08b33ef82308dad1fa7c837d8c2cd53877e9f47d
19
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Claude
|
e607e8cea0 |
Web UI: install/reconfigure addons, default-on install, visual redesign (v2.17.0)
Web UI now installs by default during first-time provisioning (fixed port 8090, no prompt) instead of being opt-in, and can install/ reconfigure CUPS Printing, LMS Server, Squeezelite Player, and Asterisk Intercom, and check for updates - the addons and Update action asked for by name. Privilege model: the web service itself still runs as $KIOSK_USER with zero ambient sudo. A new narrow, allow-listed root helper (menus/addon_webui.sh's webui_write_helper_script) is the only way it ever gains privilege, reachable only via a single-path passwordless sudo rule generated and validated with `visudo -c -f` before being installed, and it re-checks its own fixed action allow-list before dispatching anything. Each allow-listed action is the exact same interactive action_* function the terminal menu already uses, driven by piping the right answers on stdin - the same technique this project's own bash tests already use, so no prompt/mutation refactor of any addon file was needed. webui/lib/actions.js's stdin sequences were cross-validated against the real bash functions (not just read), which caught two real bugs (Squeezelite and Asterisk Intercom both silently lost their "decline reconfigure" path). Long-running installs stream live output via Server-Sent Events (webui/lib/jobs.js), one action at a time. Full visual redesign: a sidebar shell (Sites/Display/Lockout/Addons/ Update) replacing the single scrolling page, light+dark themes via prefers-color-scheme, no external font/CDN dependency. Actually driving the redesigned UI in a headless browser (not just reading the code) caught a real bug: refreshing an addon's pill/button after a successful install used to rebuild the whole card, racing (and usually losing to) the success status/log that job had just written. Fixed to update pill/buttons in place. Uninstall-via-web is deliberately still not offered, for any addon. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
b6ed4aad9c |
Add Web UI addon: browser-based config editor (v2.16.0)
New Addons -> Web UI: a small Node/Express app (webui/) installed as a systemd service running as $KIOSK_USER, giving a browser-based editor for Sites & Page Timing, Display & Interaction, and Password Protection & Lockout - the three Core Settings menus that are pure config.json read/write with no privileged system mutation involved. Runs with no sudo at all, since config.json is already owned by $KIOSK_USER. webui/lib/config.js re-implements lib/config.sh's exact schema and merge-on-save contract in JS (kiosk-app/main.js already reads the same config.json directly in JS, so this isn't a new pattern), so it can never silently clobber fields it doesn't track - the same bug previously fixed in lib/config.sh's own history. No login of its own by design: Authelia runs elsewhere, and the expectation is a reverse proxy (e.g. Caddy) with Authelia forward-auth in front of it, the same way other self-hosted apps get protected - Authelia integration is explicitly out of scope for this repo. Deliberately narrow scope for this first pass: WiFi, Timezone, Power/Display/Quiet Hours, Complete Uninstall, every other addon, and everything in Advanced remain terminal-only, since a network-facing process shouldn't be handed sudo-level system mutation without a lot more thought than this pass gives it. Wired into Complete Uninstall (webui_do_uninstall) and Clone Settings (addon-presence detection) the same way every other addon is. This is the single-kiosk piece of the web-based GUI this repo's "Modular Management" notes have mentioned for a while - a central multi-kiosk fleet dashboard is an intentional follow-up. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
d411b05cae |
Add Upgrade to install.sh (v2.15.0)
The legacy Upgrade re-extracted main.js/preload.js/etc from its own heredocs on every run - a mechanism the modular tool has no equivalent of now that kiosk-app/ and provision/files/ are real files in the git checkout. The new Advanced -> Upgrade is `git pull` (only after a clean-tree check, and only as a fast-forward - never an automatic merge) followed by re-running the same packages/kiosk-app/display/ firewall/power-management steps lib/provision.sh already has for a fresh install, reused rather than reimplemented. Also offers an on-demand Electron version check via the existing action_update_electron, since Electron isn't versioned by this repo. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
037a62e008 |
Add real first-time provisioning to install.sh (v2.14.0)
Until now ./install.sh only managed an already-installed kiosk; ubuntu-based-kiosk.sh was still the only path from a bare Ubuntu Server box to a running one. install.sh now provisions from scratch too: packages, kiosk user, Node.js/Electron, LightDM+Openbox autologin, audio/video/HDMI/power-button hardware setup, and the firewall, then hands off to the already-migrated Core Settings/Advanced menus for initial configuration instead of reimplementing that logic again. - lib/provision.sh: the new provisioning flow, built mostly by calling existing menus (core_settings_menu, emergency hotspot, virtual consoles) - cuts it to ~300 lines against the legacy script's ~4,000-line first_time_install(). - lib/electron.sh: electron_install_binary() extracted out of menus/advanced_electron.sh so provisioning and the existing "Fix blank screen" action share one implementation. - kiosk-app/ and provision/files/: the Electron app source and every system template file, extracted byte-for-byte out of ubuntu-based-kiosk.sh's heredocs into real files. - Found and fixed a bash set -e gotcha along the way: testing a multi-statement function as an if-condition (`if ! some_func; then`) silently exempts everything inside that function from set -e for the duration of the call. Fixed in the new provisioning code and in menus/advanced_electron.sh's pre-existing repair action, which had the same shape. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
1c9447bc5d |
Rename Fleet Profile to Clone Settings per feedback
menus/fleet_profile.sh -> menus/clone_settings.sh. Same functionality (export/apply portable config.json settings between kiosks); renamed the file, every function, the menu label, and the on-disk default profile filename to match. No behavior change. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
5d56c667da |
Add Fleet Profile MVP for replicating settings across kiosks; bump to v2.13.0
New menus/fleet_profile.sh (Advanced), for the "set up one kiosk, then stand up a dozen more like it" use case. Not a port of the legacy Export/Import Settings - a narrower, deliberately-scoped feature: - Export: writes config.json's portable fields (sites, display/touch/ navigation, lockout, password protection) plus a list of addons present at export time to a JSON profile file. - Apply: merges those fields onto a target kiosk's config.json (same merge-not-replace pattern as save_config, so the target's own fields survive untouched) and prints a checklist of which listed addons are/ aren't installed on the target. Deliberately excludes machine-bound credentials rather than silently mishandling them: Authelia's encrypted password is keyed off /etc/machine-id and decrypts to garbage elsewhere; a WireGuard private key is a device identity, reusing one across machines is a peer conflict; most Asterisk PBXes reject duplicate registrations to the same extension. Apply prints all three as an explicit "needs a human" checklist. Non-interactive addon installation (for a fully scriptable fleet rollout) is a deliberate follow-up, not part of this MVP. Full command-level stubbed test suite covering export (site/setting content, Authelia stripped, addon detection) and apply (merge correctness, target's own Authelia preserved, bad path/invalid JSON handled cleanly). Full 20-suite regression + real end-to-end menu navigation via install.sh all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
b0b558f015 |
Migrate Complete Uninstall, composed from each addon's own uninstall helper; bump to v2.12.0
New menus/complete_uninstall.sh (Core Settings), the last of the "destructive trio". Rather than re-implementing every addon's teardown a second time (the legacy shape), it composes the *_do_uninstall helpers each addon already has - if an addon's removal logic changes, Complete Uninstall picks it up automatically. Every addon menu with an uninstall action (CUPS, VNC, WireGuard, Tailscale, Netbird, LMS, Squeezelite, Asterisk Intercom) plus power_schedule's "remove all schedules" and Emergency Hotspot's disable action were each split into a confirm-and-call wrapper (unchanged from the user's perspective) and a silent do-the-removal helper that both the wrapper and Complete Uninstall call. Bug fix found while composing these: several *_do_uninstall helpers (CUPS's apt autoremove/apt clean, VNC/WireGuard/Tailscale/Netbird's apt remove) had a bare, unguarded apt call as their second-to-last statement. Previously this only risked aborting that one menu action if the package was already gone. Composed together as sequential calls inside Complete Uninstall, the same failure would have silently truncated the entire uninstall sequence partway through. Guarded all of them with `|| true`. Non-addon teardown (kiosk user/files, Node.js, LightDM/Openbox, remaining systemd units/scripts, polkit rules, re-enabling virtual consoles, final package cleanup) stays inline in menus/complete_uninstall.sh, since no single addon owns those paths. Upgrade and Full Reinstall stay in ubuntu-based-kiosk.sh only - both are coupled to its own heredoc self-extraction of main.js/preload.js/ etc, which has no modular equivalent yet. Full command-level stubbed test suite exercising the full 12-step teardown, confirmation-text validation, and reboot prompt. Full 19-suite regression + real end-to-end menu navigation via install.sh all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
a3313aa9b8 |
Migrate 4 more Advanced items (Electron, Factory Reset, Virtual Consoles, Emergency Hotspot); bump to v2.11.0
New in install.sh's Advanced menu, alongside Diagnostics: - menus/advanced_electron.sh: "Electron Maintenance" - the legacy "Manual Electron Update" and "Fix Blank Screen" combined into one submenu, sharing the binary-repair logic (electron_install_binary). - menus/advanced_factory_reset.sh: "Factory Reset" - wipes config.json back to defaults only; addons are untouched. - menus/advanced_virtual_consoles.sh: "Virtual Consoles" - toggles Ctrl+Alt+F1-F8 terminal login access. - menus/advanced_emergency_hotspot.sh: "Emergency Hotspot" - auto-starts a WiFi hotspot if no internet is detected 60 seconds after boot. Its own runtime script and systemd unit now go through $BIN_DIR/ $SYSTEMD_DIR like every other addon's own files, instead of the legacy's hardcoded /usr/local/bin and /etc/systemd/system. That covers 8 of the legacy Advanced menu's 12 entries. Not migrated this round: Export/Import Settings (pending a decision on rebuilding it around actual paths vs. a hardcoded step list, or whether the future web UI replaces the need for it) and Fix Squeezelite Audio (small enough it may fold into the LMS addon instead of staying standalone). Full command-level stubbed test suite per file, including set -e safety checks (declined/failed paths never crash the session) and content verification for every written file. Full 18-suite regression + real end-to-end menu navigation via install.sh all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
3eadcdb584 |
Migrate Asterisk Intercom, redesigned as SIP-extension-only; bump to v2.10.0
New menus/addon_asterisk_intercom.sh, wired into install.sh's Addons menu. The legacy addon offered Client Only (Baresip SIP client), Server Only, and Full (server + client), where Server/Full downloaded and ran a third-party installer from a separate "Easy Asterisk" repository to stand up a whole Asterisk PBX. That repository has since gone through a major rework upstream, so this migration drops the PBX-install path entirely: the addon now only installs Baresip and registers this kiosk as a SIP extension against an Asterisk server the user already has running elsewhere. It never installs or manages Asterisk itself. The legacy script's own three-option version is untouched, same as every other migrated menu. Dropped the legacy client path's dependency on the Easy Asterisk repo's GitHub API for version tracking - now reads the real installed baresip package version via dpkg instead. Added an uninstall option, which the legacy addon never had at all. Bug fix found while testing: an unguarded `ver=$(baresip_installed_version)` assignment crashed the whole session under set -e the first time status was checked before Baresip was installed (dpkg-query legitimately fails when the package isn't there). Guarded with `|| true`. Full command-level stubbed test suite covering configure (manual/auto- answer, TLS port bump, apt-install failure) and uninstall (keep/purge config) for both fresh and already-configured states. Full 13-suite regression + real end-to-end menu navigation via install.sh all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
2bf4efe2b1 |
Migrate LMS/Squeezelite addon; fix is_service_enabled dead pre-check; bump to v2.9.0
New menus/addon_lms_squeezelite.sh: install/reconfigure/uninstall for an LMS (Lyrion/Logitech Media Server) server and a Squeezelite player, wired into install.sh's Addons menu. Squeezelite's own start script and systemd unit now go through $BIN_DIR/$SYSTEMD_DIR like every other addon instead of hardcoded /usr/local/bin and /etc/systemd/system; LMS's own apt repo/GPG key/ufw rules stay at their real fixed system paths, same approach as CUPS. Fixed a real unguarded-pipeline bug from the legacy install_lms(): `sudo systemctl enable "$service_name" 2>&1 | tee ...` made the exit status depend on tee (always 0) instead of systemctl enable, silently swallowing real enable/start failures. Now uses enable_and_start_units(). Fixed is_service_enabled() (shared helper, backported into the legacy script too): its list-unit-files pre-check never matched a bare service name, so it always fell through to "not enabled" regardless of the real state. Dropped the dead pre-check. Full command-level stubbed test suite covering install/reconfigure/ uninstall for both LMS and Squeezelite, including the repo-vs-fallback- download path, undetectable-service-name path, and enable/start-failure path. Full 12-suite regression + real end-to-end menu navigation via install.sh all pass. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VfsFSoRqfbRG7XAg5RoE7e |
||
|
Claude
|
0454a259fa |
Migrate Remote Access addon; fix status-function crash gap in run_menu; bump to v2.8.0
Third and biggest Addon migrated: menus/addon_remote_access.sh - VNC (x11vnc), WireGuard, Tailscale, and Netbird, each with its own install/ connect/status/uninstall flow. Same risk class as CUPS (real apt packages, real system state) but broader in scope: Tailscale and Netbird install via the vendors' own documented `curl -fsSL <url> | sh` method, preserved exactly as-is rather than redesigned. - lib/config.sh: new $WIREGUARD_DIR, same pattern as $SYSTEMD_DIR/ $BIN_DIR/etc - nothing in this file hardcodes /etc/wireguard. - lib/menu.sh: promoted power_schedule.sh's enable_and_start_timers() to a shared enable_and_start_units() (works for services now too, not just timers) - Remote Access needed the identical enable+start-with- graceful-failure-reporting pattern for x11vnc and wg-quick@, so this is fixed once and reused rather than duplicated a second time. power_schedule.sh's four call sites renamed to match. Found and fixed a real framework-level bug while building this file: run_menu()'s *handler* call has been `|| true`-guarded since v2.1.0, but the *status function* call (`"$status_func"` on its own line) was still completely bare. A status function's entire job is read-only display, but if it contains so much as a pipeline whose grep matches nothing - which pipefail turns into a pipeline failure even though the actual last command in it (e.g. sed) succeeds - that bare call would crash the *entire session*, not just fail to show status text. Found while writing wireguard_status()'s `sudo wg show | grep ... | sed ...` and deliberately verifying its exact failure mode rather than assuming run_menu already covered it. Fixed once in run_menu() itself (lib/menu.sh), protecting every status function across every menu - present and future - the same "fix once at the framework level" pattern as the v2.1.0 handler fix. Given the framework fix meant this class of bug had been silently possible since v2.1.0, audited every existing status function across every already-migrated menu for the same specific shape (a bare `var=$(...)` assignment from a grep-based pipeline, not embedded in an echo and not already guarded - embedded substitutions and if-condition contexts are both already safe on their own). Found and fixed one real instance in power_schedule_status(). menus/addon_remote_access.sh's own two equivalent pipelines (wireguard_status, netbird_status) were written with `|| true` from the start once the pattern was identified. Verified: - New scratch/stub test for addon_remote_access.sh, with curl stubbed separately from sudo (Tailscale/Netbird's install scripts must never reach the real network regardless of what sudo intercepts) and a belt-and-suspenders `sh` stub in case anything got past curl: full status/menu-builder coverage for all four sub-areas in their real, unstubbed "not installed" state (none of the four tools exist in this sandbox); VNC install/change-password/uninstall with systemd unit content verified (correct $KIOSK_USER/$KIOSK_HOME substitution); WireGuard install, paste-config (content written correctly to scratch $WIREGUARD_DIR), and uninstall - including documenting a genuine cat-until-EOF test-harness limitation (a redirected pipe's EOF is permanent for the whole stream, unlike a real terminal's per-read Ctrl+D, so only the config's *default* name is testable through simple stdin redirection - inherent to the design, matches the legacy script's identical `cat`-based approach, not a bug); Tailscale and Netbird install/connect-interactive/connect-with-key/uninstall; and all four cancel paths confirmed to make zero sudo calls. - Full regression: re-ran all 11 prior scratch/stub suites after the lib/menu.sh and power_schedule.sh changes - all still clean. - End-to-end: ran the real install.sh as a genuine non-root, non- "kiosk" user through Addons -> Remote Access -> all four sub-menus in turn, each showing accurate real (unstubbed) "not installed" status, selecting Install, declining the confirmation, and returning cleanly - zero invalid-choice errors, clean exit code 0. |
||
|
Claude
|
6c68897935 |
Migrate Authelia addon; fix real config-clobbering bug in save_config; bump to v2.6.0
Second Addon migrated: menus/addon_authelia.sh (encrypted SSO
credentials, AES-256-CBC with a key derived from /etc/machine-id via
scrypt - same algorithm main.js decrypts with - plus the full
Dockerized server-side setup instructions, now viewable again later
without reconfiguring).
Investigating how to wire its three config.json fields (autheliaURL/
autheliaUsername/autheliaEncryptedPassword) into lib/config.sh surfaced
a real, currently-shipping bug that has nothing to do with Authelia
specifically: save_config() did a full `jq -n` rebuild of config.json
from a fixed list of known fields - identical to what the legacy
script's own save_config still does. The legacy configure_authelia()
writes its three fields via a careful `. + {...}` merge that preserves
everything else already in the file, but neither save_config knew those
fields existed - so the next time a user visited Sites, Touch Controls,
Navigation, or Password Protection (all of which call save_config),
their Authelia credentials were silently deleted. This bug already
existed in the shipped single-file installer; it was ported faithfully
into lib/config.sh's first version because no test happened to set an
untracked field before calling save_config.
Fixed in lib/config.sh: save_config now merges its known fields onto
whatever's already in config.json (jq `. + {...}`) instead of rebuilding
the file from nothing, with a `jq empty` validity check falling back to
`{}` if the existing file is missing or corrupt. Any field this tool
doesn't track - Authelia's three today, anything else a future addon
adds tomorrow - now survives automatically. autheliaURL/
autheliaUsername/autheliaEncryptedPassword are also tracked fields in
their own right now (load_existing_config/save_config), consistent with
every other config.json field this tool manages, giving Authelia both a
direct fix and the general safety net.
The equivalent bug still exists, unfixed, in ubuntu-based-kiosk.sh's own
save_config - noted in both that script's changelog and the Readme's
"Modular Management" section as an open question: whether to backport
just that one fix into the legacy script now, independent of the wider
migration, given it's a real credential-loss bug affecting the
currently-shipping installer today.
Verified:
- New dedicated test (test_save_merge.sh) proving the save_config fix
itself: seeded config.json with a simulated untracked field via the
same `. + {...}` merge Authelia's own code uses, called save_config
from an unrelated context (Sites deleting a tab), and confirmed the
untracked field survived while the tab deletion still correctly took
effect (not undone by the merge) - plus corrupt-JSON and
missing-file edge cases both handled without crashing.
- New scratch-config test for addon_authelia.sh using REAL encryption
(this sandbox has both Node and /etc/machine-id): configured with a
real password, then decrypted the stored ciphertext using main.js's
exact algorithm (independently reproduced in the test) and confirmed
it recovers the original password exactly - true interoperability,
not just "some ciphertext was produced." Also covered cancel paths,
clearing the configuration, the encryption-unavailable failure path,
and confirmed Authelia's config survives an unrelated Sites save.
- Full regression: re-ran all 9 prior scratch/stub test suites after
both the lib/config.sh changes - all still clean.
- End-to-end: ran the real install.sh as a genuine non-root, non-
"kiosk" user with a seeded minimal config.json, through Addons ->
Authelia -> Configure with a real URL/username/password -> confirmed
the resulting config.json on disk, and independently decrypted the
stored password for real using main.js's algorithm to confirm it
matches exactly. Clean exit code 0 throughout.
|
||
|
Claude
|
1b16bcf3ee |
Migrate CUPS Printing addon; restructure install.sh into Core Settings/Addons/Advanced; bump to v2.5.0
First Addon migrated: menus/addon_cups.sh (install, reconfigure for network access, complete uninstall/purge). Different risk profile from everything migrated so far - it genuinely mutates real system state (apt install/remove --purge, /etc/cups, ufw) at fixed paths CUPS itself doesn't let us relocate, unlike the systemd/cron/bin paths this project already controls via $SYSTEMD_DIR etc. Only the polkit rule's directory is parameterized ($POLKIT_DIR, lib/config.sh, since that one is ours to place); everything else gets full command-level `sudo` stubbing in every test - there is no scratch equivalent for a real apt-managed subsystem's own file layout. Also added $BUILD_USER (the admin account actually running the tool, as opposed to $KIOSK_USER) since CUPS needs to grant it lpadmin group membership. Restructured install.sh's top-level menu into Core Settings / Addons / Advanced (matching the legacy tool) instead of one flat list, now that Addons exists as its own category - cheap to do with one item in it, much more annoying to retrofit once the flat list has fifteen. Two bugs caught and fixed before they shipped: - A "wait for CUPS to start" retry loop used a bare `cmd1 && cmd2 && break` as its body while "simplifying" the legacy script's `if cmd1 && cmd2; then break; fi`. Being inside a loop doesn't protect a bare &&/|| list from set -e - only if/while/until conditions and the protected side of &&/|| do that - so the first command failing on an early iteration (near-certain right after a fresh install, before CUPS has actually started) would have crashed the entire session. Restored the `if` form; noted the lesson in the file's own header comment since it's a general trap, not CUPS-specific. - Resolved real uncertainty, rather than assuming: how far does run_menu's `handler || true` guard (v2.1.0) actually protect? Wrote a minimal isolated test (a bare `false` three function calls deep, called via `outer || true` at the top) and confirmed bash's errexit exemption for the left side of `||` covers the *entire* evaluation, arbitrarily deep through function calls - not just the immediately invoked function. So the session-crash risk this project has been chasing since v2.1.0 is already covered end-to-end by that one fix. Per-statement guards (`|| true`, explicit `if`) still earn their keep for a different reason: without them a deep failure bubbles silently past the menu actually responsible for it to wherever the nearest `|| true` happens to sit, which can be several menu levels above where the user actually was - not a crash, but a confusing jump. Verified: - Full regression: re-ran every existing scratch-config/stub test suite after the lib/config.sh change (new $BUILD_USER/$POLKIT_DIR) and after the install.sh restructuring - all still clean. - New scratch/stub test for addon_cups.sh: full state-machine coverage (not installed -> decline -> install -> running -> reconfigure -> stopped -> start -> uninstall decline -> uninstall confirm -> not installed again) with every `sudo` call intercepted and only `rm` targeting the scratch $POLKIT_DIR ever actually executed; confirmed the polkit rule's content and that declining install makes zero sudo calls. Added both apt-failure paths (update fails, install fails) and confirmed the tool reports clearly and returns to the menu instead of dying, exercising the exact bug class just fixed. - End-to-end: ran the real install.sh as a genuine non-root, non- "kiosk" user through the full new three-level structure - Core Settings -> Sites -> back -> back, Addons -> CUPS -> declined install (using this container's real, unstubbed dpkg check, correctly reporting "not installed" and making no apt/systemctl calls) -> back -> back, Advanced -> Diagnostics -> System status -> back -> back -> Exit. Zero invalid-choice errors, clean exit code 0 throughout. |
||
|
Claude
|
459da53182 |
Migrate Diagnostics menu; bump to v2.4.0
Deliberately skipped Upgrade/Full Reinstall/Complete Uninstall for now: all three are large (130-250 lines), genuinely destructive (wipe/ reinstall the kiosk), and Upgrade specifically is coupled to the legacy script's own self-extraction mechanism (it greps its own running source for embedded heredocs to pull out main.js/preload.js) - there's no modular equivalent to migrate it to yet, since those files don't exist as separate assets outside the monolith. Migrated Diagnostics instead: 4 of the legacy Advanced menu's 12 items (System Status, View Logs, Audio Diagnostics, Network Test), all read-only except one optional "play a test sound?" prompt - a deliberate change of pace with no destructive-action risk to design around, after Sites/WiFi/Power. - lib/menu.sh: ported get_vpn_ips alongside get_ip_address. - menus/diagnostics.sh: straight port, using $KIOSK_USER/$KIOSK_HOME throughout instead of the legacy code's mix of the variable and a hardcoded "kiosk" literal. Bug fixed, same set -e-safety class as v2.1.0's run_menu fix and v2.3.0's netplan/systemctl fixes, but a bigger batch this time: nearly every diagnostic command here was a bare unguarded statement whose *expected, common* failure - no lightdm running, no audio hardware, no network, missing log files, ping/nslookup not even installed - would have crashed the entire session instead of reporting "not found" and continuing. A diagnostics tool has to be the most crash-proof code in the project, since it exists to run when something is already broken. Fixed at every call site: systemctl status | head, tail on lightdm's log, journalctl, ping, nslookup, and three pactl-backed variable assignments. Also noted for future menus in this migration: writing `local var;` and `var=$(cmd)` as separate statements (good practice, and how several earlier real bugs were caught) removes an accidental safety net - `local x=$(cmd)` on one line masks the substitution's exit code with `local`'s own always-success status. Splitting them is correct, but each split assignment needs an explicit `|| true` (or real fallback) where failure is expected and non-fatal, rather than relying on that masking by accident. Caught three instances of exactly this while writing this file fresh, not just porting old bugs. Verified: - Full regression: re-ran every existing scratch-config/stub test suite (sites, display, timezone/pin, lockout, power schedule + RTC, wifi) - all still clean after the lib/menu.sh change. - New test for diagnostics.sh, exercised mostly for real (no destructive-mutation risk here, so minimal stubbing needed): system status, all three log views (including the "no such file" paths for lightdm log and electron log), full 8-step audio diagnostic with test sound declined, and network test - all report gracefully instead of crashing, confirmed by re-running after each fix until every bare unguarded statement was accounted for. - End-to-end: ran the real install.sh as a genuine non-root, non- "kiosk" user, navigating Diagnostics -> System status -> View Logs -> System journal -> Audio diagnostics (declined test sound) -> Network test -> exit. Confirmed every diagnostic path completes and returns to its menu cleanly (exit code 0) even with ping/nslookup missing and no audio hardware/network present in this environment. |
||
|
Claude
|
2375bf5eab |
Migrate WiFi and Power/Display/Quiet Hours menus; bump to v2.3.0
By far the riskiest menus migrated so far. Both can affect real system
state outside config.json in ways that are hard to reverse: WiFi
rewrites live netplan config and, over SSH, can disconnect the very
session configuring it; power scheduling can shut the physical machine
down and wake it via RTC.
- lib/config.sh: new $SYSTEMD_DIR/$CRON_D_DIR/$BIN_DIR/$NETPLAN_DIR,
same `: "${VAR:=default}"` pattern as $KIOSK_DIR. Nothing under
menus/ hardcodes /etc/systemd/system, /etc/cron.d, /usr/local/bin, or
/etc/netplan directly, so every test in this change points them at
scratch space instead of ever touching this sandbox's real systemd
units, cron, or network config.
- lib/menu.sh: ported get_ip_address (also fixing its "No IP" fallback,
which never actually fired before - `hostname -I | awk` always exits
0 even on empty output).
- menus/wifi.sh: apply_wifi_config split out from wifi_menu specifically
so tests can drive the netplan-writing logic without needing real
scan hardware. Preserves the legacy netplan backup, 60s SSH watchdog,
and restore-on-failure behavior exactly.
- menus/power_schedule.sh: power schedule (+ RTC wake), display
schedule, quiet hours, and an Electron reload timer (with its own
nested run_menu, mirroring the legacy configured/not-configured
dispatch), plus remove-all. Deliberately excludes the legacy
dispatcher's "Test schedules & system" - a shared diagnostics submenu
(audio/network/keyboard tests) that isn't specific to scheduling and
belongs with a future Advanced/Diagnostics migration instead.
Bugs found and fixed along the way, none papered over:
- The legacy dispatcher refused to open "Configure power schedule" at
all without RTC hardware, even though shutdown-only mode never needed
RTC. Now always available.
- None of the six HH:MM prompts across these menus (shutdown, wake,
display off/on, quiet start/end, custom Electron reload time) were
validated before - plain `read`, no format check. All now go through
ask_time.
- set -e safety (same class as the v2.1.0 run_menu fix), three more
instances: `ls *.yaml` when no netplan file exists still fails under
pipefail even with stderr silenced (masked in practice by cloud-init
usually leaving a file behind); the restore-and-reapply `netplan
apply` after an initial failure was a bare unguarded statement; and
`systemctl enable`/`start` after writing each of the four timer pairs
was unguarded too - caught only by testing in an environment without
a live systemd, but a real enable/start failure on actual hardware
(bad unit, daemon-reload skipped, ...) would hit the exact same crash.
Added a shared enable_and_start_timers() helper used at all four call
sites; all now report a clear warning and return to the menu instead
of taking the session down.
Testing discipline for this round, given the risk:
- No automated test calls the real netplan/nmcli/iw/wpa_cli/systemctl -
confirmed no WiFi tools or `wl*` interface exist in this sandbox, so
wifi_menu's own tools-check safely short-circuits before touching
anything; apply_wifi_config's actual YAML/backup/failure-recovery
logic is tested with sudo/netplan/get_ip_address stubbed instead.
- One stubbing pitfall caught and fixed in the test itself: `nohup sudo
bash "$watchdog" ... &` execs nohup as a real external binary, which
then execs the real sudo - a bash function stub named `sudo` does NOT
intercept that, only stubbing `nohup` itself does. Verified via pgrep
that no real watchdog process or `sleep 60` was ever spawned.
- power_schedule.sh tested with SYSTEMD_DIR/CRON_D_DIR/BIN_DIR pointed
at scratch dirs and only `sudo systemctl` stubbed (tee/rm/chmod/cp
left real, since they only ever touch scratch paths): full lifecycle
for all four schedule types plus remove-all, the RTC-available branch
(including the wake-time-before-shutdown-time hour/day wraparound
arithmetic) via a stubbed rtc_wake_available, and the new
enable_and_start_timers failure path via a stub that fails `enable`
specifically.
- End-to-end: ran the real install.sh as a genuine non-root, non-
"kiosk" user for both menus. WiFi correctly short-circuits on missing
tools without crashing. Power/Display/Quiet Hours (SYSTEMD_DIR/
CRON_D_DIR/BIN_DIR redirected to scratch space) configured all four
schedule types in sequence including the nested Electron Reload menu,
survived four consecutive real "systemctl enable/start failed"
warnings (this container has no live systemd) without the session
dying, then removed everything - confirmed the scratch dirs ended up
empty and config.json was never touched (correctly out of scope for
this menu).
|
||
|
Claude
|
8672c15469 |
Migrate Password Protection & Lockout menu; add missing ask_time helper; bump to v2.2.0
Fifth menu migrated onto lib/menu.sh + lib/config.sh: menus/lockout.sh covers enable/disable, changing the password, inactivity timeout, daily lock time, and boot password. The password is SHA-256 hashed before it's ever assigned to LOCKOUT_PASSWORD (matching main.js's comparison logic) - verified by test that the stored value is the correct hash and never plaintext. Rewrote the legacy configure_password_protection's linear "ask everything, confirm save at the end" wizard as the same immediate-save pattern used by every other migrated menu: each action (change password, change timeout, toggle boot password, ...) is a complete, standalone change, consistent with Sites/Display/Timezone/Hidden PIN. LOCKOUT_ACTIVE_START/END are deliberately left untouched - per the Readme they're inert leftover fields the app ignores, so lib/config.sh just carries whatever is already in config.json through unchanged. Testing this menu surfaced a real gap before it ever shipped: lib/menu.sh never had ask_time/validate_time at all (only validate_integer/ask_integer, ask_url, etc were ported when the framework was first built) - "set a daily lock time" would have failed for every single user with "ask_time: command not found". Ported both from the legacy script. Also promoted the ON/OFF toggle-label helper (previously private to menus/display.sh as display_onoff) to a shared onoff() in lib/menu.sh, since menus/lockout.sh needed the same thing and menu files should only ever depend on lib/, never on each other. Bumped SCRIPT_VERSION to 2.2.0 with matching changelog entries in the script header and Readme, and updated "Modular Management" to list the new menu and drop Password Protection & Lockout from the "not yet migrated" list. Verified: - Full regression: re-ran the Sites, Display, Timezone/PIN scratch-config suites after every change in this round (the onoff refactor, and again after adding ask_time) - all still clean. - New scratch-config test for lockout.sh: enable (password+timeout+daily lock+boot toggle), independently recomputed the expected SHA-256 hash and confirmed it matches config.json exactly, change password, change timeout, clear daily lock, toggle boot password, disable (confirmed every field clears), and that the menu builder's options correctly differ between the enabled and disabled states. - End-to-end: ran the real install.sh as a genuine non-root, non-"kiosk" user - Lockout menu -> enable protection with a real password entered via the masked prompt -> set 20m timeout, 23:00 daily lock, boot password on -> confirmed the menu redraws with the new state -> clean exit (code 0). Checked the resulting config.json and file permissions on disk. |
||
|
Claude
|
074b2ec2e3 |
Migrate Timezone and Hidden Site PIN menus; harden menu framework against set -e; bump to v2.1.0
Two more menus migrated onto lib/menu.sh + lib/config.sh, chosen specifically because neither touches config.json - a third and fourth shape for the framework (a system command via timedatectl, and a flat PIN file), on top of Sites' list CRUD and Display's JSON toggles. - menus/timezone.sh: also replaces the legacy script's hand-numbered 18-entry case statement with a plain data list (TIMEZONE_COMMON_ZONES) plus one handler that reads the number run_menu hands it - adding or removing a zone never touches numbering anywhere else. Required a small run_menu addition: handlers now receive the chosen 1-based number as $1, so one handler can serve a whole data-driven list instead of needing a wrapper function per entry. - menus/hidden_pin.sh: set/disable/reset the PIN gating hidden pages. Testing menus/timezone.sh surfaced a real bug before it ever shipped: this whole tool runs under `set -e`, and set_timezone() rejecting an invalid zone via a bare `return 1` as its last statement took down the *entire* install.sh session, not just that one action - a single typo would silently drop the user back to their shell. Fixed at the framework level in lib/menu.sh (run_menu now absorbs a failed handler's exit code) rather than patching set_timezone alone, since any future menu could hit the same trap. Verified against the real install.sh as a genuine non-root user: an invalid timezone now logs an error and redraws the Timezone menu instead of killing the session (confirmed exit code 0 at the end of the run). Note this specific hazard was introduced by this session's own return-1 idiom, not inherited from the legacy script, which never uses a bare return 1 in these functions. Also per the user: left the old configure_sites/configure_touch_controls/ configure_navigation_security/configure_optional_features functions in ubuntu-based-kiosk.sh untouched for now (still carrying the v2.0.0 settings-clobber and reorder bugs) rather than removing them - they'll be retired in one pass once enough of Core Settings/Addons/Advanced is migrated. Bumped SCRIPT_VERSION to 2.1.0 with matching changelog entries in the script header and Readme, and updated the Readme's "Modular Management" section to state plainly what is and isn't migrated yet. Verified: - Full regression: re-ran the Sites and Display scratch-config test suites against the updated run_menu signature - both still clean. - New scratch-config tests for hidden_pin.sh (set/mismatch/reject/ disable/reset, correct file permissions) and timezone.sh (builder entry count, common-zone pick by index, manual entry with legacy US/* alias normalization, region search + cancel, invalid-zone rejection) - all correct, with timedatectl/sudo stubbed only where needed to avoid mutating this sandbox's real system clock/timezone. - End-to-end: ran the real install.sh as a genuine non-root, non-"kiosk" user, navigating Timezone -> manual entry -> invalid zone -> confirmed no crash and a normal return to the menu, then Hidden Site PIN -> set a PIN -> confirmed the file on disk (mode 600, correct content) -> clean exit (code 0). |
||
|
Claude
|
c1370edc3e |
Migrate Display & Interaction menu; drop version number from installer filename; bump to v2.0.0
- menus/display.sh: second menu migrated onto lib/menu.sh + lib/config.sh, covering touch gesture mode, link navigation security, and the pause/keyboard/navigation button toggles (previously three separate Core Settings entries). Deliberately a different shape from Sites (toggle list vs. list CRUD) to exercise the framework more broadly. Wired into install.sh's top-level menu alongside Sites. - Renamed ubuntu-based-kiosk-v1.0.3.sh -> ubuntu-based-kiosk.sh so the installer can be updated in place instead of growing a new version-numbered filename every release; released versions are now tracked via git history and the in-script changelog. Updated all Readme download/re-run commands accordingly. Older versioned files (ubuntu-based-kiosk-v*.sh, install_kiosk_*.sh) are left in place as archived releases. - Bumped SCRIPT_VERSION to 2.0.0 (new script-level changelog entry) and the Readme version/changelog to match, given the new modular management path, the rename, and the two real bugs fixed along the way (settings clobbered on save, off-by-one in reorder). Verified before moving on to the web admin work: - Regression: re-ran the full Sites scratch-config test suite (add, edit, delete, reorder, home) - still clean, no invalid-input paths hit. - New: scratch-config test for every display.sh action (touch mode, navigation security, all three toggles), confirming values persist through save/reload and that a previously-added site survives untouched across Display-menu saves. - End-to-end: ran the real install.sh (not just sourced functions) as a genuine non-root, non-"kiosk" user with real sudo, driving actual menu input through Sites -> add a page -> Display -> toggle a setting -> exit. Confirmed final config.json on disk matches every action taken, and both guard clauses (run as root; no installed kiosk found) fire correctly. |
||
|
Claude
|
21a0768c8c |
Add modular menu framework, migrate Sites & Page Timing onto it
Start of pulling the menu system out of the 12k-line single-file installer so individual menus can change without risking the rest of the script (network, VNC, addons, etc). This is groundwork for the planned web-based management UI, which will share the same lib/config.sh read/write layer instead of duplicating it. - lib/menu.sh: generic numbered-menu framework (auto-numbered entries, "0" always exits/returns) plus the validated input helpers menus need. - lib/config.sh: single load/save for config.json. Fixes a latent bug where the old Sites menu wrote config.json without first loading swipe/navigation/lockout settings, silently resetting them to defaults on save. - menus/sites.sh: Sites & Page Timing fully migrated - add/edit/delete/ reorder pages, set duration (auto-rotate/manual/hidden) and home page. Also fixes an off-by-one in the ported reorder logic (moving an item landed one slot short of the requested position) caught by testing. - install.sh: new entry point for managing an already-installed kiosk via `git clone` + `./install.sh`, wired to the Sites menu. Does not yet replace first-time provisioning, which still uses the existing single-file installer. All new site CRUD/reorder/home-page paths were exercised against a scratch config.json (add with/without basic auth, edit duration, set home + timeout, 2- and 3-item reorders in both directions, delete) to confirm the resulting config.json matches expectations. |