arming/disarming does not work properly with multiple users about alarmo

[nielsfaber]

I just tried to reproduce the bug you are reporting but without success.

In my test case I have two users:

The admin user has pin code 1111, the test user has pin code 2222.
I kept all settings in the default state:

Obviously, playing with the fields 'allow code for arming' and 'allow code for disarming' will not help you, but you should get a different message in the HA log (e.g. "User test has no permission to arm the alarm").

If I use the alarmo-card for arming/disarming the alarm, both codes 1111 and 2222 are accepted, for both arming and disarming.
Any other code is rejected:

In summary, all works as I would expect. Also in the source code I don't see any reason why the code for the first user would be treated different than others.
The code simply goes through the list of users and compares the stored (encrypted) code with the entered code after encryption until there is a match.
Obviously, each user should have a unique pin code for this to work well.

alarmo/custom_components/alarmo/__init__.py

Lines 282 to 290 in 77a294e

	for (user_id, user) in users.items():
	if not user[const.ATTR_ENABLED]:
	continue
	elif not user[ATTR_CODE] and not code:
	return user
	elif user[ATTR_CODE]:
	hash = base64.b64decode(user[ATTR_CODE])
	if bcrypt.checkpw(code.encode("utf-8"), hash):
	return user

At this point, I would assume that when the log (or alarmo-card) states that a wrong code was entered, this is indeed the case.
Perhaps you could erase all current users and start with only 2 users, each having a pincode that you remember, and expand from there?
Since I don't experience the problem you are having, I don't know how to help further.

[rolfvreijdenberger]

@nielsfaber thanks for taking the time to look at the bug report 💯
I filed a wrong bug report :(

Here's the RCA:
From the 6 users I have, I tried 3. 1st was the first user (me), the 2nd one of my kids, and the 3rd a newly created automation user.

The first user obviously worked fine. I keep my code well protected in my password manager.
The 2nd user, one of my kids, gave me the code that I had provided, but, that one I think in hindsight I hadn't actually provisioned yet, since I was testing and setting up the alarm. After now recreating that user with the code, It works. So I'm sure it's a user error.
The automation code is now working after retesting (with the same password). I'm assuming it might have something to do with restarting HA. I had the automation use secret.yaml, so maybe something to do with not reloading the files (and tried using '!secret alarmo_automation_code' directly in an automation (will see if it works in a template expression)
OTOH, I did test in the developer tools->services and that did not seem to work as I recall.. oh well.

But, seeing the rather plain oversights that I did, I am also summing that up under user error. Testing the users in different scenarios (arming/disarming, changing users for arming/disarming, arming/disarming different areas interleaved etc) everything works like a charm 👍

I'm sorry for wasting your valuable time, I've tried to make up by buying you some cups of coffee :)