From 38aa9ec3801f5895e09866fe92cb8e44fb987cee Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 16 May 2026 11:56:43 +0530 Subject: Unique SSID/IP per board + captive detection fix + mint list in portal MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Derive unique SSID (TollGate-{MAC4}{MAC5}) and AP IP (10.{b5}.{subnet}.1) from factory MAC — boards no longer conflict - Board A: TollGate-377C @ 10.55.85.1, Board B: TollGate-5050 @ 10.80.10.1 - Captive portal detection URIs return 200 with portal HTML (matching esp32-mesh working approach) instead of 302 redirect - Dynamic AP IP in portal HTML via __AP_IP__ template substitution - Supported mints section in portal page (shows mint URL, tap to copy) - Fixed mint URL to testnut.cashu.space (was stale in SPIFFS) - DoT reject server on port 853 for DNS-over-TLS fallback - DNS hijack: NXDOMAIN for all non-A queries, no forwarding for unauthed - Playwright tests updated for 200 response on detection URIs - Phase 2 test suite: 20/21 pass (test 22 expiry ping route issue) - Tests 25-27 deferred to Phase 3 (Board B as second client) --- PLAN.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'PLAN.md') diff --git a/PLAN.md b/PLAN.md index 2406158..d43344b 100644 --- a/PLAN.md +++ b/PLAN.md @@ -74,10 +74,10 @@ Build a TollGate firmware for two ESP32 devices, following the [TollGate protoco | 21 | Wrong mint | Token from unaccepted mint | kind=21023 mint error | PASS | | 22 | Session expiry | Wait for allotment | Internet blocked | PASS | | 23 | Session renewal | Second payment | Allotment extended | PASS | -| 24 | Portal payment form | Playwright paste token | Checkmark shown | TODO | -| 25 | Two clients pay independently | Two POSTs | Both authenticated | TODO | -| 26 | Client isolation | Only payer gets internet | Non-payer blocked | TODO | -| 27 | Full e2e: portal→pay→browse | Playwright | Complete flow | TODO | +| 24 | Portal payment form | Playwright paste token | Checkmark shown | PASS | +| 25 | Two clients pay independently | Two POSTs | Both authenticated | Phase 3 | +| 26 | Client isolation | Only payer gets internet | Non-payer blocked | Phase 3 | +| 27 | Full e2e: portal→pay→browse | Playwright | Complete flow | Phase 3 | **Captive Portal Fix:** Added DoT reject server on port 853 (TCP RST forces DNS-over-TLS fallback to plain DNS), DNS hijack returns NXDOMAIN for all non-A query types, explicit 302 redirect handlers for all captive detection URIs. Needs verification with actual GrapheneOS phone. -- cgit v1.2.3