5 Commits

Author	SHA1	Message	Date
schmidt.florian	8fe5f4411b	Fix defects found auditing the ingestion, import and connector changes ... An audit of this session's commits found several real problems, three of which lose or expose data. Ordered by severity. Live recompute was not atomic. RecomputeMeterAsync clears a meter's series with ExecuteDelete, which commits by itself when no transaction is ambient, and only then adds the rebuilt rows. Between the two the meter had *no* consumption: a dashboard read reported zero, and a crash or cancelled request made the loss permanent, for data the SDD treats as the long-term source of truth (§5.5). Import and the events API already wrapped their recomputes; live ingestion, which I added this session, did not. Now shares one transaction, joining an ambient one rather than nesting. The MQTT backfill migration counted brokers without regard to is_enabled. One live broker plus a disabled leftover counted two, declined to backfill, and left those sources unbound — which under endpoint-scoped routing means silently and permanently dead. The "two or more is ambiguous" reasoning did not hold there: the worker only ever connected to enabled endpoints. Corrected by a follow-up migration rather than an edit, since the original may already have run; it touches only rows still NULL, so hand-made bindings are safe. A mapping edited after a dry run committed the *old* staged rows under the *new* mapping. Readings went to the previous meter while the batch recorded the current mapping — wrong data, provenance contradicting it, no exception. The earlier fix re-validated but did not detect staleness. Commit now compares the mapping against the one the preview was staged under and refuses. "Test connection" sent a stored token to whatever Base URL was in the dialog. Encrypting secrets at rest means the UI can decrypt what the operator can no longer read, so this turned the button into an exfiltration primitive: point it at any host, the token arrives as a Bearer header. A stored token now only goes to the origin it was saved for; testing elsewhere requires typing it again. A source that cannot ingest looked identical to a healthy one. Endpoint-scoped routing made unbound and mis-bound sources silently dead, while the Sources tab showed no connector at all and the delete dialog still promised sources would be "unlinked". Added a Connector column that names the fault, stopped offering disabled connectors (both workers filter on IsEnabled), and made the delete warning say ingestion stops. Virtual meters rendered four zero tiles: they evaluate on read and only materialize when a cost category references them (§14.1), so summing consumption is a confident lie about a working meter. They now report nothing and the page explains why. Re-importing an overlapping file failed at the database with EF's "An error occurred while saving the entity changes", naming neither meter nor date — the diagnosis problem a3af483 set out to fix, via the path its guard could not see. Checked up front now, bounded by each meter's staged range. The LXC updater left the service stopped on any failure. set -e plus an explicit stop means Restart=always does not apply, so an OOM-killed publish or a brief Gitea outage took MeterVault down until someone noticed. An EXIT trap restarts the previous build and says so. Claude-Session: https://claude.ai/code/session_01V6joyergfvVLFEizH1hJLd	2026-07-18 19:52:48 +02:00
schmidt.florian	e23df37a3f	Connectors: allow secrets to be entered in the UI, encrypted at rest ... Reference-only secrets (SDD §6.4) meant adding a connector required editing a file on the server and restarting the service. In practice that leads to the token being pasted into the env-var *name* field, which fails with "environment variable '<token>' is not set" and gives no hint what went wrong. Add a second storage form, chosen per connector: type the secret in and it is encrypted via ASP.NET Core data protection before it is stored. The env-var reference stays as an equal alternative — this widens the choice rather than replacing it. Exactly one form survives a save, so a stale secret cannot linger and silently win; EndpointSecret.Resolve is the single resolution path. The guarantee that matters is preserved: no plaintext in the database, so pg_dump and JSON exports carry nothing usable. The trust boundary is stated plainly in §6.4 — the key ring is on disk, so this protects against leaked database content, not an attacker who already has the host, which is the same boundary an env var has. Details worth noting: - Key ring defaults to /var/lib/metervault/keys, outside the app directory, because the LXC updater republishes /opt/metervault on every update. Docker gets a named volume. Overridable via MeterVault__DataProtectionKeyPath. - Undecryptable ciphertext (key ring lost) falls back rather than throwing: an ingestion worker on a timer should degrade, not crash. - The stored secret is never sent to the browser; a blank field means "unchanged", not "cleared". - MQTT usernames are stored as-is — §6.4 covers tokens and passwords, and encrypting a username would only blank the field on every edit. - ExportService drops *_enc values: bound to the originating key ring, so useless where an export would be restored. Expect to re-enter after a restore. - HaConnectionTester now takes a resolved token, so the admin UI can test a token that has been typed but not yet saved. SDD §6.4 and §9 updated to describe both forms rather than contradict the code. Claude-Session: https://claude.ai/code/session_01V6joyergfvVLFEizH1hJLd	2026-07-18 15:41:52 +02:00
schmidt.florian	8550ed8d9e	Ingestion: Home Assistant WebSocket push path ... HomeAssistantWebSocketWorker holds a persistent state_changed subscription per HA endpoint that opts in via the connector's WebSocket toggle (HaEndpointConfig.UseWebSocket): auth handshake, subscribe, ingest in real time, capped-backoff reconnect. The REST poll worker skips WS endpoints so each is served once. HaWebSocketProtocol holds the pure handshake/parse logic. Verified by 11 protocol unit tests + a live integration test against an in-process fake HA server. CLAUDE.md updated. Claude-Session: https://claude.ai/code/session_01Kib2MniVFbD95fkgLgBBnB	2026-07-17 11:05:01 +02:00
schmidt.florian	85d650a8f5	Fix: enable global interactivity so dialogs/selects actually work ... Editing a meter (any admin dialog, select dropdown, snackbar, dark-mode toggle) did nothing: pages declared @rendermode InteractiveServer individually, but MainLayout — which hosts MudDialogProvider/MudPopoverProvider/MudSnackbarProvider — was rendered by <Routes>, which was static. Inline MudDialogs and MudSelect popovers render through those providers, so with the providers non-interactive no dialog could ever open. Set the render mode on <Routes> and <HeadOutlet> in App.razor (global interactivity) and removed the now-redundant per-page @rendermode declarations (they would otherwise throw "parent already has a render mode"). Why it slipped through: the integration render tests only issue a GET (static prerender), which never exercises the SignalR circuit. Verified this fix with a real headless-browser run (Playwright): the meter edit dialog opens and the "Sub-meter of (upstream meters)" multi-select opens with options — proving the layout providers are now interactive. 116 tests still green. Claude-Session: https://claude.ai/code/session_01Lz2RqAsnQhetqWNoCDfexK	2026-07-14 14:22:15 +02:00
schmidt.florian	09cd435c2b	Admin write-CRUD, Home Assistant connector config, wiring audit ... Three requested phases. 1) Admin section (SDD §8.7) — MudBlazor inline-dialog CRUD, consistent pattern, delete guards, snackbar feedback, shared Confirm helper: - Energy types: create/edit/delete (blocks delete when meters reference it). - Meters: create/edit/delete; recomputes consumption when mode/baseline changes (NormalizationService over a fresh factory context, in a tx); delete cascades data (consumption+readings are Restrict → removed first). - A meter's ingest sources: manage on the meter-detail Sources tab (add/edit/delete MQTT/Tasmota/HA sources with typed config). - Tariffs: full CRUD (scope/component/value/validity). - Cost categories: CRUD + member management (meter or energy-type members). - Connectors: ingestion_endpoint CRUD (MQTT broker + Home Assistant); secrets referenced by env-var name only, never stored. - Settings: read-only effective-config view (settings are env-driven and reproducible, so an editable form would change nothing — kept honest). PV role is now editable on meters (MeterMeta.SetRole can clear a role). 2) Read Home Assistant — extracted a shared public HaEndpointConfig (was a private record in the worker), added HaConnectionTester (powers the connector "Test connection": checks base URL + env-resolved token, optionally reads one entity). Configuring an HA connector + an HA source on a meter drives the existing REST-poll worker end to end. (WebSocket push stays a future optimization; REST poll already reads HA.) 3) Wiring/placeholder audit — swept every OnClick/Href: all handlers are real, all internal links resolve to real routes, no TODO/stub/placeholder code. Fixed one genuine gap: MainLayout had no drawer toggle, so the nav was unreachable on narrow screens — added a hamburger button. Tests: +6 (MeterMeta.SetRole role-removal; HaConnectionTester fail-closed guard branches with a throwing HttpClientFactory proving no network on bad config); render test now covers all admin routes. 69 Core + 45 Integration = 114 green. Live-verified in Docker: all admin pages 200, drawer toggle present, Settings shows real effective config. Claude-Session: https://claude.ai/code/session_01Lz2RqAsnQhetqWNoCDfexK	2026-07-14 11:22:17 +02:00