Merge branch 'fix/wall-display-digest-auth'

Author: jfmlima

packages/api/src/api/presentation/handlers.py

@@ -6,6 +6,7 @@
 from datetime import datetime
 from typing import Any
 
+from core.domain.entities.exceptions import DeviceAuthenticationError
 from litestar.connection import Request
 from litestar.exceptions import HTTPException
 from litestar.response import Response
@@ -39,6 +40,20 @@ def handle_value_error(request: Request, exc: ValueError) -> Response:
     )
 
 
+def handle_device_authentication_error(
+    request: Request, exc: DeviceAuthenticationError
+) -> Response:
+    return Response(
+        content={
+            "error": "Authentication Required",
+            "message": str(exc),
+            "timestamp": datetime.now().isoformat(),
+        },
+        status_code=401,
+        media_type="application/json",
+    )
+
+
 def handle_device_not_found_exception(
     request: Request, exc: DeviceNotFoundHTTPException
 ) -> Response:
@@ -84,6 +99,7 @@ def handle_generic_exception(request: Request, exc: Exception) -> Response:
     ]
     | None
 ) = {
+    DeviceAuthenticationError: handle_device_authentication_error,
     DeviceNotFoundHTTPException: handle_device_not_found_exception,
     ValueError: handle_value_error,
     HTTPException: handle_http_exception,

packages/cli/src/cli/credential_commands.py

@@ -1,7 +1,7 @@
 import click
 from rich.table import Table
 
-from cli.commands.common import async_command, common_options
+from cli.commands.common import async_command
 from cli.presentation.styles import Messages
 
 
@@ -15,7 +15,6 @@ def credential_commands() -> None:
 @click.argument("mac")
 @click.argument("password")
 @click.option("--username", default="admin", help="Username (default: admin)")
-@common_options
 @click.pass_context
 @async_command
 async def set_credential(
@@ -40,7 +39,6 @@ async def set_credential(
 @credential_commands.command("set-global")
 @click.argument("password")
 @click.option("--username", default="admin", help="Username (default: admin)")
-@common_options
 @click.pass_context
 @async_command
 async def set_global_credential(
@@ -62,7 +60,6 @@ async def set_global_credential(
 
 
 @credential_commands.command("list")
-@common_options
 @click.pass_context
 @async_command
 async def list_credentials(ctx: click.Context) -> None:
@@ -95,7 +92,6 @@ async def list_credentials(ctx: click.Context) -> None:
 
 @credential_commands.command("delete")
 @click.argument("mac")
-@common_options
 @click.pass_context
 @async_command
 async def delete_credential(ctx: click.Context, mac: str) -> None:

packages/core/src/core/gateways/device/shelly_device_gateway.py

@@ -15,6 +15,7 @@
 )
 from ...domain.enums.enums import Status
 from ...domain.value_objects.action_result import ActionResult
+from ...utils.validation import normalize_mac
 from ..network.network import RpcNetworkGateway
 from .component_type_mapping import get_api_component_type
 from .device import DeviceGateway
@@ -54,16 +55,21 @@ async def discover_device(self, ip: str) -> DiscoveredDevice | None:
             )
             device_data = device_info.get("result", device_info)
 
-            # Check if auth is required from cache or if it was just marked during request
-            auth_required = False
+            auth_required = device_data.get("auth_en", False)
+
             if (
                 hasattr(self._rpc_client, "auth_state_cache")
                 and self._rpc_client.auth_state_cache
             ):
-                device_id = device_data.get("id") or ip
-                auth_required = self._rpc_client.auth_state_cache.requires_auth(
-                    device_id
-                )
+                if auth_required:
+                    self._rpc_client.auth_state_cache.mark_auth_required(
+                        normalize_mac(ip)
+                    )
+                else:
+                    device_id = device_data.get("id") or ip
+                    auth_required = self._rpc_client.auth_state_cache.requires_auth(
+                        device_id
+                    )
 
             device = DiscoveredDevice(
                 ip=ip,
@@ -136,6 +142,16 @@ async def get_device_status(self, ip: str) -> DeviceStatus | None:
                     "result", device_info_response
                 )
                 rpc_success = True
+
+                if (
+                    device_info_data
+                    and device_info_data.get("auth_en", False)
+                    and hasattr(self._rpc_client, "auth_state_cache")
+                    and self._rpc_client.auth_state_cache
+                ):
+                    self._rpc_client.auth_state_cache.mark_auth_required(
+                        normalize_mac(ip)
+                    )
             except Exception as e:
                 logger.error(f"Error getting device info: {e}", exc_info=True)
 
@@ -149,6 +165,8 @@ async def get_device_status(self, ip: str) -> DeviceStatus | None:
                 )
                 components_data = components_response.get("result", components_response)
                 rpc_success = True
+            except DeviceAuthenticationError:
+                raise
             except Exception as e:
                 logger.error(f"Error getting components: {e}", exc_info=True)
 
@@ -159,6 +177,8 @@ async def get_device_status(self, ip: str) -> DeviceStatus | None:
                 )
                 status_response = status_response.get("result", status_response)
                 rpc_success = True
+            except DeviceAuthenticationError:
+                raise
             except Exception as e:
                 logger.error(f"Error getting device status: {e}", exc_info=True)
 
@@ -175,6 +195,8 @@ async def get_device_status(self, ip: str) -> DeviceStatus | None:
                 status_data=status_response,
             )
 
+        except DeviceAuthenticationError:
+            raise
         except Exception as e:
             logger.error(
                 f"Error getting device status via RPC, attempting legacy fallback: {e}",

packages/core/src/core/gateways/network/async_shelly_rpc_client.py

@@ -16,6 +16,7 @@
 from core.utils.validation import normalize_mac
 
 from .network import RpcNetworkGateway
+from .shelly_digest_auth import ShellyDigestAuth
 
 logger = logging.getLogger(__name__)
 
@@ -38,7 +39,7 @@ def __init__(
         self.auth_state_cache = auth_state_cache
         self._closed = False
         self._ip_to_mac: dict[str, str] = {}
-        self._digest_auth_cache: dict[str, httpx.DigestAuth] = {}
+        self._digest_auth_cache: dict[str, ShellyDigestAuth] = {}
 
     async def make_rpc_request(
         self,
@@ -138,7 +139,7 @@ async def _resolve_authentication(
 
     async def _get_or_create_digest_auth(
         self, ip: str, mac: str
-    ) -> httpx.DigestAuth | None:
+    ) -> ShellyDigestAuth | None:
         """Get cached or create new DigestAuth instance for a device.
 
         Args:
@@ -163,7 +164,7 @@ async def _get_or_create_digest_auth(
             return None
 
         logger.debug("Creating new DigestAuth for %s (MAC: %s)", ip, mac)
-        digest_auth = httpx.DigestAuth(
+        digest_auth = ShellyDigestAuth(
             username=credential.username, password=credential.password
         )
         self._digest_auth_cache[mac] = digest_auth

packages/core/src/core/gateways/network/shelly_digest_auth.py

@@ -0,0 +1,81 @@
+"""
+Shelly-specific DigestAuth that correctly handles empty opaque values.
+
+httpx 0.28.1's DigestAuth uses ``if challenge.opaque:`` which treats b""
+as falsy, omitting opaque from the Authorization header. RFC 7616 requires
+clients to return opaque unchanged — even when empty. Shelly Wall Display
+devices send ``opaque=""`` and reject responses that omit it.
+"""
+
+from __future__ import annotations
+
+import httpx
+from httpx._auth import _DigestAuthChallenge
+from httpx._models import Request
+from httpx._utils import to_str
+
+
+class ShellyDigestAuth(httpx.DigestAuth):
+    # Pinned to httpx 0.28.1 — verify on upgrades.
+    def _build_auth_header(
+        self, request: Request, challenge: _DigestAuthChallenge
+    ) -> str:
+        hash_func = self._ALGORITHM_TO_HASH_FUNCTION[challenge.algorithm.upper()]
+
+        def digest(data: bytes) -> bytes:
+            return hash_func(data).hexdigest().encode()
+
+        A1 = b":".join((self._username, challenge.realm, self._password))
+
+        path = request.url.raw_path
+        A2 = b":".join((request.method.encode(), path))
+        HA2 = digest(A2)
+
+        nc_value = b"%08x" % self._nonce_count
+        cnonce = self._get_client_nonce(self._nonce_count, challenge.nonce)
+        self._nonce_count += 1
+
+        HA1 = digest(A1)
+        if challenge.algorithm.lower().endswith("-sess"):
+            HA1 = digest(b":".join((HA1, challenge.nonce, cnonce)))
+
+        qop = self._resolve_qop(challenge.qop, request=request)
+        if qop is None:
+            digest_data = [HA1, challenge.nonce, HA2]
+        else:
+            digest_data = [HA1, challenge.nonce, nc_value, cnonce, qop, HA2]
+
+        format_args: dict[str, bytes] = {
+            "username": self._username,
+            "realm": challenge.realm,
+            "nonce": challenge.nonce,
+            "uri": path,
+            "response": digest(b":".join(digest_data)),
+            "algorithm": challenge.algorithm.encode(),
+        }
+        if challenge.opaque is not None:
+            format_args["opaque"] = challenge.opaque
+        if qop:
+            format_args["qop"] = b"auth"
+            format_args["nc"] = nc_value
+            format_args["cnonce"] = cnonce
+
+        return "Digest " + self._get_header_value(format_args)
+
+    def _get_header_value(self, header_fields: dict[str, bytes]) -> str:
+        NON_QUOTED_FIELDS = ("algorithm", "qop", "nc")
+        QUOTED_TEMPLATE = '{}="{}"'
+        NON_QUOTED_TEMPLATE = "{}={}"
+
+        header_value = ""
+        for i, (field, value) in enumerate(header_fields.items()):
+            if i > 0:
+                header_value += ", "
+            template = (
+                QUOTED_TEMPLATE
+                if field not in NON_QUOTED_FIELDS
+                else NON_QUOTED_TEMPLATE
+            )
+            header_value += template.format(field, to_str(value))
+
+        return header_value

packages/core/src/core/use_cases/scan_devices.py

@@ -56,6 +56,7 @@ async def execute(self, request: ScanRequest) -> list[DiscoveredDevice]:
                 Status.DETECTED,
                 Status.UPDATE_AVAILABLE,
                 Status.NO_UPDATE_NEEDED,
+                Status.AUTH_REQUIRED,
             ]:
                 discovered_devices.append(result)
 
@@ -124,11 +125,7 @@ def _validate_discovered_device(self, device: DiscoveredDevice) -> None:
             )
 
     def _apply_device_status_rules(self, device: DiscoveredDevice) -> None:
-        if device.auth_required and device.status in [
-            Status.DETECTED,
-            Status.UPDATE_AVAILABLE,
-            Status.NO_UPDATE_NEEDED,
-        ]:
+        if device.auth_required and device.status == Status.DETECTED:
             device.status = Status.AUTH_REQUIRED
 
     async def _discover_devices_via_mdns(self, request: ScanRequest) -> list[str]: