2a954aa158
Step 4a of docs/SECURITY_PLAN.md. Port 80 keeps the eleven HTTP routes of ADR 0006 and the socket at /ws; everything else moved to protocol 2. - Port 8081 (ApiRoutes) and the socket on 8080 (SocketEmitter) are gone. Protocol 2 owns its frame buffer and loop-task check. - Port 80 drops every route the old web UI called: reads, edits, settings, scans, reboot, /shades.cfg, /discovery. HttpRoutes.cpp holds what stays. - ModelSnapshot, SnapshotSlots and the read documents are gone. The item snapshot types stay, as ItemSnapshot, for events, MQTT and the command replies. - Model edits reply only to their protocol 2 op: requestResult goes. - The settings' toJSON writers, used only by the settings routes, go. - The _espsomfy_rts._tcp mDNS record moves to port 80, with path=/ws. - The memory event reports the loop-rate window it closes. - A deleted room no longer re-publishes its retained MQTT topics. - e2e: the heap check reads the sync's status; the sync is checked on its own instead of against /controller. - README gets an API and ports section. BREAKING CHANGE: ports 8081 and 8080 and the old HTTP routes are gone. Home Assistant needs integration 3.0.0 or newer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2.2 KiB
Known Issues
Tracked as GitHub issues
- #77 Port 80 routes don't check login
- #78 CORS allows any origin
- #79 Websocket has no auth
- #82 A saved WiFi passphrase or MQTT password can't be cleared from the UI
- #83 Installing "Main" from the update dialog always fails
- #84 Transmitting a frame stops
loop()for about 365 ms - #85 Integrated tilt turns its slats back with an Up after a lift-only target
- #86 ShadeBehaviour: self-echo, group commands and
lastFrame(structural follow-ups)
Command replies read the live shade model
Status: open. What's left of the concurrent-mutation problem that ADR-0002 fixed for reads and edits. Location: the command handlers in src/entryPoints/Web.cpp.
Summary
The three HTTP commands for scripts (/shadeCommand, /groupCommand, /tiltCommand) copy the shade or group they report from the live shade model on async_tcp, so a reply can show a value from the middle of a change. The socket's ops reply from loop() and don't have this problem.
.gz does not exist errors are log noise
Status: open. Cosmetic.
Location: serveStatic in src/entryPoints/HttpRoutes.cpp; MINIFY_AND_GZIP in minify.py.
serveStatic tries <file>.gz first. For files stored without one (appversion, icon.png), LittleFS logs an E-level does not exist, no permits for creation line on every request. The fix would be for minify.py to gzip the plain files too; appversion must stay plain as well, because ConfigSettings reads it from LittleFS. setTryGzipFirst(false) doesn't help: the error comes from exists() probing the missing variant, so it would only move the noise to the gzip-only files.