Skip to content

Client control: the master signs the settings it shares - #2639

Merged
psonnera merged 2 commits into
devfrom
client-control-pairing
Oct 23, 2026
Merged

psonnera merged 2 commits into
devfrom
client-control-pairing

Conversation

@MilosKozak

Copy link
Copy Markdown
Collaborator

Follow-up to #2638. The matching code is in AndroidAPS dev already, so this can be merged now.

The master now signs the settings it puts in Nightscout for its clients (the settings, the client list and the "master is alive" sign). A client takes them only when the signature is the master's, so another client's Nightscout token cannot change them.

What changes, all on Master ↔ Client control:

  • Security notes: a new point, "The master signs what it shares", and how a client learns the master's key (when it pairs, or from the QR code for a phone that only reads Nightscout).
  • Troubleshooting: a new row for the NSClient log message "✕ SETTINGS … refused" and what to do: a paired client takes a new key by itself, and a phone that only reads Nightscout needs the master's QR code again.

utils/qualitycheck.py --lang EN passes.

@github-actions

github-actions Bot commented Oct 21, 2026 •

Copy link
Copy Markdown

♻️ Preview destroyed

PR preview ♻️ Destroyed ♻️ Destroyed
🔗 Preview https://openaps-AndroidAPSdocs-build-pr-2639.surge.sh (already destroyed)
📝 Commit5199c12
🪵 LogsView logs

🤖 Powered by surge-preview

@psonnera
psonnera merged commit 884b252 into dev Oct 23, 2026
1 check passed
@psonnera
psonnera deleted the client-control-pairing branch October 23, 2026 20:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants