PhoneAPI *who = nullptr;

meshtastic_LockdownStatus status = {};

bool hasPending = false;

// True between a successful passphrase verify and the main-loop

// reloadFromDisk that follows. While set, the connection is NOT

// yet authorized and no UNLOCKED status has been emitted — the

// client still sees LOCKED, and any admin op it tries is dropped

// by the existing unauth gates. Cleared either way by

// completePendingUnlocks once reload finishes.

bool pendingUnlockAfterReload = false;

{

if (!p)

return;

for (auto &s : g_statusSlots) {

if (s.who == p) {

s.who = nullptr;

s.hasPending = false;

s.pendingUnlockAfterReload = false;

memset(&s.status, 0, sizeof(s.status));

return;

}

}

uint8_t boots_remaining, uint32_t valid_until_epoch, uint32_t backoff_seconds)

{

memset(&out, 0, sizeof(out));

out.state = state;

// Collapse the specific token_* reasons to a generic "locked" over

// the wire — full detail still goes to local logs. An unauth client

// does not need to know whether HMAC failed vs the boot count

// hit zero vs the file was the wrong size; all of those mean the

// same thing to the client ("locked, ask for passphrase") but

// telling them apart over the network lets an attacker confirm

// that their tampering or rollback attempt was noticed.

const char *wireReason = lock_reason;

if (state == meshtastic_LockdownStatus_State_LOCKED && wireReason && wireReason[0] != '\0') {

if (strncmp(wireReason, "token_", 6) == 0)

wireReason = "locked";

}

if (wireReason && wireReason[0] != '\0')

strncpy(out.lock_reason, wireReason, sizeof(out.lock_reason) - 1);

out.boots_remaining = boots_remaining;

out.valid_until_epoch = valid_until_epoch;

out.backoff_seconds = backoff_seconds;

PhoneAPI *who = nullptr;

bool authorized = false;

uint32_t epoch = 0;

{

if (!p)

return;

for (auto &s : g_authSlots) {

if (s.who == p) {

s.authorized = false;

s.epoch = 0;

s.who = nullptr;

break;

}

}

clearStatusSlot_LH(p);

{

lastContactMsec = millis();

std::fill(std::begin(recentToRadioPacketIds), std::end(recentToRadioPacketIds), 0);

{

// Must be before setting state (because state is how we know !connected)

if (!isConnected()) {

onConnectionChanged(true);

observe(&service->fromNumChanged);

#ifdef FSCom

observe(&xModem.packetReady);

#endif

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

// New physical connection: clear this PhoneAPI's auth slot so the new

// client must present a passphrase or PKC admin signature before

// seeing full config. Do NOT reset on a subsequent want_config_id

// within the same connection: after a successful unlock the client

// re-requests config to pull the now-unredacted values, and re-locking

// that same-link re-fetch would strip the auth it just earned (config

// comes back redacted and set_config writes get dropped).

//

// The security boundary is therefore the physical connection, not the

// want_config handshake. For BLE that boundary is enforced in

// onConnect() (which fires once per link and also resets the slot), so

// a reconnect re-locks even if this !isConnected() transition was

// missed because the prior link's close() raced the new config burst.

{

concurrency::LockGuard g(&g_authSlotsMutex);

if (auto *slot = findOrAllocSlot_LH(this)) {

slot->authorized = false;

slot->epoch = 0;

}

}

#endif

}

// Allow subclasses to prepare for high-throughput config traffic

onConfigStart();

// even if we were already connected - restart our state machine

if (config_nonce == SPECIAL_NONCE_ONLY_NODES) {

// If client only wants node info, jump directly to sending nodes

state = STATE_SEND_OWN_NODEINFO;

LOG_INFO("Client only wants node info, skipping other config");

} else {

state = STATE_SEND_MY_INFO;

}

pauseBluetoothLogging = true;

#if defined(MESHTASTIC_EXCLUDE_FILES_MANIFEST)

// Skip the recursive FS walk. Used by platforms whose Zephyr LittleFS

// backend can't safely traverse a deep tree (e.g. nRF54L15) and platforms

// that don't support OTA browsing — the manifest is only consumed by

// companion apps for those flows.

releaseFilesManifest(filesManifest);

#else

// Manifest is never read on the node-info-only path (STATE_SEND_FILEMANIFEST

// short-circuits to sendConfigComplete), so skip the SPI lock + FS walk.

if (config_nonce != SPECIAL_NONCE_ONLY_NODES) {

bool filesManifestLimited = false;

{

concurrency::LockGuard guard(spiLock);

filesManifest = getFiles("/", FILES_MANIFEST_LEVELS, FILES_MANIFEST_MAX_COUNT, &filesManifestLimited);

}

if (filesManifestLimited) {

LOG_WARN("Got %zu files in manifest (limited to %zu entries/depth %u)", filesManifest.size(),

FILES_MANIFEST_MAX_COUNT, static_cast<unsigned>(FILES_MANIFEST_LEVELS));

} else {

LOG_DEBUG("Got %zu files in manifest", filesManifest.size());

}

} else {

releaseFilesManifest(filesManifest);

}

#endif

LOG_INFO("Start API client config millis=%u", millis());

// Protect against concurrent BLE callbacks: they run in NimBLE's FreeRTOS task and also touch nodeInfoQueue.

{

concurrency::LockGuard guard(&nodeInfoMutex);

nodeInfoForPhone = {};

nodeInfoQueue.clear();

replayQueue.clear();

replayPositionOrder.clear();

replayTelemetryOrder.clear();

replayEnvironmentOrder.clear();

replayStatusOrder.clear();

replayPositionIndex = 0;

replayTelemetryIndex = 0;

replayEnvironmentIndex = 0;

replayStatusIndex = 0;

}

resetReadIndex();

{

LOG_DEBUG("PhoneAPI::close()");

if (service->api_state == service->STATE_BLE && api_type == TYPE_BLE)

service->api_state = service->STATE_DISCONNECTED;

else if (service->api_state == service->STATE_WIFI && api_type == TYPE_WIFI)

service->api_state = service->STATE_DISCONNECTED;

else if (service->api_state == service->STATE_SERIAL && api_type == TYPE_SERIAL)

service->api_state = service->STATE_DISCONNECTED;

else if (service->api_state == service->STATE_PACKET && api_type == TYPE_PACKET)

service->api_state = service->STATE_DISCONNECTED;

else if (service->api_state == service->STATE_HTTP && api_type == TYPE_HTTP)

service->api_state = service->STATE_DISCONNECTED;

else if (service->api_state == service->STATE_ETH && api_type == TYPE_ETH)

service->api_state = service->STATE_DISCONNECTED;

if (state != STATE_SEND_NOTHING) {

state = STATE_SEND_NOTHING;

resetReadIndex();

unobserve(&service->fromNumChanged);

#ifdef FSCom

unobserve(&xModem.packetReady);

#endif

releasePhonePacket(); // Don't leak phone packets on shutdown

releaseQueueStatusPhonePacket();

releaseMqttClientProxyPhonePacket();

releaseClientNotification();

onConnectionChanged(false);

fromRadioScratch = {};

toRadioScratch = {};

// Clear cached node info under lock because NimBLE callbacks can still be draining it.

{

concurrency::LockGuard guard(&nodeInfoMutex);

nodeInfoForPhone = {};

nodeInfoQueue.clear();

replayQueue.clear();

replayPositionOrder.clear();

replayTelemetryOrder.clear();

replayEnvironmentOrder.clear();

replayStatusOrder.clear();

replayPositionIndex = 0;

replayTelemetryIndex = 0;

replayEnvironmentIndex = 0;

replayStatusIndex = 0;

replayPhase = REPLAY_PHASE_IDLE;

}

packetForPhone = NULL;

releaseFilesManifest(filesManifest);

lastPortNumToRadio.clear();

fromRadioNum = 0;

config_nonce = 0;

config_state = 0;

pauseBluetoothLogging = false;

heartbeatReceived = false;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

{

concurrency::LockGuard g(&g_authSlotsMutex);

clearAuthSlot_LH(this);

}

#endif

}

{

if (isConnected()) {

bool newContact = checkIsConnected();

if (!newContact) {

LOG_INFO("Lost phone connection");

close();

return true;

}

}

return false;

{

powerFSM.trigger(EVENT_CONTACT_FROM_PHONE); // As long as the phone keeps talking to us, don't let the radio go to sleep

lastContactMsec = millis();

memset(&toRadioScratch, 0, sizeof(toRadioScratch));

if (pb_decode_from_bytes(buf, bufLength, &meshtastic_ToRadio_msg, &toRadioScratch)) {

switch (toRadioScratch.which_payload_variant) {

case meshtastic_ToRadio_packet_tag:

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Allow admin messages addressed to this device — passphrase delivery must get through.

// AdminModule handles its own is_managed gate for those.

// Block everything else — unauthorized clients cannot inject mesh traffic.

// Require the packet to carry a decoded (not encrypted) payload so portnum is valid.

// Refuse to match when our own node number is still 0 (NodeDB

// not yet loaded — happens during the locked-default boot path

// before reloadFromDisk). Otherwise a packet with to==0 would

// satisfy the equality and bypass the gate.

NodeNum ourNum = nodeDB->getNodeNum();

bool isLocalAdmin =

ourNum != 0 && toRadioScratch.packet.which_payload_variant == meshtastic_MeshPacket_decoded_tag &&

toRadioScratch.packet.decoded.portnum == meshtastic_PortNum_ADMIN_APP && toRadioScratch.packet.to == ourNum;

if (!isLocalAdmin) {

LOG_INFO("Lockdown: Dropping non-admin ToRadio packet from unauthorized client");

return false;

}

}

#endif

return handleToRadioPacket(toRadioScratch.packet);

case meshtastic_ToRadio_want_config_id_tag:

config_nonce = toRadioScratch.want_config_id;

LOG_INFO("Client wants config, nonce=%u", config_nonce);

handleStartConfig();

break;

case meshtastic_ToRadio_disconnect_tag:

LOG_INFO("Disconnect from phone");

close();

break;

case meshtastic_ToRadio_xmodemPacket_tag:

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

LOG_INFO("Lockdown: Dropping xmodem packet from unauthorized client");

break;

}

#endif

LOG_INFO("Got xmodem packet");

#ifdef FSCom

xModem.handlePacket(toRadioScratch.xmodemPacket);

#endif

break;

#if !MESHTASTIC_EXCLUDE_MQTT

case meshtastic_ToRadio_mqttClientProxyMessage_tag:

LOG_DEBUG("Got MqttClientProxy message");

if (state != STATE_SEND_PACKETS) {

LOG_WARN("Ignore MqttClientProxy message while completing config handshake");

break;

}

if (mqtt && moduleConfig.mqtt.proxy_to_client_enabled && moduleConfig.mqtt.enabled &&

(channels.anyMqttEnabled() || moduleConfig.mqtt.map_reporting_enabled)) {

mqtt->onClientProxyReceive(toRadioScratch.mqttClientProxyMessage);

} else {

LOG_WARN("MqttClientProxy received but proxy is not enabled, no channels have up/downlink, or map reporting "

"not enabled");

}

break;

#endif

case meshtastic_ToRadio_heartbeat_tag:

// nonce==1 is a special "nodeinfo ping" trigger: force a fresh

// NodeInfo broadcast on the 60-second shorterTimeout path so

// peers can re-learn our public key after a reboot or

// factory_reset without waiting out the normal 10-minute

// NodeInfo send cooldown. Mirrors the TCP/UDP path in

// `src/mesh/api/PacketAPI.cpp:74-79` for serial clients.

// Default nonce (0) remains a plain keepalive that triggers

// a queue-status reply.

if (toRadioScratch.heartbeat.nonce == 1) {

if (nodeInfoModule) {

LOG_INFO("Broadcasting nodeinfo ping (serial)");

nodeInfoModule->sendOurNodeInfo(NODENUM_BROADCAST, true, 0, true);

}

} else {

LOG_DEBUG("Got client heartbeat");

heartbeatReceived = true;

}

break;

default:

// Ignore nop messages

break;

}

} else {

LOG_ERROR("Error: ignore malformed toradio");

}

return false;

{

// Respond to heartbeat by sending queue status

if (heartbeatReceived) {

memset(&fromRadioScratch, 0, sizeof(fromRadioScratch));

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_queueStatus_tag;

fromRadioScratch.queueStatus = router->getQueueStatus();

heartbeatReceived = false;

size_t numbytes = pb_encode_to_bytes(buf, meshtastic_FromRadio_size, &meshtastic_FromRadio_msg, &fromRadioScratch);

LOG_DEBUG("FromRadio=STATE_SEND_QUEUE_STATUS, numbytes=%u", numbytes);

return numbytes;

}

if (!available()) {

return 0;

}

// In case we send a FromRadio packet

memset(&fromRadioScratch, 0, sizeof(fromRadioScratch));

// Advance states as needed

switch (state) {

case STATE_SEND_NOTHING:

LOG_DEBUG("FromRadio=STATE_SEND_NOTHING");

break;

case STATE_SEND_MY_INFO:

LOG_DEBUG("FromRadio=STATE_SEND_MY_INFO");

// If the user has specified they don't want our node to share its location, make sure to tell the phone

// app not to send locations on our behalf.

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_my_info_tag;

strncpy(myNodeInfo.pio_env, optstr(APP_ENV), sizeof(myNodeInfo.pio_env));

myNodeInfo.nodedb_count = static_cast<uint16_t>(nodeDB->getNumMeshNodes());

fromRadioScratch.my_info = myNodeInfo;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// device_id is a stable hardware identifier — useful for an attacker

// to fingerprint / correlate the device across observations. Strip it

// for unauthenticated clients. my_node_num is kept (it's broadcast

// on the mesh anyway). pio_env / min_app_version reveal the exact

// build flavour, useful only for picking which known-CVE to try.

// nodedb_count stays — clients need it to decide whether to pull

// the node DB after unlocking.

fromRadioScratch.my_info.device_id.size = 0;

memset(fromRadioScratch.my_info.device_id.bytes, 0, sizeof(fromRadioScratch.my_info.device_id.bytes));

memset(fromRadioScratch.my_info.pio_env, 0, sizeof(fromRadioScratch.my_info.pio_env));

fromRadioScratch.my_info.min_app_version = 0;

}

#endif

state = STATE_SEND_UIDATA;

service->refreshLocalMeshNode(); // Update my NodeInfo because the client will be asking for it soon.

break;

case STATE_SEND_UIDATA:

LOG_INFO("getFromRadio=STATE_SEND_UIDATA");

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_deviceuiConfig_tag;

fromRadioScratch.deviceuiConfig = uiconfig;

state = STATE_SEND_OWN_NODEINFO;

break;

case STATE_SEND_OWN_NODEINFO: {

LOG_DEBUG("Send My NodeInfo");

auto us = nodeDB->readNextMeshNode(readIndex);

if (us) {

auto info = TypeConversions::ConvertToNodeInfo(us);

info.has_hops_away = false;

info.is_favorite = true;

{

concurrency::LockGuard guard(&nodeInfoMutex);

nodeInfoForPhone = info;

}

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_node_info_tag;

fromRadioScratch.node_info = info;

// Should allow us to resume sending NodeInfo in STATE_SEND_OTHER_NODEINFOS

{

concurrency::LockGuard guard(&nodeInfoMutex);

nodeInfoForPhone.num = 0;

}

}

if (config_nonce == SPECIAL_NONCE_ONLY_NODES) {

// If client only wants node info, jump directly to sending nodes

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

state = STATE_SEND_COMPLETE_ID; // Unauthorized: skip node DB

} else

#endif

{

state = STATE_SEND_OTHER_NODEINFOS;

onNowHasData(0);

}

} else {

state = STATE_SEND_METADATA;

}

break;

}

case STATE_SEND_METADATA:

LOG_DEBUG("Send device metadata");

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_metadata_tag;

fromRadioScratch.metadata = getDeviceMetadata();

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// DeviceMetadata is one large fingerprint vector for an unauth

// client: firmware_version, device_state_version, hw_model,

// hw_model_string, has_bluetooth/has_wifi/has_ethernet, role,

// position_flags, excluded_modules, optionsCount. None of it

// is needed to drive lockdown_auth, and most of it tells an

// attacker which CVE / behavior quirks to probe. Wipe the

// whole struct — clients re-fetch once authenticated.

memset(&fromRadioScratch.metadata, 0, sizeof(fromRadioScratch.metadata));

}

#endif

state = STATE_SEND_REGION_PRESETS;

break;

case STATE_SEND_REGION_PRESETS:

// Tell the client which modem presets are legal in each region so its UI

// can block illegal region+preset combinations. This is public RF /

// regulatory information (region and modem_preset are already in the

// unauthenticated LoRa whitelist below), so it is sent unconditionally —

// even an unauthorized/locked-down client can render a correct picker.

LOG_DEBUG("Send region preset map");

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_region_presets_tag;

getRegionPresetMap(fromRadioScratch.region_presets);

state = STATE_SEND_CHANNELS;

config_state = 0; // STATE_SEND_CHANNELS indexes channels starting at 0

break;

case STATE_SEND_CHANNELS:

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_channel_tag;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Unauthenticated: emit a zero-initialized Channel. fromRadioScratch

// was memset(0) at the top of getFromRadio(), so leaving .channel

// untouched gives the client an empty entry — no name, no PSK, no

// role. Advances the state machine normally so config_complete_id

// still fires.

} else

#endif

{

fromRadioScratch.channel = channels.getByIndex(config_state);

}

config_state++;

// Advance when we have sent all of our Channels

if (config_state >= MAX_NUM_CHANNELS) {

LOG_DEBUG("Send channels %d", config_state);

state = STATE_SEND_CONFIG;

config_state = _meshtastic_AdminMessage_ConfigType_MIN + 1;

}

break;

case STATE_SEND_CONFIG:

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_config_tag;

switch (config_state) {

case meshtastic_Config_device_tag:

LOG_DEBUG("Send config: device");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_device_tag;

fromRadioScratch.config.payload_variant.device = config.device;

break;

case meshtastic_Config_position_tag:

LOG_DEBUG("Send config: position");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_position_tag;

fromRadioScratch.config.payload_variant.position = config.position;

break;

case meshtastic_Config_power_tag:

LOG_DEBUG("Send config: power");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_power_tag;

fromRadioScratch.config.payload_variant.power = config.power;

fromRadioScratch.config.payload_variant.power.ls_secs = default_ls_secs;

break;

case meshtastic_Config_network_tag:

LOG_DEBUG("Send config: network");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_network_tag;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Unauthenticated: emit an empty NetworkConfig (zero-init from the

// top-of-loop memset). No wifi_psk, no SSID, no static IP info.

} else

#endif

{

fromRadioScratch.config.payload_variant.network = config.network;

}

break;

case meshtastic_Config_display_tag:

LOG_DEBUG("Send config: display");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_display_tag;

fromRadioScratch.config.payload_variant.display = config.display;

break;

case meshtastic_Config_lora_tag:

LOG_DEBUG("Send config: lora");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_lora_tag;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Whitelist only the spec-mandated radio identity fields that

// are intrinsically observable on the air anyway: region,

// modem_preset, use_preset, channel_num, hop_limit. Operator-

// private knobs (ignore_incoming list, override_duty_cycle,

// override_frequency, sx126x_rx_boosted_gain, tx_power,

// ignore_mqtt, fem_lna_mode, config_ok_to_mqtt, ...) stay

// hidden — they tell an attacker how the operator has tuned

// the device but are not needed by an unauth client.

meshtastic_Config_LoRaConfig whitelist = {};

whitelist.use_preset = config.lora.use_preset;

whitelist.modem_preset = config.lora.modem_preset;

whitelist.region = config.lora.region;

whitelist.channel_num = config.lora.channel_num;

whitelist.hop_limit = config.lora.hop_limit;

fromRadioScratch.config.payload_variant.lora = whitelist;

} else

#endif

{

fromRadioScratch.config.payload_variant.lora = config.lora;

}

break;

case meshtastic_Config_bluetooth_tag:

LOG_DEBUG("Send config: bluetooth");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_bluetooth_tag;

fromRadioScratch.config.payload_variant.bluetooth = config.bluetooth;

break;

case meshtastic_Config_security_tag:

LOG_DEBUG("Send config: security");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_security_tag;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Unauthenticated: emit an empty SecurityConfig (zero-init from

// the top-of-loop memset). No private_key, no admin_keys, no

// public_key — nothing for an attacker to inspect.

//

// Provisioning state (NEEDS_PROVISION vs LOCKED) is conveyed via

// the FromRadio.lockdown_status proto sent post-config; clients

// should consume that rather than inferring from this empty

// security config.

} else

#endif

{

fromRadioScratch.config.payload_variant.security = config.security;

}

break;

case meshtastic_Config_sessionkey_tag:

LOG_DEBUG("Send config: sessionkey");

fromRadioScratch.config.which_payload_variant = meshtastic_Config_sessionkey_tag;

break;

case meshtastic_Config_device_ui_tag: // NOOP!

fromRadioScratch.config.which_payload_variant = meshtastic_Config_device_ui_tag;

break;

default:

LOG_ERROR("Unknown config type %d", config_state);

}

// NOTE: The phone app needs to know the ls_secs value so it can properly expect sleep behavior.

// So even if we internally use 0 to represent 'use default' we still need to send the value we are

// using to the app (so that even old phone apps work with new device loads).

config_state++;

// Advance when we have sent all of our config objects

if (config_state > (_meshtastic_AdminMessage_ConfigType_MAX + 1)) {

state = STATE_SEND_MODULECONFIG;

config_state = _meshtastic_AdminMessage_ModuleConfigType_MIN + 1;

}

break;

case STATE_SEND_MODULECONFIG:

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_moduleConfig_tag;

switch (config_state) {

case meshtastic_ModuleConfig_mqtt_tag:

LOG_DEBUG("Send module config: mqtt");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_mqtt_tag;

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Unauthenticated: emit an empty MQTTConfig (zero-init from

// the top-of-loop memset). MQTT broker username/password, the

// server address, and root_topic are credentials/config that

// shouldn't be visible to an unauth client.

} else

#endif

{

fromRadioScratch.moduleConfig.payload_variant.mqtt = moduleConfig.mqtt;

}

break;

case meshtastic_ModuleConfig_serial_tag:

LOG_DEBUG("Send module config: serial");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_serial_tag;

fromRadioScratch.moduleConfig.payload_variant.serial = moduleConfig.serial;

break;

case meshtastic_ModuleConfig_external_notification_tag:

LOG_DEBUG("Send module config: ext notification");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_external_notification_tag;

fromRadioScratch.moduleConfig.payload_variant.external_notification = moduleConfig.external_notification;

break;

case meshtastic_ModuleConfig_store_forward_tag:

LOG_DEBUG("Send module config: store forward");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_store_forward_tag;

fromRadioScratch.moduleConfig.payload_variant.store_forward = moduleConfig.store_forward;

break;

case meshtastic_ModuleConfig_range_test_tag:

LOG_DEBUG("Send module config: range test");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_range_test_tag;

fromRadioScratch.moduleConfig.payload_variant.range_test = moduleConfig.range_test;

break;

case meshtastic_ModuleConfig_telemetry_tag:

LOG_DEBUG("Send module config: telemetry");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_telemetry_tag;

fromRadioScratch.moduleConfig.payload_variant.telemetry = moduleConfig.telemetry;

break;

case meshtastic_ModuleConfig_canned_message_tag:

LOG_DEBUG("Send module config: canned message");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_canned_message_tag;

fromRadioScratch.moduleConfig.payload_variant.canned_message = moduleConfig.canned_message;

break;

case meshtastic_ModuleConfig_audio_tag:

LOG_DEBUG("Send module config: audio");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_audio_tag;

fromRadioScratch.moduleConfig.payload_variant.audio = moduleConfig.audio;

break;

case meshtastic_ModuleConfig_remote_hardware_tag:

LOG_DEBUG("Send module config: remote hardware");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_remote_hardware_tag;

fromRadioScratch.moduleConfig.payload_variant.remote_hardware = moduleConfig.remote_hardware;

break;

case meshtastic_ModuleConfig_neighbor_info_tag:

LOG_DEBUG("Send module config: neighbor info");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_neighbor_info_tag;

fromRadioScratch.moduleConfig.payload_variant.neighbor_info = moduleConfig.neighbor_info;

break;

case meshtastic_ModuleConfig_detection_sensor_tag:

LOG_DEBUG("Send module config: detection sensor");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_detection_sensor_tag;

fromRadioScratch.moduleConfig.payload_variant.detection_sensor = moduleConfig.detection_sensor;

break;

case meshtastic_ModuleConfig_ambient_lighting_tag:

LOG_DEBUG("Send module config: ambient lighting");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_ambient_lighting_tag;

fromRadioScratch.moduleConfig.payload_variant.ambient_lighting = moduleConfig.ambient_lighting;

break;

case meshtastic_ModuleConfig_paxcounter_tag:

LOG_DEBUG("Send module config: paxcounter");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_paxcounter_tag;

fromRadioScratch.moduleConfig.payload_variant.paxcounter = moduleConfig.paxcounter;

break;

case meshtastic_ModuleConfig_traffic_management_tag:

LOG_DEBUG("Send module config: traffic management");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_traffic_management_tag;

fromRadioScratch.moduleConfig.payload_variant.traffic_management = moduleConfig.traffic_management;

break;

case meshtastic_ModuleConfig_tak_tag:

LOG_DEBUG("Send module config: tak");

fromRadioScratch.moduleConfig.which_payload_variant = meshtastic_ModuleConfig_tak_tag;

fromRadioScratch.moduleConfig.payload_variant.tak = moduleConfig.tak;

break;

default:

LOG_DEBUG("Unhandled module config type %d", config_state);

}

config_state++;

// Advance when we have sent all of our ModuleConfig objects

if (config_state > (_meshtastic_AdminMessage_ModuleConfigType_MAX + 1)) {

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

// Unauthorized client: skip node DB and file manifest — only send config complete

state = STATE_SEND_COMPLETE_ID;

} else

#endif

// Handle special nonce behaviors:

// - SPECIAL_NONCE_ONLY_CONFIG: Skip node info, go directly to file manifest

// - SPECIAL_NONCE_ONLY_NODES: After sending nodes, skip to complete

if (config_nonce == SPECIAL_NONCE_ONLY_CONFIG) {

state = STATE_SEND_FILEMANIFEST;

} else {

state = STATE_SEND_OTHER_NODEINFOS;

onNowHasData(0);

}

config_state = 0;

}

break;

case STATE_SEND_OTHER_NODEINFOS: {

if (readIndex == 2) { // readIndex==2 will be true for the first non-us node

LOG_INFO("Start sending nodeinfos millis=%u", millis());

}

meshtastic_NodeInfo infoToSend = {};

{

concurrency::LockGuard guard(&nodeInfoMutex);

if (nodeInfoForPhone.num == 0 && !nodeInfoQueue.empty()) {

// Serve the next cached node without re-reading from the DB iterator.

nodeInfoForPhone = nodeInfoQueue.front();

nodeInfoQueue.pop_front();

}

infoToSend = nodeInfoForPhone;

if (infoToSend.num != 0)

nodeInfoForPhone = {};

}

if (infoToSend.num != 0) {

// Just in case we stored a different user.id in the past, but should never happen going forward

sprintf(infoToSend.user.id, "!%08x", infoToSend.num);

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_node_info_tag;

fromRadioScratch.node_info = infoToSend;

prefetchNodeInfos();

} else {

LOG_DEBUG("Done sending %d of %d nodeinfos millis=%u", readIndex, nodeDB->getNumMeshNodes(), millis());

nodeInfoMutex.lock();

nodeInfoQueue.clear();

nodeInfoMutex.unlock();

// Satellite-DB replay (positions/telemetry/environment/status) now happens

// *after* config_complete_id, interleaved with live traffic in STATE_SEND_PACKETS.

state = STATE_SEND_FILEMANIFEST;

return getFromRadio(buf);

}

break;

}

case STATE_SEND_FILEMANIFEST: {

LOG_DEBUG("FromRadio=STATE_SEND_FILEMANIFEST");

// ONLY_NODES variants skip the manifest.

if (config_state == filesManifest.size() || config_nonce == SPECIAL_NONCE_ONLY_NODES) {

config_state = 0;

releaseFilesManifest(filesManifest);

// Skip to complete packet

sendConfigComplete();

} else {

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_fileInfo_tag;

fromRadioScratch.fileInfo = filesManifest.at(config_state);

LOG_DEBUG("File: %s (%d) bytes", fromRadioScratch.fileInfo.file_name, fromRadioScratch.fileInfo.size_bytes);

config_state++;

}

break;

}

case STATE_SEND_COMPLETE_ID:

sendConfigComplete();

break;

case STATE_SEND_PACKETS:

pauseBluetoothLogging = false;

// Do we have a message from the mesh or packet from the local device?

LOG_DEBUG("FromRadio=STATE_SEND_PACKETS");

if (queueStatusPacketForPhone) {

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_queueStatus_tag;

fromRadioScratch.queueStatus = *queueStatusPacketForPhone;

releaseQueueStatusPhonePacket();

} else if (mqttClientProxyMessageForPhone) {

#ifdef MESHTASTIC_PHONEAPI_ACCESS_CONTROL

if (!getAdminAuthorized()) {

releaseMqttClientProxyPhonePacket(); // Discard — unauthorized client

} else

#endif

{

fromRadioScratch.which_payload_variant = meshtastic_FromRadio_mqttClientProxyMessage_tag;