Features/lockdown

[niccellular]

This PR presents one way to accomplish the "lockdown" mode I'm trying to get into firmware (meshtastic/firmware#9771) The basics of it is that with "lockdown" mode enabled on a node, physical access to an unattended node doesn't get you much. All the logging is disabled, a client connecting to the node will be required to enter a password before it can view/edit the configs, the .protos on the filesystem in flash are encrypted.

This PR plumbs in a auth mechanisms into the App such that it can talk to a locked down node. A node with lockdown mode enabled will not send complete protobufs (just defaults) to a client over BLE/USB unless they send the correct passphrase.

With these changes implemented, the App connecting to a node (BLE or USB) would be prompted to enter or set a passphrase. Without doing that the locked down node will just send you empty protobufs (defaults) not the actual contents. When sending the auth the App allows the user to specify a number of reboots and hours to allow until it expires. When it expires it wipes RAM and reboots. Which would default the node to a basic region unset, client, long_fast AQ== etc...

The App caches the passphrase so future reconnections don't prompt the user. I'm not sure if this is good or bad idea yet.

There is a new UI button created in Settings -> Security. A "Lock Now" button when pressed sends a protobuf to the node and tells it to erase the token, wipe RAM, and reboot.

[Copilot]

Pull request overview

Adds “lockdown mode” support to the Android app/service so clients must authenticate to read/write real config on locked nodes, plus a “Lock Now” action and intent constant cleanup for external consumers.

Changes:

• Introduces lockdown state/token flows and UI (unlock dialog, token display, “Lock Now” button) wired through repository/viewmodels to the service.
• Extends AIDL/service plumbing with sendLockdownUnlock() and sendLockNow(); adds encrypted local storage for cached passphrases.
• Centralizes broadcast Intent action constants under MeshtasticIntent and adjusts broadcast behavior/compat.

Reviewed changes

Copilot reviewed 35 out of 35 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
mesh_service_example/src/main/kotlin/com/meshtastic/android/meshserviceexample/MainActivity.kt	Uses shared MeshtasticIntent action constants instead of hardcoded strings.
gradle/libs.versions.toml	Adds AndroidX Security Crypto dependency for encrypted passphrase storage.
feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/component/SecurityConfigItemList.kt	Adds “Lock Now” action and displays lockdown token expiry/boots remaining.
feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/component/LoRaConfigItemList.kt	Avoids early-return when channel list is empty (supports locked nodes returning defaults).
feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/channel/ChannelConfigScreen.kt	Avoids early-return when primary channel is missing (supports locked nodes returning defaults).
feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/RadioConfigViewModel.kt	Exposes Lock Now command and lockdown token info flow.
feature/settings/src/main/kotlin/org/meshtastic/feature/settings/SettingsViewModel.kt	Exposes per-connection authorization state to settings UI.
feature/settings/src/main/kotlin/org/meshtastic/feature/settings/SettingsScreen.kt	Adjusts “managed” gating based on session authorization state.
core/service/src/test/kotlin/org/meshtastic/core/service/FakeIMeshService.kt	Updates test stub with new lockdown AIDL methods.
core/service/src/main/kotlin/org/meshtastic/core/service/testing/FakeIMeshService.kt	Updates runtime/testing stub with new lockdown AIDL methods.
core/service/src/main/kotlin/org/meshtastic/core/service/ServiceRepository.kt	Adds lockdown state/token/auth flows for UI/service coordination.
core/proto/src/main/proto	Updates proto submodule pointer.
core/proto/README.md	Adds module documentation and usage example.
core/model/README.md	Updates dependency version in docs.
core/api/src/main/kotlin/org/meshtastic/core/api/MeshtasticIntent.kt	Introduces shared broadcast action/extra constants in API module.
core/api/src/main/aidl/org/meshtastic/core/service/IMeshService.aidl	Adds AIDL APIs for lockdown unlock + lock-now.
core/api/README.md	Documents use of MeshtasticIntent constants.
app/src/test/java/com/geeksville/mesh/repository/radio/NordicBleInterfaceDrainTest.kt	Disables a flaky BLE mock timing test.
app/src/main/java/com/geeksville/mesh/ui/connections/ConnectionsViewModel.kt	Exposes lockdown state to connections UI.
app/src/main/java/com/geeksville/mesh/ui/connections/ConnectionsScreen.kt	Suppresses region-unset prompt until authorized on locked nodes.
app/src/main/java/com/geeksville/mesh/ui/Main.kt	Adds unlock dialog + Lock Now disconnect handling; filters TAK_* notifications from generic UI toast flow.
app/src/main/java/com/geeksville/mesh/ui/LockdownUnlockDialog.kt	New UI for passphrase entry/provisioning and TTL selection.
app/src/main/java/com/geeksville/mesh/service/MeshServiceBroadcasts.kt	Adds compat broadcast behavior and emits explicit disconnect broadcast.
app/src/main/java/com/geeksville/mesh/service/MeshService.kt	Wires new AIDL methods to action handler.
app/src/main/java/com/geeksville/mesh/service/MeshRouter.kt	Adds LockdownHandler to service router.
app/src/main/java/com/geeksville/mesh/service/MeshDataHandler.kt	Adjusts broadcast logic for additional port types and unknown packets.
app/src/main/java/com/geeksville/mesh/service/MeshConnectionManager.kt	Hooks lockdown lifecycle on connect/disconnect; adds local config clearing helper.
app/src/main/java/com/geeksville/mesh/service/MeshCommandSender.kt	Implements commands to submit passphrase/TTL and send Lock Now.
app/src/main/java/com/geeksville/mesh/service/MeshActionHandler.kt	Adds handlers to forward AIDL calls to LockdownHandler.
app/src/main/java/com/geeksville/mesh/service/LockdownPassphraseStore.kt	New encrypted storage for cached passphrases per device address.
app/src/main/java/com/geeksville/mesh/service/LockdownHandler.kt	New core lockdown state machine (auto-unlock, backoff, lock-now handling).
app/src/main/java/com/geeksville/mesh/service/FromRadioPacketHandler.kt	Routes TAK_* client notifications to lockdown handler (instead of generic notifications).
app/src/main/java/com/geeksville/mesh/service/Constants.kt	Switches app constants to MeshtasticIntent and adds missing action constants.
app/src/main/java/com/geeksville/mesh/model/UIState.kt	Exposes lockdown state/token and forwards unlock/lock-now calls to service.
app/build.gradle.kts	Adds encrypted shared prefs dependency to the app.

Comments suppressed due to low confidence (7)

core/api/src/main/kotlin/org/meshtastic/core/api/MeshtasticIntent.kt:22

• These self-imports (importing members of MeshtasticIntent from within the same file that defines MeshtasticIntent) are unnecessary and can be confusing; they may also trigger lint/formatting issues as unused imports. Remove them and reference the constants directly in KDoc (or keep KDoc references unqualified—Kotlin resolves them within the object).

import org.meshtastic.core.api.MeshtasticIntent.EXTRA_CONNECTED
import org.meshtastic.core.api.MeshtasticIntent.EXTRA_NODEINFO
import org.meshtastic.core.api.MeshtasticIntent.EXTRA_PACKET_ID
import org.meshtastic.core.api.MeshtasticIntent.EXTRA_STATUS

app/src/main/java/com/geeksville/mesh/service/MeshServiceBroadcasts.kt:56

• The comment says this is “numeric port number” compatibility, but payload.dataType.toString() is not guaranteed to be numeric (it may be an enum name). If the intent is to broadcast RECEIVED.<portNumInt>, use the actual numeric port value (e.g., an explicit int field/property) rather than toString(), so compatibility broadcasts reliably match what older consumers expect.

        // Also broadcast with the numeric port number for backwards compatibility with some apps
        val numericAction = actionReceived(payload.dataType.toString())
        if (numericAction != action) {

feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/component/SecurityConfigItemList.kt:1

• Newly added user-visible strings are hardcoded, which bypasses localization and makes consistency harder to maintain. Move these strings to resources (including pluralization for “boots remaining”) and use stringResource(...) so they can be translated and format-safe.
  feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/component/SecurityConfigItemList.kt:1
• Newly added user-visible strings are hardcoded, which bypasses localization and makes consistency harder to maintain. Move these strings to resources (including pluralization for “boots remaining”) and use stringResource(...) so they can be translated and format-safe.
  feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/component/SecurityConfigItemList.kt:1
• Newly added user-visible strings are hardcoded, which bypasses localization and makes consistency harder to maintain. Move these strings to resources (including pluralization for “boots remaining”) and use stringResource(...) so they can be translated and format-safe.
  feature/settings/src/main/kotlin/org/meshtastic/feature/settings/radio/component/SecurityConfigItemList.kt:1
• Creating a new SimpleDateFormat inside composition can cause unnecessary allocations on recomposition and SimpleDateFormat is generally error-prone. Prefer java.time formatting (where available) or at least wrap the formatter creation in remember(...) so it isn’t re-created every recomposition.
  app/src/test/java/com/geeksville/mesh/repository/radio/NordicBleInterfaceDrainTest.kt:55
• Ignoring this test removes coverage for packet queue draining behavior. If CI flakiness is due to timing, consider refactoring the test to be deterministic (e.g., controlling the scheduler/virtual time, removing real delays, or asserting via mocked callbacks/events) rather than disabling it entirely.

    @Ignore("Flaky: relies on timing in the Nordic BLE mock library which causes intermittent CI failures")
    @Test
    fun `drainPacketQueueAndDispatch reads multiple packets until empty`() = runTest(testDispatcher) {

[Copilot]

clientNotification.message appears to be nullable, but msg.startsWith("TAK_") will throw if msg is null. Use a safe-call check (or compare msg?.startsWith(...) == true) and only forward to handleLockdownNotification when non-null; otherwise fall back to existing notification handling.

Suggested change

	if (msg.startsWith("TAK_")) {
	if (msg?.startsWith("TAK_") == true) {