Commander1024/ESP32_Serial_Swiss_Army_Knife

Files

T

Commander1024 91267b371e Consolidate Phase 8 documentation

Mark web administration complete, centralize current contracts and
acceptance evidence, and remove superseded slice records. Update
roadmap,
architecture notes, and test references without changing firmware
sources.

2026-09-13 22:27:10 +02:00

4.2 KiB

Raw Blame History

Legacy credential removal and storage compatibility

Current storage/recovery contract. The user accepted cleanup on 2026-09-08, confirming the certificate fingerprint was unchanged and preexisting test users remained usable. Overall acceptance and evidence limits supersede the old per-slice handoff; no unreported provisioning, recovery, power-loss or all-key tests are implied.

User database

user_database_init(load_result) takes no legacy credential. Missing user_db/database storage is committed as an empty v1 database; no account/password is imported.
Create the first administrator on physical UART0 with user add <username> admin, optionally --generate. Entered passwords use hidden confirmation; generated passwords are shown once. There is no reserved bootstrap account or public bootstrap state.
user recover --force is UART0-only, calls user_database_recover_empty(), and destructively rebuilds only an unavailable database empty. It refuses a healthy initialized database, including an empty one. Follow with normal user add; unrelated configuration and TLS/SSH identities are untouched.
Valid existing v1 database bytes load without rewriting or changing accounts, roles, IDs, authentication generations, verifiers or authorized keys. Previously migrated role-user accounts are not automatically promoted. The private v1_admin_marker preserves the old wire byte and is derived from administrator count during mutations; it is not a new role, public bootstrap field or schema change.
No public bootstrap, legacy user migration or synchronization API remains. Final-admin protection, conditional mutations, copied principal currentness and target-only revocation remain the canonical account contracts.

HTTPS identity storage

web_security owns only TLS material. At the unchanged web_sec/material key, a private byte-oriented reader validates the shipped 1,392-byte v1 layout and builds 1,340-byte TLS-only v2. It retains the exact private-key DER, certificate DER, SHA-256 fingerprint and material generation: this migration is not certificate rotation.

The v2 candidate is validated and committed before live publication. Temporary credential-bearing v1 input is wiped. No public legacy credential reader/type, display, rotation or authentication path remains. Unknown/malformed material, read failures, invalid cryptographic identity and migration write/commit failures fail closed; they do not trigger fallback regeneration or overwrite of rejected material. Truly missing material may be generated and saved normally.

web credentials show, web credentials rotate --force and user bootstrap (including its generated form) are removed. web certificate info and web certificate rotate --force remain subject to existing frontend policy. web reset --force explicitly replaces TLS certificate/private key only; it does not reset passwords, import accounts or synchronize verifiers. TLS replacement/restart can close browser sessions and requires renewed certificate trust/login, without changing user credentials or revoking unrelated SSH sessions.

Compatibility and physical-security limits

Older v1-only firmware cannot read v2 HTTPS storage. Do not assume a downgrade preserves usable HTTPS or restores removed credentials. Existing user database v1 compatibility is separate from this HTTPS downgrade incompatibility.

Replacing an NVS blob logically removes credential fields from the current record; it is not secure flash wiping. Append-oriented historical copies may retain plaintext legacy credentials, and current Wi-Fi secrets/TLS/SSH private keys remain unencrypted. PBKDF2 verifiers remain subject to offline guessing. No factory/partition erase is required or authorized by this cleanup.

Regression references

Use tests/web_security/run.py, tests/admin_console_boundary/accounts.py, tests/admin_ssh_policy/run.py and current legacy-removal procedures. Prior host tests used NVS fault doubles and a generated identity wrapped in the historical TLS layout, not an independently captured old-device fixture; they do not prove flash durability or power-loss behavior. Procedures are not claims of execution.

4.2 KiB Raw Blame History