[pwsh]

Description:

Lets the LoRa gateway receive LoRaWAN devices that use ABP on a single channel. Until now these were published as encrypted hex only. Many inexpensive sensors (Dragino LDS02, LHT65, LSN50, …) can be set to ABP on a fixed frequency and data rate, which makes them usable with a single LilyGo board and no LoRaWAN network server.

Builds on #2402: its first commit is that fix. It is opt-in, and builds without the flags are unchanged (ttgo-lora32-v21 is 1,388,338 bytes with or without this PR).

-DLORA_LORAWAN (ESP32 only, about 8 KB):

• Devices are declared at runtime through the existing MQTTtoLORA/config command, and kept in NVS with "save":true:
  {"lorawan":{"devaddr":"0187F184","nwkskey":"…","appskey":"…","name":"Front door","model":"LDS02"},"save":true}
  Devices can also be updated or removed ("remove":true). The LoRa state message lists them, without keys.
• Uplinks from declared devices have their MIC (message integrity code) checked with the NwkSKey. Frames with a repeated frame counter are dropped, and the FRMPayload is decrypted with the AppSKey. Each one is published to LORAtoMQTT/<DEVADDR> with fcnt, fport and the decrypted payload hex. Packets from other devices, or that fail the MIC check, keep the current hex behaviour.

-DLORA_LORAWAN_JS + ${libraries.duktape} (about 200 KB):

• Runs TTN-style decoders on the gateway, either Decoder(bytes, port) (v2) or decodeUplink(input) (v3), using Duktape 2.7.0 (MIT). Decoders are published raw to <base><gateway>/LORAWANdecoder/<DEVADDR> and stored in NVS (up to 3800 bytes). This topic is deliberately outside /commands/#: that subscription only accepts JSON up to JSON_MSG_BUFFER_MAX, and cmpToMainTopic() matches by prefix. A dedicated PicoMQTT subscription with its own size limit receives the script.
• The decoded fields are merged into the published message, or decoder_error is set if the decoder fails. A fresh Duktape heap is used for each uplink, so a faulty decoder cannot leak state between uplinks.
• NTP is started once MQTT is connected, so decoders that timestamp with new Date() get real time. Today the clock is only set for TLS connections.

Home Assistant: an optional per-device entities list (key, type, device class, unit, on/off payloads) creates discovery entities from the published fields.

WebUI: a new "Configure LoRaWAN" page (/lw) is added to the configuration menu:

• the list of declared devices, with decoder status and last FCnt
• an add/edit form for DevAddr, name, model, session keys, entities (JSON) and the decoder. Stored keys are never sent back to the browser, only a hint of their last bytes, and an empty key field keeps the current key.
• "Test decoder" runs the decoder being edited on a payload hex, pre-filled with the device's last decrypted payload, and shows the result without saving
• a delete button

Documentation: new section "Decoding LoRaWAN ABP devices" in docs/use/lora.md.

Tests on a LilyGo LoRa32 V2.1 (SX1276, 915 MHz), receiving a Dragino LDS02 door sensor on firmware v1.8.2 set to ABP, 903.9 MHz, DR0 (SF10/125 kHz):

• Decryption: the MIC is verified and the payload decrypted correctly (checked against an offline AES-CMAC/AES-CTR reference).
• The vendor's TTN v2 decoder runs unchanged. Example output:
  {"id":"0187F184","name":"LDS02 Door Sensor","model":"LDS02","fcnt":67,"fport":10,"payload":"8C6C0100003B00000000","BAT_V":3.18,"BAT_PCNT":"88.33","DOOR_OPEN_STATUS":1,"DOOR_STATE":"open","LAST_DOOR_OPEN_DURATION":0,"UTC_TIME":"2026-10-09T06:49:17.000Z","rssi":-34,"snr":10.5,"pferror":-2435,"packetSize":23}
• The device, its entities and its decoder persist across reboots, and Home Assistant entities are created.
• WebUI page: devices listed; edit form loads without exposing keys; "Test decoder" returns the expected fields for a real LDS02 payload; saving without changes keeps the keys and decoder.
• Builds without warnings in the new code with the env's -w removed and -Wall added: stock env, LORA_LORAWAN, and LORA_LORAWAN + LORA_LORAWAN_JS. (The default [env] passes -w, which hides all warnings.) The new code is clang-format 9 clean.

Limitations: single channel and uplink only. There is no OTAA join, no downlinks and no MAC commands. Frame counters are tracked in RAM, so after a reboot the first frame is accepted whatever its counter. Decoders run without an execution time limit, so a decoder stuck in an infinite loop would block the loop task. This was not tested.

Checklist:

• The pull request is done against the latest development branch
• Only one feature/fix was added per PR and the code change compiles without warnings (compiles without warnings; it includes the [LORA] Fix buffer overflow when converting binary packets to hex #2402 commit until that one is merged)
• I accept the DCO.

🤖 Generated with Claude Code