Subversion Repositories ESP8266_P1_Meter

#pragma once

#include <Arduino.h>

#include <LittleFS.h>

#include <AsyncFsWebServer.h>  // https://github.com/cotestatnt/async-esp-fs-webserver

#include "mbedtls/md.h"

// Webserver class

AsyncFsWebServer myWebServer(LittleFS, 80, "esp32rfid");

extern TableManager usersTable;

extern const char* uniqueKeys[];

String getSHA256(const char* payload) {

  String hashed = "";

  byte shaResult[32];

  mbedtls_md_context_t ctx;

  const size_t payloadLength = strlen(payload);         

  mbedtls_md_init(&ctx);

  mbedtls_md_setup(&ctx, mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), 0);

  mbedtls_md_starts(&ctx);

  mbedtls_md_update(&ctx, (const unsigned char *) payload, payloadLength);

  mbedtls_md_finish(&ctx, shaResult);

  mbedtls_md_free(&ctx);

  for(int i= 0; i< sizeof(shaResult); i++){

    char str[3];

    sprintf(str, "%02x", (int)shaResult[i]);

    hashed += str;

  }

  return hashed;

}

int getUserLevel(const String& username, const String&  hash) {

  JsonObject user = usersTable.findRecord("username", username.c_str());

  if (user) {

    if (hash.equals(user["password"].as<const char*>())) {

      return user["level"].as<int>();

    }

  }

  return 0;

}

void handleGetUsers(AsyncWebServerRequest *request) {

  JsonArray users = usersTable.getUsers();

  String json;

  serializeJsonPretty(users, json);

  request->send(200, "application/json", json);

}

void handleNewUser(AsyncWebServerRequest *request) {

  String username = request->arg("username");

  String name = request->arg("name");

  String email = request->arg("email");

  String tag = request->arg("tag");

  String level = request->arg("level");

  String hashedPassword = getSHA256(request->arg("password").c_str());

  bool update = request->arg("type").equals("Update");

  JsonDocument newUser;

  newUser["username"] = username;

  newUser["password"] = hashedPassword;

  newUser["name"] = name;

  newUser["email"] = email;

  newUser["tag"] = tag;

  newUser["level"] = level;

  usersTable.loadTable();

  if (update){

    if (!usersTable.deleteRecord("username", username.c_str()))

      request->send(500, "text/plain", "Error");

  }

  if (usersTable.addRecord(newUser.as<JsonObject>(),uniqueKeys, 2))  {

    request->send(200, "text/plain", "OK");

    return;

  } 

  request->send(500, "text/plain", "Error");

}

void handleRemoveUser(AsyncWebServerRequest *request) {

  String username = request->arg("username");

  if (usersTable.deleteRecord("username", username.c_str()))

    request->send(200, "text/plain", "OK");

  else

    request->send(500, "text/plain", "Error");

}

void handleGetCode(AsyncWebServerRequest *request) {

  uint32_t timeout = millis();

  while (true) {

    if (mfrc522.PICC_IsNewCardPresent() && mfrc522.PICC_ReadCardSerial()) {

      uint64_t tagCode = 0;

      // tagCode is swapped, but it doesn't matter We need only it's a unique number

      for(byte i = 0; i < mfrc522.uid.size; i++) {

        tagCode |= mfrc522.uid.uidByte[i] << (8*i);

      }

      // With 8 byte TAG code, the result integer could be too large since JavaScript 

      // uses 64-bit floating-point numbers (IEEE 754), which have a maximum precision of 2^53 - 1 

      String result = "{\"tag\": \"";

      result += String(tagCode);  

      result += "\"}";

      Serial.printf("Tag code: 0x%llX", tagCode);

      request->send(200, "application/json", result);

      addLogRecord = true;

      return;

    }

    if (millis() - timeout > 5000) {

      request->send(500, "application/json", "{\"error\": \"timeout\"}");

      addLogRecord = true;

      return;

    }

  }

}

// This handler will be called from login page to check password

void handleCheckHash(AsyncWebServerRequest *request) {

  // Even if user con login, only user with level >= 5 can edit users table

  if (getUserLevel(request->arg("username"), request->arg("hash"))) {

    request->send(200, "text/plain", "OK");

  }

  else {

    request->send(401, "text/plain", "Wrong password");

  }

}

// This handler will be called from login page on login succesfull

void handleMainPage(AsyncWebServerRequest *request) {

  // Check again user and password to avoid direct page loading

  int level = getUserLevel(request->arg("username"), request->arg("hash"));

  if (level) {

    // Even if any user con login succesfully, only user with level >= 5 can edit users table

    // Username and user level is set here using cookie.

    String cookie = "username=" ;

    cookie += request->arg("username");

    cookie += ",";  cookie += level;  cookie += "; Path=/";

#if USE_EMBEDDED_HTM

    AsyncWebServerResponse *response = request->beginResponse(200, "text/html", (const uint8_t*)rfid, sizeof(rfid));

    response->addHeader("Content-Encoding", "gzip");

#else

    AsyncWebServerResponse *response = request->beginResponse(LittleFS, "/rfid", "text/html");    

#endif

    response->addHeader("Set-Cookie", cookie);

    request->send(response);    

  } 

  else {

    request->send(401, "text/plain", "Wrong password");

  }

}

// Configure and start webserver

bool startWebServer(bool clear = false) {

  bool connected = false;

  // FILESYSTEM INIT

  if (!LittleFS.begin()) {

    Serial.println("ERROR on mounting filesystem. It will be formmatted!");

    LittleFS.format();

    ESP.restart();

  }

  if (clear) {

    LittleFS.remove(myWebServer.getConfiFileName());

  }

  // Try to connect to WiFi (will start AP if not connected after timeout)

  if (!myWebServer.startWiFi(15000)) {

    Serial.println("\nWiFi not connected! Starting AP mode...");

    myWebServer.startCaptivePortal("ESP32_RFID", "", "/setup");

  }

  else 

    connected = true;

  // Add endpoints request handlers

  myWebServer.on("/users", HTTP_GET, handleGetUsers);

  myWebServer.on("/addUser", HTTP_POST, handleNewUser);

  myWebServer.on("/delUser", HTTP_POST, handleRemoveUser);

  myWebServer.on("/getCode", HTTP_GET, handleGetCode);

  myWebServer.on("/waitCode", HTTP_GET, [](AsyncWebServerRequest *request){

    addLogRecord = false; 

    request->send(200, "text/plain", "OK");

  });

  /* 

  * To avoid ugly and basic login prompt avalaible with "stardard" DIGEST_AUTH

  * let's use a custom login web page (from flash literal string). This web page

  * will send a POST request to /rfid enpoint passing username and password SHA256 hash

  */

  myWebServer.on("/", HTTP_ANY, [](AsyncWebServerRequest *request){

    request->redirect("/login");

  });

  #if USE_EMBEDDED_HTM

  myWebServer.on("/login", HTTP_ANY, [](AsyncWebServerRequest *request){

    AsyncWebServerResponse *response = request->beginResponse(200, "text/html", (const uint8_t*)login, sizeof(login));

    response->addHeader("Content-Encoding", "gzip");

    request->send(response);    

  });

  #else

  // Use flash stored file (remember to upload before using /setup embedded webpage)

  myWebServer.on("/login", HTTP_ANY, [](AsyncWebServerRequest *request){

    AsyncWebServerResponse *response = request->beginResponse(LittleFS, "/login.htm", "text/html");

    request->send(response);    

  });

  #endif

  /*

  * If client calculated password SHA256 hash string match with the user stored,

  * we can serve the /rfid web page (from flash literal string, same as login page)

  */

  myWebServer.on("/rfid", HTTP_POST, handleCheckHash);

  /*

  * Although it is not the conventional way, handle this page with a PUT request

  * otherwise it will be impossible to edit file if needed.

  * The embedded /edit webpage uses the GET method to retrieve the file content.

  */

  myWebServer.on("/rfid", HTTP_PUT, handleMainPage);

  // Enable ACE FS file web editor and add FS info callback function

  myWebServer.enableFsCodeEditor();

  // Start the webserver

  myWebServer.init();

  Serial.print("\n\nESP Web Server started on IP Address: ");

  Serial.println(myWebServer.getServerIP());

  Serial.println(

    "Open /setup page to configure optional parameters.\n"

    "Open /edit page to view, edit or upload example or your custom webserver source files."

  );

  return connected;

}