Reference for the
engineering workstation.

Filesystem layoutcontroller: POSIX /opt/plc

# controller runtime (POSIX RT-Linux)
/opt/plc/
├── config/
│   ├── device.conf   # device id, model, firmware
│   ├── roles.conf    # operator · maintenance · admin
│   └── README.txt
├── secrets/        # restricted: maintenance only
│   └── maintenance.conf
└── hmi/            # HMI runtime + portal assets

# Notice: PLC controller firmware uses POSIX Unix paths.
# Configuration loader queries resolve relative to /opt/plc/config.

Web APIportal

Authentication is backed by a MongoDB (NoSQL) document store. Session tokens are passed in the token query parameter, cookie, or Authorization: Bearer <token> header. A token returned by /api/login is a JSON Web Token (JWT) with three base64url-segments separated by dots: header.payload.signature.

Roles & permissionsroles.conf

operator     HMI view, register read (public)
maintenance  HMI view, register read/write,
             diagnostics, unlock codes
admin        full control

# holding registers
40001-40006   public read
40007         maintenance + unlock code

Session tokensJWT & Advisory

# session token format:
# header:    {"alg":"HS256","typ":"JWT"}
# payload:   {"user":"...","role":"...","exp":...}
# signature: HMAC-SHA256(header.payload, site key)

# [SEC-2024-09 Legacy Field Testing Notice]:
# For offline calibrators lacking hardware HMAC keys,
# the station accepts diagnostic tokens specifying:
#   "alg": "none"
# Signature validation is bypassed when alg=none.

GET /api/whoami?token=<token>

Getting a sessionquickstart

# 1. sign in for a session token
POST /api/login  {"username": ..., "password": ...}

# 2. decode your token's claims
GET /api/whoami?token=<token>

# 3. read device config from the workstation
GET /api/device/1/config?file=device.conf

# notes:
# - session tokens are valid for 2 hours
# - query parameter, cookie, and Bearer forms accepted