julian
0375227a16
Two-step device setup so the admin verifies before committing — and never touches the device's own web UI. - POST /api/setup/test (admin-only): healthCheck + checkPreconditions, no save and no device change. Returns device health + precondition issues. - assign (Save) now also runs fixPreconditions (e.g. disables input_link_relay so a button press doesn't auto-fire its relay) before configuring the input push. Closes a gap where an assigned device could still auto-open. Fails the save with no DB row if device configuration fails (no orphan/half-configured rows). - SetupWizard: wires config fields -> Test connection (health badge + precondition warnings) -> Save & configure; editing config resets prior test/save status. Verified in-browser against the real device: Test -> ● ready + preconditions OK; Save -> row persisted AND the device's Input Link URL written (push path matches the saved device id). wiki/first-run-setup updated.
44 lines
2.2 KiB
Markdown
44 lines
2.2 KiB
Markdown
---
|
|
type: concept
|
|
tags: [parking, architecture, devices, admin]
|
|
sources: [parking-system-architecture]
|
|
updated: 2026-06-15
|
|
---
|
|
|
|
# First-Run Setup (device selection)
|
|
|
|
The admin install flow that makes the system **device-agnostic in practice**: on first run, an
|
|
admin assigns devices **per lane** by choosing from the [[device-registry]] catalog and entering
|
|
each device's connection config.
|
|
|
|
> Implementation-derived (from `apps/server` + `apps/web`), not the source doc.
|
|
|
|
## Flow
|
|
|
|
1. **Read the catalog** — `GET /api/setup/catalog` returns supported drivers per category (no
|
|
secrets, just schema) plus a `discoverable` list. The web `SetupWizard` renders a picker + the
|
|
driver's config fields, and a **Scan** button for discoverable drivers ([[device-discovery]]).
|
|
2. **Test** (optional, no save) — `POST /api/setup/test` (admin-only). Validates the config,
|
|
probes reachability (`healthCheck`), and reports preconditions (e.g. `input_link_relay`) —
|
|
**without** saving or changing the device. The wizard's **Test connection** button shows a
|
|
health badge + any precondition warnings.
|
|
3. **Save & configure** — `POST /api/setup/assign` (admin-only). Validates, then **configures the
|
|
device**: fixes preconditions (e.g. disables `input_link_relay`) and sets up the Digest-
|
|
authenticated input push ([[device-input-flow]]) — the admin never touches the device's own web
|
|
UI. **Fails the save** (no DB row) if the device can't be configured, so there are no
|
|
orphan/half-configured rows. On success persists to `lane_devices`.
|
|
4. **Complete** — `POST /api/setup/complete` marks the single-row `setup_state`.
|
|
|
|
## Config granularity
|
|
|
|
Organized **per lane** — each lane gets an access controller, reader(s), and camera(s), each with
|
|
its own connection settings. Matches the architecture's "mixable per lane" reality (a lane can
|
|
serve permit holders via [[wiegand]] and casual via host-side reads on one relay — see
|
|
[[entry-exit-readers]]).
|
|
|
|
## Security notes
|
|
|
|
- The assign/state/complete endpoints require the **admin** role ([[local-jwt-auth]]).
|
|
- Device **credentials are stored in `lane_devices.config`** — protect at rest
|
|
([[disk-os-hardening]]); device hosts belong on the isolated VLAN ([[network-isolation]]).
|