295 lines
17 KiB
Markdown
295 lines
17 KiB
Markdown
# Changelog
|
|
|
|
All notable changes to this project will be documented in this file.
|
|
|
|
The format is based on Keep a Changelog and this project follows Semantic Versioning.
|
|
|
|
---
|
|
|
|
## [Unreleased]
|
|
|
|
### Fixed
|
|
|
|
- Aligned project documentation with the implemented PN532, BLE, mobile,
|
|
opening-history, user-role, one-time-code, 150 ms lock-pulse, and diagnostic
|
|
behavior, while keeping unfinished timeout, power, Zigbee, and Home Assistant
|
|
work explicitly marked as pending.
|
|
- Restored explicit 2-second open-door reminder diagnostics and increased the
|
|
D9 lock-control pulse from 100 ms to 150 ms so mechanical relay stages have
|
|
more time to present `SIG` without excessive coil-on time.
|
|
- Added a clipboard action to permanent and temporary access-code rows in the
|
|
mobile application, positioned before the edit action.
|
|
- Matched NFC access feedback to keypad-code feedback: authorized badges use
|
|
the long success beep, while unauthorized badges and duplicate enrollment
|
|
attempts use the same three-beep invalid sequence.
|
|
- Reworked box-reader NFC enrollment into an administrator-only 15-second BLE
|
|
flow with an active waiting modal, in-modal errors, post-detection naming,
|
|
cancellation, duplicate detection, and authoritative tag-list refresh.
|
|
- Prevented generated permanent and temporary codes from colliding with any
|
|
active code, including across code kinds, and made firmware reject exclusive
|
|
creation when the value already exists.
|
|
- Added manual six-digit permanent-code editing with a numeric OTP-style input,
|
|
continuous multi-digit backspace behavior, and explicit confirmation before
|
|
converting a matching temporary code to permanent.
|
|
- Kept the final code card above the Android navigation area with the same
|
|
visible bottom inset as the modal's side spacing.
|
|
- Persisted each box's last authenticated BLE state in secure mobile storage so
|
|
history, permanent and one-time codes, NFC tags, and guests remain visible
|
|
after restarting the application while the box is out of range.
|
|
- Marked restored backups and guest QR invitations for BLE rediscovery so a new
|
|
phone creates its own Android bond before authenticating with the transferred
|
|
OpenParcelBox identity key.
|
|
- Removed the matching Android Bluetooth bond when a user forgets a box from
|
|
the application, while leaving firmware data unchanged unless factory reset
|
|
was explicitly selected.
|
|
- Kept the cached dashboard immediately available while startup reconnection
|
|
runs in the background or the box remains out of range.
|
|
- Prevented ordinary Android BLE connection timeouts from deleting a valid
|
|
bond, and added scan-based recovery when a saved private BLE address changes.
|
|
- Reassembled authenticated BLE state from 480-byte pages so code, NFC-tag,
|
|
opening-history, and guest data no longer produce JSON truncated at the
|
|
512-byte GATT attribute limit.
|
|
- Removed redundant state-change notifications after mobile BLE commands to
|
|
prevent explicit and automatic state reads from racing each other.
|
|
|
|
### Added
|
|
|
|
- Added PN532 passive-tag detection over the shared I2C bus at 7-bit address
|
|
`0x24`, including firmware-version probing, ISO/IEC 14443-A UID reads, mobile
|
|
enrollment, stored-tag unlock, history, and UART diagnostics.
|
|
- Added a fixed 15-second NFC scan window started only by the first keypad press;
|
|
additional presses cannot extend it, and the PN532 enters I2C-wakeable
|
|
power-down mode outside scan windows.
|
|
- Internal identity-reset button on XIAO `P1.11`: holding it for three seconds
|
|
clears administrator and guest app identities plus BLE bonds without erasing
|
|
access codes, NFC tags, history, or the box name.
|
|
- One-second white RGB indication when firmware initialization completes and
|
|
the keypad loop is ready.
|
|
- Branded Android launcher icon and native splash screen using the project
|
|
assets.
|
|
- French and English mobile UI with automatic phone-language selection and a
|
|
manual override.
|
|
- Dark mobile dashboard, shortcut bar, styled modals, code limits, opening
|
|
history, phone-side NFC UID scanning, and administrator/guest role controls.
|
|
- Secure saved-box records, automatic BLE reconnection, invitation QR
|
|
generation/scanning, and guest revocation.
|
|
- AES-256-GCM password-protected mobile backup and restore using a
|
|
PBKDF2-SHA256 derived key.
|
|
- Persistent box names and administrator factory reset with BLE bond removal.
|
|
- Persistent seven-day opening history for permanent codes, temporary codes,
|
|
named NFC tags, and named mobile identities.
|
|
- Fallback time `2026-06-01T00:00:00Z` and reboot continuity from the newest
|
|
persisted opening event.
|
|
- Eight permanent and twenty temporary access-code slots.
|
|
- BLE LE Secure Connections, AES-CCM encrypted GATT access, persistent bonding,
|
|
and 128-bit administrator/guest application identities.
|
|
- First-phone administrator provisioning without exposing the stored key.
|
|
- App-triggered NFC enrollment with persistent tag names.
|
|
- Dashboard synchronization shortcut and automatic mobile refresh from compact
|
|
firmware state-change notifications.
|
|
- Persistent administrator-registration progress and error screen with an
|
|
explicit return action.
|
|
- Persistent timestamp for the most recent successful mobile settings backup.
|
|
- Mobile offline dashboard banner with a reconnect shortcut and read-only access
|
|
to cached history, codes, NFC tags, and guests.
|
|
- Initial project structure.
|
|
- Zephyr RTOS firmware baseline.
|
|
- Standardized project architecture.
|
|
- Firmware coding conventions.
|
|
- Documentation structure.
|
|
- RGB LED driver.
|
|
- GPIO expander abstraction layer.
|
|
- Matrix keypad driver.
|
|
- Active buzzer driver.
|
|
- Firmware component documentation.
|
|
- Firmware debugging documentation.
|
|
- Firmware buzzer documentation.
|
|
- Firmware lock control documentation.
|
|
- English architecture documentation in `docs/architecture.md`.
|
|
- Persistent six-digit access code storage.
|
|
- Persistent NFC tag UID storage with default development UID `60:4F:E2:B5`.
|
|
- NFC scan-mode application flow triggered by keypad activity.
|
|
- Flutter mobile application shell in `mobile-app/app`.
|
|
- Mobile application use of the root `images/` logo and `background.jpg` assets.
|
|
- Mobile BLE scan/connect flow targeting the OpenParcelBox XIAO service.
|
|
- Mobile commands for XIAO clock synchronization, direct lock opening, access-code management, and NFC tag management.
|
|
- Firmware BLE administration service with JSON command writes and stored-state readback.
|
|
- Volatile phone-synchronized firmware clock for lock-opening log timestamps.
|
|
- One-time access codes that are removed after first successful keypad use.
|
|
- Lock control pulse on XIAO pin `D9`.
|
|
- Lock state feedback detection using KR-S79 `COM/NC` on XIAO `D7` / `D8`.
|
|
- Long buzzer success beep for accepted unlock codes.
|
|
- Door opened and door closed UART messages.
|
|
- NFC scan and UID validation UART messages.
|
|
|
|
### Changed
|
|
|
|
- Android BLE reconnection now removes a stale phone-side bond and retries when
|
|
secure pairing reports that it did not complete after the box cleared bonds.
|
|
- Android administrator registration now initiates bonding from the app before
|
|
GATT discovery instead of racing a firmware-triggered security request.
|
|
- Mobile BLE write authorization failures now explain that the restored
|
|
application identity no longer matches the identity stored in the box.
|
|
- Android administrator registration now waits for firmware-triggered BLE
|
|
bonding before falling back to an explicit bond request.
|
|
- Mobile administrator registration now explains when the box already has an
|
|
administrator instead of surfacing a raw `Bad state` error.
|
|
- Firmware now stores up to four BLE bonds and can replace the oldest unused
|
|
bond, avoiding stale Android pairing keys blocking reconnection.
|
|
- Firmware now clears stale BLE bonds before first administrator provisioning
|
|
when no administrator identity exists yet.
|
|
- Refactored firmware into independent components.
|
|
- Standardized source file headers.
|
|
- Standardized project coding style.
|
|
- Centralized board-specific definitions into `board_config.h`.
|
|
- Updated project documentation to English.
|
|
- Renamed project constraint documents from `contraintes.md` to `constraints.md`.
|
|
- Updated firmware, hardware, Home Assistant, and mobile application documentation.
|
|
- Disabled mobile box-mutating actions while offline, including open,
|
|
synchronization-only, code, NFC, guest, and factory-reset actions.
|
|
- Aligned hardware documentation with the active buzzer transistor driver.
|
|
- Aligned firmware documentation with C17 and the current Zephyr build tools.
|
|
- Updated project tracking documents to reflect completed RGB LED, GPIO expander, keypad, and active buzzer work.
|
|
- Updated keypad unlock user feedback with off-at-rest LEDs, green-open indication, red invalid-code feedback, and `B` entry cancellation.
|
|
- Updated runtime LED feedback with blue NFC scan-mode indication.
|
|
- Updated open-lock reminder beep interval to 2 seconds.
|
|
- Updated the mobile application to reload access codes and NFC tags from the firmware BLE state characteristic.
|
|
- Reworked NFC actions into a three-item shortcut bar, kept scan guidance
|
|
visible inside the modal, and clarified manual UID entry and pairing labels.
|
|
- Improved mobile settings with immediate language changes, language flags,
|
|
visible backup-location state, and explanatory input-dialog text.
|
|
- Replaced the solid mobile page background with the project background image
|
|
and grouped the logo, box name, active identity, and Bluetooth indicator in a
|
|
solid dashboard header.
|
|
- Anchored dashboard actions to equal 20-pixel side and bottom margins and
|
|
arranged NFC tags, guests, and settings as a compact three-card row.
|
|
- Doubled the separation between the dashboard shortcut bar and the action
|
|
cards, and added show/hide controls to password fields.
|
|
- Restored guest access to global opening history and code lists, allowed guest
|
|
management of temporary codes, hid permanent-code mutation and firmware
|
|
update actions, and displayed modal errors above the active modal.
|
|
- Merged the separate mobile factory-reset action into box removal: guests see
|
|
a local-data warning, while administrators receive a detailed warning and an
|
|
optional checkbox to reset the physical box as well.
|
|
- Corrected NFC hardware documentation: the nRF52840 integrated NFCT peripheral is tag-side NFC-A hardware, while passive badge UID reading requires a dedicated NFC reader circuit.
|
|
|
|
### Fixed
|
|
|
|
- Fixed Android box registration discovery by scanning nearby BLE
|
|
advertisements before applying the OpenParcelBox name/service filter in the
|
|
application, waiting for the actual scan timeout, and refreshing registration
|
|
results as advertisements arrive.
|
|
- Replaced the per-device registration icon with radio-button box selection and
|
|
an explicit add button, with inline errors and terminal diagnostics for
|
|
provisioning failures.
|
|
- Kept a completed administrator registration when the following clock
|
|
synchronization fails instead of reporting the whole addition as failed.
|
|
- Serialized Android BLE connection, secure bonding, MTU negotiation, and GATT
|
|
discovery before the first encrypted state read.
|
|
- Added one-time stale-bond recovery when Android disconnects during the first
|
|
encrypted provisioning read.
|
|
- Removed the Android BLE bond after a successful administrator factory reset,
|
|
preventing the stale bond from rejecting the next administrator registration.
|
|
- Moved modal close controls fully inside their hit-test area and increased the
|
|
touch target so closing a mobile modal is reliable.
|
|
- Removed the duplicate visible Android 12 splash icon before the branded
|
|
Flutter splash frame.
|
|
- Enabled administrator registration as soon as a box and name are selected,
|
|
stopped active BLE scanning before connecting, and increased the registration
|
|
connection window from 12 to 20 seconds.
|
|
- Closed the administrator-registration progress modal immediately after
|
|
provisioning instead of waiting for the secondary clock synchronization.
|
|
- Removed the exact registration modal route as soon as the controller publishes
|
|
the newly saved box, preventing the loading overlay from remaining above an
|
|
already rendered dashboard.
|
|
- Requested BLE security immediately on firmware connection and restarted
|
|
connectable advertising after every recycled connection, including failed
|
|
initial pairing attempts.
|
|
- Replaced Zephyr Secure Connections Only Mode, which implicitly required
|
|
unavailable level-4 passkey/OOB authentication, with Secure Connections
|
|
pairing-only mode and encrypted level-2 bonding for the headless XIAO.
|
|
- Added a Material surface behind registration radio rows so Android ink and
|
|
selection rendering no longer emits an invisible-background warning.
|
|
- Increased the firmware ATT MTU to 247 bytes with matching ACL buffers so the
|
|
120-byte administrator provisioning JSON fits in one acknowledged GATT write
|
|
instead of exceeding the previous 62-byte payload limit.
|
|
- Fixed the Android startup logo safe area so the complete logo remains
|
|
centered instead of being cropped by the system splash icon mask, while
|
|
restoring `background.jpg` and increasing the visible logo size.
|
|
- Removed oversized Settings callback allocations that exceeded the 1024-byte
|
|
main stack once opening-history or application-identity records existed.
|
|
- Moved Settings/NVS loading to a dedicated 4096-byte services thread and
|
|
increased the main, system-workqueue, and Bluetooth RX stack margins.
|
|
- Kept the keypad fallback code and default clock available from RAM before any
|
|
flash or Bluetooth operation can run.
|
|
- Added bounded retries when Bluetooth advertising temporarily returns
|
|
`-EAGAIN`, and no longer abort advertising solely because stored Bluetooth
|
|
settings report a load error.
|
|
- Prevented invalid persisted box settings from overwriting the active default
|
|
configuration before validation.
|
|
- Kept opening-history timestamps monotonic after an older phone clock sync so
|
|
one descending event cannot invalidate the complete table on reboot.
|
|
- Provided Flutter's Material localization delegates so input fields and
|
|
registration dialogs work when the phone language is French.
|
|
- Prevented incompatible persistent development-table layouts from blocking
|
|
firmware startup before keypad initialization; affected tables now recover
|
|
through their safe defaults.
|
|
- Made Bluetooth initialization asynchronous so keypad operation and USB
|
|
availability no longer wait for BLE controller startup.
|
|
- Removed the silent early exit when RGB LED initialization fails.
|
|
- Kept keypad access available with in-memory default credentials when
|
|
persistent settings fail, and added background keypad initialization retries.
|
|
- Fixed secure BLE startup ordering: the persisted `bt/*` settings and identity
|
|
are now loaded after `bt_enable()` and before advertising, preventing
|
|
`BLE advertising failed: -11`.
|
|
- Moved secure BLE initialization to a dedicated thread started after the local
|
|
keypad-ready indication, so Bluetooth or bond restoration can never block
|
|
keypad access, lock control, or the main application loop.
|
|
- Removed the interactive Zephyr/I2C shell and its competing serial backend;
|
|
USB CDC is now owned exclusively by the firmware console, matching the
|
|
validated standalone diagnostic configuration.
|
|
- Restricted guest BLE sessions to authentication, clock synchronization, lock
|
|
opening, and temporary-code management; permanent-code, NFC, identity, and
|
|
destructive administration remain blocked. Replaced oversized full-state
|
|
notifications with a compact change marker.
|
|
- Added strict validation of persisted identity and opening-history records
|
|
before they can be used or serialized.
|
|
- Removed automatic NVS writes and migrations from the boot path. Default
|
|
tables are now available immediately in RAM and are persisted only after a
|
|
real credential, identity, tag, box-name, or history change.
|
|
- Replaced the coupled application loop with a resilient local-first entry
|
|
point: keypad input, code validation, lock control, buzzer, LEDs, and door
|
|
feedback run independently from BLE and NFC processing.
|
|
- Temporarily removed NFC polling from the production main loop while retaining
|
|
NFC storage and BLE management initialization; it will be restored after the
|
|
validated keypad/BLE baseline is confirmed on hardware.
|
|
|
|
- Fixed Flutter inherited-widget assertions when closing input modals by keeping
|
|
text controllers alive until their dialog widgets are actually unmounted.
|
|
- Changed encrypted-backup restoration to select the backup file before asking
|
|
for its password.
|
|
- Matrix keypad scanning.
|
|
- GPIO expander abstraction.
|
|
- Firmware build configuration.
|
|
- Removed obsolete documentation references to `board_pins.h`.
|
|
- Removed obsolete documentation references to PWM buzzer control.
|
|
- Removed stale development-environment references from project documentation.
|
|
- Removed corrupted text encoding artifacts from Markdown documentation.
|
|
- Prevented unintended lock command pulses at startup or after flashing by declaring D9 in Devicetree and configuring it directly inactive.
|
|
|
|
---
|
|
|
|
## [0.1.0] - TBD
|
|
|
|
### Added
|
|
|
|
- First public development release.
|
|
- Zephyr RTOS firmware.
|
|
- RGB LED driver.
|
|
- GPIO expander driver.
|
|
- Matrix keypad driver.
|
|
- Active buzzer driver.
|
|
- Initial documentation.
|
|
- Project roadmap.
|
|
- TODO list.
|