Files

295 lines
17 KiB
Markdown

# Changelog
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog and this project follows Semantic Versioning.
---
## [Unreleased]
### Fixed
- Aligned project documentation with the implemented PN532, BLE, mobile,
opening-history, user-role, one-time-code, 150 ms lock-pulse, and diagnostic
behavior, while keeping unfinished timeout, power, Zigbee, and Home Assistant
work explicitly marked as pending.
- Restored explicit 2-second open-door reminder diagnostics and increased the
D9 lock-control pulse from 100 ms to 150 ms so mechanical relay stages have
more time to present `SIG` without excessive coil-on time.
- Added a clipboard action to permanent and temporary access-code rows in the
mobile application, positioned before the edit action.
- Matched NFC access feedback to keypad-code feedback: authorized badges use
the long success beep, while unauthorized badges and duplicate enrollment
attempts use the same three-beep invalid sequence.
- Reworked box-reader NFC enrollment into an administrator-only 15-second BLE
flow with an active waiting modal, in-modal errors, post-detection naming,
cancellation, duplicate detection, and authoritative tag-list refresh.
- Prevented generated permanent and temporary codes from colliding with any
active code, including across code kinds, and made firmware reject exclusive
creation when the value already exists.
- Added manual six-digit permanent-code editing with a numeric OTP-style input,
continuous multi-digit backspace behavior, and explicit confirmation before
converting a matching temporary code to permanent.
- Kept the final code card above the Android navigation area with the same
visible bottom inset as the modal's side spacing.
- Persisted each box's last authenticated BLE state in secure mobile storage so
history, permanent and one-time codes, NFC tags, and guests remain visible
after restarting the application while the box is out of range.
- Marked restored backups and guest QR invitations for BLE rediscovery so a new
phone creates its own Android bond before authenticating with the transferred
OpenParcelBox identity key.
- Removed the matching Android Bluetooth bond when a user forgets a box from
the application, while leaving firmware data unchanged unless factory reset
was explicitly selected.
- Kept the cached dashboard immediately available while startup reconnection
runs in the background or the box remains out of range.
- Prevented ordinary Android BLE connection timeouts from deleting a valid
bond, and added scan-based recovery when a saved private BLE address changes.
- Reassembled authenticated BLE state from 480-byte pages so code, NFC-tag,
opening-history, and guest data no longer produce JSON truncated at the
512-byte GATT attribute limit.
- Removed redundant state-change notifications after mobile BLE commands to
prevent explicit and automatic state reads from racing each other.
### Added
- Added PN532 passive-tag detection over the shared I2C bus at 7-bit address
`0x24`, including firmware-version probing, ISO/IEC 14443-A UID reads, mobile
enrollment, stored-tag unlock, history, and UART diagnostics.
- Added a fixed 15-second NFC scan window started only by the first keypad press;
additional presses cannot extend it, and the PN532 enters I2C-wakeable
power-down mode outside scan windows.
- Internal identity-reset button on XIAO `P1.11`: holding it for three seconds
clears administrator and guest app identities plus BLE bonds without erasing
access codes, NFC tags, history, or the box name.
- One-second white RGB indication when firmware initialization completes and
the keypad loop is ready.
- Branded Android launcher icon and native splash screen using the project
assets.
- French and English mobile UI with automatic phone-language selection and a
manual override.
- Dark mobile dashboard, shortcut bar, styled modals, code limits, opening
history, phone-side NFC UID scanning, and administrator/guest role controls.
- Secure saved-box records, automatic BLE reconnection, invitation QR
generation/scanning, and guest revocation.
- AES-256-GCM password-protected mobile backup and restore using a
PBKDF2-SHA256 derived key.
- Persistent box names and administrator factory reset with BLE bond removal.
- Persistent seven-day opening history for permanent codes, temporary codes,
named NFC tags, and named mobile identities.
- Fallback time `2026-06-01T00:00:00Z` and reboot continuity from the newest
persisted opening event.
- Eight permanent and twenty temporary access-code slots.
- BLE LE Secure Connections, AES-CCM encrypted GATT access, persistent bonding,
and 128-bit administrator/guest application identities.
- First-phone administrator provisioning without exposing the stored key.
- App-triggered NFC enrollment with persistent tag names.
- Dashboard synchronization shortcut and automatic mobile refresh from compact
firmware state-change notifications.
- Persistent administrator-registration progress and error screen with an
explicit return action.
- Persistent timestamp for the most recent successful mobile settings backup.
- Mobile offline dashboard banner with a reconnect shortcut and read-only access
to cached history, codes, NFC tags, and guests.
- Initial project structure.
- Zephyr RTOS firmware baseline.
- Standardized project architecture.
- Firmware coding conventions.
- Documentation structure.
- RGB LED driver.
- GPIO expander abstraction layer.
- Matrix keypad driver.
- Active buzzer driver.
- Firmware component documentation.
- Firmware debugging documentation.
- Firmware buzzer documentation.
- Firmware lock control documentation.
- English architecture documentation in `docs/architecture.md`.
- Persistent six-digit access code storage.
- Persistent NFC tag UID storage with default development UID `60:4F:E2:B5`.
- NFC scan-mode application flow triggered by keypad activity.
- Flutter mobile application shell in `mobile-app/app`.
- Mobile application use of the root `images/` logo and `background.jpg` assets.
- Mobile BLE scan/connect flow targeting the OpenParcelBox XIAO service.
- Mobile commands for XIAO clock synchronization, direct lock opening, access-code management, and NFC tag management.
- Firmware BLE administration service with JSON command writes and stored-state readback.
- Volatile phone-synchronized firmware clock for lock-opening log timestamps.
- One-time access codes that are removed after first successful keypad use.
- Lock control pulse on XIAO pin `D9`.
- Lock state feedback detection using KR-S79 `COM/NC` on XIAO `D7` / `D8`.
- Long buzzer success beep for accepted unlock codes.
- Door opened and door closed UART messages.
- NFC scan and UID validation UART messages.
### Changed
- Android BLE reconnection now removes a stale phone-side bond and retries when
secure pairing reports that it did not complete after the box cleared bonds.
- Android administrator registration now initiates bonding from the app before
GATT discovery instead of racing a firmware-triggered security request.
- Mobile BLE write authorization failures now explain that the restored
application identity no longer matches the identity stored in the box.
- Android administrator registration now waits for firmware-triggered BLE
bonding before falling back to an explicit bond request.
- Mobile administrator registration now explains when the box already has an
administrator instead of surfacing a raw `Bad state` error.
- Firmware now stores up to four BLE bonds and can replace the oldest unused
bond, avoiding stale Android pairing keys blocking reconnection.
- Firmware now clears stale BLE bonds before first administrator provisioning
when no administrator identity exists yet.
- Refactored firmware into independent components.
- Standardized source file headers.
- Standardized project coding style.
- Centralized board-specific definitions into `board_config.h`.
- Updated project documentation to English.
- Renamed project constraint documents from `contraintes.md` to `constraints.md`.
- Updated firmware, hardware, Home Assistant, and mobile application documentation.
- Disabled mobile box-mutating actions while offline, including open,
synchronization-only, code, NFC, guest, and factory-reset actions.
- Aligned hardware documentation with the active buzzer transistor driver.
- Aligned firmware documentation with C17 and the current Zephyr build tools.
- Updated project tracking documents to reflect completed RGB LED, GPIO expander, keypad, and active buzzer work.
- Updated keypad unlock user feedback with off-at-rest LEDs, green-open indication, red invalid-code feedback, and `B` entry cancellation.
- Updated runtime LED feedback with blue NFC scan-mode indication.
- Updated open-lock reminder beep interval to 2 seconds.
- Updated the mobile application to reload access codes and NFC tags from the firmware BLE state characteristic.
- Reworked NFC actions into a three-item shortcut bar, kept scan guidance
visible inside the modal, and clarified manual UID entry and pairing labels.
- Improved mobile settings with immediate language changes, language flags,
visible backup-location state, and explanatory input-dialog text.
- Replaced the solid mobile page background with the project background image
and grouped the logo, box name, active identity, and Bluetooth indicator in a
solid dashboard header.
- Anchored dashboard actions to equal 20-pixel side and bottom margins and
arranged NFC tags, guests, and settings as a compact three-card row.
- Doubled the separation between the dashboard shortcut bar and the action
cards, and added show/hide controls to password fields.
- Restored guest access to global opening history and code lists, allowed guest
management of temporary codes, hid permanent-code mutation and firmware
update actions, and displayed modal errors above the active modal.
- Merged the separate mobile factory-reset action into box removal: guests see
a local-data warning, while administrators receive a detailed warning and an
optional checkbox to reset the physical box as well.
- Corrected NFC hardware documentation: the nRF52840 integrated NFCT peripheral is tag-side NFC-A hardware, while passive badge UID reading requires a dedicated NFC reader circuit.
### Fixed
- Fixed Android box registration discovery by scanning nearby BLE
advertisements before applying the OpenParcelBox name/service filter in the
application, waiting for the actual scan timeout, and refreshing registration
results as advertisements arrive.
- Replaced the per-device registration icon with radio-button box selection and
an explicit add button, with inline errors and terminal diagnostics for
provisioning failures.
- Kept a completed administrator registration when the following clock
synchronization fails instead of reporting the whole addition as failed.
- Serialized Android BLE connection, secure bonding, MTU negotiation, and GATT
discovery before the first encrypted state read.
- Added one-time stale-bond recovery when Android disconnects during the first
encrypted provisioning read.
- Removed the Android BLE bond after a successful administrator factory reset,
preventing the stale bond from rejecting the next administrator registration.
- Moved modal close controls fully inside their hit-test area and increased the
touch target so closing a mobile modal is reliable.
- Removed the duplicate visible Android 12 splash icon before the branded
Flutter splash frame.
- Enabled administrator registration as soon as a box and name are selected,
stopped active BLE scanning before connecting, and increased the registration
connection window from 12 to 20 seconds.
- Closed the administrator-registration progress modal immediately after
provisioning instead of waiting for the secondary clock synchronization.
- Removed the exact registration modal route as soon as the controller publishes
the newly saved box, preventing the loading overlay from remaining above an
already rendered dashboard.
- Requested BLE security immediately on firmware connection and restarted
connectable advertising after every recycled connection, including failed
initial pairing attempts.
- Replaced Zephyr Secure Connections Only Mode, which implicitly required
unavailable level-4 passkey/OOB authentication, with Secure Connections
pairing-only mode and encrypted level-2 bonding for the headless XIAO.
- Added a Material surface behind registration radio rows so Android ink and
selection rendering no longer emits an invisible-background warning.
- Increased the firmware ATT MTU to 247 bytes with matching ACL buffers so the
120-byte administrator provisioning JSON fits in one acknowledged GATT write
instead of exceeding the previous 62-byte payload limit.
- Fixed the Android startup logo safe area so the complete logo remains
centered instead of being cropped by the system splash icon mask, while
restoring `background.jpg` and increasing the visible logo size.
- Removed oversized Settings callback allocations that exceeded the 1024-byte
main stack once opening-history or application-identity records existed.
- Moved Settings/NVS loading to a dedicated 4096-byte services thread and
increased the main, system-workqueue, and Bluetooth RX stack margins.
- Kept the keypad fallback code and default clock available from RAM before any
flash or Bluetooth operation can run.
- Added bounded retries when Bluetooth advertising temporarily returns
`-EAGAIN`, and no longer abort advertising solely because stored Bluetooth
settings report a load error.
- Prevented invalid persisted box settings from overwriting the active default
configuration before validation.
- Kept opening-history timestamps monotonic after an older phone clock sync so
one descending event cannot invalidate the complete table on reboot.
- Provided Flutter's Material localization delegates so input fields and
registration dialogs work when the phone language is French.
- Prevented incompatible persistent development-table layouts from blocking
firmware startup before keypad initialization; affected tables now recover
through their safe defaults.
- Made Bluetooth initialization asynchronous so keypad operation and USB
availability no longer wait for BLE controller startup.
- Removed the silent early exit when RGB LED initialization fails.
- Kept keypad access available with in-memory default credentials when
persistent settings fail, and added background keypad initialization retries.
- Fixed secure BLE startup ordering: the persisted `bt/*` settings and identity
are now loaded after `bt_enable()` and before advertising, preventing
`BLE advertising failed: -11`.
- Moved secure BLE initialization to a dedicated thread started after the local
keypad-ready indication, so Bluetooth or bond restoration can never block
keypad access, lock control, or the main application loop.
- Removed the interactive Zephyr/I2C shell and its competing serial backend;
USB CDC is now owned exclusively by the firmware console, matching the
validated standalone diagnostic configuration.
- Restricted guest BLE sessions to authentication, clock synchronization, lock
opening, and temporary-code management; permanent-code, NFC, identity, and
destructive administration remain blocked. Replaced oversized full-state
notifications with a compact change marker.
- Added strict validation of persisted identity and opening-history records
before they can be used or serialized.
- Removed automatic NVS writes and migrations from the boot path. Default
tables are now available immediately in RAM and are persisted only after a
real credential, identity, tag, box-name, or history change.
- Replaced the coupled application loop with a resilient local-first entry
point: keypad input, code validation, lock control, buzzer, LEDs, and door
feedback run independently from BLE and NFC processing.
- Temporarily removed NFC polling from the production main loop while retaining
NFC storage and BLE management initialization; it will be restored after the
validated keypad/BLE baseline is confirmed on hardware.
- Fixed Flutter inherited-widget assertions when closing input modals by keeping
text controllers alive until their dialog widgets are actually unmounted.
- Changed encrypted-backup restoration to select the backup file before asking
for its password.
- Matrix keypad scanning.
- GPIO expander abstraction.
- Firmware build configuration.
- Removed obsolete documentation references to `board_pins.h`.
- Removed obsolete documentation references to PWM buzzer control.
- Removed stale development-environment references from project documentation.
- Removed corrupted text encoding artifacts from Markdown documentation.
- Prevented unintended lock command pulses at startup or after flashing by declaring D9 in Devicetree and configuring it directly inactive.
---
## [0.1.0] - TBD
### Added
- First public development release.
- Zephyr RTOS firmware.
- RGB LED driver.
- GPIO expander driver.
- Matrix keypad driver.
- Active buzzer driver.
- Initial documentation.
- Project roadmap.
- TODO list.