Keep this LAN and stopped-server fixture scoped to Room HTTP, assert that setup mode cannot enter its peripheral stub, and retain the actual AP rekey regressions in the management-password suite. The broader CI job exposed the missing dependency after the new tick hook.
Validated all 43 methods consuming the affected tick paths, all 18 remaining commands in the failed CI step, and 93 additional CLI, routing and persistence regression methods.
Use the committed node credential for setup WiFi, WebConfig and browser OTA. Add persistent ESP32 WiFi Companion management credentials without changing preferences layouts, revoke stale browser sessions on rotation, retain scoped save receipts, and coordinate credential changes with flash uploads. Keep external-service credentials and trusted TCP protocol compatibility independent. Update live join QR codes, failure handling and documentation.
Validated 51 native cases, 158 related host and browser methods, and serial Full V4 Companion, Station G3 Repeater, ESP32-C6 Room Server and V4 Sensor firmware builds.
Stage STM32 preference prefixes and checked footers in one atomic image, reject declared tails that encounter premature EOF, and share the typed CLI rollback helper. Use the proven Wio Mini code-layout flags on Wio E5 and Tiny Relay without changing features or memory boundaries. All four STM32 targets and RAK4631 Full pass at the full 1.18.0.1 release version length.
Deduplicate validation and preserve the published preference bytes and transactional saves. Correct Ikoka Handheld Companion flash bounds and document QSPI Room migration. Qualify STM32 and RAK4631 at the full 1.18.0.1 release version length.
Integrate fractional Companion timezones and conditional Bluetooth pages while preserving the existing preference byte layout, transactional saves, and Full transport selector. Add migration, rollback, invalid-value, and UI profile regressions.
Upstream MeshCore, and this fork up to v1.17.1.6 except ESP32 Full
builds, rewrote /contacts3 in place, one record after another. A reset
or a full volume during that save leaves whole records followed by part
of the next one. Upstream reads such a file up to the short read. Here
readableContactFile() treats any size that is not a multiple of 152
bytes as unreadable, and since 2311160a9 the bounded recovery then
deletes /contacts3. On the first boot after an upgrade, three whole
records plus one stray byte became zero contacts.
Invariant: on ESP32, RP2040 and STM32, when /contacts3 holds at least
one whole record followed by part of one, and /contacts3.bak does not
exist, the whole records load and nothing is written or deleted at
boot. The next ordinary save publishes only whole records through the
existing transaction. Unchanged: whole-record images; a backup still
wins over an incomplete primary, including a backup that is unreadable
or of unknown presence at boot, which keeps its retry at the recovery
boundary; read errors keep the bounded recovery; a file with no whole
record is still discarded; nRF52 is not touched.
selectContactFile() makes this check only after the strict checks of
both names fail, through a new partial_tail mode of
readableContactFile(). loadContacts() drops its own size check; its
whole-record loop bound already stops before the tail.
Add test_companion_contact_partial_tail.py, which runs the real load,
recovery and save paths on the uncached ESP32, RP2040 and STM32
harness and on the ESP32 Full cache harness under ASan/UBSan. On the
old code all four fail with zero contacts and /contacts3 deleted. It
catches 14 of 15 mutations of this change, including a full revert;
the other drops a guard whose value is read only when the file handle
is valid. Two cases in the uncached storage fixture used a one-byte
truncation as their unreadable image; they now use a file shorter than
one record, so they still exercise the discard path.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
POST /api/room checked the room password on every request with no failure
limit, and a browser may send a new identity token each time. Any host that
reached WebConfig could guess the room admin password, which is also the
radio and /api/login admin password, at main-loop speed.
One budget now covers all browser tokens, with /api/login's numbers: at most
five distinct wrong passwords in each thirty-second window. After that, a
request carrying a password is refused without checking it until the window
ends. Wrong passwords count in read-only rooms too. Empty passwords are never
counted or refused, so public read-only access keeps working. The last four
wrong passwords are remembered by 8-byte SHA-256 digest and not counted
again, so a tab still polling with an old or mistyped password cannot use up
the budget. Successful sign-ins do not refund failures. Radio login is
unchanged.
test_room_web_service.py gains PASSWORD_LIMIT, which runs the real
processRoomRequest: refusal after five failures from five tokens; identical
replies for wrong, guest and admin passwords while refused, with no password
check (calls to authorizeRoomLogin are counted); no lock extension from 300
refused requests; the 29999/30000 ms boundary and the first window after
boot; read-only and empty-password cases; no refund on success; repeated,
rotating and read-only stale passwords; slow distinct failures ageing out;
and a guard that the digest ring stays in bounds. It fails on the previous
processRoomRequest at the sixth guess.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
/api/login locked every client for 30 s after five failures from anyone.
Anyone who could reach the login page could keep the owner locked out by
failing on purpose. If no login succeeded after a lockout, the lock also
returned from 2^31 to 2^32 ms (about 24.9 to 49.7 days) later, because the
deadline was never cleared and was compared as a signed difference.
Count failures per remote address instead. Five failures lock that address
for 30 s, as before. A shared budget caps failures from all addresses
together, so changing address does not add guesses: it holds six failures
and refills one every 6 s, the old global rate, so one failing address can
never empty it on its own. While it is empty every client waits, as before.
Lock times are measured as elapsed time.
The policy is a pure header, WebConfigLoginThrottle.h.
test_webconfig_login_throttle.py runs it directly (isolation, boundaries,
one-hour rate bounds, millis() half-wrap, saturation, eviction) and runs the
real handleLogin with ArduinoJson under ASan/UBSan. Putting every client on
one key, as the old code did, fails the handler test.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mikecarper