Source-checked corrections from the verification pass that were not captured
in the prior commit: mqtt default broker (dc3-rabbitmq:1883), snmp/can/http/
ble/zigbee command vs point attribute read sources and honest capability
labels, opc-ua/opc-da/modbus-rtu/fins/listening-virtual wording, and the
fieldbus/iot-protocols foundations chapters. Bilingual, all within drivers/
and foundations/, no scope creep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Apply source-checked corrections across driver and foundations pages:
- mqtt/snmp/can/http/ble/zigbee/listening-virtual: command-attribute vs
point-attribute read sources, default broker (dc3-rabbitmq:1883, not EMQX
localhost:31883), dead driver-level properties, capability matrix alignment
(CAN write ✓→—), and honest skeleton/partial labels.
- aiot: MCP catalog refresh is manual (POST /mcp/tool/catalog/refresh), not
scheduled PT5M; AGENTIC_MEMORY_ENABLED dual default clarified.
- edge-cloud: connection/state management sits on the data center, not the
manager center; soften the four-centers ↔ four-capabilities 1:1 wording.
- security: salt is stateless (no server-enforced 5-min timeout);
DC3_SECURITY_KEY has a "must exist" startup check but no weak-value rejection.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Convert all Chinese code comments under docs/.vitepress (config + theme +
components) to English; UI string literals (zh DICT values, nav labels,
uiLabels) are kept verbatim. Soften the home hero motion for a calmer feel:
slower logo wave (omega 1.0→0.6, sway 6→4.5), gentler particle convergence
(inward 120-200→70-120 px/s, fewer/slower dots), slower wave plane (0.5→0.3).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add foundations back-links (data-plane → time-series, auth-rbac → security,
ai → aiot) to complete the theory-to-implementation loop across both locales.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rewrite every protocol driver page (zh+en) into a four-section structure
— protocol background, attribute config, troubleshooting, and how it lands
in DC3 — cross-linked to the foundations network-layer chapters and the
driver capability matrix. Implementation status is verified against each
driver's source and labeled honestly (skeleton: ethernet-ip, iec104, dlms,
can, zigbee; partial: fins, mqtt, lwm2m, virtual). Add foundations
back-links from the concepts and drivers hubs to close the theory↔practice
loop.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the Foundations pillar (nav position 2) as a structured IoT primer
organized by the classic four-layer reference architecture (perception,
network, platform, application) plus cross-cutting security. One overview
(2.0) with a bespoke FourLayers SVG mapping each layer to its DC3
implementation, and eight chapters (sensing, identification, fieldbus,
iot-protocols, edge-cloud, data-pipeline, aiot, security), bilingual and
fully original. Every chapter closes with a verified "in IoT DC3" section
and cross-links into the product docs. Add the sixth homepage card.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Drop the gate "Languages" locale so the switcher shows only zh/en; keep the
/ redirect gate for no-JS fallback. Deepen the global mermaid theme (softer
on-brand palette, rounded nodes, cleaner edges) so all 156 diagrams read
cleaner. Add a reusable .dc3-diagram palette and three hand-built SVG
components (DataPlane, CommandPlane, AuthFlow) replacing the keystone
diagrams on the data-plane, command-plane and auth-rbac pages, bilingual
and theme-aware.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Collapse the flat 10-section navigation into five pillars (Overview,
Architecture, Connectivity, Operations, Develop) plus a Community dropdown,
via a pillar model in config.mts. Legacy dirs (modules, guide, ai,
automation, device-onboarding) aggregate into pillars through multi-path
sidebars and longest-prefix matching, with zero file moves and zero dead
links. Adds a bilingual glossary and driver capability matrix, and aligns
the homepage feature cards.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Design and task breakdown for collapsing the flat 10-section nav into
professional pillars and adding an IoT foundations knowledge pillar.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- title: add config `title: 'IoT DC3'` so the browser tab reads "IoT DC3"
(inner pages ":title | IoT DC3") instead of the default "VitePress".
- hero: full-bleed background particle field that converges clockwise toward the
logo from all directions (HeroParticles), plus a pseudo-perspective wave
point-grid underlay (HeroWaves); both pure 2D canvas, layered under the hero
content (waves z0 < particles z1 < content z2).
- hero: rebuild the homepage logo as a live canvas particle system faithfully
reconstructed from logo.svg (54 dots, solid #1296db) instead of a static image;
the dots animate with a clockwise, inward-converging wave along the three spiral
arms — no whole-image rotation, no extra particles or glow haze.
- architecture: render the homepage/architecture diagram via a single
theme-reactive Architecture.vue component (renamed from Dc3Architecture.vue);
drop the static SVG/HTML drawings.
- cleanup: remove ~23MB of unused images (legacy/ 167 files, architecture-cn.png,
iot-dc3-architecture-{zh,en}.svg, diagrams/iot-dc3-architecture.html).
- sidebar: group drivers/concepts/architecture into collapsible sections;
fix a pre-existing dead-link bug in cross-section link generation.
- nav: brand-blue site title.
- chore: bump packageManager to pnpm@11.9.0.
Device, Driver, Profile (thing model), Point, PointValue, Command, Event, Tenant, Attribute&Config — each grounded in source BOs + maintainer design docs, beginner-friendly with analogies, cross-linked. Field tables/enums/table names/APIs verified against source (adversarial pass caught & fixed design-doc drift: dc3_event_history not _record, EventLevelEnum LOW/MEDIUM/HIGH/CRITICAL, tenant isolation is controller-layer not a DB interceptor).
These OAuth2.1 authorization-server endpoints (metadata, jwks, register, authorize, token, revoke) and the MCP gateway endpoints (protected-resource metadata, JSON-RPC mcp) authenticate via OAuth (PKCE / client credentials / bearer-token introspection), not the internal @PreAuthorize RBAC. Marking them @PublicEndpoint — consistent with TokenController pre-login endpoints — makes their public security posture explicit and satisfies the controller permission audit (337 endpoints: 326 guarded + 11 public).
Add the first driver integration test: spins a real PostgreSQL container and
verifies the shared JDBC read path returns stored values and that the write
path binds the point value as a parameter — a SQL-injection payload is stored
verbatim and cannot drop the table, confirming the parameterised-write fix
end-to-end. Set the Failsafe classesDirectory so integration tests run against
the plain compiled classes instead of the Spring Boot repackaged fat jar.
Add offline MockitoExtension tests for bacnet-ip, can, ethernet-ip, fins, http,
lwm2m, mysql, oracle, postgresql, serial, snmp, sqlserver, and tcp-udp. Each
covers configuration validation (validate/validatePoint flag missing required
attributes) and deterministic lifecycle behavior. Network/hardware paths
(read/write/getConnector) are deliberately excluded to keep the suite fast and
deterministic. Takes these drivers from zero tests to baseline coverage.
The shared JDBC driver base interpolated the point value into the write SQL via
writeQuery.replace("${value}", ...), allowing a crafted write command value to
alter the statement. Bind the value with PreparedStatement#setString against a
single ? placeholder instead. Update the mysql/oracle/postgresql/sqlserver
writeQuery attribute docs to the ? convention and add the module's first test.
The DLMS and IEC 104 drivers are work-in-progress skeletons whose protocol I/O
is unimplemented. They previously returned a null-valued ReadPointValue / cached
echo and reported write success, so the SDK emitted fabricated point values and
masked that the drivers do not work. Make read/write throw Read/WritePointException
so the SDK records failures and applies backoff. Remove the dead connection
scaffolding and add the drivers' first unit tests.
validate(driverConfig) required commandTopic/commandQos, but those are
per-point attributes read from pointConfig in write(), so driver-level
validation always failed. Drop the misplaced checks (and the now-unused
helper); this driver declares no required driver-level attributes.
Document 31 modules that had no README: dc3-center-agentic, dc3-e2e,
common modules (agentic, sql, test, resource-registrar) and the facade
subsystem (api/grpc/local-auth/local-data/local-manager), plus 21
drivers. Content is grounded in each module's pom/yaml/source; WIP
skeleton drivers (can, dlms, ethernet-ip, iec104, lwm2m, zigbee) are
flagged as such.
Move misclassified point attributes out of the driver-attribute tables
(modbus-tcp Slave ID, virtual Tag, listening-virtual), drop plcs7's
fabricated Data Length and add the required PLC Type, document
command/event attributes, and flag the mqtt driver as a WIP skeleton.
thread: document the three JDK executor beans and the real dc3.thread
keys (the @Async claim was wrong). mqtt: correct the dc3.driver.mqtt
prefix/keys and the Spring Integration + Paho component roles.
Replace the non-existent ekuiper route with agentic, add the OAuth2/MCP
routes, and describe static addressing (no Nacos) and the actual profile
configuration.
Align the four api READMEs with the actual protos: Select*->Get*/List*
per the CRUD verb convention, fix api/common->api/center import paths
for auth/data, drop the fabricated manager SelectByServiceName RPC, and
document the previously omitted auth/data/manager services.
@EnableAsync was on the business component MetadataEventPublisher; move
it to the module's @AutoConfiguration entry (ManagerInitRunner) so the
async switch lives with config, not a bean. Scope is unchanged.
The Spring @Scheduled sweeper these supported was migrated to RabbitMQ
TTL+DLX; the bean and @EnableScheduling were left orphaned. Scheduled
work in center-data runs on Quartz.
Replace the unsafe (T) cast of PemReader.readPemObject() — which threw
ClassCastException at runtime — with explicit conversion: X.509 certs via
CertificateFactory and private keys (PKCS#1/PKCS#8, encrypted or plain) via
BouncyCastle's PEMParser. Add the bcpkix dependency and unit tests covering
the encrypted-key path used by MQTT TLS.
Replace bare `//` placeholders with concise intent comments where a
non-obvious reason exists (metadata-event publishing, referential-integrity
delete guards, gRPC registration steps), and remove the rest as leftover
field-group dividers or redundant restatements. Add class-level Javadoc to
12 auth Mapper/Manager/ManagerImpl interfaces to match the repository
convention. Comment-only change across manager, auth, and data modules.
Part of the x-dc3-ai annotation-standard rollout. Complete method/param javadoc (TokenService, RepositoryService, RuleEngine, ...), flag work-in-progress utilities and drivers (X509Util, MQTT/CAN/DLMS/... ) with explicit WARNING notes, and remove redundant inline comments / blank lines from query/VO/ext/constant classes plus mapper indentation. Comment/doc only, no behavior change.
Add dc3_menu rows for the MCP Connection / MCP Client / MCP Tool settings pages (codes settingsMcpConnection/Client/Tool under the Integration group), matching the new frontend management views.
createConnection and registerClient now take an enum-typed BO instead of a VO, so the service layer no longer parses wire strings. McpConnectionAddBO / OAuthClientRegistrationBO (enum principalType/grantType/clientType) are built from the request VO via McpConnectionBuilder.buildBOByAddVO / OAuthClientBuilder.buildBOByRequestVO; the controllers do the VO->BO conversion. The *Record projections stay String/Byte (untouched).
createConnection keeps creator stamping and every client_credentials check (service-account principal, client-SA binding, tenant match). The original 'unsupported client_type' guard is preserved: OAuthClientBuilder.isUnknownClientType lets both register controllers reject a non-blank but unrecognized client_type instead of silently defaulting to PUBLIC.
Replace bare String fields with domain enums on the read-response VOs and in service-internal comparisons, removing scattered McpConstant string literals. Five value-typed enums (OAuthGrantType/OAuthClientType/McpRiskLevel/McpAuditStatus/McpConfirmationStatus) land in common-constant with @EnumValue + @JsonValue + ofValue, registered in IndexedEnumContractTest.
VO fields: McpConnectionVO{principalType,grantType}, McpToolVO.riskLevel, McpAuditVO{principalType,riskLevel,status}, OAuthClientVO.clientType. Builders convert via @AfterMapping (Enum.ofValue); the *Record projections keep String/Byte untouched (OAuthMcpMapper custom-SQL resultType boundary). Service compares/assigns via enum.getValue(); Confirmation.DECISION_* kept (gateway-shared). common-constant gains jackson-annotations because grantType's wire value is lowercase and must serialize via @JsonValue, not the uppercase enum name.
client_credentials connections store the service account as principal_id, but the management ops (list/replace/revoke/listToolIds) authorized on principal_id == caller. The caller is the USER who built the connection while principal_id is the SERVICE_ACCOUNT, so they never matched — the connection's own creator could not list it, set its tool whitelist, or revoke it ("MCP connection does not exist").
Stamp creator_id (the acting user) in createConnection and key the management path on creator_id; the MCP runtime path (service-account bearer token) stays on principal_id. authorization_code connections are unaffected (creator == principal == USER).
Reorganize dc3_menu (and mirrored dc3_resource) under Settings into Identity / Access / Model / Alarm / Event&Command / Audit / Integration / System, matching the frontend settingsNav.ts. Replaces the flat, out-of-order layout and retires the legacy Event/Command group containers.
Henry Zhang