Subversion Repositories ESP8266_P1_Meter

#include "CredentialManager.h"
#include "SerialLog.h"


CredentialManager::CredentialManager() : m_efuse_initialized(false) {
  memset(m_encryption_key, 0, ENCRYPTION_KEY_SIZE);

  // Default global options (hostname only)
  memset(m_hostname, 0, sizeof(m_hostname));

#if defined(ESP8266)
  m_filesystem = nullptr;
#endif
}

CredentialManager::~CredentialManager() {
  // Clean key from memory
  memset(m_encryption_key, 0, ENCRYPTION_KEY_SIZE);
  clearAll();
}

bool CredentialManager::begin() {
  initializeEncryptionKey();
  return true;
}

void CredentialManager::initializeEncryptionKey() {
#if defined(ESP32)
  esp_err_t err = esp_efuse_read_block(EFUSE_BLK_KEY0, m_encryption_key, 0,
                                       ENCRYPTION_KEY_SIZE * 8);

  if (err == ESP_OK) {
    // Check if truly programmed (not all 0xFF)
    bool all_ff = true;
    for (int i = 0; i < ENCRYPTION_KEY_SIZE; i++) {
      if (m_encryption_key[i] != 0xFF) {
        all_ff = false;
        break;
      }
    }

    if (!all_ff) {
      m_efuse_initialized = true;
      log_info("BLOCK_KEY0 initialized from eFuse - SECURE mode");
    } else {
      log_info("BLOCK_KEY0 not programmed - using fallback (NOT SECURE)");
      m_efuse_initialized = false;
      // Use fallback key (derived from MAC address or constant)
      // This obfuscates but is not real security
      memset(m_encryption_key, 0xAA, ENCRYPTION_KEY_SIZE);
    }
  } else {
    log_error("Failed to read BLOCK_KEY0: %s", esp_err_to_name(err));
    // Fallback to predefined key
    memset(m_encryption_key, 0xAA, ENCRYPTION_KEY_SIZE);
  }
#else
  // For ESP8266 or other chips, use fallback
  memset(m_encryption_key, 0xAA, ENCRYPTION_KEY_SIZE);
#endif
}

String CredentialManager::getStatus() const {
  if (m_efuse_initialized) {
    return "SECURE (BLOCK_KEY0 programmed)";
  } else {
    return "INSECURE (BLOCK_KEY0 not programmed - fallback key used)";
  }
}

void CredentialManager::setHostname(const char* hostname) {
  if (!hostname) {
    memset(m_hostname, 0, sizeof(m_hostname));
    return;
  }
  strlcpy(m_hostname, hostname, sizeof(m_hostname));
}

String CredentialManager::getHostname() const {
  return String(m_hostname);
}

// Web server port is fixed at construction time in AsyncFsWebServer
// and is not stored as a shared, mutable option in CredentialManager.

bool CredentialManager::addCredential(const WiFiCredential& credential, const char* plaintext_password) {
  if (strlen(credential.ssid) == 0) {
    log_error("Invalid SSID");
    return false;
  }
  if (!plaintext_password || strlen(plaintext_password) == 0) {
    log_error("Invalid password");
    return false;
  }

  if (m_credentials.size() >= MAX_CREDENTIALS) {
    log_error("Maximum credentials reached (%d)", MAX_CREDENTIALS);
    return false;
  }

  if (strlen(plaintext_password) > 63) {
    log_error("Password too long (max 63 characters)");
    return false;
  }

  // Create credential copy with encrypted password
  WiFiCredential cred = credential;

  // Encrypt password
  uint16_t encrypted_len = 0;
  if (!encryptPassword(plaintext_password, cred.pwd_encrypted, encrypted_len)) {
    log_error("Failed to encrypt password");
    return false;
  }

  cred.pwd_len = encrypted_len;

  m_credentials.push_back(cred);
  log_debug("Credential added: %s.", cred.ssid);

  return true;
}

bool CredentialManager::removeCredential(uint8_t index) {
  if (index >= m_credentials.size()) {
    log_error("Invalid credential index %d", index);
    return false;
  }

  log_debug("Removing credential: %s", m_credentials[index].ssid);
  memset(m_credentials[index].pwd_encrypted, 0, sizeof(m_credentials[index].pwd_encrypted));
  memset(m_credentials[index].ssid, 0, sizeof(m_credentials[index].ssid));
  m_credentials.erase(m_credentials.begin() + index);
  return true;
}

bool CredentialManager::removeCredential(const char* ssid) {
  if (!ssid) {
    return false;
  }

  for (size_t i = 0; i < m_credentials.size(); i++) {
    if (strcmp(m_credentials[i].ssid, ssid) == 0) {
      return removeCredential(static_cast<uint8_t>(i));
    }
  }

  log_error("Credential not found: %s", ssid);
  return false;
}

bool CredentialManager::updateCredential(const WiFiCredential& credential, const char* plaintext_password) {
  uint8_t index = 255;
  for (size_t i = 0; i < m_credentials.size(); i++) {
    if (strcmp(m_credentials[i].ssid, credential.ssid) == 0) {
      index = i;
      break;
    }
  }
  
  if (index >= m_credentials.size()) {
    log_error("Credential not found: %s", credential.ssid);
    return false;
  }

  if (!plaintext_password || strlen(plaintext_password) == 0) {
    log_error("Invalid password");
    return false;
  }

  if (strlen(plaintext_password) > 63) {
    log_error("Password too long (max 63 characters)");
    return false;
  }

  WiFiCredential &cred = m_credentials[index];

  // Encrypt new password
  uint16_t encrypted_len = 0;
  if (!encryptPassword(plaintext_password, cred.pwd_encrypted, encrypted_len)) {
    log_error("Failed to encrypt password");
    return false;
  }

  cred.pwd_len = encrypted_len;

  // Update IP configuration from credential parameter
  cred.gateway = credential.gateway;
  cred.subnet = credential.subnet;
  cred.local_ip = credential.local_ip;
  cred.dns1 = credential.dns1;
  cred.dns2 = credential.dns2;
  
  log_debug("Credential updated: %s.", credential.ssid);
  return true;
}

const char *CredentialManager::getSSID(uint8_t index) const {
  if (index >= m_credentials.size()) {
    return nullptr;
  }
  return m_credentials[index].ssid;
}

String CredentialManager::getPassword(uint8_t index) {
  if (index >= m_credentials.size()) {
    return "";
  }

  const WiFiCredential &cred = m_credentials[index];
  char plaintext[65] = {0};

  if (decryptPassword(cred.pwd_encrypted, cred.pwd_len, plaintext,
                      64)) {
    String result = plaintext;
    // Clean password from memory
    memset(plaintext, 0, 65);
    return result;
  }

  return "";
}

bool CredentialManager::setIPConfiguration(uint8_t index, IPAddress ip, IPAddress gateway, IPAddress subnet) {
  if (index >= m_credentials.size()) {
    log_error("Invalid credential index %d", index);
    return false;
  }

  m_credentials[index].local_ip = ip;
  m_credentials[index].gateway = gateway;
  m_credentials[index].subnet = subnet;

  log_debug("IP configuration updated for credential %d: IP=%s, GW=%s, SN=%s", 
            index, ip.toString().c_str(), gateway.toString().c_str(), subnet.toString().c_str());
  return true;
}

bool CredentialManager::getIPConfiguration(uint8_t index, IPAddress& ip, IPAddress& gateway, IPAddress& subnet) const {
  if (index >= m_credentials.size()) {
    log_error("Invalid credential index %d", index);
    return false;
  }

  ip = m_credentials[index].local_ip;
  gateway = m_credentials[index].gateway;
  subnet = m_credentials[index].subnet;

  return true;
}

void CredentialManager::clearAll() {
  // Clean each credential
  for (auto &cred : m_credentials) {
    memset(cred.pwd_encrypted, 0, sizeof(cred.pwd_encrypted));
    memset(cred.ssid, 0, sizeof(cred.ssid));
  }
  m_credentials.clear();
  #if defined(ESP8266)
    saveToFS();
  #elif defined(ESP32)
    saveToNVS();
  #endif
  log_debug("All credentials cleared");
}

bool CredentialManager::encryptPassword(const char *plaintext, uint8_t *ciphertext, uint16_t &cipher_len) {
  if (!plaintext || !ciphertext) {
    return false;
  }

  size_t plaintext_len = strlen(plaintext);
  if (plaintext_len > 63) {
    log_error("Password too long");
    return false;
  }

  // Apply PKCS7 padding
  uint8_t *padded = new uint8_t[64];
  uint16_t padded_len = 0;
  applyPKCS7Padding((uint8_t *)plaintext, plaintext_len, padded, padded_len);

  // AES-256-CBC encryption
  mbedtls_aes_context aes_ctx;
  mbedtls_aes_init(&aes_ctx);

  int ret = mbedtls_aes_setkey_enc(&aes_ctx, m_encryption_key, 256);
  if (ret != 0) {
    log_error("AES setkey failed: %d", ret);
    mbedtls_aes_free(&aes_ctx);
    delete[] padded;
    return false;
  }

  // Fixed IV (deterministic, not randomized)
  // In case of randomized IV, save it in the first block
  uint8_t iv[AES_BLOCK_SIZE] = {0};

  ret = mbedtls_aes_crypt_cbc(&aes_ctx, MBEDTLS_AES_ENCRYPT, padded_len, iv,
                              padded, ciphertext);

  mbedtls_aes_free(&aes_ctx);
  delete[] padded;

  if (ret != 0) {
    log_error("AES encryption failed: %d", ret);
    return false;
  }

  cipher_len = padded_len;
  return true;
}

bool CredentialManager::decryptPassword(const uint8_t *ciphertext, uint16_t cipher_len, char *plaintext, uint16_t max_len) {
  if (!ciphertext || !plaintext || cipher_len == 0 ||
      cipher_len % AES_BLOCK_SIZE != 0) {
    log_error("Invalid decryption parameters");
    return false;
  }

  if (cipher_len > max_len) {
    log_error("Buffer too small for decryption");
    return false;
  }

  // AES-256-CBC decryption
  mbedtls_aes_context aes_ctx;
  mbedtls_aes_init(&aes_ctx);

  int ret = mbedtls_aes_setkey_dec(&aes_ctx, m_encryption_key, 256);
  if (ret != 0) {
    log_error("AES setkey failed: %d", ret);
    mbedtls_aes_free(&aes_ctx);
    return false;
  }

  uint8_t iv[AES_BLOCK_SIZE] = {0};
  uint8_t *decrypted = new uint8_t[cipher_len];

  ret = mbedtls_aes_crypt_cbc(&aes_ctx, MBEDTLS_AES_DECRYPT, cipher_len, iv,
                              ciphertext, decrypted);

  mbedtls_aes_free(&aes_ctx);

  if (ret != 0) {
    log_error("AES decryption failed: %d", ret);
    delete[] decrypted;
    return false;
  }

  // Remove PKCS7 padding
  uint16_t plaintext_len = removePKCS7Padding(decrypted, cipher_len);
  if (plaintext_len == 0) {
    log_error("Invalid padding in decrypted data");
    delete[] decrypted;
    return false;
  }

  if (plaintext_len >= max_len) {
    log_error("Plaintext too long");
    delete[] decrypted;
    return false;
  }

  memcpy(plaintext, decrypted, plaintext_len);
  plaintext[plaintext_len] = '\0';

  // Clean sensitive data from memory
  memset(decrypted, 0, cipher_len);
  delete[] decrypted;

  return true;
}

void CredentialManager::applyPKCS7Padding(const uint8_t *data, uint16_t data_len, uint8_t *padded, uint16_t &padded_len) {
  // Calculate length with padding (multiple of 16)
  uint16_t total_len = ((data_len / AES_BLOCK_SIZE) + 1) * AES_BLOCK_SIZE;
  uint8_t pad_value = total_len - data_len;

  memcpy(padded, data, data_len);
  for (int i = data_len; i < total_len; i++) {
    padded[i] = pad_value;
  }

  padded_len = total_len;
}

uint16_t CredentialManager::removePKCS7Padding(uint8_t *data, uint16_t data_len) {
  if (data_len < AES_BLOCK_SIZE || data_len % AES_BLOCK_SIZE != 0) {
    return 0;
  }

  uint8_t pad_value = data[data_len - 1];

  // Validate padding
  if (pad_value > AES_BLOCK_SIZE || pad_value == 0) {
    return 0;
  }

  // Verify that all padding bytes have the correct value
  for (int i = data_len - pad_value; i < data_len; i++) {
    if (data[i] != pad_value) {
      return 0;
    }
  }

  return data_len - pad_value;
}

#if defined(ESP8266)
// Attach a filesystem instance used for persisting credentials on ESP8266.
// This must be called before saveToFS()/loadFromFS().
void CredentialManager::setFilesystem(fs::FS* fs) {
  m_filesystem = fs;
}

// Save credentials to FS in a simple binary format:
// [uint8_t count][char hostname[33]] then for each credential:
// [char ssid[33]][uint16_t pwd_len][uint8_t pwd_encrypted[64]]
// [uint32_t gateway][uint32_t subnet][uint32_t local_ip]
// [uint32_t dns1][uint32_t dns2]
bool CredentialManager::saveToFS(const char* filepath) {
  if (!m_filesystem) {
    log_error("Filesystem not set");
    return false;
  }

  File file = m_filesystem->open(filepath, "w");
  if (!file) {
    log_error("Failed to open %s for write", filepath);
    return false;
  }

  uint8_t count = m_credentials.size();
  if (count > MAX_CREDENTIALS) {
    count = MAX_CREDENTIALS;
  }

  // New simple format (breaking change is acceptable):
  // [count][hostname][credentials...]
  file.write(&count, 1);
  file.write((const uint8_t*)m_hostname, sizeof(m_hostname));

  for (uint8_t i = 0; i < count; i++) {
    const WiFiCredential &cred = m_credentials[i];

    file.write((const uint8_t*)cred.ssid, sizeof(cred.ssid));
    file.write((const uint8_t*)&cred.pwd_len, sizeof(cred.pwd_len));
    file.write((const uint8_t*)cred.pwd_encrypted, sizeof(cred.pwd_encrypted));

    uint32_t gw_addr = cred.gateway;
    uint32_t sn_addr = cred.subnet;
    uint32_t ip_addr = cred.local_ip;
    uint32_t dns1_addr_cred = cred.dns1;
    uint32_t dns2_addr_cred = cred.dns2;
    file.write((const uint8_t*)&gw_addr, sizeof(gw_addr));
    file.write((const uint8_t*)&sn_addr, sizeof(sn_addr));
    file.write((const uint8_t*)&ip_addr, sizeof(ip_addr));
    file.write((const uint8_t*)&dns1_addr_cred, sizeof(dns1_addr_cred));
    file.write((const uint8_t*)&dns2_addr_cred, sizeof(dns2_addr_cred));
  }

  file.close();
  log_info("Credentials saved to FS (%d entries)", count);
  return true;
}

// Load credentials from FS written by saveToFS().
// Uses the same binary layout as described above.
bool CredentialManager::loadFromFS(const char* filepath) {
  if (!m_filesystem) {
    log_error("Filesystem not set");
    return false;
  }

  if (!m_filesystem->exists(filepath)) {
    log_info("No credentials file found: %s", filepath);
    return false;
  }

  File file = m_filesystem->open(filepath, "r");
  if (!file) {
    log_error("Failed to open %s for read", filepath);
    return false;
  }

  m_credentials.clear();

  uint8_t count = 0;
  if (file.read(&count, 1) != 1 || count == 0) {
    file.close();
    log_debug("No credentials in FS");
    return false;
  }

  if (count > MAX_CREDENTIALS) {
    count = MAX_CREDENTIALS;
  }

  // Simple new format: hostname directly after count
  if (file.read((uint8_t*)m_hostname, sizeof(m_hostname)) != sizeof(m_hostname)) {
    memset(m_hostname, 0, sizeof(m_hostname));
  }

  for (uint8_t i = 0; i < count; i++) {
    WiFiCredential cred{};

    if (file.read((uint8_t*)cred.ssid, sizeof(cred.ssid)) != sizeof(cred.ssid)) break;
    if (file.read((uint8_t*)&cred.pwd_len, sizeof(cred.pwd_len)) != sizeof(cred.pwd_len)) break;
    if (cred.pwd_len == 0 || cred.pwd_len > sizeof(cred.pwd_encrypted)) break;
    if (file.read((uint8_t*)cred.pwd_encrypted, sizeof(cred.pwd_encrypted)) != sizeof(cred.pwd_encrypted)) break;

    uint32_t gw_addr = 0;
    uint32_t sn_addr = 0;
    uint32_t ip_addr = 0;
    if (file.read((uint8_t*)&gw_addr, sizeof(gw_addr)) != sizeof(gw_addr)) break;
    if (file.read((uint8_t*)&sn_addr, sizeof(sn_addr)) != sizeof(sn_addr)) break;
    if (file.read((uint8_t*)&ip_addr, sizeof(ip_addr)) != sizeof(ip_addr)) break;

    cred.gateway = IPAddress(gw_addr);
    cred.subnet = IPAddress(sn_addr);
    cred.local_ip = IPAddress(ip_addr);

    // Optional per-credential DNS (backward compatible)
    uint32_t dns1_addr_cred = 0;
    uint32_t dns2_addr_cred = 0;
    if ((unsigned int)file.available() >= sizeof(dns1_addr_cred) + sizeof(dns2_addr_cred)) {
      if (file.read((uint8_t*)&dns1_addr_cred, sizeof(dns1_addr_cred)) == sizeof(dns1_addr_cred) &&
          file.read((uint8_t*)&dns2_addr_cred, sizeof(dns2_addr_cred)) == sizeof(dns2_addr_cred)) {
        cred.dns1 = IPAddress(dns1_addr_cred);
        cred.dns2 = IPAddress(dns2_addr_cred);
      }
    } else {
      cred.dns1 = IPAddress(0, 0, 0, 0);
      cred.dns2 = IPAddress(0, 0, 0, 0);
    }

    m_credentials.push_back(cred);
  }

  file.close();

  if (m_credentials.size() > 0) {
    log_info("Loaded %d credentials from FS", m_credentials.size());
    return true;
  }

  return false;
}
#endif


#if defined(ESP32)
// Save credentials to ESP32 NVS in a key/value layout.
// Global:
//   host  -> hostname (null-terminated string)
//   count -> number of stored credentials (uint8_t)
// Per credential i (0..count-1):
//   ssid{i}   -> SSID string
//   pass{i}   -> encrypted password blob (length len{i})
//   len{i}    -> encrypted password length (uint16_t)
//   gw{i}     -> gateway IPv4 as uint32_t
//   sn{i}     -> subnet mask IPv4 as uint32_t
//   ip{i}     -> local IP IPv4 as uint32_t
//   dns1_{i}  -> primary DNS IPv4 as uint32_t
//   dns2_{i}  -> secondary DNS IPv4 as uint32_t
bool CredentialManager::saveToNVS(const char *nvs_namespace) {

  nvs_handle_t nvs_handle;
  esp_err_t err = nvs_open(nvs_namespace, NVS_READWRITE, &nvs_handle);

  if (err != ESP_OK) {
    log_error("Failed to open NVS: %s", esp_err_to_name(err));
    return false;
  }

  // Save global hostname (no DNS/port globals anymore)
  err = nvs_set_str(nvs_handle, "host", m_hostname);
  if (err != ESP_OK) {
    log_error("Failed to save hostname");
    nvs_close(nvs_handle);
    return false;
  }

  // Save number of credentials
  err = nvs_set_u8(nvs_handle, "count", m_credentials.size());
  if (err != ESP_OK) {
    log_error("Failed to save credentials count");
    nvs_close(nvs_handle);
    return false;
  }

  // Save each credential
  for (size_t i = 0; i < m_credentials.size(); i++) {
    const WiFiCredential &cred = m_credentials[i];

    // SSID key
    String key_ssid = "ssid" + String(i);
    err = nvs_set_str(nvs_handle, key_ssid.c_str(), cred.ssid);
    if (err != ESP_OK) {
      log_error("Failed to save SSID %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    // Encrypted password key (as blob)
    String key_pass = "pass" + String(i);
    err = nvs_set_blob(nvs_handle, key_pass.c_str(), cred.pwd_encrypted, cred.pwd_len);
    if (err != ESP_OK) {
      log_error("Failed to save password %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    // Password length
    String key_len = "len" + String(i);
    err = nvs_set_u16(nvs_handle, key_len.c_str(), cred.pwd_len);
    if (err != ESP_OK) {
      log_error("Failed to save password length %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    // Static IP Configuration - Gateway
    String key_gw = "gw" + String(i);
    uint32_t gw_addr = cred.gateway;
    err = nvs_set_u32(nvs_handle, key_gw.c_str(), gw_addr);
    if (err != ESP_OK) {
      log_error("Failed to save gateway %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    // Static IP Configuration - Subnet
    String key_sn = "sn" + String(i);
    uint32_t sn_addr = cred.subnet;
    err = nvs_set_u32(nvs_handle, key_sn.c_str(), sn_addr);
    if (err != ESP_OK) {
      log_error("Failed to save subnet %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    // Static IP Configuration - Local IP
    String key_ip = "ip" + String(i);
    uint32_t ip_addr = cred.local_ip;
    err = nvs_set_u32(nvs_handle, key_ip.c_str(), ip_addr);
    if (err != ESP_OK) {
      log_error("Failed to save local IP %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    // Static DNS configuration (per credential, optional)
    String key_dns1 = "dns1_" + String(i);
    uint32_t dns1_addr_cred = cred.dns1;
    err = nvs_set_u32(nvs_handle, key_dns1.c_str(), dns1_addr_cred);
    if (err != ESP_OK) {
      log_error("Failed to save DNS1 %d", i);
      nvs_close(nvs_handle);
      return false;
    }

    String key_dns2 = "dns2_" + String(i);
    uint32_t dns2_addr_cred = cred.dns2;
    err = nvs_set_u32(nvs_handle, key_dns2.c_str(), dns2_addr_cred);
    if (err != ESP_OK) {
      log_error("Failed to save DNS2 %d", i);
      nvs_close(nvs_handle);
      return false;
    }
  }

  err = nvs_commit(nvs_handle);
  nvs_close(nvs_handle);

  if (err == ESP_OK) {
    log_info("Credentials saved to NVS (%d entries)", m_credentials.size());
    return true;
  } else {
    log_error("Failed to commit NVS");
    return false;
  }
}

// Load credentials from ESP32 NVS using the layout documented
// in saveToNVS(). If any entry is missing, sensible defaults
// (e.g. 0.0.0.0 for IP/DNS) are applied.
bool CredentialManager::loadFromNVS(const char *nvs_namespace) {
  m_credentials.clear();
  nvs_handle_t nvs_handle;
  esp_err_t err = nvs_open(nvs_namespace, NVS_READONLY, &nvs_handle);

  if (err != ESP_OK) {
    log_info("No NVS data found for namespace: %s", nvs_namespace);
    return false;
  }

  size_t host_len = sizeof(m_hostname);
  if (nvs_get_str(nvs_handle, "host", m_hostname, &host_len) != ESP_OK) {
    memset(m_hostname, 0, sizeof(m_hostname));
  }

  // Read number of credentials
  uint8_t count = 0;
  err = nvs_get_u8(nvs_handle, "count", &count);
  if (err != ESP_OK || count == 0) {
    log_debug("No credentials in NVS");
    nvs_close(nvs_handle);
    return false;
  }

  if (count > MAX_CREDENTIALS) {
    count = MAX_CREDENTIALS;
  }

  // Read each credential
  for (int i = 0; i < count; i++) {
    WiFiCredential cred;
    memset(&cred, 0, sizeof(cred));

    // Read SSID
    String key_ssid = "ssid" + String(i);
    size_t ssid_len = 33;
    err = nvs_get_str(nvs_handle, key_ssid.c_str(), cred.ssid, &ssid_len);
    if (err != ESP_OK) {
      log_error("Failed to load SSID %d", i);
      continue;
    }

    // Read password length
    String key_len = "len" + String(i);
    uint16_t pass_len = 0;
    err = nvs_get_u16(nvs_handle, key_len.c_str(), &pass_len);
    if (err != ESP_OK || pass_len == 0 || pass_len > 64) {
      log_error("Invalid password length for credential %d", i);
      continue;
    }

    // Read encrypted password
    String key_pass = "pass" + String(i);
    size_t blob_len = pass_len;
    err = nvs_get_blob(nvs_handle, key_pass.c_str(), cred.pwd_encrypted, &blob_len);
    if (err != ESP_OK) {
      log_error("Failed to load password %d", i);
      continue;
    }

    cred.pwd_len = pass_len;

    // Read Static IP Configuration - Gateway
    String key_gw = "gw" + String(i);
    uint32_t gw_addr = 0;
    err = nvs_get_u32(nvs_handle, key_gw.c_str(), &gw_addr);
    if (err == ESP_OK) {
      cred.gateway = IPAddress(gw_addr);
    } else {
      cred.gateway = IPAddress(0, 0, 0, 0);
    }

    // Read Static IP Configuration - Subnet
    String key_sn = "sn" + String(i);
    uint32_t sn_addr = 0;
    err = nvs_get_u32(nvs_handle, key_sn.c_str(), &sn_addr);
    if (err == ESP_OK) {
      cred.subnet = IPAddress(sn_addr);
    } else {
      cred.subnet = IPAddress(0, 0, 0, 0);
    }

    // Read Static IP Configuration - Local IP
    String key_ip = "ip" + String(i);
    uint32_t ip_addr = 0;
    err = nvs_get_u32(nvs_handle, key_ip.c_str(), &ip_addr);
    if (err == ESP_OK) {
      cred.local_ip = IPAddress(ip_addr);
    } else {
      cred.local_ip = IPAddress(0, 0, 0, 0);
    }

    // Read Static DNS configuration (per credential, optional)
    String key_dns1 = "dns1_" + String(i);
    uint32_t dns1_addr_cred = 0;
    if (nvs_get_u32(nvs_handle, key_dns1.c_str(), &dns1_addr_cred) == ESP_OK) {
      cred.dns1 = IPAddress(dns1_addr_cred);
    } else {
      cred.dns1 = IPAddress(0, 0, 0, 0);
    }

    String key_dns2 = "dns2_" + String(i);
    uint32_t dns2_addr_cred = 0;
    if (nvs_get_u32(nvs_handle, key_dns2.c_str(), &dns2_addr_cred) == ESP_OK) {
      cred.dns2 = IPAddress(dns2_addr_cred);
    } else {
      cred.dns2 = IPAddress(0, 0, 0, 0);
    }

    m_credentials.push_back(cred);
  }

  nvs_close(nvs_handle);

  if (m_credentials.size() > 0) {
    log_info("Loaded %d credentials from NVS", m_credentials.size());
    return true;
  }

  return false;
}
#endif

String CredentialManager::getDebugInfo() const {
  String info = "\n=== Credential Manager Debug Info ===\n";

  info += "Encryption Status: " + getStatus() + "\n";
  info += "Credentials Count: " + String(m_credentials.size()) + "/" +
          String(MAX_CREDENTIALS) + "\n";

#if defined(ESP32)
  info += "BLOCK_KEY0 Status: ";

  // Read BLOCK_KEY0 status
  uint8_t efuse_key[32];
  esp_err_t err = esp_efuse_read_block(EFUSE_BLK_KEY0, efuse_key, 0, 256);

  if (err == ESP_OK) {
    bool all_ff = true;
    bool all_00 = true;
    for (int i = 0; i < 32; i++) {
      if (efuse_key[i] != 0xFF)
        all_ff = false;
      if (efuse_key[i] != 0x00)
        all_00 = false;
    }

    if (all_ff) {
      info += "NOT PROGRAMMED (all 0xFF)\n";
    } else if (all_00) {
      info += "INVALID (all 0x00)\n";
    } else {
      info += "PROGRAMMED (bytes present)\n";
    }
  } else {
    info += "ERROR: " + String(esp_err_to_name(err)) + "\n";
  }
#else
  info += "BLOCK_KEY0 Status: N/A (not ESP32)\n";
#endif

  info += "\nCredentials:\n";
  for (size_t i = 0; i < m_credentials.size(); i++) {
    info += "  [" + String(i) + "] SSID: " + String(m_credentials[i].ssid);
    
    // Show IP configuration if not all zeros
    if (m_credentials[i].local_ip != IPAddress(0, 0, 0, 0)) {
      info += " | IP: " + m_credentials[i].local_ip.toString();
      info += " | GW: " + m_credentials[i].gateway.toString();
      info += " | SN: " + m_credentials[i].subnet.toString();
    } else {
      info += " | IP: DHCP";
    }
    
    info += " | Encrypted len: " + String(m_credentials[i].pwd_len) + "\n";
  }

  info += "=====================================\n";
  return info;
}