Alert: a code per user instead of a single code per house

[cicoub13]

The need

Today, a house has one code, and only one. Everyone shares the same: the residents, the person who comes to water the plants, the friend to whom we lent the keys for a weekend. Three consequences:

• you never know who disarmed the alarm;
• revoking access for one person requires changing the code for everyone;
• there is no way to grant time-limited access.

The code should belong to the person, not the house — and remain valid regardless of where it is entered: the Gladys app, a wall-mounted tablet, or later a physical keypad.

What is expected

• One code per user, revocable individually.
• Knowing who armed or disarmed, and being able to use this in a scene or notification.
• Distinct rights: some can arm and disarm, others only disarm.
• Time-limited codes for occasional access.

What it would look like

ACCESS CODES                                  + Add a code

Quentin              ••••      Arm · Disarm          active
Camille              ••••      Arm · Disarm          active
Home help           ••••      Disarm         08/09 → 15/09
Former tenant       ––––      —                       revoked

Questions to decide

1. Is a Gladys account required to have a code? Creating a full account for the person who comes to feed the cat for a week is cumbersome. Should there be « guest » codes without an associated account?
2. What rights in the first version: arm/disarm are sufficient, or should there already be « can force arming », « can modify configuration »?
3. Are time-limited codes in the first version, or a follow-up?
4. Enforced length? Can two people have the same code (in which case we no longer know who it is)?
5. What happens to the current house code during the update? It must continue to work, otherwise installations are put at risk.
6. What happens after several incorrect codes? Gladys already limits attempts — should there also be a notification, or even a trigger?
7. Is a duress code needed? A code that appears to disarm normally but discreetly alerts — useful if forced to open. It’s a classic of control panels, to be decided if it’s within the scope.

Complexity and dependencies

Medium. This request does not depend on any other and can be done in parallel with the rest. However, it does condition the arrival of physical keypads, which need Gladys to know how to validate a code.

Related requests: user codes are a prerequisite for physical keypads, and the identity of the person who disarms feeds the context of scenes.

---

This request is part of a set from the discussion Gladys Alarm System (need F08).

[cicoub13]

Implementation in progress → feat(alarm): one alarm code per person, hashed with bcrypt by cicoub13 · Pull Request #3105 · GladysAssistant/Gladys · GitHub

The assumptions retained for this first version, in order of the questions above:

1. Guest codes without a Gladys account: yes. An admin creates a code for the person who comes to feed the cat — a name, a code, an expiration date. No account to create.
2. Rights: no rights per code for now. Any valid code disarms. One point was clarified along the way: a code is never used to arm — arming remains the action of a connected user, a scene, or HomeKit. “Can force arming” and “can modify configuration” will wait.
3. Time-limited codes: in this version. The chosen day is valid in its entirety; after the deadline, the code is refused exactly like a wrong code — the keyboard does not tell a stranger that their code existed.
4. Length: 4 to 8 digits, and two people cannot have the same code. An already taken code is refused without ever saying by whom.
5. The current home code continues to work. On update, it becomes a guest code named after the house, assigned to no one in particular: it was a shared code, and putting it in someone’s profile would have allowed it to be replaced by mistake and cut off access to everyone else. Whoever wants to make it their personal code revokes it and enters it in their profile.
6. Wrong codes: current behavior preserved. The scene trigger “too many code attempts” remains the only hook — free for each to make a notification.
7. Constraint code: out of scope for this version.

What this changes in use:

• Each person sets their code from their profile page. A code is never readable again: neither by an admin nor by its owner. You replace it, you do not consult it.
• The alarm configuration (arming delay, access codes) becomes reserved for admins.
• The “alarm code” field of the house card gives way to the list of access codes: holder, expiration, revocation.
• Scenes know who disarmed, the first name of the person or the name of the guest code, directly usable in a scene (and therefore notification).
• The keyboard of locked wall tablets does not change.
• By the way: the home code was stored in plain text and returned by the API to any connected user. Codes are now hashed and never leave the server again.

A test image is available on cicoub13/gladys:alarm-user-codes

A data migration is applied, so ABSOLUTELY DO NOT use this image on your production database!!!

On the Settings → House page (Admin only) with guest codes

On the Profile page of each user

[cicoub13]

I think there’s an issue between House / Users / Code. Maybe we need to add a user’s affiliation to a house, but I’d like to discuss it first.

[quentins33]

What’s the problem?

[cicoub13]

A single code assigned to a user disables all houses.