identity management: update security handling in room servers to use settings section and improve identity key update logic

config.yaml.example

@@ -77,8 +77,6 @@ identities:
     #     node_name: "Test BBS Room"
     #     latitude: 0.0
     #     longitude: 0.0
-    #   
-    #   security:
     #     admin_password: "room_admin_password"
     #     guest_password: "room_guest_password"
     
@@ -88,7 +86,8 @@ identities:
     #   type: "room_server"
     #   settings:
     #     node_name: "Social Hub"
-    #   security:
+    #     latitude: 0.0
+    #     longitude: 0.0
     #     admin_password: "social_admin_123"
     #     guest_password: "social_guest_123"
     

repeater/handler_helpers/acl.py

@@ -62,22 +62,23 @@ class ACL:
         target_identity_config = target_identity_config or {}
         
         # Check for identity-specific passwords (required for room servers)
-        identity_security = target_identity_config.get("security", {})
+        identity_settings = target_identity_config.get("settings", {})
         
         # Determine if this is a room server by checking the type field
         identity_type = target_identity_config.get("type", "")
         is_room_server = identity_type == "room_server"
         
         if is_room_server:
-            # Room servers MUST define their own passwords - no fallback
-            admin_pwd = identity_security.get("admin_password")
-            guest_pwd = identity_security.get("guest_password")
+            # Room servers use passwords from their settings section only
+            # Empty strings are treated as "not set"
+            admin_pwd = identity_settings.get("admin_password") or None
+            guest_pwd = identity_settings.get("guest_password") or None
             
             if not admin_pwd and not guest_pwd:
-                logger.error(f"Room server '{target_identity_name}' has no passwords configured!")
+                logger.error(f"Room server '{target_identity_name}' has no passwords configured! Set admin_password and/or guest_password in settings.")
                 return False, 0
         else:
-            # Repeater uses global passwords
+            # Repeater uses global passwords from its own security section
             admin_pwd = self.admin_password
             guest_pwd = self.guest_password
         

repeater/handler_helpers/login.py

@@ -32,24 +32,44 @@ class LoginHelper:
         
         # Get security config for this identity
         if identity_type == "room_server":
-            security = config.get("security", {})
-            # Validate room servers have their own passwords
-            if not security.get("admin_password") and not security.get("guest_password"):
+            # Room servers use passwords from their settings section only
+            settings = config.get("settings", {})
+            
+            # Empty strings ('') are treated as "not set" by using 'or None'
+            admin_password = settings.get("admin_password") or None
+            guest_password = settings.get("guest_password") or None
+            
+            # Validate room servers have passwords configured
+            if not admin_password and not guest_password:
                 logger.error(
-                    f"Room server '{name}' MUST have security.admin_password or "
-                    f"security.guest_password configured. Skipping registration."
+                    f"Room server '{name}' MUST have admin_password or guest_password configured. "
+                    f"Add them to 'settings' section. Skipping registration."
                 )
                 return
+            
+            # Use configured passwords from settings
+            final_security = {
+                "max_clients": settings.get("max_clients", 50),
+                "admin_password": admin_password,
+                "guest_password": guest_password,
+                "allow_read_only": settings.get("allow_read_only", True),
+            }
         else:
             # Repeater uses security from its config
             security = config.get("security", {})
+            final_security = {
+                "max_clients": security.get("max_clients", 50),
+                "admin_password": security.get("admin_password", "admin123"),
+                "guest_password": security.get("guest_password", "guest123"),
+                "allow_read_only": security.get("allow_read_only", True),
+            }
         
         # Create ACL for this identity
         identity_acl = ACL(
-            max_clients=security.get("max_clients", 50),
-            admin_password=security.get("admin_password", "admin123"),
-            guest_password=security.get("guest_password", "guest123"),
-            allow_read_only=security.get("allow_read_only", True),
+            max_clients=final_security["max_clients"],
+            admin_password=final_security["admin_password"],
+            guest_password=final_security["guest_password"],
+            allow_read_only=final_security["allow_read_only"],
         )
         
         self.acls[hash_byte] = identity_acl

repeater/web/api_endpoints.py

@@ -1291,7 +1291,8 @@ class APIEndpoints:
                     return self._error(f"Identity with name '{new_name}' already exists")
                 identity["name"] = new_name
             
-            if "identity_key" in data:
+            # Only update identity_key if a non-empty value is provided
+            if "identity_key" in data and data["identity_key"]:
                 identity["identity_key"] = data["identity_key"]
             
             if "settings" in data:
@@ -1314,7 +1315,8 @@ class APIEndpoints:
             
             # Hot reload - re-register identity if key changed or name changed
             registration_success = False
-            needs_reload = "identity_key" in data or "new_name" in data
+            # Only reload if identity_key was actually provided and not empty, or if name changed
+            needs_reload = (data.get("identity_key") or "new_name" in data)
             
             if needs_reload and self.daemon_instance:
                 try: