alpha_connect_web.py

#!/usr/bin/env python3
"""
Alpha Connect Web Wrapper — a browser UI for the reverse-engineered
LuxTronic GLT-enable protocol + integrated USB license manager.

Runs a local HTTP server that serves a config UI:
  1. Send UDP packet to heat pump on port 4444 to write /home/GLT.conf
     and call InitGLT() (protocol decoded from CDemoappl::UDP_Handler at 0xddc54).
  2. Read/write license blocks on a USB dongle (Python port of
     https://github.com/Jaarden/luxtronic-glt-licensetool/blob/main/licensetool.c).

USAGE
    # For UDP-only features:
    python3 alpha_connect_web.py [--port 8080]

    # For license operations (writes raw block device — needs root):
    sudo python3 alpha_connect_web.py [--port 8080]

Then open http://localhost:8080/ in a browser.

STDLIB ONLY. No third-party packages required.
"""

import argparse
import json
import os
import secrets
import socket
import struct
import subprocess
import threading
import time
from http.server import HTTPServer, BaseHTTPRequestHandler


# ── Protocol layer ────────────────────────────────────────────────────────

def build_glt_packet(config):
    """Build the UDP payload from a config dict. Field order MUST match
    what UDP_Handler at 0xddc54 expects when subcmd=0xBAC1.
    """
    fields = [
        "5000",                              # cmd: config write
        "47809",                             # subcmd 0xBAC1: GLT WRITE (0xBAC0 is read-only)
        str(int(config.get("mode", 0))),     # Einst_GLT_akt (0=off default, 1=BACnet, 2=Modbus — 1/2 need license)
        str(int(config.get("bacnet_port", 47808))),  # BACnet listen port (vector[0])
        "0",                                 # vector[1] — reserved/unused by handler
        str(int(config.get("fkt_at", 0))),
        str(int(config.get("fkt_freigabe", 1))),
        str(int(config.get("fkt_sollwert", 1))),
        str(int(config.get("fkt_sollwert_mk1", 1))),
        str(int(config.get("fkt_sollwert_mk2", 1))),
        str(int(config.get("fkt_sollwert_mk3", 0))),
        str(int(config.get("fkt_ba_heizen", 1))),
        str(int(config.get("fkt_ba_brauchw", 1))),
        str(int(config.get("fkt_ba_mk1", 1))),
        str(int(config.get("fkt_ba_mk2", 1))),
        str(int(config.get("fkt_ba_mk3", 0))),
        str(int(config.get("fkt_ba_kuehl", 1))),
        str(int(config.get("fkt_ba_lueftung", 0))),
        str(int(config.get("fkt_ba_schwimmbad", 0))),
        str(config.get("vendorname", "JaSec")),
        str(int(config.get("vendor_id", 123))),
        str(config.get("modelname", "FordKuga")),
        str(config.get("location", "Somewhere")),
        str(config.get("device_description", "YourDescription")),
        str(int(config.get("device_id", 50))),
        str(config.get("devicename", "HackedByJAarden")),
    ]
    return (";".join(fields) + ";").encode("ascii")


def send_udp(ip, port, payload, timeout=5):
    """Send UDP packet, return (response_bytes, from_addr) or (None, None)."""
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.settimeout(timeout)
    try:
        s.sendto(payload, (ip, port))
        try:
            data, addr = s.recvfrom(4096)
            return data, addr
        except socket.timeout:
            return None, None
    finally:
        s.close()


def check_tcp_port(ip, port, timeout=2):
    """Simple TCP connect test — returns True if we can open a socket."""
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(timeout)
    try:
        s.connect((ip, port))
        return True
    except Exception:
        return False
    finally:
        s.close()


def check_modbus_alive(ip, timeout=3):
    """
    Modbus TCP test: attempt a MBAP-framed Read Holding Registers request
    on port 502. If a well-formed reply comes back, Modbus is live.
    If port is closed we get ConnectionRefused; if unreachable we time out.
    Returns (up: bool, reply_or_error: str).
    """
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(timeout)
    try:
        s.connect((ip, 502))
        # MBAP header: transaction=1, protocol=0, length=6, unit=1
        # PDU: fn=0x03 (Read Holding Regs), addr=0, count=1
        req = struct.pack("!HHHBBHH", 1, 0, 6, 1, 0x03, 0, 1)
        s.sendall(req)
        try:
            resp = s.recv(64)
            if len(resp) >= 8:
                return True, f"MBAP reply ({len(resp)} bytes): {resp.hex()}"
            return True, f"TCP open (short reply: {resp.hex()!r})"
        except socket.timeout:
            return True, "TCP open, no Modbus reply (device may be busy)"
    except ConnectionRefusedError:
        return False, "connection refused (Modbus off / mode 0)"
    except socket.timeout:
        return False, "TCP connect timeout"
    except Exception as e:
        return False, str(e)
    finally:
        s.close()


def check_bacnet_alive(ip, timeout=2):
    """BACnet Who-Is unicast — succeeds if port 47808 responds."""
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.settimeout(timeout)
    # BVLC + NPDU + APDU Who-Is
    whois = bytes([0x81, 0x0b, 0x00, 0x0c, 0x01, 0x20,
                   0xff, 0xff, 0x00, 0xff, 0x10, 0x08])
    try:
        s.sendto(whois, (ip, 47808))
        data, addr = s.recvfrom(1024)
        return True, data.hex()
    except socket.timeout:
        return False, None
    except Exception as e:
        return False, str(e)
    finally:
        s.close()


# ── License tool (Python port of Jaarden/luxtronic-glt-licensetool) ───────
# Source: https://github.com/Jaarden/luxtronic-glt-licensetool/blob/main/licensetool.c
#
# The license lives in the LAST 512 bytes of the USB dongle's raw block device.
# Layout:
#   offset 0x34  uint16 LE  license count
#   offset 0x65  2 bytes    fixed value 0x01 0x02 (used in checksum)
#   offset 0x69  2 bytes    fixed value 0x03 0x04 (used in checksum)
#   offset 0x1FC uint16 LE  stored checksum = getChecksum(0x34) + getChecksum(0x65) + getChecksum(0x69)
#   remainder    random bytes
#
# getCheckSum sums exactly 2 bytes starting at the given offset.

LICENSE_BLOCK_SIZE = 512


def _get_checksum(block, offset):
    # Matches getCheckSum() at 0x001b1d88 in appl: sums two bytes at [offset], [offset+1].
    return (block[offset] + block[offset + 1]) & 0xFFFF


def _check_not_mounted(device_path):
    """Refuse to operate on a mounted device — the FS could overwrite our writes,
    which is the most likely cause of intermittent license failures."""
    try:
        with open("/proc/mounts") as f:
            for line in f:
                parts = line.split()
                if not parts:
                    continue
                src = parts[0]
                # /dev/sdb1, /dev/sdb-part1, /dev/mapper/*, etc — anything that starts with our device
                if src == device_path or src.startswith(device_path):
                    mp = parts[1] if len(parts) > 1 else "?"
                    raise IOError(
                        f"{src} is mounted at {mp}. Unmount it first "
                        f"(sudo umount {src}) — a mounted filesystem can overwrite "
                        f"the license block and cause intermittent failures."
                    )
    except FileNotFoundError:
        pass  # not on Linux, skip


def _device_size(fd):
    """Get block-device or file size in bytes."""
    # Try BLKGETSIZE64 first (block device); fall back to lseek for regular files.
    try:
        import fcntl
        BLKGETSIZE64 = 0x80081272
        buf = fcntl.ioctl(fd, BLKGETSIZE64, b"\x00" * 8)
        return int.from_bytes(buf, "little")
    except (OSError, ImportError):
        return os.lseek(fd, 0, os.SEEK_END)


def _read_license_block(device_path):
    """Raw unbuffered read of the last 512 bytes. Bypasses Python's buffered IO."""
    _check_not_mounted(device_path)
    fd = os.open(device_path, os.O_RDONLY)
    try:
        size = _device_size(fd)
        if size < LICENSE_BLOCK_SIZE:
            raise IOError(f"{device_path} too small: {size} bytes")
        os.lseek(fd, size - LICENSE_BLOCK_SIZE, os.SEEK_SET)
        data = b""
        while len(data) < LICENSE_BLOCK_SIZE:
            chunk = os.read(fd, LICENSE_BLOCK_SIZE - len(data))
            if not chunk:
                raise IOError(f"short read from {device_path}: {len(data)} bytes")
            data += chunk
        return data
    finally:
        os.close(fd)


def _write_license_block(device_path, block):
    """Raw synchronous write of the last 512 bytes, followed by fsync + BLKFLSBUF.

    Uses O_SYNC so each write is committed before returning, and issues fsync
    at the end to force the kernel page cache to disk. This is what fixes the
    intermittency in the original licensetool.c which only did fflush() on stdio.
    """
    if len(block) != LICENSE_BLOCK_SIZE:
        raise ValueError(f"block must be {LICENSE_BLOCK_SIZE} bytes")
    _check_not_mounted(device_path)

    flags = os.O_RDWR | os.O_SYNC
    fd = os.open(device_path, flags)
    try:
        size = _device_size(fd)
        if size < LICENSE_BLOCK_SIZE:
            raise IOError(f"{device_path} too small: {size} bytes")
        offset = size - LICENSE_BLOCK_SIZE
        os.lseek(fd, offset, os.SEEK_SET)
        written = 0
        while written < LICENSE_BLOCK_SIZE:
            n = os.write(fd, bytes(block[written:]))
            if n <= 0:
                raise IOError(f"write stalled at {written} bytes")
            written += n
        os.fsync(fd)
        # For block devices, also flush the kernel buffer cache so subsequent
        # reads (from a different fd or another tool) see our data.
        try:
            import fcntl
            BLKFLSBUF = 0x1261
            fcntl.ioctl(fd, BLKFLSBUF)
        except (OSError, ImportError):
            pass
    finally:
        os.close(fd)


def _build_license_block(license_count):
    """Compose a 512-byte block matching the licensetool layout."""
    block = bytearray(secrets.token_bytes(LICENSE_BLOCK_SIZE))
    # license count at 0x34, little-endian
    block[0x34] = license_count & 0xFF
    block[0x35] = (license_count >> 8) & 0xFF
    # Checksum-source bytes
    block[0x65] = 0x01
    block[0x66] = 0x02
    block[0x69] = 0x03
    block[0x6A] = 0x04
    # Compute checksum
    c1 = _get_checksum(block, 0x34)
    c2 = _get_checksum(block, 0x65)
    c3 = _get_checksum(block, 0x69)
    total = (c1 + c2 + c3) & 0xFFFF
    block[0x1FC] = total & 0xFF
    block[0x1FD] = (total >> 8) & 0xFF
    return bytes(block)


def check_licenses(device_path):
    """Read + validate the license block. Returns dict with count and checksum info."""
    block = _read_license_block(device_path)
    count = block[0x34] | (block[0x35] << 8)
    c1 = _get_checksum(block, 0x34)
    c2 = _get_checksum(block, 0x65)
    c3 = _get_checksum(block, 0x69)
    calculated = (c1 + c2 + c3) & 0xFFFF
    stored = block[0x1FC] | (block[0x1FD] << 8)
    return {
        "count": count,
        "calculated_checksum": calculated,
        "stored_checksum": stored,
        "checksum_ok": calculated == stored,
        "components": {"c1": c1, "c2": c2, "c3": c3},
    }


def create_licenses(device_path, license_count):
    """Write a new license block with the given license count.

    Writes to the raw device AND every partition, because the heat pump's
    /dev/usb symlink may point to either — writing to only one of them is
    the primary cause of intermittent success.
    """
    if license_count < 1 or license_count > 0xFFFF:
        raise ValueError("license count must be 1..65535")
    block = _build_license_block(license_count)
    targets = _write_targets_for(device_path)
    results = []
    last_err = None
    for tgt in targets:
        try:
            _write_license_block(tgt, block)
            verify = check_licenses(tgt)
            results.append({"target": tgt, "ok": True, "verify": verify})
        except Exception as e:
            results.append({"target": tgt, "ok": False, "error": str(e)})
            last_err = e
    # Primary result is verification of the original device_path
    primary = check_licenses(device_path)
    primary["targets_written"] = results
    if last_err and not any(r["ok"] for r in results):
        raise last_err
    return primary


def decrement_licenses(device_path):
    """Read the license count, decrement by 1, write to raw device AND all partitions."""
    current = check_licenses(device_path)
    if current["count"] == 0:
        raise ValueError("no licenses left to decrement")
    new_count = current["count"] - 1
    block = _build_license_block(new_count)
    targets = _write_targets_for(device_path)
    results = []
    last_err = None
    for tgt in targets:
        try:
            _write_license_block(tgt, block)
            verify = check_licenses(tgt)
            results.append({"target": tgt, "ok": True, "verify": verify})
        except Exception as e:
            results.append({"target": tgt, "ok": False, "error": str(e)})
            last_err = e
    primary = check_licenses(device_path)
    primary["targets_written"] = results
    if last_err and not any(r["ok"] for r in results):
        raise last_err
    return primary


def _list_partitions(dev_name):
    """Given 'sda', return ['/dev/sda1', '/dev/sda2', ...] partitions that exist."""
    parts = []
    try:
        for sub in sorted(os.listdir(f"/sys/block/{dev_name}")):
            if sub.startswith(dev_name):
                parts.append(f"/dev/{sub}")
    except FileNotFoundError:
        pass
    return parts


def list_usb_candidates():
    """
    Enumerate removable block devices that look like USB dongles.
    Reads /sys/block/*/removable to filter, and includes size for sanity-checking.
    Also lists partitions of each device — the heat pump's /dev/usb might point
    to either the raw device or a partition depending on udev rules.
    """
    candidates = []
    try:
        for name in os.listdir("/sys/block"):
            # Skip virtual/loop devices
            if name.startswith(("loop", "ram", "sr", "dm-")):
                continue
            removable_path = f"/sys/block/{name}/removable"
            try:
                with open(removable_path) as f:
                    if f.read().strip() != "1":
                        continue
            except FileNotFoundError:
                continue
            # Get size in bytes (512-byte sectors)
            size_bytes = 0
            try:
                with open(f"/sys/block/{name}/size") as f:
                    size_bytes = int(f.read().strip()) * 512
            except FileNotFoundError:
                pass
            # Get model
            model = ""
            try:
                with open(f"/sys/block/{name}/device/model") as f:
                    model = f.read().strip()
            except FileNotFoundError:
                pass
            partitions = _list_partitions(name)
            candidates.append({
                "device": f"/dev/{name}",
                "model": model,
                "size_bytes": size_bytes,
                "size_human": _human_size(size_bytes),
                "partitions": partitions,
            })
    except FileNotFoundError:
        pass
    return candidates


def _write_targets_for(device_path):
    """Given a user-selected device path, return the list of paths we should
    write the license block to. If the device has partitions we write to BOTH
    the raw device AND every partition — the heat pump's /dev/usb symlink might
    point to either, and this is the most likely cause of intermittent failures.
    """
    targets = [device_path]
    # /dev/sda → sda; check if there are partitions
    if device_path.startswith("/dev/"):
        dev_name = device_path.rsplit("/", 1)[-1]
        parts = _list_partitions(dev_name)
        for p in parts:
            if p != device_path and p not in targets:
                targets.append(p)
    return targets


def _human_size(n):
    if n < 1024:
        return f"{n} B"
    for unit in ("KiB", "MiB", "GiB", "TiB"):
        n /= 1024
        if n < 1024:
            return f"{n:.1f} {unit}"
    return f"{n:.1f} PiB"


# ── HTML UI (embedded) ────────────────────────────────────────────────────

HTML = r"""<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Alpha Connect — LuxTronic GLT Enabler</title>
<style>
* { box-sizing: border-box; margin: 0; padding: 0; }
:root {
  --bg:#12131a; --surface:#1a1d2e; --card:#0f3460;
  --accent:#e94560; --accent2:#5a3fad; --text:#e8eaf0;
  --muted:#7a8499; --border:#252d45;
  --green:#4ecca3; --yellow:#f5a623; --red:#e94560;
}
body { background:var(--bg); color:var(--text); font-family:'Segoe UI',system-ui,sans-serif; font-size:14px; min-height:100vh; }

header {
  background:var(--surface); border-bottom:1px solid var(--border);
  padding:14px 24px; display:flex; align-items:center; gap:12px;
  position:sticky; top:0; z-index:10;
}
header h1 { font-size:17px; font-weight:600; }
header .subtitle { font-size:12px; color:var(--muted); margin-left:auto; }

.nav-tabs { display:flex; gap:4px; margin-left:20px; }
.nav-tab {
  background:transparent; color:var(--muted); border:none; border-bottom:2px solid transparent;
  padding:6px 14px; font-size:13px; cursor:pointer; font-family:inherit; border-radius:0;
  transition: color .15s, border-color .15s;
}
.nav-tab:hover { color:var(--text); }
.nav-tab.active { color:var(--text); border-bottom-color:var(--accent); }
.status-dot { width:10px; height:10px; border-radius:50%; background:var(--muted); transition:background .3s, box-shadow .3s; }
.status-dot.connected { background:var(--green); box-shadow:0 0 8px var(--green); }
.status-dot.error { background:var(--red); }
#status-text { font-size:12px; color:var(--muted); }

.container { max-width:1140px; margin:0 auto; padding:20px 24px; display:grid; grid-template-columns:1fr 1fr; gap:14px; }
.full-width { grid-column:1/-1; }
.card { background:var(--surface); border:1px solid var(--border); border-radius:10px; padding:20px; }
.card h2 { font-size:11px; font-weight:700; text-transform:uppercase; letter-spacing:.1em; color:var(--muted); margin-bottom:14px; display:flex; align-items:center; gap:8px; }

label { display:block; font-size:12px; color:var(--muted); margin-bottom:4px; margin-top:11px; }
label:first-of-type { margin-top:0; }

input[type="text"], input[type="number"], select, textarea {
  width:100%; background:var(--bg); border:1px solid var(--border); border-radius:6px;
  color:var(--text); padding:8px 10px; font-size:13px; font-family:inherit; transition:border-color .2s;
}
input:focus, select:focus, textarea:focus { outline:none; border-color:var(--accent2); }
input[readonly] { color:var(--muted); background:#0a0b10; cursor:not-allowed; opacity:0.7; }

.gated { opacity:0.4; pointer-events:none; filter:grayscale(0.5); transition:opacity .25s, filter .25s; }
.gated-unlocked { opacity:1; pointer-events:auto; filter:none; }

.row { display:flex; gap:8px; } .row > * { flex:1; } .row > .narrow { flex:0 0 90px; }

button {
  background:var(--accent2); color:white; border:none; border-radius:6px;
  padding:8px 14px; font-size:13px; cursor:pointer; font-family:inherit;
  transition:opacity .15s, background .15s; white-space:nowrap; font-weight:500;
}
button:hover:not(:disabled) { opacity:.82; }
button.primary { background:var(--accent); }
button.success { background:#2e7d5e; }
button.neutral { background:#2a3a55; }
button:disabled { opacity:.35; cursor:not-allowed; }

.btn-row { display:flex; gap:8px; margin-top:12px; flex-wrap:wrap; }

.mode-grid { display:grid; grid-template-columns:1fr 1fr; gap:8px; margin-bottom:12px; }
.mode-card {
  background:var(--bg); border:2px solid var(--border); border-radius:8px;
  padding:11px 13px; cursor:pointer; transition:border-color .2s, background .2s; user-select:none;
}
.mode-card.active { border-color:var(--green); background:rgba(78,204,163,.08); }
.mode-card .mnum { font-size:18px; font-weight:700; line-height:1; color:var(--muted); }
.mode-card.active .mnum { color:var(--green); }
.mode-card .mlabel { font-size:13px; font-weight:600; margin-top:4px; }
.mode-card .mdesc { font-size:11px; color:var(--muted); margin-top:2px; }

.toggle-grid { display:grid; grid-template-columns:1fr 1fr; gap:7px; }
.toggle-row {
  display:flex; align-items:center; justify-content:space-between;
  background:var(--bg); border:1px solid var(--border); border-radius:6px; padding:9px 12px;
}
.toggle-name { font-size:12px; line-height:1.3; }
.toggle-sub { font-size:10px; color:var(--muted); }
.toggle { position:relative; display:inline-block; width:38px; height:21px; flex-shrink:0; }
.toggle input { opacity:0; width:0; height:0; position:absolute; }
.tslider { position:absolute; cursor:pointer; inset:0; background:#2a3a55; border-radius:11px; transition:.25s; }
.tslider:before { content:''; position:absolute; height:15px; width:15px; left:3px; bottom:3px; background:#7a8499; border-radius:50%; transition:.25s; }
.toggle input:checked + .tslider { background:rgba(78,204,163,.25); }
.toggle input:checked + .tslider:before { transform:translateX(17px); background:var(--green); }

#packet-preview, #log {
  background:#0a0b10; border:1px solid var(--border); border-radius:6px;
  padding:10px 12px; font-family:'Courier New',monospace; font-size:11.5px;
  line-height:1.65; white-space:pre-wrap; word-break:break-all;
}
#packet-preview { color:#a08ee0; min-height:2em; }
#log { min-height:90px; max-height:280px; overflow-y:auto; color:var(--text); }
.log-info { color:var(--yellow); }
.log-ok { color:var(--green); }
.log-err { color:var(--red); }
.log-line { padding:2px 0; }

.two-col { display:grid; grid-template-columns:1fr 1fr; gap:16px; }
.sub-label { font-size:12px; color:var(--muted); margin-bottom:6px; }
.note { font-size:11px; color:var(--muted); margin-top:9px; line-height:1.55; }
.chip { display:inline-block; background:rgba(90,63,173,.25); border:1px solid rgba(90,63,173,.4);
        border-radius:4px; padding:1px 7px; font-size:10px; font-family:monospace; color:#a08ee0; }
.license-note {
  background: rgba(245,166,35,.08); border:1px solid rgba(245,166,35,.35);
  border-radius:6px; padding:10px 12px; font-size:12px; color:#f5c95a; line-height:1.55; margin-bottom:12px;
}
.license-note a { color:#f5c95a; text-decoration:underline; }
.license-note code { background:rgba(0,0,0,.25); padding:1px 5px; border-radius:3px; font-size:11px; }
.license-warn {
  background: rgba(233,69,96,.08); border:1px solid rgba(233,69,96,.4);
  border-radius:6px; padding:10px 12px; font-size:12px; color:#ff8b9a; line-height:1.55;
}
.license-warn code { background:rgba(0,0,0,.25); padding:1px 5px; border-radius:3px; font-size:11px; }

.root-warning {
  background: rgba(233,69,96,.15) !important;
  border:2px solid var(--red) !important;
  display:flex; gap:16px; align-items:flex-start;
  animation: pulse 2s ease-in-out infinite;
}
@keyframes pulse {
  0%, 100% { box-shadow: 0 0 0 0 rgba(233,69,96,.4); }
  50%      { box-shadow: 0 0 0 8px rgba(233,69,96,0);   }
}
.root-warning-icon { font-size:44px; line-height:1; padding-top:4px; }
.root-warning-body { flex:1; }
.root-warning-body h3 { color:var(--red); font-size:18px; margin-bottom:8px; }
.root-warning-body p { color:#ffb3c0; font-size:13px; line-height:1.6; }
.root-warning-body pre {
  background: rgba(0,0,0,.35); border:1px solid rgba(255,255,255,.1); border-radius:5px;
  padding:10px 12px; margin-top:10px; font-family:'Courier New',monospace; font-size:13px;
  color: var(--green); font-weight:600;
}
.root-warning-body code { background:rgba(0,0,0,.35); padding:1px 6px; border-radius:3px; font-size:11px; }
.root-warning-body kbd {
  background:rgba(255,255,255,.1); border:1px solid rgba(255,255,255,.2); border-bottom-width:2px;
  border-radius:4px; padding:1px 5px; font-family:monospace; font-size:11px;
}
.usb-list { margin-top:10px; }
.usb-item {
  background: var(--bg); border:1px solid var(--border); border-radius:6px;
  padding:8px 10px; margin-top:6px; font-family:'Courier New',monospace; font-size:12px;
  cursor:pointer; transition: border-color .15s;
}
.usb-item:hover { border-color:var(--accent2); }
.usb-item .u-dev { color:var(--accent); font-weight:600; }
.usb-item .u-model { color:var(--text); }
.usb-item .u-size { color:var(--muted); font-size:11px; }
</style>
</head>
<body>

<header>
  <div class="status-dot" id="status-dot"></div>
  <h1>LuxTronic Toolbox</h1>
  <nav class="nav-tabs">
    <button class="nav-tab active" id="tab-alpha" onclick="showPage('alpha')">Alpha Connect Tool</button>
    <button class="nav-tab" id="tab-license" onclick="showPage('license')">License Manager</button>
  </nav>
  <span id="status-text">Ready</span>
  <span class="subtitle" id="page-subtitle">GLT/BACnet Enable via UDP 4444</span>
</header>

<div id="page-alpha" class="container">

  <!-- Target -->
  <div class="card">
    <h2>Target Device</h2>
    <label>Device IP Address</label>
    <div class="row">
      <input type="text" id="ip" placeholder="192.168.10.50" autocomplete="off">
      <input type="number" id="port" value="4444" class="narrow" title="Alpha Connect UDP port">
    </div>
    <p class="note">The heat pump listens on UDP 4444 (default). Custom port only if <code>WPPORT</code> env var was set.</p>
    <div class="btn-row">
      <button class="primary" id="btn-connect" onclick="connectToDevice()">Connect &amp; verify</button>
      <button class="neutral" onclick="checkModbus()">Check Modbus (502)</button>
      <button class="neutral" onclick="checkBacnet()">Check BACnet (47808)</button>
    </div>
    <p class="note" id="connect-hint" style="margin-top:8px; color:var(--yellow);">
      Enter the device IP, then click <b>Connect &amp; verify</b> to enable configuration.
    </p>
  </div>

  <!-- Everything below this point is gated on a successful connect (see JS setGated) -->

  <!-- GLT Mode -->
  <div class="card gated" data-gated="1">
    <h2>GLT Enable Mode <span class="chip">Einst_GLT_aktiviert</span></h2>
    <div class="license-note">
      <b>⚠ License required.</b> The GLT feature is a paid unlock. Before enabling mode 1 or 2,
      write a license to the USB dongle in the
      <a href="#" onclick="showPage('license'); return false;"><b>License Manager</b> tab</a>,
      then plug the dongle into the heat pump. Reference implementation:
      <a href="https://github.com/Jaarden/luxtronic-glt-licensetool" target="_blank" rel="noopener">github.com/Jaarden/luxtronic-glt-licensetool</a>.
    </div>
    <div class="mode-grid" style="grid-template-columns: 1fr 1fr 1fr;">
      <div class="mode-card active" id="mc-0" onclick="selectMode(0)">
        <div class="mnum">0</div><div class="mlabel">Disabled</div><div class="mdesc">GLT interface off (default)</div>
      </div>
      <div class="mode-card" id="mc-1" onclick="selectMode(1)">
        <div class="mnum">1</div><div class="mlabel">BACnet UDP</div><div class="mdesc">Port 47808 (0xBAC0) — needs license</div>
      </div>
      <div class="mode-card" id="mc-2" onclick="selectMode(2)">
        <div class="mnum">2</div><div class="mlabel">Modbus TCP</div><div class="mdesc">Port 502 — needs license</div>
      </div>
    </div>
  </div>

  <!-- Identity -->
  <div class="card gated" data-gated="1" id="bacnet-identity-card">
    <h2>Modbus/BACnet Settings <span class="chip" id="mode-hint-chip">applies to selected mode</span></h2>
    <div class="row">
      <div>
        <label>Port</label>
        <input type="number" id="bacnet_port" value="47808" readonly onchange="updatePreview()">
      </div>
      <div>
        <label>Device ID</label>
        <input type="number" id="device_id" value="50" onchange="updatePreview()">
      </div>
    </div>
    <label>Device Name</label>
    <input type="text" id="devicename" value="HackedByJAarden" onchange="updatePreview()">
    <label>Vendor Name</label>
    <input type="text" id="vendorname" value="JAarden" onchange="updatePreview()">
    <div class="row">
      <div>
        <label>Vendor ID</label>
        <input type="number" id="vendor_id" value="123" onchange="updatePreview()">
      </div>
      <div>
        <label>Model Name</label>
        <input type="text" id="modelname" value="Alpha Innotec" onchange="updatePreview()">
      </div>
    </div>
    <label>Location</label>
    <input type="text" id="location" value="Somewhere" onchange="updatePreview()">
    <label>Device Description</label>
    <input type="text" id="device_description" value="YourDescription" onchange="updatePreview()">
  </div>

  <!-- Functions -->
  <div class="card gated" data-gated="1">
    <h2>GLT Functions <span class="chip">Fkt_*_akt</span></h2>
    <div class="toggle-grid">
      <div class="toggle-row"><div><div class="toggle-name">AT</div><div class="toggle-sub">Outside temperature</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_at" onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">Freigabe</div><div class="toggle-sub">Enable/release</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_freigabe" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">Sollwert</div><div class="toggle-sub">Setpoint control</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_sollwert" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">Sollwert MK1</div><div class="toggle-sub">Mixer 1 setpoint</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_sollwert_mk1" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">Sollwert MK2</div><div class="toggle-sub">Mixer 2 setpoint</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_sollwert_mk2" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">Sollwert MK3</div><div class="toggle-sub">Mixer 3 setpoint</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_sollwert_mk3" onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA Heizen</div><div class="toggle-sub">Heating mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_heizen" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA Brauchwasser</div><div class="toggle-sub">Domestic hot water</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_brauchw" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA MK1</div><div class="toggle-sub">Mixer 1 mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_mk1" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA MK2</div><div class="toggle-sub">Mixer 2 mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_mk2" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA MK3</div><div class="toggle-sub">Mixer 3 mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_mk3" onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA Kühlung</div><div class="toggle-sub">Cooling mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_kuehl" checked onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA Lüftung</div><div class="toggle-sub">Ventilation mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_lueftung" onchange="updatePreview()"><span class="tslider"></span></label></div>
      <div class="toggle-row"><div><div class="toggle-name">BA Schwimmbad</div><div class="toggle-sub">Pool mode</div></div>
        <label class="toggle"><input type="checkbox" id="fkt_ba_schwimmbad" onchange="updatePreview()"><span class="tslider"></span></label></div>
    </div>
  </div>

  <!-- Packet + Send -->
  <div class="card full-width gated" data-gated="1">
    <h2>UDP Packet — subcmd 5000;47809; writes GLT.conf + calls InitGLT()</h2>
    <div class="sub-label" style="display:flex; justify-content:space-between; align-items:center;">
      <span>Packet that will be sent to <code id="target-info">device:4444</code>:</span>
      <span id="packet-mode-badge" class="chip">auto from form</span>
    </div>
    <div id="packet-preview"></div>
    <textarea id="packet-override" rows="3" style="display:none; margin-top:8px; font-family:'Courier New',monospace; font-size:12px;"></textarea>
    <div class="btn-row">
      <button class="primary" onclick="send()">Apply Configuration + Enable BACnet</button>
      <button class="neutral" onclick="copyPacket()">Copy Packet</button>
      <button class="neutral" id="btn-override" onclick="toggleOverride()">Override packet…</button>
      <button class="neutral" id="btn-reset-override" onclick="resetOverride()" style="display:none;">Reset to form values</button>
    </div>
    <p class="note">
      On the device, <code>UDP_Handler</code> parses this packet, writes <code>/home/GLT.conf</code>,
      then calls <code>InitGLT()</code>. BACnet appears on port 47808 within seconds.
    </p>
  </div>

  <!-- Log -->
  <div class="card full-width">
    <h2>Send Log</h2>
    <div id="log"><span style="color:var(--muted)">Actions and responses appear here…</span></div>
  </div>

</div>
<!-- /page-alpha -->

<!-- License Manager page -->
<div id="page-license" class="container" style="display:none;">

  <!-- Non-root warning — populated by JS -->
  <div id="root-warning" class="card full-width root-warning" style="display:none;">
    <div class="root-warning-icon">⛔</div>
    <div class="root-warning-body">
      <h3>Not running as root!</h3>
      <p>
        The License Manager needs to read and write raw block devices (e.g. <code>/dev/sdb</code>),
        which requires root privileges. Stop this server (<kbd>Ctrl-C</kbd> in the terminal) and restart it with:
      </p>
      <pre>sudo python3 alpha_connect_web.py</pre>
      <p style="margin-top:8px; font-size:11px; opacity:0.85;">
        Every license operation on this page will fail with <code>permission denied</code> until you restart as root.
      </p>
    </div>
  </div>

  <div class="card full-width">
    <h2>License Manager <span class="chip">USB dongle · requires root</span></h2>
    <p class="note" style="margin-bottom:12px;">
      Ports the C implementation from
      <a href="https://github.com/Jaarden/luxtronic-glt-licensetool" target="_blank" rel="noopener" style="color:#a08ee0;">luxtronic-glt-licensetool</a>.
      Writes the license block to the LAST 512 bytes of a USB dongle. When plugged into the heat pump,
      <code>CDemoappl::onUsbDongle()</code> reads it and calls <code>SetZugangMitDongleEinstellung(true, N)</code>
      which raises the access level so <code>InitGLT()</code> starts BACnet/Modbus.
    </p>
    <div class="license-warn">
      <b>⚠ WARNING:</b> writing to a wrong device path will DESTROY DATA on that device.
      Double-check the size and model before clicking Create/Decrement. This server must run as root
      (<code>sudo python3 alpha_connect_web.py</code>) to access raw block devices.
      <br><br>
      <b>⚠ UNMOUNT FIRST.</b> If the USB has a filesystem (FAT/exFAT/etc), unmount it before writing —
      the filesystem may overwrite the license block near the end of the device, causing intermittent
      "invalid checksum" failures. This tool will refuse to write while the device is mounted.
    </div>
    <div class="two-col" style="margin-top:14px;">
      <div>
        <div class="sub-label">USB dongle device path</div>
        <div class="row">
          <input type="text" id="lic-device" placeholder="/dev/sdX">
          <button class="neutral" onclick="listDevices()" style="flex:0 0 auto;">Scan USB</button>
        </div>
        <div id="usb-candidates" class="usb-list"></div>
      </div>
      <div>
        <div class="sub-label">Operations</div>
        <div class="btn-row">
          <button class="neutral" onclick="licCheck()">Check current licenses</button>
        </div>
        <label style="margin-top:14px;">Create license count</label>
        <div class="row">
          <input type="number" id="lic-count" value="10" min="1" max="65535">
          <button class="primary" onclick="licCreate()" style="flex:0 0 auto;">Create</button>
        </div>
        <label style="margin-top:14px;">Decrement</label>
        <div class="btn-row">
          <button class="neutral" onclick="licDecrement()">Decrement by 1</button>
        </div>
      </div>
    </div>
    <div id="lic-log" style="background:#0a0b10; border:1px solid var(--border); border-radius:6px;
         padding:10px 12px; font-family:'Courier New',monospace; font-size:11.5px; line-height:1.65;
         min-height:60px; max-height:280px; overflow-y:auto; margin-top:14px;">
      <span style="color:var(--muted)">License operations output appears here…</span>
    </div>
  </div>

</div>
<!-- /page-license -->

<script>
'use strict';

// ── Page navigation ─────────────────────────────────────────────────────
let rootChecked = false;
async function checkRoot() {
  try {
    const r = await fetch('/whoami');
    const j = await r.json();
    const warn = document.getElementById('root-warning');
    if (j.is_root) {
      warn.style.display = 'none';
    } else {
      warn.style.display = '';
      // Scroll the warning into view
      warn.scrollIntoView({ behavior: 'smooth', block: 'start' });
    }
  } catch(e) {
    console.warn('root check failed', e);
  }
  rootChecked = true;
}

function showPage(name) {
  document.getElementById('page-alpha').style.display = (name === 'alpha') ? '' : 'none';
  document.getElementById('page-license').style.display = (name === 'license') ? '' : 'none';
  document.getElementById('tab-alpha').classList.toggle('active', name === 'alpha');
  document.getElementById('tab-license').classList.toggle('active', name === 'license');
  const subtitle = document.getElementById('page-subtitle');
  subtitle.textContent = (name === 'license')
    ? 'USB dongle license writer'
    : 'GLT/BACnet Enable via UDP 4444';
  // Check root status every time the license page is shown
  if (name === 'license') checkRoot();
  // Remember choice
  try { localStorage.setItem('lux-page', name); } catch(e) {}
}

let selectedMode = 0;  // 0 = Disabled by default; needs license (see luxtronic-glt-licensetool) before enabling

function selectMode(n) {
  selectedMode = n;
  [0,1,2].forEach(i => document.getElementById('mc-'+i).classList.toggle('active', i === n));
  // Swap the (read-only) port and mode hint based on which protocol is active.
  //   1 = BACnet UDP → port 47808
  //   2 = Modbus TCP → port 502
  //   0 = Disabled    → keep 47808 as harmless default
  const portInput = document.getElementById('bacnet_port');
  const chip = document.getElementById('mode-hint-chip');
  if (n === 2) {
    portInput.value = 502;
    chip.textContent = 'Modbus mode — port 502';
  } else if (n === 1) {
    portInput.value = 47808;
    chip.textContent = 'BACnet mode — port 47808';
  } else {
    portInput.value = 47808;
    chip.textContent = 'GLT disabled — identity ignored';
  }
  updatePreview();
}

function gv(id) { return document.getElementById(id).value; }
function gc(id) { return document.getElementById(id).checked ? 1 : 0; }

function collectConfig() {
  return {
    mode: selectedMode,
    bacnet_port: parseInt(gv('bacnet_port')) || 47808,
    fkt_at: gc('fkt_at'),
    fkt_freigabe: gc('fkt_freigabe'),
    fkt_sollwert: gc('fkt_sollwert'),
    fkt_sollwert_mk1: gc('fkt_sollwert_mk1'),
    fkt_sollwert_mk2: gc('fkt_sollwert_mk2'),
    fkt_sollwert_mk3: gc('fkt_sollwert_mk3'),
    fkt_ba_heizen: gc('fkt_ba_heizen'),
    fkt_ba_brauchw: gc('fkt_ba_brauchw'),
    fkt_ba_mk1: gc('fkt_ba_mk1'),
    fkt_ba_mk2: gc('fkt_ba_mk2'),
    fkt_ba_mk3: gc('fkt_ba_mk3'),
    fkt_ba_kuehl: gc('fkt_ba_kuehl'),
    fkt_ba_lueftung: gc('fkt_ba_lueftung'),
    fkt_ba_schwimmbad: gc('fkt_ba_schwimmbad'),
    vendorname: gv('vendorname'),
    vendor_id: parseInt(gv('vendor_id')) || 123,
    modelname: gv('modelname'),
    location: gv('location'),
    device_description: gv('device_description'),
    device_id: parseInt(gv('device_id')) || 50,
    devicename: gv('devicename'),
  };
}

function buildPacketString(cfg) {
  const fields = [
    "5000", "47809",
    String(cfg.mode),
    String(cfg.bacnet_port),
    "0",
    cfg.fkt_at, cfg.fkt_freigabe, cfg.fkt_sollwert,
    cfg.fkt_sollwert_mk1, cfg.fkt_sollwert_mk2, cfg.fkt_sollwert_mk3,
    cfg.fkt_ba_heizen, cfg.fkt_ba_brauchw,
    cfg.fkt_ba_mk1, cfg.fkt_ba_mk2, cfg.fkt_ba_mk3,
    cfg.fkt_ba_kuehl, cfg.fkt_ba_lueftung, cfg.fkt_ba_schwimmbad,
    cfg.vendorname, String(cfg.vendor_id),
    cfg.modelname, cfg.location, cfg.device_description,
    String(cfg.device_id), cfg.devicename,
  ];
  return fields.join(';') + ';';
}

let packetOverride = false;  // true when user has manually edited the packet

function updatePreview() {
  const cfg = collectConfig();
  const packet = buildPacketString(cfg);
  if (!packetOverride) {
    document.getElementById('packet-preview').textContent = packet;
  }
  const ip = gv('ip') || '<device>';
  const port = gv('port') || '4444';
  document.getElementById('target-info').textContent = ip + ':' + port;
}

function currentPacket() {
  return packetOverride
    ? document.getElementById('packet-override').value
    : document.getElementById('packet-preview').textContent;
}

function toggleOverride() {
  const preview = document.getElementById('packet-preview');
  const ta = document.getElementById('packet-override');
  const badge = document.getElementById('packet-mode-badge');
  const btnReset = document.getElementById('btn-reset-override');
  const btnOverride = document.getElementById('btn-override');
  if (!packetOverride) {
    // Enter override mode: copy current preview text into the textarea
    ta.value = preview.textContent;
    preview.style.display = 'none';
    ta.style.display = 'block';
    ta.focus();
    packetOverride = true;
    badge.textContent = 'MANUAL OVERRIDE';
    badge.style.background = 'rgba(233,69,96,.2)';
    badge.style.borderColor = 'rgba(233,69,96,.5)';
    badge.style.color = '#ff8b9a';
    btnReset.style.display = '';
    btnOverride.textContent = 'Cancel override';
  } else {
    // Exit override mode: revert to auto-generated
    resetOverride();
  }
}

function resetOverride() {
  const preview = document.getElementById('packet-preview');
  const ta = document.getElementById('packet-override');
  const badge = document.getElementById('packet-mode-badge');
  const btnReset = document.getElementById('btn-reset-override');
  const btnOverride = document.getElementById('btn-override');
  packetOverride = false;
  preview.style.display = '';
  ta.style.display = 'none';
  badge.textContent = 'auto from form';
  badge.style.background = '';
  badge.style.borderColor = '';
  badge.style.color = '';
  btnReset.style.display = 'none';
  btnOverride.textContent = 'Override packet…';
  updatePreview();
}

function log(cls, msg) {
  const el = document.getElementById('log');
  if (el.querySelector('span')) el.innerHTML = '';
  const line = document.createElement('div');
  line.className = 'log-line ' + cls;
  const time = new Date().toTimeString().slice(0,8);
  line.textContent = '[' + time + '] ' + msg;
  el.appendChild(line);
  el.scrollTop = el.scrollHeight;
}

function setStatus(cls, text) {
  document.getElementById('status-dot').className = 'status-dot ' + cls;
  document.getElementById('status-text').textContent = text;
}

async function api(endpoint, payload) {
  const r = await fetch(endpoint, {
    method: 'POST', headers: {'Content-Type': 'application/json'},
    body: JSON.stringify(payload)
  });
  return await r.json();
}

async function send() {
  const ip = gv('ip').trim();
  if (!ip) { log('log-err', 'Enter device IP first'); return; }
  const port = parseInt(gv('port')) || 4444;
  const cfg = collectConfig();
  const body = { ip, port, config: cfg };
  if (packetOverride) {
    const raw = document.getElementById('packet-override').value;
    body.raw_packet = raw;
    log('log-info', '[MANUAL OVERRIDE] Sending raw packet: ' + raw);
  } else {
    log('log-info', 'Sending config packet to ' + ip + ':' + port + '…');
  }
  setStatus('', 'Sending…');
  try {
    const r = await api('/send', body);
    if (r.error) {
      log('log-err', 'Send error: ' + r.error);
      setStatus('error', 'Send failed');
    } else {
      log('log-ok', '✓ UDP sent (' + r.bytes + ' bytes)');
      if (r.response) {
        log('log-ok', '← device replied: ' + r.response.substring(0, 200));
      } else {
        log('log-info', '(no reply — normal for write command)');
      }
      if (r.service_name === null) {
        log('log-info', 'Mode 0 (disabled) sent — no service to probe');
        setStatus('', 'Sent (GLT disabled)');
      } else if (r.service_up) {
        log('log-ok', '✓✓✓ ' + r.service_name + ' is responding on port '
              + r.service_port + '! GLT is ENABLED.');
        if (r.service_detail) log('log-info', '  detail: ' + r.service_detail);
        setStatus('connected', r.service_name + ' live');
      } else {
        log('log-info', r.service_name + ' not responding yet on port '
              + r.service_port + ' — retry in 5 sec or use Check '
              + r.service_name + ' button');
        if (r.service_detail) log('log-info', '  detail: ' + r.service_detail);
        setStatus('', 'Sent, waiting for ' + r.service_name);
      }
    }
  } catch(e) {
    log('log-err', 'Fetch error: ' + e.message);
    setStatus('error', 'Error');
  }
}

async function checkModbus() {
  const ip = gv('ip').trim();
  if (!ip) { log('log-err', 'Enter device IP first'); return; }
  log('log-info', 'Testing Modbus TCP on ' + ip + ':502 …');
  try {
    const r = await api('/modbus', { ip });
    if (r.up) {
      log('log-ok', '✓ Modbus TCP is OPEN on ' + ip + ':502');
      if (r.reply) log('log-ok', '  device responded to Modbus probe: ' + r.reply);
      setStatus('connected', 'Modbus live');
    } else {
      log('log-err', 'Modbus TCP not reachable: ' + (r.error || 'no connect'));
      setStatus('error', 'Modbus down');
    }
  } catch(e) {
    log('log-err', 'Fetch error: ' + e.message);
  }
}

async function checkBacnet() {
  const ip = gv('ip').trim();
  if (!ip) { log('log-err', 'Enter device IP first'); return; }
  log('log-info', 'Sending BACnet Who-Is to ' + ip + ':47808 …');
  try {
    const r = await api('/bacnet', { ip });
    if (r.up) {
      log('log-ok', '✓✓ BACnet is responding! Hex: ' + r.hex.substring(0, 80));
      setStatus('connected', 'BACnet live');
    } else {
      log('log-err', 'No BACnet response');
      setStatus('error', 'BACnet down');
    }
  } catch(e) {
    log('log-err', 'Fetch error: ' + e.message);
  }
}

function copyPacket() {
  const p = currentPacket();
  navigator.clipboard.writeText(p).then(
    () => log('log-info', 'Packet copied to clipboard' + (packetOverride ? ' (from override)' : '')),
    () => log('log-err', 'Clipboard denied — select manually')
  );
}

// ── Connection gating ───────────────────────────────────────────────────
let deviceConnected = false;

function setGated(unlocked) {
  deviceConnected = unlocked;
  document.querySelectorAll('.gated').forEach(el => {
    el.classList.toggle('gated-unlocked', unlocked);
  });
  const hint = document.getElementById('connect-hint');
  if (hint) {
    hint.style.color = unlocked ? 'var(--green)' : 'var(--yellow)';
    hint.innerHTML = unlocked
      ? '✓ Device reachable — configuration unlocked. Click <b>Connect &amp; verify</b> again if the IP changes.'
      : 'Enter the device IP, then click <b>Connect &amp; verify</b> to enable configuration.';
  }
}

async function connectToDevice() {
  const ip = gv('ip').trim();
  if (!ip) { log('log-err', 'Enter device IP first'); return; }
  log('log-info', 'Probing ' + ip + ' — BACnet (47808/UDP), Modbus (502/TCP), WebSocket (8214/TCP) …');
  setStatus('', 'Connecting…');
  try {
    const r = await api('/connect', { ip });
    log('log-info', '  BACnet 47808:   ' + (r.bacnet.up ? '✓ up (GLT mode 1 active)' : '✗ down'));
    log('log-info', '  Modbus 502:     ' + (r.modbus.up ? '✓ up (always on — not a mode indicator)' : '✗ down'));
    log('log-info', '  WebSocket 8214: ' + (r.websocket.up ? '✓ up' : '✗ down'));
    if (!r.ok) {
      log('log-err', 'Not reachable: ' + (r.error || 'no reply'));
      setStatus('error', 'Not reachable');
      setGated(false);
      return;
    }
    // BACnet is the only reliable mode indicator. Modbus TCP 502 is bound by
    // appl at startup regardless of GLT mode, so we cannot infer mode 2 from
    // port 502 being open.
    let msg = '✓ Device reachable';
    if (r.suggested_mode === 1) {
      msg += ' — BACnet is currently active. Selecting mode 1.';
      selectMode(1);
    } else {
      msg += ' — BACnet is off. GLT is either disabled or in Modbus mode; pick 0/1/2 as needed.';
    }
    log('log-ok', msg);
    setStatus('connected', 'Connected to ' + ip);
    setGated(true);
  } catch(e) {
    log('log-err', 'Connect error: ' + e.message);
    setStatus('error', 'Error');
    setGated(false);
  }
}

// If the user changes IP/port, invalidate the gate — they must re-verify.
function invalidateGate() {
  if (deviceConnected) {
    setGated(false);
    setStatus('', 'IP changed — verify again');
    log('log-info', 'IP/port changed — click Connect & verify to re-enable configuration');
  }
}
document.getElementById('ip').addEventListener('input', invalidateGate);
document.getElementById('port').addEventListener('input', invalidateGate);

// Also update preview when IP changes (existing behaviour)
document.getElementById('ip').addEventListener('input', updatePreview);
document.getElementById('port').addEventListener('input', updatePreview);

// ── License Manager ─────────────────────────────────────────────────────

function licLog(cls, msg) {
  const el = document.getElementById('lic-log');
  if (el.querySelector('span[style]')) el.innerHTML = '';
  const line = document.createElement('div');
  line.className = 'log-line ' + cls;
  const t = new Date().toTimeString().slice(0,8);
  line.textContent = '[' + t + '] ' + msg;
  el.appendChild(line);
  el.scrollTop = el.scrollHeight;
}

async function listDevices() {
  licLog('log-info', 'Scanning removable block devices…');
  try {
    const r = await api('/license/list-devices', {});
    const box = document.getElementById('usb-candidates');
    box.innerHTML = '';
    if (!r.devices || r.devices.length === 0) {
      box.innerHTML = '<div style="color:var(--muted); font-size:11px; margin-top:8px;">No removable devices detected. Plug in the dongle and re-scan.</div>';
      licLog('log-info', 'No removable devices found');
      return;
    }
    r.devices.forEach(d => {
      const div = document.createElement('div');
      div.className = 'usb-item';
      let html = '<span class="u-dev">' + d.device + '</span>  '
               + '<span class="u-model">' + (d.model || 'unknown model') + '</span>  '
               + '<span class="u-size">(' + d.size_human + ')</span>';
      if (d.partitions && d.partitions.length) {
        html += '<div style="color:var(--muted); font-size:11px; margin-top:4px;">partitions: '
             + d.partitions.join(', ')
             + ' — tool will write to raw + all partitions</div>';
      }
      div.innerHTML = html;
      div.onclick = () => {
        document.getElementById('lic-device').value = d.device;
        licLog('log-info', 'Selected ' + d.device
              + (d.partitions && d.partitions.length ? ' (+' + d.partitions.length + ' partition(s))' : ''));
      };
      box.appendChild(div);
    });
    licLog('log-ok', 'Found ' + r.devices.length + ' candidate(s) — click one to select');
  } catch(e) {
    licLog('log-err', 'Scan failed: ' + e.message);
  }
}

function _licDevice() {
  const d = document.getElementById('lic-device').value.trim();
  if (!d) { licLog('log-err', 'Enter a device path first (e.g. /dev/sdb)'); return null; }
  return d;
}

async function licCheck() {
  const dev = _licDevice(); if (!dev) return;
  licLog('log-info', 'Reading license block from ' + dev + '…');
  try {
    const r = await api('/license/check', { device: dev });
    if (r.error) { licLog('log-err', 'Error: ' + r.error); return; }
    licLog(r.checksum_ok ? 'log-ok' : 'log-err',
      'License count: ' + r.count + '  '
      + (r.checksum_ok ? '✓ checksum valid' : '✗ checksum INVALID')
      + '  (calc=' + r.calculated_checksum + ' stored=' + r.stored_checksum + ')');
  } catch(e) { licLog('log-err', 'Fetch error: ' + e.message); }
}

function _showTargetResults(r) {
  if (r.targets_written && r.targets_written.length) {
    licLog('log-info', 'Wrote to ' + r.targets_written.length + ' location(s):');
    r.targets_written.forEach(t => {
      if (t.ok) {
        licLog('log-ok', '  ✓ ' + t.target + ' → count=' + t.verify.count + ' checksum=' + (t.verify.checksum_ok ? 'OK' : 'FAIL'));
      } else {
        licLog('log-err', '  ✗ ' + t.target + ' → ' + t.error);
      }
    });
  }
}

async function licCreate() {
  const dev = _licDevice(); if (!dev) return;
  const count = parseInt(document.getElementById('lic-count').value);
  if (!count || count < 1) { licLog('log-err', 'License count must be >= 1'); return; }
  if (!confirm('This will OVERWRITE the last 512 bytes of ' + dev + ' AND every partition on it with a license block of ' + count + ' licenses.\\n\\nMake absolutely sure the device path is correct — this destroys any data at the end of the device and each partition.\\n\\nContinue?')) {
    licLog('log-info', 'Create cancelled');
    return;
  }
  licLog('log-info', 'Writing ' + count + ' licenses to ' + dev + ' (and all partitions)…');
  try {
    const r = await api('/license/create', { device: dev, count });
    if (r.error) { licLog('log-err', 'Error: ' + r.error); return; }
    licLog(r.checksum_ok ? 'log-ok' : 'log-err',
      '✓ Primary device verification: count=' + r.count + ' checksum=' + (r.checksum_ok ? 'OK' : 'MISMATCH'));
    _showTargetResults(r);
  } catch(e) { licLog('log-err', 'Fetch error: ' + e.message); }
}

async function licDecrement() {
  const dev = _licDevice(); if (!dev) return;
  if (!confirm('Decrement the license count on ' + dev + ' (and all partitions) by 1?')) {
    licLog('log-info', 'Decrement cancelled');
    return;
  }
  licLog('log-info', 'Decrementing licenses on ' + dev + ' (and all partitions)…');
  try {
    const r = await api('/license/decrement', { device: dev });
    if (r.error) { licLog('log-err', 'Error: ' + r.error); return; }
    licLog('log-ok', '✓ Primary device: remaining=' + r.count);
    _showTargetResults(r);
  } catch(e) { licLog('log-err', 'Fetch error: ' + e.message); }
}

// Init — apply default mode (0=Disabled) which hides the BACnet card
selectMode(0);

// Restore last-visited page from localStorage (defaults to alpha)
try {
  const last = localStorage.getItem('lux-page');
  if (last === 'license') showPage('license');
} catch(e) {}
</script>
</body>
</html>
"""


# ── HTTP handlers ─────────────────────────────────────────────────────────

class Handler(BaseHTTPRequestHandler):

    def log_message(self, format, *args):
        # quieter default logging
        return

    def _send_json(self, status, obj):
        body = json.dumps(obj).encode("utf-8")
        self.send_response(status)
        self.send_header("Content-Type", "application/json")
        self.send_header("Content-Length", str(len(body)))
        self.send_header("Cache-Control", "no-store")
        self.end_headers()
        self.wfile.write(body)

    def _read_json(self):
        length = int(self.headers.get("Content-Length", 0))
        if length <= 0:
            return {}
        raw = self.rfile.read(length)
        try:
            return json.loads(raw)
        except Exception:
            return {}

    def do_GET(self):
        if self.path == "/":
            body = HTML.encode("utf-8")
            self.send_response(200)
            self.send_header("Content-Type", "text/html; charset=utf-8")
            self.send_header("Content-Length", str(len(body)))
            self.end_headers()
            self.wfile.write(body)
        elif self.path == "/health":
            self._send_json(200, {"ok": True})
        elif self.path == "/whoami":
            try:
                euid = os.geteuid()
            except AttributeError:
                euid = -1  # non-POSIX
            self._send_json(200, {"euid": euid, "is_root": (euid == 0)})
        else:
            self._send_json(404, {"error": "not found"})

    def do_POST(self):
        req = self._read_json()

        if self.path == "/send":
            ip = req.get("ip", "").strip()
            port = int(req.get("port", 4444))
            cfg = req.get("config", {})
            raw = req.get("raw_packet")
            if not ip:
                return self._send_json(400, {"error": "ip required"})
            mode = int(cfg.get("mode", 0))
            if raw is not None and raw != "":
                # User-provided override — send verbatim, no field validation.
                packet = raw.encode("ascii", errors="replace")
                print(f"[send OVERRIDE] {ip}:{port} -> {packet.decode()!r}")
            else:
                packet = build_glt_packet(cfg)
                print(f"[send] {ip}:{port} -> {packet.decode()!r}")
            try:
                resp, addr = send_udp(ip, port, packet, timeout=5)
                # Wait a moment then probe the service that matches the selected mode
                time.sleep(2)
                if mode == 1:
                    service_name = "BACnet"
                    service_port = 47808
                    up, detail = check_bacnet_alive(ip, timeout=2)
                elif mode == 2:
                    service_name = "Modbus"
                    service_port = 502
                    up, detail = check_modbus_alive(ip, timeout=3)
                else:
                    service_name = None
                    service_port = None
                    up = False
                    detail = None
                return self._send_json(200, {
                    "bytes": len(packet),
                    "packet": packet.decode("ascii", errors="replace"),
                    "response": resp.decode("ascii", errors="replace") if resp else None,
                    "response_from": f"{addr[0]}:{addr[1]}" if addr else None,
                    "mode": mode,
                    "service_name": service_name,
                    "service_port": service_port,
                    "service_up": up,
                    "service_detail": detail,
                })
            except Exception as e:
                return self._send_json(500, {"error": str(e)})

        elif self.path == "/modbus":
            ip = req.get("ip", "").strip()
            if not ip:
                return self._send_json(400, {"error": "ip required"})
            print(f"[modbus] TCP connect {ip}:502")
            try:
                up, reply = check_modbus_alive(ip)
                return self._send_json(200, {
                    "up": up,
                    "reply": reply if up else None,
                    "error": None if up else reply,
                })
            except Exception as e:
                return self._send_json(500, {"error": str(e)})

        elif self.path == "/connect":
            # Reachability check via three independent probes:
            #   1. BACnet Who-Is on UDP 47808 — up iff GLT mode 1 is active
            #      (only reliable mode indicator)
            #   2. Modbus MBAP on TCP 502 — ALWAYS up: appl binds Modbus TCP
            #      independent of GLT mode, so port 502 responding does NOT
            #      imply mode 2. Used for diagnostics only, not mode detection.
            #   3. WebSocket on TCP 8214 — always up on the device; proves
            #      reachability even when GLT is off
            # A device counts as "connected" if any of the three responds.
            ip = req.get("ip", "").strip()
            if not ip:
                return self._send_json(400, {"error": "ip required"})
            print(f"[connect] probing {ip} — BACnet, Modbus, WebSocket")

            bacnet_up, bacnet_hex = check_bacnet_alive(ip, timeout=2)
            modbus_up, modbus_reply = check_modbus_alive(ip, timeout=2)
            ws_up = check_tcp_port(ip, 8214, timeout=2)

            reachable = bacnet_up or modbus_up or ws_up
            # Mode inference: ONLY BACnet is a reliable signal.
            # Modbus port 502 is up regardless of GLT mode — cannot be used.
            if bacnet_up:
                suggested_mode = 1
            elif reachable:
                # Device is up but BACnet isn't — GLT is disabled OR in Modbus
                # mode. We can't distinguish these two without a deeper probe,
                # so leave the current mode selection alone (None = no suggestion).
                suggested_mode = None
            else:
                suggested_mode = None

            return self._send_json(200, {
                "ok": reachable,
                "bacnet": {"up": bacnet_up, "detail": bacnet_hex if bacnet_up else None},
                "modbus": {"up": modbus_up, "detail": modbus_reply if modbus_up else None,
                           "note": "Modbus 502 is always up regardless of GLT mode"},
                "websocket": {"up": ws_up},
                "suggested_mode": suggested_mode,
                "error": None if reachable
                    else f"no response from {ip} on 47808/UDP, 502/TCP, or 8214/TCP",
            })

        elif self.path == "/bacnet":
            ip = req.get("ip", "").strip()
            if not ip:
                return self._send_json(400, {"error": "ip required"})
            print(f"[bacnet] Who-Is -> {ip}:47808")
            up, hex_or_err = check_bacnet_alive(ip, timeout=3)
            return self._send_json(200, {"up": up, "hex": hex_or_err if up else None,
                                          "error": None if up else hex_or_err})

        elif self.path == "/license/list-devices":
            print("[license] list-devices")
            try:
                return self._send_json(200, {"devices": list_usb_candidates()})
            except Exception as e:
                return self._send_json(500, {"error": str(e)})

        elif self.path == "/license/check":
            device = req.get("device", "").strip()
            if not device:
                return self._send_json(400, {"error": "device required"})
            if not device.startswith("/dev/"):
                return self._send_json(400, {"error": "device must be a /dev/ path"})
            print(f"[license] check {device}")
            try:
                return self._send_json(200, check_licenses(device))
            except PermissionError:
                return self._send_json(500, {"error": "permission denied — run this server as root"})
            except FileNotFoundError:
                return self._send_json(404, {"error": f"{device} not found"})
            except Exception as e:
                return self._send_json(500, {"error": str(e)})

        elif self.path == "/license/create":
            device = req.get("device", "").strip()
            count = int(req.get("count", 0))
            if not device:
                return self._send_json(400, {"error": "device required"})
            if not device.startswith("/dev/"):
                return self._send_json(400, {"error": "device must be a /dev/ path"})
            if count < 1 or count > 0xFFFF:
                return self._send_json(400, {"error": "count must be 1..65535"})
            print(f"[license] create count={count} on {device}")
            try:
                return self._send_json(200, create_licenses(device, count))
            except PermissionError:
                return self._send_json(500, {"error": "permission denied — run this server as root"})
            except FileNotFoundError:
                return self._send_json(404, {"error": f"{device} not found"})
            except Exception as e:
                return self._send_json(500, {"error": str(e)})

        elif self.path == "/license/decrement":
            device = req.get("device", "").strip()
            if not device:
                return self._send_json(400, {"error": "device required"})
            if not device.startswith("/dev/"):
                return self._send_json(400, {"error": "device must be a /dev/ path"})
            print(f"[license] decrement {device}")
            try:
                return self._send_json(200, decrement_licenses(device))
            except PermissionError:
                return self._send_json(500, {"error": "permission denied — run this server as root"})
            except FileNotFoundError:
                return self._send_json(404, {"error": f"{device} not found"})
            except Exception as e:
                return self._send_json(500, {"error": str(e)})

        else:
            self._send_json(404, {"error": "not found"})


# ── Main ──────────────────────────────────────────────────────────────────

def main():
    ap = argparse.ArgumentParser(description=__doc__)
    ap.add_argument("--port", type=int, default=8080, help="HTTP port (default 8080)")
    ap.add_argument("--bind", default="127.0.0.1", help="Bind address (default 127.0.0.1)")
    args = ap.parse_args()

    server = HTTPServer((args.bind, args.port), Handler)
    print(f"╔══════════════════════════════════════════════════════════════╗")
    print(f"║ Alpha Connect Web Wrapper                                     ║")
    print(f"║ http://{args.bind}:{args.port}/                                       ")
    print(f"║ Ctrl-C to stop                                                ║")
    print(f"╚══════════════════════════════════════════════════════════════╝")
    try:
        server.serve_forever()
    except KeyboardInterrupt:
        print("\nBye.")


if __name__ == "__main__":
    main()