chore: generate migration

Unify charge point command channel status
docs: update README.md
2026-03-18 15:44:43 +08:00 · 2026-03-18 15:26:56 +08:00 · 2026-03-18 13:05:49 +08:00 · 2026-03-18 12:47:56 +08:00 · 2026-03-17 01:42:29 +08:00 · 2026-03-17 01:26:12 +08:00
46 changed files with 8742 additions and 197 deletions
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ _这是一个毕业设计项目，旨在尝试实现一个完整的电动汽车

 ## 📋 项目概述

-Helios EVCS 是一个全栈解决方案，用于管理和监控电动汽车充电基础设施。项目包含后端 CSMS（充电管理系统）和前端 Web 云平台应用。并设计了一个基于 ESP32，演示用的充电桩终端固件和 PCB 设计。
+Helios EVCS 是一个全栈解决方案，用于管理和监控电动汽车充电基础设施。项目包含 CSMS（充电管理系统）的前端应用和后端服务。并设计了一个基于 ESP32 的，可演示用的充电桩终端固件和 PCB 设计。

 ## 🏗️ 项目结构

@@ -15,19 +15,18 @@ helios-evcs/
 │   └── web/                       # 前端云平台应用（Next.js 15 + React 19）[submodule]
 ├── hardware/                      # 硬件和固件工程
 │   ├── firmware/                  # 充电桩固件
-│   └── pcb-kicad/                 # PCB 设计文件（KiCAD）
+│   └── pcb/                       # PCB 设计文件（KiCAD）
 ├── package.json
 ├── pnpm-workspace.yaml
-├── pnpm-lock.yaml
-└── .gitmodules
+└── pnpm-lock.yaml
 ```

 ## 📦 工作区包

-### `apps/csms` - 充电管理系统后端
+### `apps/csms` - CSMS 后端

 - **技术栈**：Node.js + Hono + TypeScript
- **端口**：3001（默认）
+- **端口**：3001
 - **职责**：
  - OCPP 协议实现
  - 充电设备管理
@@ -35,16 +34,17 @@ helios-evcs/
  - 实时数据处理
  - RESTful API 接口

-### `apps/web` - 前端管理界面（子模块）
+### `apps/web` - CSMS 前端

- **技术栈**：Next.js 15 + React 19 + Tailwind CSS
- **端口**：3000（默认）
- **源仓库**：https://github.com/HoshinoSuzumi/helios
+- **技术栈**：Next.js 16 + React 19 + Tailwind CSS
+- **端口**：3000
 - **职责**：
-  - 充电站管理界面
-  - 实时监控面板
-  - 数据可视化
+  - 充电桩管理
+  - 概览监控面板
+  - 储值卡管理
  - 用户管理
+  - 充电会话历史
+  - 远程启动/停止充电

 ### `hardware/` - 硬件和固件工程

@@ -52,17 +52,18 @@ helios-evcs/
  - 设备驱动实现
  - 通信协议栈
  - 实时控制逻辑
- **pcb-kicad/** - PCB 电路板设计
+- **pcb/** - PCB 电路板设计
  - KiCAD 工程文件
  - 电路原理图
  - PCB 布局设计
  - BOM 物料清单
+  - 制造文件（Gerber）

 ## 🚀 快速开始

 ### 前置要求

- Node.js >= 18
+- Node.js >= 20
 - pnpm >= 10.18.2

 ### 安装依赖
@@ -78,6 +79,8 @@ pnpm install
 # 启动所有开发服务器（CSMS + Web）
 pnpm dev

+# 迁移数据库
+pnpm --filter csms run db:migrate
 # 仅启动后端
 pnpm dev:csms

@@ -111,21 +114,11 @@ pnpm start:csms

 # 启动前端
 pnpm start:web
+
+# 生产环境使用 docker compose
+docker compose up -d --build
 ```

-## 📝 Scripts 说明
-
-| 命令              | 描述                   |
-| ----------------- | ---------------------- |
-| `pnpm dev`        | 启动所有服务的开发模式 |
-| `pnpm dev:csms`   | 启动后端开发服务器     |
-| `pnpm dev:web`    | 启动前端开发服务器     |
-| `pnpm build`      | 构建所有包             |
-| `pnpm build:csms` | 构建后端               |
-| `pnpm build:web`  | 构建前端               |
-| `pnpm start:csms` | 生产环境启动后端       |
-| `pnpm start:web`  | 生产环境启动前端       |
-
 ## 🔧 工作区管理

 ### 使用 pnpm filter 运行特定包命令
@@ -133,7 +126,7 @@ pnpm start:web
 ```bash
 # 在指定包中运行命令
 pnpm --filter csms <command>
-pnpm --filter helios-web <command>
+pnpm --filter web <command>

 # 示例：在 csms 中运行测试
 pnpm --filter csms run test
@@ -143,42 +136,11 @@ pnpm --filter csms run test

 ```bash
 # 在根安装（所有包共用）
-pnpm add <package>
+pnpm add <package> -w

 # 在特定包中安装
 pnpm --filter csms add <package>
-pnpm --filter helios-web add <package>
-```
-
-## 📁 Git 子模块管理
-
-`apps/web` 作为 Git 子模块管理：
-
-```bash
-# 初始化并更新子模块
-git submodule update --init --recursive
-
-# 更新子模块到最新版本
-git submodule update --remote
-
-# 克隆包含子模块的仓库
-git clone --recurse-submodules <repo-url>
-```
-
-在子模块内修改后的工作流：
-
-```bash
-# 在 apps/web 目录内提交更改
-cd apps/web
-git add .
-git commit -m "feat: xxx"
-git push
-
-# 返回主仓库，更新子模块引用
-cd ..
-git add apps/web
-git commit -m "chore: update helios submodule"
-git push
+pnpm --filter web add <package>
 ```

 ## 📚 技术文档
--- a/apps/csms/drizzle/0005_peaceful_anthem.sql
+++ b/apps/csms/drizzle/0005_peaceful_anthem.sql
@@ -0,0 +1 @@
+ALTER TABLE "charge_point" ADD COLUMN "password_hash" varchar(255);
--- a/apps/csms/drizzle/0006_spooky_skin.sql
+++ b/apps/csms/drizzle/0006_spooky_skin.sql
@@ -0,0 +1,6 @@
+CREATE TABLE "system_setting" (
+	"key" varchar(64) PRIMARY KEY NOT NULL,
+	"value" jsonb NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
--- a/apps/csms/drizzle/0007_unusual_squadron_supreme.sql
+++ b/apps/csms/drizzle/0007_unusual_squadron_supreme.sql
@@ -0,0 +1,9 @@
+ALTER TABLE "charge_point" ADD COLUMN "last_ws_connected_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "charge_point" ADD COLUMN "last_ws_disconnected_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "charge_point" ADD COLUMN "connection_session_id" varchar(64);--> statement-breakpoint
+ALTER TABLE "charge_point" ADD COLUMN "transport_status" varchar DEFAULT 'offline' NOT NULL;--> statement-breakpoint
+ALTER TABLE "charge_point" ADD COLUMN "last_command_status" varchar;--> statement-breakpoint
+ALTER TABLE "charge_point" ADD COLUMN "last_command_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "transaction" ADD COLUMN "remote_stop_requested_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "transaction" ADD COLUMN "remote_stop_request_id" varchar(64);--> statement-breakpoint
+ALTER TABLE "transaction" ADD COLUMN "remote_stop_status" varchar;
--- a/apps/csms/drizzle/meta/0005_snapshot.json
+++ b/apps/csms/drizzle/meta/0005_snapshot.json
--- a/apps/csms/drizzle/meta/0006_snapshot.json
+++ b/apps/csms/drizzle/meta/0006_snapshot.json
--- a/apps/csms/drizzle/meta/0007_snapshot.json
+++ b/apps/csms/drizzle/meta/0007_snapshot.json
--- a/apps/csms/drizzle/meta/_journal.json
+++ b/apps/csms/drizzle/meta/_journal.json
@@ -36,6 +36,27 @@
      "when": 1773639782622,
      "tag": "0004_nervous_frog_thor",
      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1773678571220,
+      "tag": "0005_peaceful_anthem",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1773682931777,
+      "tag": "0006_spooky_skin",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1773819865056,
+      "tag": "0007_unusual_squadron_supreme",
+      "breakpoints": true
    }
  ]
 }
--- a/apps/csms/src/db/ocpp-schema.ts
+++ b/apps/csms/src/db/ocpp-schema.ts
@@ -62,6 +62,29 @@ export const chargePoint = pgTable('charge_point', {
  heartbeatInterval: integer('heartbeat_interval').default(60),
  /** 最后一次收到 Heartbeat.req 的时间（UTC） */
  lastHeartbeatAt: timestamp('last_heartbeat_at', { withTimezone: true }),
+  /** 最近一次 WebSocket 连接建立时间（UTC） */
+  lastWsConnectedAt: timestamp('last_ws_connected_at', { withTimezone: true }),
+  /** 最近一次 WebSocket 连接关闭时间（UTC） */
+  lastWsDisconnectedAt: timestamp('last_ws_disconnected_at', { withTimezone: true }),
+  /** 最近一次活跃 WebSocket 会话 ID（用于区分重连代次） */
+  connectionSessionId: varchar('connection_session_id', { length: 64 }),
+  /**
+   * OCPP 传输通道状态：
+   * online = 当前实例持有活动 WebSocket
+   * unavailable = 最近有心跳，但当前无可用下行通道
+   * offline = 无活动通道
+   */
+  transportStatus: varchar('transport_status', {
+    enum: ['online', 'unavailable', 'offline'],
+  })
+    .notNull()
+    .default('offline'),
+  /** 最近一次下行命令确认结果 */
+  lastCommandStatus: varchar('last_command_status', {
+    enum: ['Accepted', 'Rejected', 'Error', 'Timeout'],
+  }),
+  /** 最近一次下行命令确认时间（UTC） */
+  lastCommandAt: timestamp('last_command_at', { withTimezone: true }),
  /** 最后一次收到 BootNotification.req 的时间（UTC） */
  lastBootNotificationAt: timestamp('last_boot_notification_at', {
    withTimezone: true,
@@ -85,6 +108,12 @@ export const chargePoint = pgTable('charge_point', {
  pricingMode: varchar('pricing_mode', { enum: ['fixed', 'tou'] })
    .notNull()
    .default('fixed'),
+  /**
+   * OCPP Security Profile 1/2: HTTP Basic Auth 密码哈希（scrypt）
+   * 格式：<salt>:<hash>，均为 hex 编码
+   * 首次创建充电桩时自动生成，明文密码仅在创建/重置时返回一次
+   */
+  passwordHash: varchar('password_hash', { length: 255 }),
  createdAt: timestamp('created_at', { withTimezone: true })
    .notNull()
    .defaultNow(),
@@ -392,6 +421,16 @@ export const transaction = pgTable(
        'DeAuthorized',
      ],
    }),
+    /** 管理端发起远程停止的请求时间 */
+    remoteStopRequestedAt: timestamp('remote_stop_requested_at', {
+      withTimezone: true,
+    }),
+    /** 管理端发起远程停止的 OCPP uniqueId */
+    remoteStopRequestId: varchar('remote_stop_request_id', { length: 64 }),
+    /** 最近一次远程停止请求的结果 */
+    remoteStopStatus: varchar('remote_stop_status', {
+      enum: ['Requested', 'Accepted', 'Rejected', 'Error', 'Timeout'],
+    }),
    /**
     * 本次充电扣费金额（单位：分）
     * 由 StopTransaction 处理时根据实际用电量和充电桩电价计算写入
--- a/apps/csms/src/db/schema.ts
+++ b/apps/csms/src/db/schema.ts
@@ -1,4 +1,4 @@
 export * from './auth-schema.ts'
 export * from './ocpp-schema.ts'
 export * from './tariff-schema.ts'
-export * from './tariff-schema.ts'
+export * from './settings-schema.ts'
--- a/apps/csms/src/db/settings-schema.ts
+++ b/apps/csms/src/db/settings-schema.ts
@@ -0,0 +1,15 @@
+import { jsonb, pgTable, timestamp, varchar } from "drizzle-orm/pg-core";
+
+/**
+ * 系统参数配置（按模块 key 存储）
+ * 例如：key=ocpp16j, value={ heartbeatInterval: 60 }
+ */
+export const systemSetting = pgTable("system_setting", {
+  key: varchar("key", { length: 64 }).primaryKey(),
+  value: jsonb("value").notNull().$type<Record<string, unknown>>(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .notNull()
+    .defaultNow()
+    .$onUpdate(() => new Date()),
+});
--- a/apps/csms/src/index.ts
+++ b/apps/csms/src/index.ts
@@ -8,6 +8,10 @@ import { logger } from 'hono/logger'
 import { showRoutes } from 'hono/dev'
 import { auth } from './lib/auth.ts'
 import { createOcppHandler } from './ocpp/handler.ts'
+import { verifyOcppPassword } from './lib/ocpp-auth.ts'
+import { useDrizzle } from './lib/db.ts'
+import { chargePoint } from './db/schema.ts'
+import { eq } from 'drizzle-orm'
 import statsRoutes from './routes/stats.ts'
 import statsChartRoutes from './routes/stats-chart.ts'
 import chargePointRoutes from './routes/charge-points.ts'
@@ -16,6 +20,7 @@ import idTagRoutes from './routes/id-tags.ts'
 import userRoutes from './routes/users.ts'
 import setupRoutes from './routes/setup.ts'
 import tariffRoutes from './routes/tariff.ts'
+import settingsRoutes from './routes/settings.ts'

 import type { HonoEnv } from './types/hono.ts'

@@ -60,6 +65,7 @@ app.route('/api/id-tags', idTagRoutes)
 app.route('/api/users', userRoutes)
 app.route('/api/setup', setupRoutes)
 app.route('/api/tariff', tariffRoutes)
+app.route('/api/settings', settingsRoutes)

 app.get('/api', (c) => {
  const user = c.get('user')
@@ -83,11 +89,45 @@ app.get('/api', (c) => {

 app.get(
  '/ocpp/:chargePointId',
+  async (c, next) => {
+    const chargePointId = c.req.param('chargePointId')
+    const authHeader = c.req.header('Authorization')
+
+    if (!authHeader?.startsWith('Basic ')) {
+      c.header('WWW-Authenticate', 'Basic realm="OCPP"')
+      return c.json({ error: 'Unauthorized' }, 401)
+    }
+
+    let id: string, password: string
+    try {
+      const decoded = atob(authHeader.slice(6))
+      const colonIdx = decoded.indexOf(':')
+      if (colonIdx === -1) throw new Error('Invalid format')
+      id = decoded.slice(0, colonIdx)
+      password = decoded.slice(colonIdx + 1)
+    } catch {
+      return c.json({ error: 'Invalid Authorization header' }, 400)
+    }
+
+    if (id !== chargePointId) {
+      return c.json({ error: 'Unauthorized' }, 401)
+    }
+
+    const db = useDrizzle()
+    const [cp] = await db
+      .select({ passwordHash: chargePoint.passwordHash })
+      .from(chargePoint)
+      .where(eq(chargePoint.chargePointIdentifier, chargePointId))
+      .limit(1)
+
+    if (!cp?.passwordHash || !(await verifyOcppPassword(password, cp.passwordHash))) {
+      return c.json({ error: 'Unauthorized' }, 401)
+    }
+
+    await next()
+  },
  upgradeWebSocket((c) => {
    const chargePointId = c.req.param('chargePointId')
-    if (!chargePointId) {
-      throw new Error('Missing chargePointId parameter')
-    }
    const connInfo = getConnInfo(c)
    return createOcppHandler(chargePointId, connInfo.remote.address)
  }),
--- a/apps/csms/src/lib/ocpp-auth.ts
+++ b/apps/csms/src/lib/ocpp-auth.ts
@@ -0,0 +1,32 @@
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto'
+import { promisify } from 'node:util'
+
+const scryptAsync = promisify(scrypt)
+
+const SALT_LEN = 16
+const KEY_LEN = 64
+
+/** 生成随机明文密码（24 位 hex 字符串） */
+export function generateOcppPassword(): string {
+  return randomBytes(12).toString('hex')
+}
+
+/** 将明文密码哈希为存储格式 `<salt_hex>:<hash_hex>` */
+export async function hashOcppPassword(password: string): Promise<string> {
+  const salt = randomBytes(SALT_LEN)
+  const hash = (await scryptAsync(password, salt, KEY_LEN)) as Buffer
+  return `${salt.toString('hex')}:${hash.toString('hex')}`
+}
+
+/** 验证明文密码是否与存储的哈希匹配 */
+export async function verifyOcppPassword(
+  password: string,
+  stored: string,
+): Promise<boolean> {
+  const [saltHex, hashHex] = stored.split(':')
+  if (!saltHex || !hashHex) return false
+  const salt = Buffer.from(saltHex, 'hex')
+  const expectedHash = Buffer.from(hashHex, 'hex')
+  const actualHash = (await scryptAsync(password, salt, KEY_LEN)) as Buffer
+  return timingSafeEqual(expectedHash, actualHash)
+}
--- a/apps/csms/src/lib/system-settings.ts
+++ b/apps/csms/src/lib/system-settings.ts
@@ -0,0 +1,45 @@
+import { eq } from "drizzle-orm";
+import { systemSetting } from "@/db/schema.js";
+import { useDrizzle } from "@/lib/db.js";
+
+export const SETTINGS_KEY_OCPP16J = "ocpp16j";
+const DEFAULT_HEARTBEAT_INTERVAL = 60;
+const MIN_HEARTBEAT_INTERVAL = 10;
+const MAX_HEARTBEAT_INTERVAL = 86400;
+
+export type Ocpp16jSettings = {
+  heartbeatInterval: number;
+};
+
+export type SettingsPayload = {
+  ocpp16j: Ocpp16jSettings;
+};
+
+export function sanitizeHeartbeatInterval(raw: unknown): number {
+  if (typeof raw !== "number" || !Number.isFinite(raw)) {
+    return DEFAULT_HEARTBEAT_INTERVAL;
+  }
+  const n = Math.round(raw);
+  if (n < MIN_HEARTBEAT_INTERVAL) return MIN_HEARTBEAT_INTERVAL;
+  if (n > MAX_HEARTBEAT_INTERVAL) return MAX_HEARTBEAT_INTERVAL;
+  return n;
+}
+
+export function getDefaultHeartbeatInterval(): number {
+  return DEFAULT_HEARTBEAT_INTERVAL;
+}
+
+export async function getOcpp16jSettings(): Promise<Ocpp16jSettings> {
+  const db = useDrizzle();
+  const [ocpp16jRow] = await db
+    .select()
+    .from(systemSetting)
+    .where(eq(systemSetting.key, SETTINGS_KEY_OCPP16J))
+    .limit(1);
+
+  const ocpp16jRaw = (ocpp16jRow?.value ?? {}) as Record<string, unknown>;
+
+  return {
+    heartbeatInterval: sanitizeHeartbeatInterval(ocpp16jRaw.heartbeatInterval),
+  };
+}
--- a/apps/csms/src/ocpp/actions/boot-notification.ts
+++ b/apps/csms/src/ocpp/actions/boot-notification.ts
@@ -1,19 +1,19 @@
 import { useDrizzle } from '@/lib/db.js'
 import dayjs from 'dayjs'
 import { chargePoint } from '@/db/schema.js'
+import { getOcpp16jSettings } from '@/lib/system-settings.js'
 import type {
  BootNotificationRequest,
  BootNotificationResponse,
  OcppConnectionContext,
 } from '../types.ts'

-const DEFAULT_HEARTBEAT_INTERVAL = 60
-
 export async function handleBootNotification(
  payload: BootNotificationRequest,
  ctx: OcppConnectionContext,
 ): Promise<BootNotificationResponse> {
  const db = useDrizzle()
+  const { heartbeatInterval } = await getOcpp16jSettings()

  const [cp] = await db
    .insert(chargePoint)
@@ -30,8 +30,9 @@ export async function handleBootNotification(
      meterSerialNumber: payload.meterSerialNumber ?? null,
      // New, unknown devices start as Pending — admin must manually accept them
      registrationStatus: 'Pending',
-      heartbeatInterval: DEFAULT_HEARTBEAT_INTERVAL,
+      heartbeatInterval,
      lastBootNotificationAt: dayjs().toDate(),
+      transportStatus: 'online',
    })
    .onConflictDoUpdate({
      target: chargePoint.chargePointIdentifier,
@@ -45,8 +46,9 @@ export async function handleBootNotification(
        meterType: payload.meterType ?? null,
        meterSerialNumber: payload.meterSerialNumber ?? null,
        // Do NOT override registrationStatus — preserve whatever the admin set
-        heartbeatInterval: DEFAULT_HEARTBEAT_INTERVAL,
+        heartbeatInterval,
        lastBootNotificationAt: dayjs().toDate(),
+        transportStatus: 'online',
        updatedAt: dayjs().toDate(),
      },
    })
@@ -59,7 +61,7 @@ export async function handleBootNotification(

  return {
    currentTime: dayjs().toISOString(),
-    interval: DEFAULT_HEARTBEAT_INTERVAL,
+    interval: heartbeatInterval,
    status,
  }
 }
--- a/apps/csms/src/ocpp/actions/heartbeat.ts
+++ b/apps/csms/src/ocpp/actions/heartbeat.ts
@@ -16,7 +16,11 @@ export async function handleHeartbeat(

  await db
    .update(chargePoint)
-    .set({ lastHeartbeatAt: dayjs().toDate() })
+    .set({
+      lastHeartbeatAt: dayjs().toDate(),
+      transportStatus: 'online',
+      updatedAt: dayjs().toDate(),
+    })
    .where(eq(chargePoint.chargePointIdentifier, ctx.chargePointIdentifier))

  return {
--- a/apps/csms/src/ocpp/actions/start-transaction.ts
+++ b/apps/csms/src/ocpp/actions/start-transaction.ts
@@ -73,7 +73,7 @@ export async function handleStartTransaction(
  if (rejected) {
    await db
      .update(connector)
-      .set({ status: "Available", updatedAt: now })
+      .set({ status: "Available", updatedAt: now.toDate() })
      .where(eq(connector.id, conn.id));
  }

--- a/apps/csms/src/ocpp/actions/stop-transaction.ts
+++ b/apps/csms/src/ocpp/actions/stop-transaction.ts
@@ -26,6 +26,11 @@ export async function handleStopTransaction(
      stopMeterValue: payload.meterStop,
      stopIdTag: payload.idTag ?? null,
      stopReason: (payload.reason as (typeof transaction.$inferSelect)["stopReason"]) ?? null,
+      remoteStopStatus: sql`case
+        when ${transaction.remoteStopRequestedAt} is not null and coalesce(${transaction.remoteStopStatus}, 'Requested') in ('Requested', 'Accepted')
+          then 'Accepted'
+        else ${transaction.remoteStopStatus}
+      end`,
      updatedAt: dayjs().toDate(),
    })
    .where(eq(transaction.id, payload.transactionId))
--- a/apps/csms/src/ocpp/handler.ts
+++ b/apps/csms/src/ocpp/handler.ts
@@ -1,11 +1,18 @@
 import type { WSContext } from 'hono/ws'
+import dayjs from 'dayjs'
+import { eq } from 'drizzle-orm'
 import { isSupportedOCPP } from '@/constants.js'
+import { useDrizzle } from '@/lib/db.js'
+import { chargePoint } from '@/db/schema.js'
 import {
  OCPP_MESSAGE_TYPE,
  type OcppCall,
+  type OcppCallErrorMessage,
+  type OcppCallResultMessage,
  type OcppErrorCode,
  type OcppMessage,
  type OcppConnectionContext,
+  type CommandChannelStatus,
  type AuthorizeRequest,
  type AuthorizeResponse,
  type BootNotificationRequest,
@@ -24,9 +31,26 @@ import {

 /**
 * Global registry of active OCPP WebSocket connections.
- * Key = chargePointIdentifier, Value = WSContext
+ * Key = chargePointIdentifier, Value = connection entry
 */
-export const ocppConnections = new Map<string, WSContext>()
+export type OcppConnectionEntry = {
+  ws: WSContext
+  sessionId: string
+  openedAt: Date
+  lastMessageAt: Date
+}
+
+type PendingCall =
+  | {
+      chargePointIdentifier: string
+      action: string
+      resolve: (payload: unknown) => void
+      reject: (error: Error) => void
+      timeout: ReturnType<typeof setTimeout>
+    }
+
+export const ocppConnections = new Map<string, OcppConnectionEntry>()
+const pendingCalls = new Map<string, PendingCall>()
 import { handleAuthorize } from './actions/authorize.ts'
 import { handleBootNotification } from './actions/boot-notification.ts'
 import { handleHeartbeat } from './actions/heartbeat.ts'
@@ -92,6 +116,80 @@ function sendCallError(
  )
 }

+async function updateTransportState(
+  chargePointIdentifier: string,
+  values: Partial<typeof chargePoint.$inferInsert>,
+): Promise<void> {
+  const db = useDrizzle()
+  await db
+    .update(chargePoint)
+    .set({
+      ...values,
+      updatedAt: dayjs().toDate(),
+    })
+    .where(eq(chargePoint.chargePointIdentifier, chargePointIdentifier))
+}
+
+function getCommandChannelStatus(chargePointIdentifier: string): CommandChannelStatus {
+  return ocppConnections.has(chargePointIdentifier) ? 'online' : 'unavailable'
+}
+
+export async function sendOcppCall<TPayload extends Record<string, unknown>, TResult = unknown>(
+  chargePointIdentifier: string,
+  action: string,
+  payload: TPayload,
+  timeoutOrOptions: number | { timeoutMs?: number; uniqueId?: string } = 15000,
+): Promise<TResult> {
+  const entry = ocppConnections.get(chargePointIdentifier)
+  if (!entry) {
+    await updateTransportState(chargePointIdentifier, { transportStatus: 'unavailable' })
+    throw new Error('TransportUnavailable')
+  }
+
+  const timeoutMs =
+    typeof timeoutOrOptions === 'number' ? timeoutOrOptions : (timeoutOrOptions.timeoutMs ?? 15000)
+  const uniqueId =
+    typeof timeoutOrOptions === 'number' ? crypto.randomUUID() : (timeoutOrOptions.uniqueId ?? crypto.randomUUID())
+
+  const resultPromise = new Promise<TResult>((resolve, reject) => {
+    const timeout = setTimeout(async () => {
+      pendingCalls.delete(uniqueId)
+      await updateTransportState(chargePointIdentifier, {
+        transportStatus: getCommandChannelStatus(chargePointIdentifier),
+        lastCommandStatus: 'Timeout',
+        lastCommandAt: dayjs().toDate(),
+      })
+      reject(new Error('CommandTimeout'))
+    }, timeoutMs)
+
+    pendingCalls.set(uniqueId, {
+      chargePointIdentifier,
+      action,
+      resolve: (response) => resolve(response as TResult),
+      reject,
+      timeout,
+    })
+  })
+
+  try {
+    entry.ws.send(JSON.stringify([OCPP_MESSAGE_TYPE.CALL, uniqueId, action, payload]))
+  } catch (error) {
+    const pending = pendingCalls.get(uniqueId)
+    if (pending) {
+      clearTimeout(pending.timeout)
+      pendingCalls.delete(uniqueId)
+    }
+    await updateTransportState(chargePointIdentifier, {
+      transportStatus: 'unavailable',
+      lastCommandStatus: 'Error',
+      lastCommandAt: dayjs().toDate(),
+    })
+    throw error instanceof Error ? error : new Error('CommandSendFailed')
+  }
+
+  return resultPromise
+}
+
 /**
 * Factory that produces a hono-ws event handler object for a single
 * OCPP WebSocket connection.
@@ -104,15 +202,26 @@ export function createOcppHandler(chargePointIdentifier: string, remoteAddr?: st
    chargePointIdentifier,
    isRegistered: false,
  }
+  const sessionId = crypto.randomUUID()

  return {
-    onOpen(_evt: Event, ws: WSContext) {
+    async onOpen(_evt: Event, ws: WSContext) {
      const subProtocol = ws.protocol ?? 'unknown'
      if (!isSupportedOCPP(subProtocol)) {
        ws.close(1002, 'Unsupported subprotocol')
        return
      }
-      ocppConnections.set(chargePointIdentifier, ws)
+      ocppConnections.set(chargePointIdentifier, {
+        ws,
+        sessionId,
+        openedAt: new Date(),
+        lastMessageAt: new Date(),
+      })
+      await updateTransportState(chargePointIdentifier, {
+        transportStatus: 'online',
+        connectionSessionId: sessionId,
+        lastWsConnectedAt: dayjs().toDate(),
+      })
      console.log(
        `[OCPP] ${chargePointIdentifier} connected` +
          (remoteAddr ? ` from ${remoteAddr}` : ''),
@@ -122,6 +231,11 @@ export function createOcppHandler(chargePointIdentifier: string, remoteAddr?: st
    async onMessage(evt: MessageEvent, ws: WSContext) {
      let uniqueId = '(unknown)'
      try {
+        const current = ocppConnections.get(chargePointIdentifier)
+        if (current) {
+          current.lastMessageAt = new Date()
+        }
+
        const raw = evt.data
        if (typeof raw !== 'string') return

@@ -141,7 +255,36 @@ export function createOcppHandler(chargePointIdentifier: string, remoteAddr?: st
        const [messageType, msgUniqueId] = message
        uniqueId = String(msgUniqueId)

-        // CSMS only handles CALL messages from the charge point
+        if (messageType === OCPP_MESSAGE_TYPE.CALLRESULT) {
+          const [, responseUniqueId, payload] = message as OcppCallResultMessage
+          const pending = pendingCalls.get(responseUniqueId)
+          if (!pending) return
+          clearTimeout(pending.timeout)
+          pendingCalls.delete(responseUniqueId)
+          await updateTransportState(pending.chargePointIdentifier, {
+            transportStatus: getCommandChannelStatus(pending.chargePointIdentifier),
+            lastCommandStatus: 'Accepted',
+            lastCommandAt: dayjs().toDate(),
+          })
+          pending.resolve(payload)
+          return
+        }
+
+        if (messageType === OCPP_MESSAGE_TYPE.CALLERROR) {
+          const [, responseUniqueId, errorCode, errorDescription] = message as OcppCallErrorMessage
+          const pending = pendingCalls.get(responseUniqueId)
+          if (!pending) return
+          clearTimeout(pending.timeout)
+          pendingCalls.delete(responseUniqueId)
+          await updateTransportState(pending.chargePointIdentifier, {
+            transportStatus: getCommandChannelStatus(pending.chargePointIdentifier),
+            lastCommandStatus: errorCode === 'InternalError' ? 'Error' : 'Rejected',
+            lastCommandAt: dayjs().toDate(),
+          })
+          pending.reject(new Error(`${errorCode}:${errorDescription}`))
+          return
+        }
+
        if (messageType !== OCPP_MESSAGE_TYPE.CALL) return

        const [, , action, payload] = message as OcppCall
@@ -174,8 +317,15 @@ export function createOcppHandler(chargePointIdentifier: string, remoteAddr?: st
      }
    },

-    onClose(evt: CloseEvent, _ws: WSContext) {
-      ocppConnections.delete(chargePointIdentifier)
+    async onClose(evt: CloseEvent, _ws: WSContext) {
+      const current = ocppConnections.get(chargePointIdentifier)
+      if (current?.sessionId === sessionId) {
+        ocppConnections.delete(chargePointIdentifier)
+        await updateTransportState(chargePointIdentifier, {
+          transportStatus: 'offline',
+          lastWsDisconnectedAt: dayjs().toDate(),
+        })
+      }
      console.log(`[OCPP] ${chargePointIdentifier} disconnected (code=${evt.code})`)
    },
  }
--- a/apps/csms/src/ocpp/types.ts
+++ b/apps/csms/src/ocpp/types.ts
@@ -34,6 +34,11 @@ export type OcppConnectionContext = {
  isRegistered: boolean
 }

+export type OcppCallResultMessage = [3, string, Record<string, unknown>]
+export type OcppCallErrorMessage = [4, string, OcppErrorCode, string, Record<string, unknown>]
+
+export type CommandChannelStatus = 'online' | 'unavailable' | 'offline'
+
 // ---------------------------------------------------------------------------
 // Action payload types (OCPP 1.6-J Section 4.x)
 // ---------------------------------------------------------------------------
--- a/apps/csms/src/routes/charge-points.ts
+++ b/apps/csms/src/routes/charge-points.ts
@@ -1,9 +1,10 @@
 import { Hono } from "hono";
-import { desc, eq, sql } from "drizzle-orm";
+import { desc, eq, sql, inArray } from "drizzle-orm";
 import dayjs from "dayjs";
 import { useDrizzle } from "@/lib/db.js";
 import { chargePoint, connector } from "@/db/schema.js";
 import { ocppConnections } from "@/ocpp/handler.js";
+import { generateOcppPassword, hashOcppPassword } from "@/lib/ocpp-auth.js";
 import type { HonoEnv } from "@/types/hono.ts";

 const app = new Hono<HonoEnv>();
@@ -84,6 +85,9 @@ app.post("/", async (c) => {
    return c.json({ error: "pricingMode must be 'fixed' or 'tou'" }, 400);
  }

+  const plainPassword = generateOcppPassword()
+  const passwordHash = await hashOcppPassword(plainPassword)
+
  const [created] = await db
    .insert(chargePoint)
    .values({
@@ -95,6 +99,7 @@ app.post("/", async (c) => {
      feePerKwh: body.feePerKwh ?? 0,
      pricingMode: body.pricingMode ?? "fixed",
      deviceName: body.deviceName?.trim() || null,
+      passwordHash,
    })
    .returning()
    .catch((err: Error) => {
@@ -102,7 +107,8 @@ app.post("/", async (c) => {
      throw err;
    });

-  return c.json({ ...created, connectors: [] }, 201);
+  // 明文密码仅在创建时返回一次，之后不可再查
+  return c.json({ ...created, passwordHash: undefined, plainPassword, connectors: [] }, 201);
 });

 /** GET /api/charge-points/connections  —  list currently active OCPP WebSocket connections */
@@ -215,4 +221,25 @@ app.delete("/:id", async (c) => {
  return c.json({ success: true });
 });

+/** POST /api/charge-points/:id/reset-password  —  regenerate OCPP Basic Auth password */
+app.post("/:id/reset-password", async (c) => {
+  if (c.get("user")?.role !== "admin") return c.json({ error: "Forbidden" }, 403);
+  const db = useDrizzle();
+  const id = c.req.param("id");
+
+  const plainPassword = generateOcppPassword();
+  const passwordHash = await hashOcppPassword(plainPassword);
+
+  const [updated] = await db
+    .update(chargePoint)
+    .set({ passwordHash })
+    .where(eq(chargePoint.id, id))
+    .returning({ id: chargePoint.id, chargePointIdentifier: chargePoint.chargePointIdentifier });
+
+  if (!updated) return c.json({ error: "Not found" }, 404);
+
+  // 明文密码仅返回一次
+  return c.json({ ...updated, plainPassword });
+});
+
 export default app;
--- a/apps/csms/src/routes/settings.ts
+++ b/apps/csms/src/routes/settings.ts
@@ -0,0 +1,65 @@
+import { Hono } from "hono";
+import { useDrizzle } from "@/lib/db.js";
+import { systemSetting } from "@/db/schema.js";
+import type { HonoEnv } from "@/types/hono.ts";
+import {
+  SETTINGS_KEY_OCPP16J,
+  getOcpp16jSettings,
+  sanitizeHeartbeatInterval,
+  type SettingsPayload,
+} from "@/lib/system-settings.js";
+
+const app = new Hono<HonoEnv>();
+
+app.get("/", async (c) => {
+  const payload: SettingsPayload = {
+    ocpp16j: await getOcpp16jSettings(),
+  };
+
+  return c.json(payload);
+});
+
+app.put("/", async (c) => {
+  const currentUser = c.get("user");
+  if (currentUser?.role !== "admin") {
+    return c.json({ error: "Forbidden" }, 403);
+  }
+
+  let body: Partial<SettingsPayload>;
+  try {
+    body = await c.req.json<Partial<SettingsPayload>>();
+  } catch {
+    return c.json({ error: "Invalid JSON" }, 400);
+  }
+
+  if (!body.ocpp16j) {
+    return c.json({ error: "Missing ocpp16j settings" }, 400);
+  }
+
+  const heartbeatInterval = sanitizeHeartbeatInterval(body.ocpp16j.heartbeatInterval);
+
+  const db = useDrizzle();
+  await db
+    .insert(systemSetting)
+    .values({
+      key: SETTINGS_KEY_OCPP16J,
+      value: { heartbeatInterval },
+    })
+    .onConflictDoUpdate({
+      target: systemSetting.key,
+      set: {
+        value: { heartbeatInterval },
+        updatedAt: new Date(),
+      },
+    });
+
+  const payload: SettingsPayload = {
+    ocpp16j: {
+      heartbeatInterval,
+    },
+  };
+
+  return c.json(payload);
+});
+
+export default app;
--- a/apps/csms/src/routes/stats.ts
+++ b/apps/csms/src/routes/stats.ts
@@ -26,7 +26,9 @@ app.get("/", async (c) => {
      db
        .select({ count: sql<number>`count(*)::int` })
        .from(chargePoint)
-        .where(sql`${chargePoint.lastHeartbeatAt} > now() - interval '120 seconds'`),
+        .where(
+          sql`${chargePoint.transportStatus} = 'online' and ${chargePoint.lastHeartbeatAt} > now() - interval '120 seconds'`,
+        ),
      db
        .select({ count: sql<number>`count(*)::int` })
        .from(transaction)
--- a/apps/csms/src/routes/transactions.ts
+++ b/apps/csms/src/routes/transactions.ts
@@ -5,8 +5,7 @@ import { useDrizzle } from "@/lib/db.js";
 import { transaction, chargePoint, connector, idTag } from "@/db/schema.js";
 import type { SampledValue } from "@/db/schema.js";
 import { user } from "@/db/auth-schema.js";
-import { ocppConnections } from "@/ocpp/handler.js";
-import { OCPP_MESSAGE_TYPE } from "@/ocpp/types.js";
+import { sendOcppCall } from "@/ocpp/handler.js";
 import { resolveIdTagInfo } from "@/ocpp/actions/authorize.js";
 import type { HonoEnv } from "@/types/hono.ts";

@@ -84,19 +83,28 @@ app.post("/remote-start", async (c) => {
    return c.json({ error: "ChargePoint is not accepted" }, 400);
  }

-  // Require the charge point to be online
-  const ws = ocppConnections.get(body.chargePointIdentifier.trim());
-  if (!ws) return c.json({ error: "ChargePoint is offline" }, 503);
+  try {
+    const response = await sendOcppCall<
+      { connectorId: number; idTag: string },
+      { status?: string }
+    >(body.chargePointIdentifier.trim(), "RemoteStartTransaction", {
+      connectorId: body.connectorId,
+      idTag: body.idTag.trim(),
+    })

-  const uniqueId = crypto.randomUUID();
-  ws.send(
-    JSON.stringify([
-      OCPP_MESSAGE_TYPE.CALL,
-      uniqueId,
-      "RemoteStartTransaction",
-      { connectorId: body.connectorId, idTag: body.idTag.trim() },
-    ]),
-  );
+    if (response?.status && response.status !== "Accepted") {
+      return c.json({ error: `RemoteStartTransaction ${response.status}` }, 409)
+    }
+  } catch (error) {
+    const message = error instanceof Error ? error.message : "CommandSendFailed"
+    if (message === "TransportUnavailable") {
+      return c.json({ error: "ChargePoint command channel is unavailable" }, 503)
+    }
+    if (message === "CommandTimeout") {
+      return c.json({ error: "ChargePoint did not confirm RemoteStartTransaction in time" }, 504)
+    }
+    return c.json({ error: `RemoteStartTransaction failed: ${message}` }, 502)
+  }

  console.log(
    `[OCPP] RemoteStartTransaction cp=${body.chargePointIdentifier} ` +
@@ -311,9 +319,8 @@ app.get("/:id", async (c) => {
 /**
 * POST /api/transactions/:id/stop
 * Manually stop an active transaction.
- * 1. If the charge point is connected, send OCPP RemoteStopTransaction.
- * 2. In either case (online or offline), settle the transaction in the DB immediately
- *    so the record is always finalised from the admin side.
+ * 1. If the charge point is connected, send OCPP RemoteStopTransaction and wait for confirmation.
+ * 2. Record the stop request state in DB; final settlement still happens on StopTransaction.
 */
 app.post("/:id/stop", async (c) => {
  const db = useDrizzle();
@@ -324,7 +331,6 @@ app.post("/:id/stop", async (c) => {
    .select({
      transaction,
      chargePointIdentifier: chargePoint.chargePointIdentifier,
-      feePerKwh: chargePoint.feePerKwh,
    })
    .from(transaction)
    .leftJoin(chargePoint, eq(transaction.chargePointId, chargePoint.id))
@@ -336,55 +342,74 @@ app.post("/:id/stop", async (c) => {

  const now = dayjs();

-  // Try to send RemoteStopTransaction via OCPP if the charge point is online
-  const ws = row.chargePointIdentifier ? ocppConnections.get(row.chargePointIdentifier) : null;
-  if (ws) {
-    const uniqueId = crypto.randomUUID();
-    ws.send(
-      JSON.stringify([
-        OCPP_MESSAGE_TYPE.CALL,
-        uniqueId,
+  let remoteStopStatus: "Requested" | "Accepted" | "Rejected" | "Error" | "Timeout" = "Requested";
+  let remoteStopRequestId: string | null = null;
+  let online = false;
+
+  if (row.chargePointIdentifier) {
+    remoteStopRequestId = crypto.randomUUID();
+    try {
+      const response = await sendOcppCall<{ transactionId: number }, { status?: string }>(
+        row.chargePointIdentifier,
        "RemoteStopTransaction",
        { transactionId: row.transaction.id },
-      ]),
-    );
-    console.log(`[OCPP] Sent RemoteStopTransaction txId=${id} to ${row.chargePointIdentifier}`);
+        { uniqueId: remoteStopRequestId },
+      )
+      online = true;
+      remoteStopStatus = response?.status === "Accepted" ? "Accepted" : "Rejected";
+      console.log(`[OCPP] RemoteStopTransaction txId=${id} status=${response?.status ?? "unknown"} to ${row.chargePointIdentifier}`);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : "CommandSendFailed";
+      remoteStopStatus = message === "CommandTimeout" ? "Timeout" : "Error";
+      online = message !== "TransportUnavailable";
+      console.warn(`[OCPP] RemoteStopTransaction txId=${id} failed for ${row.chargePointIdentifier}: ${message}`);
+      if (message === "TransportUnavailable") {
+        return c.json(
+          {
+            error: "ChargePoint command channel is unavailable",
+            online: false,
+            remoteStopStatus,
+          },
+          503,
+        );
+      }
+      if (message === "CommandTimeout") {
+        return c.json(
+          {
+            error: "ChargePoint did not confirm RemoteStopTransaction in time",
+            online: true,
+            remoteStopStatus,
+          },
+          504,
+        );
+      }
+      return c.json(
+        {
+          error: `RemoteStopTransaction failed: ${message}`,
+          online,
+          remoteStopStatus,
+        },
+        502,
+      );
+    }
  }

-  // Settle in DB regardless (charge point may be offline or slow to respond)
-  // Use startMeterValue as stopMeterValue when the real value is unknown (offline case)
-  const stopMeterValue = row.transaction.startMeterValue;
-  const energyWh = 0; // cannot know actual energy without stop meter value
-  const feePerKwh = row.feePerKwh ?? 0;
-  const feeFen = feePerKwh > 0 && energyWh > 0 ? Math.ceil((energyWh * feePerKwh) / 1000) : 0;
-
  const [updated] = await db
    .update(transaction)
    .set({
-      stopTimestamp: now.toDate(),
-      stopMeterValue,
-      stopReason: "Remote",
-      chargeAmount: feeFen,
+      remoteStopRequestedAt: now.toDate(),
+      remoteStopRequestId,
+      remoteStopStatus,
      updatedAt: now.toDate(),
    })
    .where(eq(transaction.id, id))
    .returning();

-  if (feeFen > 0) {
-    await db
-      .update(idTag)
-      .set({
-        balance: sql`GREATEST(0, ${idTag.balance} - ${feeFen})`,
-        updatedAt: now.toDate(),
-      })
-      .where(eq(idTag.idTag, row.transaction.idTag));
-  }
-
  return c.json({
    ...updated,
    chargePointIdentifier: row.chargePointIdentifier,
-    online: !!ws,
-    energyWh,
+    online,
+    remoteStopStatus,
  });
 });

--- a/apps/web/app/dashboard/charge-points/[id]/page.tsx
+++ b/apps/web/app/dashboard/charge-points/[id]/page.tsx
@@ -15,9 +15,10 @@ import {
  Spinner,
  Table,
  TextField,
+  Tooltip,
 } from "@heroui/react";
-import { ArrowLeft, Pencil, ArrowRotateRight } from "@gravity-ui/icons";
-import { api } from "@/lib/api";
+import { ArrowLeft, Pencil, ArrowRotateRight, Key, Copy, Check } from "@gravity-ui/icons";
+import { api, type ChargePointPasswordReset } from "@/lib/api";
 import { useSession } from "@/lib/auth-client";
 import dayjs from "@/lib/dayjs";
 import InfoSection from "@/components/info-section";
@@ -105,6 +106,29 @@ export default function ChargePointDetailPage({ params }: { params: Promise<{ id
    feePerKwh: "0",
  });

+  // reset password
+  const [resetBusy, setResetBusy] = useState(false);
+  const [resetResult, setResetResult] = useState<ChargePointPasswordReset | null>(null);
+  const [resetCopied, setResetCopied] = useState(false);
+
+  const handleResetPassword = async () => {
+    if (!cp) return;
+    setResetBusy(true);
+    try {
+      const result = await api.chargePoints.resetPassword(cp.id);
+      setResetResult(result);
+    } finally {
+      setResetBusy(false);
+    }
+  };
+
+  const handleCopyResetPassword = (text: string) => {
+    navigator.clipboard.writeText(text).then(() => {
+      setResetCopied(true);
+      setTimeout(() => setResetCopied(false), 2000);
+    });
+  };
+
  const { isFetching: refreshing, ...cpQuery } = useQuery({
    queryKey: ["chargePoint", id],
    queryFn: () => api.chargePoints.get(id),
@@ -156,8 +180,16 @@ export default function ChargePointDetailPage({ params }: { params: Promise<{ id

  // Online if last heartbeat within 3× interval
  const isOnline =
+    cp?.transportStatus === "online" &&
    cp?.lastHeartbeatAt != null &&
    dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < (cp.heartbeatInterval ?? 60) * 3;
+  const commandChannelUnavailable = cp?.transportStatus === "unavailable";
+  const statusLabel = isOnline ? "在线" : commandChannelUnavailable ? "通道异常" : "离线";
+  const statusDotClass = isOnline
+    ? "bg-success animate-pulse"
+    : commandChannelUnavailable
+      ? "bg-warning"
+      : "bg-muted";

  const { data: sessionData } = useSession();
  const isAdmin = sessionData?.user?.role === "admin";
@@ -221,9 +253,9 @@ export default function ChargePointDetailPage({ params }: { params: Promise<{ id
            </Chip>
            <div className="flex items-center gap-1.5">
              <span
-                className={`size-2 rounded-full ${isOnline ? "bg-success animate-pulse" : "bg-muted"}`}
+                className={`size-2 rounded-full ${statusDotClass}`}
              />
-              <span className="text-xs text-muted">{isOnline ? "在线" : "离线"}</span>
+              <span className="text-xs text-muted">{statusLabel}</span>
            </div>
          </div>
          {(cp.chargePointVendor || cp.chargePointModel) && (
@@ -237,10 +269,21 @@ export default function ChargePointDetailPage({ params }: { params: Promise<{ id
            <ArrowRotateRight className={`size-4 ${refreshing ? "animate-spin" : ""}`} />
          </Button>
          {isAdmin && (
-            <Button size="sm" variant="secondary" onPress={openEdit}>
-              <Pencil className="size-4" />
-              编辑
-            </Button>
+            <>
+              <Tooltip>
+                <Tooltip.Content>重置 OCPP 认证密钥</Tooltip.Content>
+                <Tooltip.Trigger>
+                  <Button size="sm" variant="ghost" isDisabled={resetBusy} onPress={handleResetPassword}>
+                    {resetBusy ? <Spinner size="sm" /> : <Key className="size-4" />}
+                    重置密钥
+                  </Button>
+                </Tooltip.Trigger>
+              </Tooltip>
+              <Button size="sm" variant="secondary" onPress={openEdit}>
+                <Pencil className="size-4" />
+                编辑
+              </Button>
+            </>
          )}
        </div>
      </div>
@@ -402,9 +445,9 @@ export default function ChargePointDetailPage({ params }: { params: Promise<{ id
                <dd>
                  <div className="flex items-center gap-1.5">
                    <span
-                      className={`size-2 rounded-full ${isOnline ? "bg-success animate-pulse" : "bg-muted"}`}
+                      className={`size-2 rounded-full ${statusDotClass}`}
                    />
-                    <span className="text-sm text-foreground">{isOnline ? "在线" : "离线"}</span>
+                    <span className="text-sm text-foreground">{statusLabel}</span>
                  </div>
                </dd>
              </div>
@@ -552,6 +595,57 @@ export default function ChargePointDetailPage({ params }: { params: Promise<{ id
        )}
      </div>

+      {/* Reset password result modal */}
+      {isAdmin && (
+        <Modal
+          isOpen={resetResult !== null}
+          onOpenChange={(open) => {
+            if (!open) { setResetResult(null); setResetCopied(false); }
+          }}
+        >
+          <Modal.Backdrop>
+            <Modal.Container scroll="outside">
+              <Modal.Dialog className="sm:max-w-md">
+                <Modal.Header>
+                  <Modal.Heading>密钥已重置</Modal.Heading>
+                </Modal.Header>
+                <Modal.Body className="space-y-4">
+                  <p className="text-sm text-warning font-medium">
+                    此密钥仅显示一次。旧密钥已立即失效，请更新固件配置。
+                  </p>
+                  <div className="space-y-1.5">
+                    <p className="text-xs text-muted font-medium">新 OCPP Basic Auth 密钥</p>
+                    <div className="flex items-center gap-2">
+                      <code className="flex-1 rounded-md bg-surface-secondary px-3 py-2 text-sm font-mono text-foreground select-all">
+                        {resetResult?.plainPassword}
+                      </code>
+                      <Tooltip>
+                        <Tooltip.Content>{resetCopied ? "已复制" : "复制密钥"}</Tooltip.Content>
+                        <Tooltip.Trigger>
+                          <Button
+                            isIconOnly
+                            size="sm"
+                            variant="ghost"
+                            onPress={() => resetResult && handleCopyResetPassword(resetResult.plainPassword)}
+                          >
+                            {resetCopied ? <Check className="size-4 text-success" /> : <Copy className="size-4" />}
+                          </Button>
+                        </Tooltip.Trigger>
+                      </Tooltip>
+                    </div>
+                  </div>
+                </Modal.Body>
+                <Modal.Footer className="flex justify-end">
+                  <Button onPress={() => { setResetResult(null); setResetCopied(false); }}>
+                    我已保存密钥
+                  </Button>
+                </Modal.Footer>
+              </Modal.Dialog>
+            </Modal.Container>
+          </Modal.Backdrop>
+        </Modal>
+      )}
+
      {/* Edit modal */}
      {isAdmin && (
        <Modal
--- a/apps/web/app/dashboard/charge-points/page.tsx
+++ b/apps/web/app/dashboard/charge-points/page.tsx
@@ -6,6 +6,7 @@ import {
  Button,
  Chip,
  Input,
+  InputGroup,
  Label,
  ListBox,
  Modal,
@@ -22,11 +23,13 @@ import {
  TrashBin,
  ArrowRotateRight,
  QrCode,
+  Copy,
+  Check,
 } from "@gravity-ui/icons";
 import { QRCodeSVG } from "qrcode.react";
 import Link from "next/link";
 import { ScrollFade } from "@/components/scroll-fade";
-import { api, type ChargePoint } from "@/lib/api";
+import { api, type ChargePoint, type ChargePointCreated } from "@/lib/api";
 import { useSession } from "@/lib/auth-client";
 import dayjs from "@/lib/dayjs";

@@ -123,6 +126,8 @@ export default function ChargePointsPage() {
  const [deleteTarget, setDeleteTarget] = useState<ChargePoint | null>(null);
  const [deleting, setDeleting] = useState(false);
  const [qrTarget, setQrTarget] = useState<ChargePoint | null>(null);
+  const [createdCp, setCreatedCp] = useState<ChargePointCreated | null>(null);
+  const [copied, setCopied] = useState(false);
  const {
    data: chargePoints = [],
    refetch: refetchList,
@@ -168,9 +173,11 @@ export default function ChargePointsPage() {
          feePerKwh: formData.pricingMode === "fixed" ? fee : 0,
          deviceName: formData.deviceName.trim() || null,
        });
+        await refetchList();
+        setFormOpen(false);
      } else {
-        // Create
-        await api.chargePoints.create({
+        // Create — capture plainPassword for one-time display
+        const created = await api.chargePoints.create({
          chargePointIdentifier: formData.chargePointIdentifier.trim(),
          chargePointVendor: formData.chargePointVendor.trim() || undefined,
          chargePointModel: formData.chargePointModel.trim() || undefined,
@@ -179,9 +186,10 @@ export default function ChargePointsPage() {
          feePerKwh: formData.pricingMode === "fixed" ? fee : 0,
          deviceName: formData.deviceName.trim() || undefined,
        });
+        await refetchList();
+        setFormOpen(false);
+        setCreatedCp(created);
      }
-      await refetchList();
-      setFormOpen(false);
    } finally {
      setFormBusy(false);
    }
@@ -201,6 +209,13 @@ export default function ChargePointsPage() {

  const isEdit = formTarget !== null;

+  const handleCopyPassword = (text: string) => {
+    navigator.clipboard.writeText(text).then(() => {
+      setCopied(true);
+      setTimeout(() => setCopied(false), 2000);
+    });
+  };
+
  const { data: sessionData } = useSession();
  const isAdmin = sessionData?.user?.role === "admin";

@@ -268,9 +283,7 @@ export default function ChargePointsPage() {
                      <Input
                        placeholder="1号楼A区01号桩"
                        value={formData.deviceName}
-                        onChange={(e) =>
-                          setFormData((f) => ({ ...f, deviceName: e.target.value }))
-                        }
+                        onChange={(e) => setFormData((f) => ({ ...f, deviceName: e.target.value }))}
                      />
                    </TextField>
                    <div className="grid grid-cols-2 gap-3">
@@ -397,17 +410,17 @@ export default function ChargePointsPage() {
                <Modal.CloseTrigger />
                <Modal.Header>
                  <Modal.Heading>
-                    {qrTarget?.deviceName ?? qrTarget?.chargePointIdentifier} — 充电二维码
+                    {qrTarget?.deviceName ?? qrTarget?.chargePointIdentifier} 固定二维码
                  </Modal.Heading>
                </Modal.Header>
                <Modal.Body className="space-y-4">
                  <p className="text-sm text-muted">
-                    将以下二维码张贴在对应充电口上，用户扫码后可直接选卡启动充电。
+                    将二维码张贴在对应充电口上，用户扫码后可直接选卡启动充电。
                  </p>
                  {qrTarget &&
                    qrTarget.connectors.filter((c) => c.connectorId > 0).length === 0 && (
                      <p className="text-sm text-muted">
-                        该充电桩暂无接口信息，请等待设备上线后再尝试。
+                        该充电桩暂无接口信息，请等待设备首次上线后再尝试。
                      </p>
                    )}
                  <div className="grid gap-4 grid-cols-2 sm:grid-cols-3">
@@ -444,6 +457,95 @@ export default function ChargePointsPage() {
        </Modal>
      )}

+      {/* OCPP Password Modal — shown once after creation */}
+      {isAdmin && (
+        <Modal
+          isOpen={createdCp !== null}
+          onOpenChange={(open) => {
+            if (!open) {
+              setCreatedCp(null);
+              setCopied(false);
+            }
+          }}
+        >
+          <Modal.Backdrop>
+            <Modal.Container scroll="outside">
+              <Modal.Dialog className="sm:max-w-md">
+                <Modal.Header>
+                  <Modal.Heading>充电桩已创建</Modal.Heading>
+                </Modal.Header>
+                <Modal.Body className="space-y-4">
+                  <p className="text-sm text-warning font-medium">
+                    此认证密钥只显示一次，请立即烧录或妥善保存
+                  </p>
+                  <TextField fullWidth isReadOnly>
+                    <Label className="text-sm font-medium">充电桩标识符</Label>
+                    <Input value={createdCp?.chargePointIdentifier ?? ""} className="font-mono" />
+                  </TextField>
+                  <TextField fullWidth isReadOnly>
+                    <Label className="text-sm font-medium">OCPP Basic Auth 密钥</Label>
+                    <InputGroup>
+                      <InputGroup.Input
+                        value={createdCp?.plainPassword ?? ""}
+                        className="font-mono select-all"
+                      />
+                      <InputGroup.Suffix>
+                        <Tooltip>
+                          <Tooltip.Content>{copied ? "已复制" : "复制密钥"}</Tooltip.Content>
+                          <Tooltip.Trigger>
+                            <Button
+                              isIconOnly
+                              size="sm"
+                              variant="ghost"
+                              onPress={() =>
+                                createdCp && handleCopyPassword(createdCp.plainPassword)
+                              }
+                            >
+                              {copied ? (
+                                <Check className="size-4 text-success" />
+                              ) : (
+                                <Copy className="size-4" />
+                              )}
+                            </Button>
+                          </Tooltip.Trigger>
+                        </Tooltip>
+                      </InputGroup.Suffix>
+                    </InputGroup>
+                  </TextField>
+                  <div className="space-y-1.5">
+                    <TextField fullWidth isReadOnly>
+                      <Label className="text-sm font-medium">固件 WebSocket 连接地址</Label>
+                      <Input
+                        value={`wss://<your-server>/ocpp/${createdCp?.chargePointIdentifier ?? ""}`}
+                        className="font-mono text-xs"
+                      />
+                    </TextField>
+                    <p className="text-xs text-muted">
+                      设备连接时需设置 HTTP 头：
+                      <br />
+                      <code className="text-foreground">
+                        Authorization: Basic &lt;base64({createdCp?.chargePointIdentifier}
+                        :&lt;password&gt;)&gt;
+                      </code>
+                    </p>
+                  </div>
+                </Modal.Body>
+                <Modal.Footer className="flex justify-end">
+                  <Button
+                    onPress={() => {
+                      setCreatedCp(null);
+                      setCopied(false);
+                    }}
+                  >
+                    我已保存密钥
+                  </Button>
+                </Modal.Footer>
+              </Modal.Dialog>
+            </Modal.Container>
+          </Modal.Backdrop>
+        </Modal>
+      )}
+
      <Table>
        <Table.ScrollContainer>
          <Table.Content aria-label="充电桩列表" className="min-w-200">
@@ -472,18 +574,22 @@ export default function ChargePointsPage() {
                  {isAdmin && <Table.Cell>{""}</Table.Cell>}
                </Table.Row>
              )}
-              {chargePoints.map((cp) => (
-                <Table.Row key={cp.id} id={String(cp.id)} className={"group"}>
+              {chargePoints.map((cp) => {
+                const online =
+                  cp.transportStatus === "online" &&
+                  !!cp.lastHeartbeatAt &&
+                  dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < 120;
+                const commandChannelUnavailable = cp.transportStatus === "unavailable";
+
+                return (
+                  <Table.Row key={cp.id} id={String(cp.id)} className={"group"}>
                  <Table.Cell>
                    <Tooltip delay={0}>
                      <Tooltip.Trigger>
                        <div className="flex items-center gap-2">
                          <span
                            className={`size-2 shrink-0 rounded-full ${
-                              cp.lastHeartbeatAt &&
-                              dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < 120
-                                ? "bg-success"
-                                : "bg-gray-300"
+                              online ? "bg-success" : commandChannelUnavailable ? "bg-warning" : "bg-gray-300"
                            }`}
                          />
                          <div className="flex flex-col">
@@ -502,11 +608,7 @@ export default function ChargePointsPage() {
                        </div>
                      </Tooltip.Trigger>
                      <Tooltip.Content placement="start">
-                        {cp.lastHeartbeatAt
-                          ? dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < 120
-                            ? "在线"
-                            : "离线"
-                          : "从未连接"}
+                        {online ? "在线" : commandChannelUnavailable ? "通道异常" : cp.lastHeartbeatAt ? "离线" : "从未连接"}
                      </Tooltip.Content>
                    </Tooltip>
                  </Table.Cell>
@@ -649,8 +751,9 @@ export default function ChargePointsPage() {
                      </div>
                    </Table.Cell>
                  )}
-                </Table.Row>
-              ))}
+                  </Table.Row>
+                );
+              })}
            </Table.Body>
          </Table.Content>
        </Table.ScrollContainer>
--- a/apps/web/app/dashboard/charge/page.tsx
+++ b/apps/web/app/dashboard/charge/page.tsx
@@ -363,8 +363,11 @@ function ChargePageContent() {
      const msg = err.message ?? "";
      const lowerMsg = msg.toLowerCase();

-      if (lowerMsg.includes("offline")) setStartError("充电桩当前不在线，请稍后再试");
-      else if (
+      if (lowerMsg.includes("command channel is unavailable") || lowerMsg.includes("offline")) {
+        setStartError("充电桩下行通道不可用，请稍后再试");
+      } else if (lowerMsg.includes("did not confirm remotestarttransaction in time")) {
+        setStartError("充电桩未及时确认启动指令，请稍后重试");
+      } else if (
        lowerMsg.includes("chargepoint is not accepted") ||
        lowerMsg.includes("not accepted")
      ) {
@@ -596,7 +599,10 @@ function ChargePageContent() {
                .filter((cp) => cp.registrationStatus === "Accepted")
                .map((cp) => {
                  const online =
-                    !!cp.lastHeartbeatAt && dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < 120;
+                    cp.transportStatus === "online" &&
+                    !!cp.lastHeartbeatAt &&
+                    dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < 120;
+                  const commandChannelUnavailable = cp.transportStatus === "unavailable";
                  const availableCount = cp.connectors.filter(
                    (c) => c.status === "Available",
                  ).length;
@@ -644,13 +650,17 @@ function ChargePageContent() {
                            "shrink-0 inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-xs font-semibold",
                            online
                              ? "bg-success/12 text-success"
+                              : commandChannelUnavailable
+                                ? "bg-warning/12 text-warning"
                              : "bg-surface-tertiary text-muted",
                          ].join(" ")}
                        >
                          <span
-                            className={`size-1.5 rounded-full ${online ? "bg-success" : "bg-muted"}`}
+                            className={`size-1.5 rounded-full ${
+                              online ? "bg-success" : commandChannelUnavailable ? "bg-warning" : "bg-muted"
+                            }`}
                          />
-                          {online ? "在线" : "离线"}
+                          {online ? "在线" : commandChannelUnavailable ? "通道异常" : "离线"}
                        </span>
                      </div>
                      {/* Bottom row: connectors + fee */}
--- a/apps/web/app/dashboard/page.tsx
+++ b/apps/web/app/dashboard/page.tsx
@@ -35,7 +35,7 @@ function timeAgo(dateStr: string | null | undefined): string {
 }

 function cpOnline(cp: ChargePoint): boolean {
-  if (!cp.lastHeartbeatAt) return false;
+  if (cp.transportStatus !== "online" || !cp.lastHeartbeatAt) return false;
  return dayjs().diff(dayjs(cp.lastHeartbeatAt), "second") < 120;
 }

--- a/apps/web/app/dashboard/settings/parameters/page.tsx
+++ b/apps/web/app/dashboard/settings/parameters/page.tsx
@@ -0,0 +1,161 @@
+"use client";
+
+import { useEffect, useMemo, useState } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { Alert, Button, Input, Label, Spinner, TextField, toast } from "@heroui/react";
+import { Gear, Lock } from "@gravity-ui/icons";
+import { useSession } from "@/lib/auth-client";
+import { api, type SystemSettings } from "@/lib/api";
+
+const MIN_HEARTBEAT = 10;
+const MAX_HEARTBEAT = 86400;
+const DEFAULT_HEARTBEAT = 60;
+
+export default function ParametersSettingsPage() {
+  const { data: session } = useSession();
+  const isAdmin = session?.user?.role === "admin";
+  const queryClient = useQueryClient();
+
+  const { data: settings, isLoading } = useQuery({
+    queryKey: ["system-settings"],
+    queryFn: () => api.settings.get(),
+    enabled: isAdmin,
+  });
+
+  const [heartbeatInterval, setHeartbeatInterval] = useState(String(DEFAULT_HEARTBEAT));
+  const [saving, setSaving] = useState(false);
+
+  useEffect(() => {
+    if (!settings) return;
+    setHeartbeatInterval(String(settings.ocpp16j.heartbeatInterval));
+  }, [settings]);
+
+  const parsedHeartbeat = useMemo(() => {
+    const n = Number(heartbeatInterval);
+    if (!Number.isFinite(n)) return null;
+    return Math.round(n);
+  }, [heartbeatInterval]);
+
+  const heartbeatError =
+    parsedHeartbeat === null
+      ? "请输入有效数字"
+      : parsedHeartbeat < MIN_HEARTBEAT || parsedHeartbeat > MAX_HEARTBEAT
+        ? `范围应为 ${MIN_HEARTBEAT} - ${MAX_HEARTBEAT} 秒`
+        : "";
+
+  const isDirty = settings
+    ? Number(heartbeatInterval) !== settings.ocpp16j.heartbeatInterval
+    : false;
+
+  const handleSave = async () => {
+    if (parsedHeartbeat === null) {
+      toast.warning("请输入有效的心跳间隔");
+      return;
+    }
+
+    if (parsedHeartbeat < MIN_HEARTBEAT || parsedHeartbeat > MAX_HEARTBEAT) {
+      toast.warning(`心跳间隔范围应为 ${MIN_HEARTBEAT}-${MAX_HEARTBEAT} 秒`);
+      return;
+    }
+
+    const payload: SystemSettings = {
+      ocpp16j: { heartbeatInterval: parsedHeartbeat },
+    };
+
+    setSaving(true);
+    try {
+      await api.settings.put(payload);
+      toast.success("参数配置已保存");
+      queryClient.invalidateQueries({ queryKey: ["system-settings"] });
+    } catch {
+      toast.warning("保存失败，请稍后重试");
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  if (!isAdmin) {
+    return (
+      <div className="flex flex-col items-center justify-center py-24 text-center">
+        <div className="mb-4 flex size-12 items-center justify-center rounded-full bg-warning/10">
+          <Lock className="size-6 text-warning" />
+        </div>
+        <p className="text-sm font-semibold text-foreground">需要管理员权限</p>
+        <p className="mt-1 text-sm text-muted">参数配置仅对管理员开放</p>
+      </div>
+    );
+  }
+
+  if (isLoading) {
+    return (
+      <div className="flex items-center justify-center py-24">
+        <Spinner size="lg" />
+      </div>
+    );
+  }
+
+  return (
+    <div className="mx-auto max-w-3xl space-y-6">
+      <div>
+        <div className="flex items-center gap-2">
+          <Gear className="size-5 text-foreground" />
+          <h1 className="text-xl font-semibold text-foreground">参数配置</h1>
+        </div>
+        <p className="mt-0.5 text-sm text-muted">
+          按功能模块管理系统参数，变更将影响后续设备交互行为
+        </p>
+      </div>
+
+      <div className="rounded-xl border border-border bg-surface-secondary">
+        <div className="flex items-center gap-3 border-b border-border px-5 py-4">
+          <div className="flex size-9 items-center justify-center rounded-lg bg-accent/10">
+            <Gear className="size-5 text-accent" />
+          </div>
+          <div>
+            <p className="text-sm font-semibold text-foreground">OCPP 1.6J</p>
+            <p className="text-xs text-muted">协议层行为参数</p>
+          </div>
+        </div>
+
+        <div className="space-y-4 px-5 py-4">
+          <TextField fullWidth>
+            <Label className="text-sm font-medium">心跳间隔</Label>
+            <Input
+              type="number"
+              min={String(MIN_HEARTBEAT)}
+              max={String(MAX_HEARTBEAT)}
+              step="1"
+              value={heartbeatInterval}
+              onChange={(e) => setHeartbeatInterval(e.target.value)}
+              placeholder="60"
+            />
+          </TextField>
+
+          <p className="text-xs text-muted">
+            单位：秒。该值会用于 BootNotification.conf 的 interval
+            字段，并下发给充电桩默认心跳参数。
+          </p>
+
+          {!!heartbeatError && (
+            <Alert status="warning">
+              <Alert.Indicator />
+              <Alert.Content>
+                <Alert.Description>{heartbeatError}</Alert.Description>
+              </Alert.Content>
+            </Alert>
+          )}
+
+          <div className="flex justify-end">
+            <Button
+              size="sm"
+              isDisabled={saving || !isDirty || !!heartbeatError}
+              onPress={handleSave}
+            >
+              {saving ? <Spinner size="sm" color="current" /> : "保存"}
+            </Button>
+          </div>
+        </div>
+      </div>
+    </div>
+  );
+}
--- a/apps/web/app/dashboard/topology/topology-flow.tsx
+++ b/apps/web/app/dashboard/topology/topology-flow.tsx
@@ -26,7 +26,8 @@ import { Clock, EvCharger, Plug, Zap } from "lucide-react";
 type ConnectionStatus = "online" | "stale" | "offline";

 function getStatus(cp: ChargePoint, connected: string[]): ConnectionStatus {
-  if (!connected.includes(cp.chargePointIdentifier)) return "offline";
+  if (cp.transportStatus === "unavailable") return "stale";
+  if (cp.transportStatus !== "online" || !connected.includes(cp.chargePointIdentifier)) return "offline";
  if (!cp.lastHeartbeatAt) return "stale";
  return dayjs().diff(dayjs(cp.lastHeartbeatAt), "minute") < 5 ? "online" : "stale";
 }
@@ -36,7 +37,7 @@ const STATUS_CONFIG: Record<
  { color: string; edgeColor: string; label: string; animated: boolean }
 > = {
  online: { color: "#22c55e", edgeColor: "#22c55e", label: "在线", animated: true },
-  stale: { color: "#f59e0b", edgeColor: "#f59e0b", label: "心跳超时", animated: true },
+  stale: { color: "#f59e0b", edgeColor: "#f59e0b", label: "通道异常", animated: true },
  offline: { color: "#71717a", edgeColor: "#9ca3af", label: "离线", animated: false },
 };

--- a/apps/web/components/sidebar.tsx
+++ b/apps/web/components/sidebar.tsx
@@ -36,6 +36,7 @@ const navItems = [

 const settingsItems = [
  { href: "/dashboard/settings/user", label: "账号设置", icon: UserCog, adminOnly: false },
+  { href: "/dashboard/settings/parameters", label: "参数配置", icon: Gear, adminOnly: true },
 ];

 function NavContent({
--- a/apps/web/lib/api.ts
+++ b/apps/web/lib/api.ts
@@ -72,6 +72,8 @@ export type ConnectionsStatus = {
  connectedIdentifiers: string[];
 };

+export type ChargePointConnectionStatus = "online" | "unavailable" | "offline";
+
 export type ChargePoint = {
  id: string;
  chargePointIdentifier: string;
@@ -79,7 +81,12 @@ export type ChargePoint = {
  chargePointVendor: string | null;
  chargePointModel: string | null;
  registrationStatus: string;
+  transportStatus: ChargePointConnectionStatus;
  lastHeartbeatAt: string | null;
+  lastWsConnectedAt: string | null;
+  lastWsDisconnectedAt: string | null;
+  lastCommandStatus: "Accepted" | "Rejected" | "Error" | "Timeout" | null;
+  lastCommandAt: string | null;
  lastBootNotificationAt: string | null;
  feePerKwh: number;
  pricingMode: "fixed" | "tou";
@@ -102,7 +109,12 @@ export type ChargePointDetail = {
  meterType: string | null;
  registrationStatus: string;
  heartbeatInterval: number | null;
+  transportStatus: ChargePointConnectionStatus;
  lastHeartbeatAt: string | null;
+  lastWsConnectedAt: string | null;
+  lastWsDisconnectedAt: string | null;
+  lastCommandStatus: "Accepted" | "Rejected" | "Error" | "Timeout" | null;
+  lastCommandAt: string | null;
  lastBootNotificationAt: string | null;
  feePerKwh: number;
  pricingMode: "fixed" | "tou";
@@ -134,6 +146,9 @@ export type Transaction = {
  chargeAmount: number | null;
  electricityFee: number | null;
  serviceFee: number | null;
+  remoteStopStatus: "Requested" | "Accepted" | "Rejected" | "Error" | "Timeout" | null;
+  remoteStopRequestedAt: string | null;
+  remoteStopRequestId: string | null;
 };

 export type IdTag = {
@@ -160,6 +175,18 @@ export type UserRow = {
  createdAt: string;
 };

+export type ChargePointCreated = ChargePoint & {
+  /** 仅在创建时返回一次的明文密码，之后不可再查 */
+  plainPassword: string;
+};
+
+export type ChargePointPasswordReset = {
+  id: string;
+  chargePointIdentifier: string;
+  /** 仅在重置时返回一次的新明文密码 */
+  plainPassword: string;
+};
+
 export type PaginatedTransactions = {
  data: Transaction[];
  total: number;
@@ -190,6 +217,14 @@ export type TariffConfig = {
  updatedAt?: string;
 };

+export type Ocpp16jSettings = {
+  heartbeatInterval: number;
+};
+
+export type SystemSettings = {
+  ocpp16j: Ocpp16jSettings;
+};
+
 // ── API functions ──────────────────────────────────────────────────────────

 export type ChartRange = "30d" | "7d" | "24h";
@@ -221,7 +256,7 @@ export const api = {
      pricingMode?: "fixed" | "tou";
      deviceName?: string;
    }) =>
-      apiFetch<ChargePoint>("/api/charge-points", {
+      apiFetch<ChargePointCreated>("/api/charge-points", {
        method: "POST",
        body: JSON.stringify(data),
      }),
@@ -242,6 +277,10 @@ export const api = {
      }),
    delete: (id: string) =>
      apiFetch<{ success: true }>(`/api/charge-points/${id}`, { method: "DELETE" }),
+    resetPassword: (id: string) =>
+      apiFetch<ChargePointPasswordReset>(`/api/charge-points/${id}/reset-password`, {
+        method: "POST",
+      }),
  },
  transactions: {
    list: (params?: {
@@ -333,4 +372,9 @@ export const api = {
    put: (data: { slots: TariffSlot[]; prices: Record<PriceTier, TierPricing> }) =>
      apiFetch<TariffConfig>("/api/tariff", { method: "PUT", body: JSON.stringify(data) }),
  },
+  settings: {
+    get: () => apiFetch<SystemSettings>("/api/settings"),
+    put: (data: SystemSettings) =>
+      apiFetch<SystemSettings>("/api/settings", { method: "PUT", body: JSON.stringify(data) }),
+  },
 };
--- a/hardware/firmware/lib/MicroOcppMongoose/library.json
+++ b/hardware/firmware/lib/MicroOcppMongoose/library.json
@@ -0,0 +1,37 @@
+{
+    "name": "MicroOcppMongoose",
+    "version": "1.2.0",
+    "description": "Mongoose Adapter for the MicroOCPP Client",
+    "keywords": "OCPP, 1.6, OCPP 1.6, OCPP 2.0.1, Smart Energy, Smart Charging, client, ESP8266, ESP32, Arduino, EVSE, Charge Point, Mongoose",
+    "repository":
+    {
+        "type": "git",
+        "url": "https://github.com/matth-x/MicroOcppMongoose/"
+    },
+    "authors":
+    [
+      {
+        "name": "Matthias Akstaller",
+        "url": "https://www.micro-ocpp.com",
+        "maintainer": true
+      }
+    ],
+    "license": "GPL-3.0",
+    "homepage": "https://www.micro-ocpp.com",
+    "frameworks": "arduino,espidf",
+    "platforms": "espressif8266, espressif32",
+    "export": {
+        "include":
+        [
+            "src/MicroOcppMongooseClient_c.cpp",
+            "src/MicroOcppMongooseClient_c.h",
+            "src/MicroOcppMongooseClient.cpp",
+            "src/MicroOcppMongooseClient.h",
+            "CHANGELOG.md",
+            "CMakeLists.txt",
+            "library.json",
+            "LICENSE",
+            "README.md"
+        ]
+    }
+}
--- a/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient.cpp
+++ b/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient.cpp
@@ -0,0 +1,754 @@
+// matth-x/MicroOcppMongoose
+// Copyright Matthias Akstaller 2019 - 2024
+// GPL-3.0 License (see LICENSE)
+
+#include "MicroOcppMongooseClient.h"
+#include <MicroOcpp/Core/Configuration.h>
+#include <MicroOcpp/Debug.h>
+
+#if MO_ENABLE_V201
+#include <MicroOcpp/Model/Variables/VariableContainer.h>
+#endif
+
+#define DEBUG_MSG_INTERVAL 5000UL
+#define WS_UNRESPONSIVE_THRESHOLD_MS 15000UL
+
+#define MO_MG_V614 614
+#define MO_MG_V708 708
+#define MO_MG_V713 713
+#define MO_MG_V714 714
+#define MO_MG_V715 715
+
+#ifndef MO_MG_USE_VERSION
+#if defined(MO_MG_VERSION_614)
+#define MO_MG_USE_VERSION MO_MG_V614
+#else
+#define MO_MG_USE_VERSION MO_MG_V708
+#endif
+#endif
+
+#if MO_MG_USE_VERSION == MO_MG_V614
+#define MO_MG_F_IS_MOcppMongooseClient MG_F_USER_2
+#endif
+
+namespace MicroOcpp {
+bool validateAuthorizationKeyHex(const char *auth_key_hex);
+}
+
+using namespace MicroOcpp;
+
+#if MO_MG_USE_VERSION <= MO_MG_V708
+void ws_cb(struct mg_connection *c, int ev, void *ev_data, void *fn_data);
+#else
+void ws_cb(struct mg_connection *c, int ev, void *ev_data);
+#endif
+
+MOcppMongooseClient::MOcppMongooseClient(struct mg_mgr *mgr,
+            const char *backend_url_factory, 
+            const char *charge_box_id_factory,
+            unsigned char *auth_key_factory, size_t auth_key_factory_len,
+            const char *ca_certificate,
+            std::shared_ptr<FilesystemAdapter> filesystem,
+            ProtocolVersion protocolVersion) : mgr(mgr), protocolVersion(protocolVersion) {
+    
+    bool readonly;
+    
+    if (filesystem) {
+        configuration_init(filesystem);
+
+        //all credentials are persistent over reboots
+        readonly = false;
+    } else {
+        //make the credentials non-persistent
+        MO_DBG_WARN("Credentials non-persistent. Use MicroOcpp::makeDefaultFilesystemAdapter(...) for persistency");
+        readonly = true;
+    }
+
+    if (auth_key_factory_len > MO_AUTHKEY_LEN_MAX) {
+        MO_DBG_WARN("auth_key_factory too long - will be cropped");
+        auth_key_factory_len = MO_AUTHKEY_LEN_MAX;
+    }
+
+#if MO_ENABLE_V201
+    if (protocolVersion.major == 2) {
+        websocketSettings = std::unique_ptr<VariableContainerOwning>(new VariableContainerOwning());
+        if (filesystem) {
+            websocketSettings->enablePersistency(filesystem, MO_WSCONN_FN_V201);
+        }
+
+        auto csmsUrl = makeVariable(Variable::InternalDataType::String, Variable::AttributeType::Actual);
+        csmsUrl->setComponentId("SecurityCtrlr");
+        csmsUrl->setName("CsmsUrl");
+        csmsUrl->setString(backend_url_factory ? backend_url_factory : "");
+        csmsUrl->setPersistent();
+        v201csmsUrlString = csmsUrl.get();
+        websocketSettings->add(std::move(csmsUrl));
+
+        auto identity = makeVariable(Variable::InternalDataType::String, Variable::AttributeType::Actual);
+        identity->setComponentId("SecurityCtrlr");
+        identity->setName("Identity");
+        identity->setString(charge_box_id_factory ? charge_box_id_factory : "");
+        identity->setPersistent();
+        v201identityString = identity.get();
+        websocketSettings->add(std::move(identity));
+
+        auto basicAuthPassword = makeVariable(Variable::InternalDataType::String, Variable::AttributeType::Actual);
+        basicAuthPassword->setComponentId("SecurityCtrlr");
+        basicAuthPassword->setName("BasicAuthPassword");
+        char basicAuthPasswordVal [MO_AUTHKEY_LEN_MAX + 1];
+        snprintf(basicAuthPasswordVal, sizeof(basicAuthPasswordVal), "%.*s", (int)auth_key_factory_len, auth_key_factory ? (const char*)auth_key_factory : "");
+        basicAuthPassword->setString(basicAuthPasswordVal);
+        basicAuthPassword->setPersistent();
+        v201basicAuthPasswordString = basicAuthPassword.get();
+        websocketSettings->add(std::move(basicAuthPassword));
+
+        websocketSettings->load(); //if settings on flash already exist, this overwrites factory defaults
+    } else
+#endif
+    {
+        setting_backend_url_str = declareConfiguration<const char*>(
+            MO_CONFIG_EXT_PREFIX "BackendUrl", backend_url_factory, MO_WSCONN_FN, readonly, true);
+        setting_cb_id_str = declareConfiguration<const char*>(
+            MO_CONFIG_EXT_PREFIX "ChargeBoxId", charge_box_id_factory, MO_WSCONN_FN, readonly, true);
+
+        char auth_key_hex [2 * MO_AUTHKEY_LEN_MAX + 1];
+        auth_key_hex[0] = '\0';
+        if (auth_key_factory) {
+            for (size_t i = 0; i < auth_key_factory_len; i++) {
+                snprintf(auth_key_hex + 2 * i, 3, "%02X", auth_key_factory[i]);
+            }
+        }
+        setting_auth_key_hex_str = declareConfiguration<const char*>(
+            "AuthorizationKey", auth_key_hex, MO_WSCONN_FN, readonly, true);
+        registerConfigurationValidator("AuthorizationKey", validateAuthorizationKeyHex);
+    }
+
+    ws_ping_interval_int = declareConfiguration<int>(
+        "WebSocketPingInterval", 5, MO_WSCONN_FN);
+    reconnect_interval_int = declareConfiguration<int>(
+        MO_CONFIG_EXT_PREFIX "ReconnectInterval", 10, MO_WSCONN_FN);
+    stale_timeout_int = declareConfiguration<int>(
+        MO_CONFIG_EXT_PREFIX "StaleTimeout", 300, MO_WSCONN_FN);
+
+    configuration_load(MO_WSCONN_FN); //load configs with values stored on flash
+
+    ca_cert = ca_certificate;
+
+    reloadConfigs(); //load WS creds with configs values
+
+#if MO_MG_USE_VERSION == MO_MG_V614
+    MO_DBG_DEBUG("use MG version %s (tested with 6.14)", MG_VERSION);
+#elif MO_MG_USE_VERSION == MO_MG_V708
+    MO_DBG_DEBUG("use MG version %s (tested with 7.8)", MG_VERSION);
+#elif MO_MG_USE_VERSION == MO_MG_V713
+    MO_DBG_DEBUG("use MG version %s (tested with 7.13)", MG_VERSION);
+#endif
+
+    maintainWsConn();
+}
+
+MOcppMongooseClient::MOcppMongooseClient(struct mg_mgr *mgr,
+            const char *backend_url_factory, 
+            const char *charge_box_id_factory,
+            const char *auth_key_factory,
+            const char *ca_certificate,
+            std::shared_ptr<FilesystemAdapter> filesystem,
+            ProtocolVersion protocolVersion) :
+
+    MOcppMongooseClient(mgr,
+            backend_url_factory,
+            charge_box_id_factory,
+            (unsigned char *)auth_key_factory, auth_key_factory ? strlen(auth_key_factory) : 0,
+            ca_certificate,
+            filesystem,
+            protocolVersion) {
+
+}
+
+MOcppMongooseClient::~MOcppMongooseClient() {
+    MO_DBG_DEBUG("destruct MOcppMongooseClient");
+    if (websocket) {
+        reconnect(); //close WS connection, won't be reopened
+#if MO_MG_USE_VERSION == MO_MG_V614
+        websocket->flags &= ~MO_MG_F_IS_MOcppMongooseClient;
+        websocket->user_data = nullptr;
+#else
+        websocket->fn_data = nullptr;
+#endif
+    }
+}
+
+void MOcppMongooseClient::loop() {
+    maintainWsConn();
+}
+
+bool MOcppMongooseClient::sendTXT(const char *msg, size_t length) {
+    if (!websocket || !isConnectionOpen()) {
+        return false;
+    }
+    size_t sent;
+#if MO_MG_USE_VERSION == MO_MG_V614
+    if (websocket->send_mbuf.len > 0) {
+        sent = 0;
+        return false;
+    } else {
+        mg_send_websocket_frame(websocket, WEBSOCKET_OP_TEXT, msg, length);
+        sent = length;
+    }
+#else
+    sent = mg_ws_send(websocket, msg, length, WEBSOCKET_OP_TEXT);
+#endif
+    if (sent < length) {
+        MO_DBG_WARN("mg_ws_send did only accept %zu out of %zu bytes", sent, length);
+        //flush broken package and wait for next retry
+        (void)0;
+    }
+
+    return true;
+}
+
+void MOcppMongooseClient::maintainWsConn() {
+    if (mocpp_tick_ms() - last_status_dbg_msg >= DEBUG_MSG_INTERVAL) {
+        last_status_dbg_msg = mocpp_tick_ms();
+
+        //WS successfully connected?
+        if (!isConnectionOpen()) {
+            MO_DBG_DEBUG("WS unconnected");
+        } else if (mocpp_tick_ms() - last_recv >= (ws_ping_interval_int && ws_ping_interval_int->getInt() > 0 ? (ws_ping_interval_int->getInt() * 1000UL) : 0UL) + WS_UNRESPONSIVE_THRESHOLD_MS) {
+            //WS connected but unresponsive
+            MO_DBG_DEBUG("WS unresponsive");
+        }
+    }
+
+    if (websocket && isConnectionOpen() &&
+            stale_timeout_int && stale_timeout_int->getInt() > 0 && mocpp_tick_ms() - last_recv >= (stale_timeout_int->getInt() * 1000UL)) {
+        MO_DBG_INFO("connection %s -- stale, reconnect", url.c_str());
+        reconnect();
+        return;
+    }
+
+    if (websocket && isConnectionOpen() &&
+            ws_ping_interval_int && ws_ping_interval_int->getInt() > 0 && mocpp_tick_ms() - last_hb >= (ws_ping_interval_int->getInt() * 1000UL)) {
+        last_hb = mocpp_tick_ms();
+#if MO_MG_USE_VERSION == MO_MG_V614
+        mg_send_websocket_frame(websocket, WEBSOCKET_OP_PING, "", 0);
+#else
+        mg_ws_send(websocket, "", 0, WEBSOCKET_OP_PING);
+#endif
+    }
+
+    if (websocket != nullptr) { //connection pointer != nullptr means that the socket is still open
+        return;
+    }
+
+    if (url.empty()) {
+        //cannot open OCPP connection: credentials missing
+        return;
+    }
+
+    if (reconnect_interval_int && reconnect_interval_int->getInt() > 0 && mocpp_tick_ms() - last_reconnection_attempt < (reconnect_interval_int->getInt() * 1000UL)) {
+        return;
+    }
+
+    MO_DBG_DEBUG("(re-)connect to %s", url.c_str());
+
+    last_reconnection_attempt = mocpp_tick_ms();
+
+    /*
+     * determine auth token
+     */
+
+    std::string basic_auth64;
+
+    if (auth_key_len > 0) {
+
+        #if MO_DBG_LEVEL >= MO_DL_DEBUG
+        {
+            char auth_key_hex [2 * MO_AUTHKEY_LEN_MAX + 1];
+            auth_key_hex[0] = '\0';
+            for (size_t i = 0; i < auth_key_len; i++) {
+                snprintf(auth_key_hex + 2 * i, 3, "%02X", auth_key[i]);
+            }
+            MO_DBG_DEBUG("auth Token=%s:%s (key will be converted to non-hex)", cb_id.c_str(), auth_key_hex);
+        }
+        #endif //MO_DBG_LEVEL >= MO_DL_DEBUG
+
+        unsigned char *token = new unsigned char[cb_id.length() + 1 + auth_key_len]; //cb_id:auth_key
+        if (!token) {
+            //OOM
+            return;
+        }
+        size_t len = 0;
+        memcpy(token, cb_id.c_str(), cb_id.length());
+        len += cb_id.length();
+        token[len++] = (unsigned char) ':';
+        memcpy(token + len, auth_key, auth_key_len);
+        len += auth_key_len;
+
+        int base64_length = ((len + 2) / 3) * 4; //3 bytes base256 get encoded into 4 bytes base64. --> base64_len = ceil(len/3) * 4
+        char *base64 = new char[base64_length + 1];
+        if (!base64) {
+            //OOM
+            delete[] token;
+            return;
+        }
+
+        // mg_base64_encode() places a null terminator automatically, because the output is a c-string
+        #if MO_MG_USE_VERSION <= MO_MG_V708
+        mg_base64_encode(token, len, base64);
+        #else
+        mg_base64_encode(token, len, base64, base64_length + 1);
+        #endif
+        delete[] token;
+
+        MO_DBG_DEBUG("auth64 len=%u, auth64 Token=%s", base64_length, base64);
+
+        basic_auth64 = &base64[0];
+
+        delete[] base64;
+    } else {
+        MO_DBG_DEBUG("no authentication");
+        (void) 0;
+    }
+
+#if MO_MG_USE_VERSION == MO_MG_V614
+
+    struct mg_connect_opts opts;
+    memset(&opts, 0, sizeof(opts));
+
+    const char *ca_string = ca_cert ? ca_cert : "*"; //"*" enables TLS but disables CA verification
+
+    //Check if SSL is disabled, i.e. if URL starts with "ws:"
+    if (url.length() >= strlen("ws:") &&
+            tolower(url.c_str()[0]) == 'w' &&
+            tolower(url.c_str()[1]) == 's' &&
+            url.c_str()[2] == ':') {
+        //yes, disable SSL
+        ca_string = nullptr;
+        MO_DBG_WARN("Insecure connection (WS)");
+    }
+
+    opts.ssl_ca_cert = ca_string;
+
+    char extra_headers [128] = {'\0'};
+
+    if (!basic_auth64.empty()) {
+        auto ret = snprintf(extra_headers, 128, "Authorization: Basic %s\r\n", basic_auth64.c_str());
+        if (ret < 0 || ret >= 128) {
+            MO_DBG_ERR("Basic Authentication failed: %d", ret);
+            (void)0;
+        }
+    }
+
+    websocket = mg_connect_ws_opt(
+        mgr,
+        ws_cb,
+        this,
+        opts,
+        url.c_str(),
+        protocolVersion.major == 2 ? "ocpp2.0.1" : "ocpp1.6",
+        *extra_headers ? extra_headers : nullptr);
+
+    if (websocket) {
+        websocket->flags |= MO_MG_F_IS_MOcppMongooseClient;
+    }
+
+#else
+
+    websocket = mg_ws_connect(
+        mgr, 
+        url.c_str(), 
+        ws_cb, 
+        this, 
+        "Sec-WebSocket-Protocol: %s%s%s\r\n",
+                      protocolVersion.major == 2 ? "ocpp2.0.1" : "ocpp1.6",
+                      basic_auth64.empty() ? "" : "\r\nAuthorization: Basic ", 
+                      basic_auth64.empty() ? "" : basic_auth64.c_str());     // Create client
+#endif
+
+}
+
+void MOcppMongooseClient::reconnect() {
+    if (!websocket) {
+        return;
+    }
+#if MO_MG_USE_VERSION == MO_MG_V614
+    if (!connection_closing) {
+        const char *msg = "socket closed by client";
+        mg_send_websocket_frame(websocket, WEBSOCKET_OP_CLOSE, msg, strlen(msg));
+    }
+#else
+    websocket->is_closing = 1; //Mongoose will close the socket and the following maintainWsConn() call will open it again
+#endif
+    setConnectionOpen(false);
+}
+
+void MOcppMongooseClient::setBackendUrl(const char *backend_url_cstr) {
+    if (!backend_url_cstr) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+
+#if MO_ENABLE_V201
+    if (protocolVersion.major == 2) {
+        if (v201csmsUrlString) {
+            v201csmsUrlString->setString(backend_url_cstr);
+            websocketSettings->commit();
+        }
+    } else
+#endif
+    {
+        if (setting_backend_url_str) {
+            setting_backend_url_str->setString(backend_url_cstr);
+            configuration_save();
+        }
+    }
+
+}
+
+void MOcppMongooseClient::setChargeBoxId(const char *cb_id_cstr) {
+    if (!cb_id_cstr) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+
+#if MO_ENABLE_V201
+    if (protocolVersion.major == 2) {
+        if (v201identityString) {
+            v201identityString->setString(cb_id_cstr);
+            websocketSettings->commit();
+        }
+    } else
+#endif
+    {
+        if (setting_cb_id_str) {
+            setting_cb_id_str->setString(cb_id_cstr);
+            configuration_save();
+        }
+    }
+
+}
+
+void MOcppMongooseClient::setAuthKey(const char *auth_key_cstr) {
+    if (!auth_key_cstr) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+
+    return setAuthKey((const unsigned char*)auth_key_cstr, strlen(auth_key_cstr));
+}
+
+void MOcppMongooseClient::setAuthKey(const unsigned char *auth_key, size_t len) {
+    if (!auth_key || len > MO_AUTHKEY_LEN_MAX) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+
+
+#if MO_ENABLE_V201
+    if (protocolVersion.major == 2) {
+        char basicAuthPassword [MO_AUTHKEY_LEN_MAX + 1];
+        snprintf(basicAuthPassword, sizeof(basicAuthPassword), "%.*s", (int)len, auth_key ? (const char*)auth_key : "");
+        if (v201basicAuthPasswordString) {
+            v201basicAuthPasswordString->setString(basicAuthPassword);
+        }
+    } else
+#endif
+    {
+        char auth_key_hex [2 * MO_AUTHKEY_LEN_MAX + 1];
+        auth_key_hex[0] = '\0';
+        for (size_t i = 0; i < len; i++) {
+            snprintf(auth_key_hex + 2 * i, 3, "%02X", auth_key[i]);
+        }
+        if (setting_auth_key_hex_str) {
+            setting_auth_key_hex_str->setString(auth_key_hex);
+            configuration_save();
+        }
+    }
+}
+
+void MOcppMongooseClient::setCaCert(const char *ca_cert_cstr) {
+    ca_cert = ca_cert_cstr; //updated ca_cert takes immediate effect
+}
+
+void MOcppMongooseClient::reloadConfigs() {
+
+    reconnect(); //closes WS connection; will be reopened in next maintainWsConn execution
+
+    /*
+     * reload WS credentials from configs
+     */
+
+#if MO_ENABLE_V201
+    if (protocolVersion.major == 2) {
+        if (v201csmsUrlString) {
+            backend_url = v201csmsUrlString->getString();
+        }
+
+        if (v201identityString) {
+            cb_id = v201identityString->getString();
+        }
+
+        if (v201basicAuthPasswordString) {
+            snprintf((char*)auth_key, sizeof(auth_key), "%s", v201basicAuthPasswordString->getString());
+            auth_key_len = strlen((char*)auth_key);
+        }
+    } else
+#endif
+    {
+        if (setting_backend_url_str) {
+            backend_url = setting_backend_url_str->getString();
+        }
+
+        if (setting_cb_id_str) {
+            cb_id = setting_cb_id_str->getString();
+        }
+
+        if (setting_auth_key_hex_str) {
+            auto auth_key_hex = setting_auth_key_hex_str->getString();
+            auto auth_key_hex_len = strlen(setting_auth_key_hex_str->getString());
+            if (!validateAuthorizationKeyHex(auth_key_hex)) {
+                MO_DBG_ERR("AuthorizationKey stored with format error. Disable Basic Auth");
+                auth_key_hex_len = 0;
+            }
+
+            auth_key_len = auth_key_hex_len / 2;
+
+            #if MO_MG_VERSION_614
+            cs_from_hex((char*)auth_key, auth_key_hex, auth_key_hex_len);
+            #elif MO_MG_USE_VERSION <= MO_MG_V713
+            mg_unhex(auth_key_hex, auth_key_hex_len, auth_key);
+            #else
+            for (size_t i = 0; i < auth_key_len; i++) {
+                mg_str_to_num(mg_str_n(auth_key_hex + 2*i, 2), 16, auth_key + i, sizeof(uint8_t));
+            }
+            #endif
+
+            auth_key[auth_key_len] = '\0'; //need null-termination as long as deprecated `const char *getAuthKey()` exists
+        }
+    }
+
+    /*
+     * determine new URL with updated WS credentials
+     */
+
+    url.clear();
+
+    if (backend_url.empty()) {
+        MO_DBG_DEBUG("empty URL closes connection");
+        return;
+    }
+
+    url = backend_url;
+
+    if (url.back() != '/' && !cb_id.empty()) {
+        url.append("/");
+    }
+    url.append(cb_id);
+}
+
+int MOcppMongooseClient::printAuthKey(unsigned char *buf, size_t size) {
+    if (!buf || size < auth_key_len) {
+        MO_DBG_ERR("invalid argument");
+        return -1;
+    }
+
+    memcpy(buf, auth_key, auth_key_len);
+    return (int)auth_key_len;
+}
+
+void MOcppMongooseClient::setConnectionOpen(bool open) {
+    if (open) {
+        connection_established = true;
+        last_connection_established = mocpp_tick_ms();
+    } else {
+        connection_closing = true;
+    }
+}
+
+void MOcppMongooseClient::cleanConnection() {
+    connection_established = false;
+    connection_closing = false;
+    websocket = nullptr;
+}
+
+void MOcppMongooseClient::updateRcvTimer() {
+    last_recv = mocpp_tick_ms();
+}
+
+unsigned long MOcppMongooseClient::getLastRecv() {
+    return last_recv;
+}
+
+unsigned long MOcppMongooseClient::getLastConnected() {
+    return last_connection_established;
+}
+
+#if MO_ENABLE_V201
+VariableContainer *MOcppMongooseClient::getVariableContainer() {
+    return websocketSettings.get();
+}
+#endif
+
+#if MO_MG_USE_VERSION == MO_MG_V614
+
+void ws_cb(struct mg_connection *nc, int ev, void *ev_data, void *user_data) {
+
+    MOcppMongooseClient *osock = nullptr;
+    
+    if (user_data && nc->flags & MG_F_IS_WEBSOCKET && nc->flags & MO_MG_F_IS_MOcppMongooseClient) {
+        osock = reinterpret_cast<MOcppMongooseClient*>(user_data);
+    } else {
+        return;
+    }
+
+    switch (ev) {
+        case MG_EV_CONNECT: {
+            int status = *((int *) ev_data);
+            if (status != 0) {
+                MO_DBG_WARN("connection %s -- error %d", osock->getUrl(), status);
+                (void)0;
+            }
+            break;
+        }
+        case MG_EV_WEBSOCKET_HANDSHAKE_DONE: {
+            struct http_message *hm = (struct http_message *) ev_data;
+            if (hm->resp_code == 101) {
+                MO_DBG_INFO("connection %s -- connected!", osock->getUrl());
+                osock->setConnectionOpen(true);
+            } else {
+                MO_DBG_WARN("connection %s -- HTTP error %d", osock->getUrl(), hm->resp_code);
+                (void)0;
+                /* Connection will be closed after this. */
+            }
+            osock->updateRcvTimer();
+            break;
+        }
+        case MG_EV_POLL: {
+            /* Nothing to do here. OCPP engine has own loop-function */
+            break;
+        }
+        case MG_EV_WEBSOCKET_FRAME: {
+            struct websocket_message *wm = (struct websocket_message *) ev_data;
+
+            if (!osock->getReceiveTXTcallback()((const char *) wm->data, wm->size)) { //forward message to Context
+                MO_DBG_ERR("processing WS input failed");
+                (void)0;
+            }
+            osock->updateRcvTimer();
+            break;
+        }
+        case MG_EV_WEBSOCKET_CONTROL_FRAME: {
+            osock->updateRcvTimer();
+            break;
+        }
+        case MG_EV_CLOSE: {
+            MO_DBG_INFO("connection %s -- closed", osock->getUrl());
+            osock->cleanConnection();
+            break;
+        }
+    }
+}
+
+#else
+
+#if MO_MG_USE_VERSION <= MO_MG_V708
+void ws_cb(struct mg_connection *c, int ev, void *ev_data, void *fn_data) {
+#else
+void ws_cb(struct mg_connection *c, int ev, void *ev_data) {
+    void *fn_data = c->fn_data;
+#endif
+    if (ev != 2) {
+        MO_DBG_VERBOSE("Cb fn with event: %d\n", ev);
+        (void)0;
+    }
+
+    MOcppMongooseClient *osock = reinterpret_cast<MOcppMongooseClient*>(fn_data);
+    if (!osock) {
+        if (ev == MG_EV_ERROR || ev == MG_EV_CLOSE) {
+            MO_DBG_INFO("connection %s", ev == MG_EV_CLOSE ? "closed" : "error");
+            (void)0;
+        } else {
+            MO_DBG_ERR("invalid state %d", ev);
+            (void)0;
+        }
+        return;
+    }
+
+    if (ev == MG_EV_ERROR) {
+        // On error, log error message
+        MG_ERROR(("%p %s", c->fd, (char *) ev_data));
+    } else if (ev == MG_EV_CONNECT) {
+        // If target URL is SSL/TLS, command client connection to use TLS
+        if (mg_url_is_ssl(osock->getUrl())) {
+            const char *ca_string = osock->getCaCert();
+            if (ca_string && *ca_string == '\0') { //check if certificate verification is disabled (cert string is empty)
+                //yes, disabled
+                ca_string = nullptr;
+            }
+            struct mg_tls_opts opts;
+            memset(&opts, 0, sizeof(struct mg_tls_opts));
+            #if MO_MG_USE_VERSION <= MO_MG_V708
+            opts.ca = ca_string;
+            opts.srvname = mg_url_host(osock->getUrl());
+            #else
+            opts.ca = mg_str(ca_string);
+            opts.name = mg_url_host(osock->getUrl());
+            #endif
+            mg_tls_init(c, &opts);
+        } else {
+            MO_DBG_WARN("Insecure connection (WS)");
+        }
+    } else if (ev == MG_EV_WS_OPEN) {
+        // WS connection established. Perform MQTT login
+        MO_DBG_INFO("connection %s -- connected!", osock->getUrl());
+        osock->setConnectionOpen(true);
+        osock->updateRcvTimer();
+    } else if (ev == MG_EV_WS_MSG) {
+        struct mg_ws_message *wm = (struct mg_ws_message *) ev_data;
+#if MO_MG_USE_VERSION <= MO_MG_V713
+        if (!osock->getReceiveTXTcallback()((const char*) wm->data.ptr, wm->data.len)) {
+#else
+        if (!osock->getReceiveTXTcallback()((const char*) wm->data.buf, wm->data.len)) {
+#endif
+            MO_DBG_WARN("processing input message failed");
+        }
+        osock->updateRcvTimer();
+    } else if (ev == MG_EV_WS_CTL) {
+        osock->updateRcvTimer();
+    }
+
+    if (ev == MG_EV_ERROR || ev == MG_EV_CLOSE) {
+        MO_DBG_INFO("connection %s -- %s", osock->getUrl(), ev == MG_EV_CLOSE ? "closed" : "error");
+        osock->cleanConnection();
+    }
+}
+#endif
+
+bool MicroOcpp::validateAuthorizationKeyHex(const char *auth_key_hex) {
+    if (!auth_key_hex) {
+        return true; //nullptr (or "") means disable Auth
+    }
+    bool valid = true;
+    size_t i = 0;
+    while (i <= 2 * MO_AUTHKEY_LEN_MAX && auth_key_hex[i] != '\0') {
+        //check if character is in 0-9, a-f, or A-F
+        if ( (auth_key_hex[i] >= '0' && auth_key_hex[i] <= '9') ||
+             (auth_key_hex[i] >= 'a' && auth_key_hex[i] <= 'f') ||
+             (auth_key_hex[i] >= 'A' && auth_key_hex[i] <= 'F')) {
+            //yes, it is
+            i++;
+        } else {
+            //no, it isn't
+            valid = false;
+            break;
+        }
+    }
+    valid &= auth_key_hex[i] == '\0';
+    valid &= (i % 2) == 0;
+    if (!valid) {
+        MO_DBG_ERR("AuthorizationKey must be hex with at most 20 octets");
+        (void)0;
+    }
+    return valid;
+}
--- a/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient.h
+++ b/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient.h
@@ -0,0 +1,141 @@
+// matth-x/MicroOcppMongoose
+// Copyright Matthias Akstaller 2019 - 2024
+// GPL-3.0 License (see LICENSE)
+
+#ifndef MO_MONGOOSECLIENT_H
+#define MO_MONGOOSECLIENT_H
+
+#if defined(ARDUINO) //fix for conflicting definitions of IPAddress on Arduino
+#include <Arduino.h>
+#include <IPAddress.h>
+#endif
+
+#include "mongoose.h"
+#include <MicroOcpp/Core/Connection.h>
+#include <MicroOcpp/Version.h>
+
+#include <string>
+#include <memory>
+
+#ifndef MO_WSCONN_FN
+#define MO_WSCONN_FN (MO_FILENAME_PREFIX "ws-conn.jsn")
+#define MO_WSCONN_FN_V201 (MO_FILENAME_PREFIX "ws-conn-v201.jsn")
+#endif
+
+#define MO_AUTHKEY_LEN_MAX 63 // Basic Auth password length for both OCPP 1.6 and 2.0.1
+
+namespace MicroOcpp {
+
+class FilesystemAdapter;
+class Configuration;
+
+#if MO_ENABLE_V201
+class Variable;
+class VariableContainer;
+class VariableContainerOwning;
+#endif
+
+class MOcppMongooseClient : public MicroOcpp::Connection {
+private:
+    struct mg_mgr *mgr {nullptr};
+    struct mg_connection *websocket {nullptr};
+    std::string backend_url;
+    std::string cb_id;
+    std::string url; //url = backend_url + '/' + cb_id
+    unsigned char auth_key [MO_AUTHKEY_LEN_MAX + 1]; // Stores the raw Basic Auth password bytes. Appends a terminating '\0' for legacy accessors.
+    size_t auth_key_len;
+    const char *ca_cert; //zero-copy. The host system must ensure that this pointer remains valid during the lifetime of this class
+    std::shared_ptr<Configuration> setting_backend_url_str;
+    std::shared_ptr<Configuration> setting_cb_id_str;
+    std::shared_ptr<Configuration> setting_auth_key_hex_str;
+    unsigned long last_status_dbg_msg {0}, last_recv {0};
+    std::shared_ptr<Configuration> reconnect_interval_int; //minimum time between two connect trials in s
+    unsigned long last_reconnection_attempt {-1UL / 2UL};
+    std::shared_ptr<Configuration> stale_timeout_int; //inactivity period after which the connection will be closed
+    std::shared_ptr<Configuration> ws_ping_interval_int; //heartbeat intervall in s. 0 sets hb off
+    unsigned long last_hb {0};
+#if MO_ENABLE_V201
+    std::unique_ptr<VariableContainerOwning> websocketSettings;
+    Variable *v201csmsUrlString = nullptr;
+    Variable *v201identityString = nullptr;
+    Variable *v201basicAuthPasswordString = nullptr;
+#endif
+    bool connection_established {false};
+    unsigned long last_connection_established {-1UL / 2UL};
+    bool connection_closing {false};
+    ReceiveTXTcallback receiveTXTcallback = [] (const char *, size_t) {return false;};
+
+    ProtocolVersion protocolVersion;
+
+    void reconnect();
+
+    void maintainWsConn();
+
+public:
+    MOcppMongooseClient(struct mg_mgr *mgr, 
+            const char *backend_url_factory, 
+            const char *charge_box_id_factory,
+            unsigned char *auth_key_factory, size_t auth_key_factory_len,
+            const char *ca_cert = nullptr, //zero-copy, the string must outlive this class and mg_mgr. Forwards this string to Mongoose as ssl_ca_cert (see https://github.com/cesanta/mongoose/blob/ab650ec5c99ceb52bb9dc59e8e8ec92a2724932b/mongoose.h#L4192)
+            std::shared_ptr<MicroOcpp::FilesystemAdapter> filesystem = nullptr,
+            ProtocolVersion protocolVersion = ProtocolVersion(1,6));
+    
+    //DEPRECATED: will be removed in a future release
+    MOcppMongooseClient(struct mg_mgr *mgr, 
+            const char *backend_url_factory = nullptr, 
+            const char *charge_box_id_factory = nullptr,
+            const char *auth_key_factory = nullptr,
+            const char *ca_cert = nullptr, //zero-copy, the string must outlive this class and mg_mgr. Forwards this string to Mongoose as ssl_ca_cert (see https://github.com/cesanta/mongoose/blob/ab650ec5c99ceb52bb9dc59e8e8ec92a2724932b/mongoose.h#L4192)
+            std::shared_ptr<MicroOcpp::FilesystemAdapter> filesystem = nullptr,
+            ProtocolVersion protocolVersion = ProtocolVersion(1,6));
+
+    ~MOcppMongooseClient();
+
+    void loop() override;
+
+    bool sendTXT(const char *msg, size_t length) override;
+
+    void setReceiveTXTcallback(MicroOcpp::ReceiveTXTcallback &receiveTXT) override {
+        this->receiveTXTcallback = receiveTXT;
+    }
+
+    MicroOcpp::ReceiveTXTcallback &getReceiveTXTcallback() {
+        return receiveTXTcallback;
+    }
+
+    //update WS configs. To apply the updates, call `reloadConfigs()` afterwards
+    void setBackendUrl(const char *backend_url);
+    void setChargeBoxId(const char *cb_id);
+    void setAuthKey(const char *auth_key); //DEPRECATED: will be removed in a future release
+    void setAuthKey(const unsigned char *auth_key, size_t len); //set the auth key in bytes-encoded format
+    void setCaCert(const char *ca_cert); //forwards this string to Mongoose as ssl_ca_cert (see https://github.com/cesanta/mongoose/blob/ab650ec5c99ceb52bb9dc59e8e8ec92a2724932b/mongoose.h#L4192)
+
+    void reloadConfigs();
+
+    const char *getBackendUrl() {return backend_url.c_str();}
+    const char *getChargeBoxId() {return cb_id.c_str();}
+    const char *getAuthKey() {return (const char*)auth_key;} //DEPRECATED: will be removed in a future release
+    int printAuthKey(unsigned char *buf, size_t size);
+    const char *getCaCert() {return ca_cert ? ca_cert : "";}
+
+    const char *getUrl() {return url.c_str();}
+
+    void setConnectionOpen(bool open);
+    bool isConnectionOpen() {return connection_established && !connection_closing;}
+    bool isConnected() {return isConnectionOpen();}
+    void cleanConnection();
+
+    void updateRcvTimer();
+    unsigned long getLastRecv(); //get time of last successful receive in millis
+    unsigned long getLastConnected(); //get time of last connection establish
+
+#if MO_ENABLE_V201
+    //WS client creates and manages its own Variables. This getter function is a temporary solution, in future
+    //the WS client will be initialized with a Context reference for registering the Variables directly
+    VariableContainer *getVariableContainer();
+#endif
+};
+
+}
+
+#endif
--- a/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient_c.cpp
+++ b/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient_c.cpp
@@ -0,0 +1,129 @@
+// matth-x/MicroOcppMongoose
+// Copyright Matthias Akstaller 2019 - 2024
+// GPL-3.0 License (see LICENSE)
+
+#include "MicroOcppMongooseClient_c.h"
+#include "MicroOcppMongooseClient.h"
+
+#include <MicroOcpp/Core/FilesystemAdapter.h>
+#include <MicroOcpp/Debug.h>
+
+using namespace MicroOcpp;
+
+OCPP_Connection *ocpp_makeConnection(struct mg_mgr *mgr,
+        const char *backend_url_default,
+        const char *charge_box_id_default,
+        const char *auth_key_default,
+        const char *CA_cert_default,
+        OCPP_FilesystemOpt fsopt) {
+    
+    std::shared_ptr<MicroOcpp::FilesystemAdapter> filesystem;
+    
+#ifndef MO_DEACTIVATE_FLASH
+    filesystem = makeDefaultFilesystemAdapter(fsopt);
+#endif
+
+    auto sock = new MOcppMongooseClient(mgr,
+            backend_url_default,
+            charge_box_id_default,
+            auth_key_default,
+            CA_cert_default,
+            filesystem);
+    
+    return reinterpret_cast<OCPP_Connection*>(sock);;
+}
+
+void ocpp_deinitConnection(OCPP_Connection *sock) {
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    delete mgsock;
+}
+
+void ocpp_setBackendUrl(OCPP_Connection *sock, const char *backend_url) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    mgsock->setBackendUrl(backend_url);
+}
+
+void ocpp_setChargeBoxId(OCPP_Connection *sock, const char *cb_id) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    mgsock->setChargeBoxId(cb_id);
+}
+
+void ocpp_setAuthKey(OCPP_Connection *sock, const char *auth_key) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    mgsock->setAuthKey(auth_key);
+}
+
+void ocpp_setCaCert(OCPP_Connection *sock, const char *ca_cert) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    mgsock->setCaCert(ca_cert);
+}
+
+void ocpp_reloadConfigs(OCPP_Connection *sock) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    mgsock->reloadConfigs();
+}
+
+const char *ocpp_getBackendUrl(OCPP_Connection *sock) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return nullptr;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    return mgsock->getBackendUrl();
+}
+
+const char *ocpp_getChargeBoxId(OCPP_Connection *sock) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return nullptr;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    return mgsock->getChargeBoxId();
+}
+
+const char *ocpp_getAuthKey(OCPP_Connection *sock) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return nullptr;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    return mgsock->getAuthKey();
+}
+
+const char *ocpp_getCaCert(OCPP_Connection *sock) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return nullptr;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    return mgsock->getCaCert();
+}
+
+bool ocpp_isConnectionOpen(OCPP_Connection *sock) {
+    if (!sock) {
+        MO_DBG_ERR("invalid argument");
+        return false;
+    }
+    auto mgsock = reinterpret_cast<MOcppMongooseClient*>(sock);
+    return mgsock->isConnectionOpen();
+}
--- a/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient_c.h
+++ b/hardware/firmware/lib/MicroOcppMongoose/src/MicroOcppMongooseClient_c.h
@@ -0,0 +1,51 @@
+// matth-x/MicroOcppMongoose
+// Copyright Matthias Akstaller 2019 - 2024
+// GPL-3.0 License (see LICENSE)
+
+#ifndef MO_MONGOOSECLIENT_C_H
+#define MO_MONGOOSECLIENT_C_H
+
+#if defined(__cplusplus) && defined(ARDUINO) //fix for conflicting defitions of IPAddress on Arduino
+#include <Arduino.h>
+#include <IPAddress.h>
+#endif
+
+#include "mongoose.h"
+#include <MicroOcpp/Core/ConfigurationOptions.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+struct OCPP_Connection;
+typedef struct OCPP_Connection OCPP_Connection;
+
+OCPP_Connection *ocpp_makeConnection(struct mg_mgr *mgr,
+        const char *backend_url_default,   //all cstrings can be NULL
+        const char *charge_box_id_default,
+        const char *auth_key_default,
+        const char *CA_cert_default,
+        struct OCPP_FilesystemOpt fsopt);
+
+void ocpp_deinitConnection(OCPP_Connection *sock);
+
+//update WS configs. To apply the updates, call `ocpp_reloadConfigs()` afterwards
+void ocpp_setBackendUrl(OCPP_Connection *sock, const char *backend_url);
+void ocpp_setChargeBoxId(OCPP_Connection *sock, const char *cb_id);
+void ocpp_setAuthKey(OCPP_Connection *sock, const char *auth_key);
+void ocpp_setCaCert(OCPP_Connection *sock, const char *ca_cert);
+
+void ocpp_reloadConfigs(OCPP_Connection *sock);
+
+const char *ocpp_getBackendUrl(OCPP_Connection *sock);
+const char *ocpp_getChargeBoxId(OCPP_Connection *sock);
+const char *ocpp_getAuthKey(OCPP_Connection *sock);
+const char *ocpp_getCaCert(OCPP_Connection *sock);
+
+bool ocpp_isConnectionOpen(OCPP_Connection *sock);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/hardware/firmware/platformio.ini
+++ b/hardware/firmware/platformio.ini
@@ -14,7 +14,6 @@ board = rymcu-esp32-devkitc
 framework = arduino
 lib_deps = 
 	matth-x/MicroOcpp@^1.2.0
-	matth-x/MicroOcppMongoose@^1.2.0
 	roboticsbrno/SmartLeds@^3.1.5
 	miguelbalboa/MFRC522@^1.4.12
 	tzapu/WiFiManager@^2.0.17
--- a/hardware/firmware/src/config.h
+++ b/hardware/firmware/src/config.h
@@ -4,10 +4,12 @@
 // For production: ws://csms.helios.bh8.ga:8180/steve/websocket/CentralSystemService
 #define CFG_OCPP_BACKEND "wss://csms-server.uniiem.com/ocpp"
 // #define CFG_CP_IDENTIFIER "CQWU_HHB_0001"
-#define CFG_CP_IDENTIFIER "ICP_906A28"
+#define CFG_CP_IDENTIFIER ""
 #define CFG_CB_SERIAL "REDAone_prototype00"
 #define CFG_CP_FW_VERSION "1.0.0"
 #define CFG_CP_MODAL "Helios DA One"
 #define CFG_CP_VENDOR "RayineElec"
-// #define CFG_AUTHORIZATIONKEY "my_secret_key"
-#define CFG_AUTHORIZATIONKEY nullptr
+// OCPP Security Profile 1: sent as Authorization: Basic base64(<chargePointIdentifier>:<password>)
+// Set to nullptr to disable authentication
+// #define CFG_OCPP_PASSWORD "my_password"
+#define CFG_OCPP_PASSWORD nullptr
--- a/hardware/firmware/src/main.cpp
+++ b/hardware/firmware/src/main.cpp
@@ -37,7 +37,7 @@ char cpSerial[13];
 // OCPP Configuration Variables
 char ocpp_backend[128];
 char cp_identifier[64];
-char auth_key[64];
+char ocpp_password[64];
 bool shouldSaveConfig = false;

 // callback notifying us of the need to save config
@@ -145,8 +145,16 @@ void setup()
           "%02X%02X%02X%02X%02X%02X",
           mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);

-  // Auto-generate Charge Point Identifier based on MAC (e.g. HLCP_A1B2C3)
-  snprintf(cp_identifier, sizeof(cp_identifier), "HLCP_%s", cpSerial + 6);
+  if (strlen(CFG_CP_IDENTIFIER) > 0)
+  {
+    strncpy(cp_identifier, CFG_CP_IDENTIFIER, sizeof(cp_identifier) - 1);
+    cp_identifier[sizeof(cp_identifier) - 1] = '\0';
+  }
+  else
+  {
+    // Auto-generate Charge Point Identifier based on MAC (e.g. HLCP_A1B2C3)
+    snprintf(cp_identifier, sizeof(cp_identifier), "HLCP_%s", cpSerial + 6);
+  }

  // reset LED
  leds[0] = Rgb{0, 0, 0};
@@ -155,6 +163,7 @@ void setup()
  Serial.begin(115200);
  delay(1000);
  Serial.printf("\n\n%s(%s) made by %s\n", CFG_CP_MODAL, cpSerial, CFG_CP_VENDOR);
+  Serial.printf("Charge Point Identifier: %s\n", cp_identifier);
  Serial.println("Initializing firmware...\n");

  // Initialize LED
@@ -169,13 +178,15 @@ void setup()
  Preferences preferences;
  preferences.begin("ocpp-config", false);
  String b = preferences.getString("backend", CFG_OCPP_BACKEND);
-  String a = preferences.getString("auth_key", CFG_AUTHORIZATIONKEY ? CFG_AUTHORIZATIONKEY : "");
+  String p = preferences.getString("ocpp_password", CFG_OCPP_PASSWORD ? CFG_OCPP_PASSWORD : "");

  Serial.printf("\n[OCPP] Loaded Backend URL: %s\n", b.c_str());
-  Serial.printf("[OCPP] Loaded Auth Key length: %d\n", a.length());
+  Serial.printf("[OCPP] Loaded Password length: %d\n", p.length());

-  strncpy(ocpp_backend, b.c_str(), sizeof(ocpp_backend));
-  strncpy(auth_key, a.c_str(), sizeof(auth_key));
+  strncpy(ocpp_backend, b.c_str(), sizeof(ocpp_backend) - 1);
+  ocpp_backend[sizeof(ocpp_backend) - 1] = '\0';
+  strncpy(ocpp_password, p.c_str(), sizeof(ocpp_password) - 1);
+  ocpp_password[sizeof(ocpp_password) - 1] = '\0';

  WiFiManager wm;
  wm.setSaveConfigCallback(saveConfigCallback);
@@ -184,10 +195,10 @@ void setup()

  // Use autocomplete=off to prevent browsers from autofilling old URLs after a reset
  WiFiManagerParameter custom_ocpp_backend("backend", "OCPP Backend URL", ocpp_backend, 128, "autocomplete=\"off\"");
-  WiFiManagerParameter custom_auth_key("auth_key", "Auth Key (leave blank if none)", auth_key, 64, "autocomplete=\"off\"");
+  WiFiManagerParameter custom_ocpp_password("ocpp_password", "OCPP Basic AuthKey", ocpp_password, 64, "autocomplete=\"off\" type=\"password\"");

  wm.addParameter(&custom_ocpp_backend);
-  wm.addParameter(&custom_auth_key);
+  wm.addParameter(&custom_ocpp_password);

  const char *customHeadElement = R"rawliteral(
    <style>
@@ -334,11 +345,13 @@ void setup()

  if (shouldSaveConfig)
  {
-    strncpy(ocpp_backend, custom_ocpp_backend.getValue(), sizeof(ocpp_backend));
-    strncpy(auth_key, custom_auth_key.getValue(), sizeof(auth_key));
+    strncpy(ocpp_backend, custom_ocpp_backend.getValue(), sizeof(ocpp_backend) - 1);
+    ocpp_backend[sizeof(ocpp_backend) - 1] = '\0';
+    strncpy(ocpp_password, custom_ocpp_password.getValue(), sizeof(ocpp_password) - 1);
+    ocpp_password[sizeof(ocpp_password) - 1] = '\0';

    preferences.putString("backend", ocpp_backend);
-    preferences.putString("auth_key", auth_key);
+    preferences.putString("ocpp_password", ocpp_password);
    Serial.println("Saved new OCPP config to Preferences");
  }
  preferences.end();
@@ -354,8 +367,40 @@ void setup()
    s_led_state = LED_WIFI_CONNECTED;

    mg_mgr_init(&mgr);
-    const char *final_auth_key = (strlen(auth_key) > 0) ? auth_key : nullptr;
-    MicroOcpp::MOcppMongooseClient *client = new MicroOcpp::MOcppMongooseClient(&mgr, ocpp_backend, cp_identifier, final_auth_key, "", MicroOcpp::makeDefaultFilesystemAdapter(MicroOcpp::FilesystemOpt::Use_Mount_FormatOnFail), MicroOcpp::ProtocolVersion(1, 6));
+    const char *basic_auth_password = (strlen(ocpp_password) > 0) ? ocpp_password : nullptr;
+    unsigned char *basic_auth_password_bytes = nullptr;
+    size_t basic_auth_password_len = 0;
+
+    if (basic_auth_password)
+    {
+      basic_auth_password_bytes = reinterpret_cast<unsigned char *>(const_cast<char *>(basic_auth_password));
+      basic_auth_password_len = strlen(basic_auth_password);
+    }
+
+    MicroOcpp::MOcppMongooseClient *client = new MicroOcpp::MOcppMongooseClient(
+        &mgr,
+        ocpp_backend,
+        cp_identifier,
+        nullptr,
+        0,
+        "",
+        MicroOcpp::makeDefaultFilesystemAdapter(MicroOcpp::FilesystemOpt::Use_Mount_FormatOnFail),
+        MicroOcpp::ProtocolVersion(1, 6));
+
+    // Preferences and firmware config are the source of truth. Override any stale
+    // values cached in MicroOcpp's ws-conn storage before the first reconnect cycle.
+    client->setBackendUrl(ocpp_backend);
+    client->setChargeBoxId(cp_identifier);
+    if (basic_auth_password_bytes)
+    {
+      client->setAuthKey(basic_auth_password_bytes, basic_auth_password_len);
+    }
+    else
+    {
+      client->setAuthKey(reinterpret_cast<const unsigned char *>(""), 0);
+    }
+    client->reloadConfigs();
+
    mocpp_initialize(*client, ChargerCredentials(CFG_CP_MODAL, CFG_CP_VENDOR, CFG_CP_FW_VERSION, cpSerial, nullptr, nullptr, CFG_CB_SERIAL, nullptr, nullptr), MicroOcpp::makeDefaultFilesystemAdapter(MicroOcpp::FilesystemOpt::Use_Mount_FormatOnFail));

    // For development/recovery: Set up BOOT button (GPIO 0)
@@ -417,7 +462,7 @@ void loop()
        Preferences preferences;
        preferences.begin("ocpp-config", false);
        preferences.remove("backend");
-        preferences.remove("auth_key");
+        preferences.remove("ocpp_password");
        preferences.clear();
        preferences.end();
        Serial.println("NVS ocpp-config cleared.");
--- a/hardware/pcb-kicad/.gitkeep
+++ b/hardware/pcb-kicad/.gitkeep
--- a/hardware/pcb/.gitignore
+++ b/hardware/pcb/.gitignore
@@ -0,0 +1,2 @@
+*-backups
+
--- a/hardware/pcb/HeliosDAONE.kicad_pcb
+++ b/hardware/pcb/HeliosDAONE.kicad_pcb
@@ -0,0 +1,2 @@
+(kicad_pcb (version 20241229) (generator "pcbnew") (generator_version "9.0")
+)
--- a/hardware/pcb/HeliosDAONE.kicad_prl
+++ b/hardware/pcb/HeliosDAONE.kicad_prl
@@ -0,0 +1,99 @@
+{
+  "board": {
+    "active_layer": 0,
+    "active_layer_preset": "",
+    "auto_track_width": true,
+    "hidden_netclasses": [],
+    "hidden_nets": [],
+    "high_contrast_mode": 0,
+    "net_color_mode": 1,
+    "opacity": {
+      "images": 0.6,
+      "pads": 1.0,
+      "shapes": 1.0,
+      "tracks": 1.0,
+      "vias": 1.0,
+      "zones": 0.6
+    },
+    "selection_filter": {
+      "dimensions": true,
+      "footprints": true,
+      "graphics": true,
+      "keepouts": true,
+      "lockedItems": false,
+      "otherItems": true,
+      "pads": true,
+      "text": true,
+      "tracks": true,
+      "vias": true,
+      "zones": true
+    },
+    "visible_items": [
+      "vias",
+      "footprint_text",
+      "footprint_anchors",
+      "ratsnest",
+      "grid",
+      "footprints_front",
+      "footprints_back",
+      "footprint_values",
+      "footprint_references",
+      "tracks",
+      "drc_errors",
+      "drawing_sheet",
+      "bitmaps",
+      "pads",
+      "zones",
+      "drc_warnings",
+      "drc_exclusions",
+      "locked_item_shadows",
+      "conflict_shadows",
+      "shapes"
+    ],
+    "visible_layers": "ffffffff_ffffffff_ffffffff_ffffffff",
+    "zone_display_mode": 0
+  },
+  "git": {
+    "integration_disabled": false,
+    "repo_type": "",
+    "repo_username": "",
+    "ssh_key": ""
+  },
+  "meta": {
+    "filename": "HeliosDAONE.kicad_prl",
+    "version": 5
+  },
+  "net_inspector_panel": {
+    "col_hidden": [],
+    "col_order": [],
+    "col_widths": [],
+    "custom_group_rules": [],
+    "expanded_rows": [],
+    "filter_by_net_name": true,
+    "filter_by_netclass": true,
+    "filter_text": "",
+    "group_by_constraint": false,
+    "group_by_netclass": false,
+    "show_unconnected_nets": false,
+    "show_zero_pad_nets": false,
+    "sort_ascending": true,
+    "sorting_column": -1
+  },
+  "open_jobsets": [],
+  "project": {
+    "files": []
+  },
+  "schematic": {
+    "selection_filter": {
+      "graphics": true,
+      "images": true,
+      "labels": true,
+      "lockedItems": false,
+      "otherItems": true,
+      "pins": true,
+      "symbols": true,
+      "text": true,
+      "wires": true
+    }
+  }
+}
--- a/hardware/pcb/HeliosDAONE.kicad_pro
+++ b/hardware/pcb/HeliosDAONE.kicad_pro
@@ -0,0 +1,418 @@
+{
+  "board": {
+    "3dviewports": [],
+    "design_settings": {
+      "defaults": {},
+      "diff_pair_dimensions": [],
+      "drc_exclusions": [],
+      "rules": {},
+      "track_widths": [],
+      "via_dimensions": []
+    },
+    "ipc2581": {
+      "dist": "",
+      "distpn": "",
+      "internal_id": "",
+      "mfg": "",
+      "mpn": ""
+    },
+    "layer_pairs": [],
+    "layer_presets": [],
+    "viewports": []
+  },
+  "boards": [],
+  "cvpcb": {
+    "equivalence_files": []
+  },
+  "erc": {
+    "erc_exclusions": [],
+    "meta": {
+      "version": 0
+    },
+    "pin_map": [
+      [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        1,
+        0,
+        0,
+        0,
+        0,
+        2
+      ],
+      [
+        0,
+        2,
+        0,
+        1,
+        0,
+        0,
+        1,
+        0,
+        2,
+        2,
+        2,
+        2
+      ],
+      [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        1,
+        0,
+        1,
+        0,
+        1,
+        2
+      ],
+      [
+        0,
+        1,
+        0,
+        0,
+        0,
+        0,
+        1,
+        1,
+        2,
+        1,
+        1,
+        2
+      ],
+      [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        1,
+        0,
+        0,
+        0,
+        0,
+        2
+      ],
+      [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        2
+      ],
+      [
+        1,
+        1,
+        1,
+        1,
+        1,
+        0,
+        1,
+        1,
+        1,
+        1,
+        1,
+        2
+      ],
+      [
+        0,
+        0,
+        0,
+        1,
+        0,
+        0,
+        1,
+        0,
+        0,
+        0,
+        0,
+        2
+      ],
+      [
+        0,
+        2,
+        1,
+        2,
+        0,
+        0,
+        1,
+        0,
+        2,
+        2,
+        2,
+        2
+      ],
+      [
+        0,
+        2,
+        0,
+        1,
+        0,
+        0,
+        1,
+        0,
+        2,
+        0,
+        0,
+        2
+      ],
+      [
+        0,
+        2,
+        1,
+        1,
+        0,
+        0,
+        1,
+        0,
+        2,
+        0,
+        0,
+        2
+      ],
+      [
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2
+      ]
+    ],
+    "rule_severities": {
+      "bus_definition_conflict": "error",
+      "bus_entry_needed": "error",
+      "bus_to_bus_conflict": "error",
+      "bus_to_net_conflict": "error",
+      "different_unit_footprint": "error",
+      "different_unit_net": "error",
+      "duplicate_reference": "error",
+      "duplicate_sheet_names": "error",
+      "endpoint_off_grid": "warning",
+      "extra_units": "error",
+      "footprint_filter": "ignore",
+      "footprint_link_issues": "warning",
+      "four_way_junction": "ignore",
+      "global_label_dangling": "warning",
+      "hier_label_mismatch": "error",
+      "label_dangling": "error",
+      "label_multiple_wires": "warning",
+      "lib_symbol_issues": "warning",
+      "lib_symbol_mismatch": "warning",
+      "missing_bidi_pin": "warning",
+      "missing_input_pin": "warning",
+      "missing_power_pin": "error",
+      "missing_unit": "warning",
+      "multiple_net_names": "warning",
+      "net_not_bus_member": "warning",
+      "no_connect_connected": "warning",
+      "no_connect_dangling": "warning",
+      "pin_not_connected": "error",
+      "pin_not_driven": "error",
+      "pin_to_pin": "warning",
+      "power_pin_not_driven": "error",
+      "same_local_global_label": "warning",
+      "similar_label_and_power": "warning",
+      "similar_labels": "warning",
+      "similar_power": "warning",
+      "simulation_model_issue": "ignore",
+      "single_global_label": "ignore",
+      "unannotated": "error",
+      "unconnected_wire_endpoint": "warning",
+      "undefined_netclass": "error",
+      "unit_value_mismatch": "error",
+      "unresolved_variable": "error",
+      "wire_dangling": "error"
+    }
+  },
+  "libraries": {
+    "pinned_footprint_libs": [],
+    "pinned_symbol_libs": []
+  },
+  "meta": {
+    "filename": "HeliosDAONE.kicad_pro",
+    "version": 3
+  },
+  "net_settings": {
+    "classes": [
+      {
+        "bus_width": 12,
+        "clearance": 0.2,
+        "diff_pair_gap": 0.25,
+        "diff_pair_via_gap": 0.25,
+        "diff_pair_width": 0.2,
+        "line_style": 0,
+        "microvia_diameter": 0.3,
+        "microvia_drill": 0.1,
+        "name": "Default",
+        "pcb_color": "rgba(0, 0, 0, 0.000)",
+        "priority": 2147483647,
+        "schematic_color": "rgba(0, 0, 0, 0.000)",
+        "track_width": 0.2,
+        "via_diameter": 0.6,
+        "via_drill": 0.3,
+        "wire_width": 6
+      }
+    ],
+    "meta": {
+      "version": 4
+    },
+    "net_colors": null,
+    "netclass_assignments": null,
+    "netclass_patterns": []
+  },
+  "pcbnew": {
+    "last_paths": {
+      "gencad": "",
+      "idf": "",
+      "netlist": "",
+      "plot": "",
+      "pos_files": "",
+      "specctra_dsn": "",
+      "step": "",
+      "svg": "",
+      "vrml": ""
+    },
+    "page_layout_descr_file": ""
+  },
+  "schematic": {
+    "annotate_start_num": 0,
+    "bom_export_filename": "${PROJECTNAME}.csv",
+    "bom_fmt_presets": [],
+    "bom_fmt_settings": {
+      "field_delimiter": ",",
+      "keep_line_breaks": false,
+      "keep_tabs": false,
+      "name": "CSV",
+      "ref_delimiter": ",",
+      "ref_range_delimiter": "",
+      "string_delimiter": "\""
+    },
+    "bom_presets": [],
+    "bom_settings": {
+      "exclude_dnp": false,
+      "fields_ordered": [
+        {
+          "group_by": false,
+          "label": "Reference",
+          "name": "Reference",
+          "show": true
+        },
+        {
+          "group_by": false,
+          "label": "Qty",
+          "name": "${QUANTITY}",
+          "show": true
+        },
+        {
+          "group_by": true,
+          "label": "Value",
+          "name": "Value",
+          "show": true
+        },
+        {
+          "group_by": true,
+          "label": "DNP",
+          "name": "${DNP}",
+          "show": true
+        },
+        {
+          "group_by": true,
+          "label": "Exclude from BOM",
+          "name": "${EXCLUDE_FROM_BOM}",
+          "show": true
+        },
+        {
+          "group_by": true,
+          "label": "Exclude from Board",
+          "name": "${EXCLUDE_FROM_BOARD}",
+          "show": true
+        },
+        {
+          "group_by": true,
+          "label": "Footprint",
+          "name": "Footprint",
+          "show": true
+        },
+        {
+          "group_by": false,
+          "label": "Datasheet",
+          "name": "Datasheet",
+          "show": true
+        }
+      ],
+      "filter_string": "",
+      "group_symbols": true,
+      "include_excluded_from_bom": true,
+      "name": "Default Editing",
+      "sort_asc": true,
+      "sort_field": "位号"
+    },
+    "connection_grid_size": 50.0,
+    "drawing": {
+      "dashed_lines_dash_length_ratio": 12.0,
+      "dashed_lines_gap_length_ratio": 3.0,
+      "default_line_thickness": 6.0,
+      "default_text_size": 50.0,
+      "field_names": [],
+      "intersheets_ref_own_page": false,
+      "intersheets_ref_prefix": "",
+      "intersheets_ref_short": false,
+      "intersheets_ref_show": false,
+      "intersheets_ref_suffix": "",
+      "junction_size_choice": 3,
+      "label_size_ratio": 0.375,
+      "operating_point_overlay_i_precision": 3,
+      "operating_point_overlay_i_range": "~A",
+      "operating_point_overlay_v_precision": 3,
+      "operating_point_overlay_v_range": "~V",
+      "overbar_offset_ratio": 1.23,
+      "pin_symbol_size": 25.0,
+      "text_offset_ratio": 0.15
+    },
+    "legacy_lib_dir": "",
+    "legacy_lib_list": [],
+    "meta": {
+      "version": 1
+    },
+    "net_format_name": "",
+    "page_layout_descr_file": "",
+    "plot_directory": "",
+    "space_save_all_events": true,
+    "spice_current_sheet_as_root": false,
+    "spice_external_command": "spice \"%I\"",
+    "spice_model_current_sheet_as_root": true,
+    "spice_save_all_currents": false,
+    "spice_save_all_dissipations": false,
+    "spice_save_all_voltages": false,
+    "subpart_first_id": 65,
+    "subpart_id_separator": 0
+  },
+  "sheets": [
+    [
+      "ef4a6f87-87d3-400e-b11f-0c7519b83474",
+      "Root"
+    ]
+  ],
+  "text_variables": {}
+}
--- a/hardware/pcb/HeliosDAONE.kicad_sch
+++ b/hardware/pcb/HeliosDAONE.kicad_sch
@@ -0,0 +1,20 @@
+(kicad_sch
+	(version 20250114)
+	(generator "eeschema")
+	(generator_version "9.0")
+	(uuid "ef4a6f87-87d3-400e-b11f-0c7519b83474")
+	(paper "A4")
+	(title_block
+		(title "Helios DA ONE")
+		(date "2026-02-18")
+		(rev "1.0.0")
+		(company "RayineElec")
+	)
+	(lib_symbols)
+	(sheet_instances
+		(path "/"
+			(page "1")
+		)
+	)
+	(embedded_fonts no)
+)
Author	SHA1	Message	Date
Timothy Yin	e61e244c39	chore: generate migration	2026-03-18 15:44:43 +08:00
Timothy Yin	2c90404637	Unify charge point command channel status	2026-03-18 15:26:56 +08:00
Timothy Yin	3508e7de19	docs: update README.md	2026-03-18 13:05:49 +08:00
Timothy Yin	adc67e428d	chore(pcb): initial kicad project	2026-03-18 12:47:56 +08:00
Timothy Yin	dee947ce3e	feat(csms): add system settings management for OCPP 1.6J heartbeat interval	2026-03-17 01:42:29 +08:00
Timothy Yin	4d940e2cd4	chore(firmware): update text	2026-03-17 01:26:12 +08:00
Timothy Yin	8371b2a76b	feat(firmware): add Mongoose client implementation for OCPP communication	2026-03-17 01:25:41 +08:00
Timothy Yin	e1fb43d57b	refactor(csms): 更新 OCPP 认证相关文本	2026-03-17 00:38:37 +08:00
Timothy Yin	5825783f8b	feat(csms): update schema for ocpp authorization	2026-03-17 00:32:54 +08:00
Timothy Yin	e884fc5bc0	feat(firmware): 更新 OCPP 配置，添加密码字段以支持基本认证	2026-03-16 17:17:15 +08:00
Timothy Yin	cf0861f8f6	feat(csms): 添加 OCPP 鉴权	2026-03-16 16:53:39 +08:00
Timothy Yin	4885cf6778	refactor: 移除重复的 tariff-schema 导出	2026-03-16 15:27:40 +08:00
				`@@ -0,0 +1 @@`
				`ALTER TABLE "charge_point" ADD COLUMN "password_hash" varchar(255);`