No description
jtricerolph
86f03aac0b
MQTT Broker Clients gained a 'service consumer' flag. Device clients stay show-once (a human copies the password into hardware). Service clients (a stack app like hvac-backend that must re-read its own broker login on every restart) get a STABLE username (= name slug, no random suffix) and their password stored AES-256-GCM encrypted (crypto.js, same as integration secrets), served at runtime via: GET /settings/api/internal/mqtt-client/:username (bearer SETTINGS_SECRET) This is the credential path the hvac plan always intended — show-once genuinely can't feed a machine consumer. Revoke/delete drop the stored secret; the internal endpoint refuses revoked clients; secret_enc is never returned to the admin UI. Reject duplicate usernames up front with 409. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| src | ||
| .env.example | ||
| .gitignore | ||
| docker-compose.yml | ||
| Dockerfile | ||
| package-lock.json | ||
| package.json | ||