 PRIORITY 4: Plugin Ecosystem (~2-3 weeks)
- Firmware flashing UI (Sprint 3)
- Advanced header widgets
- Plugin ecosystem
- Multi-device hardware testing
### 4.1 Remote Installation (~1 week)
- [ ] GitHub releases integration
- [ ] Download/extract/verify plugins
- [ ] pip dependency installation
### 4.2 Permission Consent UI (~2-3 days)
- [ ] Show permissions before enabling
- [ ] Consent dialog with accept/reject
### 4.3 Plugin Configuration (~2-3 days)
- [ ] Plugin settings persistence
- [ ] Plugin-specific config UI
---
## Recommended Order
## ✅ COMPLETED (Power Management)
### Session Today: Power Management
1. ✅ Plans A, B, C (cloud-init, PYTHONPATH, port conflict) - DONE
2. ✅ Header widget system design - DONE
3. ✅ Power management policy design - DONE
4. **⏭️ NEXT: Implement Priority 1 (Power Management)**
### Next Session: Build & Deploy
1. Test pi-gen build (Priority 3)
2. Deploy to Pi hardware (Priority 4)
3. Verify power management works
4. Test PM3 operations
### Future Session: Polish
1. Implement header widgets (Priority 2)
2. Add firmware flashing (Sprint 3)
3. Advanced features
### ~~PRIORITY 1: Power Management~~ ✅ DONE (2025-11-26)
- [x] `get_power_restrictions()` method implemented
- [x] API endpoint `/api/system/power/restrictions` working
- [x] Returns correct response when UPS not detected
- [x] Returns correct response when UPS on AC
- [x] Returns correct response when UPS on battery
- [x] Documentation updated
---
## Quick Implementation Guide
## 🎯 Recommended Implementation Order
### Step 1: Add Power Restrictions to UPS Manager
### ✅ Done (2026-03-03)
1. ~~HTTPS Settings UI~~ - Complete
2. ~~Plugin Hook Wiring~~ - Complete
3. ~~WebSocket Auth~~ - Complete
```bash
# Edit UPS manager
nano app/backend/managers/ups_manager.py
# Add get_power_restrictions() method
# See POWER_MANAGEMENT_POLICY.md lines 49-120
```
### Step 2: Add API Endpoint
```bash
# Edit system API
nano app/backend/api/system.py
# Add /power/restrictions endpoint
# See POWER_MANAGEMENT_POLICY.md lines 166-180
```
### Step 3: Test Locally
```bash
# Start backend
cd app/backend
python -m uvicorn main:app --reload
# Test endpoint
curl http://localhost:8000/api/system/power/restrictions
```
### Step 4: Update Docs
```bash
# Update PROJECT_STATUS.md
# Update README.md with power management info
```
### Next Up
1. **JWT for REST endpoints** - Replace Basic Auth with proper tokens
2. **Login Page** - Full auth UI (currently only WS login prompt)
3. **Full Auth System** - Multi-user, RBAC
---
## Success Criteria
## 📁 Key Files Reference
### Priority 1 Complete When:
- [x] Power management policy documented
- [ ] `get_power_restrictions()` method implemented
- [ ] API endpoint `/api/system/power/restrictions` working
- [ ] Returns correct response when UPS not detected
- [ ] Returns correct response when UPS on AC
- [ ] Returns correct response when UPS on battery
- [ ] Documentation updated
### HTTPS
| File | Lines | Purpose |
|------|-------|---------|
| `scripts/generate-ssl-cert.sh` | 1-115 | EC P-256 certificate generation |
| `scripts/configure-nginx.sh` | 1-91 | nginx config switching |
| `nginx/dangerous-pi-https.conf` | 1-161 | TLS 1.2/1.3, HSTS, captive portal |
| `app/backend/api/system.py` | 578-794 | SSL API endpoints |
| `app/frontend/app/routes/settings.tsx` | 381-394 | UI display (currently read-only) |
### Ready for Pi Testing When:
- [ ] Priority 1 complete
- [ ] Priority 3 complete (build tested)
- [ ] Services start correctly
- [ ] Web interface accessible
- [ ] No Python import errors
### Authentication
| File | Purpose |
|------|---------|
| `app/backend/api/auth.py` | Basic HTTP auth + token endpoints |
| `app/backend/api/token_store.py` | In-memory WS auth token store (24h TTL) |
| `app/backend/config.py:54` | AUTH_ENABLED setting |
| `app/backend/websocket/routes.py` | WebSocket with token validation |
| `app/frontend/app/hooks/useWebSocket.ts` | WS manager with auth flow |
| `app/frontend/app/components/LoginPrompt.tsx` | Login modal for WS auth |
---
**Current Status**: Priority 1 design complete, implementation needed (~1.5 hours)
**Blocker**: Must implement before Pi deployment
**Next Action**: Implement `get_power_restrictions()` method
### Plugins
| File | Purpose |
|------|---------|
| `app/backend/managers/plugin_manager.py` | Full plugin framework (804 lines) |
| `app/backend/api/plugins.py` | 7 CRUD endpoints |
| `app/backend/services/pm3_service.py` | Triggers `pm3_command` hook |
| `app/backend/managers/update_manager.py` | Triggers `update_check` hook |
| `app/plugins/hello_world/main.py` | Example hook registration |
| `app/frontend/app/routes/settings.tsx` | Plugin management UI |