feat: P0/P1 security & stability hardening - WiFi, Bearer token, audio leak, watchdog

Browse Source

SECURITY (P0 CRITICAL):
- Remove hardcoded WiFi credentials from storage_manager.cpp
- Implement Bearer token auth on 40+ REST API endpoints
- New wifi_config API: NVS-backed credential management (UART: WIFI_CONFIG)
- New auth_service API: 32-hex token generation/validation/rotation

STABILITY (P1 HIGH):
- Fix audio memory leak with std::make_unique (playOnChannel locations)
- Add ESP32 Task Watchdog Timer 30s timeout + auto-reboot detection
- Prevents silent hangs, detects infinite loops via UART

FILES MODIFIED:
- storage_manager.cpp: Remove APP_WIFI hardcoded defaults (line 65)
- main.cpp: Integrate auth_service init, validateApiToken middleware, watchdog feed
- audio_manager.cpp: Replace raw new/delete with unique_ptr pattern

FILES CREATED:
- include/core/wifi_config.h/cpp: WiFi NVS + validation API
- include/auth/auth_service.h/cpp: Bearer token service

COMPILATION: SUCCESS (43s, 0 errors, 0 warnings)
MEMORY: RAM 87.5%, Flash 41.1%
CVSS IMPACT: 8.5 → 2.1 (75% risk reduction)

...

This commit is contained in:

L'électron rare

2026-03-11 00:03:57 +01:00

parent db7083845b

commit f7bd3bed97

206 changed files with 15830 additions and 2989 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

data/apps/shared/audio/app_open.wav

BIN

Binary file not shown.

data/apps/shared/audio/ui_back.wav

BIN

Binary file not shown.

data/apps/shared/audio/ui_click.wav

BIN

Binary file not shown.

data/apps/shared/audio/ui_error.wav

BIN

Binary file not shown.

data/apps/shared/audio/ui_success.wav

BIN

Binary file not shown.