Implement JWT-authenticated remote serial command execution over MQTT
with comprehensive security measures:
- JWT verification with Ed25519 signatures for command authentication
- Nonce tracking for replay attack prevention
- Rate limiting per public key
- Command blacklist (get wifi.pwd, set mqtt.admin)
- ACL-based authorization using existing admin list
- Deferred command processing to avoid callback stack overflow
- Memory-pressure degraded mode: auto-disable one analyzer server
when heap drops below 60KB, with IATA-based geographic preference
Also includes:
- Git commit hash injection in version string via build script
- Graceful settings migration for new preference fields
- CLI commands: mqtt.remote, mqtt.useacl, mqtt.admin
Co-authored-by: Cursor <cursoragent@cursor.com>
- Moved MQTT processing to a dedicated FreeRTOS task on Core 0, enhancing non-blocking behavior.
- Implemented a FreeRTOS queue for thread-safe packet handling, replacing the previous circular buffer approach.
- Updated WiFi initialization and connection management to occur within the FreeRTOS task, improving overall system responsiveness.
- Enhanced logging and error handling for MQTT connections and packet processing.
- Cached broker and analyzer server statuses to reduce redundant checks and improve efficiency.
- Updated the advert timer calculation to explicitly cast the advert interval to an integer type, ensuring consistent behavior across different mesh implementations.
- Enhanced the savePrefs function in CommonCLI to trigger advert timer updates when the advert interval changes, improving responsiveness to user configuration changes.
- Removed the aggressive 4-hour health check in MQTTBridge to prevent connection instability, allowing the MQTT client library to manage connection health internally.
- Added formatStatsReply, formatRadioStatsReply, and formatPacketStatsReply methods in MyMesh for both simple_repeater, simple_room_server, and simple_sensor.
- Updated CommonCLI to handle new stats commands.
