From 61c1c6f7559fb1768fae2f1215d4212aa58a21b1 Mon Sep 17 00:00:00 2001
From: Andrii Shvaika <ashvayka@thingsboard.io>
Date: Mon, 6 Apr 2026 15:14:39 +0300
Subject: [PATCH] feat(iot-hub): add optional credentials override for DEVICE
 and GATEWAY steps

Add optional 'credentials' field to DeviceInstallStep pointing to a
JSON file in the ZIP. After device creation, fetches existing credentials,
applies overrides (credentialsType, credentialsValue, credentialsId),
and saves. Supports MQTT_BASIC with clientId/userName/password.

Example credentials.json:
{
  "credentialsType": "MQTT_BASIC",
  "credentialsValue": {
    "clientId": "${deviceName}",
    "userName": "${mqttUsername}",
    "password": "${mqttPassword}"
  }
}
---
 .../device-install-dialog.component.ts        | 25 +++++++++++++++++--
 .../models/iot-hub/device-package.models.ts   |  1 +
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/ui-ngx/src/app/modules/home/components/iot-hub/device-install-dialog/device-install-dialog.component.ts b/ui-ngx/src/app/modules/home/components/iot-hub/device-install-dialog/device-install-dialog.component.ts
index bbbcfadd6d..5ec520d98b 100644
--- a/ui-ngx/src/app/modules/home/components/iot-hub/device-install-dialog/device-install-dialog.component.ts
+++ b/ui-ngx/src/app/modules/home/components/iot-hub/device-install-dialog/device-install-dialog.component.ts
@@ -496,12 +496,12 @@ export class TbDeviceInstallDialogComponent extends DialogComponent<TbDeviceInst
       }
       case InstallStepType.DEVICE: {
         const result = await firstValueFrom(this.deviceService.saveDevice(template, {ignoreErrors: true}));
-        const creds = await firstValueFrom(this.deviceService.getDeviceCredentials(result.id.id, false, {ignoreErrors: true}));
+        const creds = await this.resolveCredentials(step, result.id.id);
         return { id: result.id.id, name: result.name, url: `/entities/devices/${result.id.id}`, token: creds.credentialsId };
       }
       case InstallStepType.GATEWAY: {
         const result = await firstValueFrom(this.deviceService.saveDevice(template, {ignoreErrors: true}));
-        const creds = await firstValueFrom(this.deviceService.getDeviceCredentials(result.id.id, false, {ignoreErrors: true}));
+        const creds = await this.resolveCredentials(step, result.id.id);
         return {
           id: result.id.id,
           name: result.name,
@@ -572,6 +572,27 @@ export class TbDeviceInstallDialogComponent extends DialogComponent<TbDeviceInst
     }
   }
 
+  private async resolveCredentials(step: DeviceInstallStep, deviceId: string): Promise<any> {
+    const creds = await firstValueFrom(this.deviceService.getDeviceCredentials(deviceId, false, {ignoreErrors: true}));
+    if (step.credentials) {
+      const raw = this.zipFiles.get(step.credentials);
+      if (raw) {
+        const credTemplate = JSON.parse(this.resolveVariables(raw));
+        creds.credentialsType = credTemplate.credentialsType || creds.credentialsType;
+        if (credTemplate.credentialsValue) {
+          creds.credentialsValue = typeof credTemplate.credentialsValue === 'string'
+            ? credTemplate.credentialsValue
+            : JSON.stringify(credTemplate.credentialsValue);
+        }
+        if (credTemplate.credentialsId) {
+          creds.credentialsId = credTemplate.credentialsId;
+        }
+        await firstValueFrom(this.deviceService.saveDeviceCredentials(creds, {ignoreErrors: true}));
+      }
+    }
+    return creds;
+  }
+
   private async findDeviceProfileByName(name: string): Promise<EntityStepOutput | null> {
     const profiles = await firstValueFrom(this.deviceProfileService.getDeviceProfileNames());
     const match = profiles.find(p => p.name === name);
diff --git a/ui-ngx/src/app/shared/models/iot-hub/device-package.models.ts b/ui-ngx/src/app/shared/models/iot-hub/device-package.models.ts
index 634bd68d35..a19c5c21ae 100644
--- a/ui-ngx/src/app/shared/models/iot-hub/device-package.models.ts
+++ b/ui-ngx/src/app/shared/models/iot-hub/device-package.models.ts
@@ -84,6 +84,7 @@ export interface DeviceInstallStep {
   template?: string;
   serverAttributes?: string;
   sharedAttributes?: string;
+  credentials?: string;
 }
 
 export interface DevicePackageInfo {