给自己的ESP32项目加SoftAP安全配网入口：保存Wi-Fi和清配置恢复

# 私人终端；只把生成值保存在自己的私有配置和密码管理器
python3 -c 'import secrets; print(secrets.token_urlsafe(24)); print(secrets.token_urlsafe(24))'
# 在示例目录中
idf.py -B build -D SDKCONFIG="$PWD/sdkconfig.private" set-target esp32s3
idf.py -B build -D SDKCONFIG="$PWD/sdkconfig.private" menuconfig
idf.py -B build -D SDKCONFIG="$PWD/sdkconfig.private" build

python3.12 -m venv .client-venv
# Windows 使用 .client-venv\Scripts\python；macOS/Linux如下
.client-venv/bin/python -m pip install -r client-requirements.txt
# IDF_PATH应来自同一个5.5.5环境
.client-venv/bin/python provision_client.py

// ---- main/main.c ----
/* SPDX-License-Identifier: MIT */
#include <stdio.h>
#include <string.h>
#include <stdatomic.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "driver/gpio.h"
#include "esp_event.h"
#include "esp_wifi.h"
#include "esp_netif.h"
#include "esp_timer.h"
#include "esp_mac.h"
#include "esp_system.h"
#include "esp_log.h"
#include "nvs_flash.h"
#include "wifi_provisioning/manager.h"
#include "wifi_provisioning/scheme_softap.h"
#include "sdkconfig.h"
#include "provision_policy.h"
static const char *TAG="N08";
static atomic_bool in_provisioning, failed, ended, got_ip, lost;
static void event(void *arg,esp_event_base_t base,int32_t id,void *data){
 (void)arg;
 if(base==WIFI_PROV_EVENT){
  if(id==WIFI_PROV_START)ESP_LOGI(TAG,"PROVISIONING: Security1, credentials/PoP deliberately omitted");
  else if(id==WIFI_PROV_CRED_RECV)ESP_LOGI(TAG,"CREDENTIALS_RECEIVED: not yet successful; no SSID/password logged");
  else if(id==WIFI_PROV_CRED_FAIL){wifi_prov_sta_fail_reason_t *r=data;ESP_LOGW(TAG,"CREDENTIALS_FAILED reason=%d; retry within open window",*r);atomic_store(&failed,true);}
  else if(id==WIFI_PROV_CRED_SUCCESS)ESP_LOGI(TAG,"CREDENTIALS_SUCCESS: manager accepted connection; verify restart separately");
  else if(id==WIFI_PROV_END)atomic_store(&ended,true);
 }else if(base==WIFI_EVENT&&id==WIFI_EVENT_STA_START){if(!atomic_load(&in_provisioning))esp_wifi_connect();}
 else if(base==WIFI_EVENT&&id==WIFI_EVENT_STA_DISCONNECTED){atomic_store(&got_ip,false);atomic_store(&lost,true);}
 else if(base==IP_EVENT&&id==IP_EVENT_STA_GOT_IP){
  ip_event_got_ip_t *e=data;atomic_store(&got_ip,true);
  ESP_LOGI(TAG,"ONLINE IP=" IPSTR " (this is not a reboot persistence test)",IP2STR(&e->ip_info.ip));
 }
}
void app_main(void){
 gpio_config_t button={.pin_bit_mask=1ULL<<5,.mode=GPIO_MODE_INPUT,.pull_up_en=GPIO_PULLUP_ENABLE};ESP_ERROR_CHECK(gpio_config(&button));
 esp_err_t err=nvs_flash_init();
 if(err!=ESP_OK){ESP_LOGE(TAG,"NVS_INIT=%s; no automatic erase. Back up other app data, then deliberate erase-flash recovery.",esp_err_to_name(err));return;}
 ESP_ERROR_CHECK(esp_netif_init());ESP_ERROR_CHECK(esp_event_loop_create_default());
 esp_netif_create_default_wifi_sta();esp_netif_create_default_wifi_ap();
 wifi_init_config_t wi=WIFI_INIT_CONFIG_DEFAULT();ESP_ERROR_CHECK(esp_wifi_init(&wi));
 ESP_ERROR_CHECK(esp_wifi_set_storage(WIFI_STORAGE_FLASH));
 ESP_ERROR_CHECK(esp_event_handler_register(WIFI_PROV_EVENT,ESP_EVENT_ANY_ID,event,NULL));
 ESP_ERROR_CHECK(esp_event_handler_register(WIFI_EVENT,ESP_EVENT_ANY_ID,event,NULL));
 ESP_ERROR_CHECK(esp_event_handler_register(IP_EVENT,IP_EVENT_STA_GOT_IP,event,NULL));
 wifi_prov_mgr_config_t cfg={.scheme=wifi_prov_scheme_softap,.scheme_event_handler=WIFI_PROV_EVENT_HANDLER_NONE,.wifi_prov_conn_cfg={.wifi_conn_attempts=3}};
 ESP_ERROR_CHECK(wifi_prov_mgr_init(cfg));bool provisioned=false;ESP_ERROR_CHECK(wifi_prov_mgr_is_provisioned(&provisioned));
 int64_t began=esp_timer_get_time()/1000,next_retry=began;bool manager=true,window=false,station_running=provisioned;
 if(provisioned){
  ESP_LOGI(TAG,"STORED_CONFIG_PRESENT: existence only, not proof credentials still work");
  wifi_prov_mgr_deinit();manager=false;ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA));ESP_ERROR_CHECK(esp_wifi_start());
 }else if(!provisioning_secrets_valid(CONFIG_DEMO_POP,CONFIG_DEMO_AP_PASSWORD)){
  ESP_LOGW(TAG,"CONFIG_MISSING: set per-device PoP and AP passphrase. No AP opened; GPIO5 5-second reset still available.");
 }else{
  uint8_t mac[6];ESP_ERROR_CHECK(esp_read_mac(mac,ESP_MAC_WIFI_STA));char name[32];snprintf(name,sizeof(name),"HIX-N08-%02X%02X%02X",mac[3],mac[4],mac[5]);
  atomic_store(&in_provisioning,true);window=true;
  ESP_ERROR_CHECK(wifi_prov_mgr_start_provisioning(WIFI_PROV_SECURITY_1,CONFIG_DEMO_POP,name,CONFIG_DEMO_AP_PASSWORD));
  ESP_LOGI(TAG,"SoftAP name=%s, window=300s. Use official SoftAP client with Security1/PoP; no captive portal or plaintext form.",name);
 }
 ResetButton reset={0};
 for(;;){
  int64_t now=esp_timer_get_time()/1000;
  if(reset_step(&reset,gpio_get_level(GPIO_NUM_5)==0,now)){
   ESP_LOGW(TAG,"PHYSICAL_RESET: clearing persistent Wi-Fi stack config only; this is NOT all namespaces or a secure flash erase");
   err=wifi_prov_mgr_reset_provisioning();
   if(err==ESP_OK){ESP_LOGW(TAG,"Wi-Fi config reset returned OK; restarting, expect provisioning path");vTaskDelay(pdMS_TO_TICKS(200));esp_restart();}
   else ESP_LOGE(TAG,"RESET_FAILED=%s; no success/restart claimed",esp_err_to_name(err));
  }
  if(manager&&atomic_exchange(&failed,false)){
   err=wifi_prov_mgr_reset_sm_state_on_failure();ESP_LOGW(TAG,"RESET_FAILED_SESSION=%s; window deadline unchanged",esp_err_to_name(err));
  }
  if(manager&&window&&provisioning_expired(began,now)){
   window=false;wifi_prov_mgr_stop_provisioning();ESP_LOGW(TAG,"WINDOW_EXPIRED: stop requested; hold GPIO5 5s to clear/restart and reopen");
  }
  if(manager&&atomic_exchange(&ended,false)){
   wifi_prov_mgr_deinit();manager=false;window=false;station_running=atomic_load(&got_ip);atomic_store(&in_provisioning,false);
   if(!atomic_load(&got_ip)){esp_wifi_stop();ESP_LOGW(TAG,"PROVISIONING_ENDED_OFFLINE: no automatic AP reopen");}
  }
  if(station_running&&!manager&&!atomic_load(&in_provisioning)&&atomic_exchange(&lost,false))next_retry=now+2000;
  if(station_running&&!manager&&!atomic_load(&got_ip)&&now>=next_retry){
   next_retry=now+5000;err=esp_wifi_connect();if(err!=ESP_OK)ESP_LOGW(TAG,"CONNECT_REQUEST=%s; physical reset available",esp_err_to_name(err));
  }
  vTaskDelay(pdMS_TO_TICKS(20));
 }
}

# ---- provision_client.py ----
#!/usr/bin/env python3
# SPDX-License-Identifier: MIT
"""Official fixed-IDF client functions; no credentials in argv or debug output."""
import argparse, asyncio, getpass, os, sys
from pathlib import Path

def sdk_client():
    root=Path(os.environ['IDF_PATH'])
    sys.path.insert(0,str(root/'tools/esp_prov'))
    import esp_prov
    return esp_prov

async def provision(address,pop,ssid,password):
    client=sdk_client()
    tp=await client.get_transport('softap',address)
    if not tp: raise RuntimeError('transport unavailable')
    try:
        sec=client.get_security(1,0,None,None,pop,False)
        if not await client.establish_session(tp,sec): raise RuntimeError('Security1 session rejected; no credentials sent')
        if not await client.send_wifi_config(tp,sec,ssid,password): raise RuntimeError('SetConfig rejected')
        if not await client.apply_wifi_config(tp,sec): raise RuntimeError('ApplyConfig rejected')
        for _ in range(20):
            state=await client.get_wifi_config(tp,sec)
            if state=='connected': return True
            if state in ('failed','disconnected'): return False
            await asyncio.sleep(1)
        raise RuntimeError('status window elapsed; inspect device without assuming success')
    finally:
        tp.conn.close()

if __name__=='__main__':
    parser=argparse.ArgumentParser(description=__doc__);parser.add_argument('--address',default='192.168.4.1:80');a=parser.parse_args()
    pop=getpass.getpass('Per-device PoP (hidden): ')
    ssid=getpass.getpass('2.4GHz WPA2 SSID (hidden): ')
    password=getpass.getpass('Wi-Fi password (hidden): ')
    if len(pop)<16 or not 1<=len(ssid.encode())<=32 or not 8<=len(password.encode())<=63:
        raise SystemExit('Invalid lengths; this demo uses WPA2-PSK only')
    try: ok=asyncio.run(provision(a.address,pop,ssid,password))
    except Exception as e: raise SystemExit(f'Provisioning not confirmed: {type(e).__name__}: {e}')
    print('Client observed connected; now test physical reboot and persistence separately' if ok else 'Connection failed; correct credentials or hold GPIO5 for reset')
    raise SystemExit(0 if ok else 1)