Skip to content

Fixes #3269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
benderl merged 4 commits into from
Apr 9, 2026
Merged

Fixes #3269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a42e3a7
check for active user management before modifying acl roles
benderl Apr 7, 2026
898df6a
restore: remove duplicate checks and inet dependency
benderl Apr 7, 2026
e80273e
fix charge point get_values in secure mode
benderl Apr 9, 2026
77bed57
review
benderl Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
60 changes: 40 additions & 20 deletions packages/helpermodules/command.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,7 +208,9 @@ def addIoAction(self, connection_id: str, payload: dict) -> None:
Pub().pub(f'openWB/set/io/action/{new_id}/config', device_default)
self.max_id_io_action = new_id
Pub().pub("openWB/set/command/max_id/io_action", self.max_id_io_action)
add_acl_role("io-action-<id>-access", new_id)
# add ACL roles for IO action access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
add_acl_role("io-action-<id>-access", new_id)
Comment thread
benderl marked this conversation as resolved.
Resolved
Comment thread
benderl marked this conversation as resolved.
Resolved
pub_user_message(
payload, connection_id,
f'Neue IO-Aktion vom Typ \'{" / ".join(payload["data"]["type"])}\' mit ID \'{new_id}\' hinzugefügt.',
Expand All @@ -217,7 +219,9 @@ def addIoAction(self, connection_id: str, payload: dict) -> None:
def removeIoAction(self, connection_id: str, payload: dict) -> None:
if self.max_id_io_action >= payload["data"]["id"]:
ProcessBrokerBranch(f'io/action/{payload["data"]["id"]}/').remove_topics()
remove_acl_role("io-action-<id>-access", payload["data"]["id"])
# remove ACL roles for IO action access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
remove_acl_role("io-action-<id>-access", payload["data"]["id"])
Comment thread
benderl marked this conversation as resolved.
Resolved
pub_user_message(payload, connection_id, f'IO-Aktion mit ID \'{payload["data"]["id"]}\' gelöscht.',
MessageType.SUCCESS)
else:
Expand All @@ -238,9 +242,11 @@ def addIoDevice(self, connection_id: str, payload: dict) -> None:
Pub().pub(f'openWB/set/system/io/{new_id}/config', device_default)
self.max_id_io_device = new_id
Pub().pub("openWB/set/command/max_id/io_device", self.max_id_io_device)
add_acl_role("io-device-<id>-access", new_id)
if device_default["output"]["digital"] or device_default["output"]["analog"]:
add_acl_role("io-device-<id>-write-access", new_id)
# add ACL roles for IO device access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
add_acl_role("io-device-<id>-access", new_id)
if device_default["output"]["digital"] or device_default["output"]["analog"]:
add_acl_role("io-device-<id>-write-access", new_id)
Comment thread
benderl marked this conversation as resolved.
Resolved
pub_user_message(
payload, connection_id,
f'Neues IO-Gerät vom Typ \'{payload["data"]["type"]}\' mit ID \'{new_id}\' hinzugefügt.',
Expand All @@ -252,8 +258,10 @@ def removeIoDevice(self, connection_id: str, payload: dict) -> None:
if self.max_id_io_device >= payload["data"]["id"]:
ProcessBrokerBranch(f'system/io/{payload["data"]["id"]}/').remove_topics()
ProcessBrokerBranch(f'io/states/{payload["data"]["id"]}/').remove_topics()
remove_acl_role("io-device-<id>-access", payload["data"]["id"])
remove_acl_role("io-device-<id>-write-access", payload["data"]["id"])
# remove ACL roles for IO device access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
remove_acl_role("io-device-<id>-access", payload["data"]["id"])
remove_acl_role("io-device-<id>-write-access", payload["data"]["id"])
pub_user_message(payload, connection_id, f'IO-Gerät mit ID \'{payload["data"]["id"]}\' gelöscht.',
MessageType.SUCCESS)
else:
Expand All @@ -279,9 +287,11 @@ def setup_added_chargepoint():
self.addChargepointTemplate("addChargepoint", {})
if self.max_id_vehicle == -1:
self.addVehicle("addChargepoint", {})
add_acl_role("chargepoint-<id>-access", new_id)
if chargepoint_config["type"] == "mqtt":
add_acl_role("chargepoint-<id>-write-access", new_id)
# add ACL roles for charge point access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
add_acl_role("chargepoint-<id>-access", new_id)
if chargepoint_config["type"] == "mqtt":
add_acl_role("chargepoint-<id>-write-access", new_id)
pub_user_message(payload, connection_id, f'Neuer Ladepunkt mit ID \'{new_id}\' wurde erstellt.',
MessageType.SUCCESS)
new_id = self.max_id_hierarchy + 1
Expand Down Expand Up @@ -386,8 +396,10 @@ def removeChargepoint(self, connection_id: str, payload: dict) -> None:
break
else:
remove_display_user(cp_ip)
remove_acl_role("chargepoint-<id>-access", cp_id)
remove_acl_role("chargepoint-<id>-write-access", cp_id)
# remove ACL roles for charge point access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
remove_acl_role("chargepoint-<id>-access", cp_id)
remove_acl_role("chargepoint-<id>-write-access", cp_id)
ProcessBrokerBranch(f'chargepoint/{cp_id}/').remove_topics()
data.data.counter_all_data.hierarchy_remove_item(cp_id, ComponentType.CHARGEPOINT)
Pub().pub("openWB/set/counter/get/hierarchy", data.data.counter_all_data.data.get.hierarchy)
Expand Down Expand Up @@ -679,7 +691,9 @@ def set_default(topic: str, defaults: dict):
self.max_id_hierarchy = self.max_id_hierarchy + 1
Pub().pub("openWB/set/command/max_id/hierarchy",
self.max_id_hierarchy)
add_acl_role(f"{general_type.value}-<id>-access", new_id)
# add ACL roles for component access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
add_acl_role(f"{general_type.value}-<id>-access", new_id)
Comment thread
benderl marked this conversation as resolved.
Resolved
pub_user_message(
payload, connection_id,
f'Neue Komponente vom Typ \'{payload["data"]["type"]}\' mit ID \'{new_id}\' hinzugefügt.',
Expand All @@ -693,10 +707,12 @@ def removeComponent(self, connection_id: str, payload: dict) -> None:
"Die ID ist größer als die maximal vergebene ID.", MessageType.ERROR)
branch = f'system/device/{payload["data"]["deviceId"]}/component/{payload["data"]["id"]}/'
ProcessBrokerBranch(branch).remove_topics()
remove_acl_role(f"{special_to_general_type_mapping(payload['data']['type']).value}-<id>-access",
payload["data"]["id"])
remove_acl_role(f"{special_to_general_type_mapping(payload['data']['type']).value}-<id>-write-access",
payload["data"]["id"])
# remove ACL roles for component access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
remove_acl_role(f"{special_to_general_type_mapping(payload['data']['type']).value}-<id>-access",
payload["data"]["id"])
remove_acl_role(f"{special_to_general_type_mapping(payload['data']['type']).value}-<id>-write-access",
payload["data"]["id"])
Comment thread
benderl marked this conversation as resolved.
Resolved
pub_user_message(
payload, connection_id,
f'Komponente mit ID \'{payload["data"]["id"]}\' gelöscht.', MessageType.SUCCESS)
Expand Down Expand Up @@ -753,7 +769,9 @@ def addVehicle(self, connection_id: str, payload: dict) -> None:
self.addChargeTemplate("addVehicle", {})
if self.max_id_ev_template == -1:
self.addEvTemplate("addVehicle", {})
add_acl_role("vehicle-<id>-access", new_id)
# add ACL roles for vehicle access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
add_acl_role("vehicle-<id>-access", new_id)
Comment thread
benderl marked this conversation as resolved.
Resolved
pub_user_message(payload, connection_id, f'Neues EV mit ID \'{new_id}\' hinzugefügt.', MessageType.SUCCESS)

def removeVehicle(self, connection_id: str, payload: dict) -> None:
Expand All @@ -765,8 +783,10 @@ def removeVehicle(self, connection_id: str, payload: dict) -> None:
if payload["data"]["id"] > 0:
Pub().pub(f'openWB/vehicle/{payload["data"]["id"]}', "")
ProcessBrokerBranch(f'vehicle/{payload["data"]["id"]}/').remove_topics()
remove_acl_role("vehicle-<id>-access", payload["data"]["id"])
remove_acl_role("vehicle-<id>-write-access", payload["data"]["id"])
# remove ACL roles for vehicle access, if user management is active
if SubData.system_data["system"].data["security"]["user_management_active"]:
remove_acl_role("vehicle-<id>-access", payload["data"]["id"])
remove_acl_role("vehicle-<id>-write-access", payload["data"]["id"])
pub_user_message(
payload, connection_id,
f'EV mit ID \'{payload["data"]["id"]}\' gelöscht.', MessageType.SUCCESS)
Expand Down
7 changes: 5 additions & 2 deletions packages/helpermodules/subdata.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -314,8 +314,11 @@ def process_vehicle_topic(self, client: mqtt.Client, var: Dict[str, ev.Ev], msg:
var["ev"+index].soc_module = mod.create_vehicle(config, index)
client.subscribe(f"openWB/vehicle/{index}/soc_module/calculated_soc_state", 2)
client.subscribe(f"openWB/vehicle/{index}/soc_module/general_config", 2)
if config.type == "mqtt":
add_acl_role("vehicle-<id>-write-access", int(index))
if self.system_data["system"].data["security"]["user_management_active"]:
if config.type == "mqtt":
add_acl_role("vehicle-<id>-write-access", int(index))
else:
remove_acl_role("vehicle-<id>-write-access", int(index))
self.processing_counter.add_task()
Pub().pub("openWB/system/subdata_initialized", True)
self.event_soc.set()
Expand Down
3 changes: 2 additions & 1 deletion packages/modules/chargepoints/external_openwb/chargepoint_module.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,8 @@ def on_message(client, userdata, message):
on_connect,
on_message,
host=self.config.configuration.ip_address,
port=1883).start_finite_loop()
port=1886 if self.config.configuration.ip_address == "localhost" else 1883
).start_finite_loop()

if received_topics:
log.debug(f"Empfange MQTT Daten für Ladepunkt {self.config.id}: {received_topics}")
Expand Down
8 changes: 2 additions & 6 deletions runs/atreboot.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,12 +228,8 @@ chmod 666 "$LOGFILE"
echo "pending restore detected"
# remove flag to prevent a boot loop on failure
rm "${OPENWBBASEDIR}/data/restore/run_on_boot"
if ((hasInet == 1)); then
"${OPENWBBASEDIR}/runs/restore.sh"
# restore.sh will reboot if successful
else
echo "no internet connection, restore not possible, skipping"
fi
"${OPENWBBASEDIR}/runs/restore.sh"
# restore.sh will reboot if successful
else
echo "no restore pending, normal startup"
fi
Expand Down
6 changes: 3 additions & 3 deletions runs/prepare_restore.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,17 +57,17 @@ declare resultStatus
GIT_REMOTE="origin"
BRANCH=$(<"$WORKING_DIR/GIT_BRANCH")
# TAG=$(<"$WORKING_DIR/GIT_HASH")
echo "Step 5.1: fetch info from git"
echo "Step 4.1: fetch info from git"
if ! git -C "$OPENWB_BASE_DIR" fetch -v "$GIT_REMOTE"; then
resultMessage="Beim Abgleich mit dem openWB Git ist ein Fehler aufgetreten!"
resultStatus=1
else
echo "Step 5.2: verify branch \"$BRANCH\" from archive"
echo "Step 4.2: verify branch \"$BRANCH\" from archive"
if ! git -C "$OPENWB_BASE_DIR" branch | grep "$BRANCH"; then
resultMessage="Der Entwicklungszweig \"$BRANCH\" des Archivs ist ungültig."
resultStatus=1
else
echo "Step 5.3: clean mosquitto configuration, will be recreated on next boot"
echo "Step 4.3: clean mosquitto configuration, will be recreated on next boot"
sudo rm -v -f /etc/mosquitto/conf.d/openwb-*.conf
sudo rm -v -f "/var/lib/mosquitto/dynamic-security.json"
rm -v -f "/home/openwb/.config/mosquitto_ctrl"
Expand Down
42 changes: 14 additions & 28 deletions runs/restore.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,42 +11,32 @@ LOG_FILE="$OPENWB_BASE_DIR/data/log/restore.log"
{
echo "$(date +"%Y-%m-%d %H:%M:%S") Restore of backup started..."
echo "****************************************"
echo "Step 1: validating extracted files"
if [[ ! -f "$WORKING_DIR/SHA256SUM" ]] ||
[[ ! -f "$WORKING_DIR/GIT_BRANCH" ]] ||
[[ ! -f "$WORKING_DIR/GIT_HASH" ]] ||
[[ ! -d "$WORKING_DIR/openWB" ]] ||
[[ ! -f "$WORKING_DIR/mosquitto/mosquitto.db" ]] ||
[[ ! -f "$WORKING_DIR/mosquitto_local/mosquitto.db" ]]; then
echo "this is not a complete archive! aborting restore"
exit 1
fi
if ! (cd "$WORKING_DIR" && sudo sha256sum --quiet --check "SHA256SUM"); then
echo "some files were modified or removed! aborting restore"
exit 1
fi
echo "****************************************"
echo "Step 2: stop mosquitto services"
# already done in prepare_restore.sh:
# Step 1: creating working directory
# Step 2: extract archive to working directory
# Step 3: validating extracted files
# Step 4: sync with git
Comment thread
benderl marked this conversation as resolved.
Resolved
echo "Step 5: stop mosquitto services"
# no need to stop openwb2.service as we are in pre start script
sudo systemctl stop mosquitto.service mosquitto_local.service
# give systemctl some time to finish, may be unnecessary?
sleep 2
echo "****************************************"
echo "Step 3: sync with git"
echo "Step 6: checkout matching git branch and tag"
BRANCH=$(<"$WORKING_DIR/GIT_BRANCH")
TAG=$(<"$WORKING_DIR/GIT_HASH")
echo "Step 3.1: checkout branch: $BRANCH"
echo "Step 6.1: checkout branch: $BRANCH"
if ! git -C "$OPENWB_BASE_DIR" checkout --force "$BRANCH"; then
echo "checkout of branch \"$BRANCH\" failed! aborting restore"
exit 1
fi
echo "Step 3.2: reset to matching version: [$TAG]"
echo "Step 6.2: reset to matching version: [$TAG]"
if ! git -C "$OPENWB_BASE_DIR" reset --hard "$TAG"; then
echo "reset to version [$TAG] failed! aborting restore"
exit 1
fi
echo "****************************************"
echo "Step 4: restore contents of backup"
echo "Step 7: restore contents of backup"
# we use cp not mv because of not empty directories in destination
sudo cp -v -p -r "${WORKING_DIR}/openWB/." "${OPENWB_BASE_DIR}/"
if [[ -f "$WORKING_DIR/configuration.json" ]]; then
Comment thread
benderl marked this conversation as resolved.
Resolved
Expand All @@ -60,7 +50,7 @@ LOG_FILE="$OPENWB_BASE_DIR/data/log/restore.log"
echo "Backup does not contain mosquitto_ctrl. Skipping restore."
fi
echo "****************************************"
echo "Step 5.1: restore mosquitto db"
echo "Step 7.1: restore mosquitto db"
if [[ -f "${WORKING_DIR}/mosquitto/mosquitto.db" ]]; then
sudo mv -v -f "${WORKING_DIR}/mosquitto/mosquitto.db" "$MOSQUITTO_DB_DIR/mosquitto.db"
sudo chown mosquitto:mosquitto "$MOSQUITTO_DB_DIR/mosquitto.db"
Expand All @@ -81,7 +71,7 @@ LOG_FILE="$OPENWB_BASE_DIR/data/log/restore.log"
echo "Backup does not contain local mosquitto.db. Skipping restore."
fi
echo "****************************************"
echo "Step 5.2: restore mosquitto configuration"
echo "Step 7.2: restore mosquitto configuration"
if [[ -d "${WORKING_DIR}/conf_local.d" ]]; then
# remove old configuration
sudo rm -v -r "$MOSQUITTO_CONF_DIR/conf_local.d"
Expand All @@ -90,19 +80,15 @@ LOG_FILE="$OPENWB_BASE_DIR/data/log/restore.log"
else
echo "Backup does not contain mosquitto configuration. Skipping restore."
fi
# already done in prepare_restore.sh
# echo "****************************************"
# echo "Step 5.3: clean mosquitto configuration, will be recreated on next start"
# sudo rm -v -f "$MOSQUITTO_CONF_DIR/conf.d/openwb-*.conf"
echo "****************************************"
echo "Step 6: restore boot file"
echo "Step 8: restore boot file"
if [[ -f "${WORKING_DIR}/boot/config.txt" ]]; then
sudo mv -v -f "${WORKING_DIR}/boot/config.txt" "/boot/"
else
echo "Backup does not contain boot file. Skipping restore."
fi
echo "****************************************"
echo "Step 7: cleanup after restore"
echo "Step 9: cleanup after restore"
sudo rm "$SOURCE_FILE"
sudo rm -R "$WORKING_DIR"
echo "****************************************"
Expand Down
Loading