Update more cluster access privileges (#17115)

Also fix thermostat cluster attribute name (should be "ac compressor type" not "ac compressor" per spec)
project-chip · Apr 25, 2022 · bed992d · bed992d
1 parent 87442b7
commit bed992d
Show file tree

Hide file tree

Showing 36 changed files with 1,373 additions and 58 deletions.
diff --git a/src/app/zap-templates/zcl/data-model/all.xml b/src/app/zap-templates/zcl/data-model/all.xml
@@ -14,7 +14,6 @@
    <xi:include href="chip/chip-ota.xml" />
    <xi:include href="chip/chip-types.xml" />
    <xi:include href="chip/clusters-extensions.xml" />
-   <xi:include href="chip/commissioning.xml" />
    <xi:include href="chip/content-launch-cluster.xml" />
    <xi:include href="chip/descriptor-cluster.xml" />
    <xi:include href="chip/diagnostic-logs-cluster.xml" />
@@ -34,6 +33,7 @@
    <xi:include href="chip/media-input-cluster.xml" />
    <xi:include href="chip/media-playback-cluster.xml" />
    <xi:include href="chip/mode-select-cluster.xml" />
+   <xi:include href="chip/network-commissioning-cluster.xml" />
    <xi:include href="chip/onoff-cluster.xml" />
    <xi:include href="chip/operational-credentials-cluster.xml" />
    <xi:include href="chip/pressure-measurement-cluster.xml" />

diff --git a/src/app/zap-templates/zcl/data-model/chip/group-key-mgmt-cluster.xml b/src/app/zap-templates/zcl/data-model/chip/group-key-mgmt-cluster.xml
@@ -56,19 +56,25 @@ limitations under the License.
     <code>0x003F</code>
     <define>GROUP_KEY_MANAGEMENT_CLUSTER</define>
     <description>The Group Key Management Cluster is the mechanism by which group keys are managed.</description>
-    <attribute side="server" code="0x0000" define="GROUP_KEY_MAP" type="ARRAY" length="254" entryType="GroupKeyMapStruct" writable="true" optional="false">GroupKeyMap</attribute>
+    <attribute side="server" code="0x0000" define="GROUP_KEY_MAP" type="ARRAY" length="254" entryType="GroupKeyMapStruct" writable="true" optional="false">
+      <description>GroupKeyMap</description>
+      <access op="read" privilege="view"/>
+      <access op="write" privilege="manage"/>
+    </attribute>
     <attribute side="server" code="0x0001" define="GROUP_TABLE" type="ARRAY" length="254" entryType="GroupInfoMapStruct" writable="false" optional="false">GroupTable</attribute>
     <attribute side="server" code="0x0002" define="MAX_GROUPS_PER_FABRIC" type="INT16U" writable="false" optional="false">MaxGroupsPerFabric</attribute>
     <attribute side="server" code="0x0003" define="MAX_GROUP_KEYS_PER_FABRIC" type="INT16U" writable="false" optional="false">MaxGroupKeysPerFabric</attribute>
 
     <command source="client" code="0x00" name="KeySetWrite" optional="false" cli="zcl GroupKeyManagement KeySetWrite">
       <description>Revoke a Root Key from a Group</description>
       <arg name="GroupKeySet" type="GroupKeySetStruct"/>
+      <access op="invoke" privilege="administer"/>
     </command>
 
     <command source="client" code="0x01" name="KeySetRead" response="KeySetReadResponse" optional="false" cli="zcl GroupKeyManagement KeySetRead">
       <description>Revoke a Root Key from a Group</description>
       <arg name="GroupKeySetID" type="INT16U"/>
+      <access op="invoke" privilege="administer"/>
     </command>
 
     <command source="server" code="0x02" name="KeySetReadResponse" optional="false" disableDefaultResponse="true">
@@ -81,11 +87,13 @@ limitations under the License.
     <command source="client" code="0x03" name="KeySetRemove" optional="false" cli="zcl GroupKeyManagement KeySetRemove">
       <description>Revoke a Root Key from a Group</description>
       <arg name="GroupKeySetID" type="INT16U"/>
+      <access op="invoke" privilege="administer"/>
     </command>
 
     <command source="client" code="0x04" name="KeySetReadAllIndices" response="KeySetReadAllIndicesResponse" optional="false" cli="zcl GroupKeyManagement KeySetReadAllIndices">
       <description>Return the list of Group Key Sets associated with the accessing fabric</description>
       <arg name="GroupKeySetIDs" type="INT16U" array="true"/>
+      <access op="invoke" privilege="administer"/>
     </command>
 
     <command source="server" code="0x05" name="KeySetReadAllIndicesResponse" optional="false" disableDefaultResponse="true">

diff --git a/src/app/zap-templates/zcl/data-model/chip/identify-cluster.xml b/src/app/zap-templates/zcl/data-model/chip/identify-cluster.xml
@@ -58,18 +58,21 @@ limitations under the License.
         Command description for Identify
       </description>
       <arg name="identifyTime" type="INT16U"/>
+      <access op="invoke" privilege="manage"/>
     </command>
     <command source="client" code="0x01" name="IdentifyQuery" response="IdentifyQueryResponse" optional="false">
       <description>
         Command description for IdentifyQuery
       </description>
+      <access op="invoke" privilege="manage"/>
     </command>
     <command source="client" code="0x40" name="TriggerEffect" optional="true">
       <description>
         Command description for TriggerEffect
       </description>
       <arg name="effectIdentifier" type="IdentifyEffectIdentifier"/>
       <arg name="effectVariant" type="IdentifyEffectVariant"/>
+      <access op="invoke" privilege="manage"/>
     </command>
     <command source="server" code="0x00" name="IdentifyQueryResponse" optional="false" disableDefaultResponse="true">
       <description>

diff --git a/...tes/zcl/data-model/chip/commissioning.xml → ...el/chip/network-commissioning-cluster.xml b/...tes/zcl/data-model/chip/commissioning.xml → ...el/chip/network-commissioning-cluster.xml
@@ -83,19 +83,39 @@ limitations under the License.
         <client tick="false" init="false">true</client>
         <server tick="false" init="false">true</server>
 
-        <attribute side="server" code="0x0000" define="MAX_NETWORKS" type="INT8U" writable="false" optional="false">MaxNetworks</attribute>
-        <attribute side="server" code="0x0001" define="NETWORKS" type="ARRAY" entryType="NetworkInfo" length="12" writable="false" optional="false">Networks</attribute>
+        <attribute side="server" code="0x0000" define="MAX_NETWORKS" type="INT8U" writable="false" optional="false">
+            <description>MaxNetworks</description>
+            <access op="read" privilege="administer"/>
+        </attribute>
+        <attribute side="server" code="0x0001" define="NETWORKS" type="ARRAY" entryType="NetworkInfo" length="12" writable="false" optional="false">
+            <description>Networks</description>
+            <access op="read" privilege="administer"/>
+        </attribute>
         <attribute side="server" code="0x0002" define="SCAN_MAX_TIME_SECONDS" type="INT8U" writable="false" optional="true">ScanMaxTimeSeconds</attribute>
         <attribute side="server" code="0x0003" define="CONNECT_MAX_TIME_SECONDS" type="INT8U" writable="false" optional="true">ConnectMaxTimeSeconds</attribute>
-        <attribute side="server" code="0x0004" define="INTERFACE_ENABLED" type="BOOLEAN" writable="true" optional="false">InterfaceEnabled</attribute>
-        <attribute side="server" code="0x0005" define="LAST_NETWORKING_STATUS" type="NetworkCommissioningStatus" writable="false" optional="false" isNullable="true">LastNetworkingStatus</attribute>
-        <attribute side="server" code="0x0006" define="LAST_NETWORK_ID" type="OCTET_STRING" length="32" writable="false" optional="false" isNullable="true">LastNetworkID</attribute>
-        <attribute side="server" code="0x0007" define="LAST_CONNECT_ERROR_VALUE" type="INT32S" writable="false" optional="false" isNullable="true">LastConnectErrorValue</attribute>
+        <attribute side="server" code="0x0004" define="INTERFACE_ENABLED" type="BOOLEAN" writable="true" optional="false">
+            <description>InterfaceEnabled</description>
+            <access op="read" privilege="view"/>
+            <access op="write" privilege="administer"/>
+        </attribute>
+        <attribute side="server" code="0x0005" define="LAST_NETWORKING_STATUS" type="NetworkCommissioningStatus" writable="false" optional="false" isNullable="true">
+            <description>LastNetworkingStatus</description>
+            <access op="read" privilege="administer"/>
+        </attribute>
+        <attribute side="server" code="0x0006" define="LAST_NETWORK_ID" type="OCTET_STRING" length="32" writable="false" optional="false" isNullable="true">
+            <description>LastNetworkID</description>
+            <access op="read" privilege="administer"/>
+        </attribute>
+        <attribute side="server" code="0x0007" define="LAST_CONNECT_ERROR_VALUE" type="INT32S" writable="false" optional="false" isNullable="true">
+            <description>LastConnectErrorValue</description>
+            <access op="read" privilege="administer"/>
+        </attribute>
 
         <command source="client" code="0x00" name="ScanNetworks" optional="false" response="ScanNetworksResponse" cli="chip network_commissioning scannetworks">
             <description>Detemine the set of networks the device sees as available.</description>
             <arg name="SSID" type="OCTET_STRING" length="32" isNullable="true" optional="true"/>
             <arg name="Breadcrumb" type="INT64U" optional="true"/>
+            <access op="invoke" privilege="administer"/>
         </command>
         <command source="server" code="0x01" name="ScanNetworksResponse" optional="false" cli="chip network_commissioning scannetworksresponse">
             <description>Relay the set of networks the device sees as available back to the client.</description>
@@ -109,16 +129,19 @@ limitations under the License.
             <arg name="SSID" type="OCTET_STRING" length="32"/>
             <arg name="Credentials" type="OCTET_STRING" length="64"/>
             <arg name="breadcrumb" type="INT64U" optional="true"/>
+            <access op="invoke" privilege="administer"/>
         </command>
         <command source="client" code="0x03" name="AddOrUpdateThreadNetwork" optional="true" response="NetworkConfigResponse" cli="chip network_commissioning addorupdatethreadnetwork">
             <description>Add or update the credentials for a given Thread network.</description>
             <arg name="OperationalDataset" type="OCTET_STRING" length="254"/>
             <arg name="Breadcrumb" type="INT64U" optional="true"/>
+            <access op="invoke" privilege="administer"/>
         </command>
         <command source="client" code="0x04" name="RemoveNetwork" optional="false" response="NetworkConfigResponse" cli="chip network_commissioning removenetwork">
             <description>Remove the definition of a given network (including its credentials).</description>
             <arg name="NetworkID" type="OCTET_STRING" length="32"/>
             <arg name="Breadcrumb" type="INT64U" optional="true"/>
+            <access op="invoke" privilege="administer"/>
         </command>
         <command source="server" code="0x05" name="NetworkConfigResponse" optional="true" cli="chip network_commissioning addwifiresponse">
             <description>Response command for various commands that add/remove/modify network credentials.</description>
@@ -130,6 +153,7 @@ limitations under the License.
             <description>Connect to the specified network, using previously-defined credentials.</description>
             <arg name="NetworkID" type="OCTET_STRING" length="32"/>
             <arg name="Breadcrumb" type="INT64U" optional="true"/>
+            <access op="invoke" privilege="administer"/>
         </command>
         <command source="server" code="0x07" name="ConnectNetworkResponse" optional="false" cli="chip network_commissioning connectnetworkresponse">
             <description>Command that indicates whether we have succcessfully connected to a network.</description>
@@ -142,6 +166,7 @@ limitations under the License.
             <arg name="NetworkID" type="OCTET_STRING" length="32"/>
             <arg name="NetworkIndex" type="INT8U"/>
             <arg name="Breadcrumb" type="INT64U" optional="true"/>
+            <access op="invoke" privilege="administer"/>
         </command>
     </cluster>
     <bitmap name="NetworkCommissioningFeature" type="BITMAP32">

diff --git a/src/app/zap-templates/zcl/data-model/chip/onoff-cluster.xml b/src/app/zap-templates/zcl/data-model/chip/onoff-cluster.xml
@@ -59,7 +59,11 @@ limitations under the License.
     <attribute side="server" code="0x4000" define="GLOBAL_SCENE_CONTROL" type="boolean" default="1"                 optional="true">GlobalSceneControl</attribute>
     <attribute side="server" code="0x4001" define="ON_TIME"              type="int16u"  default="0" writable="true" optional="true">OnTime</attribute>
     <attribute side="server" code="0x4002" define="OFF_WAIT_TIME"        type="int16u"  default="0" writable="true" optional="true">OffWaitTime</attribute>
-    <attribute side="server" code="0x4003" define="START_UP_ON_OFF"      type="OnOffStartUpOnOff" min="0" max="2" isNullable="true" writable="true" optional="true">StartUpOnOff</attribute>
+    <attribute side="server" code="0x4003" define="START_UP_ON_OFF"      type="OnOffStartUpOnOff" min="0" max="2" isNullable="true" writable="true" optional="true">
+      <description>StartUpOnOff</description>
+      <access op="read" privilege="view"/>
+      <access op="write" privilege="manage"/>
+    </attribute>
 
     <command source="client" code="0x00" name="Off" optional="false">
       <description>On receipt of this command, a device SHALL enter its ‘Off’ state. This state is device dependent, but it is recommended that it is used for power off or similar functions. On receipt of the Off command, the OnTime attribute SHALL be set to 0.</description>