Merge branch 'feat/gen1-authentication'

Author: jfmlima

packages/api/src/api/dependencies/container.py

@@ -93,6 +93,7 @@ def get_credentials_use_case(self) -> ManageCredentialsUseCase:
 
             def on_credential_changed(mac: str) -> None:
                 self.get_rpc_client().invalidate_credential_cache(mac)
+                self.get_device_gateway().invalidate_legacy_credential_cache(mac)
 
             self._credentials_use_case = ManageCredentialsUseCase(
                 repository_factory=self.create_credentials_repository,

packages/core/src/core/dependencies/container_base.py

@@ -1,6 +1,11 @@
 """Shared container base providing common gateway and interactor factories (no cast)."""
 
-from typing import Any
+from __future__ import annotations
+
+from typing import TYPE_CHECKING, Any
+
+if TYPE_CHECKING:
+    from core.services.authentication_service import AuthenticationService
 
 from core.gateways.device import LegacyDeviceGateway
 from core.gateways.device.ap_device_detector import APDeviceDetector
@@ -45,6 +50,8 @@ def get_device_gateway(self) -> ShellyDeviceGateway:
             legacy_gateway = LegacyDeviceGateway(
                 http_client=legacy_http_client,
                 component_mapper=legacy_component_mapper,
+                authentication_service=self._get_authentication_service_optional(),
+                auth_state_cache=self.get_auth_state_cache(),
             )
 
             self._device_gateway = ShellyDeviceGateway(
@@ -53,6 +60,13 @@ def get_device_gateway(self) -> ShellyDeviceGateway:
             )
         return self._device_gateway
 
+    def _get_authentication_service_optional(self) -> AuthenticationService | None:
+        """Return AuthenticationService if available, None otherwise."""
+        if hasattr(self, "get_authentication_service"):
+            service: AuthenticationService = self.get_authentication_service()
+            return service
+        return None
+
     def get_mdns_client(self) -> MDNSGateway:
         if self._mdns_client is None:
             self._mdns_client = ZeroconfMDNSClient()

packages/core/src/core/gateways/device/legacy_device_gateway.py

@@ -2,18 +2,26 @@
 Legacy device gateway for Gen1 Shelly devices.
 """
 
+from __future__ import annotations
+
 import logging
 import time
 from datetime import datetime
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 from ...domain.entities.device_status import DeviceStatus
 from ...domain.entities.discovered_device import DiscoveredDevice
+from ...domain.entities.exceptions import DeviceAuthenticationError
 from ...domain.enums.enums import Status
 from ...domain.value_objects.action_result import ActionResult
+from ...utils.validation import normalize_mac
 from ..network.legacy_http_client import LegacyHttpClient
 from .legacy_component_mapper import LegacyComponentMapper
 
+if TYPE_CHECKING:
+    from ...services.auth_state_cache import AuthStateCache
+    from ...services.authentication_service import AuthenticationService
+
 logger = logging.getLogger(__name__)
 
 
@@ -24,9 +32,55 @@ def __init__(
         self,
         http_client: LegacyHttpClient,
         component_mapper: LegacyComponentMapper,
+        authentication_service: AuthenticationService | None = None,
+        auth_state_cache: AuthStateCache | None = None,
     ) -> None:
         self._http_client = http_client
         self._component_mapper = component_mapper
+        self._authentication_service = authentication_service
+        self._auth_state_cache = auth_state_cache
+        self._ip_to_mac: dict[str, str] = {}
+        self._basic_auth_cache: dict[str, tuple[str, str]] = {}
+
+    async def _ensure_mac(self, ip: str) -> str | None:
+        """Get MAC address for an IP, fetching from /shelly if not cached."""
+        normalized_ip = normalize_mac(ip)
+        if normalized_ip in self._ip_to_mac:
+            return self._ip_to_mac[normalized_ip]
+        try:
+            shelly_data = await self._http_client.fetch_json(ip, "shelly")
+            mac = shelly_data.get("mac")
+            if mac:
+                normalized_mac = normalize_mac(mac)
+                self._ip_to_mac[normalized_ip] = normalized_mac
+                return normalized_mac
+        except Exception:
+            pass
+        return None
+
+    async def _resolve_auth(self, ip: str) -> tuple[str, str] | None:
+        """Resolve Basic Auth credentials for a device by IP."""
+        if not self._authentication_service:
+            return None
+
+        mac = await self._ensure_mac(ip)
+        if not mac:
+            return None
+
+        if mac in self._basic_auth_cache:
+            return self._basic_auth_cache[mac]
+
+        credential = await self._authentication_service.resolve_credentials(mac)
+        if credential:
+            auth_tuple = (credential.username, credential.password)
+            self._basic_auth_cache[mac] = auth_tuple
+            return auth_tuple
+        return None
+
+    def invalidate_credential_cache(self, mac: str) -> None:
+        """Clear cached credentials for a device."""
+        normalized_mac = normalize_mac(mac)
+        self._basic_auth_cache.pop(normalized_mac, None)
 
     async def discover_device(self, ip: str) -> DiscoveredDevice | None:
         """Discover a legacy Gen1 Shelly device.
@@ -42,8 +96,23 @@ async def discover_device(self, ip: str) -> DiscoveredDevice | None:
             device_info = await self._http_client.fetch_json(ip, "shelly")
             response_time = time.perf_counter() - start_time
 
-            status_data = await self._http_client.fetch_json_optional(ip, "status")
-            settings_data = await self._http_client.fetch_json_optional(ip, "settings")
+            # Detect auth requirement from /shelly response
+            auth_enabled = device_info.get("auth", False)
+            mac = device_info.get("mac")
+            auth: tuple[str, str] | None = None
+
+            if auth_enabled and mac and self._auth_state_cache:
+                normalized_mac = normalize_mac(mac)
+                self._ip_to_mac[normalize_mac(ip)] = normalized_mac
+                self._auth_state_cache.mark_auth_required(normalized_mac)
+                auth = await self._resolve_auth(ip)
+
+            status_data = await self._http_client.fetch_json_optional(
+                ip, "status", auth=auth
+            )
+            settings_data = await self._http_client.fetch_json_optional(
+                ip, "settings", auth=auth
+            )
 
             device_name = self._derive_device_name(device_info, settings_data)
             firmware_version = (
@@ -74,6 +143,7 @@ async def discover_device(self, ip: str) -> DiscoveredDevice | None:
                 response_time=response_time,
                 last_seen=datetime.now(),
                 has_update=has_update_value,
+                auth_required=auth_enabled,
             )
         except Exception as e:
             logger.debug(
@@ -95,8 +165,21 @@ async def get_device_status(self, ip: str) -> DeviceStatus | None:
         """
         try:
             device_info = await self._http_client.fetch_json(ip, "shelly")
-            status_data = await self._http_client.fetch_json(ip, "status")
-            settings_data = await self._http_client.fetch_json_optional(ip, "settings")
+
+            auth: tuple[str, str] | None = None
+            if device_info.get("auth", False):
+                mac = device_info.get("mac")
+                if mac:
+                    normalized_mac = normalize_mac(mac)
+                    self._ip_to_mac[normalize_mac(ip)] = normalized_mac
+                auth = await self._resolve_auth(ip)
+
+            status_data = await self._http_client.fetch_json(ip, "status", auth=auth)
+            settings_data = await self._http_client.fetch_json_optional(
+                ip, "settings", auth=auth
+            )
+        except DeviceAuthenticationError:
+            raise
         except Exception as e:
             logger.debug(
                 "Failed to fetch legacy data for %s: %s",
@@ -174,8 +257,11 @@ async def execute_action(
             )
 
         try:
+            auth = (
+                await self._resolve_auth(ip) if self._authentication_service else None
+            )
             response = await self._http_client.get_with_params(
-                ip, command["endpoint"], command["params"]
+                ip, command["endpoint"], command["params"], auth=auth
             )
             return ActionResult(
                 device_ip=ip,

packages/core/src/core/gateways/device/shelly_device_gateway.py

@@ -39,6 +39,10 @@ def __init__(
         self.timeout = timeout
         self._legacy_gateway = legacy_gateway
 
+    def invalidate_legacy_credential_cache(self, mac: str) -> None:
+        if self._legacy_gateway:
+            self._legacy_gateway.invalidate_credential_cache(mac)
+
     async def discover_device(self, ip: str) -> DiscoveredDevice | None:
         """
         Discover basic device information (original get_device_status logic).

packages/core/src/core/gateways/network/legacy_http_client.py

@@ -3,6 +3,8 @@
 
 import requests
 
+from core.domain.entities.exceptions import DeviceAuthenticationError
+
 
 class LegacyHttpClient:
     """HTTP client for legacy Gen1 Shelly devices using simple HTTP GET requests."""
@@ -13,28 +15,42 @@ def __init__(
         self.timeout = timeout
         self._session = session or requests.Session()
 
-    async def fetch_json(self, ip: str, endpoint: str) -> dict[str, Any]:
+    async def fetch_json(
+        self, ip: str, endpoint: str, auth: tuple[str, str] | None = None
+    ) -> dict[str, Any]:
         loop = asyncio.get_event_loop()
-        return await loop.run_in_executor(None, self._sync_fetch_json, ip, endpoint)
+        return await loop.run_in_executor(
+            None, self._sync_fetch_json, ip, endpoint, auth
+        )
 
-    async def fetch_json_optional(self, ip: str, endpoint: str) -> dict[str, Any]:
+    async def fetch_json_optional(
+        self, ip: str, endpoint: str, auth: tuple[str, str] | None = None
+    ) -> dict[str, Any]:
         try:
-            return await self.fetch_json(ip, endpoint)
+            return await self.fetch_json(ip, endpoint, auth=auth)
         except Exception:
             return {}
 
     async def get_with_params(
-        self, ip: str, endpoint: str, params: dict[str, Any]
+        self,
+        ip: str,
+        endpoint: str,
+        params: dict[str, Any],
+        auth: tuple[str, str] | None = None,
     ) -> dict[str, Any]:
         loop = asyncio.get_event_loop()
 
         return await loop.run_in_executor(
-            None, self._sync_get_with_params, ip, endpoint, params
+            None, self._sync_get_with_params, ip, endpoint, params, auth
         )
 
-    def _sync_fetch_json(self, ip: str, endpoint: str) -> dict[str, Any]:
+    def _sync_fetch_json(
+        self, ip: str, endpoint: str, auth: tuple[str, str] | None = None
+    ) -> dict[str, Any]:
         url = f"http://{ip}/{endpoint.lstrip('/')}"
-        response = self._session.get(url, timeout=self.timeout)
+        response = self._session.get(url, timeout=self.timeout, auth=auth)
+        if response.status_code == 401:
+            raise DeviceAuthenticationError(ip)
         response.raise_for_status()
         data = response.json()
 
@@ -44,10 +60,18 @@ def _sync_fetch_json(self, ip: str, endpoint: str) -> dict[str, Any]:
         return cast(dict[str, Any], data)
 
     def _sync_get_with_params(
-        self, ip: str, endpoint: str, params: dict[str, Any]
+        self,
+        ip: str,
+        endpoint: str,
+        params: dict[str, Any],
+        auth: tuple[str, str] | None = None,
     ) -> dict[str, Any]:
         url = f"http://{ip}/{endpoint.lstrip('/')}"
-        response = self._session.get(url, params=params, timeout=self.timeout)
+        response = self._session.get(
+            url, params=params, timeout=self.timeout, auth=auth
+        )
+        if response.status_code == 401:
+            raise DeviceAuthenticationError(ip)
         response.raise_for_status()
 
         try:

packages/core/tests/unit/gateways/device/test_legacy_device_gateway.py

@@ -140,7 +140,7 @@ async def test_it_executes_legacy_action_successfully(
         assert result.success is True
         assert result.data == {"ison": True}
         mock_http_client.get_with_params.assert_called_once_with(
-            "192.168.1.100", "relay/0", {"turn": "on"}
+            "192.168.1.100", "relay/0", {"turn": "on"}, auth=None
         )
 
     async def test_it_handles_unsupported_legacy_action(self, gateway):