Merge remote-tracking branch 'origin/develop/3.5' into replace_ObjectMapper_usages_with_JacksonUtil

# Conflicts:
#	application/src/main/java/org/thingsboard/server/service/transport/DefaultTransportApiService.java
#	application/src/test/java/org/thingsboard/server/service/notification/NotificationRuleApiTest.java

application/src/main/data/json/system/widget_bundles/home_page_widgets.json

@@ -0,0 +1,50 @@
+{
+  "widgetsBundle": {
+    "alias": "home_page_widgets",
+    "title": "Home page widgets",
+    "image": null,
+    "description": null,
+    "externalId": null,
+    "name": "Home page widgets"
+  },
+  "widgetTypes": [
+    {
+      "alias": "documentation_links",
+      "name": "Documentation links",
+      "image": null,
+      "description": null,
+      "descriptor": {
+        "type": "static",
+        "sizeX": 7.5,
+        "sizeY": 3,
+        "resources": [],
+        "templateHtml": "<tb-doc-links-widget\n    [ctx]=\"ctx\">\n</tb-doc-links-widget>\n",
+        "templateCss": "",
+        "controllerScript": "self.onInit = function() {\n}",
+        "settingsSchema": "",
+        "dataKeySettingsSchema": "",
+        "settingsDirective": "tb-doc-links-widget-settings",
+        "defaultConfig": "{\"showTitle\":false,\"backgroundColor\":\"rgb(255, 255, 255)\",\"color\":\"rgba(0, 0, 0, 0.87)\",\"padding\":\"8px\",\"settings\":{\"columns\":3},\"title\":\"Documentation links\",\"dropShadow\":true}"
+      }
+    },
+    {
+      "alias": "getting_started",
+      "name": "Getting started",
+      "image": null,
+      "description": null,
+      "descriptor": {
+        "type": "static",
+        "sizeX": 7.5,
+        "sizeY": 6.5,
+        "resources": [],
+        "templateHtml": "<tb-getting-started-widget\n    [ctx]=\"ctx\">\n</tb-getting-started-widget>\n",
+        "templateCss": "",
+        "controllerScript": "self.onInit = function() {\n}",
+        "settingsSchema": "",
+        "dataKeySettingsSchema": "",
+        "settingsDirective": "",
+        "defaultConfig": "{\"showTitle\":false,\"backgroundColor\":\"rgb(255, 255, 255)\",\"color\":\"rgba(0, 0, 0, 0.87)\",\"padding\":\"8px\",\"settings\":{},\"title\":\"Getting started\",\"dropShadow\":true}"
+      }
+    }
+  ]
+}

application/src/main/data/upgrade/3.4.4/schema_update.sql

@@ -609,4 +609,4 @@ BEGIN
 END
 $$;
 
--- TTL DROP PARTITIONS FUNCTIONS UPDATE END
+-- TTL DROP PARTITIONS FUNCTIONS UPDATE END

application/src/main/java/org/thingsboard/server/controller/BaseController.java

@@ -102,7 +102,6 @@ import org.thingsboard.server.common.data.rpc.Rpc;
 import org.thingsboard.server.common.data.rule.RuleChain;
 import org.thingsboard.server.common.data.rule.RuleChainType;
 import org.thingsboard.server.common.data.rule.RuleNode;
-import org.thingsboard.server.common.data.settings.UserDashboardAction;
 import org.thingsboard.server.common.data.util.ThrowingBiFunction;
 import org.thingsboard.server.common.data.widget.WidgetTypeDetails;
 import org.thingsboard.server.common.data.widget.WidgetsBundle;
@@ -129,12 +128,12 @@ import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.relation.RelationService;
 import org.thingsboard.server.dao.rpc.RpcService;
 import org.thingsboard.server.dao.rule.RuleChainService;
+import org.thingsboard.server.dao.service.ConstraintValidator;
 import org.thingsboard.server.dao.service.Validator;
 import org.thingsboard.server.dao.tenant.TbTenantProfileCache;
 import org.thingsboard.server.dao.tenant.TenantProfileService;
 import org.thingsboard.server.dao.tenant.TenantService;
 import org.thingsboard.server.dao.user.UserService;
-import org.thingsboard.server.dao.user.UserSettingsService;
 import org.thingsboard.server.dao.widget.WidgetTypeService;
 import org.thingsboard.server.dao.widget.WidgetsBundleService;
 import org.thingsboard.server.exception.ThingsboardErrorResponseHandler;
@@ -163,7 +162,9 @@ import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService;
 
 import javax.mail.MessagingException;
 import javax.servlet.http.HttpServletResponse;
+import javax.validation.ConstraintViolation;
 import java.util.List;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
@@ -392,16 +393,19 @@ public abstract class BaseController {
      * Handles validation error for controller method arguments annotated with @{@link javax.validation.Valid}
      * */
     @ExceptionHandler(MethodArgumentNotValidException.class)
-    public void handleValidationError(MethodArgumentNotValidException e, HttpServletResponse response) {
+    public void handleValidationError(MethodArgumentNotValidException validationError, HttpServletResponse response) {
-        String errorMessage = "Validation error: " + e.getFieldErrors().stream()
+        List<ConstraintViolation<Object>> constraintsViolations = validationError.getFieldErrors().stream()
                 .map(fieldError -> {
-                    String property = fieldError.getField();
+                    try {
-                    if (property.equals("valid") || StringUtils.endsWith(property, ".valid")) { // when custom @AssertTrue is used
+                        return (ConstraintViolation<Object>) fieldError.unwrap(ConstraintViolation.class);
-                        property = "";
+                    } catch (Exception e) {
+                        log.warn("FieldError source is not of type ConstraintViolation");
+                        return null; // should not happen
                     }
-                    return (!property.isEmpty() ? (property + " ") : "") + fieldError.getDefaultMessage();
                 })
-                .collect(Collectors.joining(", "));
+                .filter(Objects::nonNull)
+                .collect(Collectors.toList());
+        String errorMessage = "Validation error: " + ConstraintValidator.getErrorMessage(constraintsViolations);
         ThingsboardException thingsboardException = new ThingsboardException(errorMessage, ThingsboardErrorCode.BAD_REQUEST_PARAMS);
         handleControllerException(thingsboardException, response);
     }

application/src/main/java/org/thingsboard/server/controller/NotificationController.java

@@ -64,7 +64,9 @@ import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.security.permission.Resource;
 
 import javax.validation.Valid;
+import java.util.Comparator;
 import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
@@ -201,9 +203,6 @@ public class NotificationController extends BaseController {
     public NotificationRequestPreview getNotificationRequestPreview(@RequestBody @Valid NotificationRequest request,
                                                                     @RequestParam(defaultValue = "20") int recipientsPreviewSize,
                                                                     @AuthenticationPrincipal SecurityUser user) throws ThingsboardException {
-        NotificationRequestPreview preview = new NotificationRequestPreview();
-
-        request.setOriginatorEntityId(user.getId());
         NotificationTemplate template;
         if (request.getTemplateId() != null) {
             template = checkEntityId(request.getTemplateId(), notificationTemplateService::findNotificationTemplateById, Operation.READ);
@@ -213,33 +212,23 @@ public class NotificationController extends BaseController {
         if (template == null) {
             throw new IllegalArgumentException("Template is missing");
         }
-        NotificationProcessingContext tmpProcessingCtx = NotificationProcessingContext.builder()
+        request.setOriginatorEntityId(user.getId());
-                .tenantId(user.getTenantId())
+        List<NotificationTarget> targets = request.getTargets().stream()
-                .request(request)
+                .map(NotificationTargetId::new)
-                .template(template)
+                .map(targetId -> notificationTargetService.findNotificationTargetById(user.getTenantId(), targetId))
-                .settings(null)
+                .sorted(Comparator.comparing(target -> target.getConfiguration().getType()))
-                .build();
+                .collect(Collectors.toList());
 
-        Map<NotificationDeliveryMethod, DeliveryMethodNotificationTemplate> processedTemplates = tmpProcessingCtx.getDeliveryMethods().stream()
+        NotificationRequestPreview preview = new NotificationRequestPreview();
-                .collect(Collectors.toMap(m -> m, deliveryMethod -> {
-                    NotificationRecipient recipient = null;
-                    if (NotificationTargetType.PLATFORM_USERS.getSupportedDeliveryMethods().contains(deliveryMethod)) {
-                        recipient = userService.findUserById(user.getTenantId(), user.getId());
-                    }
-                    return tmpProcessingCtx.getProcessedTemplate(deliveryMethod, recipient);
-                }));
-        preview.setProcessedTemplates(processedTemplates);
 
-        // generic permission
         Set<String> recipientsPreview = new LinkedHashSet<>();
-        Map<String, Integer> recipientsCountByTarget = new HashMap<>();
+        Map<String, Integer> recipientsCountByTarget = new LinkedHashMap<>();
-
+        Map<NotificationTargetType, NotificationRecipient> firstRecipient = new HashMap<>();
-        List<NotificationTarget> targets = notificationTargetService.findNotificationTargetsByTenantIdAndIds(user.getTenantId(),
-                request.getTargets().stream().map(NotificationTargetId::new).collect(Collectors.toList()));
         for (NotificationTarget target : targets) {
             int recipientsCount;
             List<NotificationRecipient> recipientsPart;
-            if (target.getConfiguration().getType() == NotificationTargetType.PLATFORM_USERS) {
+            NotificationTargetType targetType = target.getConfiguration().getType();
+            if (targetType == NotificationTargetType.PLATFORM_USERS) {
                 PageData<User> recipients = notificationTargetService.findRecipientsForNotificationTargetConfig(user.getTenantId(),
                         (PlatformUsersNotificationTargetConfig) target.getConfiguration(), new PageLink(recipientsPreviewSize));
                 recipientsCount = (int) recipients.getTotalElements();
@@ -248,7 +237,7 @@ public class NotificationController extends BaseController {
                 recipientsCount = 1;
                 recipientsPart = List.of(((SlackNotificationTargetConfig) target.getConfiguration()).getConversation());
             }
-
+            firstRecipient.putIfAbsent(targetType, !recipientsPart.isEmpty() ? recipientsPart.get(0) : null);
             for (NotificationRecipient recipient : recipientsPart) {
                 if (recipientsPreview.size() < recipientsPreviewSize) {
                     recipientsPreview.add(recipient.getTitle());
@@ -258,11 +247,26 @@ public class NotificationController extends BaseController {
             }
             recipientsCountByTarget.put(target.getName(), recipientsCount);
         }
-
         preview.setRecipientsPreview(recipientsPreview);
         preview.setRecipientsCountByTarget(recipientsCountByTarget);
         preview.setTotalRecipientsCount(recipientsCountByTarget.values().stream().mapToInt(Integer::intValue).sum());
 
+        Set<NotificationDeliveryMethod> deliveryMethods = template.getConfiguration().getDeliveryMethodsTemplates().entrySet()
+                .stream().filter(entry -> entry.getValue().isEnabled()).map(Map.Entry::getKey).collect(Collectors.toSet());
+        NotificationProcessingContext ctx = NotificationProcessingContext.builder()
+                .tenantId(user.getTenantId())
+                .request(request)
+                .deliveryMethods(deliveryMethods)
+                .template(template)
+                .settings(null)
+                .build();
+        Map<NotificationDeliveryMethod, DeliveryMethodNotificationTemplate> processedTemplates = ctx.getDeliveryMethods().stream()
+                .collect(Collectors.toMap(m -> m, deliveryMethod -> {
+                    NotificationTargetType targetType = NotificationTargetType.forDeliveryMethod(deliveryMethod);
+                    return ctx.getProcessedTemplate(deliveryMethod, firstRecipient.get(targetType));
+                }));
+        preview.setProcessedTemplates(processedTemplates);
+
         return preview;
     }
 

application/src/main/java/org/thingsboard/server/controller/NotificationTargetController.java

@@ -71,7 +71,7 @@ public class NotificationTargetController extends BaseController {
     private final NotificationTargetService notificationTargetService;
 
     @ApiOperation(value = "Save notification target (saveNotificationTarget)",
-            notes = "Create or update notification target.\n\n" +
+            notes = "Create or update notification target." +
                     SYSTEM_OR_TENANT_AUTHORITY_PARAGRAPH)
     @PostMapping("/target")
     @PreAuthorize("hasAnyAuthority('SYS_ADMIN', 'TENANT_ADMIN')")

application/src/main/java/org/thingsboard/server/controller/TelemetryController.java

@@ -75,16 +75,15 @@ import org.thingsboard.server.common.data.kv.StringDataEntry;
 import org.thingsboard.server.common.data.kv.TsKvEntry;
 import org.thingsboard.server.common.data.tenant.profile.DefaultTenantProfileConfiguration;
 import org.thingsboard.server.common.transport.adaptor.JsonConverter;
-import org.thingsboard.server.dao.service.ConstraintValidator;
 import org.thingsboard.server.dao.timeseries.TimeseriesService;
+import org.thingsboard.server.exception.InvalidParametersException;
+import org.thingsboard.server.exception.UncheckedApiException;
 import org.thingsboard.server.queue.util.TbCoreComponent;
 import org.thingsboard.server.service.security.AccessValidator;
 import org.thingsboard.server.service.security.model.SecurityUser;
 import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.telemetry.AttributeData;
 import org.thingsboard.server.service.telemetry.TsData;
-import org.thingsboard.server.exception.InvalidParametersException;
-import org.thingsboard.server.exception.UncheckedApiException;
 
 import javax.annotation.Nullable;
 import javax.annotation.PostConstruct;
@@ -624,7 +623,6 @@ public class TelemetryController extends BaseController {
         }
         if (json.isObject()) {
             List<AttributeKvEntry> attributes = extractRequestAttributes(json);
-            attributes.forEach(ConstraintValidator::validateFields);
             if (attributes.isEmpty()) {
                 return getImmediateDeferredResult("No attributes data found in request body!", HttpStatus.BAD_REQUEST);
             }

application/src/main/java/org/thingsboard/server/controller/plugin/TbWebSocketHandler.java

@@ -84,6 +84,8 @@ public class TbWebSocketHandler extends TextWebSocketHandler implements WebSocke
     private long sendTimeout;
     @Value("${server.ws.ping_timeout:30000}")
     private long pingTimeout;
+    @Value("${server.ws.max_queue_messages_per_session:1000}")
+    private int wsMaxQueueMessagesPerSession;
 
     private final ConcurrentMap<String, WebSocketSessionRef> blacklistedSessions = new ConcurrentHashMap<>();
     private final ConcurrentMap<String, TbRateLimits> perSessionUpdateLimits = new ConcurrentHashMap<>();
@@ -143,9 +145,11 @@ public class TbWebSocketHandler extends TextWebSocketHandler implements WebSocke
                 return;
             }
             var tenantProfileConfiguration = getTenantProfileConfiguration(sessionRef);
+            int wsTenantProfileQueueLimit = tenantProfileConfiguration != null ?
+                    tenantProfileConfiguration.getWsMsgQueueLimitPerSession() : wsMaxQueueMessagesPerSession;
             internalSessionMap.put(internalSessionId, new SessionMetaData(session, sessionRef,
-                    tenantProfileConfiguration != null && tenantProfileConfiguration.getWsMsgQueueLimitPerSession() > 0 ?
+                    (wsTenantProfileQueueLimit > 0 && wsTenantProfileQueueLimit < wsMaxQueueMessagesPerSession) ?
-                            tenantProfileConfiguration.getWsMsgQueueLimitPerSession() : 500));
+                            wsTenantProfileQueueLimit : wsMaxQueueMessagesPerSession));
 
             externalSessionMap.put(externalSessionId, internalSessionId);
             processInWebSocketService(sessionRef, SessionEvent.onEstablished());

application/src/main/java/org/thingsboard/server/service/apiusage/limits/DefaultRateLimitService.java

@@ -15,54 +15,81 @@
  */
 package org.thingsboard.server.service.apiusage.limits;
 
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+import lombok.Data;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.thingsboard.server.common.data.StringUtils;
+import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.msg.tools.TbRateLimits;
 import org.thingsboard.server.dao.tenant.TbTenantProfileCache;
 
-import java.util.Map;
+import javax.annotation.PostConstruct;
-import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
 
 @Service
 @RequiredArgsConstructor
+@Slf4j
 public class DefaultRateLimitService implements RateLimitService {
 
     private final TbTenantProfileCache tenantProfileCache;
+    @Value("${cache.rateLimits.timeToLiveInMinutes:60}")
+    private int rateLimitsTtl;
+    @Value("${cache.rateLimits.maxSize:100000}")
+    private int rateLimitsCacheMaxSize;
 
-    private final Map<LimitedApi, Map<TenantId, TbRateLimits>> rateLimits = new ConcurrentHashMap<>();
+    private Cache<RateLimitKey, TbRateLimits> rateLimits;
+
+    @PostConstruct
+    private void init() {
+        rateLimits = Caffeine.newBuilder()
+                .expireAfterAccess(rateLimitsTtl, TimeUnit.MINUTES)
+                .maximumSize(rateLimitsCacheMaxSize)
+                .build();
+    }
+
+    @Override
+    public boolean checkRateLimit(LimitedApi api, TenantId tenantId) {
+        return checkRateLimit(api, tenantId, tenantId);
+    }
 
     @Override
-    public boolean checkRateLimit(TenantId tenantId, LimitedApi api) {
+    public boolean checkRateLimit(LimitedApi api, TenantId tenantId, EntityId entityId) {
         if (tenantId.isSysTenantId()) {
             return true;
         }
+        RateLimitKey key = new RateLimitKey(api, entityId);
+
         String rateLimitConfig = tenantProfileCache.get(tenantId).getProfileConfiguration()
                 .map(api::getLimitConfig).orElse(null);
-
-        Map<TenantId, TbRateLimits> rateLimits = this.rateLimits.get(api);
         if (StringUtils.isEmpty(rateLimitConfig)) {
-            if (rateLimits != null) {
+            rateLimits.invalidate(key);
-                rateLimits.remove(tenantId);
-                if (rateLimits.isEmpty()) {
-                    this.rateLimits.remove(api);
-                }
-            }
             return true;
         }
+        log.trace("[{}] Checking rate limit for {} ({})", entityId, api, rateLimitConfig);
 
-        if (rateLimits == null) {
+        TbRateLimits rateLimit = rateLimits.asMap().compute(key, (k, limit) -> {
-            rateLimits = new ConcurrentHashMap<>();
+            if (limit == null || !limit.getConfiguration().equals(rateLimitConfig)) {
-            this.rateLimits.put(api, rateLimits);
+                limit = new TbRateLimits(rateLimitConfig);
-        }
+                log.trace("[{}] Created new rate limit bucket for {} ({})", entityId, api, rateLimitConfig);
-        TbRateLimits rateLimit = rateLimits.get(tenantId);
+            }
-        if (rateLimit == null || !rateLimit.getConfiguration().equals(rateLimitConfig)) {
+            return limit;
-            rateLimit = new TbRateLimits(rateLimitConfig);
+        });
-            rateLimits.put(tenantId, rateLimit);
+        boolean success = rateLimit.tryConsume();
+        if (!success) {
+            log.debug("[{}] Rate limit exceeded for {} ({})", entityId, api, rateLimitConfig);
         }
+        return success;
+    }
 
-        return rateLimit.tryConsume();
+    @Data(staticConstructor = "of")
+    private static class RateLimitKey {
+        private final LimitedApi api;
+        private final EntityId entityId;
     }
 
 }

application/src/main/java/org/thingsboard/server/service/apiusage/limits/LimitedApi.java

@@ -25,7 +25,8 @@ public enum LimitedApi {
 
     ENTITY_EXPORT(DefaultTenantProfileConfiguration::getTenantEntityExportRateLimit),
     ENTITY_IMPORT(DefaultTenantProfileConfiguration::getTenantEntityImportRateLimit),
-    NOTIFICATION_REQUEST(DefaultTenantProfileConfiguration::getTenantNotificationRequestsRateLimit);
+    NOTIFICATION_REQUESTS(DefaultTenantProfileConfiguration::getTenantNotificationRequestsRateLimit),
+    NOTIFICATION_REQUESTS_PER_RULE(DefaultTenantProfileConfiguration::getTenantNotificationRequestsPerRuleRateLimit);
 
     private final Function<DefaultTenantProfileConfiguration, String> configExtractor;
 

application/src/main/java/org/thingsboard/server/service/apiusage/limits/RateLimitService.java

@@ -15,10 +15,13 @@
  */
 package org.thingsboard.server.service.apiusage.limits;
 
+import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.TenantId;
 
 public interface RateLimitService {
 
-    boolean checkRateLimit(TenantId tenantId, LimitedApi api);
+    boolean checkRateLimit(LimitedApi api, TenantId tenantId);
+
+    boolean checkRateLimit(LimitedApi api, TenantId tenantId, EntityId entityId);
 
 }

application/src/main/java/org/thingsboard/server/service/device/DeviceProvisionServiceImpl.java

@@ -20,15 +20,16 @@ import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import com.google.common.util.concurrent.ListenableFuture;
 import lombok.extern.slf4j.Slf4j;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 import org.thingsboard.common.util.JacksonUtil;
 import org.thingsboard.server.cluster.TbClusterService;
 import org.thingsboard.server.common.data.DataConstants;
 import org.thingsboard.server.common.data.Device;
 import org.thingsboard.server.common.data.DeviceProfile;
+import org.thingsboard.server.common.data.DeviceProfileProvisionType;
 import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.common.data.audit.ActionType;
+import org.thingsboard.server.common.data.device.profile.X509CertificateChainProvisionConfiguration;
 import org.thingsboard.server.common.data.id.CustomerId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.id.UserId;
@@ -36,15 +37,16 @@ import org.thingsboard.server.common.data.kv.AttributeKvEntry;
 import org.thingsboard.server.common.data.kv.BaseAttributeKvEntry;
 import org.thingsboard.server.common.data.kv.StringDataEntry;
 import org.thingsboard.server.common.data.security.DeviceCredentials;
+import org.thingsboard.server.common.data.security.DeviceCredentialsType;
 import org.thingsboard.server.common.msg.TbMsg;
 import org.thingsboard.server.common.msg.TbMsgMetaData;
 import org.thingsboard.server.common.msg.queue.ServiceType;
 import org.thingsboard.server.common.msg.queue.TopicPartitionInfo;
+import org.thingsboard.server.common.transport.util.SslUtil;
 import org.thingsboard.server.dao.attributes.AttributesService;
 import org.thingsboard.server.dao.audit.AuditLogService;
 import org.thingsboard.server.dao.device.DeviceCredentialsService;
-import org.thingsboard.server.dao.device.DeviceDao;
+import org.thingsboard.server.dao.device.DeviceProfileService;
-import org.thingsboard.server.dao.device.DeviceProfileDao;
 import org.thingsboard.server.dao.device.DeviceProvisionService;
 import org.thingsboard.server.dao.device.DeviceService;
 import org.thingsboard.server.dao.device.provision.ProvisionFailedException;
@@ -59,12 +61,13 @@ import org.thingsboard.server.queue.common.TbProtoQueueMsg;
 import org.thingsboard.server.queue.discovery.PartitionService;
 import org.thingsboard.server.queue.provider.TbQueueProducerProvider;
 import org.thingsboard.server.queue.util.TbCoreComponent;
-import org.thingsboard.server.service.state.DeviceStateService;
 
 import java.util.Collections;
 import java.util.List;
 import java.util.Optional;
 import java.util.concurrent.ExecutionException;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 
 @Service
@@ -77,35 +80,56 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
     private static final String DEVICE_PROVISION_STATE = "provisionState";
     private static final String PROVISIONED_STATE = "provisioned";
 
-    @Autowired
+    private final TbClusterService clusterService;
-    TbClusterService clusterService;
+    private final DeviceProfileService deviceProfileService;
+    private final DeviceService deviceService;
+    private final DeviceCredentialsService deviceCredentialsService;
+    private final AttributesService attributesService;
+    private final AuditLogService auditLogService;
+    private final PartitionService partitionService;
 
-    @Autowired
+    public DeviceProvisionServiceImpl(TbQueueProducerProvider producerProvider, TbClusterService clusterService, DeviceProfileService deviceProfileService, DeviceService deviceService, DeviceCredentialsService deviceCredentialsService, AttributesService attributesService, AuditLogService auditLogService, PartitionService partitionService) {
-    DeviceDao deviceDao;
-
-    @Autowired
-    DeviceProfileDao deviceProfileDao;
-
-    @Autowired
-    DeviceService deviceService;
-
-    @Autowired
-    DeviceCredentialsService deviceCredentialsService;
-
-    @Autowired
-    AttributesService attributesService;
-
-    @Autowired
-    DeviceStateService deviceStateService;
-
-    @Autowired
-    AuditLogService auditLogService;
-
-    @Autowired
-    PartitionService partitionService;
-
-    public DeviceProvisionServiceImpl(TbQueueProducerProvider producerProvider) {
         ruleEngineMsgProducer = producerProvider.getRuleEngineMsgProducer();
+        this.clusterService = clusterService;
+        this.deviceProfileService = deviceProfileService;
+        this.deviceService = deviceService;
+        this.deviceCredentialsService = deviceCredentialsService;
+        this.attributesService = attributesService;
+        this.auditLogService = auditLogService;
+        this.partitionService = partitionService;
+    }
+
+    @Override
+    public ProvisionResponse provisionDeviceViaX509Chain(DeviceProfile targetProfile, ProvisionRequest provisionRequest) throws ProvisionFailedException {
+        if (targetProfile == null) {
+            throw new ProvisionFailedException("Device profile is not specified!");
+        }
+        if (!DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN.equals(targetProfile.getProfileData().getProvisionConfiguration().getType())) {
+            throw new ProvisionFailedException("Device profile provision strategy is not X509_CERTIFICATE_CHAIN!");
+        }
+        X509CertificateChainProvisionConfiguration configuration = (X509CertificateChainProvisionConfiguration) targetProfile.getProfileData().getProvisionConfiguration();
+        String certificateValue = provisionRequest.getCredentialsData().getX509CertHash();
+        String certificateRegEx = configuration.getCertificateRegExPattern();
+        String commonName = getCNFromX509Certificate(targetProfile, certificateValue);
+        String deviceName = extractDeviceNameFromCNByRegEx(targetProfile, commonName, certificateRegEx);
+        provisionRequest.setDeviceName(deviceName);
+        Device targetDevice = deviceService.findDeviceByTenantIdAndName(targetProfile.getTenantId(), provisionRequest.getDeviceName());
+        X509CertificateChainProvisionConfiguration x509Configuration = (X509CertificateChainProvisionConfiguration) targetProfile.getProfileData().getProvisionConfiguration();
+        if (targetDevice != null && targetDevice.getDeviceProfileId().equals(targetProfile.getId())) {
+            DeviceCredentials deviceCredentials = deviceCredentialsService.findDeviceCredentialsByDeviceId(targetDevice.getTenantId(), targetDevice.getId());
+            if (DeviceCredentialsType.X509_CERTIFICATE.equals(deviceCredentials.getCredentialsType())) {
+                String updatedDeviceCertificateValue = provisionRequest.getCredentialsData().getX509CertHash();
+                deviceCredentials = updateDeviceCredentials(targetDevice.getTenantId(), deviceCredentials,
+                        updatedDeviceCertificateValue, DeviceCredentialsType.X509_CERTIFICATE);
+            }
+            return new ProvisionResponse(deviceCredentials, ProvisionResponseStatus.SUCCESS);
+        } else if (x509Configuration.isAllowCreateNewDevicesByX509Certificate()) {
+            return createDevice(provisionRequest, targetProfile);
+        } else {
+            log.warn("[{}][{}] Device with name {} doesn't exist and cannot be created due incorrect configuration for X509CertificateChainProvisionConfiguration",
+                    targetProfile.getTenantId(), targetProfile.getId(), provisionRequest.getDeviceName());
+            throw new ProvisionFailedException(ProvisionResponseStatus.FAILURE.name());
+        }
     }
 
     @Override
@@ -124,14 +148,14 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
             throw new ProvisionFailedException(ProvisionResponseStatus.NOT_FOUND.name());
         }
 
-        DeviceProfile targetProfile = deviceProfileDao.findByProvisionDeviceKey(provisionRequestKey);
+        DeviceProfile targetProfile = deviceProfileService.findDeviceProfileByProvisionDeviceKey(provisionRequestKey);
 
         if (targetProfile == null || targetProfile.getProfileData().getProvisionConfiguration() == null ||
                 targetProfile.getProfileData().getProvisionConfiguration().getProvisionDeviceSecret() == null) {
             throw new ProvisionFailedException(ProvisionResponseStatus.NOT_FOUND.name());
         }
 
-        Device targetDevice = deviceDao.findDeviceByTenantIdAndName(targetProfile.getTenantId().getId(), provisionRequest.getDeviceName()).orElse(null);
+        Device targetDevice = deviceService.findDeviceByTenantIdAndName(targetProfile.getTenantId(), provisionRequest.getDeviceName());
 
         switch (targetProfile.getProvisionType()) {
             case ALLOW_CREATE_NEW_DEVICES:
@@ -155,6 +179,8 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
                     }
                 }
                 break;
+            case X509_CERTIFICATE_CHAIN:
+                throw new ProvisionFailedException("Invalid provision strategy type!");
         }
         throw new ProvisionFailedException(ProvisionResponseStatus.NOT_FOUND.name());
     }
@@ -209,6 +235,14 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
         }
     }
 
+    private DeviceCredentials updateDeviceCredentials(TenantId tenantId, DeviceCredentials deviceCredentials, String certificateValue,
+                                                      DeviceCredentialsType credentialsType) {
+        log.trace("Updating device credentials [{}] with certificate value [{}]", deviceCredentials, certificateValue);
+        deviceCredentials.setCredentialsValue(certificateValue);
+        deviceCredentials.setCredentialsType(credentialsType);
+        return deviceCredentialsService.updateDeviceCredentials(tenantId, deviceCredentials);
+    }
+
     private ListenableFuture<List<String>> saveProvisionStateAttribute(Device device) {
         return attributesService.save(device.getTenantId(), device.getId(), DataConstants.SERVER_SCOPE,
                 Collections.singletonList(new BaseAttributeKvEntry(new StringDataEntry(DEVICE_PROVISION_STATE, PROVISIONED_STATE),
@@ -257,4 +291,27 @@ public class DeviceProvisionServiceImpl implements DeviceProvisionService {
         ActionType actionType = success ? ActionType.PROVISION_SUCCESS : ActionType.PROVISION_FAILURE;
         auditLogService.logEntityAction(tenantId, customerId, new UserId(UserId.NULL_UUID), device.getName(), device.getId(), device, actionType, null, provisionRequest);
     }
+
+    private String getCNFromX509Certificate(DeviceProfile profile, String x509Value) {
+        try {
+            return SslUtil.parseCommonName(SslUtil.readCertFile(x509Value));
+        } catch (Exception e) {
+            log.trace("[{}][{}] Failed to parse CN from X509 certificate {}", profile.getTenantId(), profile.getId(), x509Value);
+            return null;
+        }
+    }
+
+    public String extractDeviceNameFromCNByRegEx(DeviceProfile profile, String commonName, String regex) throws ProvisionFailedException {
+        try {
+            log.trace("Extract device name from CN [{}] by regex pattern [{}]", commonName, regex);
+            Pattern pattern = Pattern.compile(regex);
+            Matcher matcher = pattern.matcher(commonName);
+            if (matcher.find()) {
+                return matcher.group(1);
+            }
+        } catch (Exception ignored) {}
+        log.trace("[{}][{}] Failed to match device name using [{}] from CN: [{}]", profile.getTenantId(), profile.getId(), regex, commonName);
+        throw new ProvisionFailedException(ProvisionResponseStatus.FAILURE.name());
+    }
+
 }

application/src/main/java/org/thingsboard/server/service/edge/rpc/EdgeGrpcService.java

@@ -98,11 +98,14 @@ public class EdgeGrpcService extends EdgeRpcServiceGrpc.EdgeRpcServiceImplBase i
     private String privateKeyResource;
     @Value("${edges.state.persistToTelemetry:false}")
     private boolean persistToTelemetry;
-    @Value("${edges.rpc.client_max_keep_alive_time_sec}")
+    @Value("${edges.rpc.client_max_keep_alive_time_sec:1}")
     private int clientMaxKeepAliveTimeSec;
     @Value("${edges.rpc.max_inbound_message_size:4194304}")
     private int maxInboundMessageSize;
-
+    @Value("${edges.rpc.keep_alive_time_sec:10}")
+    private int keepAliveTimeSec;
+    @Value("${edges.rpc.keep_alive_timeout_sec:5}")
+    private int keepAliveTimeoutSec;
     @Value("${edges.scheduler_pool_size}")
     private int schedulerPoolSize;
 
@@ -131,6 +134,9 @@ public class EdgeGrpcService extends EdgeRpcServiceGrpc.EdgeRpcServiceImplBase i
         log.info("Initializing Edge RPC service!");
         NettyServerBuilder builder = NettyServerBuilder.forPort(rpcPort)
                 .permitKeepAliveTime(clientMaxKeepAliveTimeSec, TimeUnit.SECONDS)
+                .keepAliveTime(keepAliveTimeSec, TimeUnit.SECONDS)
+                .keepAliveTimeout(keepAliveTimeoutSec, TimeUnit.SECONDS)
+                .permitKeepAliveWithoutCalls(true)
                 .maxInboundMessageSize(maxInboundMessageSize)
                 .addService(this);
         if (sslEnabled) {

application/src/main/java/org/thingsboard/server/service/install/DefaultSystemDataLoaderService.java

@@ -507,6 +507,7 @@ public class DefaultSystemDataLoaderService implements SystemDataLoaderService {
         this.deleteSystemWidgetBundle("entity_admin_widgets");
         this.deleteSystemWidgetBundle("navigation_widgets");
         this.deleteSystemWidgetBundle("edge_widgets");
+        this.deleteSystemWidgetBundle("home_page_widgets");
         installScripts.loadSystemWidgets();
     }
 

application/src/main/java/org/thingsboard/server/service/install/update/DefaultCacheCleanupService.java

@@ -82,6 +82,9 @@ public class DefaultCacheCleanupService implements CacheCleanupService {
                 log.info("Clearing cache to upgrade from version 3.4.2 to 3.4.3 ...");
                 clearCacheByName("repositorySettings");
                 break;
+            case "3.4.4":
+                log.info("Clearing cache to upgrade from version 3.4.4 to 3.5.0");
+                clearCacheByName("deviceProfiles");
             default:
                 //Do nothing, since cache cleanup is optional.
         }

application/src/main/java/org/thingsboard/server/service/notification/DefaultNotificationCenter.java

@@ -107,8 +107,10 @@ public class DefaultNotificationCenter extends AbstractSubscriptionService imple
 
     @Override
     public NotificationRequest processNotificationRequest(TenantId tenantId, NotificationRequest request, Consumer<NotificationRequestStats> callback) {
-        if (!rateLimitService.checkRateLimit(tenantId, LimitedApi.NOTIFICATION_REQUEST)) {
+        if (request.getRuleId() == null) {
-            throw new TbRateLimitsException(EntityType.TENANT);
+            if (!rateLimitService.checkRateLimit(LimitedApi.NOTIFICATION_REQUESTS, tenantId)) {
+                throw new TbRateLimitsException(EntityType.TENANT);
+            }
         }
 
         NotificationTemplate notificationTemplate;
@@ -119,21 +121,33 @@ public class DefaultNotificationCenter extends AbstractSubscriptionService imple
         }
         if (notificationTemplate == null) throw new IllegalArgumentException("Template is missing");
 
+        Set<NotificationDeliveryMethod> deliveryMethods = new HashSet<>();
         List<NotificationTarget> targets = request.getTargets().stream().map(NotificationTargetId::new)
-                .map(id -> notificationTargetService.findNotificationTargetById(tenantId, id)).collect(Collectors.toList());
+                .map(id -> notificationTargetService.findNotificationTargetById(tenantId, id))
+                .collect(Collectors.toList());
 
         NotificationRuleId ruleId = request.getRuleId();
         notificationTemplate.getConfiguration().getDeliveryMethodsTemplates().forEach((deliveryMethod, template) -> {
             if (!template.isEnabled()) return;
-            if (!channels.get(deliveryMethod).check(tenantId)) {
+            try {
-                throw new IllegalArgumentException("Unable to send notification via " + deliveryMethod.getName() + ": not configured or not working");
+                channels.get(deliveryMethod).check(tenantId);
+            } catch (Exception e) {
+                if (ruleId == null) {
+                    throw new IllegalArgumentException(e.getMessage());
+                } else {
+                    return; // if originated by rule - just ignore delivery method
+                }
             }
             if (ruleId == null) {
                 if (targets.stream().noneMatch(target -> target.getConfiguration().getType().getSupportedDeliveryMethods().contains(deliveryMethod))) {
-                    throw new IllegalArgumentException("Target for " + deliveryMethod.getName() + " delivery method is missing");
+                    throw new IllegalArgumentException("Recipients for " + deliveryMethod.getName() + " delivery method not chosen");
                 }
             }
+            deliveryMethods.add(deliveryMethod);
         });
+        if (deliveryMethods.isEmpty()) {
+            throw new IllegalArgumentException("No delivery methods to send notification with");
+        }
 
         if (request.getAdditionalConfig() != null) {
             NotificationRequestConfig config = request.getAdditionalConfig();
@@ -153,6 +167,7 @@ public class DefaultNotificationCenter extends AbstractSubscriptionService imple
         NotificationProcessingContext ctx = NotificationProcessingContext.builder()
                 .tenantId(tenantId)
                 .request(request)
+                .deliveryMethods(deliveryMethods)
                 .template(notificationTemplate)
                 .settings(settings)
                 .build();
@@ -341,14 +356,20 @@ public class DefaultNotificationCenter extends AbstractSubscriptionService imple
     @Override
     public Set<NotificationDeliveryMethod> getAvailableDeliveryMethods(TenantId tenantId) {
         return channels.values().stream()
-                .filter(channel -> channel.check(tenantId))
+                .filter(channel -> {
+                    try {
+                        channel.check(tenantId);
+                        return true;
+                    } catch (Exception e) {
+                        return false;
+                    }
+                })
                 .map(NotificationChannel::getDeliveryMethod)
                 .collect(Collectors.toSet());
     }
 
     @Override
-    public boolean check(TenantId tenantId) {
+    public void check(TenantId tenantId) throws Exception {
-        return true;
     }
 
     @Override

application/src/main/java/org/thingsboard/server/service/notification/NotificationProcessingContext.java

@@ -48,20 +48,21 @@ public class NotificationProcessingContext {
     private final NotificationSettings settings;
     @Getter
     private final NotificationRequest request;
-
+    @Getter
+    private final Set<NotificationDeliveryMethod> deliveryMethods;
     @Getter
     private final NotificationTemplate notificationTemplate;
+
     private final Map<NotificationDeliveryMethod, DeliveryMethodNotificationTemplate> templates;
     @Getter
-    private Set<NotificationDeliveryMethod> deliveryMethods;
-    @Getter
     private final NotificationRequestStats stats;
 
-
     @Builder
-    public NotificationProcessingContext(TenantId tenantId, NotificationRequest request, NotificationTemplate template, NotificationSettings settings) {
+    public NotificationProcessingContext(TenantId tenantId, NotificationRequest request, Set<NotificationDeliveryMethod> deliveryMethods,
+                                           NotificationTemplate template, NotificationSettings settings) {
         this.tenantId = tenantId;
         this.request = request;
+        this.deliveryMethods = deliveryMethods;
         this.settings = settings;
         this.notificationTemplate = template;
         this.templates = new EnumMap<>(NotificationDeliveryMethod.class);
@@ -77,7 +78,6 @@ public class NotificationProcessingContext {
                 templates.put(deliveryMethod, template);
             }
         });
-        deliveryMethods = templates.keySet();
     }
 
     public <C extends NotificationDeliveryMethodConfig> C getDeliveryMethodConfig(NotificationDeliveryMethod deliveryMethod) {

application/src/main/java/org/thingsboard/server/service/notification/channels/EmailNotificationChannel.java

@@ -48,12 +48,11 @@ public class EmailNotificationChannel implements NotificationChannel<User, Email
     }
 
     @Override
-    public boolean check(TenantId tenantId) {
+    public void check(TenantId tenantId) throws Exception {
         try {
             mailService.testConnection(tenantId);
-            return true;
         } catch (Exception e) {
-            return false;
+            throw new RuntimeException("Mail server is not available");
         }
     }
 

application/src/main/java/org/thingsboard/server/service/notification/channels/NotificationChannel.java

@@ -26,7 +26,7 @@ public interface NotificationChannel<R extends NotificationRecipient, T extends
 
     ListenableFuture<Void> sendNotification(R recipient, T processedTemplate, NotificationProcessingContext ctx);
 
-    boolean check(TenantId tenantId);
+    void check(TenantId tenantId) throws Exception;
 
     NotificationDeliveryMethod getDeliveryMethod();
 

application/src/main/java/org/thingsboard/server/service/notification/channels/SlackNotificationChannel.java

@@ -22,12 +22,12 @@ import org.thingsboard.rule.engine.api.slack.SlackService;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
 import org.thingsboard.server.common.data.notification.settings.NotificationSettings;
-import org.thingsboard.server.dao.notification.NotificationSettingsService;
-import org.thingsboard.server.service.notification.NotificationProcessingContext;
 import org.thingsboard.server.common.data.notification.settings.SlackNotificationDeliveryMethodConfig;
 import org.thingsboard.server.common.data.notification.targets.slack.SlackConversation;
 import org.thingsboard.server.common.data.notification.template.SlackDeliveryMethodNotificationTemplate;
+import org.thingsboard.server.dao.notification.NotificationSettingsService;
 import org.thingsboard.server.service.executors.ExternalCallExecutorService;
+import org.thingsboard.server.service.notification.NotificationProcessingContext;
 
 @Component
 @RequiredArgsConstructor
@@ -47,9 +47,11 @@ public class SlackNotificationChannel implements NotificationChannel<SlackConver
     }
 
     @Override
-    public boolean check(TenantId tenantId) {
+    public void check(TenantId tenantId) throws Exception {
         NotificationSettings notificationSettings = notificationSettingsService.findNotificationSettings(tenantId);
-        return notificationSettings.getDeliveryMethodsConfigs().containsKey(NotificationDeliveryMethod.SLACK);
+        if (!notificationSettings.getDeliveryMethodsConfigs().containsKey(NotificationDeliveryMethod.SLACK)) {
+            throw new RuntimeException("Slack API token is not configured");
+        }
     }
 
     @Override

application/src/main/java/org/thingsboard/server/service/notification/channels/SmsNotificationChannel.java

@@ -49,8 +49,10 @@ public class SmsNotificationChannel implements NotificationChannel<User, SmsDeli
     }
 
     @Override
-    public boolean check(TenantId tenantId) {
+    public void check(TenantId tenantId) throws Exception {
-        return smsService.isConfigured(tenantId);
+        if (!smsService.isConfigured(tenantId)) {
+            throw new RuntimeException("SMS provider is not configured");
+        }
     }
 
     @Override

application/src/main/java/org/thingsboard/server/service/notification/rule/DefaultNotificationRuleProcessor.java

@@ -41,9 +41,11 @@ import org.thingsboard.server.common.msg.notification.trigger.RuleEngineMsgTrigg
 import org.thingsboard.server.common.msg.plugin.ComponentLifecycleMsg;
 import org.thingsboard.server.common.msg.queue.ServiceType;
 import org.thingsboard.server.dao.notification.NotificationRequestService;
-import org.thingsboard.server.service.notification.rule.cache.NotificationRulesCache;
 import org.thingsboard.server.queue.discovery.PartitionService;
+import org.thingsboard.server.service.apiusage.limits.LimitedApi;
+import org.thingsboard.server.service.apiusage.limits.RateLimitService;
 import org.thingsboard.server.service.executors.NotificationExecutorService;
+import org.thingsboard.server.service.notification.rule.cache.NotificationRulesCache;
 import org.thingsboard.server.service.notification.rule.trigger.NotificationRuleTriggerProcessor;
 import org.thingsboard.server.service.notification.rule.trigger.RuleEngineMsgNotificationRuleTriggerProcessor;
 
@@ -65,6 +67,7 @@ public class DefaultNotificationRuleProcessor implements NotificationRuleProcess
     private final NotificationRulesCache notificationRulesCache;
     private final NotificationRequestService notificationRequestService;
     private final PartitionService partitionService;
+    private final RateLimitService rateLimitService;
     @Autowired @Lazy
     private NotificationCenter notificationCenter;
     private final NotificationExecutorService notificationExecutor;
@@ -119,6 +122,11 @@ public class DefaultNotificationRuleProcessor implements NotificationRuleProcess
         }
 
         if (matchesFilter(trigger, triggerConfig)) {
+            if (!rateLimitService.checkRateLimit(LimitedApi.NOTIFICATION_REQUESTS_PER_RULE, rule.getTenantId(), rule.getId())) {
+                log.debug("[{}] Rate limit for notification requests per rule was exceeded (rule '{}')", rule.getTenantId(), rule.getName());
+                return;
+            }
+
             NotificationInfo notificationInfo = constructNotificationInfo(trigger, triggerConfig);
             rule.getRecipientsConfig().getTargetsTable().forEach((delay, targets) -> {
                 submitNotificationRequest(targets, rule, trigger.getOriginatorEntityId(), notificationInfo, delay);

application/src/main/java/org/thingsboard/server/service/security/AccessValidator.java

@@ -67,6 +67,7 @@ import org.thingsboard.server.dao.device.DeviceProfileService;
 import org.thingsboard.server.dao.device.DeviceService;
 import org.thingsboard.server.dao.edge.EdgeService;
 import org.thingsboard.server.dao.entityview.EntityViewService;
+import org.thingsboard.server.dao.exception.DataValidationException;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
 import org.thingsboard.server.dao.ota.OtaPackageService;
 import org.thingsboard.server.dao.resource.ResourceService;
@@ -575,7 +576,7 @@ public class AccessValidator {
         ResponseEntity responseEntity;
         if (e instanceof ToErrorResponseEntity) {
             responseEntity = ((ToErrorResponseEntity) e).toErrorResponseEntity();
-        } else if (e instanceof IllegalArgumentException || e instanceof IncorrectParameterException) {
+        } else if (e instanceof IllegalArgumentException || e instanceof IncorrectParameterException || e instanceof DataValidationException) {
             responseEntity = new ResponseEntity<>(e.getMessage(), HttpStatus.BAD_REQUEST);
         } else {
             responseEntity = new ResponseEntity<>(defaultErrorStatus);

application/src/main/java/org/thingsboard/server/service/security/auth/rest/RestAuthenticationDetails.java

@@ -20,7 +20,6 @@ import ua_parser.Client;
 import ua_parser.Parser;
 
 import javax.servlet.http.HttpServletRequest;
-import java.io.IOException;
 import java.io.Serializable;
 
 @Data
@@ -43,11 +42,7 @@ public class RestAuthenticationDetails implements Serializable {
     }
 
     private static Client getUserAgent(HttpServletRequest request) {
-        try {
+        Parser uaParser = new Parser();
-            Parser uaParser = new Parser();
+        return uaParser.parse(request.getHeader("User-Agent"));
-            return uaParser.parse(request.getHeader("User-Agent"));
-        } catch (IOException e) {
-            return new Client(null, null, null);
-        }
     }
 }

application/src/main/java/org/thingsboard/server/service/sync/ie/DefaultEntitiesExportImportService.java

@@ -73,7 +73,7 @@ public class DefaultEntitiesExportImportService implements EntitiesExportImportS
 
     @Override
     public <E extends ExportableEntity<I>, I extends EntityId> EntityExportData<E> exportEntity(EntitiesExportCtx<?> ctx, I entityId) throws ThingsboardException {
-        if (!rateLimitService.checkRateLimit(ctx.getTenantId(), LimitedApi.ENTITY_EXPORT)) {
+        if (!rateLimitService.checkRateLimit(LimitedApi.ENTITY_EXPORT, ctx.getTenantId())) {
             throw new ThingsboardException("Rate limit for entities export is exceeded", ThingsboardErrorCode.TOO_MANY_REQUESTS);
         }
 
@@ -85,7 +85,7 @@ public class DefaultEntitiesExportImportService implements EntitiesExportImportS
 
     @Override
     public <E extends ExportableEntity<I>, I extends EntityId> EntityImportResult<E> importEntity(EntitiesImportCtx ctx, EntityExportData<E> exportData) throws ThingsboardException {
-        if (!rateLimitService.checkRateLimit(ctx.getTenantId(), LimitedApi.ENTITY_IMPORT)) {
+        if (!rateLimitService.checkRateLimit(LimitedApi.ENTITY_IMPORT, ctx.getTenantId())) {
             throw new ThingsboardException("Rate limit for entities import is exceeded", ThingsboardErrorCode.TOO_MANY_REQUESTS);
         }
         if (exportData.getEntity() == null || exportData.getEntity().getId() == null) {

application/src/main/java/org/thingsboard/server/service/system/DefaultSystemInfoService.java

@@ -26,10 +26,12 @@ import org.thingsboard.common.util.ThingsBoardThreadFactory;
 import org.thingsboard.server.common.data.AdminSettings;
 import org.thingsboard.server.common.data.ApiUsageState;
 import org.thingsboard.server.common.data.FeaturesInfo;
+import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.common.data.SystemInfo;
 import org.thingsboard.server.common.data.SystemInfoData;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.kv.BasicTsKvEntry;
+import org.thingsboard.server.common.data.kv.BooleanDataEntry;
 import org.thingsboard.server.common.data.kv.JsonDataEntry;
 import org.thingsboard.server.common.data.kv.LongDataEntry;
 import org.thingsboard.server.common.data.kv.TsKvEntry;
@@ -50,6 +52,7 @@ import org.thingsboard.server.service.telemetry.TelemetrySubscriptionService;
 import javax.annotation.Nullable;
 import javax.annotation.PreDestroy;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
 import java.util.concurrent.Executors;
@@ -143,9 +146,7 @@ public class DefaultSystemInfoService extends TbApplicationEventListener<Partiti
         AdminSettings mailSettings = adminSettingsService.findAdminSettingsByKey(TenantId.SYS_TENANT_ID, "mail");
         if (mailSettings != null) {
             JsonNode mailFrom = mailSettings.getJsonValue().get("mailFrom");
-            if (mailFrom != null) {
+            return StringUtils.isNotEmpty(mailFrom.asText()) && !"ThingsBoard <sysadmin@localhost.localdomain>".equalsIgnoreCase(mailFrom.asText());
-                return DataValidator.doValidateEmail(mailFrom.asText());
-            }
         }
         return false;
     }
@@ -154,13 +155,13 @@ public class DefaultSystemInfoService extends TbApplicationEventListener<Partiti
         long ts = System.currentTimeMillis();
         List<SystemInfoData> clusterSystemData = getSystemData(serviceInfoProvider.getServiceInfo());
         BasicTsKvEntry clusterDataKv = new BasicTsKvEntry(ts, new JsonDataEntry("clusterSystemData", JacksonUtil.toString(clusterSystemData)));
-        doSave(Collections.singletonList(clusterDataKv));
+        doSave(Arrays.asList(new BasicTsKvEntry(ts, new BooleanDataEntry("clusterMode", true)), clusterDataKv));
     }
 
     private void saveCurrentMonolithSystemInfo() {
         long ts = System.currentTimeMillis();
         List<TsKvEntry> tsList = new ArrayList<>();
-
+        tsList.add(new BasicTsKvEntry(ts, new BooleanDataEntry("clusterMode", false)));
         getCpuUsage().ifPresent(v -> tsList.add(new BasicTsKvEntry(ts, new LongDataEntry("cpuUsage", (long) v))));
         getMemoryUsage().ifPresent(v -> tsList.add(new BasicTsKvEntry(ts, new LongDataEntry("memoryUsage", (long) v))));
         getDiscSpaceUsage().ifPresent(v -> tsList.add(new BasicTsKvEntry(ts, new LongDataEntry("discUsage", (long) v))));

application/src/main/java/org/thingsboard/server/service/transport/DefaultTransportApiService.java

@@ -32,6 +32,7 @@ import org.thingsboard.server.common.data.ApiUsageState;
 import org.thingsboard.server.common.data.DataConstants;
 import org.thingsboard.server.common.data.Device;
 import org.thingsboard.server.common.data.DeviceProfile;
+import org.thingsboard.server.common.data.DeviceProfileProvisionType;
 import org.thingsboard.server.common.data.DeviceTransportType;
 import org.thingsboard.server.common.data.EntityType;
 import org.thingsboard.server.common.data.OtaPackage;
@@ -65,11 +66,13 @@ import org.thingsboard.server.common.msg.TbMsg;
 import org.thingsboard.server.common.msg.TbMsgDataType;
 import org.thingsboard.server.common.msg.TbMsgMetaData;
 import org.thingsboard.server.dao.device.DeviceCredentialsService;
+import org.thingsboard.server.dao.device.DeviceProfileService;
 import org.thingsboard.server.dao.device.DeviceProvisionService;
 import org.thingsboard.server.dao.device.DeviceService;
 import org.thingsboard.server.dao.device.provision.ProvisionFailedException;
 import org.thingsboard.server.dao.device.provision.ProvisionRequest;
 import org.thingsboard.server.dao.device.provision.ProvisionResponse;
+import org.thingsboard.server.dao.device.provision.ProvisionResponseStatus;
 import org.thingsboard.server.dao.ota.OtaPackageService;
 import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.relation.RelationService;
@@ -107,6 +110,7 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
 import java.util.concurrent.locks.Lock;
 import java.util.concurrent.locks.ReentrantLock;
+import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 import static org.thingsboard.server.service.transport.BasicCredentialsValidationResult.PASSWORD_MISMATCH;
@@ -121,10 +125,13 @@ import static org.thingsboard.server.service.transport.BasicCredentialsValidatio
 @RequiredArgsConstructor
 public class DefaultTransportApiService implements TransportApiService {
 
+    private static final Pattern X509_CERTIFICATE_TRIM_CHAIN_PATTERN = Pattern.compile("-----BEGIN CERTIFICATE-----\\s*.*?\\s*-----END CERTIFICATE-----");
+
     private final TbDeviceProfileCache deviceProfileCache;
     private final TbTenantProfileCache tenantProfileCache;
     private final TbApiUsageStateService apiUsageStateService;
     private final DeviceService deviceService;
+    private final DeviceProfileService deviceProfileService;
     private final RelationService relationService;
     private final DeviceCredentialsService deviceCredentialsService;
     private final DbCallbackExecutorService dbCallbackExecutorService;
@@ -156,6 +163,9 @@ public class DefaultTransportApiService implements TransportApiService {
         } else if (transportApiRequestMsg.hasValidateX509CertRequestMsg()) {
             ValidateDeviceX509CertRequestMsg msg = transportApiRequestMsg.getValidateX509CertRequestMsg();
             result = validateCredentials(msg.getHash(), DeviceCredentialsType.X509_CERTIFICATE);
+        } else if (transportApiRequestMsg.hasValidateOrCreateX509CertRequestMsg()) {
+            TransportProtos.ValidateOrCreateDeviceX509CertRequestMsg msg = transportApiRequestMsg.getValidateOrCreateX509CertRequestMsg();
+            result = validateOrCreateDeviceX509Certificate(msg.getCertificateChain());
         } else if (transportApiRequestMsg.hasGetOrCreateDeviceRequestMsg()) {
             result = handle(transportApiRequestMsg.getGetOrCreateDeviceRequestMsg());
         } else if (transportApiRequestMsg.hasEntityProfileRequestMsg()) {
@@ -223,6 +233,35 @@ public class DefaultTransportApiService implements TransportApiService {
         }
     }
 
+    protected ListenableFuture<TransportApiResponseMsg> validateOrCreateDeviceX509Certificate(String certificateChain) {
+        List<String> chain = X509_CERTIFICATE_TRIM_CHAIN_PATTERN.matcher(certificateChain).results().map(match ->
+                EncryptionUtil.certTrimNewLines(match.group())).collect(Collectors.toList());
+        for (String certificateValue : chain) {
+            String certificateHash = EncryptionUtil.getSha3Hash(certificateValue);
+            DeviceCredentials credentials = deviceCredentialsService.findDeviceCredentialsByCredentialsId(certificateHash);
+            if (credentials != null && DeviceCredentialsType.X509_CERTIFICATE.equals(credentials.getCredentialsType())) {
+                return getDeviceInfo(credentials);
+            }
+            DeviceProfile deviceProfile = deviceProfileService.findDeviceProfileByProvisionDeviceKey(certificateHash);
+            if (deviceProfile != null && DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN.equals(deviceProfile.getProvisionType())) {
+                String updatedDeviceProvisionSecret = chain.get(0);
+                ProvisionRequest provisionRequest = createProvisionRequest(updatedDeviceProvisionSecret);
+                try {
+                    ProvisionResponse provisionResponse = deviceProvisionService.provisionDeviceViaX509Chain(deviceProfile, provisionRequest);
+                    if (ProvisionResponseStatus.SUCCESS.equals(provisionResponse.getResponseStatus())) {
+                        return getDeviceInfo(provisionResponse.getDeviceCredentials());
+                    }
+                } catch (ProvisionFailedException e) {
+                    log.debug("[{}][{}] Failed to provision device with cert chain: {}", deviceProfile.getTenantId(), deviceProfile.getId(), provisionRequest, e);
+                    return getEmptyTransportApiResponseFuture();
+                }
+            } else if (deviceProfile != null) {
+                log.warn("[{}][{}] Device Profile provision configuration mismatched: expected {}, actual {}", deviceProfile.getTenantId(), deviceProfile.getId(), DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN, deviceProfile.getProvisionType());
+            }
+        }
+        return getEmptyTransportApiResponseFuture();
+    }
+
     private ListenableFuture<TransportApiResponseMsg> validateUserNameCredentials(TransportProtos.ValidateBasicMqttCredRequestMsg mqtt) {
         DeviceCredentials credentials = deviceCredentialsService.findDeviceCredentialsByCredentialsId(mqtt.getUserName());
         if (credentials != null) {
@@ -662,4 +701,11 @@ public class DefaultTransportApiService implements TransportApiService {
     private Long checkLong(Long l) {
         return l != null ? l : 0;
     }
+
+    private ProvisionRequest createProvisionRequest(String certificateValue) {
+        return new ProvisionRequest(null, DeviceCredentialsType.X509_CERTIFICATE,
+                new ProvisionDeviceCredentialsData(null, null, null, null, certificateValue),
+                null);
+    }
+
 }

application/src/main/java/org/thingsboard/server/service/ttl/EdgeEventsCleanUpService.java

@@ -32,7 +32,7 @@ import static org.thingsboard.server.dao.model.ModelConstants.EDGE_EVENT_COLUMN_
 @TbCoreComponent
 @Slf4j
 @Service
-@ConditionalOnExpression("${sql.ttl.edge_events.enabled:true} && ${sql.ttl.edge_events.edge_event_ttl:0} > 0")
+@ConditionalOnExpression("${sql.ttl.edge_events.enabled:true} && ${sql.ttl.edge_events.edge_events_ttl:0} > 0")
 public class EdgeEventsCleanUpService extends AbstractCleanUpService {
 
     public static final String RANDOM_DELAY_INTERVAL_MS_EXPRESSION =

application/src/main/java/org/thingsboard/server/service/update/DefaultUpdateService.java

@@ -79,7 +79,9 @@ public class DefaultUpdateService implements UpdateService {
     @AfterStartUp(order = AfterStartUp.REGULAR_SERVICE)
     public void init() {
         version = buildProperties != null ? buildProperties.getVersion() : "unknown";
-        updateMessage = new UpdateMessage(false, version, "", "", "", "");
+        updateMessage = new UpdateMessage(false, version, "", "",
+                "https://thingsboard.io/docs/reference/releases",
+                "https://thingsboard.io/docs/reference/releases");
         if (updatesEnabled) {
             try {
                 platform = System.getProperty("platform", "unknown");

application/src/main/resources/thingsboard.yml

@@ -65,6 +65,7 @@ server:
       max_per_user: "${TB_SERVER_WS_DYNAMIC_PAGE_LINK_MAX_PER_USER:10}"
     max_entities_per_data_subscription: "${TB_SERVER_WS_MAX_ENTITIES_PER_DATA_SUBSCRIPTION:10000}"
     max_entities_per_alarm_subscription: "${TB_SERVER_WS_MAX_ENTITIES_PER_ALARM_SUBSCRIPTION:10000}"
+    max_queue_messages_per_session: "${TB_SERVER_WS_DEFAULT_QUEUE_MESSAGES_PER_SESSION:1000}"
   rest:
     server_side_rpc:
       # Minimum value of the server side RPC timeout. May override value provided in the REST API call.
@@ -130,6 +131,9 @@ security:
     loginProcessingUrl: "${SECURITY_OAUTH2_LOGIN_PROCESSING_URL:/login/oauth2/code/}"
     githubMapper:
       emailUrl: "${SECURITY_OAUTH2_GITHUB_MAPPER_EMAIL_URL_KEY:https://api.github.com/user/emails}"
+  java_cacerts:
+    path: "${SECURITY_JAVA_CACERTS_PATH:${java.home}${file.separator}lib${file.separator}security${file.separator}cacerts}"
+    password: "${SECURITY_JAVA_CACERTS_PASSWORD:changeit}"
 
 # Usage statistics parameters
 usage:
@@ -255,11 +259,13 @@ sql:
     batch_max_delay: "${SQL_ATTRIBUTES_BATCH_MAX_DELAY_MS:100}"
     stats_print_interval_ms: "${SQL_ATTRIBUTES_BATCH_STATS_PRINT_MS:10000}"
     batch_threads: "${SQL_ATTRIBUTES_BATCH_THREADS:3}" # batch thread count have to be a prime number like 3 or 5 to gain perfect hash distribution
+    noxss_validation_enabled: "${SQL_ATTRIBUTES_NOXSS_VALIDATION_ENABLED:true}"
   ts:
     batch_size: "${SQL_TS_BATCH_SIZE:10000}"
     batch_max_delay: "${SQL_TS_BATCH_MAX_DELAY_MS:100}"
     stats_print_interval_ms: "${SQL_TS_BATCH_STATS_PRINT_MS:10000}"
     batch_threads: "${SQL_TS_BATCH_THREADS:3}" # batch thread count have to be a prime number like 3 or 5 to gain perfect hash distribution
+    noxss_validation_enabled: "${SQL_TS_NOXSS_VALIDATION_ENABLED:true}"
   ts_latest:
     batch_size: "${SQL_TS_LATEST_BATCH_SIZE:10000}"
     batch_max_delay: "${SQL_TS_LATEST_BATCH_MAX_DELAY_MS:100}"
@@ -478,10 +484,14 @@ cache:
     entityCount:
       timeToLiveInMinutes: "${CACHE_SPECS_ENTITY_COUNT_TTL:1440}"
       maxSize: "${CACHE_SPECS_ENTITY_COUNT_MAX_SIZE:100000}"
+
   # deliberately placed outside 'specs' group above
   notificationRules:
     timeToLiveInMinutes: "${CACHE_SPECS_NOTIFICATION_RULES_TTL:30}"
     maxSize: "${CACHE_SPECS_NOTIFICATION_RULES_MAX_SIZE:1000}"
+  rateLimits:
+    timeToLiveInMinutes: "${CACHE_SPECS_RATE_LIMITS_TTL:60}"
+    maxSize: "${CACHE_SPECS_RATE_LIMITS_MAX_SIZE:100000}"
 
 #Disable this because it is not required.
 spring.data.redis.repositories.enabled: false
@@ -948,7 +958,9 @@ edges:
   enabled: "${EDGES_ENABLED:true}"
   rpc:
     port: "${EDGES_RPC_PORT:7070}"
-    client_max_keep_alive_time_sec: "${EDGES_RPC_CLIENT_MAX_KEEP_ALIVE_TIME_SEC:300}"
+    client_max_keep_alive_time_sec: "${EDGES_RPC_CLIENT_MAX_KEEP_ALIVE_TIME_SEC:1}"
+    keep_alive_time_sec: "${EDGES_RPC_KEEP_ALIVE_TIME_SEC:10}"
+    keep_alive_timeout_sec: "${EDGES_RPC_KEEP_ALIVE_TIMEOUT_SEC:5}"
     ssl:
       # Enable/disable SSL support
       enabled: "${EDGES_RPC_SSL_ENABLED:false}"

application/src/test/java/org/thingsboard/server/controller/BaseDeviceProfileControllerTest.java

@@ -299,6 +299,28 @@ public abstract class BaseDeviceProfileControllerTest extends AbstractController
                 tenantAdmin.getId(), tenantAdmin.getEmail(), ActionType.ADDED, new DataValidationException(msgError));
     }
 
+    @Test
+    public void testSaveDeviceProfileWithSameCertificateHash() throws Exception {
+        DeviceProfile deviceProfile = this.createDeviceProfile("Device Profile");
+        deviceProfile.setProvisionDeviceKey("Certificate hash");
+
+        doPost("/api/deviceProfile", deviceProfile)
+                .andExpect(status().isOk());
+
+        DeviceProfile deviceProfile2 = this.createDeviceProfile("Device Profile 2");
+        deviceProfile2.setProvisionDeviceKey("Certificate hash");
+
+        Mockito.reset(tbClusterService, auditLogService);
+
+        String msgError = "Device profile with such provision device key already exists!";
+        doPost("/api/deviceProfile", deviceProfile2)
+                .andExpect(status().isBadRequest())
+                .andExpect(statusReason(containsString(msgError)));
+
+        testNotifyEntityEqualsOneTimeServiceNeverError(deviceProfile, savedTenant.getId(),
+                tenantAdmin.getId(), tenantAdmin.getEmail(), ActionType.ADDED, new DataValidationException(msgError));
+    }
+
     @Test
     public void testChangeDeviceProfileTypeNull() throws Exception {
         DeviceProfile deviceProfile = this.createDeviceProfile("Device Profile");

application/src/test/java/org/thingsboard/server/controller/BaseTelemetryControllerTest.java

@@ -0,0 +1,58 @@
+/**
+ * Copyright © 2016-2023 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.controller;
+
+import org.junit.Test;
+import org.thingsboard.server.common.data.Device;
+import org.thingsboard.server.common.data.SaveDeviceWithCredentialsRequest;
+import org.thingsboard.server.common.data.security.DeviceCredentials;
+import org.thingsboard.server.common.data.security.DeviceCredentialsType;
+
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+public abstract class BaseTelemetryControllerTest extends AbstractControllerTest {
+
+    @Test
+    public void testConstraintValidator() throws Exception {
+        loginTenantAdmin();
+        Device device = createDevice();
+        String correctRequestBody = "{\"data\": \"value\"}";
+        doPostAsync("/api/plugins/telemetry/" + device.getId() + "/SHARED_SCOPE", correctRequestBody, String.class, status().isOk());
+        doPostAsync("/api/plugins/telemetry/DEVICE/" + device.getId() + "/timeseries/smth", correctRequestBody, String.class, status().isOk());
+        String invalidRequestBody = "{\"data\": \"<object data=\\\"data:text/html,<script>alert(document)</script>\\\"></object>\"}";
+        doPostAsync("/api/plugins/telemetry/" + device.getId() + "/SHARED_SCOPE", invalidRequestBody, String.class, status().isBadRequest());
+        doPostAsync("/api/plugins/telemetry/DEVICE/" + device.getId() + "/timeseries/smth", invalidRequestBody, String.class, status().isBadRequest());
+        invalidRequestBody = "{\"<object data=\\\"data:text/html,<script>alert(document)</script>\\\"></object>\": \"data\"}";
+        doPostAsync("/api/plugins/telemetry/" + device.getId() + "/SHARED_SCOPE", invalidRequestBody, String.class, status().isBadRequest());
+        doPostAsync("/api/plugins/telemetry/DEVICE/" + device.getId() + "/timeseries/smth", invalidRequestBody, String.class, status().isBadRequest());
+    }
+
+    private Device createDevice() throws Exception {
+        String testToken = "TEST_TOKEN";
+
+        Device device = new Device();
+        device.setName("My device");
+        device.setType("default");
+
+        DeviceCredentials deviceCredentials = new DeviceCredentials();
+        deviceCredentials.setCredentialsType(DeviceCredentialsType.ACCESS_TOKEN);
+        deviceCredentials.setCredentialsId(testToken);
+
+        SaveDeviceWithCredentialsRequest saveRequest = new SaveDeviceWithCredentialsRequest(device, deviceCredentials);
+
+        return readResponse(doPost("/api/device-with-credentials", saveRequest).andExpect(status().isOk()), Device.class);
+    }
+}

common/data/src/main/java/org/thingsboard/server/common/data/notification/template/NotificationText.java → application/src/test/java/org/thingsboard/server/controller/sql/TelemetryControllerSqlTest.java

@@ -13,18 +13,11 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.thingsboard.server.common.data.notification.template;
+package org.thingsboard.server.controller.sql;
 
-import lombok.AllArgsConstructor;
+import org.thingsboard.server.controller.BaseTelemetryControllerTest;
-import lombok.Data;
+import org.thingsboard.server.dao.service.DaoSqlTest;
-import lombok.NoArgsConstructor;
-
-@Data
-@AllArgsConstructor
-@NoArgsConstructor
-public class NotificationText {
-
-    private String body;
-    private String subject;
 
+@DaoSqlTest
+public class TelemetryControllerSqlTest extends BaseTelemetryControllerTest {
 }

application/src/test/java/org/thingsboard/server/edge/imitator/EdgeImitator.java

@@ -108,6 +108,7 @@ public class EdgeImitator {
         updateEdgeClientFields("rpcPort", port);
         updateEdgeClientFields("timeoutSecs", 3);
         updateEdgeClientFields("keepAliveTimeSec", 300);
+        updateEdgeClientFields("keepAliveTimeoutSec", 5);
         updateEdgeClientFields("maxInboundMessageSize", 4194304);
     }
 

application/src/test/java/org/thingsboard/server/service/device/provision/DeviceProvisionServiceTest.java

@@ -0,0 +1,266 @@
+/**
+ * Copyright © 2016-2023 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.device.provision;
+
+
+import lombok.extern.slf4j.Slf4j;
+import org.assertj.core.api.Assertions;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.boot.test.mock.mockito.SpyBean;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.thingsboard.server.cluster.TbClusterService;
+import org.thingsboard.server.common.data.Device;
+import org.thingsboard.server.common.data.DeviceProfile;
+import org.thingsboard.server.common.data.DeviceProfileProvisionType;
+import org.thingsboard.server.common.data.Tenant;
+import org.thingsboard.server.common.data.device.credentials.ProvisionDeviceCredentialsData;
+import org.thingsboard.server.common.data.device.profile.DeviceProfileData;
+import org.thingsboard.server.common.data.device.profile.X509CertificateChainProvisionConfiguration;
+import org.thingsboard.server.common.data.id.CustomerId;
+import org.thingsboard.server.common.data.id.DeviceId;
+import org.thingsboard.server.common.data.id.DeviceProfileId;
+import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.security.DeviceCredentials;
+import org.thingsboard.server.common.data.security.DeviceCredentialsType;
+import org.thingsboard.server.common.msg.EncryptionUtil;
+import org.thingsboard.server.common.transport.util.SslUtil;
+import org.thingsboard.server.dao.attributes.AttributesService;
+import org.thingsboard.server.dao.audit.AuditLogService;
+import org.thingsboard.server.dao.device.DeviceCredentialsService;
+import org.thingsboard.server.dao.device.DeviceProfileService;
+import org.thingsboard.server.dao.device.DeviceService;
+import org.thingsboard.server.dao.device.provision.ProvisionFailedException;
+import org.thingsboard.server.dao.device.provision.ProvisionRequest;
+import org.thingsboard.server.dao.device.provision.ProvisionResponse;
+import org.thingsboard.server.dao.device.provision.ProvisionResponseStatus;
+import org.thingsboard.server.gen.transport.TransportProtos;
+import org.thingsboard.server.queue.TbQueueProducer;
+import org.thingsboard.server.queue.common.TbProtoQueueMsg;
+import org.thingsboard.server.queue.discovery.PartitionService;
+import org.thingsboard.server.queue.provider.TbQueueProducerProvider;
+import org.thingsboard.server.service.device.DeviceProvisionServiceImpl;;import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@Slf4j
+@RunWith(SpringRunner.class)
+@ContextConfiguration(classes = DeviceProvisionServiceImpl.class)
+public class DeviceProvisionServiceTest {
+
+    @MockBean
+    protected TbQueueProducerProvider producerProvider;
+    @MockBean
+    protected TbQueueProducer<TbProtoQueueMsg<TransportProtos.ToRuleEngineMsg>> ruleEngineMsgProducer;
+    @MockBean
+    protected TbClusterService clusterService;
+    @MockBean
+    protected DeviceProfileService deviceProfileService;
+    @MockBean
+    protected DeviceService deviceService;
+    @MockBean
+    protected DeviceCredentialsService deviceCredentialsService;
+    @MockBean
+    protected AttributesService attributesService;
+    @MockBean
+    protected AuditLogService auditLogService;
+    @MockBean
+    protected PartitionService partitionService;
+    @SpyBean
+    DeviceProvisionServiceImpl service;
+
+    private String[] chain;
+
+    @Before
+    public void setUp() {
+        String filePath = "src/test/resources/provision/x509ChainProvisionTest.pem";
+        try {
+            String certificateChain = Files.readString(Paths.get(filePath));
+            certificateChain = certTrimNewLinesForChainInDeviceProfile(certificateChain);
+            chain = fetchLeafCertificateFromChain(certificateChain);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+
+    @Test
+    public void provisionDeviceViaX509Certificate() {
+        var tenant = createTenant();
+        var deviceProfile = createDeviceProfile(tenant.getId(), chain[1], true);
+
+        var device = createDevice(tenant.getId(), deviceProfile.getId());
+        when(deviceService.findDeviceByTenantIdAndName(any(), any())).thenReturn(device);
+
+        var deviceCredentials = createDeviceCredentials(chain[0], device.getId());
+        when(deviceCredentialsService.findDeviceCredentialsByDeviceId(any(), any())).thenReturn(deviceCredentials);
+        when(deviceCredentialsService.updateDeviceCredentials(any(), any())).thenReturn(deviceCredentials);
+
+        ProvisionResponse response = service.provisionDeviceViaX509Chain(deviceProfile, createProvisionRequest(chain[0]));
+
+        verify(deviceService, times(1)).findDeviceByTenantIdAndName(any(), any());
+        verify(deviceCredentialsService, times(1)).findDeviceCredentialsByDeviceId(any(), any());
+        verify(deviceCredentialsService, times(1)).updateDeviceCredentials(any(), any());
+
+        Assertions.assertThat(response.getResponseStatus()).isEqualTo(ProvisionResponseStatus.SUCCESS);
+        Assertions.assertThat(response.getDeviceCredentials()).isEqualTo(deviceCredentials);
+    }
+
+    @Test
+    public void provisionDeviceWithIncorrectConfiguration() {
+        var tenant = createTenant();
+        var deviceProfile = createDeviceProfile(tenant.getId(), chain[1], false);
+
+        Assertions.assertThatThrownBy(() ->
+                        service.provisionDeviceViaX509Chain(deviceProfile, createProvisionRequest(chain[0])))
+                .isInstanceOf(ProvisionFailedException.class);
+
+        verify(deviceService, times(1)).findDeviceByTenantIdAndName(any(), any());
+    }
+
+    @Test
+    public void matchDeviceNameFromX509CNCertificateByRegex() {
+        var tenant = createTenant();
+        var deviceProfile = createDeviceProfile(tenant.getId(), chain[1], true);
+        X509CertificateChainProvisionConfiguration configuration = (X509CertificateChainProvisionConfiguration) deviceProfile.getProfileData().getProvisionConfiguration();
+        String CN = getCNFromX509Certificate(chain[0]);
+        String deviceName = service.extractDeviceNameFromCNByRegEx(deviceProfile, CN, configuration.getCertificateRegExPattern());
+
+        Assertions.assertThat(deviceName).isNotBlank();
+        Assertions.assertThat(deviceName).isEqualTo("deviceCertificate");
+    }
+
+    @Test
+    public void matchDeviceNameFromCNByRegex() {
+        var CN = "DeviceA.company.com";
+        var regex = "(.*)\\.company.com";
+        var result = service.extractDeviceNameFromCNByRegEx(null, CN, regex);
+        Assertions.assertThat(result).isNotBlank();
+        Assertions.assertThat(result).isEqualTo("DeviceA");
+
+        CN = "DeviceA@company.com";
+        regex = "(.*)@company.com";
+        result = service.extractDeviceNameFromCNByRegEx(null, CN, regex);
+        Assertions.assertThat(result).isNotBlank();
+        Assertions.assertThat(result).isEqualTo("DeviceA");
+
+        CN = "prefixDeviceAsuffix@company.com";
+        regex = "prefix(.*)suffix@company.com";
+        result = service.extractDeviceNameFromCNByRegEx(null, CN, regex);
+        Assertions.assertThat(result).isNotBlank();
+        Assertions.assertThat(result).isEqualTo("DeviceA");
+
+        CN = "prefixDeviceAsufix@company.com";
+        regex = "prefix(.*)sufix@company.com";
+        result = service.extractDeviceNameFromCNByRegEx(null, CN, regex);
+        Assertions.assertThat(result).isNotBlank();
+        Assertions.assertThat(result).isEqualTo("DeviceA");
+
+        CN = "region.DeviceA.220423@company.com";
+        regex = "\\D+\\.(.*)\\.\\d+@company.com";
+        result = service.extractDeviceNameFromCNByRegEx(null, CN, regex);
+        Assertions.assertThat(result).isNotBlank();
+        Assertions.assertThat(result).isEqualTo("DeviceA");
+    }
+
+    private DeviceProfile createDeviceProfile(TenantId tenantId, String certificateValue, boolean isAllowToCreateNewDevices) {
+        X509CertificateChainProvisionConfiguration provision = new X509CertificateChainProvisionConfiguration();
+        provision.setProvisionDeviceSecret(certificateValue);
+        provision.setCertificateRegExPattern("([^@]+)");
+        provision.setAllowCreateNewDevicesByX509Certificate(isAllowToCreateNewDevices);
+
+        DeviceProfileData deviceProfileData = new DeviceProfileData();
+        deviceProfileData.setProvisionConfiguration(provision);
+
+        DeviceProfile deviceProfile = new DeviceProfile();
+        deviceProfile.setId(new DeviceProfileId(UUID.randomUUID()));
+        deviceProfile.setProfileData(deviceProfileData);
+        deviceProfile.setProvisionDeviceKey(EncryptionUtil.getSha3Hash(certificateValue));
+        deviceProfile.setProvisionType(DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN);
+        deviceProfile.setTenantId(tenantId);
+        return deviceProfile;
+    }
+
+    private Device createDevice(TenantId tenantId, DeviceProfileId deviceProfileId) {
+        Device device = new Device();
+        device.setTenantId(tenantId);
+        device.setId(new DeviceId(UUID.randomUUID()));
+        device.setDeviceProfileId(deviceProfileId);
+        device.setCustomerId(new CustomerId(UUID.randomUUID()));
+        return device;
+    }
+
+    private Tenant createTenant() {
+        Tenant tenant = new Tenant();
+        tenant.setId(new TenantId(UUID.randomUUID()));
+        return tenant;
+    }
+
+    private DeviceCredentials createDeviceCredentials(String certificateValue, DeviceId deviceId) {
+        DeviceCredentials deviceCredentials = new DeviceCredentials();
+        deviceCredentials.setDeviceId(deviceId);
+        deviceCredentials.setCredentialsValue(certificateValue);
+        deviceCredentials.setCredentialsId(EncryptionUtil.getSha3Hash(certificateValue));
+        deviceCredentials.setCredentialsType(DeviceCredentialsType.X509_CERTIFICATE);
+        return deviceCredentials;
+    }
+
+    private ProvisionRequest createProvisionRequest(String certificateValue) {
+        return new ProvisionRequest(null, DeviceCredentialsType.X509_CERTIFICATE,
+                new ProvisionDeviceCredentialsData(null, null, null, null, certificateValue),
+                null);
+    }
+
+    public static String certTrimNewLinesForChainInDeviceProfile(String input) {
+        return input.replaceAll("\n", "")
+                .replaceAll("\r", "")
+                .replaceAll("-----BEGIN CERTIFICATE-----", "-----BEGIN CERTIFICATE-----\n")
+                .replaceAll("-----END CERTIFICATE-----", "\n-----END CERTIFICATE-----\n")
+                .trim();
+    }
+
+    private String[] fetchLeafCertificateFromChain(String value) {
+        List<String> chain = new ArrayList<>();
+        String regex = "-----BEGIN CERTIFICATE-----\\s*.*?\\s*-----END CERTIFICATE-----";
+        Pattern pattern = Pattern.compile(regex);
+        Matcher matcher = pattern.matcher(value);
+        while (matcher.find()) {
+            chain.add(matcher.group(0));
+        }
+        return chain.toArray(new String[0]);
+    }
+
+    private String getCNFromX509Certificate(String x509Value) {
+        try {
+            return SslUtil.parseCommonName(SslUtil.readCertFile(x509Value));
+        } catch (Exception e) {
+            return null;
+        }
+    }
+}

application/src/test/java/org/thingsboard/server/service/notification/NotificationApiTest.java

@@ -40,6 +40,7 @@ import org.thingsboard.server.common.data.notification.targets.platform.Customer
 import org.thingsboard.server.common.data.notification.targets.platform.PlatformUsersNotificationTargetConfig;
 import org.thingsboard.server.common.data.notification.targets.platform.UserListFilter;
 import org.thingsboard.server.common.data.notification.targets.slack.SlackConversation;
+import org.thingsboard.server.common.data.notification.targets.slack.SlackConversationType;
 import org.thingsboard.server.common.data.notification.targets.slack.SlackNotificationTargetConfig;
 import org.thingsboard.server.common.data.notification.template.DeliveryMethodNotificationTemplate;
 import org.thingsboard.server.common.data.notification.template.EmailDeliveryMethodNotificationTemplate;
@@ -49,7 +50,6 @@ import org.thingsboard.server.common.data.notification.template.SlackDeliveryMet
 import org.thingsboard.server.common.data.notification.template.SmsDeliveryMethodNotificationTemplate;
 import org.thingsboard.server.common.data.notification.template.WebDeliveryMethodNotificationTemplate;
 import org.thingsboard.server.common.data.security.Authority;
-import org.thingsboard.server.dao.DaoUtil;
 import org.thingsboard.server.dao.notification.NotificationDao;
 import org.thingsboard.server.dao.service.DaoSqlTest;
 import org.thingsboard.server.service.executors.DbCallbackExecutorService;
@@ -226,13 +226,13 @@ public class NotificationApiTest extends AbstractNotificationApiTest {
         NotificationRequest notificationRequest = submitNotificationRequest(notificationTarget.getId(), notificationText, 5);
         assertThat(notificationRequest.getStatus()).isEqualTo(NotificationRequestStatus.SCHEDULED);
         await().atLeast(4, TimeUnit.SECONDS)
-                .atMost(6, TimeUnit.SECONDS)
+                .atMost(15, TimeUnit.SECONDS)
                 .until(() -> wsClient.getLastMsg() != null);
 
         Notification delayedNotification = wsClient.getLastDataUpdate().getUpdate();
         assertThat(delayedNotification).extracting(Notification::getText).isEqualTo(notificationText);
         assertThat(delayedNotification.getCreatedTime() - notificationRequest.getCreatedTime())
-                .isCloseTo(TimeUnit.SECONDS.toMillis(5), Offset.offset(500L));
+                .isCloseTo(TimeUnit.SECONDS.toMillis(5), Offset.offset(10000L));
         assertThat(findNotificationRequest(notificationRequest.getId()).getStatus()).isEqualTo(NotificationRequestStatus.SENT);
     }
 
@@ -324,16 +324,17 @@ public class NotificationApiTest extends AbstractNotificationApiTest {
 
     @Test
     public void testNotificationRequestPreview() throws Exception {
-        NotificationTarget target1 = new NotificationTarget();
+        NotificationTarget tenantAdminTarget = new NotificationTarget();
-        target1.setName("Me");
+        tenantAdminTarget.setName("Me");
-        PlatformUsersNotificationTargetConfig target1Config = new PlatformUsersNotificationTargetConfig();
+        PlatformUsersNotificationTargetConfig tenantAdminTargetConfig = new PlatformUsersNotificationTargetConfig();
         UserListFilter userListFilter = new UserListFilter();
-        userListFilter.setUsersIds(DaoUtil.toUUIDs(List.of(tenantAdminUserId)));
+        userListFilter.setUsersIds(List.of(tenantAdminUserId.getId()));
-        target1Config.setUsersFilter(userListFilter);
+        tenantAdminTargetConfig.setUsersFilter(userListFilter);
-        target1.setConfiguration(target1Config);
+        tenantAdminTarget.setConfiguration(tenantAdminTargetConfig);
-        target1 = saveNotificationTarget(target1);
+        tenantAdminTarget = saveNotificationTarget(tenantAdminTarget);
         List<String> recipients = new ArrayList<>();
         recipients.add(TENANT_ADMIN_EMAIL);
+        String firstRecipientEmail = TENANT_ADMIN_EMAIL;
 
         createDifferentCustomer();
         loginTenantAdmin();
@@ -347,21 +348,32 @@ public class NotificationApiTest extends AbstractNotificationApiTest {
             customerUser = createUser(customerUser, "12345678");
             recipients.add(customerUser.getEmail());
         }
-        NotificationTarget target2 = new NotificationTarget();
+        NotificationTarget customerUsersTarget = new NotificationTarget();
-        target2.setName("Other customer users");
+        customerUsersTarget.setName("Other customer users");
-        PlatformUsersNotificationTargetConfig target2Config = new PlatformUsersNotificationTargetConfig();
+        PlatformUsersNotificationTargetConfig customerUsersTargetConfig = new PlatformUsersNotificationTargetConfig();
         CustomerUsersFilter customerUsersFilter = new CustomerUsersFilter();
         customerUsersFilter.setCustomerId(differentCustomerId.getId());
-        target2Config.setUsersFilter(customerUsersFilter);
+        customerUsersTargetConfig.setUsersFilter(customerUsersFilter);
-        target2.setConfiguration(target2Config);
+        customerUsersTarget.setConfiguration(customerUsersTargetConfig);
-        target2 = saveNotificationTarget(target2);
+        customerUsersTarget = saveNotificationTarget(customerUsersTarget);
-
+
+        NotificationTarget slackTarget = new NotificationTarget();
+        slackTarget.setName("Slack user");
+        SlackNotificationTargetConfig slackTargetConfig = new SlackNotificationTargetConfig();
+        slackTargetConfig.setConversationType(SlackConversationType.DIRECT);
+        SlackConversation slackConversation = new SlackConversation();
+        slackConversation.setId("U1234567");
+        slackConversation.setTitle("@jdoe (John Doe)");
+        slackConversation.setWholeName("John Doe");
+        slackTargetConfig.setConversation(slackConversation);
+        slackTarget.setConfiguration(slackTargetConfig);
+        slackTarget = saveNotificationTarget(slackTarget);
+        recipients.add(slackConversation.getTitle());
 
         NotificationTemplate notificationTemplate = new NotificationTemplate();
         notificationTemplate.setNotificationType(NotificationType.GENERAL);
         notificationTemplate.setName("Test template");
 
-        String requestorEmail = TENANT_ADMIN_EMAIL;
         NotificationTemplateConfig templateConfig = new NotificationTemplateConfig();
         HashMap<NotificationDeliveryMethod, DeliveryMethodNotificationTemplate> templates = new HashMap<>();
         templateConfig.setDeliveryMethodsTemplates(templates);
@@ -369,69 +381,59 @@ public class NotificationApiTest extends AbstractNotificationApiTest {
 
         WebDeliveryMethodNotificationTemplate webNotificationTemplate = new WebDeliveryMethodNotificationTemplate();
         webNotificationTemplate.setEnabled(true);
-        webNotificationTemplate.setBody("Message for WEB: ${recipientEmail} ${unknownParam}");
+        webNotificationTemplate.setSubject("WEB SUBJECT: ${recipientEmail}");
-        webNotificationTemplate.setSubject("Subject for WEB: ${recipientEmail}");
+        webNotificationTemplate.setBody("WEB: ${recipientEmail} ${unknownParam}");
         templates.put(NotificationDeliveryMethod.WEB, webNotificationTemplate);
 
         SmsDeliveryMethodNotificationTemplate smsNotificationTemplate = new SmsDeliveryMethodNotificationTemplate();
         smsNotificationTemplate.setEnabled(true);
-        smsNotificationTemplate.setBody("Message for SMS: ${recipientEmail}");
+        smsNotificationTemplate.setBody("SMS: ${recipientEmail}");
         templates.put(NotificationDeliveryMethod.SMS, smsNotificationTemplate);
 
         EmailDeliveryMethodNotificationTemplate emailNotificationTemplate = new EmailDeliveryMethodNotificationTemplate();
         emailNotificationTemplate.setEnabled(true);
-        emailNotificationTemplate.setSubject("Subject for EMAIL: ${recipientEmail}");
+        emailNotificationTemplate.setSubject("EMAIL SUBJECT: ${recipientEmail}");
-        emailNotificationTemplate.setBody("Message for EMAIL: ${recipientEmail}");
+        emailNotificationTemplate.setBody("EMAIL: ${recipientEmail}");
         templates.put(NotificationDeliveryMethod.EMAIL, emailNotificationTemplate);
 
         SlackDeliveryMethodNotificationTemplate slackNotificationTemplate = new SlackDeliveryMethodNotificationTemplate();
         slackNotificationTemplate.setEnabled(true);
-        slackNotificationTemplate.setBody("Message for SLACK: ${recipientEmail}");
+        slackNotificationTemplate.setBody("SLACK: ${recipientFirstName} ${recipientLastName}");
         templates.put(NotificationDeliveryMethod.SLACK, slackNotificationTemplate);
 
         notificationTemplate = saveNotificationTemplate(notificationTemplate);
 
-
         NotificationRequest notificationRequest = new NotificationRequest();
-        notificationRequest.setTargets(List.of(target1.getUuidId(), target2.getUuidId()));
+        notificationRequest.setTargets(List.of(tenantAdminTarget.getUuidId(), customerUsersTarget.getUuidId(), slackTarget.getUuidId()));
         notificationRequest.setTemplateId(notificationTemplate.getId());
         notificationRequest.setAdditionalConfig(new NotificationRequestConfig());
 
         NotificationRequestPreview preview = doPost("/api/notification/request/preview", notificationRequest, NotificationRequestPreview.class);
-        assertThat(preview.getRecipientsCountByTarget().get(target1.getName())).isEqualTo(1);
+        assertThat(preview.getRecipientsCountByTarget().get(tenantAdminTarget.getName())).isEqualTo(1);
-        assertThat(preview.getRecipientsCountByTarget().get(target2.getName())).isEqualTo(customerUsersCount);
+        assertThat(preview.getRecipientsCountByTarget().get(customerUsersTarget.getName())).isEqualTo(customerUsersCount);
-        assertThat(preview.getTotalRecipientsCount()).isEqualTo(1 + customerUsersCount);
+        assertThat(preview.getRecipientsCountByTarget().get(slackTarget.getName())).isEqualTo(1);
+
+        assertThat(preview.getTotalRecipientsCount()).isEqualTo(2 + customerUsersCount);
         assertThat(preview.getRecipientsPreview()).containsAll(recipients);
 
         Map<NotificationDeliveryMethod, DeliveryMethodNotificationTemplate> processedTemplates = preview.getProcessedTemplates();
         assertThat(processedTemplates.get(NotificationDeliveryMethod.WEB)).asInstanceOf(type(WebDeliveryMethodNotificationTemplate.class))
                 .satisfies(template -> {
-                    assertThat(template.getBody())
+                    assertThat(template.getSubject()).isEqualTo("WEB SUBJECT: " + firstRecipientEmail);
-                            .startsWith("Message for WEB")
+                    assertThat(template.getBody()).isEqualTo("WEB: " + firstRecipientEmail + " ${unknownParam}");
-                            .endsWith(requestorEmail + " ${unknownParam}");
-                    assertThat(template.getSubject())
-                            .startsWith("Subject for WEB")
-                            .endsWith(requestorEmail);
                 });
         assertThat(processedTemplates.get(NotificationDeliveryMethod.SMS)).asInstanceOf(type(SmsDeliveryMethodNotificationTemplate.class))
                 .satisfies(template -> {
-                    assertThat(template.getBody())
+                    assertThat(template.getBody()).isEqualTo("SMS: " + firstRecipientEmail);
-                            .startsWith("Message for SMS")
-                            .endsWith(requestorEmail);
                 });
         assertThat(processedTemplates.get(NotificationDeliveryMethod.EMAIL)).asInstanceOf(type(EmailDeliveryMethodNotificationTemplate.class))
                 .satisfies(template -> {
-                    assertThat(template.getBody())
+                    assertThat(template.getSubject()).isEqualTo("EMAIL SUBJECT: " + firstRecipientEmail);
-                            .startsWith("Message for EMAIL")
+                    assertThat(template.getBody()).isEqualTo("EMAIL: " + firstRecipientEmail);
-                            .endsWith(requestorEmail);
-                    assertThat(template.getSubject())
-                            .startsWith("Subject for EMAIL")
-                            .endsWith(requestorEmail);
                 });
         assertThat(processedTemplates.get(NotificationDeliveryMethod.SLACK)).asInstanceOf(type(SlackDeliveryMethodNotificationTemplate.class))
                 .satisfies(template -> {
-                    assertThat(template.getBody())
+                    assertThat(template.getBody()).isEqualTo("SLACK: John Doe");
-                            .isEqualTo("Message for SLACK: ${recipientEmail}"); // ${recipientEmail} should not be processed
                 });
     }
 

application/src/test/java/org/thingsboard/server/service/notification/NotificationRuleApiTest.java

@@ -23,14 +23,12 @@ import org.junit.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.mock.mockito.SpyBean;
 import org.springframework.data.util.Pair;
-import org.springframework.test.context.TestPropertySource;
 import org.thingsboard.common.util.JacksonUtil;
-import org.thingsboard.rule.engine.debug.TbMsgGeneratorNode;
-import org.thingsboard.rule.engine.debug.TbMsgGeneratorNodeConfiguration;
 import org.thingsboard.server.common.data.DataConstants;
 import org.thingsboard.server.common.data.Device;
 import org.thingsboard.server.common.data.DeviceProfile;
 import org.thingsboard.server.common.data.EntityType;
+import org.thingsboard.server.common.data.TenantProfile;
 import org.thingsboard.server.common.data.User;
 import org.thingsboard.server.common.data.alarm.Alarm;
 import org.thingsboard.server.common.data.alarm.AlarmSearchStatus;
@@ -43,8 +41,7 @@ import org.thingsboard.server.common.data.device.profile.AlarmConditionKeyType;
 import org.thingsboard.server.common.data.device.profile.AlarmRule;
 import org.thingsboard.server.common.data.device.profile.DeviceProfileAlarm;
 import org.thingsboard.server.common.data.device.profile.SimpleAlarmConditionSpec;
-import org.thingsboard.server.common.data.id.NotificationRuleId;
+import org.thingsboard.server.common.data.id.TenantId;
-import org.thingsboard.server.common.data.id.RuleChainId;
 import org.thingsboard.server.common.data.notification.Notification;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
 import org.thingsboard.server.common.data.notification.NotificationRequest;
@@ -59,25 +56,21 @@ import org.thingsboard.server.common.data.notification.rule.trigger.AlarmNotific
 import org.thingsboard.server.common.data.notification.rule.trigger.AlarmNotificationRuleTriggerConfig.AlarmAction;
 import org.thingsboard.server.common.data.notification.rule.trigger.EntityActionNotificationRuleTriggerConfig;
 import org.thingsboard.server.common.data.notification.rule.trigger.NotificationRuleTriggerType;
-import org.thingsboard.server.common.data.notification.rule.trigger.RuleEngineComponentLifecycleEventNotificationRuleTriggerConfig;
 import org.thingsboard.server.common.data.notification.targets.NotificationTarget;
 import org.thingsboard.server.common.data.notification.template.NotificationTemplate;
 import org.thingsboard.server.common.data.page.PageData;
 import org.thingsboard.server.common.data.page.PageLink;
-import org.thingsboard.server.common.data.plugin.ComponentLifecycleEvent;
 import org.thingsboard.server.common.data.query.BooleanFilterPredicate;
 import org.thingsboard.server.common.data.query.EntityKeyValueType;
 import org.thingsboard.server.common.data.query.FilterPredicateValue;
-import org.thingsboard.server.common.data.rule.RuleChain;
-import org.thingsboard.server.common.data.rule.RuleChainMetaData;
-import org.thingsboard.server.common.data.rule.RuleNode;
-import org.thingsboard.server.common.data.script.ScriptLanguage;
 import org.thingsboard.server.common.data.security.Authority;
-import org.thingsboard.server.dao.alarm.AlarmService;
+import org.thingsboard.server.common.data.tenant.profile.DefaultTenantProfileConfiguration;
+import org.thingsboard.server.common.data.tenant.profile.TenantProfileData;
 import org.thingsboard.server.dao.notification.NotificationRequestService;
-import org.thingsboard.server.dao.notification.NotificationRuleService;
-import org.thingsboard.server.dao.notification.NotificationTemplateService;
 import org.thingsboard.server.dao.service.DaoSqlTest;
+import org.thingsboard.server.dao.tenant.TenantProfileService;
+import org.thingsboard.server.service.apiusage.limits.LimitedApi;
+import org.thingsboard.server.service.apiusage.limits.RateLimitService;
 import org.thingsboard.server.service.telemetry.AlarmSubscriptionService;
 
 import java.util.ArrayList;
@@ -96,9 +89,6 @@ import static org.awaitility.Awaitility.await;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
 @DaoSqlTest
-@TestPropertySource(properties = {
-        "js.evaluator=local"
-})
 public class NotificationRuleApiTest extends AbstractNotificationApiTest {
 
     @SpyBean
@@ -106,18 +96,13 @@ public class NotificationRuleApiTest extends AbstractNotificationApiTest {
     @Autowired
     private NotificationRequestService notificationRequestService;
     @Autowired
-    private NotificationRuleService notificationRuleService;
+    private TenantProfileService tenantProfileService;
     @Autowired
-    private NotificationTemplateService notificationTemplateService;
+    private RateLimitService rateLimitService;
-
-    @SpyBean
-    private AlarmService alarmService;
 
     @Before
     public void beforeEach() throws Exception {
         loginTenantAdmin();
-        notificationRuleService.deleteNotificationRulesByTenantId(tenantId);
-        notificationTemplateService.deleteNotificationTemplatesByTenantId(tenantId);
     }
 
     @Test
@@ -208,7 +193,7 @@ public class NotificationRuleApiTest extends AbstractNotificationApiTest {
 
 
         String alarmType = "myBoolIsTrue";
-        DeviceProfile deviceProfile = createDeviceProfileWithAlarmRules(notificationRule.getId(), alarmType);
+        DeviceProfile deviceProfile = createDeviceProfileWithAlarmRules(alarmType);
         Device device = createDevice("Device 1", deviceProfile.getName(), "1234");
 
         clients.values().forEach(wsClient -> {
@@ -272,7 +257,7 @@ public class NotificationRuleApiTest extends AbstractNotificationApiTest {
         notificationRule.setTriggerType(NotificationRuleTriggerType.ALARM);
 
         String alarmType = "myBoolIsTrue";
-        DeviceProfile deviceProfile = createDeviceProfileWithAlarmRules(notificationRule.getId(), alarmType);
+        DeviceProfile deviceProfile = createDeviceProfileWithAlarmRules(alarmType);
         Device device = createDevice("Device 1", deviceProfile.getName(), "1234");
 
         AlarmNotificationRuleTriggerConfig triggerConfig = new AlarmNotificationRuleTriggerConfig();
@@ -352,7 +337,56 @@ public class NotificationRuleApiTest extends AbstractNotificationApiTest {
         assertThat(ruleInfo.getDeliveryMethods()).containsOnly(deliveryMethods);
     }
 
-    private DeviceProfile createDeviceProfileWithAlarmRules(NotificationRuleId notificationRuleId, String alarmType) {
+    @Test
+    public void testNotificationRequestsPerRuleRateLimits() throws Exception {
+        int notificationRequestsLimit = 10;
+        TenantProfile tenantProfile = tenantProfileService.findDefaultTenantProfile(TenantId.SYS_TENANT_ID);
+        TenantProfileData profileData = tenantProfile.getProfileData();
+        DefaultTenantProfileConfiguration profileConfiguration = (DefaultTenantProfileConfiguration) profileData.getConfiguration();
+        profileConfiguration.setTenantNotificationRequestsPerRuleRateLimit(notificationRequestsLimit + ":300");
+        tenantProfile.setProfileData(profileData);
+        loginSysAdmin();
+        doPost("/api/tenantProfile", tenantProfile).andExpect(status().isOk());
+        loginTenantAdmin();
+
+        NotificationRule rule = new NotificationRule();
+        rule.setName("Device created");
+        rule.setTriggerType(NotificationRuleTriggerType.ENTITY_ACTION);
+        NotificationTemplate template = createNotificationTemplate(NotificationType.ENTITY_ACTION, "Device created", "Device created",
+                NotificationDeliveryMethod.WEB, NotificationDeliveryMethod.SMS);
+        rule.setTemplateId(template.getId());
+        EntityActionNotificationRuleTriggerConfig triggerConfig = new EntityActionNotificationRuleTriggerConfig();
+        triggerConfig.setEntityTypes(Set.of(EntityType.DEVICE));
+        triggerConfig.setCreated(true);
+        rule.setTriggerConfig(triggerConfig);
+        NotificationTarget target = createNotificationTarget(tenantAdminUserId);
+        DefaultNotificationRuleRecipientsConfig recipientsConfig = new DefaultNotificationRuleRecipientsConfig();
+        recipientsConfig.setTriggerType(NotificationRuleTriggerType.ENTITY_ACTION);
+        recipientsConfig.setTargets(List.of(target.getUuidId()));
+        rule.setRecipientsConfig(recipientsConfig);
+        rule = saveNotificationRule(rule);
+
+        for (int i = 0; i < notificationRequestsLimit; i++) {
+            String name = "device " + i;
+            createDevice(name, name);
+        }
+        await().atMost(5, TimeUnit.SECONDS)
+                .untilAsserted(() -> {
+                    assertThat(getMyNotifications(false, 100)).size().isEqualTo(notificationRequestsLimit);
+                });
+        for (int i = 0; i < 5; i++) {
+            String name = "device " + (notificationRequestsLimit + i);
+            createDevice(name, name);
+        }
+
+        boolean rateLimitExceeded = !rateLimitService.checkRateLimit(LimitedApi.NOTIFICATION_REQUESTS_PER_RULE, tenantId, rule.getId());
+        assertThat(rateLimitExceeded).isTrue();
+
+        TimeUnit.SECONDS.sleep(3);
+        assertThat(getMyNotifications(false, 100)).size().isEqualTo(notificationRequestsLimit);
+    }
+
+    private DeviceProfile createDeviceProfileWithAlarmRules(String alarmType) {
         DeviceProfile deviceProfile = createDeviceProfile("For notification rule test");
         deviceProfile.setTenantId(tenantId);
 
@@ -387,41 +421,6 @@ public class NotificationRuleApiTest extends AbstractNotificationApiTest {
         return deviceProfile;
     }
 
-    private RuleChain createEmptyRuleChain(String name) {
-        RuleChain ruleChain = new RuleChain();
-        ruleChain.setName(name);
-        ruleChain.setTenantId(tenantId);
-        ruleChain.setRoot(false);
-        ruleChain.setDebugMode(false);
-        ruleChain = doPost("/api/ruleChain", ruleChain, RuleChain.class);
-
-        RuleChainMetaData metaData = new RuleChainMetaData();
-        metaData.setRuleChainId(ruleChain.getId());
-        metaData.setNodes(List.of());
-        metaData = doPost("/api/ruleChain/metadata", metaData, RuleChainMetaData.class);
-        return ruleChain;
-    }
-
-    private RuleNode addRuleNodeWithError(RuleChainId ruleChainId, String name) {
-        RuleChainMetaData metaData = new RuleChainMetaData();
-        metaData.setRuleChainId(ruleChainId);
-
-        RuleNode generatorNodeWithError = new RuleNode();
-        generatorNodeWithError.setName(name);
-        generatorNodeWithError.setType(TbMsgGeneratorNode.class.getName());
-        TbMsgGeneratorNodeConfiguration generatorNodeConfiguration = new TbMsgGeneratorNodeConfiguration();
-        generatorNodeConfiguration.setScriptLang(ScriptLanguage.JS);
-        generatorNodeConfiguration.setPeriodInSeconds(1000);
-        generatorNodeConfiguration.setMsgCount(1);
-        generatorNodeConfiguration.setJsScript("[return");
-        generatorNodeWithError.setConfiguration(JacksonUtil.valueToTree(generatorNodeConfiguration));
-
-        metaData.setNodes(List.of(generatorNodeWithError));
-        metaData.setFirstNodeIndex(0);
-        metaData = doPost("/api/ruleChain/metadata", metaData, RuleChainMetaData.class);
-        return metaData.getNodes().get(0);
-    }
-
     private NotificationRule saveNotificationRule(NotificationRule notificationRule) {
         return doPost("/api/notification/rule", notificationRule, NotificationRule.class);
     }

application/src/test/java/org/thingsboard/server/service/notification/NotificationTemplateApiTest.java

@@ -19,7 +19,6 @@ import com.fasterxml.jackson.core.type.TypeReference;
 import org.apache.commons.lang3.StringUtils;
 import org.junit.Before;
 import org.junit.Test;
-import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.test.web.servlet.ResultActions;
 import org.springframework.test.web.servlet.ResultMatcher;
 import org.thingsboard.server.common.data.id.IdBased;
@@ -30,8 +29,6 @@ import org.thingsboard.server.common.data.notification.template.NotificationTemp
 import org.thingsboard.server.common.data.notification.template.NotificationTemplateConfig;
 import org.thingsboard.server.common.data.page.PageData;
 import org.thingsboard.server.common.data.page.PageLink;
-import org.thingsboard.server.dao.notification.NotificationRuleService;
-import org.thingsboard.server.dao.notification.NotificationTemplateService;
 import org.thingsboard.server.dao.service.DaoSqlTest;
 
 import java.util.List;
@@ -43,16 +40,9 @@ import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.
 @DaoSqlTest
 public class NotificationTemplateApiTest extends AbstractNotificationApiTest {
 
-    @Autowired
-    private NotificationTemplateService templateService;
-    @Autowired
-    private NotificationRuleService notificationRuleService;
-
     @Before
     public void beforeEach() throws Exception {
         loginTenantAdmin();
-        notificationRuleService.deleteNotificationRulesByTenantId(tenantId);
-        templateService.deleteNotificationTemplatesByTenantId(tenantId);
     }
 
     @Test

application/src/test/java/org/thingsboard/server/service/transport/DefaultTransportApiServiceTest.java

@@ -0,0 +1,211 @@
+/**
+ * Copyright © 2016-2023 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.service.transport;
+
+
+import com.google.common.util.concurrent.Futures;
+import lombok.extern.slf4j.Slf4j;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.springframework.boot.test.mock.mockito.MockBean;
+import org.springframework.boot.test.mock.mockito.SpyBean;
+import org.springframework.test.context.ContextConfiguration;
+import org.springframework.test.context.junit4.SpringRunner;
+import org.thingsboard.server.cache.ota.OtaPackageDataCache;
+import org.thingsboard.server.cluster.TbClusterService;
+import org.thingsboard.server.common.data.Device;
+import org.thingsboard.server.common.data.DeviceProfile;
+import org.thingsboard.server.common.data.DeviceProfileProvisionType;
+import org.thingsboard.server.common.data.device.profile.DeviceProfileData;
+import org.thingsboard.server.common.data.device.profile.X509CertificateChainProvisionConfiguration;
+import org.thingsboard.server.common.data.id.DeviceId;
+import org.thingsboard.server.common.data.security.DeviceCredentials;
+import org.thingsboard.server.common.data.security.DeviceCredentialsType;
+import org.thingsboard.server.common.msg.EncryptionUtil;
+import org.thingsboard.server.dao.device.DeviceCredentialsService;
+import org.thingsboard.server.dao.device.DeviceProfileService;
+import org.thingsboard.server.dao.device.DeviceProvisionService;
+import org.thingsboard.server.dao.device.DeviceService;
+import org.thingsboard.server.dao.device.provision.ProvisionResponse;
+import org.thingsboard.server.dao.device.provision.ProvisionResponseStatus;
+import org.thingsboard.server.dao.ota.OtaPackageService;
+import org.thingsboard.server.dao.queue.QueueService;
+import org.thingsboard.server.dao.relation.RelationService;
+import org.thingsboard.server.dao.tenant.TbTenantProfileCache;
+import org.thingsboard.server.queue.util.DataDecodingEncodingService;
+import org.thingsboard.server.service.apiusage.TbApiUsageStateService;
+import org.thingsboard.server.service.executors.DbCallbackExecutorService;
+import org.thingsboard.server.service.profile.TbDeviceProfileCache;
+import org.thingsboard.server.service.resource.TbResourceService;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@Slf4j
+@RunWith(SpringRunner.class)
+@ContextConfiguration(classes = DefaultTransportApiService.class)
+public class DefaultTransportApiServiceTest {
+
+    @MockBean
+    protected TbDeviceProfileCache deviceProfileCache;
+    @MockBean
+    protected TbTenantProfileCache tenantProfileCache;
+    @MockBean
+    protected TbApiUsageStateService apiUsageStateService;
+    @MockBean
+    protected DeviceService deviceService;
+    @MockBean
+    protected DeviceProfileService deviceProfileService;
+    @MockBean
+    protected RelationService relationService;
+    @MockBean
+    protected DeviceCredentialsService deviceCredentialsService;
+    @MockBean
+    protected DbCallbackExecutorService dbCallbackExecutorService;
+    @MockBean
+    protected TbClusterService tbClusterService;
+    @MockBean
+    protected DataDecodingEncodingService dataDecodingEncodingService;
+    @MockBean
+    protected DeviceProvisionService deviceProvisionService;
+    @MockBean
+    protected TbResourceService resourceService;
+    @MockBean
+    protected OtaPackageService otaPackageService;
+    @MockBean
+    protected OtaPackageDataCache otaPackageDataCache;
+    @MockBean
+    protected QueueService queueService;
+    @SpyBean
+    DefaultTransportApiService service;
+
+    private String certificateChain;
+    private String[] chain;
+
+    @Before
+    public void setUp() {
+
+        String filePath = "src/test/resources/provision/x509ChainProvisionTest.pem";
+        try {
+            certificateChain = Files.readString(Paths.get(filePath));
+            certificateChain = certTrimNewLinesForChainInDeviceProfile(certificateChain);
+            chain = fetchLeafCertificateFromChain(certificateChain);
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Test
+    public void validateExistingDeviceByX509CertificateStrategy() {
+        var device = createDevice();
+        when(deviceService.findDeviceByIdAsync(any(), any())).thenReturn(Futures.immediateFuture(device));
+
+        var deviceCredentials = createDeviceCredentials(chain[0], device.getId());
+        when(deviceCredentialsService.findDeviceCredentialsByCredentialsId(any())).thenReturn(deviceCredentials);
+
+        service.validateOrCreateDeviceX509Certificate(certificateChain);
+        verify(deviceCredentialsService, times(1)).findDeviceCredentialsByCredentialsId(any());
+    }
+
+    @Test
+    public void provisionDeviceX509Certificate() {
+        var deviceProfile = createDeviceProfile(chain[1]);
+        when(deviceProfileService.findDeviceProfileByProvisionDeviceKey(any())).thenReturn(deviceProfile);
+
+        var device = createDevice();
+        when(deviceService.findDeviceByTenantIdAndName(any(), any())).thenReturn(device);
+        when(deviceService.findDeviceByIdAsync(any(), any())).thenReturn(Futures.immediateFuture(device));
+
+        var deviceCredentials = createDeviceCredentials(chain[0], device.getId());
+        when(deviceCredentialsService.findDeviceCredentialsByCredentialsId(any())).thenReturn(null);
+        when(deviceCredentialsService.updateDeviceCredentials(any(), any())).thenReturn(deviceCredentials);
+
+        var provisionResponse = createProvisionResponse(deviceCredentials);
+        when(deviceProvisionService.provisionDeviceViaX509Chain(any(), any())).thenReturn(provisionResponse);
+
+        service.validateOrCreateDeviceX509Certificate(certificateChain);
+        verify(deviceProfileService, times(1)).findDeviceProfileByProvisionDeviceKey(any());
+        verify(deviceService, times(1)).findDeviceByIdAsync(any(), any());
+        verify(deviceCredentialsService, times(1)).findDeviceCredentialsByCredentialsId(any());
+        verify(deviceProvisionService, times(1)).provisionDeviceViaX509Chain(any(), any());
+    }
+
+    private DeviceProfile createDeviceProfile(String certificateValue) {
+        X509CertificateChainProvisionConfiguration provision = new X509CertificateChainProvisionConfiguration();
+        provision.setProvisionDeviceSecret(certificateValue);
+        provision.setCertificateRegExPattern("([^@]+)");
+        provision.setAllowCreateNewDevicesByX509Certificate(true);
+
+        DeviceProfileData deviceProfileData = new DeviceProfileData();
+        deviceProfileData.setProvisionConfiguration(provision);
+
+        DeviceProfile deviceProfile = new DeviceProfile();
+        deviceProfile.setProfileData(deviceProfileData);
+        deviceProfile.setProvisionDeviceKey(EncryptionUtil.getSha3Hash(certificateValue));
+        deviceProfile.setProvisionType(DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN);
+        return deviceProfile;
+    }
+
+    private DeviceCredentials createDeviceCredentials(String certificateValue, DeviceId deviceId) {
+        DeviceCredentials deviceCredentials = new DeviceCredentials();
+        deviceCredentials.setDeviceId(deviceId);
+        deviceCredentials.setCredentialsValue(certificateValue);
+        deviceCredentials.setCredentialsId(EncryptionUtil.getSha3Hash(certificateValue));
+        deviceCredentials.setCredentialsType(DeviceCredentialsType.X509_CERTIFICATE);
+        return deviceCredentials;
+    }
+
+    private Device createDevice() {
+        Device device = new Device();
+        device.setId(new DeviceId(UUID.randomUUID()));
+        return device;
+    }
+
+    private ProvisionResponse createProvisionResponse(DeviceCredentials deviceCredentials) {
+        return new ProvisionResponse(deviceCredentials, ProvisionResponseStatus.SUCCESS);
+    }
+
+    public static String certTrimNewLinesForChainInDeviceProfile(String input) {
+        return input.replaceAll("\n", "")
+                .replaceAll("\r", "")
+                .replaceAll("-----BEGIN CERTIFICATE-----", "-----BEGIN CERTIFICATE-----\n")
+                .replaceAll("-----END CERTIFICATE-----", "\n-----END CERTIFICATE-----\n")
+                .trim();
+    }
+
+    private String[] fetchLeafCertificateFromChain(String value) {
+        List<String> chain = new ArrayList<>();
+        String regex = "-----BEGIN CERTIFICATE-----\\s*.*?\\s*-----END CERTIFICATE-----";
+        Pattern pattern = Pattern.compile(regex);
+        Matcher matcher = pattern.matcher(value);
+        while (matcher.find()) {
+            chain.add(matcher.group(0));
+        }
+        return chain.toArray(new String[0]);
+    }
+}

application/src/test/resources/provision/x509ChainProvisionTest.pem

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIICMTCCAdegAwIBAgIUI9dBuwN6pTtK6uZ03rkiCwV4wEYwCgYIKoZIzj0EAwIw
+bjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMRowGAYDVQQKDBFUaGlu
+Z3NCb2FyZCwgSW5jLjEwMC4GA1UEAwwnZGV2aWNlQ2VydGlmaWNhdGVAWDUwOVBy
+b3Zpc2lvblN0cmF0ZWd5MB4XDTIzMDMyOTE0NTYxN1oXDTI0MDMyODE0NTYxN1ow
+bjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMRowGAYDVQQKDBFUaGlu
+Z3NCb2FyZCwgSW5jLjEwMC4GA1UEAwwnZGV2aWNlQ2VydGlmaWNhdGVAWDUwOVBy
+b3Zpc2lvblN0cmF0ZWd5MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE9Zo791qK
+QiGNBm11r4ZGxh+w+ossZL3xc46ufq5QckQHP7zkD2XDAcmP5GvdkM1sBFN9AWaC
+kQfNnWmfERsOOKNTMFEwHQYDVR0OBBYEFFFc5uyCyglQoZiKhzXzMcQ3BKORMB8G
+A1UdIwQYMBaAFFFc5uyCyglQoZiKhzXzMcQ3BKORMA8GA1UdEwEB/wQFMAMBAf8w
+CgYIKoZIzj0EAwIDSAAwRQIhANbA9CuhoOifZMMmqkpuld+65CR+ItKdXeRAhLMZ
+uccuAiB0FSQB34zMutXrZj1g8Gl5OkE7YryFHbei1z0SveHR8g==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIICMTCCAdegAwIBAgIUUEKxS9hTz4l+oLUMF0LV6TC/gCIwCgYIKoZIzj0EAwIw
+bjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMRowGAYDVQQKDBFUaGlu
+Z3NCb2FyZCwgSW5jLjEwMC4GA1UEAwwnZGV2aWNlUHJvZmlsZUNlcnRAWDUwOVBy
+b3Zpc2lvblN0cmF0ZWd5MB4XDTIzMDMyOTE0NTczNloXDTI0MDMyODE0NTczNlow
+bjELMAkGA1UEBhMCVVMxETAPBgNVBAgMCE5ldyBZb3JrMRowGAYDVQQKDBFUaGlu
+Z3NCb2FyZCwgSW5jLjEwMC4GA1UEAwwnZGV2aWNlUHJvZmlsZUNlcnRAWDUwOVBy
+b3Zpc2lvblN0cmF0ZWd5MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAECMlWO72k
+rDoUL9FQjUmSCetkhaEGJUfQkdSfkLSNa0GyAEIMbfmzI4zITeapunu4rGet3EMy
+LydQzuQanBicp6NTMFEwHQYDVR0OBBYEFHpZ78tPnztNii4Da/yCw6mhEIL3MB8G
+A1UdIwQYMBaAFHpZ78tPnztNii4Da/yCw6mhEIL3MA8GA1UdEwEB/wQFMAMBAf8w
+CgYIKoZIzj0EAwIDSAAwRQIgJ7qyMFqNcwSYkH6o+UlQXzLWfwZbNjVk+aR7foAZ
+NGsCIQDsd7v3WQIGHiArfZeDs1DLEDuV/2h6L+ZNoGNhEKL+1A==
+-----END CERTIFICATE-----

common/cluster-api/src/main/proto/queue.proto

@@ -179,6 +179,10 @@ message ValidateDeviceX509CertRequestMsg {
   string hash = 1;
 }
 
+message ValidateOrCreateDeviceX509CertRequestMsg {
+  string certificateChain = 1;
+}
+
 message ValidateBasicMqttCredRequestMsg {
   string clientId = 1;
   string userName = 2;
@@ -942,6 +946,7 @@ message TransportApiRequestMsg {
   GetDeviceRequestMsg deviceRequestMsg = 12;
   GetDeviceCredentialsRequestMsg deviceCredentialsRequestMsg = 13;
   GetAllQueueRoutingInfoRequestMsg getAllQueueRoutingInfoRequestMsg = 14;
+  ValidateOrCreateDeviceX509CertRequestMsg validateOrCreateX509CertRequestMsg = 15;
 }
 
 /* Response from ThingsBoard Core Service to Transport Service */

common/dao-api/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsService.java

@@ -15,10 +15,10 @@
  */
 package org.thingsboard.server.dao.device;
 
+import com.fasterxml.jackson.databind.JsonNode;
 import org.thingsboard.server.common.data.id.DeviceId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.security.DeviceCredentials;
-import com.fasterxml.jackson.databind.JsonNode;
 
 public interface DeviceCredentialsService {
 

common/dao-api/src/main/java/org/thingsboard/server/dao/device/DeviceProfileService.java

@@ -39,6 +39,8 @@ public interface DeviceProfileService extends EntityDaoService {
 
     PageData<DeviceProfileInfo> findDeviceProfileInfos(TenantId tenantId, PageLink pageLink, String transportType);
 
+    DeviceProfile findDeviceProfileByProvisionDeviceKey(String provisionDeviceKey);
+
     DeviceProfile findOrCreateDeviceProfile(TenantId tenantId, String profileName);
 
     DeviceProfile createDefaultDeviceProfile(TenantId tenantId);

common/dao-api/src/main/java/org/thingsboard/server/dao/device/DeviceProvisionService.java

@@ -15,6 +15,7 @@
  */
 package org.thingsboard.server.dao.device;
 
+import org.thingsboard.server.common.data.DeviceProfile;
 import org.thingsboard.server.dao.device.provision.ProvisionFailedException;
 import org.thingsboard.server.dao.device.provision.ProvisionRequest;
 import org.thingsboard.server.dao.device.provision.ProvisionResponse;
@@ -22,4 +23,6 @@ import org.thingsboard.server.dao.device.provision.ProvisionResponse;
 public interface DeviceProvisionService {
 
     ProvisionResponse provisionDevice(ProvisionRequest provisionRequest) throws ProvisionFailedException;
+
+    ProvisionResponse provisionDeviceViaX509Chain(DeviceProfile deviceProfile, ProvisionRequest provisionRequest) throws ProvisionFailedException;
 }

common/dao-api/src/main/java/org/thingsboard/server/dao/device/provision/ProvisionFailedException.java

@@ -16,7 +16,11 @@
 package org.thingsboard.server.dao.device.provision;
 
 public class ProvisionFailedException extends RuntimeException {
+
+    private static final long serialVersionUID = 1673991117668477401L;
+
     public ProvisionFailedException(String errorMsg) {
         super(errorMsg);
     }
+
 }

common/data/pom.xml

@@ -100,6 +100,10 @@
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
         </dependency>
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.swagger</groupId>
             <artifactId>swagger-annotations</artifactId>

common/data/src/main/java/org/thingsboard/server/common/data/DeviceProfileProvisionType.java

@@ -18,5 +18,6 @@ package org.thingsboard.server.common.data;
 public enum DeviceProfileProvisionType {
     DISABLED,
     ALLOW_CREATE_NEW_DEVICES,
-    CHECK_PRE_PROVISIONED_DEVICES
+    CHECK_PRE_PROVISIONED_DEVICES,
+    X509_CERTIFICATE_CHAIN
 }

common/data/src/main/java/org/thingsboard/server/common/data/UpdateMessage.java

@@ -38,5 +38,4 @@ public class UpdateMessage implements Serializable {
     @ApiModelProperty(position = 6, value = "Latest ThingsBoard version release notes URL.")
     private final String latestVersionReleaseNotesUrl;
 
-
 }

common/data/src/main/java/org/thingsboard/server/common/data/device/profile/DeviceProfileProvisionConfiguration.java

@@ -31,7 +31,8 @@ import java.io.Serializable;
 @JsonSubTypes({
         @JsonSubTypes.Type(value = DisabledDeviceProfileProvisionConfiguration.class, name = "DISABLED"),
         @JsonSubTypes.Type(value = AllowCreateNewDevicesDeviceProfileProvisionConfiguration.class, name = "ALLOW_CREATE_NEW_DEVICES"),
-        @JsonSubTypes.Type(value = CheckPreProvisionedDevicesDeviceProfileProvisionConfiguration.class, name = "CHECK_PRE_PROVISIONED_DEVICES")})
+        @JsonSubTypes.Type(value = CheckPreProvisionedDevicesDeviceProfileProvisionConfiguration.class, name = "CHECK_PRE_PROVISIONED_DEVICES"),
+        @JsonSubTypes.Type(value = X509CertificateChainProvisionConfiguration.class, name = "X509_CERTIFICATE_CHAIN")})
 public interface DeviceProfileProvisionConfiguration extends Serializable {
 
     String getProvisionDeviceSecret();

common/data/src/main/java/org/thingsboard/server/common/data/device/profile/X509CertificateChainProvisionConfiguration.java

@@ -0,0 +1,36 @@
+/**
+ * Copyright © 2016-2023 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.thingsboard.server.common.data.device.profile;
+
+import lombok.Data;
+import lombok.NoArgsConstructor;
+import org.thingsboard.server.common.data.DeviceProfileProvisionType;
+
+@Data
+@NoArgsConstructor
+public class X509CertificateChainProvisionConfiguration implements DeviceProfileProvisionConfiguration {
+
+    private String provisionDeviceSecret;
+    private String certificateRegExPattern;
+    private boolean allowCreateNewDevicesByX509Certificate;
+
+    @Override
+    public DeviceProfileProvisionType getType() {
+        return DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN;
+    }
+
+}

common/data/src/main/java/org/thingsboard/server/common/data/kv/BasicKvEntry.java

@@ -16,6 +16,7 @@
 package org.thingsboard.server.common.data.kv;
 
 import org.thingsboard.server.common.data.validation.Length;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 import java.util.Objects;
 import java.util.Optional;
@@ -23,6 +24,7 @@ import java.util.Optional;
 public abstract class BasicKvEntry implements KvEntry {
 
     @Length(fieldName = "attribute key")
+    @NoXss
     private final String key;
 
     protected BasicKvEntry(String key) {

common/data/src/main/java/org/thingsboard/server/common/data/kv/BasicTsKvEntry.java

@@ -15,12 +15,14 @@
  */
 package org.thingsboard.server.common.data.kv;
 
+import javax.validation.Valid;
 import java.util.Objects;
 import java.util.Optional;
 
 public class BasicTsKvEntry implements TsKvEntry {
     private static final int MAX_CHARS_PER_DATA_POINT = 512;
     protected final long ts;
+    @Valid
     private final KvEntry kv;
 
     public BasicTsKvEntry(long ts, KvEntry kv) {

common/data/src/main/java/org/thingsboard/server/common/data/kv/JsonDataEntry.java

@@ -15,10 +15,14 @@
  */
 package org.thingsboard.server.common.data.kv;
 
+import org.thingsboard.server.common.data.validation.NoXss;
+
 import java.util.Objects;
 import java.util.Optional;
 
 public class JsonDataEntry extends BasicKvEntry {
+
+    @NoXss
     private final String value;
 
     public JsonDataEntry(String key, String value) {

common/data/src/main/java/org/thingsboard/server/common/data/kv/StringDataEntry.java

@@ -15,6 +15,8 @@
  */
 package org.thingsboard.server.common.data.kv;
 
+import org.thingsboard.server.common.data.validation.NoXss;
+
 import java.util.Objects;
 import java.util.Optional;
 
@@ -22,6 +24,7 @@ public class StringDataEntry extends BasicKvEntry {
 
     private static final long serialVersionUID = 1L;
 
+    @NoXss
     private final String value;
 
     public StringDataEntry(String key, String value) {

common/data/src/main/java/org/thingsboard/server/common/data/notification/rule/NotificationRule.java

@@ -27,6 +27,7 @@ import org.thingsboard.server.common.data.id.NotificationTemplateId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.notification.rule.trigger.NotificationRuleTriggerConfig;
 import org.thingsboard.server.common.data.notification.rule.trigger.NotificationRuleTriggerType;
+import org.thingsboard.server.common.data.validation.Length;
 import org.thingsboard.server.common.data.validation.NoXss;
 
 import javax.validation.Valid;
@@ -43,6 +44,7 @@ public class NotificationRule extends BaseData<NotificationRuleId> implements Ha
     private TenantId tenantId;
     @NotBlank
     @NoXss
+    @Length(max = 255, message = "cannot be longer than 255 chars")
     private String name;
     @NotNull
     private NotificationTemplateId templateId;

common/data/src/main/java/org/thingsboard/server/common/data/notification/targets/NotificationTarget.java

@@ -22,6 +22,7 @@ import org.thingsboard.server.common.data.HasName;
 import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.id.NotificationTargetId;
 import org.thingsboard.server.common.data.id.TenantId;
+import org.thingsboard.server.common.data.validation.Length;
 import org.thingsboard.server.common.data.validation.NoXss;
 
 import javax.validation.Valid;
@@ -35,6 +36,7 @@ public class NotificationTarget extends BaseData<NotificationTargetId> implement
     private TenantId tenantId;
     @NotBlank
     @NoXss
+    @Length(max = 255, message = "cannot be longer than 255 chars")
     private String name;
     @NotNull
     @Valid

common/data/src/main/java/org/thingsboard/server/common/data/notification/targets/NotificationTargetConfig.java

@@ -23,6 +23,7 @@ import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import lombok.Data;
 import org.thingsboard.server.common.data.notification.targets.platform.PlatformUsersNotificationTargetConfig;
 import org.thingsboard.server.common.data.notification.targets.slack.SlackNotificationTargetConfig;
+import org.thingsboard.server.common.data.validation.Length;
 import org.thingsboard.server.common.data.validation.NoXss;
 
 @JsonIgnoreProperties(ignoreUnknown = true)
@@ -35,6 +36,7 @@ import org.thingsboard.server.common.data.validation.NoXss;
 public abstract class NotificationTargetConfig {
 
     @NoXss
+    @Length(max = 500, message = "cannot be longer than 500 chars")
     private String description;
 
     @JsonIgnore

common/data/src/main/java/org/thingsboard/server/common/data/notification/targets/NotificationTargetType.java

@@ -19,6 +19,7 @@ import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
 
+import java.util.Arrays;
 import java.util.Set;
 
 @RequiredArgsConstructor
@@ -30,4 +31,10 @@ public enum NotificationTargetType {
     @Getter
     private final Set<NotificationDeliveryMethod> supportedDeliveryMethods;
 
+    public static NotificationTargetType forDeliveryMethod(NotificationDeliveryMethod deliveryMethod) {
+        return Arrays.stream(values())
+                .filter(targetType -> targetType.getSupportedDeliveryMethods().contains(deliveryMethod))
+                .findFirst().orElse(null);
+    }
+
 }

common/data/src/main/java/org/thingsboard/server/common/data/notification/template/EmailDeliveryMethodNotificationTemplate.java

@@ -21,6 +21,8 @@ import lombok.NoArgsConstructor;
 import lombok.ToString;
 import org.apache.commons.lang3.StringUtils;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
+import org.thingsboard.server.common.data.validation.Length;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 import javax.validation.constraints.NotEmpty;
 
@@ -30,6 +32,8 @@ import javax.validation.constraints.NotEmpty;
 @ToString(callSuper = true)
 public class EmailDeliveryMethodNotificationTemplate extends DeliveryMethodNotificationTemplate implements HasSubject {
 
+    @NoXss(fieldName = "email subject")
+    @Length(fieldName = "email subject", max = 250, message = "cannot be longer than 250 chars")
     @NotEmpty
     private String subject;
 

common/data/src/main/java/org/thingsboard/server/common/data/notification/template/NotificationTemplate.java

@@ -23,6 +23,7 @@ import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.id.NotificationTemplateId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.notification.NotificationType;
+import org.thingsboard.server.common.data.validation.Length;
 import org.thingsboard.server.common.data.validation.NoXss;
 
 import javax.validation.Valid;
@@ -36,6 +37,7 @@ public class NotificationTemplate extends BaseData<NotificationTemplateId> imple
     private TenantId tenantId;
     @NoXss
     @NotEmpty
+    @Length(max = 255, message = "cannot be longer than 255 chars")
     private String name;
     @NoXss
     @NotNull

common/data/src/main/java/org/thingsboard/server/common/data/notification/template/SlackDeliveryMethodNotificationTemplate.java

@@ -20,6 +20,7 @@ import lombok.EqualsAndHashCode;
 import lombok.NoArgsConstructor;
 import lombok.ToString;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Data
 @NoArgsConstructor
@@ -31,6 +32,12 @@ public class SlackDeliveryMethodNotificationTemplate extends DeliveryMethodNotif
         super(other);
     }
 
+    @NoXss(fieldName = "Slack message")
+    @Override
+    public String getBody() {
+        return super.getBody();
+    }
+
     @Override
     public NotificationDeliveryMethod getMethod() {
         return NotificationDeliveryMethod.SLACK;

common/data/src/main/java/org/thingsboard/server/common/data/notification/template/SmsDeliveryMethodNotificationTemplate.java

@@ -20,6 +20,8 @@ import lombok.EqualsAndHashCode;
 import lombok.NoArgsConstructor;
 import lombok.ToString;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
+import org.thingsboard.server.common.data.validation.Length;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 @Data
 @NoArgsConstructor
@@ -31,6 +33,13 @@ public class SmsDeliveryMethodNotificationTemplate extends DeliveryMethodNotific
         super(other);
     }
 
+    @NoXss(fieldName = "SMS message")
+    @Length(fieldName = "SMS message", max = 320, message = "cannot be longer than 320 chars")
+    @Override
+    public String getBody() {
+        return super.getBody();
+    }
+
     @Override
     public NotificationDeliveryMethod getMethod() {
         return NotificationDeliveryMethod.SMS;

common/data/src/main/java/org/thingsboard/server/common/data/notification/template/WebDeliveryMethodNotificationTemplate.java

@@ -25,6 +25,8 @@ import lombok.NoArgsConstructor;
 import lombok.ToString;
 import org.apache.commons.lang3.StringUtils;
 import org.thingsboard.server.common.data.notification.NotificationDeliveryMethod;
+import org.thingsboard.server.common.data.validation.Length;
+import org.thingsboard.server.common.data.validation.NoXss;
 
 import javax.validation.constraints.NotEmpty;
 import java.util.Optional;
@@ -35,6 +37,8 @@ import java.util.Optional;
 @ToString(callSuper = true)
 public class WebDeliveryMethodNotificationTemplate extends DeliveryMethodNotificationTemplate implements HasSubject {
 
+    @NoXss(fieldName = "web notification subject")
+    @Length(fieldName = "web notification subject", max = 150, message = "cannot be longer than 150 chars")
     @NotEmpty
     private String subject;
     private JsonNode additionalConfig;
@@ -45,6 +49,15 @@ public class WebDeliveryMethodNotificationTemplate extends DeliveryMethodNotific
         this.additionalConfig = other.additionalConfig != null ? other.additionalConfig.deepCopy() : null;
     }
 
+    @NoXss(fieldName = "web notification message")
+    @Length(fieldName = "web notification message", max = 250, message = "cannot be longer than 250 chars")
+    @Override
+    public String getBody() {
+        return super.getBody();
+    }
+
+    @NoXss(fieldName = "web notification button text")
+    @Length(fieldName = "web notification button text", max = 50, message = "cannot be longer than 50 chars")
     @JsonIgnore
     public String getButtonText() {
         return getButtonConfigProperty("text");
@@ -57,6 +70,8 @@ public class WebDeliveryMethodNotificationTemplate extends DeliveryMethodNotific
         });
     }
 
+    @NoXss(fieldName = "web notification button link")
+    @Length(fieldName = "web notification button link", max = 300, message = "cannot be longer than 300 chars")
     @JsonIgnore
     public String getButtonLink() {
         return getButtonConfigProperty("link");

common/data/src/main/java/org/thingsboard/server/common/data/settings/UserSettingsType.java

@@ -19,7 +19,7 @@ import lombok.Getter;
 
 public enum UserSettingsType {
 
-    GENERAL, VISITED_DASHBOARDS(true), QUICK_LINKS, DOC_LINKS, DASHBOARDS;
+    GENERAL, VISITED_DASHBOARDS(true), QUICK_LINKS, DOC_LINKS, DASHBOARDS, GETTING_STARTED;
 
     @Getter
     private final boolean reserved;

common/data/src/main/java/org/thingsboard/server/common/data/tenant/profile/DefaultTenantProfileConfiguration.java

@@ -48,6 +48,7 @@ public class DefaultTenantProfileConfiguration implements TenantProfileConfigura
     private String tenantEntityExportRateLimit;
     private String tenantEntityImportRateLimit;
     private String tenantNotificationRequestsRateLimit;
+    private String tenantNotificationRequestsPerRuleRateLimit;
 
     private long maxTransportMessages;
     private long maxTransportDataPoints;

common/data/src/main/java/org/thingsboard/server/common/data/validation/Length.java

@@ -23,12 +23,12 @@ import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
 @Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.FIELD)
+@Target({ElementType.FIELD, ElementType.METHOD})
 @Constraint(validatedBy = {})
 public @interface Length {
     String message() default "length must be equal or less than {max}";
 
-    String fieldName();
+    String fieldName() default "";
 
     int max() default 255;
 

common/data/src/main/java/org/thingsboard/server/common/data/validation/NoXss.java

@@ -23,12 +23,16 @@ import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
 @Retention(RetentionPolicy.RUNTIME)
-@Target(ElementType.FIELD)
+@Target({ElementType.FIELD, ElementType.METHOD})
 @Constraint(validatedBy = {})
 public @interface NoXss {
+
     String message() default "is malformed";
 
+    String fieldName() default "";
+
     Class<?>[] groups() default {};
 
     Class<? extends Payload>[] payload() default {};
+
 }

common/edge-api/src/main/java/org/thingsboard/edge/rpc/EdgeGrpcClient.java

@@ -57,8 +57,10 @@ public class EdgeGrpcClient implements EdgeRpcClient {
     private int rpcPort;
     @Value("${cloud.rpc.timeout}")
     private int timeoutSecs;
-    @Value("${cloud.rpc.keep_alive_time_sec}")
+    @Value("${cloud.rpc.keep_alive_time_sec:10}")
     private int keepAliveTimeSec;
+    @Value("${cloud.rpc.keep_alive_timeout_sec:5}")
+    private int keepAliveTimeoutSec;
     @Value("${cloud.rpc.ssl.enabled}")
     private boolean sslEnabled;
     @Value("${cloud.rpc.ssl.cert:}")
@@ -83,7 +85,9 @@ public class EdgeGrpcClient implements EdgeRpcClient {
                         Consumer<Exception> onError) {
         NettyChannelBuilder builder = NettyChannelBuilder.forAddress(rpcHost, rpcPort)
                 .maxInboundMessageSize(maxInboundMessageSize)
-                .keepAliveTime(keepAliveTimeSec, TimeUnit.SECONDS);
+                .keepAliveTime(keepAliveTimeSec, TimeUnit.SECONDS)
+                .keepAliveTimeout(keepAliveTimeoutSec, TimeUnit.SECONDS)
+                .keepAliveWithoutCalls(true);
         if (sslEnabled) {
             try {
                 SslContextBuilder sslContextBuilder = GrpcSslContexts.forClient();

common/message/src/main/java/org/thingsboard/server/common/msg/EncryptionUtil.java

@@ -35,6 +35,14 @@ public class EncryptionUtil {
                 .replaceAll("-----END CERTIFICATE-----", "");
     }
 
+    public static String certTrimNewLinesForChainInDeviceProfile(String input) {
+        return input.replaceAll("\n", "")
+                .replaceAll("\r", "")
+                .replaceAll("-----BEGIN CERTIFICATE-----", "-----BEGIN CERTIFICATE-----\n")
+                .replaceAll("-----END CERTIFICATE-----", "\n-----END CERTIFICATE-----\n")
+                .trim();
+    }
+
     public static String pubkTrimNewLines(String input) {
         return input.replaceAll("-----BEGIN PUBLIC KEY-----", "")
                 .replaceAll("\n", "")

common/script/remote-js-client/src/main/java/org/thingsboard/server/service/script/RemoteJsInvokeService.java

@@ -20,7 +20,6 @@ import com.google.common.util.concurrent.ListenableFuture;
 import com.google.common.util.concurrent.MoreExecutors;
 import lombok.Getter;
 import lombok.extern.slf4j.Slf4j;
-import org.jetbrains.annotations.NotNull;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
@@ -191,7 +190,6 @@ public class RemoteJsInvokeService extends AbstractJsInvokeService {
         }, callbackExecutor);
     }
 
-    @NotNull
     private JsInvokeProtos.RemoteJsRequest buildJsInvokeRequest(JsScriptInfo jsInfo, Object[] args, boolean includeScriptBody, String scriptBody) {
         JsInvokeProtos.JsInvokeRequest.Builder jsRequestBuilder = JsInvokeProtos.JsInvokeRequest.newBuilder()
                 .setScriptHash(jsInfo.getHash())

common/transport/lwm2m/src/main/java/org/thingsboard/server/transport/lwm2m/server/store/TbRedisLwM2MClientStore.java

@@ -16,6 +16,7 @@
 package org.thingsboard.server.transport.lwm2m.server.store;
 
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.codec.binary.Hex;
 import org.springframework.data.redis.connection.RedisClusterConnection;
 import org.springframework.data.redis.connection.RedisConnectionFactory;
 import org.springframework.data.redis.core.Cursor;
@@ -48,7 +49,12 @@ public class TbRedisLwM2MClientStore implements TbLwM2MClientStore {
             if (data == null) {
                 return null;
             } else {
-                return deserialize(data);
+                try {
+                    return deserialize(data);
+                } catch (Exception e) {
+                    log.warn("[{}] Failed to deserialize client from data: {}", endpoint, Hex.encodeHexString(data), e);
+                    return null;
+                }
             }
         }
     }
@@ -70,7 +76,13 @@ public class TbRedisLwM2MClientStore implements TbLwM2MClientStore {
             scans.forEach(scan -> {
                 scan.forEachRemaining(key -> {
                     byte[] element = connection.get(key);
-                    clients.add(deserialize(element));
+                    if (element != null) {
+                        try {
+                            clients.add(deserialize(element));
+                        } catch (Exception e) {
+                            log.warn("[{}] Failed to deserialize client from data: {}", Hex.encodeHexString(key), Hex.encodeHexString(element), e);
+                        }
+                    }
                 });
             });
             return clients;

common/transport/mqtt/src/main/java/org/thingsboard/server/transport/mqtt/MqttSslHandlerProvider.java

@@ -24,9 +24,8 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Bean;
 import org.springframework.stereotype.Component;
-import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.common.data.DeviceTransportType;
-import org.thingsboard.server.common.msg.EncryptionUtil;
+import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.common.transport.TransportService;
 import org.thingsboard.server.common.transport.TransportServiceCallback;
 import org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse;
@@ -42,7 +41,6 @@ import javax.net.ssl.SSLEngine;
 import javax.net.ssl.TrustManager;
 import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
-import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
 import java.util.concurrent.CountDownLatch;
@@ -123,7 +121,7 @@ public class MqttSslHandlerProvider {
     static class ThingsboardMqttX509TrustManager implements X509TrustManager {
 
         private final X509TrustManager trustManager;
-        private TransportService transportService;
+        private final TransportService transportService;
 
         ThingsboardMqttX509TrustManager(X509TrustManager trustManager, TransportService transportService) {
             this.trustManager = trustManager;
@@ -142,43 +140,59 @@ public class MqttSslHandlerProvider {
         }
 
         @Override
-        public void checkClientTrusted(X509Certificate[] chain,
+        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
-                                       String authType) throws CertificateException {
+            if (!validateCertificateChain(chain)) {
-            String credentialsBody = null;
+                throw new CertificateException("Invalid Chain of X509 Certificates. ");
-            for (X509Certificate cert : chain) {
+            }
-                try {
+            String clientDeviceCertValue = SslUtil.getCertificateString(chain[0]);
-                    String strCert = SslUtil.getCertificateString(cert);
+            final String[] credentialsBodyHolder = new String[1];
-                    String sha3Hash = EncryptionUtil.getSha3Hash(strCert);
+            CountDownLatch latch = new CountDownLatch(1);
-                    final String[] credentialsBodyHolder = new String[1];
+            try {
-                    CountDownLatch latch = new CountDownLatch(1);
+                String certificateChain = SslUtil.getCertificateChainString(chain);
-                    transportService.process(DeviceTransportType.MQTT, TransportProtos.ValidateDeviceX509CertRequestMsg.newBuilder().setHash(sha3Hash).build(),
+                transportService.process(DeviceTransportType.MQTT, TransportProtos.ValidateOrCreateDeviceX509CertRequestMsg
-                            new TransportServiceCallback<ValidateDeviceCredentialsResponse>() {
+                                .newBuilder().setCertificateChain(certificateChain).build(),
-                                @Override
+                        new TransportServiceCallback<>() {
-                                public void onSuccess(ValidateDeviceCredentialsResponse msg) {
+                            @Override
-                                    if (!StringUtils.isEmpty(msg.getCredentials())) {
+                            public void onSuccess(ValidateDeviceCredentialsResponse msg) {
-                                        credentialsBodyHolder[0] = msg.getCredentials();
+                                if (!StringUtils.isEmpty(msg.getCredentials())) {
-                                    }
+                                    credentialsBodyHolder[0] = msg.getCredentials();
-                                    latch.countDown();
-                                }
-
-                                @Override
-                                public void onError(Throwable e) {
-                                    log.error(e.getMessage(), e);
-                                    latch.countDown();
                                 }
-                            });
+                                latch.countDown();
-                    latch.await(10, TimeUnit.SECONDS);
+                            }
-                    if (strCert.equals(credentialsBodyHolder[0])) {
+
-                        credentialsBody = credentialsBodyHolder[0];
+                            @Override
-                        break;
+                            public void onError(Throwable e) {
+                                log.trace("Failed to process certificate chain: {}", certificateChain, e);
+                                latch.countDown();
+                            }
+                        });
+                latch.await(10, TimeUnit.SECONDS);
+                if (!clientDeviceCertValue.equals(credentialsBodyHolder[0])) {
+                    log.debug("Failed to find credentials for device certificate chain: {}", chain);
+                    if (chain.length == 1) {
+                        throw new CertificateException("Invalid Device Certificate");
+                    } else {
+                        throw new CertificateException("Invalid Chain of X509 Certificates");
                     }
-                } catch (InterruptedException | CertificateEncodingException e) {
-                    log.error(e.getMessage(), e);
                 }
+            } catch (Exception e) {
+                log.error(e.getMessage(), e);
             }
-            if (credentialsBody == null) {
+        }
-                log.debug("Failed to find credentials for device certificate chain: {}", chain);
+
-                throw new CertificateException("Invalid Device Certificate");
+        private boolean validateCertificateChain(X509Certificate[] chain) {
+            try {
+                if (chain.length > 1) {
+                    X509Certificate leafCert = chain[0];
+                    for (int i = 1; i < chain.length; i++) {
+                        X509Certificate intermediateCert = chain[i];
+                        leafCert.verify(intermediateCert.getPublicKey());
+                        leafCert = intermediateCert;
+                    }
+                }
+                return true;
+            } catch (Exception e) {
+                return false;
             }
         }
     }

common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/TransportService.java

@@ -54,8 +54,9 @@ import org.thingsboard.server.gen.transport.TransportProtos.ToServerRpcRequestMs
 import org.thingsboard.server.gen.transport.TransportProtos.TransportToDeviceActorMsg;
 import org.thingsboard.server.gen.transport.TransportProtos.ValidateBasicMqttCredRequestMsg;
 import org.thingsboard.server.gen.transport.TransportProtos.ValidateDeviceLwM2MCredentialsRequestMsg;
-import org.thingsboard.server.gen.transport.TransportProtos.ValidateDeviceTokenRequestMsg;
 import org.thingsboard.server.gen.transport.TransportProtos.ValidateDeviceX509CertRequestMsg;
+import org.thingsboard.server.gen.transport.TransportProtos.ValidateDeviceTokenRequestMsg;
+import org.thingsboard.server.gen.transport.TransportProtos.ValidateOrCreateDeviceX509CertRequestMsg;
 
 import java.util.List;
 import java.util.concurrent.ExecutorService;
@@ -87,6 +88,9 @@ public interface TransportService {
     void process(DeviceTransportType transportType, ValidateDeviceX509CertRequestMsg msg,
                  TransportServiceCallback<ValidateDeviceCredentialsResponse> callback);
 
+    void process(DeviceTransportType transportType, ValidateOrCreateDeviceX509CertRequestMsg msg,
+                 TransportServiceCallback<ValidateDeviceCredentialsResponse> callback);
+
     void process(ValidateDeviceLwM2MCredentialsRequestMsg msg,
                  TransportServiceCallback<ValidateDeviceCredentialsResponse> callback);
 

common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/service/DefaultTransportService.java

@@ -72,7 +72,6 @@ import org.thingsboard.server.common.transport.auth.GetOrCreateDeviceFromGateway
 import org.thingsboard.server.common.transport.auth.TransportDeviceInfo;
 import org.thingsboard.server.common.transport.auth.ValidateDeviceCredentialsResponse;
 import org.thingsboard.server.common.transport.limits.TransportRateLimitService;
-import org.thingsboard.server.queue.util.DataDecodingEncodingService;
 import org.thingsboard.server.common.transport.util.JsonUtils;
 import org.thingsboard.server.gen.transport.TransportProtos;
 import org.thingsboard.server.gen.transport.TransportProtos.ProvisionDeviceRequestMsg;
@@ -97,6 +96,7 @@ import org.thingsboard.server.queue.provider.TbQueueProducerProvider;
 import org.thingsboard.server.queue.provider.TbTransportQueueFactory;
 import org.thingsboard.server.queue.scheduler.SchedulerComponent;
 import org.thingsboard.server.queue.util.AfterStartUp;
+import org.thingsboard.server.queue.util.DataDecodingEncodingService;
 import org.thingsboard.server.queue.util.TbTransportComponent;
 
 import javax.annotation.PostConstruct;
@@ -434,6 +434,13 @@ public class DefaultTransportService implements TransportService {
         doProcess(transportType, protoMsg, callback);
     }
 
+    @Override
+    public void process(DeviceTransportType transportType, TransportProtos.ValidateOrCreateDeviceX509CertRequestMsg msg, TransportServiceCallback<ValidateDeviceCredentialsResponse> callback) {
+        log.trace("Processing msg: {}", msg);
+        TbProtoQueueMsg<TransportApiRequestMsg> protoMsg = new TbProtoQueueMsg<>(UUID.randomUUID(), TransportApiRequestMsg.newBuilder().setValidateOrCreateX509CertRequestMsg(msg).build());
+        doProcess(transportType, protoMsg, callback);
+    }
+
     private void doProcess(DeviceTransportType transportType, TbProtoQueueMsg<TransportApiRequestMsg> protoMsg,
                            TransportServiceCallback<ValidateDeviceCredentialsResponse> callback) {
         ListenableFuture<ValidateDeviceCredentialsResponse> response = Futures.transform(transportApiRequestTemplate.send(protoMsg), tmp -> {

common/transport/transport-api/src/main/java/org/thingsboard/server/common/transport/util/SslUtil.java

@@ -16,11 +16,21 @@
 package org.thingsboard.server.common.transport.util;
 
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.codec.binary.Base64;
+import org.bouncycastle.asn1.x500.RDN;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x500.style.BCStyle;
+import org.bouncycastle.asn1.x500.style.IETFUtils;
+import org.bouncycastle.cert.jcajce.JcaX509CertificateHolder;
 import org.springframework.util.Base64Utils;
 import org.thingsboard.server.common.msg.EncryptionUtil;
 
+import java.io.ByteArrayInputStream;
+import java.io.InputStream;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
 
 /**
  * @author Valerii Sosliuk
@@ -35,4 +45,44 @@ public class SslUtil {
             throws CertificateEncodingException {
         return EncryptionUtil.certTrimNewLines(Base64Utils.encodeToString(cert.getEncoded()));
     }
+
+    public static String getCertificateChainString(Certificate[] chain)
+            throws CertificateEncodingException {
+        String begin = "-----BEGIN CERTIFICATE-----";
+        String end = "-----END CERTIFICATE-----";
+        StringBuilder stringBuilder = new StringBuilder();
+        for (Certificate cert: chain) {
+            stringBuilder.append(begin).append(EncryptionUtil.certTrimNewLines(Base64Utils.encodeToString(cert.getEncoded()))).append(end).append("\n");
+        }
+        return stringBuilder.toString();
+    }
+
+    public static X509Certificate readCertFile(String fileContent) {
+        X509Certificate certificate = null;
+        try {
+            if (fileContent != null && !fileContent.trim().isEmpty()) {
+                fileContent = fileContent.replace("-----BEGIN CERTIFICATE-----", "")
+                        .replace("-----END CERTIFICATE-----", "")
+                        .replaceAll("\\s", "");
+                byte[] decoded = Base64.decodeBase64(fileContent);
+                CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+                try (InputStream inStream = new ByteArrayInputStream(decoded)) {
+                    certificate = (X509Certificate) certFactory.generateCertificate(inStream);
+                }
+            }
+        } catch (Exception ignored) {}
+        return certificate;
+    }
+
+    public static String parseCommonName(X509Certificate certificate) {
+        X500Name x500name;
+        try {
+            x500name = new JcaX509CertificateHolder(certificate).getSubject();
+        } catch (CertificateEncodingException e) {
+            log.warn("Cannot parse CN from device certificate");
+            throw new RuntimeException(e);
+        }
+        RDN cn = x500name.getRDNs(BCStyle.CN)[0];
+        return IETFUtils.valueToString(cn.getFirst().getValue());
+    }
 }

dao/src/main/java/org/thingsboard/server/dao/attributes/AttributeUtils.java

@@ -19,6 +19,9 @@ import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.kv.AttributeKvEntry;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
 import org.thingsboard.server.dao.service.Validator;
+import org.thingsboard.server.dao.util.KvUtils;
+
+import java.util.List;
 
 public class AttributeUtils {
 
@@ -27,10 +30,13 @@ public class AttributeUtils {
         Validator.validateString(scope, "Incorrect scope " + scope);
     }
 
-    public static void validate(AttributeKvEntry kvEntry) {
+    public static void validate(List<AttributeKvEntry> kvEntries, boolean validateNoxss) {
-        if (kvEntry == null) {
+        kvEntries.forEach(kv -> validate(kv, validateNoxss));
-            throw new IncorrectParameterException("Key value entry can't be null");
+    }
-        } else if (kvEntry.getDataType() == null) {
+
+    public static void validate(AttributeKvEntry kvEntry, boolean validateNoxss) {
+        KvUtils.validate(kvEntry, validateNoxss);
+        if (kvEntry.getDataType() == null) {
             throw new IncorrectParameterException("Incorrect kvEntry. Data type can't be null");
         } else {
             Validator.validateString(kvEntry.getKey(), "Incorrect kvEntry. Key can't be empty");

dao/src/main/java/org/thingsboard/server/dao/attributes/BaseAttributesService.java

@@ -18,6 +18,7 @@ package org.thingsboard.server.dao.attributes;
 import com.google.common.util.concurrent.Futures;
 import com.google.common.util.concurrent.ListenableFuture;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.context.annotation.Primary;
 import org.springframework.stereotype.Service;
@@ -45,6 +46,9 @@ import static org.thingsboard.server.dao.attributes.AttributeUtils.validate;
 public class BaseAttributesService implements AttributesService {
     private final AttributesDao attributesDao;
 
+    @Value("${sql.attributes.noxss_validation_enabled:true}")
+    private boolean noxssValidationEnabled;
+
     public BaseAttributesService(AttributesDao attributesDao) {
         this.attributesDao = attributesDao;
     }
@@ -82,14 +86,14 @@ public class BaseAttributesService implements AttributesService {
     @Override
     public ListenableFuture<String> save(TenantId tenantId, EntityId entityId, String scope, AttributeKvEntry attribute) {
         validate(entityId, scope);
-        AttributeUtils.validate(attribute);
+        AttributeUtils.validate(attribute, noxssValidationEnabled);
         return attributesDao.save(tenantId, entityId, scope, attribute);
     }
 
     @Override
     public ListenableFuture<List<String>> save(TenantId tenantId, EntityId entityId, String scope, List<AttributeKvEntry> attributes) {
         validate(entityId, scope);
-        attributes.forEach(AttributeUtils::validate);
+        AttributeUtils.validate(attributes, noxssValidationEnabled);
         List<ListenableFuture<String>> saveFutures = attributes.stream().map(attribute -> attributesDao.save(tenantId, entityId, scope, attribute)).collect(Collectors.toList());
         return Futures.allAsList(saveFutures);
     }

dao/src/main/java/org/thingsboard/server/dao/attributes/CachedAttributesService.java

@@ -70,6 +70,9 @@ public class CachedAttributesService implements AttributesService {
     @Value("${cache.type:caffeine}")
     private String cacheType;
 
+    @Value("${sql.attributes.noxss_validation_enabled:true}")
+    private boolean noxssValidationEnabled;
+
     public CachedAttributesService(AttributesDao attributesDao,
                                    StatsFactory statsFactory,
                                    CacheExecutorService cacheExecutorService,
@@ -134,7 +137,7 @@ public class CachedAttributesService implements AttributesService {
     @Override
     public ListenableFuture<List<AttributeKvEntry>> find(TenantId tenantId, EntityId entityId, String scope, Collection<String> attributeKeys) {
         validate(entityId, scope);
-        attributeKeys =  new LinkedHashSet<>(attributeKeys); // deduplicate the attributes
+        attributeKeys = new LinkedHashSet<>(attributeKeys); // deduplicate the attributes
         attributeKeys.forEach(attributeKey -> Validator.validateString(attributeKey, "Incorrect attribute key " + attributeKey));
 
         Map<String, TbCacheValueWrapper<AttributeKvEntry>> wrappedCachedAttributes = findCachedAttributes(entityId, scope, attributeKeys);
@@ -212,7 +215,7 @@ public class CachedAttributesService implements AttributesService {
     @Override
     public ListenableFuture<String> save(TenantId tenantId, EntityId entityId, String scope, AttributeKvEntry attribute) {
         validate(entityId, scope);
-        AttributeUtils.validate(attribute);
+        AttributeUtils.validate(attribute, noxssValidationEnabled);
         ListenableFuture<String> future = attributesDao.save(tenantId, entityId, scope, attribute);
         return Futures.transform(future, key -> evict(entityId, scope, attribute, key), cacheExecutor);
     }
@@ -220,7 +223,7 @@ public class CachedAttributesService implements AttributesService {
     @Override
     public ListenableFuture<List<String>> save(TenantId tenantId, EntityId entityId, String scope, List<AttributeKvEntry> attributes) {
         validate(entityId, scope);
-        attributes.forEach(AttributeUtils::validate);
+        AttributeUtils.validate(attributes, noxssValidationEnabled);
 
         List<ListenableFuture<String>> futures = new ArrayList<>(attributes.size());
         for (var attribute : attributes) {

dao/src/main/java/org/thingsboard/server/dao/device/DeviceCredentialsServiceImpl.java

@@ -16,15 +16,12 @@
 package org.thingsboard.server.dao.device;
 
 import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.node.ObjectNode;
 import lombok.extern.slf4j.Slf4j;
 import org.eclipse.leshan.core.SecurityMode;
 import org.eclipse.leshan.core.util.SecurityUtil;
 import org.hibernate.exception.ConstraintViolationException;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Propagation;
-import org.springframework.transaction.annotation.Transactional;
 import org.springframework.transaction.event.TransactionalEventListener;
 import org.thingsboard.common.util.JacksonUtil;
 import org.thingsboard.server.common.data.StringUtils;

dao/src/main/java/org/thingsboard/server/dao/device/DeviceProfileCacheKey.java

@@ -16,6 +16,7 @@
 package org.thingsboard.server.dao.device;
 
 import lombok.Data;
+import org.thingsboard.server.common.data.StringUtils;
 import org.thingsboard.server.common.data.id.DeviceProfileId;
 import org.thingsboard.server.common.data.id.TenantId;
 
@@ -30,34 +31,44 @@ public class DeviceProfileCacheKey implements Serializable {
     private final String name;
     private final DeviceProfileId deviceProfileId;
     private final boolean defaultProfile;
+    private final String provisionDeviceKey;
 
-    private DeviceProfileCacheKey(TenantId tenantId, String name, DeviceProfileId deviceProfileId, boolean defaultProfile) {
+    private DeviceProfileCacheKey(TenantId tenantId, String name, DeviceProfileId deviceProfileId, boolean defaultProfile, String provisionDeviceKey) {
         this.tenantId = tenantId;
         this.name = name;
         this.deviceProfileId = deviceProfileId;
         this.defaultProfile = defaultProfile;
+        this.provisionDeviceKey = provisionDeviceKey;
     }
 
     public static DeviceProfileCacheKey fromName(TenantId tenantId, String name) {
-        return new DeviceProfileCacheKey(tenantId, name, null, false);
+        return new DeviceProfileCacheKey(tenantId, name, null, false, null);
     }
 
     public static DeviceProfileCacheKey fromId(DeviceProfileId id) {
-        return new DeviceProfileCacheKey(null, null, id, false);
+        return new DeviceProfileCacheKey(null, null, id, false, null);
     }
 
     public static DeviceProfileCacheKey defaultProfile(TenantId tenantId) {
-        return new DeviceProfileCacheKey(tenantId, null, null, true);
+        return new DeviceProfileCacheKey(tenantId, null, null, true, null);
     }
 
+    public static DeviceProfileCacheKey fromProvisionDeviceKey(String provisionDeviceKey) {
+        return new DeviceProfileCacheKey(null, null, null, false, provisionDeviceKey);
+    }
+
+    /**
+     * IMPORTANT: Method toString() has to return unique value, if you add additional field to this class, please also refactor toString().
+     */
     @Override
     public String toString() {
         if (deviceProfileId != null) {
             return deviceProfileId.toString();
         } else if (defaultProfile) {
             return tenantId.toString();
-        } else {
+        } else if (StringUtils.isNotEmpty(provisionDeviceKey)) {
-            return tenantId + "_" + name;
+            return provisionDeviceKey;
         }
+        return tenantId + "_" + name;
     }
 }

dao/src/main/java/org/thingsboard/server/dao/device/DeviceProfileEvictEvent.java

@@ -27,5 +27,6 @@ public class DeviceProfileEvictEvent {
     private final String oldName;
     private final DeviceProfileId deviceProfileId;
     private final boolean defaultProfile;
+    private final String provisionDeviceKey;
 
 }

dao/src/main/java/org/thingsboard/server/dao/device/DeviceProfileServiceImpl.java

@@ -34,12 +34,14 @@ import org.thingsboard.server.common.data.device.profile.DefaultDeviceProfileCon
 import org.thingsboard.server.common.data.device.profile.DefaultDeviceProfileTransportConfiguration;
 import org.thingsboard.server.common.data.device.profile.DeviceProfileData;
 import org.thingsboard.server.common.data.device.profile.DisabledDeviceProfileProvisionConfiguration;
+import org.thingsboard.server.common.data.device.profile.X509CertificateChainProvisionConfiguration;
 import org.thingsboard.server.common.data.id.DeviceProfileId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.HasId;
 import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.page.PageData;
 import org.thingsboard.server.common.data.page.PageLink;
+import org.thingsboard.server.common.msg.EncryptionUtil;
 import org.thingsboard.server.dao.entity.AbstractCachedEntityService;
 import org.thingsboard.server.dao.exception.DataValidationException;
 import org.thingsboard.server.dao.queue.QueueService;
@@ -47,12 +49,19 @@ import org.thingsboard.server.dao.service.DataValidator;
 import org.thingsboard.server.dao.service.PaginatedRemover;
 import org.thingsboard.server.dao.service.Validator;
 
+import java.io.ByteArrayInputStream;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateException;
+import java.security.cert.CertificateFactory;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import static org.thingsboard.server.dao.service.Validator.validateId;
+import static org.thingsboard.server.dao.service.Validator.validateString;
 
 @Service("DeviceProfileDaoService")
 @Slf4j
@@ -61,6 +70,7 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
     private static final String INCORRECT_TENANT_ID = "Incorrect tenantId ";
     private static final String INCORRECT_DEVICE_PROFILE_ID = "Incorrect deviceProfileId ";
     private static final String INCORRECT_DEVICE_PROFILE_NAME = "Incorrect deviceProfileName ";
+    private static final String INCORRECT_PROVISION_DEVICE_KEY = "Incorrect provisionDeviceKey ";
     private static final String DEVICE_PROFILE_WITH_SUCH_NAME_ALREADY_EXISTS = "Device profile with such name already exists!";
 
     @Autowired
@@ -93,13 +103,16 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
         if (StringUtils.isNotEmpty(event.getOldName()) && !event.getOldName().equals(event.getNewName())) {
             keys.add(DeviceProfileCacheKey.fromName(event.getTenantId(), event.getOldName()));
         }
+        if (StringUtils.isNotEmpty(event.getProvisionDeviceKey())) {
+            keys.add(DeviceProfileCacheKey.fromProvisionDeviceKey(event.getProvisionDeviceKey()));
+        }
         cache.evict(keys);
     }
 
     @Override
     public DeviceProfile findDeviceProfileById(TenantId tenantId, DeviceProfileId deviceProfileId) {
         log.trace("Executing findDeviceProfileById [{}]", deviceProfileId);
-        Validator.validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
+        validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
         return cache.getAndPutInTransaction(DeviceProfileCacheKey.fromId(deviceProfileId),
                 () -> deviceProfileDao.findById(tenantId, deviceProfileId.getId()), true);
     }
@@ -107,30 +120,46 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
     @Override
     public DeviceProfile findDeviceProfileByName(TenantId tenantId, String profileName) {
         log.trace("Executing findDeviceProfileByName [{}][{}]", tenantId, profileName);
-        Validator.validateString(profileName, INCORRECT_DEVICE_PROFILE_NAME + profileName);
+        validateString(profileName, INCORRECT_DEVICE_PROFILE_NAME + profileName);
         return cache.getAndPutInTransaction(DeviceProfileCacheKey.fromName(tenantId, profileName),
                 () -> deviceProfileDao.findByName(tenantId, profileName), true);
     }
 
+    @Override
+    public DeviceProfile findDeviceProfileByProvisionDeviceKey(String provisionDeviceKey) {
+        log.trace("Executing findDeviceProfileByProvisionDeviceKey provisionKey [{}]", provisionDeviceKey);
+        validateString(provisionDeviceKey, INCORRECT_PROVISION_DEVICE_KEY + provisionDeviceKey);
+        return cache.getAndPutInTransaction(DeviceProfileCacheKey.fromProvisionDeviceKey(provisionDeviceKey),
+                () -> deviceProfileDao.findByProvisionDeviceKey(provisionDeviceKey), false);
+    }
+
     @Override
     public DeviceProfileInfo findDeviceProfileInfoById(TenantId tenantId, DeviceProfileId deviceProfileId) {
         log.trace("Executing findDeviceProfileById [{}]", deviceProfileId);
-        Validator.validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
+        validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
         return toDeviceProfileInfo(findDeviceProfileById(tenantId, deviceProfileId));
     }
 
     @Override
     public DeviceProfile saveDeviceProfile(DeviceProfile deviceProfile) {
         log.trace("Executing saveDeviceProfile [{}]", deviceProfile);
+        if (deviceProfile.getProfileData() != null && deviceProfile.getProfileData().getProvisionConfiguration() instanceof X509CertificateChainProvisionConfiguration) {
+            X509CertificateChainProvisionConfiguration x509Configuration = (X509CertificateChainProvisionConfiguration) deviceProfile.getProfileData().getProvisionConfiguration();
+            if (x509Configuration.getProvisionDeviceSecret() != null) {
+                formatDeviceProfileCertificate(deviceProfile, x509Configuration);
+            }
+        }
         DeviceProfile oldDeviceProfile = deviceProfileValidator.validate(deviceProfile, DeviceProfile::getTenantId);
         DeviceProfile savedDeviceProfile;
         try {
             savedDeviceProfile = deviceProfileDao.saveAndFlush(deviceProfile.getTenantId(), deviceProfile);
             publishEvictEvent(new DeviceProfileEvictEvent(savedDeviceProfile.getTenantId(), savedDeviceProfile.getName(),
-                    oldDeviceProfile != null ? oldDeviceProfile.getName() : null, savedDeviceProfile.getId(), savedDeviceProfile.isDefault()));
+                    oldDeviceProfile != null ? oldDeviceProfile.getName() : null, savedDeviceProfile.getId(), savedDeviceProfile.isDefault(),
+                    oldDeviceProfile != null ? oldDeviceProfile.getProvisionDeviceKey() : null));
         } catch (Exception t) {
             handleEvictEvent(new DeviceProfileEvictEvent(deviceProfile.getTenantId(), deviceProfile.getName(),
-                    oldDeviceProfile != null ? oldDeviceProfile.getName() : null, null, deviceProfile.isDefault()));
+                    oldDeviceProfile != null ? oldDeviceProfile.getName() : null, null, deviceProfile.isDefault(),
+                    oldDeviceProfile != null ? oldDeviceProfile.getProvisionDeviceKey() : null));
             checkConstraintViolation(t,
                     Map.of("device_profile_name_unq_key", DEVICE_PROFILE_WITH_SUCH_NAME_ALREADY_EXISTS,
                             "device_provision_key_unq_key", "Device profile with such provision device key already exists!",
@@ -156,7 +185,7 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
     @Transactional
     public void deleteDeviceProfile(TenantId tenantId, DeviceProfileId deviceProfileId) {
         log.trace("Executing deleteDeviceProfile [{}]", deviceProfileId);
-        Validator.validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
+        validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
         DeviceProfile deviceProfile = deviceProfileDao.findById(tenantId, deviceProfileId.getId());
         if (deviceProfile != null && deviceProfile.isDefault()) {
             throw new DataValidationException("Deletion of Default Device Profile is prohibited!");
@@ -170,7 +199,8 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
             deleteEntityRelations(tenantId, deviceProfileId);
             deviceProfileDao.removeById(tenantId, deviceProfileId.getId());
             publishEvictEvent(new DeviceProfileEvictEvent(deviceProfile.getTenantId(), deviceProfile.getName(),
-                    null, deviceProfile.getId(), deviceProfile.isDefault()));
+                    null, deviceProfile.getId(), deviceProfile.isDefault(),
+                    deviceProfile.getProvisionDeviceKey()));
         } catch (Exception t) {
             ConstraintViolationException e = extractConstraintViolationException(t).orElse(null);
             if (e != null && e.getConstraintName() != null && e.getConstraintName().equalsIgnoreCase("fk_device_profile")) {
@@ -260,7 +290,7 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
     @Override
     public boolean setDefaultDeviceProfile(TenantId tenantId, DeviceProfileId deviceProfileId) {
         log.trace("Executing setDefaultDeviceProfile [{}]", deviceProfileId);
-        Validator.validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
+        validateId(deviceProfileId, INCORRECT_DEVICE_PROFILE_ID + deviceProfileId);
         DeviceProfile deviceProfile = deviceProfileDao.findById(tenantId, deviceProfileId.getId());
         if (!deviceProfile.isDefault()) {
             deviceProfile.setDefault(true);
@@ -268,14 +298,14 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
             boolean changed = false;
             if (previousDefaultDeviceProfile == null) {
                 deviceProfileDao.save(tenantId, deviceProfile);
-                publishEvictEvent(new DeviceProfileEvictEvent(deviceProfile.getTenantId(), deviceProfile.getName(), null, deviceProfile.getId(), true));
+                publishEvictEvent(new DeviceProfileEvictEvent(deviceProfile.getTenantId(), deviceProfile.getName(), null, deviceProfile.getId(), true, deviceProfile.getProvisionDeviceKey()));
                 changed = true;
             } else if (!previousDefaultDeviceProfile.getId().equals(deviceProfile.getId())) {
                 previousDefaultDeviceProfile.setDefault(false);
                 deviceProfileDao.save(tenantId, previousDefaultDeviceProfile);
                 deviceProfileDao.save(tenantId, deviceProfile);
-                publishEvictEvent(new DeviceProfileEvictEvent(previousDefaultDeviceProfile.getTenantId(), previousDefaultDeviceProfile.getName(), null, previousDefaultDeviceProfile.getId(), false));
+                publishEvictEvent(new DeviceProfileEvictEvent(previousDefaultDeviceProfile.getTenantId(), previousDefaultDeviceProfile.getName(), null, previousDefaultDeviceProfile.getId(), false, deviceProfile.getProvisionDeviceKey()));
-                publishEvictEvent(new DeviceProfileEvictEvent(deviceProfile.getTenantId(), deviceProfile.getName(), null, deviceProfile.getId(), true));
+                publishEvictEvent(new DeviceProfileEvictEvent(deviceProfile.getTenantId(), deviceProfile.getName(), null, deviceProfile.getId(), true, deviceProfile.getProvisionDeviceKey()));
                 changed = true;
             }
             return changed;
@@ -319,4 +349,38 @@ public class DeviceProfileServiceImpl extends AbstractCachedEntityService<Device
                 profile.getDefaultDashboardId(), profile.getType(), profile.getTransportType());
     }
 
+    private void formatDeviceProfileCertificate(DeviceProfile deviceProfile, X509CertificateChainProvisionConfiguration x509Configuration) {
+        String formattedCertificateValue = formatCertificateValue(x509Configuration.getProvisionDeviceSecret());
+        String cert = fetchLeafCertificateFromChain(formattedCertificateValue);
+        String sha3Hash = EncryptionUtil.getSha3Hash(cert);
+        DeviceProfileData deviceProfileData = deviceProfile.getProfileData();
+        x509Configuration.setProvisionDeviceSecret(formattedCertificateValue);
+        deviceProfileData.setProvisionConfiguration(x509Configuration);
+        deviceProfile.setProfileData(deviceProfileData);
+        deviceProfile.setProvisionDeviceKey(sha3Hash);
+    }
+
+    private String fetchLeafCertificateFromChain(String value) {
+        String regex = "-----BEGIN CERTIFICATE-----\\s*.*?\\s*-----END CERTIFICATE-----";
+        Pattern pattern = Pattern.compile(regex);
+        Matcher matcher = pattern.matcher(value);
+        if (matcher.find()) {
+            // if the method receives a chain it fetches the leaf (end-entity) certificate, else if it gets a single certificate, it returns the single certificate
+            return matcher.group(0);
+        }
+        return value;
+    }
+
+    private String formatCertificateValue(String certificateValue) {
+        try {
+            CertificateFactory cf = CertificateFactory.getInstance("X.509");
+            ByteArrayInputStream inputStream = new ByteArrayInputStream(certificateValue.getBytes());
+            Certificate[] certificates = cf.generateCertificates(inputStream).toArray(new Certificate[0]);
+            if (certificates.length > 1) {
+                return EncryptionUtil.certTrimNewLinesForChainInDeviceProfile(certificateValue);
+            }
+        } catch (CertificateException ignored) {}
+        return EncryptionUtil.certTrimNewLines(certificateValue);
+    }
+
 }

dao/src/main/java/org/thingsboard/server/dao/notification/DefaultNotificationSettingsService.java

@@ -170,8 +170,7 @@ public class DefaultNotificationSettingsService implements NotificationSettingsS
         newAlarmRuleTriggerConfig.setAlarmSeverities(null);
         newAlarmRuleTriggerConfig.setNotifyOn(Set.of(AlarmAction.CREATED));
         createRule(tenantId, "New alarm", newAlarmNotificationTemplate.getId(), newAlarmRuleTriggerConfig,
-                List.of(tenantAdmins.getId(), originatorEntityOwnerUsers.getId()), "Send notification to tenant admins and alarm's customer users " +
+                List.of(tenantAdmins.getId()), "Send notification to tenant admins when an alarm is created");
-                        "when an alarm is created");
 
         NotificationTemplate alarmUpdateNotificationTemplate = createTemplate(tenantId, "Alarm update notification", NotificationType.ALARM,
                 "Alarm '${alarmType}' - ${action}",
@@ -182,8 +181,7 @@ public class DefaultNotificationSettingsService implements NotificationSettingsS
         alarmRuleTriggerConfig.setAlarmSeverities(null);
         alarmRuleTriggerConfig.setNotifyOn(Set.of(AlarmAction.SEVERITY_CHANGED, AlarmAction.ACKNOWLEDGED, AlarmAction.CLEARED));
         createRule(tenantId, "Alarm update", alarmUpdateNotificationTemplate.getId(), alarmRuleTriggerConfig,
-                List.of(tenantAdmins.getId(), originatorEntityOwnerUsers.getId()), "Send notification to tenant admins and alarm's customer users " +
+                List.of(tenantAdmins.getId()), "Send notification to tenant admins when any alarm is updated or cleared");
-                        "when any alarm is updated or cleared");
 
         NotificationTemplate deviceActionNotificationTemplate = createTemplate(tenantId, "Device action notification", NotificationType.ENTITY_ACTION,
                 "${entityType} was ${actionType}",
@@ -195,8 +193,7 @@ public class DefaultNotificationSettingsService implements NotificationSettingsS
         deviceActionRuleTriggerConfig.setUpdated(false);
         deviceActionRuleTriggerConfig.setDeleted(false);
         createRule(tenantId, "Device created", deviceActionNotificationTemplate.getId(), deviceActionRuleTriggerConfig,
-                List.of(originatorEntityOwnerUsers.getId()), "Send notification to tenant admins or customer users " +
+                List.of(tenantAdmins.getId()), "Send notification to tenant admins when device is created");
-                        "when device is created");
 
         NotificationTemplate deviceActivityNotificationTemplate = createTemplate(tenantId, "Device activity notification", NotificationType.DEVICE_ACTIVITY,
                 "Device '${deviceName}' became ${eventType}",
@@ -207,8 +204,7 @@ public class DefaultNotificationSettingsService implements NotificationSettingsS
         deviceActivityRuleTriggerConfig.setDeviceProfiles(null);
         deviceActivityRuleTriggerConfig.setNotifyOn(Set.of(DeviceEvent.ACTIVE, DeviceEvent.INACTIVE));
         createRule(tenantId, "Device activity status change", deviceActivityNotificationTemplate.getId(), deviceActivityRuleTriggerConfig,
-                List.of(originatorEntityOwnerUsers.getId()), "Send notification to tenant admins or customer users " +
+                List.of(tenantAdmins.getId()), "Send notification to tenant admins when any device changes its activity state");
-                        "when any device changes its activity state");
 
         NotificationTemplate alarmCommentNotificationTemplate = createTemplate(tenantId, "Alarm comment notification", NotificationType.ALARM_COMMENT,
                 "Comment on '${alarmType}' alarm",
@@ -221,8 +217,7 @@ public class DefaultNotificationSettingsService implements NotificationSettingsS
         alarmCommentRuleTriggerConfig.setOnlyUserComments(true);
         alarmCommentRuleTriggerConfig.setNotifyOnCommentUpdate(false);
         createRule(tenantId, "Comment on active alarm", alarmCommentNotificationTemplate.getId(), alarmCommentRuleTriggerConfig,
-                List.of(originatorEntityOwnerUsers.getId()), "Send notification to tenant admins or customer users " +
+                List.of(tenantAdmins.getId()), "Send notification to tenant admins when comment is added by user on active alarm");
-                        "when comment is added by user on active alarm");
 
         NotificationTemplate alarmAssignedNotificationTemplate = createTemplate(tenantId, "Alarm assigned notification", NotificationType.ALARM_ASSIGNMENT,
                 "Alarm '${alarmType}' (${alarmSeverity}) was assigned to user",

dao/src/main/java/org/thingsboard/server/dao/service/ConstraintValidator.java

@@ -17,6 +17,7 @@ package org.thingsboard.server.dao.service;
 
 import com.google.common.collect.Iterators;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.hibernate.validator.HibernateValidator;
 import org.hibernate.validator.HibernateValidatorConfiguration;
 import org.hibernate.validator.cfg.ConstraintMapping;
@@ -29,11 +30,13 @@ import org.thingsboard.server.common.data.validation.Length;
 import org.thingsboard.server.common.data.validation.NoXss;
 import org.thingsboard.server.dao.exception.DataValidationException;
 
-import javax.validation.Path;
+import javax.validation.ConstraintViolation;
 import javax.validation.Validation;
 import javax.validation.Validator;
 import javax.validation.constraints.AssertTrue;
-import java.util.List;
+import javax.validation.metadata.ConstraintDescriptor;
+import java.util.Collection;
+import java.util.Set;
 import java.util.stream.Collectors;
 
 @Slf4j
@@ -51,26 +54,31 @@ public class ConstraintValidator {
     }
 
     public static void validateFields(Object data, String errorPrefix) {
-        List<String> constraintsViolations = getConstraintsViolations(data);
+        Set<ConstraintViolation<Object>> constraintsViolations = fieldsValidator.validate(data);
         if (!constraintsViolations.isEmpty()) {
-            throw new DataValidationException(errorPrefix + String.join(", ", constraintsViolations));
+            throw new DataValidationException(errorPrefix + getErrorMessage(constraintsViolations));
         }
     }
 
-    public static List<String> getConstraintsViolations(Object data) {
+    public static String getErrorMessage(Collection<ConstraintViolation<Object>> constraintsViolations) {
-        return fieldsValidator.validate(data).stream()
+        return constraintsViolations.stream()
-                .map(constraintViolation -> {
+                .map(ConstraintValidator::getErrorMessage)
-                    String property;
+                .distinct().sorted().collect(Collectors.joining(", "));
-                    if (constraintViolation.getConstraintDescriptor().getAttributes().containsKey("fieldName")) {
+    }
-                        property = constraintViolation.getConstraintDescriptor().getAttributes().get("fieldName").toString();
+
-                    } else {
+    public static String getErrorMessage(ConstraintViolation<Object> constraintViolation) {
-                        Path propertyPath = constraintViolation.getPropertyPath();
+        ConstraintDescriptor<?> constraintDescriptor = constraintViolation.getConstraintDescriptor();
-                        property = Iterators.getLast(propertyPath.iterator()).toString();
+        String property = (String) constraintDescriptor.getAttributes().get("fieldName");
-                    }
+        if (StringUtils.isEmpty(property) && !(constraintDescriptor.getAnnotation() instanceof AssertTrue)) {
-                    return property + " " + constraintViolation.getMessage();
+            property = Iterators.getLast(constraintViolation.getPropertyPath().iterator()).toString();
-                })
+        }
-                .distinct()
+
-                .collect(Collectors.toList());
+        String error = "";
+        if (StringUtils.isNotEmpty(property)) {
+            error += property + " ";
+        }
+        error += constraintViolation.getMessage();
+        return error;
     }
 
     private static void initializeValidators() {

dao/src/main/java/org/thingsboard/server/dao/service/validator/DeviceProfileDataValidator.java

@@ -17,10 +17,13 @@ package org.thingsboard.server.dao.service.validator;
 
 import com.google.protobuf.Descriptors;
 import com.google.protobuf.DynamicMessage;
+import lombok.extern.slf4j.Slf4j;
 import org.eclipse.leshan.core.util.SecurityUtil;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.stereotype.Component;
+import org.springframework.util.Base64Utils;
 import org.springframework.util.CollectionUtils;
 import org.thingsboard.server.common.data.DashboardInfo;
 import org.thingsboard.server.common.data.DeviceProfile;
@@ -55,10 +58,22 @@ import org.thingsboard.server.dao.queue.QueueService;
 import org.thingsboard.server.dao.rule.RuleChainService;
 import org.thingsboard.server.dao.tenant.TenantService;
 
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.security.InvalidAlgorithmParameterException;
+import java.security.KeyStore;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateEncodingException;
+import java.security.cert.CertificateException;
+import java.security.cert.PKIXParameters;
+import java.security.cert.TrustAnchor;
+import java.security.cert.X509Certificate;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
+@Slf4j
 @Component
 public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<DeviceProfile> {
 
@@ -85,6 +100,12 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
     @Autowired
     private DashboardService dashboardService;
 
+    @Value("${security.java_cacerts.path:}")
+    private String javaCacertsPath;
+
+    @Value("${security.java_cacerts.password:}")
+    private String javaCacertsPassword;
+
     @Override
     protected void validateDataImpl(TenantId tenantId, DeviceProfile deviceProfile) {
         if (StringUtils.isEmpty(deviceProfile.getName())) {
@@ -118,6 +139,11 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
         if (deviceProfile.getProvisionType() == null) {
             deviceProfile.setProvisionType(DeviceProfileProvisionType.DISABLED);
         }
+        if (deviceProfile.getProvisionDeviceKey() != null && DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN.equals(deviceProfile.getProvisionType())) {
+            if (isDeviceProfileCertificateInJavaCacerts(deviceProfile.getProfileData().getProvisionConfiguration().getProvisionDeviceSecret())) {
+                throw new DataValidationException("Device profile certificate cannot be well known root CA!");
+            }
+        }
         DeviceProfileTransportConfiguration transportConfiguration = deviceProfile.getProfileData().getTransportConfiguration();
         transportConfiguration.validate();
         if (transportConfiguration instanceof MqttDeviceProfileTransportConfiguration) {
@@ -211,6 +237,11 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
                 throw new DataValidationException(message);
             }
         }
+        if (deviceProfile.getProvisionDeviceKey() != null && DeviceProfileProvisionType.X509_CERTIFICATE_CHAIN.equals(deviceProfile.getProvisionType())) {
+            if (isDeviceProfileCertificateInJavaCacerts(deviceProfile.getProvisionDeviceKey())) {
+                throw new DataValidationException("Device profile certificate cannot be well known root CA!");
+            }
+        }
         return old;
     }
 
@@ -314,13 +345,13 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
             if (!uris.add(uri)) {
                 throw new DeviceCredentialsValidationException(server + " \"Host + port\" value = " + uri + ". This value must be a unique value for all servers!");
             }
-            Integer port;
+            int port;
             if (LwM2MSecurityMode.NO_SEC.equals(serverConfig.getSecurityMode())) {
                 port = serverConfig.isBootstrapServerIs() ? 5687 : 5685;
             } else {
                 port = serverConfig.isBootstrapServerIs() ? 5688 : 5686;
             }
-            if (serverConfig.getPort() == null || serverConfig.getPort().intValue() != port) {
+            if (serverConfig.getPort() == null || serverConfig.getPort() != port) {
                 throw new DeviceCredentialsValidationException(server + " \"Port\" value = " + serverConfig.getPort() + ". This value for security " + serverConfig.getSecurityMode().name() + " must be " + port + "!");
             }
         }
@@ -363,4 +394,27 @@ public class DeviceProfileDataValidator extends AbstractHasOtaPackageValidator<D
                 break;
         }
     }
+
+    private boolean isDeviceProfileCertificateInJavaCacerts(String deviceProfileX509Secret) {
+        try {
+            FileInputStream is = new FileInputStream(javaCacertsPath);
+            KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
+            keystore.load(is, javaCacertsPassword.toCharArray());
+
+            PKIXParameters params = new PKIXParameters(keystore);
+            for (TrustAnchor ta : params.getTrustAnchors()) {
+                X509Certificate cert = ta.getTrustedCert();
+                if (getCertificateString(cert).equals(deviceProfileX509Secret)) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            log.trace("Failed to validate certificate due to: ", e);
+        }
+        return false;
+    }
+
+    private String getCertificateString(X509Certificate cert) throws CertificateEncodingException {
+        return EncryptionUtil.certTrimNewLines(Base64Utils.encodeToString(cert.getEncoded()));
+    }
 }

dao/src/main/java/org/thingsboard/server/dao/service/validator/TenantProfileDataValidator.java

@@ -25,6 +25,7 @@ import org.thingsboard.server.common.data.id.TenantId;
 import org.thingsboard.server.common.data.queue.ProcessingStrategy;
 import org.thingsboard.server.common.data.queue.SubmitStrategy;
 import org.thingsboard.server.common.data.queue.SubmitStrategyType;
+import org.thingsboard.server.common.data.tenant.profile.DefaultTenantProfileConfiguration;
 import org.thingsboard.server.common.data.tenant.profile.TenantProfileQueueConfiguration;
 import org.thingsboard.server.dao.exception.DataValidationException;
 import org.thingsboard.server.dao.service.DataValidator;

dao/src/main/java/org/thingsboard/server/dao/sql/alarm/JpaAlarmDao.java

@@ -18,7 +18,6 @@ package org.thingsboard.server.dao.sql.alarm;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.google.common.util.concurrent.ListenableFuture;
 import lombok.extern.slf4j.Slf4j;
-import org.jetbrains.annotations.NotNull;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.jpa.repository.JpaRepository;
@@ -303,7 +302,6 @@ public class JpaAlarmDao extends JpaAbstractDao<AlarmEntity, Alarm> implements A
         return alarmQueryRepository.countAlarmsByQuery(tenantId, customerId, query);
     }
 
-    @NotNull
     private static String getPropagationTypes(AlarmPropagationInfo ap) {
         String propagateRelationTypes;
         if (!CollectionUtils.isEmpty(ap.getPropagateRelationTypes())) {

dao/src/main/java/org/thingsboard/server/dao/sql/edge/JpaBaseEdgeEventDao.java

@@ -80,11 +80,11 @@ public class JpaBaseEdgeEventDao extends JpaAbstractSearchTextDao<EdgeEventEntit
     @Value("${sql.edge_events.stats_print_interval_ms:10000}")
     private long statsPrintIntervalMs;
 
-    @Value("${sql.edge_events.partitions_size:168}")
+    @Value("${sql.edge_events.partition_size:168}")
     private int partitionSizeInHours;
 
     @Value("${sql.ttl.edge_events.edge_events_ttl:2628000}")
-    private long edge_events_ttl;
+    private long edgeEventsTtl;
 
     private static final String TABLE_NAME = ModelConstants.EDGE_EVENT_COLUMN_FAMILY_NAME;
 
@@ -203,7 +203,7 @@ public class JpaBaseEdgeEventDao extends JpaAbstractSearchTextDao<EdgeEventEntit
 
     @Override
     public void migrateEdgeEvents() {
-        long startTime = edge_events_ttl > 0 ? System.currentTimeMillis() - TimeUnit.SECONDS.toMillis(edge_events_ttl) : 1629158400000L;
+        long startTime = edgeEventsTtl > 0 ? System.currentTimeMillis() - TimeUnit.SECONDS.toMillis(edgeEventsTtl) : 1629158400000L;
 
         long currentTime = System.currentTimeMillis();
         var partitionStepInMs = TimeUnit.HOURS.toMillis(partitionSizeInHours);

dao/src/main/java/org/thingsboard/server/dao/timeseries/BaseTimeseriesService.java

@@ -42,6 +42,7 @@ import org.thingsboard.server.common.data.kv.TsKvLatestRemovingResult;
 import org.thingsboard.server.dao.entityview.EntityViewService;
 import org.thingsboard.server.dao.exception.IncorrectParameterException;
 import org.thingsboard.server.dao.service.Validator;
+import org.thingsboard.server.dao.util.KvUtils;
 
 import java.util.Collection;
 import java.util.Collections;
@@ -80,6 +81,9 @@ public class BaseTimeseriesService implements TimeseriesService {
     @Value("${database.ts_max_intervals}")
     private long maxTsIntervals;
 
+    @Value("${sql.ts.noxss_validation_enabled:true}")
+    private boolean noxssValidationEnabled;
+
     @Autowired
     private TimeseriesDao timeseriesDao;
 
@@ -155,10 +159,8 @@ public class BaseTimeseriesService implements TimeseriesService {
 
     @Override
     public ListenableFuture<Integer> save(TenantId tenantId, EntityId entityId, TsKvEntry tsKvEntry) {
+        KvUtils.validate(tsKvEntry, noxssValidationEnabled);
         validate(entityId);
-        if (tsKvEntry == null) {
-            throw new IncorrectParameterException("Key value entry can't be null");
-        }
         List<ListenableFuture<Integer>> futures = Lists.newArrayListWithExpectedSize(INSERTS_PER_ENTRY);
         saveAndRegisterFutures(tenantId, futures, entityId, tsKvEntry, 0L);
         return Futures.transform(Futures.allAsList(futures), SUM_ALL_INTEGERS, MoreExecutors.directExecutor());
@@ -175,12 +177,10 @@ public class BaseTimeseriesService implements TimeseriesService {
     }
 
     private ListenableFuture<Integer> doSave(TenantId tenantId, EntityId entityId, List<TsKvEntry> tsKvEntries, long ttl, boolean saveLatest) {
+        KvUtils.validate(tsKvEntries, noxssValidationEnabled);
         int inserts = saveLatest ? INSERTS_PER_ENTRY : INSERTS_PER_ENTRY_WITHOUT_LATEST;
         List<ListenableFuture<Integer>> futures = Lists.newArrayListWithExpectedSize(tsKvEntries.size() * inserts);
         for (TsKvEntry tsKvEntry : tsKvEntries) {
-            if (tsKvEntry == null) {
-                throw new IncorrectParameterException("Key value entry can't be null");
-            }
             if (saveLatest) {
                 saveAndRegisterFutures(tenantId, futures, entityId, tsKvEntry, ttl);
             } else {
@@ -192,11 +192,9 @@ public class BaseTimeseriesService implements TimeseriesService {
 
     @Override
     public ListenableFuture<List<Void>> saveLatest(TenantId tenantId, EntityId entityId, List<TsKvEntry> tsKvEntries) {
+        KvUtils.validate(tsKvEntries, noxssValidationEnabled);
         List<ListenableFuture<Void>> futures = Lists.newArrayListWithExpectedSize(tsKvEntries.size());
         for (TsKvEntry tsKvEntry : tsKvEntries) {
-            if (tsKvEntry == null) {
-                throw new IncorrectParameterException("Key value entry can't be null");
-            }
             futures.add(timeseriesLatestDao.saveLatest(tenantId, entityId, tsKvEntry));
         }
         return Futures.allAsList(futures);

dao/src/main/java/org/thingsboard/server/dao/util/KvUtils.java

@@ -0,0 +1,37 @@
+/**
+ * Copyright © 2016-2023 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.dao.util;
+
+import org.thingsboard.server.common.data.kv.KvEntry;
+import org.thingsboard.server.dao.exception.IncorrectParameterException;
+import org.thingsboard.server.dao.service.ConstraintValidator;
+
+import java.util.List;
+
+public class KvUtils {
+    public static void validate(List<? extends KvEntry> tsKvEntries, boolean validateNoxss) {
+        tsKvEntries.forEach(kvEntry -> validate(kvEntry, validateNoxss));
+    }
+
+    public static void validate(KvEntry tsKvEntry, boolean validateNoxss) {
+        if (tsKvEntry == null) {
+            throw new IncorrectParameterException("Key value entry can't be null");
+        }
+        if (validateNoxss) {
+            ConstraintValidator.validateFields(tsKvEntry);
+        }
+    }
+}

dao/src/test/java/org/thingsboard/server/dao/service/ConstraintValidatorTest.java

@@ -0,0 +1,57 @@
+/**
+ * Copyright © 2016-2023 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.dao.service;
+
+import org.junit.Assert;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.thingsboard.server.common.data.kv.JsonDataEntry;
+import org.thingsboard.server.common.data.kv.StringDataEntry;
+import org.thingsboard.server.dao.exception.DataValidationException;
+
+class ConstraintValidatorTest {
+
+    private static final int MIN_IN_MS = 60000;
+    private static final int _1M = 1_000_000;
+
+    @Test
+    void validateFields() {
+        StringDataEntry stringDataEntryValid = new StringDataEntry("key", "value");
+
+        StringDataEntry stringDataEntryInvalid1 = new StringDataEntry("<object type=\"text/html\"><script>alert(document)</script></object>", "value");
+        StringDataEntry stringDataEntryInvalid2 = new StringDataEntry("key", "<object type=\"text/html\"><script>alert(document)</script></object>");
+
+        JsonDataEntry jsonDataEntryInvalid = new JsonDataEntry("key", "{\"value\": <object type=\"text/html\"><script>alert(document)</script></object>}");
+
+        Assert.assertThrows(DataValidationException.class, () -> ConstraintValidator.validateFields(stringDataEntryInvalid1));
+        Assert.assertThrows(DataValidationException.class, () -> ConstraintValidator.validateFields(stringDataEntryInvalid2));
+        Assert.assertThrows(DataValidationException.class, () -> ConstraintValidator.validateFields(jsonDataEntryInvalid));
+        ConstraintValidator.validateFields(stringDataEntryValid);
+    }
+
+    @Test
+    void validatePerMinute() {
+        StringDataEntry stringDataEntryValid = new StringDataEntry("key", "value");
+
+        long start = System.currentTimeMillis();
+        for (int i = 0; i < _1M; i++) {
+            ConstraintValidator.validateFields(stringDataEntryValid);
+        }
+        long end = System.currentTimeMillis();
+
+        Assertions.assertTrue(MIN_IN_MS > end - start);
+    }
+}

dao/src/test/resources/application-test.properties

@@ -82,6 +82,8 @@ redis.connection.password=
 security.user_login_case_sensitive=true
 security.claim.allowClaimingByDefault=true
 security.claim.duration=60000
+security.java_cacerts.path=/path/to/cacerts/file
+security.java_cacerts.password=myPassword
 
 database.ts_max_intervals=700
 

msa/black-box-tests/README.md

@@ -54,6 +54,7 @@ As result, in REPOSITORY column, next images should be present:
 
         mvn clean install -DblackBoxTests.skip=false -Dsuite=all 
 
-
+### To run a separate test manually on a built UI:
-
+1. Add the black-box-tests module in the [pom.xml](../pom.xml) or add as a Maven project
-
+2. Add Vm Option "*-DrunLocal=true -Dtb.baseUiUrl=http://localhost:4200/*" in "Run" -> "Edit Configuration" -> "Edit Configuration Templates" -> "TestNG"
+3. To run a specific test, go to the test class in the [UI tests package](../black-box-tests/src/test/java/org/thingsboard/server/msa/ui/tests) and run the test. Alternatively, go to the [resources](../black-box-tests/src/test/resources) in the black-box-tests module and run the test suite that you need.

msa/black-box-tests/src/test/java/org/thingsboard/server/msa/TestProperties.java

@@ -18,10 +18,6 @@ package org.thingsboard.server.msa;
 import lombok.extern.slf4j.Slf4j;
 import org.testcontainers.DockerClientFactory;
 
-import java.io.IOException;
-import java.io.InputStream;
-import java.util.Properties;
-
 @Slf4j
 public class TestProperties {
 
@@ -31,41 +27,26 @@ public class TestProperties {
 
     private static final ContainerTestSuite instance = ContainerTestSuite.getInstance();
 
-    private static Properties properties;
-
     public static String getBaseUrl() {
         if (instance.isActive()) {
             return HTTPS_URL;
         }
-        return getProperties().getProperty("tb.baseUrl");
+        return System.getProperty("tb.baseUrl", "http://localhost:8080");
     }
 
     public static String getBaseUiUrl() {
         if (instance.isActive()) {
-            //return "https://host.docker.internal" // this alternative requires docker-selenium.yml extra_hosts: - "host.docker.internal:host-gateway"
+            //return "https://host.docker.internal"; // this alternative requires docker-selenium.yml extra_hosts: - "host.docker.internal:host-gateway"
             //return "https://" + DockerClientFactory.instance().dockerHostIpAddress(); //this alternative will get Docker IP from testcontainers
             return "https://haproxy"; //communicate inside current docker-compose network to the load balancer container
         }
-        return getProperties().getProperty("tb.baseUiUrl");
+        return System.getProperty("tb.baseUiUrl", "http://localhost:8080");
     }
 
     public static String getWebSocketUrl() {
         if (instance.isActive()) {
             return WSS_URL;
         }
-        return getProperties().getProperty("tb.wsUrl");
+        return System.getProperty("tb.wsUrl", "ws://localhost:8080");
-    }
-
-    private static Properties getProperties() {
-        if (properties == null) {
-            try (InputStream input = TestProperties.class.getClassLoader().getResourceAsStream("config.properties")) {
-                properties = new Properties();
-                properties.load(input);
-            } catch (IOException ex) {
-                log.error("Exception while reading test properties " + ex.getMessage());
-            }
-        }
-        return properties;
     }
-
 }

msa/black-box-tests/src/test/java/org/thingsboard/server/msa/ui/tests/ruleChainsSmoke/RuleChainEditMenuTest.java

@@ -151,12 +151,12 @@ public class RuleChainEditMenuTest extends AbstractDriverBaseTest {
         ruleChainsPage.editPencilBtn().click();
         ruleChainsPage.debugCheckboxEdit().click();
         ruleChainsPage.doneBtnEditView().click();
-        boolean debugMode = Boolean.parseBoolean(ruleChainsPage.debugCheckboxView().getAttribute("aria-checked"));
+        boolean debugMode = ruleChainsPage.debugCheckboxView().getAttribute("class").contains("selected");
         ruleChainsPage.editPencilBtn().click();
         ruleChainsPage.debugCheckboxEdit().click();
         ruleChainsPage.doneBtnEditView().click();
 
-        Assert.assertFalse(Boolean.parseBoolean(ruleChainsPage.debugCheckboxView().getAttribute("aria-checked")));
+        Assert.assertFalse(ruleChainsPage.debugCheckboxView().getAttribute("class").contains("selected"), "Debug mode disable");
-        Assert.assertTrue(debugMode);
+        Assert.assertTrue(debugMode, "Debug mode enable");
     }
 }

msa/black-box-tests/src/test/resources/config.properties

@@ -1,3 +0,0 @@
-tb.baseUrl=http://localhost:8080
-tb.baseUiUrl=http://localhost:8080
-tb.wsUrl=ws://localhost:8080

pom.xml

@@ -39,13 +39,13 @@
         <javax-annotation.version>1.3.2</javax-annotation.version>
         <jakarta.xml.bind-api.version>2.3.2</jakarta.xml.bind-api.version>
         <jaxb-runtime.version>2.3.2</jaxb-runtime.version>
-        <spring-boot.version>2.7.0</spring-boot.version>
+        <spring-boot.version>2.7.10</spring-boot.version>
-        <spring-data.version>2.7.0</spring-data.version>
+        <spring-data.version>2.7.10</spring-data.version>
-        <spring.version>5.3.20</spring.version>
+        <spring.version>5.3.26</spring.version>
-        <spring-redis.version>5.5.12</spring-redis.version>
+        <spring-redis.version>5.5.17</spring-redis.version>
-        <spring-security.version>5.7.1</spring-security.version>
+        <spring-security.version>5.7.7</spring-security.version>
-        <spring-data-redis.version>2.7.0</spring-data-redis.version>
+        <spring-data-redis.version>2.7.10</spring-data-redis.version>
-        <jedis.version>3.7.1</jedis.version>
+        <jedis.version>3.8.0</jedis.version>
         <jjwt.version>0.7.0</jjwt.version>
         <slf4j.version>1.7.32</slf4j.version>
         <log4j.version>2.17.1</log4j.version>
@@ -75,14 +75,14 @@
         <freemarker.version>2.3.30</freemarker.version>
         <mail.version>1.6.2</mail.version>
         <curator.version>4.2.0</curator.version>
-        <zookeeper.version>3.5.5</zookeeper.version>
+        <zookeeper.version>3.8.1</zookeeper.version>
         <protobuf.version>3.21.9</protobuf.version>
         <grpc.version>1.42.1</grpc.version>
         <tbel.version>1.0.6</tbel.version>
         <lombok.version>1.18.18</lombok.version>
         <paho.client.version>1.2.4</paho.client.version>
         <paho.mqttv5.client.version>1.2.5</paho.mqttv5.client.version>
-        <netty.version>4.1.75.Final</netty.version>
+        <netty.version>4.1.91.Final</netty.version>
         <netty-tcnative.version>2.0.51.Final</netty-tcnative.version>
         <os-maven-plugin.version>1.7.0</os-maven-plugin.version>
         <rabbitmq.version>4.8.0</rabbitmq.version>
@@ -107,13 +107,13 @@
         <bucket4j.version>4.1.1</bucket4j.version>
         <fst.version>2.57</fst.version>
         <antlr.version>2.7.7</antlr.version>
-        <snakeyaml.version>1.27</snakeyaml.version>
+        <snakeyaml.version>2.0</snakeyaml.version>
         <aws.sdk.version>1.11.747</aws.sdk.version>
         <pubsub.client.version>1.105.0</pubsub.client.version>
         <google.common.protos.version>2.1.0</google.common.protos.version> <!-- required by io.grpc:grpc-protobuf:1.38.0-->
         <azure-servicebus.version>3.2.0</azure-servicebus.version>
         <passay.version>1.5.0</passay.version>
-        <ua-parser.version>1.4.3</ua-parser.version>
+        <ua-parser.version>1.5.4</ua-parser.version>
         <commons-beanutils.version>1.9.4</commons-beanutils.version>
         <commons-collections.version>3.2.2</commons-collections.version>
         <micrometer.version>1.9.0</micrometer.version>
@@ -123,7 +123,7 @@
         <hibernate-validator.version>6.0.20.Final</hibernate-validator.version>
         <javax.el.version>3.0.0</javax.el.version>
         <javax.validation-api.version>2.0.1.Final</javax.validation-api.version>
-        <antisamy.version>1.6.8</antisamy.version>
+        <antisamy.version>1.7.2</antisamy.version>
         <snmp4j.version>2.8.5</snmp4j.version>
         <!--         TEST SCOPE         -->
         <awaitility.version>4.1.0</awaitility.version>

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/action/TbCopyAttributesToEntityViewNode.java

@@ -21,7 +21,6 @@ import com.google.gson.JsonElement;
 import com.google.gson.JsonParser;
 import com.google.gson.JsonPrimitive;
 import lombok.extern.slf4j.Slf4j;
-import org.jetbrains.annotations.NotNull;
 import org.thingsboard.server.common.data.util.CollectionsUtil;
 import org.thingsboard.common.util.DonAsynchron;
 import org.thingsboard.rule.engine.api.EmptyNodeConfiguration;
@@ -127,7 +126,6 @@ public class TbCopyAttributesToEntityViewNode implements TbNode {
         }
     }
 
-    @NotNull
     private FutureCallback<Void> getFutureCallback(TbContext ctx, TbMsg msg, EntityView entityView) {
         return new FutureCallback<Void>() {
             @Override

rule-engine/rule-engine-components/src/main/java/org/thingsboard/rule/engine/filter/TbOriginatorTypeSwitchNode.java

@@ -29,7 +29,7 @@ import org.thingsboard.server.common.data.plugin.ComponentType;
         type = ComponentType.FILTER,
         name = "entity type switch",
         configClazz = EmptyNodeConfiguration.class,
-        relationTypes = {"Device", "Asset", "Alarm", "Entity View", "Tenant", "Customer", "User", "Dashboard", "Rule chain", "Rule node"},
+        relationTypes = {"Device", "Asset", "Alarm", "Entity View", "Tenant", "Customer", "User", "Dashboard", "Rule chain", "Rule node", "Edge"},
         nodeDescription = "Route incoming messages by Message Originator Type",
         nodeDetails = "Routes messages to chain according to the entity type ('Device', 'Asset', etc.).",
         uiResources = {"static/rulenode/rulenode-core-config.js"},

transport/mqtt/src/main/resources/tb-mqtt-transport.yml

@@ -114,7 +114,7 @@ transport:
       # Server SSL credentials
       credentials:
         # Server credentials type (PEM - pem certificate file; KEYSTORE - java keystore)
-        type:  "${MQTT_SSL_CREDENTIALS_TYPE:PEM}"
+        type: "${MQTT_SSL_CREDENTIALS_TYPE:PEM}"
         # PEM server credentials
         pem:
           # Path to the server certificate file (holds server certificate or certificate chain, may include server private key)

ui-ngx/package.json

@@ -97,7 +97,7 @@
     "screenfull": "^6.0.2",
     "split.js": "^1.6.5",
     "systemjs": "6.11.0",
-    "tinycolor2": "~1.4.2",
+    "tinycolor2": "^1.6.0",
     "tinymce": "~5.10.7",
     "tooltipster": "^4.2.8",
     "ts-transformer-keys": "^0.4.4",