[ISSUE] A deleted user's code can keep working when the lock ignores the release clear

Chiusa
  • Qualcosa non va?
#1,622 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
43/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
python
Ambito
authentication, backend

Direzione di ricerca

Read async_release_managed_slot and the coordinator refactor planned after the current bug-fix PRs; the issue does not name files or tests. Trace how a deleted user's clear is confirmed and whether the slot can be read back after release. Done means an ignored clear is detected and retried, or raises a repair warning that the old PIN may still work.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug
What happened?

When a user is deleted, Lock Code Manager releases their slot and clears the code on the lock (async_release_managed_slot). If the lock acknowledges that clear without applying it, the deleted user's PIN keeps opening the door. Nothing reports it or retries.

Examples of a lock that does this:

  • a ZHA lock that answers with a success Default Response but drops the command;
  • a Z-Wave lock behind zwave-js-ui that receives an unsupervised User Code Set and ignores it.

Today Lock Code Manager reports the slot as empty after any clear that returns, so the problem is invisible:

  • the slot has already left the configuration, so no sync manager re-checks it;
  • the unmanaged-code sweep runs only at migration;
  • no repair is raised.

This is the same outcome as #1453 (deleted users kept working), reached through a different path: there the clear was never sent, here it is sent and silently ignored.

Expected: a release clear that the lock does not confirm is read back. If the code is still there, Lock Code Manager retries, or at least raises a repair telling the user the deleted user's code may still open the door.

Found while reviewing #1621 (closed). Doing the read-back properly depends on the coordinator refactor planned after the current bug-fix PRs, so this is tracked here until then.

Steps to reproduce the issue
  1. Use a lock that acknowledges a PIN clear without applying it: a ZHA lock replying with a success Default Response, or an unsupervised User Code Set through zwave-js-ui.
  2. Create a Lock Code Manager user with a PIN and let it sync to the lock.
  3. Make the lock ignore the next clear (on real hardware: a weak mesh link, or a lock that drops the command).
  4. Delete the user in Lock Code Manager.
  5. The slot shows as empty in Lock Code Manager, but the PIN still unlocks the door, and no repair is raised.
Home Assistant Version

2026.9.0

What version of Lock Code Manager are you running?

6.0.1

Lock make and model

Any lock whose clear can be acknowledged without being applied (seen in code review for ZHA and zwave-js-ui; not yet reproduced on hardware).

Anything else?

Related: #1453, #1621.

Lingua principale
Python
Stelle
114
Fork
20
Merge medio
2h 57m
PR unite (30g)
158

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di raman325/lock_code_manager

Tutte le issue di raman325/lock_code_manager

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.