mi band 2/3/4: pairs-only support - #356
Conversation
no auth key vendor lock — locally generated, aes-128 challenge/response. subscribes battery/steps/hr best-effort and archives them undecoded. never touches history, never derives a metric.
|
Warning Review limit reachedNext included review available in 35 minutes. View limit detailsLimit details: You’ve used all 4 included reviews currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: ⛔ Files ignored due to path filters (5)
📒 Files selected for processing (8)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideAdds experimental pairs-only support for Mi Band 2/3/4 using a locally generated secure key and AES-128 challenge-response authentication, then collects optional notifications as unattributed raw archive data without decoding history or metrics; pairing, syncing, forgetting, UI registration, and replay-based tests are included, but real hardware validation remains outstanding. Sequence diagram for Mi Band 2/3/4 pairing and authenticationsequenceDiagram
participant User
participant App
participant Band as MiBand234
participant SecureStorage
participant Database
User->>App: pairMiBand234(device)
App->>SecureStorage: write pairing key
App->>Band: write AUTH install key
Band-->>App: key install response
App->>Band: write AUTH challenge request
Band-->>App: 16-byte challenge
App->>App: miBand234AuthResponse(key, challenge)
App->>Band: write AUTH encrypted response
Band-->>App: authentication result
alt authentication succeeds
App->>Database: upsertDevice(miband234)
else authentication fails
App->>SecureStorage: delete pairing key
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've reviewed your changes and they look great!
Sourcery assessment
Needs a human reviewer. This adds a new pairing trust boundary: it generates and installs a persistent AES key, stores it in secure storage, and uses the authentication exchange to grant access to the band. If the protocol or key lifecycle is wrong, reverting will not undo keys already installed or repair the resulting pairing; affected bands may require a factory reset, and a crypto flaw could expose authenticated access.
|
Failed to generate code suggestions for PR |
|
Failed to generate code suggestions for PR |
Paired band never got run() invoked again after the handshake — add a Sync now affordance for it on the device-detail screen (same bounded-window snapshot shape as the ring's), and best-effort call it alongside the ring at the end of every headless cycle.
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
|
Failed to generate code suggestions for PR |
1 participant
adds legacy Mi Band 2/3/4 as a pairable band — auth key exchange, banks raw notifications. no decoded signals yet, experimental until real hardware confirms it.
Summary by Sourcery
Enable experimental, pairs-only support for Mi Band 2/3/4 with local authentication and raw notification capture.
New Features:
Enhancements:
Tests: