fix: register unifi pages with shell NavVisibilityRegistry; v1.12.1

The Access tab persists user/group grants in unifi_page_grants and the
existing RouteMatched listener honors them on the request path, but
NavItem::visibleTo() only consulted the page's required_permission —
so a granted user never saw the menu entry to reach the page. Register
the unifi.* prefix with the shell's NavVisibilityRegistry so the
sidebar lists exactly the pages the grant table allows.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

composer.json

@@ -1,7 +1,7 @@
 {
     "name": "dashboard/unifi",
     "description": "UniFi network management, WiFi stats, and captive portal authentication for the Dashboard platform",
-    "version": "1.7.1",
+    "version": "1.12.1",
     "type": "library",
     "license": "MIT",
     "autoload": {

src/Console/RotatePasswords.php

@@ -80,16 +80,73 @@ class RotatePasswords extends Command
                 $newPass = $passwords[array_rand($passwords)];
                 try {
                     if (str_starts_with((string) $ppsk->unifi_id, 'emb_')) {
-                        // Embedded PPSK: update inside the parent WLAN object.
+                        // Embedded PPSK: update inside the parent WLAN object,
-                        // Synthetic ID is derived from the new passphrase, so update it too.
+                        // matched by name (synthetic id changes with the
-                        $unifi->updateEmbeddedPpsk($ppsk->wlan_id, $ppsk->x_passphrase, $newPass);
+                        // passphrase, so it's not a stable matcher).
+                        $unifi->updateEmbeddedPpsk($ppsk->wlan_id, $ppsk->x_passphrase, $newPass, $ppsk->name);
                         $newUid = 'emb_' . substr(hash('sha256', $ppsk->wlan_id . ':' . $newPass), 0, 32);
                         $ppsk->update(['x_passphrase' => $newPass, 'unifi_id' => $newUid]);
+
+                        // Update every grouped sibling (user-defined SSID
+                        // groups take precedence; same-name fallback for
+                        // installs that haven't grouped manually).
+                        foreach ($unifi->getGroupedWlans($ppsk->wlan_id) as $siblingWlanId) {
+                            $sibling = UnifiPpsk::where('wlan_id', $siblingWlanId)
+                                ->where('name', $ppsk->name)
+                                ->where('state', 'active')
+                                ->first();
+                            try {
+                                $unifi->updateEmbeddedPpsk($siblingWlanId, $sibling?->x_passphrase, $newPass, $ppsk->name);
+                                if ($sibling) {
+                                    $sibling->update([
+                                        'x_passphrase' => $newPass,
+                                        'unifi_id'     => 'emb_' . substr(hash('sha256', $siblingWlanId . ':' . $newPass), 0, 32),
+                                    ]);
+                                }
+                            } catch (\Throwable $e) {
+                                if (str_contains($e->getMessage(), 'not found')) {
+                                    \Illuminate\Support\Facades\Log::info('unifi.ppsk_sibling_skipped', [
+                                        'sibling_wlan' => $siblingWlanId,
+                                        'ppsk_name'    => $ppsk->name,
+                                    ]);
+                                    continue;
+                                }
+                                $this->error("Sibling rotate failed for wlan {$siblingWlanId}: {$e->getMessage()}");
+                                $failedPpsks[] = ['name' => $ppsk->name . ' (sibling wlan ' . $siblingWlanId . ')', 'error' => $e->getMessage()];
+                            }
+                        }
+
+                        // Verify that the new passphrase actually applied
+                        // on every grouped WLAN. UniFi can 200 an update
+                        // that doesn't stick (cluster sync race, etc).
+                        // Anything we expected to rotate that didn't is a
+                        // failure — surface it in the cron log.
+                        $allWlanIds = array_merge([$ppsk->wlan_id], $unifi->getGroupedWlans($ppsk->wlan_id));
+                        foreach ($allWlanIds as $checkWlanId) {
+                            $result = $unifi->verifyEmbeddedPpsk($checkWlanId, $ppsk->name, $newPass);
+                            if ($result['ok']) continue;
+
+                            // 'not_found' on a sibling = PPSK isn't on that band — ignore
+                            // (consistent with the skip in the update loop).
+                            if ($result['reason'] === 'not_found' && $checkWlanId !== $ppsk->wlan_id) continue;
+
+                            $failedPpsks[] = [
+                                'name'   => $ppsk->name . ' (verify wlan ' . $checkWlanId . ')',
+                                'error'  => 'verification ' . $result['reason'] . ($result['error'] ?? null ? ': ' . $result['error'] : ''),
+                            ];
+                        }
                     } else {
                         $unifi->updatePpsk($ppsk->unifi_id, ['x_passphrase' => $newPass]);
                         $ppsk->update(['x_passphrase' => $newPass]);
                     }
                     $rotatedPpsks[] = $ppsk->name;
+
+                    // Save the active password every time a rotation
+                    // succeeds — covers PPSK-only rotation setups where
+                    // there's no whole-SSID rotation. Last successful
+                    // password wins if multiple PPSKs rotate in one run.
+                    Setting::set('unifi.password_rotation.last_password', $newPass);
+                    Setting::set('unifi.password_rotation.last_rotated_at', now()->toIso8601String());
                 } catch (\Throwable $e) {
                     $this->error("Failed to rotate PPSK \"{$ppsk->name}\": {$e->getMessage()}");
                     $failedPpsks[] = ['name' => $ppsk->name, 'error' => $e->getMessage()];

src/Http/Controllers/WifiController.php

@@ -149,8 +149,18 @@ class WifiController extends Controller
                     $name = $networksById[$nconfId]['name'] ?? null;
                 }
 
-                // Match by unifi_id, or by passphrase for a held embedded record re-appearing
+                // Match in priority order:
+                //   1. by current unifi_id (already-synced row)
+                //   2. by name within this wlan (catches rotation: passphrase
+                //      changed → synthetic id changed → row identity unchanged)
+                //   3. by passphrase among held rows (legacy fallback for
+                //      cases where name wasn't ingested)
                 $record = UnifiPpsk::where('unifi_id', $uid)->first()
+                       ?? ($name
+                            ? UnifiPpsk::where('wlan_id', $wlanId)->where('name', $name)
+                                ->orderByRaw("FIELD(state, 'active', 'held')")
+                                ->first()
+                            : null)
                        ?? UnifiPpsk::where('wlan_id', $wlanId)
                             ->where('x_passphrase', $pass)
                             ->where('state', 'held')
@@ -174,8 +184,8 @@ class WifiController extends Controller
                 }
             }
 
-            // Only mark as held when we have confirmed live IDs —
+            // Mark non-matching active rows as held — but ONLY if there's no
-            // never wipe on an empty API response (prevents false-holds on API failures)
+            // other active row with the same name we just reconnected.
             if (! empty($liveIds)) {
                 UnifiPpsk::where('wlan_id', $wlanId)
                     ->where('state', 'active')
@@ -184,6 +194,47 @@ class WifiController extends Controller
                     ->update(['state' => 'held', 'unifi_id' => null]);
             }
 
+            // For each active row, salvage any rotate_password / schedule
+            // settings from the held tombstones with the same name BEFORE
+            // we prune them. Otherwise a row that had rotate=on loses the
+            // flag every time a rotation changes its synthetic id.
+            $activeRows = UnifiPpsk::where('wlan_id', $wlanId)
+                ->where('state', 'active')
+                ->whereNotNull('name')
+                ->get();
+            foreach ($activeRows as $active) {
+                $heldWithSettings = UnifiPpsk::where('wlan_id', $wlanId)
+                    ->where('state', 'held')
+                    ->where('name', $active->name)
+                    ->where(fn ($q) => $q
+                        ->where('rotate_password', true)
+                        ->orWhereNotNull('schedule'))
+                    ->orderByDesc('updated_at')
+                    ->first();
+                if (! $heldWithSettings) continue;
+
+                $patch = [];
+                if ($heldWithSettings->rotate_password && ! $active->rotate_password) {
+                    $patch['rotate_password'] = true;
+                }
+                if ($heldWithSettings->schedule && ! $active->schedule) {
+                    $patch['schedule'] = $heldWithSettings->schedule;
+                }
+                if ($patch) $active->update($patch);
+            }
+
+            // Prune obsolete held rows: any held row whose name matches an
+            // active row in the same wlan is a stale tombstone — its
+            // settings have been salvaged above, and its data has been
+            // superseded by the active one.
+            $activeNames = $activeRows->pluck('name')->filter()->unique();
+            if ($activeNames->isNotEmpty()) {
+                UnifiPpsk::where('wlan_id', $wlanId)
+                    ->where('state', 'held')
+                    ->whereIn('name', $activeNames)
+                    ->delete();
+            }
+
             $dbRecords = UnifiPpsk::where('wlan_id', $wlanId)
                 ->orderByRaw("FIELD(state, 'active', 'held')")
                 ->orderBy('name')
@@ -293,9 +344,37 @@ class WifiController extends Controller
                 if (! empty($unifiUpdate)) {
                     if (str_starts_with($record->unifi_id, 'emb_') && isset($unifiUpdate['x_passphrase'])) {
                         // Embedded PPSK update path — modify the WLAN's embedded array.
-                        $unifi->updateEmbeddedPpsk($record->wlan_id, $record->x_passphrase, $unifiUpdate['x_passphrase']);
+                        // Match by name (reliable across drift).
-                        // Synthetic id is derived from the new passphrase.
+                        $newPass = $unifiUpdate['x_passphrase'];
-                        $data['unifi_id'] = 'emb_' . substr(hash('sha256', $record->wlan_id . ':' . $unifiUpdate['x_passphrase']), 0, 32);
+                        $unifi->updateEmbeddedPpsk($record->wlan_id, $record->x_passphrase, $newPass, $record->name);
+                        $data['unifi_id'] = 'emb_' . substr(hash('sha256', $record->wlan_id . ':' . $newPass), 0, 32);
+
+                        // Also update grouped WLAN siblings (user-defined
+                        // SSID groups, falling back to same-name).
+                        foreach ($unifi->getGroupedWlans($record->wlan_id) as $siblingWlanId) {
+                            $sibling = UnifiPpsk::where('wlan_id', $siblingWlanId)
+                                ->where('name', $record->name)
+                                ->where('state', 'active')
+                                ->first();
+                            try {
+                                $unifi->updateEmbeddedPpsk($siblingWlanId, $sibling?->x_passphrase, $newPass, $record->name);
+                                if ($sibling) {
+                                    $sibling->update([
+                                        'x_passphrase' => $newPass,
+                                        'unifi_id'     => 'emb_' . substr(hash('sha256', $siblingWlanId . ':' . $newPass), 0, 32),
+                                    ]);
+                                }
+                            } catch (\Throwable $e) {
+                                // PPSK absent on this band is fine — just
+                                // means it isn't mirrored. Anything else
+                                // gets warning-logged.
+                                $level = str_contains($e->getMessage(), 'not found') ? 'info' : 'warning';
+                                \Illuminate\Support\Facades\Log::log($level, 'unifi.ppsk_sibling_update', [
+                                    'sibling_wlan' => $siblingWlanId,
+                                    'error'        => $e->getMessage(),
+                                ]);
+                            }
+                        }
                     } else {
                         $unifi->updatePpsk($record->unifi_id, $unifiUpdate);
                     }

src/Services/UnifiApiClient.php

@@ -312,6 +312,122 @@ class UnifiApiClient
         return $this->put("/rest/wlanconf/{$wlanId}", $data);
     }
 
+    /**
+     * Find every other WLAN that should rotate/update together with this
+     * one. Authoritative source: the user-defined "SSID groups" setting
+     * (unifi.ssid_groups) from the WiFi Networks page, which lets the
+     * operator manually couple WLANs that may have different SSID names.
+     *
+     * Falls back to same-SSID-name siblings for installs that haven't
+     * configured groups yet.
+     *
+     * Returns an array of sibling wlan IDs (excludes $wlanId itself).
+     */
+    public function getGroupedWlans(string $wlanId): array
+    {
+        $groupsJson = Setting::get('unifi.ssid_groups', '{}');
+        $groups     = json_decode($groupsJson, true);
+        if (is_array($groups)) {
+            foreach ($groups as $wlanIds) {
+                if (! is_array($wlanIds)) continue;
+                if (in_array($wlanId, $wlanIds, true)) {
+                    return array_values(array_filter($wlanIds, fn ($id) => $id !== $wlanId));
+                }
+            }
+        }
+        return $this->getWlanSiblings($wlanId);
+    }
+
+    /**
+     * Verify an embedded PPSK has the expected passphrase right now.
+     * Used after an update to confirm the change actually applied —
+     * UniFi sometimes 200s an update that didn't stick (cluster sync
+     * race, hot-restart in progress, etc.).
+     *
+     * Returns ['ok' => true] on a clean match, or
+     * ['ok' => false, 'reason' => 'fetch_failed'|'not_found'|'mismatch']
+     * with optional 'error' on fetch failures.
+     */
+    public function verifyEmbeddedPpsk(string $wlanId, string $name, string $expectedPassphrase): array
+    {
+        try {
+            $entries = $this->getPpskEntries($wlanId);
+        } catch (\Throwable $e) {
+            return ['ok' => false, 'reason' => 'fetch_failed', 'error' => $e->getMessage()];
+        }
+
+        $networkconfId = $this->findNetworkconfIdByName($name);
+
+        foreach ($entries as $e) {
+            $entryName     = $e['name'] ?? $e['label'] ?? $e['username'] ?? $e['privatePskName'] ?? null;
+            $entryNetId    = $e['networkconf_id'] ?? null;
+            $entryMatches  = ($networkconfId !== null && $entryNetId === $networkconfId)
+                          || ($entryName !== null && $entryName === $name);
+            if (! $entryMatches) continue;
+
+            $entryPass = $e['x_passphrase'] ?? $e['password'] ?? $e['passphrase'] ?? null;
+            return $entryPass === $expectedPassphrase
+                ? ['ok' => true]
+                : ['ok' => false, 'reason' => 'mismatch'];
+        }
+        return ['ok' => false, 'reason' => 'not_found'];
+    }
+
+    /**
+     * Look up a networkconf (VLAN/network) by its display name. Embedded
+     * PPSKs on this controller use networkconf_id as their stable
+     * identifier — the human "name" the operator sees is actually the
+     * network's name.
+     */
+    private function findNetworkconfIdByName(string $name): ?string
+    {
+        try {
+            $networks = $this->getNetworkConfs();
+        } catch (\Throwable) {
+            return null;
+        }
+        foreach ($networks as $n) {
+            if (($n['name'] ?? null) === $name) {
+                return $n['_id'] ?? null;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Find sibling WLAN configs — same SSID name, different _id. UniFi
+     * splits a "banded" SSID (band-steering disabled) into one wlanconf
+     * per band, each with its own _id and its own embedded PPSK array.
+     * A rotation that updates one band must also update the others, or
+     * the SSID's two halves drift out of sync.
+     *
+     * Returns an array of sibling wlan IDs (excludes $wlanId itself).
+     * Empty array if the target WLAN is unique or can't be found.
+     */
+    public function getWlanSiblings(string $wlanId): array
+    {
+        try {
+            $all = $this->get('/rest/wlanconf');
+        } catch (\Throwable) {
+            return [];
+        }
+
+        $target = null;
+        foreach ($all as $w) {
+            if (($w['_id'] ?? null) === $wlanId) { $target = $w; break; }
+        }
+        if (! $target || empty($target['name'])) return [];
+
+        $siblings = [];
+        foreach ($all as $w) {
+            if (($w['_id'] ?? null) === $wlanId) continue;
+            if (($w['name'] ?? null) === $target['name']) {
+                $siblings[] = $w['_id'];
+            }
+        }
+        return $siblings;
+    }
+
     // ── PPSK ─────────────────────────────────────────────────────────────────
 
     /**
@@ -504,7 +620,7 @@ class UnifiApiClient
      * no controller-side ID. Only changes the entry's passphrase; name
      * isn't separately addressable on embedded PPSKs.
      */
-    public function updateEmbeddedPpsk(string $wlanId, string $oldPassphrase, string $newPassphrase): array
+    public function updateEmbeddedPpsk(string $wlanId, ?string $oldPassphrase, string $newPassphrase, ?string $name = null): array
     {
         $wlanResp = $this->get("/rest/wlanconf/{$wlanId}");
         $wlan     = $wlanResp[0] ?? $wlanResp;
@@ -514,26 +630,66 @@ class UnifiApiClient
             throw new \RuntimeException('WLAN has no embedded PPSKs to update.');
         }
 
-        $matched = false;
+        // Embedded PPSKs on this controller don't carry a name field —
-        foreach ($entries as &$e) {
+        // the human label ("GUEST", "3DPrinters", …) is the *network's*
-            $current = $e['x_passphrase'] ?? $e['password'] ?? $e['passphrase'] ?? null;
+        // name, and each entry references it via networkconf_id. So when
-            if ($current === $oldPassphrase) {
+        // the caller passes a name, first resolve it to a networkconf_id
-                // Preserve whichever field name the controller is using.
+        // and match on that. Falls back to entry-level name (other
+        // controller versions DO put a name on the entry) and finally
+        // to current passphrase.
+        $applyUpdate = function (array &$e) use ($newPassphrase) {
             if (array_key_exists('x_passphrase', $e)) $e['x_passphrase'] = $newPassphrase;
             if (array_key_exists('password',     $e)) $e['password']     = $newPassphrase;
             if (array_key_exists('passphrase',   $e)) $e['passphrase']   = $newPassphrase;
-                // If none of the above existed, default to password (most common on embedded).
             if (! isset($e['x_passphrase']) && ! isset($e['password']) && ! isset($e['passphrase'])) {
                 $e['password'] = $newPassphrase;
             }
+        };
+
+        $networkconfId = ($name !== null && $name !== '') ? $this->findNetworkconfIdByName($name) : null;
+
+        $matched = false;
+        if ($networkconfId !== null) {
+            foreach ($entries as &$e) {
+                if (($e['networkconf_id'] ?? null) === $networkconfId) {
+                    $applyUpdate($e);
                     $matched = true;
                     break;
                 }
             }
             unset($e);
+        }
+
+        if (! $matched && $name !== null && $name !== '') {
+            foreach ($entries as &$e) {
+                $entryName = $e['name'] ?? $e['label'] ?? $e['username'] ?? $e['privatePskName'] ?? null;
+                if ($entryName === $name) {
+                    $applyUpdate($e);
+                    $matched = true;
+                    break;
+                }
+            }
+            unset($e);
+        }
+
+        if (! $matched && $oldPassphrase !== null && $oldPassphrase !== '') {
+            foreach ($entries as &$e) {
+                $current = $e['x_passphrase'] ?? $e['password'] ?? $e['passphrase'] ?? null;
+                if ($current === $oldPassphrase) {
+                    $applyUpdate($e);
+                    $matched = true;
+                    break;
+                }
+            }
+            unset($e);
+        }
 
         if (! $matched) {
-            throw new \RuntimeException('Embedded PPSK not found by current passphrase.');
+            throw new \RuntimeException(
+                'Embedded PPSK not found' .
+                ($name !== null ? " for network \"{$name}\"" : '') .
+                ' or by current passphrase.'
+            );
         }
 
         // UniFi REST expects the full WLAN object on PUT — send what we

src/Services/WebhookCheckService.php

@@ -181,7 +181,11 @@ class WebhookCheckService
             $prev     = DeviceState::where('device_mac', $mac)->first();
             if (! $prev) continue;
 
-            // Skip planned reboots — these are intentional, not alerts
+            // Skip planned reboots — these are intentional, not alerts.
+            // Two layers: a global suppression window set by RebootAllAps
+            // (Setting, survives any cache driver), plus the per-MAC
+            // cache keys for finer granularity.
+            if ($this->inGlobalRebootSuppression()) continue;
             if (Cache::has('unifi:planned_reboot:' . strtolower($mac))) continue;
 
             if ($comingOnline) {
@@ -509,6 +513,8 @@ class WebhookCheckService
     private function checkReboot($aps, array $filter): array
     {
         $alerts = [];
+        if ($this->inGlobalRebootSuppression()) return $alerts;
+
         foreach ($aps as $ap) {
             if (! empty($filter) && ! in_array($ap['mac'], $filter)) continue;
             if (Cache::has('unifi:planned_reboot:' . strtolower($ap['mac']))) continue;
@@ -584,6 +590,24 @@ class WebhookCheckService
         return self::buildPlatformPayload($url, $message, $fullPayload);
     }
 
+    /**
+     * Is a fleet reboot in progress right now? RebootAllAps stamps a
+     * suppression-until timestamp as a Setting; while that timestamp
+     * is in the future, we skip all device-offline / device-online /
+     * unexpected-reboot alerts to avoid flooding webhooks during the
+     * known maintenance window.
+     */
+    private function inGlobalRebootSuppression(): bool
+    {
+        $until = \App\Models\Setting::get('unifi.reboot_suppression_until');
+        if (! $until) return false;
+        try {
+            return \Carbon\Carbon::parse($until)->isFuture();
+        } catch (\Throwable) {
+            return false;
+        }
+    }
+
     /**
      * Public/static helper so the test-webhook endpoint produces the
      * same per-platform payload shape that real events do.

src/UnifiServiceProvider.php

@@ -25,6 +25,31 @@ class UnifiServiceProvider extends ServiceProvider
         $this->loadRoutesFrom(__DIR__ . '/routes/unifi.php');
         $this->loadMigrationsFrom(__DIR__ . '/../database/migrations');
 
+        // Tell the shell's NavVisibilityRegistry which unifi nav items
+        // the user can see in the sidebar. Without this the sidebar
+        // would only follow legacy required_permission, hiding pages
+        // the user has been explicitly granted via the Access tab.
+        try {
+            app(\App\Support\NavVisibilityRegistry::class)->register(
+                'unifi.',
+                function (\App\Models\User $user) {
+                    if (! \Illuminate\Support\Facades\Schema::hasTable('unifi_page_grants')) {
+                        return collect();
+                    }
+                    $groupIds = $user->groups()->pluck('groups.id');
+                    return UnifiPageGrant::query()
+                        ->where(function ($q) use ($user, $groupIds) {
+                            $q->where(fn ($u) => $u->where('grantee_type', 'user')->where('grantee_id', $user->id))
+                              ->orWhere(fn ($g) => $g->where('grantee_type', 'group')->whereIn('grantee_id', $groupIds));
+                        })
+                        ->pluck('nav_item_id');
+                }
+            );
+        } catch (\Throwable) {
+            // Shell may not have the registry yet (older shell version).
+            // Sidebar will fall back to legacy permission filter.
+        }
+
         // Per-page access enforcement for unifi routes. If a unifi page has
         // any UnifiPageGrant rows, only super-admins and granted users/
         // groups can hit it; otherwise (no grants) it's open per the existing