Jsondb

.gitignore

@@ -350,3 +350,6 @@ MigrationBackup/
 .ionide/
 
 .idea/
+
+# Selenium screenshots
+screenshots/

README.md

@@ -2,37 +2,108 @@
 
 [![Build Status](https://dev.azure.com/jonathanhorvath/Aporta/_apis/build/status%2Fbytedreamer.Aporta?branchName=develop)](https://dev.azure.com/jonathanhorvath/Aporta/_build/latest?definitionId=2&branchName=develop)
 
-Aporta is an open source physical access controller. The main purpose of the software is to secure doors from unauthorized access. This is accomplished by determining if a person presenting an issued credential is authorized to enter a door. The door is unlocked momentarily by the software if the person has been given access.
+Aporta is an open source physical access controller. The main purpose of the software is to secure doors from unauthorized access. This is accomplished by determining if a presented credential is authorized to enter a door. The door is unlocked momentarily by the software if the credential has the appropriate access rights.
 
 Aporta doesn't intend to recreate what is already available by existing physical access controllers. The goal is to provide a level of flexibility that is not possible with existing closed physical access control systems. Below are the design considerations that are going to make Aporta truly versatile. 
 
 - The software is written to be platform independent. This gives Aporta the ability to run on wide range of hardware. The same code runs on Windows, Mac, or Linux, even lower power devices such as Raspberry Pi.
 - Modularity is built into the architecture of the software. There will be the ability to add custom plugins for enhanced capabilities. 
-- Open standards are embraced and built into the software.
+- Open standards are embraced and built into the software — most notably OSDP, and Z9/Open Community Profile.
 - Features are not to be restricted by licensing. All the software's capabilities are available without being overburden with expensive and confusing license terms.
 
-## Release Plan ##
+## Z9/Open Community Profile ##
 
-The project is early in its development. After working on access control products for many years, my inclination is that there are a large number of features required for a viable access controller. The list below is an attempt to limit the feature targeted in the first release.
+Aporta uses the Z9/Open Community Profile data model for data storage, as well as host communications. The protocol and library are here: https://github.com/z9security/z9open-community. This profile covers important core electronic door access control functionality: credentials, access levels, schedules, holidays, card formats, events, status, door modes, and device actions such as momentary unlock.
 
-- Easy installation **(Done)**
-    - Windows installer **(Done)**
-    - Debian packages **(Done)**
+## Z9/Flex Community Profile ##
+
+Aporta supports the Z9/Flex Community Profile as a JSON/REST API, intended for use by the built-in web user interface. This API is not generally used for data synchronization with other systems, as Z9/Open Community Profile is much better suited for high-performance data synchronization. The protocol and library are here: https://github.com/z9security/z9flex-community. Z9/Open Community Profile and Z9/Flex Community Profile are essentially the same data model with 2 different representations (Google Protobuf, and JSON/REST, respectively).
+
+## Completed ##
+
+### Aporta
+- Easy installation
+    - Windows installer
+    - Debian packages
 - Self hosted web management
-    - SSL required by default **(Done)**
-    - A master password to gain access
+    - SSL required by default
+- OSDP Driver
+    - Install new devices with security channel encryption
+    - Process standard Wiegand card reads
+    - Detect if device is online
+    - Control output
+- Access Control
+    - Enroll new credential
+    - Read entire card data for card number
+    - Log access events
+    - Door access privilege management from Credentials page (assign/remove doors, set schedule restrictions)
+    - Door Access column on Credentials page showing assigned doors with schedule names
+    - Card format management (create, edit, delete binary card formats with parity, field, and static elements)
+    - Holiday management (create, edit, delete holidays with repeat and schedule preservation options)
+
+### Z9/Open Community Profile
+- Connection & Protocol
+    - Outbound TCP connection from panel to host (panel-initiates model)
+    - Protobuf-based Z9/Open Community protocol with identification handshake
+    - Automatic configuration download on connect (DbChange messages)
+- Device Management
+    - OSDP credential readers over TCP/IP, configured from Dev messages
+    - Door model with strike actuator, door contact sensor, and REX sensor — all wired automatically from the device hierarchy
+    - Credential reader online/offline status reporting
+    - Device status reporting to host via DevStatus messages
+- Credential & Data Format Support
+    - Credential mapping from Cred objects (card number, facility code, enabled/disabled, effective/expiry dates)
+    - Credentials stored by card number; card reads decoded using DataFormat definitions to extract and match by card number
+    - Card format definitions (DataFormat, DataLayout, DataGroup) for decoding raw card data into meaningful fields
+    - Credential templates, data layouts, and data formats persisted to local SQLite database
+- Access Control Decisions
+    - Privilege-based access control using DoorAccessPriv and CredPrivBinding
+    - Door-specific privilege checking (precision access and privilege group elements)
+    - Element-level schedule restrictions on DoorAccessPrivElements
+    - Schedule enforcement with SchedRestriction (time-of-day, day-of-week)
+    - Holiday-aware schedule evaluation
+    - Credential status checks: disabled, not yet effective, expired
+    - Access granted and denied events reported to host with appropriate EvtSubCode
+- Door Control
+    - Door strike actuation on access grant with configurable strike time from DoorConfig
+    - Extended strike time support via credential DoorAccessModifiers (extDoorTime flag)
+    - Request to Exit (REX) with configurable activateStrikeOnRex
+    - Door momentary unlock via DevActionReq from host
+    - Door mode support: unlocked, locked, card-only, card+confirming PIN, unique PIN only, card-only or unique PIN
+    - PIN support: keypad entry buffering, confirming PIN validation, unique PIN lookup
+    - Default door mode applied from DoorConfig on door creation
+    - Runtime door mode change via DevActionReq (DoorModeChange) from host, including reset-to-default
+    - REX behavior respects current door mode
+- Door Alarm Monitoring
+    - Door state reporting: unlocked, locked, opened, closed
+    - Door forced open detection with DoorForced/DoorNotForced events
+    - Door held open detection with DoorHeld/DoorNotHeld events
+    - Extended held time support via credential extDoorTime flag
+- Events
+    - CONTROLLER_STARTUP on service start
+    - MOMENTARY_UNLOCK audit trail when host initiates a momentary unlock action
+    - TAMPER / TAMPER_NORMAL events with dev state tracking when OSDP reader reports tamper
+    - CRED_READER_POWER_CYCLE event when OSDP reader reports power cycle
+    - RAW_CRED_READ event in primary mode for credential enrollment
+    - SCHED_ACTIVE / SCHED_INACTIVE events with per-minute schedule evaluation
+
+## API Architecture ##
+
+The web UI communicates with the server through the Z9/Flex Community Profile API (e.g., `/cred/list`, `/door/list`). The Extensions and Driver Configuration pages still use the original REST API (`/api/Extensions`), which is maintained as-is for now.
+
+## TODO ##
+
+### Aporta
+- Self hosted web management
+    - Configurable user accounts (currently uses default credentials)
 - OSDP Driver
-    - Install new devices with security channel encryption **(Done)**
-    - Process standard Wiegand card reads **(Done)**
-    - Detect if device is online **(Done)**
-    - Control output **(Done)**
     - Notify when input is tripped
- - Access Control
-    - Enroll new cardholder **(Done)**
-    - Basic access level assignment
-    - Read entire card data for card number **(Done)**
-    - Card number is a non-reversible hash **(Done)**
-    - Log access events **(Done)**
+
+### Z9/Open Community Profile
+- DbChange: Handle device deletions (devDelete, devDeleteAll) — currently silently ignored, causing stale devices to accumulate
+- EvtControl: Implement event flow control (StartContinuous, ConsumeUpTo) for generic delivery of events persisted while offline
+- Events: CONTROLLER_ONLINE / CONTROLLER_OFFLINE — for IO_CONTROLLER_SUB subcontrollers (requires subcontroller device model first)
+- Events: Power/battery (POWER_PRIMARY/OFF_PRIMARY/NONE, BATTERY_OK/LOW/FAIL/CRITICAL) — needs a way of expressing that an input/sensor is used for this purpose
 
 ## Installation ##
 
@@ -70,7 +141,7 @@ The log files will be placed in the standard Linux logging directory
 
 ### Quick Start
 
-After installing Aporta, browse to the local web url ```https://localhost:8443``` to get started. A [Quick Start Guide](https://github.com/bytedreamer/Aporta/wiki/Quick-start-guide) can be found in the Wiki section.
+After installing Aporta, browse to the local web url ```https://localhost:8443``` to get started. You will be presented with a login screen. The default credentials are username ```admin``` and password ```pass```. A [Quick Start Guide](https://github.com/bytedreamer/Aporta/wiki/Quick-start-guide) can be found in the Wiki section.
 
 ### Configuration ###
 
@@ -106,3 +177,5 @@ General information about configuring and setting up the Aporta project for deve
 
 [A summary of all of the Core Abstractions and Concepts](https://github.com/bytedreamer/Aporta/wiki/Aporta-Core-Abstractions-and-Concepts) used in the Aporta code.
 
+Note: The Wiki documents the pre-Z9/Open Community Profile architecture.
+

src/Aporta.Core/Aporta.Core.csproj

@@ -11,6 +11,7 @@
       <PackageReference Include="Microsoft.AspNetCore.SignalR.Core" Version="1.1.0" />
       <PackageReference Include="Microsoft.Data.Sqlite" Version="8.0.8" />
       <PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
+      <PackageReference Include="Z9.Protobuf.Community" Version="1.0.18" />
     </ItemGroup>
 
     <ItemGroup>

src/Aporta.Core/DataAccess/Migrations/_0000_InitialCreate.cs

@@ -6,25 +6,113 @@ namespace Aporta.Core.DataAccess.Migrations
 {
     public class _0000_InitialCreate : IMigration
     {
-        public int Version => 0;
-
-        public string Name => "Initial create";
+        // Version 100 to distinguish from old column-based schema (versions 0-10)
+        public int Version => 100;
+
+        public string Name => "Initial create with JSON document storage";
 
         public async Task PerformUpdate(IDbConnection connection, IDbTransaction transaction)
         {
             await connection.ExecuteAsync(
-                @"create table schema_info
-                        (
-                            id        integer not null
-                                constraint schema_info_pk
-                                    primary key,
-                            name      text not null,
-                            timestamp datetime not null
-                        );
-
-                        create unique index schema_info_id_uindex
-                            on schema_info (id);", 
+                @"
+                -- Schema info table (unchanged)
+                CREATE TABLE schema_info (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    name TEXT NOT NULL,
+                    timestamp DATETIME NOT NULL
+                );
+                CREATE UNIQUE INDEX schema_info_id_uindex ON schema_info (id);
+
+                -- Extension table (GUID primary key)
+                CREATE TABLE extension (
+                    id TEXT NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+                CREATE UNIQUE INDEX extension_id_uindex ON extension (id);
+
+                -- Global setting table (string primary key)
+                CREATE TABLE global_setting (
+                    name TEXT NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Credential Template table
+                CREATE TABLE cred_template (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Data Layout table
+                CREATE TABLE data_layout (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Data Format table
+                CREATE TABLE data_format (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Privilege table
+                CREATE TABLE priv (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Schedule table
+                CREATE TABLE sched (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Holiday table
+                CREATE TABLE hol (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Holiday Calendar table
+                CREATE TABLE hol_cal (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Holiday Type table
+                CREATE TABLE hol_type (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Z9 Device table (stores full Dev proto messages)
+                CREATE TABLE z9_dev (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL,
+                    external_dev_mod_id TEXT
+                );
+
+                -- Encryption Key table
+                CREATE TABLE encryption_key (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL
+                );
+
+                -- Z9 Credential table (stores full proto including privBindings)
+                CREATE TABLE z9_cred (
+                    id INTEGER NOT NULL PRIMARY KEY,
+                    data TEXT NOT NULL,
+                    cred_num TEXT
+                );
+                CREATE UNIQUE INDEX z9_cred_cred_num_uindex ON z9_cred(cred_num) WHERE cred_num IS NOT NULL;
+
+                -- Z9 Event table
+                CREATE TABLE z9_evt (
+                    id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,
+                    data TEXT NOT NULL
+                );
+
+",
                 transaction: transaction);
         }
     }
-}
+}