feat: implement credential management UI

[AlCalzone]

This PR adds a dedicated credential management UI, powered by Z-Wave JS's new Access Control API.
It includes everything that belongs to it: managing credentials, moving them between users, fingerprint and other credential learning, bulk deletion, logging, etc.

This also removes the userCode and userIdStatus values from the User Code CC dropdown, since those are no longer needed to manage codes.

Screencast.From.2026-07-17.10-16-37.mp4

[coveralls]

Coverage Report for CI Build 29570888571

Coverage increased (+0.03%) to 12.399%

Details

• Coverage increased (+0.03%) from the base build.
• Patch coverage: 203 uncovered changes across 2 files (37 of 240 lines covered, 15.42%).
• 2 coverage regressions across 2 files.

Uncovered Changes

File	Changed	Covered	%
api/lib/ZwaveClient.ts	172	0	0.0%
src/lib/accessControl.ts	68	37	54.41%

Coverage Regressions

2 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
api/lib/utils.ts	1	39.95%
api/lib/ZwaveClient.ts	1	0.27%

---

Coverage Stats

Relevant Lines:	7002
Covered Lines:	937
Line Coverage:	13.38%
Relevant Branches:	4531
Covered Branches:	493
Branch Coverage:	10.88%
Branches in Coverage %:	Yes
Coverage Strength:	2.08 hits per line

---

💛 - Coveralls

[robertsLando]

@AlCalzone do you have support in mock server for it?

[AlCalzone]

@AlCalzone do you have support in mock server for it?

Yeah, both CCs are extensively tested through mocks internally.

[Copilot]

Pull request overview

This PR introduces an Access Control (User Credential / User Code) management feature across backend + frontend, adding a dedicated UI for users/credentials enrollment and operations, and hiding legacy User Code CC values from the generic value list when Access Control is available.

Changes:

• Added frontend Access Control helpers/constants/types and a new node “Access Control” tab UI (users, credentials, activity, admin code).
• Added new dialogs for adding/editing users and adding/replacing credentials.
• Extended backend ZwaveClient with Access Control APIs, state mapping, and event wiring to keep the UI snapshot updated.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
src/lib/accessControl.ts	Frontend enums/labels/helpers + shared Access Control types used by the new UI.
src/components/nodes-table/NodeDetails.vue	Hides userCode/userIdStatus values from the value list when Access Control is supported.
src/components/nodes-table/ExpandedNode.vue	Adds the “Access Control” node tab and lazy-loads the new component.
src/components/nodes-table/AccessControl.vue	New main Access Control UI (users/credentials/actions/enrollment/admin code).
src/components/dialogs/DialogAccessControlUser.vue	New dialog for creating/editing users, including optional initial credential.
src/components/dialogs/DialogAccessControlCredential.vue	New dialog for adding/replacing direct-entry credentials (PIN/password).
api/lib/ZwaveClient.ts	Backend Access Control API surface + cached state mapping + event handling updates.

[AlCalzone]

Fixed in d4eae67 — the initial credential is masked with an explicit reveal control.

[AlCalzone]

Deep review — feat: implement credential management UI

Verdict: Needs work — the approach is sound and composes well with the codebase, but a credential-leakage Blocker and a silent-data-loss Major should be fixed before merge.

Top 3 risks

1. Cleartext PINs/passwords broadcast to every connected client and retained in the in-memory event buffer.
2. Adding a user to a full lock silently overwrites user 1 instead of erroring.
3. The admin-code path monkeypatches a zwave-js-private method with a non-reentrant wrapper and reports unconfirmed changes as success.

Strengths

• Composes with house style: canonical validateMethods/allowedApis → callApi dispatch, the emitNodeUpdate(node,{accessControl}) snapshot pattern shared with userCodes/schedule, and standard async-component tab registration.
• accessControl.ts is clean, well-factored pure logic; the result-code → user-message mappers are a nice UX touch.
• Comprehensive: learning/enrollment, bulk delete, move-between-users, admin code — all wired end to end.

Themes

1. Secret handling — credentials leak through the event stream, the state snapshot, and the mask function.
2. The admin-code handleCommand monkeypatch — one construct drew correctness, design, readability, and operability findings at once.
3. Frontend/backend contract duplication — enums and types hand-mirrored instead of imported.

FYI (not line-anchored)

• Backcompat is fine: hiding userCode/userIdStatus (NodeDetails.vue ~557) only filters the value grid; values stay in node.values and on MQTT, so automations are unaffected. But the legacy "Users" (UserCodeTable) tab in ExpandedNode.vue still renders alongside the new "Access Control" tab — two overlapping UIs for the same locks.
• _onNodeEvent (ZwaveClient.ts:7871) was broadened to zwaveNode?.nodeId ?? zwaveNode?.id; equal for root nodes, so no behavior change, but a shared dispatch helper was changed for one feature.
• Confirmed not problems: formatHex doesn't duplicate the backend buffer2hex/num2hex; no i18n infra exists so the hardcoded label maps bypass nothing; the two new dialogs are presentational and bypass no dialog base.

Coverage: All 7 specialists ran (Correctness, Security, DRY, Design/API, Operability, Tests, Readability). Performance not run — no DB/query/hot-loop surface in its lane. Reviewed against a worktree at PR head 6a0ab63.