From b849d1c01bf451ac536d5a81dedaab315e8d9057 Mon Sep 17 00:00:00 2001
From: Piero Andreini <pieroandreini@gmail.com>
Date: Tue, 31 Mar 2026 17:23:47 +0200
Subject: [PATCH] Fix TCPConsole to use runtime NodePrefs password instead of
 compile-time ADMIN_PASSWORD

---
 examples/companion_radio/main.cpp    |  5 ++++-
 examples/simple_repeater/main.cpp    |  4 +++-
 examples/simple_room_server/main.cpp |  4 +++-
 src/helpers/esp32/TCPConsole.h       | 18 ++++++++++--------
 4 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/examples/companion_radio/main.cpp b/examples/companion_radio/main.cpp
index d9a1c3df..a5c11fc1 100644
--- a/examples/companion_radio/main.cpp
+++ b/examples/companion_radio/main.cpp
@@ -4,7 +4,7 @@
 
 #if defined(ESP32) && defined(TCP_CONSOLE_PORT) && defined(ADMIN_PASSWORD)
   #include <helpers/esp32/TCPConsole.h>
-  TCPConsole tcp_console(ADMIN_PASSWORD, ADVERT_NAME);
+  TCPConsole tcp_console(nullptr);  // prefs set in setup()
 #endif
 
 // Believe it or not, this std C function is busted on some platforms!
@@ -152,6 +152,9 @@ void setup() {
   #endif
   store.begin();
   the_mesh.begin(
+
+    tcp_console.setPrefs(the_mesh.getNodePrefs());
+
     #ifdef DISPLAY_CLASS
         disp != NULL
     #else
diff --git a/examples/simple_repeater/main.cpp b/examples/simple_repeater/main.cpp
index f00b1219..1d3e5d67 100644
--- a/examples/simple_repeater/main.cpp
+++ b/examples/simple_repeater/main.cpp
@@ -5,7 +5,7 @@
 
 #if defined(ESP32) && defined(TCP_CONSOLE_PORT)
   #include <helpers/esp32/TCPConsole.h>
-  TCPConsole tcp_console(ADMIN_PASSWORD, ADVERT_NAME);
+  TCPConsole tcp_console(nullptr);  // prefs set in setup()
 #endif
 
 #ifdef DISPLAY_CLASS
@@ -104,6 +104,8 @@ void setup() {
 
   the_mesh.begin(fs);
 
+  tcp_console.setPrefs(the_mesh.getNodePrefs());
+
 #ifdef DISPLAY_CLASS
   ui_task.begin(the_mesh.getNodePrefs(), FIRMWARE_BUILD_DATE, FIRMWARE_VERSION);
 #endif
diff --git a/examples/simple_room_server/main.cpp b/examples/simple_room_server/main.cpp
index 1237c575..bda105a0 100644
--- a/examples/simple_room_server/main.cpp
+++ b/examples/simple_room_server/main.cpp
@@ -5,7 +5,7 @@
 
 #if defined(ESP32) && defined(TCP_CONSOLE_PORT)
   #include <helpers/esp32/TCPConsole.h>
-  TCPConsole tcp_console(ADMIN_PASSWORD, ADVERT_NAME);
+  TCPConsole tcp_console(nullptr);  // prefs set in setup()
 #endif
 
 #ifdef DISPLAY_CLASS
@@ -81,6 +81,8 @@ void setup() {
 
   the_mesh.begin(fs);
 
+  tcp_console.setPrefs(the_mesh.getNodePrefs());
+
 #ifdef DISPLAY_CLASS
   ui_task.begin(the_mesh.getNodePrefs(), FIRMWARE_BUILD_DATE, FIRMWARE_VERSION);
 #endif
diff --git a/src/helpers/esp32/TCPConsole.h b/src/helpers/esp32/TCPConsole.h
index cbc98d26..9e4bd797 100644
--- a/src/helpers/esp32/TCPConsole.h
+++ b/src/helpers/esp32/TCPConsole.h
@@ -6,6 +6,7 @@
 #include <WiFi.h>
 #include <WiFiClient.h>
 #include <WiFiServer.h>
+#include <helpers/CommonCLI.h>  // for NodePrefs
 
 #ifndef TCP_CONSOLE_MAX_CLIENTS
   #define TCP_CONSOLE_MAX_CLIENTS 2
@@ -22,8 +23,7 @@ class TCPConsole {
   unsigned long _last_active[TCP_CONSOLE_MAX_CLIENTS];
   char _cmd_buf[TCP_CONSOLE_MAX_CLIENTS][160];
   int _cmd_len[TCP_CONSOLE_MAX_CLIENTS];
-  const char* _password;
-  const char* _node_name;
+  NodePrefs* _prefs;  // pointer to live NodePrefs — password is read at runtime
 
   void sendToClient(int i, const char* msg) {
     if (_clients[i] && _clients[i].connected()) {
@@ -39,8 +39,8 @@ class TCPConsole {
   }
 
 public:
-  TCPConsole(const char* password, const char* node_name)
-    : _server(TCP_CONSOLE_PORT), _password(password), _node_name(node_name) {
+  TCPConsole(NodePrefs* prefs)
+    : _server(TCP_CONSOLE_PORT), _prefs(prefs) {
     for (int i = 0; i < TCP_CONSOLE_MAX_CLIENTS; i++) {
       _authenticated[i] = false;
       _cmd_buf[i][0] = 0;
@@ -54,6 +54,8 @@ public:
     Serial.printf("TCP Console listening on port %d\n", TCP_CONSOLE_PORT);
   }
 
+  void setPrefs(NodePrefs* prefs) { _prefs = prefs; }
+
   // Call this from loop(), passing the mesh's handleCommand function
   template<typename T>
   void loop(T& mesh) {
@@ -107,11 +109,11 @@ public:
         _cmd_buf[i][_cmd_len[i]] = 0;
 
         if (!_authenticated[i]) {
-          // Authentication
-          if (strcmp(_cmd_buf[i], _password) == 0) {
+          // Authentication — always read from live NodePrefs, not compile-time constant
+          if (_prefs != nullptr && strcmp(_cmd_buf[i], _prefs->password) == 0) {
             _authenticated[i] = true;
             char welcome[80];
-            snprintf(welcome, sizeof(welcome), "Welcome to %s console.\r\n> ", _node_name);
+            snprintf(welcome, sizeof(welcome), "Welcome to %s console.\r\n> ", _prefs->node_name);
             sendToClient(i, welcome);
           } else {
             sendToClient(i, "Wrong password. Disconnecting.\r\n");
@@ -139,4 +141,4 @@ public:
   }
 };
 
-#endif  // ESP32 && TCP_CONSOLE_PORT
+#endif  // ESP32 && TCP_CONSOLE_PORT && ADMIN_PASSWORD