A mode that does not work stops being on the menu

The control-mode picker offered all five paths to everyone, always. When one of them is broken in a deployment — OCPP is, right now — there was nothing to do about it: the superadmin could pick a different mode for the global layer, but the option stayed in every organization's and every user's dropdown, waiting to be chosen. The cascade could impose a mode. It could not withdraw one. So each layer now carries a second, separate thing: a list of the modes it hides from the layers below it. controlModesDisabled sits beside controlMode, on the global layer as a plugin config field and on an organization as part of the same pluginSettings blob its credentials already live in. A superadmin ticking Own CSMS and Proxy CSMS takes both OCPP paths out of every picker underneath; an org admin ticking Modbus takes it out of their own users'. Three decisions are worth naming. A hide-list governs the layers below, not the layer holding it. The superadmin can keep running Proxy globally while hiding it from everyone else, which is what you want while a mode is being repaired rather than retired: the operator testing the fix is the one person who still needs to select it. The alternative, a list that also invalidates its own layer's choice, would have made the panel contradict itself — a mode chosen in one field and switched off in the one below it. But a hidden mode really is hidden, not merely absent from a dropdown. A user who had picked Proxy last month stops resolving to Proxy the moment the superadmin hides it, and falls back to monitoring only. Filtering the picker alone would have left every existing charger on the broken path and quietly disagreed with the list the operator had just filled in. Resolution now walks the layers accumulating what each hides from the next, so a stored value only takes effect if the layers above it still permit it. And off is never hideable. It is what a charger falls back to and what an empty cascade resolves to, so a layer that could take it away could leave the layer below with a picker holding no valid choice at all. It is not among the checkboxes in any of the three clients, and the parser drops it if it arrives anyway. The panel needed a field shape it did not have — several options, any number chosen — so ConfigField grows a "multiselect" type, stored as the comma-separated string that fits the flat map every other field already uses. That is generic: any plugin can declare one now, and the PUT body is unchanged. The phone's field specs grew the same way, a scopeOptions hook that narrows a declared option list to what the server still offers, rather than teaching the integration card about control modes specifically. Both clients clamp a stored mode that has since been hidden back to off before drawing the picker, so the box shows what will actually happen rather than a choice that would be dropped on save. Verified: Go tests pass, both frontends build, flutter analyze is clean, and the panel's new checkbox field was rendered against the real stylesheet. The end-to-end path — superadmin hides a mode, an org admin and then a user reload and find it gone — has not been walked on a live stack; the panel is embedded in the Go binary, so the remote deployment needs a rebuild before any of this is visible there. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-09-05 12:54:30 +02:00
parent d4b9d0870e
commit 3c34b708b9
21 changed files with 582 additions and 49 deletions
@@ -6,8 +6,8 @@
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <meta name="theme-color" content="#2563eb" />
    <title>DriverVault · API Server</title>
-    <script type="module" crossorigin src="/assets/index-BBZfstAT.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-_8IdQ1wh.css">
+    <script type="module" crossorigin src="/assets/index-CUgU2Fxs.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-Cd85xDqG.css">
  </head>
  <body>
    <div id="app"></div>
@@ -62,6 +62,52 @@ func normalizeControlMode(v string) string {
 	}
 }

+// ankerControlModesAll lists every control mode, in the order the clients offer
+// them. off leads because it is the default and the fallback.
+var ankerControlModesAll = []string{ankerControlOff, ankerControlMqtt, ankerControlModbus, ankerControlOwn, ankerControlProxy}
+
+// parseControlModes reads a stored comma-separated mode list into a set,
+// dropping anything unrecognized. off is never in it: monitoring-only is what a
+// charger falls back to, so no layer may take it away from the layers below.
+func parseControlModes(v string) map[string]bool {
+	out := map[string]bool{}
+	for _, part := range strings.Split(v, ",") {
+		if m := normalizeControlMode(part); m != "" && m != ankerControlOff {
+			out[m] = true
+		}
+	}
+	return out
+}
+
+// joinControlModes renders a mode set back to its stored form, in the canonical
+// order, so what a client sends round-trips to a predictable string.
+func joinControlModes(set map[string]bool) string {
+	return strings.Join(controlModeList(set), ",")
+}
+
+// controlModeList sorts a mode set into the canonical order.
+func controlModeList(set map[string]bool) []string {
+	out := []string{}
+	for _, m := range ankerControlModesAll {
+		if set[m] {
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
+// controlModesOffered lists the modes a layer may still choose once the layers
+// above it have hidden theirs.
+func controlModesOffered(hidden map[string]bool) []string {
+	out := []string{}
+	for _, m := range ankerControlModesAll {
+		if !hidden[m] {
+			out = append(out, m)
+		}
+	}
+	return out
+}
+
 // ankerConfig is one layer's Anker Solix settings.
 type ankerConfig struct {
 	Email    string `json:"email"`
@@ -70,6 +116,12 @@ type ankerConfig struct {
 	// ControlMode is the control path: off | mqtt | modbus | own | proxy.
 	// It resolves independently of the credentials, like Country.
 	ControlMode string `json:"controlMode"`
+	// ControlModesDisabled is a comma-separated list of modes this layer hides
+	// from the layers below it — a mode a deployment (or an organization) does
+	// not want offered at all. It does not constrain this layer's own choice, and
+	// it never hides off. Meaningful on the global and organization layers only:
+	// a user has nobody below them.
+	ControlModesDisabled string `json:"controlModesDisabled,omitempty"`
 }

 // ankerChargerBinding is what we know about one charger the caller controls:
@@ -128,6 +180,14 @@ type ankerResolution struct {
 	available  bool              // global master switch (plugin enabled in the panel)
 	orgEnabled bool              // org gate (default true; gates the org's users)
 	enabled    bool              // caller's personal enable flag
+
+	// hiddenForOrg is what the global layer hides from everyone below it;
+	// hiddenForUser adds what the caller's organization hides from its own users.
+	// They gate both the pickers the clients draw and which layer's stored mode
+	// is allowed to take effect.
+	hiddenForOrg  map[string]bool
+	hiddenForUser map[string]bool
+	orgHidden     map[string]bool // the organization layer's own list, for its editor
 }

 // ankerLayerRank orders the cascade layers; a higher number is lower priority.
@@ -137,7 +197,8 @@ var ankerLayerRank = map[string]int{"global": 1, "org": 2, "user": 3}
 // pluginSettings blob (read from their user record).
 func (s *Server) resolveAnker(ctx context.Context, who *callerIdentity, userRaw json.RawMessage) ankerResolution {
 	g, masterEnabled, _ := s.plugins.RawConfig(ankerPlugin)
-	gc := ankerConfig{Email: g["email"], Password: g["password"], Country: g["country"], ControlMode: g["controlMode"]}
+	gc := ankerConfig{Email: g["email"], Password: g["password"], Country: g["country"],
+		ControlMode: g["controlMode"], ControlModesDisabled: g["controlModesDisabled"]}

 	var oStored ankerStored
 	if who.OrgID != "" {
@@ -166,6 +227,21 @@ func (s *Server) resolveAnker(ctx context.Context, who *callerIdentity, userRaw
 		enabled:    uStored.Enabled,
 	}

+	// What each layer below may still be offered. The global list reaches
+	// everyone; an organization's own list reaches only its users, so it narrows
+	// the set once more on the way down.
+	res.hiddenForOrg = parseControlModes(gc.ControlModesDisabled)
+	res.orgHidden = parseControlModes(oc.ControlModesDisabled)
+	res.hiddenForUser = map[string]bool{}
+	for m := range res.hiddenForOrg {
+		res.hiddenForUser[m] = true
+	}
+	if who.OrgID != "" {
+		for m := range res.orgHidden {
+			res.hiddenForUser[m] = true
+		}
+	}
+
 	// Ordered layers, top (highest priority) first.
 	type layer struct {
 		name string
@@ -189,13 +265,18 @@ func (s *Server) resolveAnker(ctx context.Context, who *callerIdentity, userRaw
 	// Control mode resolves independently too, defaulting to off (monitoring
 	// only). The highest layer that sets a recognized value wins; an explicit
 	// "off" set above still wins (and locks lower layers to monitoring).
+	// A mode hidden by a layer above is not merely absent from the picker: a value
+	// stored below before it was hidden stops taking effect too, so switching a
+	// mode off really does switch it off everywhere underneath.
 	res.eff.ControlMode = ankerControlOff
 	res.source["controlMode"] = "unset"
 	for _, l := range layers {
-		if v := normalizeControlMode(l.c.ControlMode); v != "" {
-			res.eff.ControlMode, res.source["controlMode"] = v, l.name
-			break
+		v := normalizeControlMode(l.c.ControlMode)
+		if v == "" || res.hiddenAt(l.name)[v] {
+			continue
 		}
+		res.eff.ControlMode, res.source["controlMode"] = v, l.name
+		break
 	}

 	// Credentials resolve as a pair from the highest layer with an email, so the
@@ -212,6 +293,19 @@ func (s *Server) resolveAnker(ctx context.Context, who *callerIdentity, userRaw
 	return res
 }

+// hiddenAt is the set of modes hidden from one cascade layer by the layers above
+// it. The global layer answers to nobody, so nothing is hidden from it.
+func (r ankerResolution) hiddenAt(layer string) map[string]bool {
+	switch layer {
+	case "org":
+		return r.hiddenForOrg
+	case "user":
+		return r.hiddenForUser
+	default:
+		return map[string]bool{}
+	}
+}
+
 // ankerLockedFor reports whether a field whose value comes from source is locked
 // for a caller whose editable layer is editable (i.e. the value is set above them).
 func ankerLockedFor(source, editable string) bool {
@@ -301,7 +395,13 @@ func (s *Server) ankerScopeView(res ankerResolution, editable string) map[string
 		}
 		return fv
 	}
-	return map[string]any{
+	// The modes this scope may pick from: everything the layers above it left
+	// standing. A superadmin's read-only view answers as the user layer they are.
+	hidden := res.hiddenForUser
+	if editable == "org" {
+		hidden = res.hiddenForOrg
+	}
+	out := map[string]any{
 		"editableLayer": editable,
 		"fields": map[string]ankerFieldView{
 			"email":       field("email", res.eff.Email, own.Email, false),
@@ -309,7 +409,15 @@ func (s *Server) ankerScopeView(res ankerResolution, editable string) map[string
 			"country":     field("country", res.eff.Country, own.Country, false),
 			"controlMode": field("controlMode", res.eff.ControlMode, own.ControlMode, false),
 		},
+		"controlModes": controlModesOffered(hidden),
 	}
+	if editable == "org" {
+		// The organization's own hide-list, which its admin edits here. Modes the
+		// global layer already hid are not in controlModes above, so they simply
+		// never come up.
+		out["controlModesDisabled"] = controlModeList(res.orgHidden)
+	}
+	return out
 }

 // ankerView builds the masked, client-safe response body from a resolution.
@@ -319,6 +427,7 @@ func (s *Server) ankerView(who *callerIdentity, res ankerResolution) map[string]
 		"orgEnabled":   res.orgEnabled,
 		"enabled":      res.enabled,
 		"controlMode":  res.eff.ControlMode, // effective control mode (off|mqtt|modbus|own|proxy)
+		"controlModes": controlModesOffered(res.hiddenForUser), // modes still offered to this caller
 		"role":         who.Role,
 		"orgId":        who.OrgID,
 		"canEditOrg":   res.canOrg,
@@ -430,7 +539,21 @@ func (s *Server) handlePutAnker(w http.ResponseWriter, r *http.Request) {
 	applyField("email", func(c *ankerConfig, v string) { c.Email = v })
 	applyField("password", func(c *ankerConfig, v string) { c.Password = v })
 	applyField("country", func(c *ankerConfig, v string) { c.Country = strings.ToUpper(v) })
-	applyField("controlMode", func(c *ankerConfig, v string) { c.ControlMode = normalizeControlMode(v) })
+	applyField("controlMode", func(c *ankerConfig, v string) {
+		m := normalizeControlMode(v)
+		// A mode hidden above is not a choice this layer can make; keep whatever it
+		// had rather than storing something that would never take effect.
+		if m != "" && res.hiddenAt(editable)[m] {
+			return
+		}
+		c.ControlMode = m
+	})
+	if editable == "org" {
+		// Only a layer with users under it has anything to hide from them.
+		applyField("controlModesDisabled", func(c *ankerConfig, v string) {
+			c.ControlModesDisabled = joinControlModes(parseControlModes(v))
+		})
+	}

 	// Persist the organization layer (admins) via the service account.
 	if editable == "org" {
@@ -241,3 +241,83 @@ func TestAnkerCardRoutesAreRegistered(t *testing.T) {
 		}
 	}
 }
+
+func TestParseControlModes(t *testing.T) {
+	got := parseControlModes(" Proxy , own ,bogus,, off ")
+	// off is never hideable: monitoring only is what a charger falls back to.
+	want := map[string]bool{"proxy": true, "own": true}
+	if len(got) != len(want) {
+		t.Fatalf("parseControlModes = %v, want %v", got, want)
+	}
+	for m := range want {
+		if !got[m] {
+			t.Errorf("parseControlModes is missing %q", m)
+		}
+	}
+	if s := joinControlModes(got); s != "own,proxy" {
+		t.Errorf("joinControlModes = %q, want own,proxy (canonical order)", s)
+	}
+}
+
+func TestControlModesOffered(t *testing.T) {
+	got := controlModesOffered(map[string]bool{"own": true, "proxy": true})
+	want := []string{"off", "mqtt", "modbus"}
+	if len(got) != len(want) {
+		t.Fatalf("controlModesOffered = %v, want %v", got, want)
+	}
+	for i, m := range want {
+		if got[i] != m {
+			t.Errorf("controlModesOffered[%d] = %q, want %q", i, got[i], m)
+		}
+	}
+}
+
+// A mode the global layer hides is not merely absent from a lower picker: a
+// value stored below before it was hidden stops taking effect too.
+func TestHiddenControlModeDoesNotTakeEffect(t *testing.T) {
+	res := ankerResolution{
+		hiddenForOrg:  map[string]bool{"own": true, "proxy": true},
+		hiddenForUser: map[string]bool{"own": true, "proxy": true},
+	}
+	if !res.hiddenAt("user")["proxy"] {
+		t.Error("proxy should be hidden from the user layer")
+	}
+	if res.hiddenAt("global")["proxy"] {
+		t.Error("nothing is hidden from the global layer — it is the one hiding")
+	}
+	view := (&Server{}).ankerScopeView(res, "user")
+	for _, m := range view["controlModes"].([]string) {
+		if m == "own" || m == "proxy" {
+			t.Errorf("hidden mode %q is still offered to the user scope", m)
+		}
+	}
+	if _, ok := view["controlModesDisabled"]; ok {
+		t.Error("the user scope has nobody below it and must carry no hide-list")
+	}
+}
+
+// An organization narrows the set once more for its own users, and its admin
+// edits that list in the org scope.
+func TestOrgScopeCarriesItsOwnHideList(t *testing.T) {
+	res := ankerResolution{
+		hiddenForOrg:  map[string]bool{"proxy": true},
+		hiddenForUser: map[string]bool{"proxy": true, "own": true},
+		orgHidden:     map[string]bool{"own": true},
+	}
+	org := (&Server{}).ankerScopeView(res, "org")
+	offered := org["controlModes"].([]string)
+	var sawOwn, sawProxy bool
+	for _, m := range offered {
+		sawOwn = sawOwn || m == "own"
+		sawProxy = sawProxy || m == "proxy"
+	}
+	if !sawOwn {
+		t.Error("an org may still choose a mode it only hides from its users")
+	}
+	if sawProxy {
+		t.Error("a mode the global layer hid must not reach the org picker")
+	}
+	if got := org["controlModesDisabled"].([]string); len(got) != 1 || got[0] != "own" {
+		t.Errorf("org hide-list = %v, want [own]", got)
+	}
+}
@@ -334,6 +334,19 @@ func (p *Plugin) Descriptor() plugins.Descriptor {
 					{Value: "own", Label: "Own CSMS (full control)"},
 					{Value: "proxy", Label: "Proxy CSMS (relay + control)"},
 				}},
+			// controlModesDisabled hides modes from the layers *below* this one. It
+			// is how a superadmin takes a mode that is broken or unwanted in this
+			// deployment (OCPP, say) out of every organization's and user's picker
+			// without touching the mode this layer itself runs. Organizations carry
+			// the same field for their own users; see integrations_ankersolix.go.
+			{Key: "controlModesDisabled", Label: "Hidden control modes", Type: "multiselect",
+				Help: "Control modes to hide from organizations and users. A hidden mode disappears from their picker and stops taking effect for them; the mode chosen above, which is this layer's own, is unaffected. Off (monitoring only) can never be hidden — it is what a charger falls back to.",
+				Options: []plugins.SelectOption{
+					{Value: "mqtt", Label: "Anker cloud (works anywhere)"},
+					{Value: "modbus", Label: "Modbus TCP (local network)"},
+					{Value: "own", Label: "Own CSMS (full control)"},
+					{Value: "proxy", Label: "Proxy CSMS (relay + control)"},
+				}},
 		},
 	}
 }
@@ -66,6 +66,31 @@ func TestDescriptor(t *testing.T) {
 			t.Errorf("controlMode is missing option %q", v)
 		}
 	}
+
+	// controlModesDisabled is the superadmin's hide-list: which of the modes the
+	// organizations and users below are offered at all. off is not among them —
+	// monitoring only is the fallback, so no layer may take it away.
+	hide, ok := fields["controlModesDisabled"]
+	if !ok {
+		t.Fatal("controlModesDisabled config field should be present")
+	}
+	if hide.Type != "multiselect" {
+		t.Errorf("controlModesDisabled type = %q, want multiselect", hide.Type)
+	}
+	hideable := map[string]bool{"mqtt": false, "modbus": false, "own": false, "proxy": false}
+	for _, o := range hide.Options {
+		if o.Value == "off" {
+			t.Error("off must not be hideable — it is what a charger falls back to")
+		}
+		if _, known := hideable[o.Value]; known {
+			hideable[o.Value] = true
+		}
+	}
+	for v, seen := range hideable {
+		if !seen {
+			t.Errorf("controlModesDisabled is missing option %q", v)
+		}
+	}
 }

 func TestRegistered(t *testing.T) {
@@ -44,7 +44,8 @@ const (
 	StatusDown     = "down"
 )

-// SelectOption is one choice for a ConfigField of Type "select".
+// SelectOption is one choice for a ConfigField of Type "select" (pick one) or
+// "multiselect" (pick any number; stored as a comma-separated list of values).
 type SelectOption struct {
 	Value string `json:"value"`
 	Label string `json:"label"`
@@ -55,12 +56,12 @@ type SelectOption struct {
 type ConfigField struct {
 	Key      string         `json:"key"`
 	Label    string         `json:"label"`
-	Type     string         `json:"type"` // "text" | "password" | "number" | "select"
+	Type     string         `json:"type"` // "text" | "password" | "number" | "select" | "multiselect"
 	Required bool           `json:"required"`
 	Secret   bool           `json:"secret"` // never echoed back to clients in clear
 	Help     string         `json:"help,omitempty"`
 	Default  string         `json:"default,omitempty"` // effective default when unset
-	Options  []SelectOption `json:"options,omitempty"` // for Type "select"
+	Options  []SelectOption `json:"options,omitempty"` // for Type "select" and "multiselect"
 }

 // Capability is one operation a plugin exposes. It maps a stable id to the
@@ -62,6 +62,31 @@ function expand(p) {
  open.value = p.name;
 }

+// A multiselect field is a comma-separated list of option values in the same
+// flat string map every other field uses, so the PUT body stays unchanged.
+function multiValues(name, key) {
+  return String(drafts[name]?.[key] ?? "")
+    .split(",")
+    .map((v) => v.trim())
+    .filter(Boolean);
+}
+function hasMulti(name, key, value) {
+  return multiValues(name, key).includes(value);
+}
+function toggleMulti(name, key, value, on) {
+  const set = new Set(multiValues(name, key));
+  if (on) set.add(value);
+  else set.delete(value);
+  // Keep the declared option order rather than click order, so the stored value
+  // is stable across edits.
+  const p = plugins.value.find((x) => x.name === name);
+  const order = (p?.configFields || []).find((f) => f.key === key)?.options || [];
+  drafts[name][key] = order
+    .map((o) => o.value)
+    .filter((v) => set.has(v))
+    .join(",");
+}
+
 async function save(p, enabled) {
  busy.value = true;
  rowNotice[p.name] = "";
@@ -224,7 +249,25 @@ const healthClass = (s) =>
            <label class="dh-label">
              {{ f.label || f.key }}<span v-if="f.required" class="text-danger"> *</span>
            </label>
-            <select v-if="f.type === 'select'" v-model="drafts[p.name][f.key]" class="dh-select">
+            <!-- multiselect: any number of the declared options, stored as a
+                 comma-separated list. Nothing checked means the field imposes
+                 nothing, which is the unset state for a select too. -->
+            <div v-if="f.type === 'multiselect'" class="flex flex-col gap-1.5 pt-1">
+              <label
+                v-for="o in f.options || []"
+                :key="o.value"
+                class="flex items-center gap-2 text-sm text-body"
+              >
+                <input
+                  type="checkbox"
+                  class="dh-checkbox"
+                  :checked="hasMulti(p.name, f.key, o.value)"
+                  @change="toggleMulti(p.name, f.key, o.value, $event.target.checked)"
+                />
+                <span>{{ o.label || o.value }}</span>
+              </label>
+            </div>
+            <select v-else-if="f.type === 'select'" v-model="drafts[p.name][f.key]" class="dh-select">
              <!-- A non-required select can be left unset (empty), so the global
                   layer abstains and lower layers (org / user) may choose. -->
              <option v-if="!f.required" value="">{{ t("plugins.notSet") }}</option>
@@ -293,6 +293,20 @@ body {
  border-color: var(--accent);
  box-shadow: 0 0 0 3px var(--focus-ring);
 }
+/* Checkbox for multiselect config fields. accent-color keeps the native control
+   (and its keyboard behaviour) while tinting it to the panel's accent. */
+.dh-checkbox {
+  width: 15px;
+  height: 15px;
+  flex: none;
+  accent-color: var(--accent);
+  cursor: pointer;
+}
+.dh-checkbox:focus-visible {
+  outline: none;
+  box-shadow: 0 0 0 3px var(--focus-ring);
+  border-radius: 3px;
+}
 .dh-label {
  display: block;
  margin-bottom: 5px;