Fix #27. Also clear up error messages a bit

Reviewed-on: #21

README.md

@@ -1,9 +1,10 @@
 ## Gatekeeper - Door access system
-#### Status: WIP - getting there o.o
+#### Status: "WORKING" - Base functionality is there, mayor issues
 
 Start prod server `nix run`<br>
 Start dev server `nix run .#dev` or  `nix run .#dev -- {args}`<br>
 Interactive dev with `nix develop`, then sync deps with `uv sync`<br>
+There is a nix module you can use by importing `inputs.gatekeeper.nixosModules.gatekeeper`<br>
 Swagger UI @ http://127.0.0.1:8000/api/v1/docs<br>
 OpenApi @ http://127.0.0.1:8000/api/v1/openapi.json<br>
 
@@ -33,17 +34,13 @@ Range: The range of the ACR1552U was much better at over 60mm (almost 70mm if yo
 
 
 #### Issues:
+   - cards can only unlock, not lock
    - documentation missing
-   - raspberry pi image not working
-   - no door state
-   - no door operations
-   - hardcoded secret key in auth.py -> centralise env var loading 
    - i don't like the error handling in the scanner - doesn't pass errors correctly
    - cors for frontend: https://fastapi.tiangolo.com/tutorial/cors
      - Load cors from env var or something
    - BackgroundScanner shouldn't get a single session for the whole lifecycle
    - input validation maybe
-   - too many imports
    - inconsistent logging (request logging?)
    - rate limiting maybe
    - pretty sure the controllers are doing too much stuff

app/__init__.py

@@ -1,7 +0,0 @@
-from fastapi import FastAPI
-
-from .controllers import cardManager, userManager
-
-app = FastAPI()
-app.include_router(userManager.user_router)
-app.include_router(cardManager.card_router)

app/controllers/doorManager.py

@@ -10,14 +10,21 @@ door_router = APIRouter(prefix="/api/v1/door", tags=["Door"])
 
 @door_router.put("/open")
 def open_door(db: Session = Depends(get_session), admin: bool = Depends(auth_is_admin)):
-    doorService.opendoor()
+    doorService.openDoor()
 
 
 @door_router.put("/close")
 def close_door(
     db: Session = Depends(get_session), admin: bool = Depends(auth_is_admin)
 ):
-    doorService.closedoor()
+    doorService.closeDoor()
+
+
+@door_router.put("/status")
+def is_door_open(
+    db: Session = Depends(get_session), admin: bool = Depends(auth_is_admin)
+):
+    return doorService.isDoorOpen()
 
 
 @door_router.post("/test")

app/main.py

@@ -1,15 +1,10 @@
 import logging
-import os
 from contextlib import asynccontextmanager
 
-from dotenv import load_dotenv
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.security import OAuth2PasswordBearer
 
-load_dotenv()
-
-# ruff: disable[E402]
 from app.controllers import (
     aaManager,
     cardManager,
@@ -20,10 +15,9 @@ from app.controllers import (
 )
 from app.services.auth import create_first_user, token_router
 from app.services.database import create_db_and_tables, get_db_session
+from app.services.door import DoorController, init_controller
 from app.services.scanner import BackgroundScanner
-from app.services.settings import verify_settings
-
-# ruff: enable[E402]
+from app.services.settings import settings
 
 logger = logging.getLogger(__name__)
 
@@ -34,11 +28,16 @@ logging.basicConfig(level=logging.INFO)
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    verify_settings()
     create_db_and_tables()
     create_first_user(db=get_db_session())
-
-    if not os.getenv("DISABLE_CARDS"):
+    init_controller(
+        DoorController(
+            mqtt_host=settings.mqtt_host,
+            mqtt_port=settings.mqtt_port,
+            mock_factory=settings.mock,
+        ),
+    )
+    if not settings.disable_cards:
         scanner.start()
 
     logger.info("-" * 63)

app/services/auth.py

@@ -1,5 +1,4 @@
 import logging
-import os
 import secrets
 import string
 from datetime import UTC, datetime, timedelta
@@ -14,10 +13,11 @@ from sqlmodel import Session, select
 
 from app.model.models import Token, TokenData, UserDB
 from app.services.database import add_and_refresh, get_session
+from app.services.settings import settings
 
 logger = logging.getLogger(__name__)
 
-SECRET_KEY = os.getenv("SECRET_KEY", default="ff" * 16)
+SECRET_KEY = settings.secret_key
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = 120
 

app/services/database.py

@@ -1,38 +1,48 @@
 import logging
-from os import getenv, path
+from functools import lru_cache
 
+from sqlalchemy import inspect
 from sqlmodel import Session, SQLModel, create_engine
 
+from app.services.settings import settings
+
 logger = logging.getLogger(__name__)
 
-SQLALCHEMY_DATABASE_PATH = getenv("SQLALCHEMY_DATABASE_PATH", "./gatekeeper.db")
-SQLALCHEMY_DATABASE_URL = "sqlite:///" + SQLALCHEMY_DATABASE_PATH
 
-engine = create_engine(SQLALCHEMY_DATABASE_URL)
+@lru_cache
+def get_engine():
+    return create_engine(
+        settings.sqlalchemy_database_url, connect_args={"check_same_thread": False}
+    )
 
 
 def create_db_and_tables():
-    if not path.exists(SQLALCHEMY_DATABASE_PATH):
-        SQLModel.metadata.create_all(engine)
+    inspector = inspect(get_engine())
+    existing_tables = inspector.get_table_names()
+    if not existing_tables:
+        SQLModel.metadata.create_all(get_engine())
         from alembic.config import Config
 
         from alembic import command
 
-        alembic_cfg = Config("./alembic.ini")
-        alembic_cfg.attributes["sqlalchemy.url"] = SQLALCHEMY_DATABASE_URL
+        alembic_cfg = Config(settings.alembic_config)
+        alembic_cfg.set_main_option("sqlalchemy.url", str(get_engine().url))
+        alembic_cfg.attributes["sqlalchemy.url"] = settings.sqlalchemy_database_url
         command.stamp(alembic_cfg, "head")
         logger.info("Database created and tables initialized.")
     else:
-        logger.info("Database already exists")
+        logger.info(
+            "Database already initialized (%d tables found).", len(existing_tables)
+        )
 
 
 def get_session():
-    with Session(engine) as db:
+    with Session(get_engine()) as db:
         yield db
 
 
 def get_db_session():
-    return Session(engine)
+    return Session(get_engine())
 
 
 def add_and_refresh(db: Session, obj):

app/services/door.py

@@ -1,5 +1,6 @@
 import logging
 from datetime import date, datetime, timedelta
+from time import sleep
 
 from sqlalchemy import exc
 from sqlmodel import select
@@ -9,25 +10,82 @@ from app.services.database import Session, add_and_refresh
 
 logger = logging.getLogger(__name__)
 
-doorIsOpen = True
-# I think this could also be gpio controlled
+
 # See: https://github.com/technyon/nuki_hub#gpio-lock-control-optional
+# TODO: add sensor pin
+class DoorController:
+    def __init__(
+        self,
+        mqtt_host: str = "localhost",
+        mqtt_port: int = 1883,
+        mock_factory: bool = False,
+
+    ):
+        self._is_open: bool = False
+        self._mqtt = None
+        self._mqtt_topic = "nukihub/lock/action"
+        self._mock = mock_factory
+
+        if not mock_factory:
+            import paho.mqtt.client as mqtt
+            self._mqtt = mqtt.Client(mqtt.CallbackAPIVersion.VERSION2)
+            self._mqtt.connect(mqtt_host, mqtt_port) #TODO: add login with username+pw, tls
+            self._mqtt.loop_start()
+            logger.info("Mqtt client connect to %s:%s", mqtt_host, mqtt_port)
+
+        logger.info(
+            "DoorController started. topic=%s mock=%s", self._mqtt_topic,
+            mock_factory,
+        )
+
+    def open(self):
+        if self._mock:
+            self._is_open = True
+            logger.info("Door unlocked.[MOCK]")
+            return
+
+        self._mqtt.publish(self._mqtt_topic, "unlock")
+        self._is_open = True
+        logger.info("Door unlocked!")
+
+    def close(self):
+        if self._mock:
+            self._is_open = False
+            logger.info("Door locked.[MOCK]")
+            return
+
+        self._mqtt.publish(self._mqtt_topic, "lock")
+        self._is_open = False
+        logger.info("Door locked!")
+
+    def is_open(self):
+        return self._is_open
+
+
+_contoller: DoorController | None = None
+
+
+def init_controller(ctrl: DoorController):
+    global _contoller
+    _contoller = ctrl
+
+
+def get_controller():
+    if _contoller is None:
+        raise RuntimeError("DoorController not initialized.")
+    return _contoller
 
 
 def openDoor():
-    global doorIsOpen
-    doorIsOpen = True
-    logger.info("Still needs gpio out")
+    get_controller().open()
 
 
 def closeDoor():
-    global doorIsOpen
-    doorIsOpen = False
-    logger.info("Still needs gpio out")
+    get_controller().close()
 
 
 def isDoorOpen():
-    return doorIsOpen
+    return get_controller().is_open()
 
 
 def decrementOneshot(db: Session, oneshot: OneShotAccess):
@@ -43,8 +101,14 @@ def checkAccess(key: str, db: Session):
         current_weekday = datetime.weekday(date.today())
         current_time = datetime.now()
         card = db.exec(select(Card).where(Card.key == key)).one()
+        if not card.enabled:
+            logger.info("Card Inactive!")
+            return False
         for auth in card.group.accessauths:
             logger.info(f"checking auth: {auth.name}")
+            if not auth.is_active:
+                logger.info("AA inactive!")
+                continue
             if auth.type == "timetable":
                 for timetable in auth.timetables:
                     logger.info(f"  checking timetable {timetable.id}")
@@ -69,4 +133,4 @@ def checkAccess(key: str, db: Session):
         logger.info("No more auths found")
         return False
     except exc.NoResultFound:
-        raise Exception("No Access with that key found, this might be a db error")
+        raise Exception("No AccessAuth with that key found!")

app/services/scanner.py

@@ -1,5 +1,4 @@
 import logging
-import os
 import secrets
 import threading
 import time
@@ -19,21 +18,20 @@ from desfire.enums import (
     DESFireKeyType,
 )
 from desfire.schemas import FilePermissions, FileSettings, KeySettings
-from dotenv import load_dotenv
 from fastapi import HTTPException, status
 from smartcard.CardRequest import CardRequest
 from smartcard.CardType import AnyCardType
 from smartcard.Exceptions import CardRequestTimeoutException
 
-from app.services.door import checkAccess, openDoor
+from app.services.door import checkAccess, closeDoor, isDoorOpen, openDoor
+from app.services.settings import settings
 
 logger = logging.getLogger(__name__)
 
 # ENV vars
-load_dotenv()
-MIFARE_APP_MASTER_KEY = os.getenv("MIFARE_APP_MASTER_KEY")
-MIFARE_ACL_READ_BASE_KEY = os.getenv("MIFARE_ACL_READ_BASE_KEY")
-MIFARE_ACL_WRITE_BASE_KEY = os.getenv("MIFARE_ACL_WRITE_BASE_KEY")
+MIFARE_APP_MASTER_KEY = settings.mifare_app_master_key
+MIFARE_ACL_READ_BASE_KEY = settings.mifare_acl_read_base_key
+MIFARE_ACL_WRITE_BASE_KEY = settings.mifare_acl_write_base_key
 
 # Constants
 MIFARE_APP_ID = "DEAFFE"  # 7 bytes
@@ -79,7 +77,7 @@ def readFileOnCard(desfire: DESFire):
         assert len(applications) == 1
         assert applications[0] == get_list(MIFARE_APP_ID)
     except AssertionError:
-        logger.error("No application found!")
+        logger.error("No application found! The card must be registered first!")
         time.sleep(4)
         return
     # Then use the key derivation with that uid, the appid, the sysid
@@ -127,23 +125,13 @@ def DeleteCard():
         aes_null_key = DESFireKey(aes_keysettings, "00" * 16)
 
         desfire.select_application(0x0)
-
-        try:
-            try:
-                logger.debug("Auth1")
-                desfire.authenticate(0x0, aes_master_key)
-            except:
-                logger.debug("Auth2")
-                desfire.authenticate(0x0, aes_null_key)
-        except:
-            logger.debug("Auth3")
-            desfire.authenticate(0x0, desKey)
+        desfire.authenticate(0x0, desKey)
 
         applications = desfire.get_application_ids()
         logger.debug(f"Applications: {applications}")
         if len(applications) == 0:
             raise HTTPException(
-                status_code=status.HTTP_410_GONE, detail="No applications on card"
+                status_code=status.HTTP_410_GONE, detail="Card is empty."
             )
 
         desfire.select_application(MIFARE_APP_ID)
@@ -187,6 +175,13 @@ def WriteNewCard():
         # get uid
         uid = desfire.get_real_uid()
 
+        applications = desfire.get_application_ids()
+        logger.debug(f"Applications: {applications}")
+        if len(applications) >= 1:
+            raise HTTPException(
+                status_code=status.HTTP_409_CONFLICT, detail="This Card already has a key!"
+            )
+
         # Set default key
         logger.debug("Setting default key...")
         desfire.change_default_key(aes_null_key, 0x0)
@@ -272,12 +267,12 @@ def WriteNewCard():
         return key, to_hex_string(data=uid, separator=":")
 
     except Exception as e:
-        logger.error(f"Error in write function: {e}", exc_info=True)
+        logger.error(f"Error in write function: {e}", exc_info=False)
+        scannerThread.start()
         raise HTTPException(
             status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=f"Error: {e}"
         )
 
-
 class BackgroundScanner:
     def __init__(self, db):
         self.db = db
@@ -312,7 +307,7 @@ class BackgroundScanner:
                     logger.debug("READY after timout")
 
             except Exception as e:
-                logger.error(f"Error in scan function: {e}", exc_info=True)
+                logger.error(f"Error in function _scan_loop: {e}", exc_info=False)
                 time.sleep(6)
 
     def _read_card(self):
@@ -328,13 +323,17 @@ class BackgroundScanner:
             rdata = readFileOnCard(desfire=desfire)
             return rdata
         except Exception as e:
-            logger.error(f"something went wrong: {e}")
+            logger.error(f"Error in function _read_card: {e}", exc_info=False)
             time.sleep(5)
 
     def _check_db(self, key):
-        check = checkAccess(key, self.db)
-        if check:
-            openDoor()
-            logger.info("Access granted!")
+        if isDoorOpen():
+            closeDoor()
+            logger.info("Door closed by key %s", key)
         else:
-            logger.error("Access denied!")
+            check = checkAccess(key, self.db)
+            if check:
+                openDoor()
+                logger.info("Access granted!")
+            else:
+                logger.error("Access denied!")

app/services/settings.py

@@ -1,29 +1,70 @@
 import logging
-import os
+from functools import lru_cache
+
+from pydantic_settings import BaseSettings, SettingsConfigDict
 
 logger = logging.getLogger(__name__)
 
 
-def verify_settings():
-    card_envs = [
-        "MIFARE_APP_MASTER_KEY",
-        "MIFARE_ACL_READ_BASE_KEY",
-        "MIFARE_ACL_WRITE_BASE_KEY",
-    ]
-    important_envs = ["SECRET_KEY"]
-    other_envs = ["SQLALCHEMY_DATABASE_PATH"]
-    for setting in card_envs:
-        if (setting not in os.environ or setting == "") and not os.getenv(
-            "DISABLE_CARDS"
-        ):
-            raise ValueError(
-                f"Missing environment variable for scanner start: {setting} \n Run with DISABLE_CARDS env var to disable cards"  # noqa: E501
+class Settings(BaseSettings):
+    model_config = SettingsConfigDict(env_file=".env")
+
+    secret_key: str
+    sqlalchemy_database_url: str = "sqlite:///./gatekeeper.db"
+    mqtt_host: str = "localhost"
+    mqtt_port: int = 1883
+    mock: bool = True
+    alembic_config: str = "./alembic.ini"
+
+    disable_cards: bool = False
+    mifare_app_master_key: str | None = None
+    mifare_acl_read_base_key: str | None = None
+    mifare_acl_write_base_key: str | None = None
+
+
+@lru_cache(1)
+def _create_settings():
+    settings = Settings()
+    if not settings.disable_cards:
+        missing = [
+            name.upper()
+            for name in (
+                "mifare_app_master_key",
+                "mifare_acl_read_base_key",
+                "mifare_acl_write_base_key",
             )
-    for setting in important_envs:
-        if setting not in os.environ or setting == "":
-            raise ValueError(
-                f"Missing critical environment variable {setting}. Stopping..."
+            if not getattr(settings, name)
+        ]
+        if missing:
+            logger.critical(
+                "Missing environment variable for scanner start: %s"
+                "Card scanner and related funcionality is disabled!",
+                ", ".join(missing),
             )
-    for setting in other_envs:
-        if setting not in os.environ:
-            logger.warning(f"Env var {setting} not set. Continuing with defaults.")
+            settings.disable_cards = True
+    return settings
+
+
+class _SettingsProxy:
+    _instance: Settings | None = None
+
+    def _load(self) -> Settings:
+        if self._instance is None:
+            self._instance = _create_settings()
+        return self._instance
+
+    def __getattr__(self, name: str):
+        return getattr(self._load(), name)
+
+    def __setattr__(self, name: str, value):
+        if name == "_instance":
+            super().__setattr__(name, value)
+        else:
+            setattr(self._load(), name, value)
+
+    def reset(self) -> None:
+        self._instance = None
+        _create_settings.cache_clear()
+
+
+settings = _SettingsProxy()

flake.nix

@@ -65,6 +65,10 @@
                   buildInputs = (old.buildInputs or []) ++ [ pkgs.pcsclite.dev ];
                   NIX_CFLAGS_COMPILE = "-I${pkgs.pcsclite.dev}/include/PCSC";
                 });
+                lgpio = prev.lgpio.overrideAttrs (old: {
+                  nativeBuildInputs = (old.nativeBuildInputs or []) ++ [ pkgs.swig ];
+                  buildInputs = (old.buildInputs or []) ++ [ pkgs.lgpio ];
+                });
               })
             ]
           )
@@ -93,7 +97,7 @@
               UV_NO_SYNC = "1";
               UV_PYTHON = pythonSet.python.interpreter;
               UV_PYTHON_DOWNLOADS = "never";
-              LD_LIBRARY_PATH = "${lib.getLib pkgs.pcsclite}/lib";
+              LD_LIBRARY_PATH = "${lib.getLib pkgs.pcsclite}/lib:${lib.getLib pkgs.lgpio}/lib";
             };
             shellHook = ''
               unset PYTHONPATH

module.nix

@@ -6,23 +6,42 @@ in
   options = {
     services.gatekeeper = {
       enable = lib.mkEnableOption "Enable the gatekeeper api service.";
-      dotenv = lib.mkOption {
-        type = lib.types.path;
-        description = "The path to a .env file with the keys";
+      envFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        description = "The path to a .env file with all the other options";
       };
       db = lib.mkOption {
         type = lib.types.path;
         description = "Where to save the database.";
+        default = "/var/lib/gatekeeper";
+      };
+      mock = lib.mkOption {
+        type = lib.types.str;
+        default = "False";
+        description = "Mock the doorcontroller. Has to be a string!";
       };
     };
   };
   config = lib.mkIf cfg.enable {
     users.groups.gatekeeper = {};
+    users.groups.gpio = {};
     users.users.gatekeeper = {
       description = "gatekeeper user";
       group = "gatekeeper";
+      extraGroups = ["gpio"];
       isSystemUser = true;
     };
+    services.udev.extraRules = lib.mkBefore ''
+      KERNEL=="gpiomem", GROUP="gpio", MODE="0660"
+      SUBSYSTEM=="gpio", KERNEL=="gpiochip*", ACTION=="add", PROGRAM="${pkgs.bash}/bin/bash -c '${pkgs.coreutils}/bin/chgrp gpio /dev/%k && chmod 660 /dev/%k && ${pkgs.coreutils}/bin/chgrp -R gpio /sys/class/gpio && ${pkgs.coreutils}/bin/chmod -R g=u /sys/class/gpio'"
+      SUBSYSTEM=="gpio", ACTION=="add", PROGRAM="${pkgs.bash}/bin/bash -c '${pkgs.coreutils}/bin/chgrp -R gpio /sys%p && ${pkgs.coreutils}/bin/chmod -R g=u /sys%p'"
+    '';
+
+    boot.kernelParams = [
+      "iomem=relaxed" # for pigpiod 
+      "strict-devmem=0"
+    ];
+
     services.pcscd = {
       enable = true;
       plugins = [ pkgs.acsccid ];
@@ -43,6 +62,12 @@ in
         RestartSec = "20";
         StateDirectory = "gatekeeper";
         WorkingDirectory = "/var/lib/gatekeeper";
+        EnvironmentFile = cfg.envFile;
+      };
+      environment = {
+        SQLALCHEMY_DATABASE_URL = "sqlite:///${cfg.db}/gatekeeper.db";
+        ALEMBIC_CONFIG = "${self}/alembic.ini";
+        MOCK = cfg.mock;
       };
     };
   };

pyproject.toml

@@ -11,13 +11,19 @@ dependencies = [
     "python-desfire",
     "pyjwt[crypto]>=2.12.1",
     "pwdlib[argon2]>=0.3.0",
-    "pytest>=9.0.3",
     "requests>=2.33.1",
-    "pytest-cov>=7.1.0",
     "setuptools>=82.0.1",
     "pyscard>=2.3.1",
     "alembic>=1.18.5",
+    "pydantic-settings>=2.13.1",
+    "paho-mqtt>=2.1.0",
+]
+[dependency-groups]
+dev = [
     "ruff>=0.16.0",
+    "pytest>=9.0.3",
+    "pytest-cov>=7.1.0",
+    "jedi-language-server>=0.47.0",
 ]
 
 [tool.uv.sources]
@@ -26,6 +32,7 @@ python-desfire = { git = "https://github.com/waza-ari/python-desfire" }
 [tool.uv.extra-build-dependencies]
 python-desfire = ["poetry"]
 "pyscard" = ["setuptools"]
+"lgpio" = ["setuptools"]
 
 [tool.setuptools]
 py-modules = ["app"]
@@ -47,4 +54,4 @@ select = [
     # isort
     "I",
 ]
-ignore = ["B008"]
+ignore = ["B008"]

test/conftest.py

@@ -1,3 +1,4 @@
+import os
 from datetime import time
 
 import pytest
@@ -5,6 +6,8 @@ from fastapi.testclient import TestClient
 from sqlalchemy.pool import StaticPool
 from sqlmodel import Session, SQLModel, create_engine
 
+os.environ["SECRET_KEY"] = "ff" * 16
+
 from app.main import app
 from app.model.models import (
     AccessAuthorizationDB,

test/test_services/test_database.py

@@ -9,10 +9,10 @@ def test_create_db_and_tables():
     # This is primarily an integration test
     from sqlalchemy import inspect
 
-    from app.services.database import engine
+    from app.services.database import get_engine
 
     create_db_and_tables()
-    inspector = inspect(engine)
+    inspector = inspect(get_engine())
 
     # Check that tables exist
     tables = inspector.get_table_names()

test/test_services/test_door.py

@@ -112,3 +112,108 @@ def test_check_access_invalid_card(db_session):
     # Should raise exception for non-existent card
     with pytest.raises(Exception):
         checkAccess("non-existent-key", db_session)
+
+def test_check_access_with_inactive_aa(db_session):
+    # Setup: create card with valid access
+    group = GroupDB(name="Test Group")
+    db_session.add(group)
+    db_session.commit()
+
+    card = Card(
+        key="test-key-123",
+        group_id=group.id,
+        enabled=True,
+        name="test_card",
+        card_serial="00:00:00:00:00:00:00",
+    )
+    db_session.add(card)
+
+    timetable = Timetable(
+        weekday=datetime.datetime.weekday(datetime.date.today()),
+        starttime=datetime.datetime.now().time(),
+        duration=120,  # 2 hours
+    )
+    db_session.add(timetable)
+
+    aa = AccessAuthorizationDB(name="Test AA", is_active=False, type="timetable")
+    db_session.add(aa)
+    aa.timetables = [timetable]
+    group.accessauths = [aa]
+
+    db_session.commit()
+
+    assert checkAccess("test-key-123", db_session) == False
+
+def test_check_access_with_inactive_card(db_session):
+    # Setup: create card with valid access
+    group = GroupDB(name="Test Group")
+    db_session.add(group)
+    db_session.commit()
+
+    card = Card(
+        key="test-key-123",
+        group_id=group.id,
+        enabled=False,
+        name="test_card",
+        card_serial="00:00:00:00:00:00:00",
+    )
+    db_session.add(card)
+
+    timetable = Timetable(
+        weekday=datetime.datetime.weekday(datetime.date.today()),
+        starttime=datetime.datetime.now().time(),
+        duration=120,  # 2 hours
+    )
+    db_session.add(timetable)
+
+    aa = AccessAuthorizationDB(name="Test AA", is_active=True, type="timetable")
+    db_session.add(aa)
+    aa.timetables = [timetable]
+    group.accessauths = [aa]
+
+    db_session.commit()
+
+    assert checkAccess("test-key-123", db_session) == False
+
+def test_regression_check_access_issue_28(db_session):
+    # Having a active aa after a inactive/invalid one denies access
+    group = GroupDB(name="Test Group")
+    db_session.add(group)
+    db_session.commit()
+
+    card = Card(
+        key="test-key-123",
+        group_id=group.id,
+        enabled=True,
+        name="test_card",
+        card_serial="00:00:00:00:00:00:00",
+    )
+    db_session.add(card)
+
+    #Creating timetable with inactive AA
+    timetable1 = Timetable(
+        weekday=datetime.datetime.weekday(datetime.date.today()),
+        starttime=datetime.datetime.now().time(),
+        duration=120,  # 2 hours
+    )
+    db_session.add(timetable1)
+    aa1 = AccessAuthorizationDB(name="First AA", is_active=False, type="timetable")
+    db_session.add(aa1)
+    aa1.timetables = [timetable1]
+
+    #Creating timetable with active AA
+    timetable2 = Timetable(
+        weekday=datetime.datetime.weekday(datetime.date.today()),
+        starttime=datetime.datetime.now().time(),
+        duration=120,  # 2 hours
+    )
+    db_session.add(timetable2)
+    aa2 = AccessAuthorizationDB(name="Second AA", is_active=True, type="timetable")
+    db_session.add(aa2)
+    aa2.timetables = [timetable2]
+
+    group.accessauths = [aa1, aa2]
+
+    db_session.commit()
+
+    assert checkAccess("test-key-123", db_session) == True

uv.lock

@@ -93,6 +93,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/42/b9/f8d6fa329ab25128b7e98fd83a3cb34d9db5b059a9847eddb840a0af45dd/argon2_cffi_bindings-25.1.0-cp39-abi3-win_arm64.whl", hash = "sha256:b0fdbcf513833809c882823f98dc2f931cf659d9a1429616ac3adebb49f5db94", size = 27149, upload-time = "2025-07-30T10:01:59.329Z" },
 ]
 
+[[package]]
+name = "attrs"
+version = "26.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/9a/8e/82a0fe20a541c03148528be8cac2408564a6c9a0cc7e9171802bc1d26985/attrs-26.1.0.tar.gz", hash = "sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32", size = 952055, upload-time = "2026-03-19T14:22:25.026Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/64/b4/17d4b0b2a2dc85a6df63d1157e028ed19f90d4cd97c36717afef2bc2f395/attrs-26.1.0-py3-none-any.whl", hash = "sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309", size = 67548, upload-time = "2026-03-19T14:22:23.645Z" },
+]
+
 [[package]]
 name = "build"
 version = "1.4.3"
@@ -125,6 +134,19 @@ filecache = [
     { name = "filelock" },
 ]
 
+[[package]]
+name = "cattrs"
+version = "26.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a0/ec/ba18945e7d6e55a58364d9fb2e46049c1c2998b3d805f19b703f14e81057/cattrs-26.1.0.tar.gz", hash = "sha256:fa239e0f0ec0715ba34852ce813986dfed1e12117e209b816ab87401271cdd40", size = 495672, upload-time = "2026-02-18T22:15:19.406Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/80/56/60547f7801b97c67e97491dc3d9ade9fbccbd0325058fd3dfcb2f5d98d90/cattrs-26.1.0-py3-none-any.whl", hash = "sha256:d1e0804c42639494d469d08d4f26d6b9de9b8ab26b446db7b5f8c2e97f7c3096", size = 73054, upload-time = "2026-02-18T22:15:17.958Z" },
+]
+
 [[package]]
 name = "certifi"
 version = "2026.2.25"
@@ -419,6 +441,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ba/5a/18ad964b0086c6e62e2e7500f7edc89e3faa45033c71c1893d34eed2b2de/dnspython-2.8.0-py3-none-any.whl", hash = "sha256:01d9bbc4a2d76bf0db7c1f729812ded6d912bd318d3b1cf81d30c0f845dbf3af", size = 331094, upload-time = "2025-09-07T18:57:58.071Z" },
 ]
 
+[[package]]
+name = "docstring-to-markdown"
+version = "0.17"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "importlib-metadata" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/52/d8/8abe80d62c5dce1075578031bcfde07e735bcf0afe2886dd48b470162ab4/docstring_to_markdown-0.17.tar.gz", hash = "sha256:df72a112294c7492487c9da2451cae0faeee06e86008245c188c5761c9590ca3", size = 32260, upload-time = "2025-05-02T15:09:07.932Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/56/7b/af3d0da15bed3a8665419bb3a630585756920f4ad67abfdfef26240ebcc0/docstring_to_markdown-0.17-py3-none-any.whl", hash = "sha256:fd7d5094aa83943bf5f9e1a13701866b7c452eac19765380dead666e36d3711c", size = 23479, upload-time = "2025-05-02T15:09:06.676Z" },
+]
+
 [[package]]
 name = "dulwich"
 version = "1.1.0"
@@ -624,36 +659,52 @@ source = { virtual = "." }
 dependencies = [
     { name = "alembic" },
     { name = "fastapi", extra = ["standard"] },
+    { name = "lgpio", marker = "platform_machine == 'aarch64' and sys_platform == 'linux'" },
+    { name = "paho-mqtt" },
     { name = "poetry" },
     { name = "pwdlib", extra = ["argon2"] },
+    { name = "pydantic-settings" },
     { name = "pyjwt", extra = ["crypto"] },
     { name = "pyscard" },
-    { name = "pytest" },
-    { name = "pytest-cov" },
     { name = "python-desfire" },
     { name = "requests" },
-    { name = "ruff" },
     { name = "setuptools" },
     { name = "sqlmodel" },
 ]
 
+[package.dev-dependencies]
+dev = [
+    { name = "jedi-language-server" },
+    { name = "pytest" },
+    { name = "pytest-cov" },
+    { name = "ruff" },
+]
+
 [package.metadata]
 requires-dist = [
     { name = "alembic", specifier = ">=1.18.5" },
     { name = "fastapi", extras = ["standard"], specifier = ">=0.135.3" },
+    { name = "lgpio", marker = "platform_machine == 'aarch64' and sys_platform == 'linux'", specifier = ">=0.2.2.0" },
+    { name = "paho-mqtt", specifier = ">=2.1.0" },
     { name = "poetry", specifier = ">=2.3.4" },
     { name = "pwdlib", extras = ["argon2"], specifier = ">=0.3.0" },
+    { name = "pydantic-settings", specifier = ">=2.13.1" },
     { name = "pyjwt", extras = ["crypto"], specifier = ">=2.12.1" },
     { name = "pyscard", specifier = ">=2.3.1" },
-    { name = "pytest", specifier = ">=9.0.3" },
-    { name = "pytest-cov", specifier = ">=7.1.0" },
     { name = "python-desfire", git = "https://github.com/waza-ari/python-desfire" },
     { name = "requests", specifier = ">=2.33.1" },
-    { name = "ruff", specifier = ">=0.16.0" },
     { name = "setuptools", specifier = ">=82.0.1" },
     { name = "sqlmodel", specifier = ">=0.0.38" },
 ]
 
+[package.metadata.requires-dev]
+dev = [
+    { name = "jedi-language-server", specifier = ">=0.47.0" },
+    { name = "pytest", specifier = ">=9.0.3" },
+    { name = "pytest-cov", specifier = ">=7.1.0" },
+    { name = "ruff", specifier = ">=0.16.0" },
+]
+
 [[package]]
 name = "greenlet"
 version = "3.4.0"
@@ -753,6 +804,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
 ]
 
+[[package]]
+name = "importlib-metadata"
+version = "9.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "zipp" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a9/01/15bb152d77b21318514a96f43af312635eb2500c96b55398d020c93d86ea/importlib_metadata-9.0.0.tar.gz", hash = "sha256:a4f57ab599e6a2e3016d7595cfd72eb4661a5106e787a95bcc90c7105b831efc", size = 56405, upload-time = "2026-03-20T06:42:56.999Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/38/3d/2d244233ac4f76e38533cfcb2991c9eb4c7bf688ae0a036d30725b8faafe/importlib_metadata-9.0.0-py3-none-any.whl", hash = "sha256:2d21d1cc5a017bd0559e36150c21c830ab1dc304dedd1b7ea85d20f45ef3edd7", size = 27789, upload-time = "2026-03-20T06:42:55.665Z" },
+]
+
 [[package]]
 name = "iniconfig"
 version = "2.3.0"
@@ -804,6 +867,34 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/fd/c4/813bb09f0985cb21e959f21f2464169eca882656849adf727ac7bb7e1767/jaraco_functools-4.4.0-py3-none-any.whl", hash = "sha256:9eec1e36f45c818d9bf307c8948eb03b2b56cd44087b3cdc989abca1f20b9176", size = 10481, upload-time = "2025-12-21T09:29:42.27Z" },
 ]
 
+[[package]]
+name = "jedi"
+version = "0.20.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "parso" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/46/b7/a3635f6a2d7cf5b5dd98064fc1d5fbbafcb25477bcea204a3a92145d158b/jedi-0.20.0.tar.gz", hash = "sha256:c3f4ccbd276696f4b19c54618d4fb18f9fc24b0aef02acf704b23f487daa1011", size = 3119416, upload-time = "2026-05-01T23:38:47.814Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9a/93/242e2eab5fe682ffcb8b0084bde703a41d51e17ee0f3a31ff0d9d813620a/jedi-0.20.0-py2.py3-none-any.whl", hash = "sha256:7bdd9c2634f56713299976f4cbd59cb3fa92165cc5e05ea811fb253480728b67", size = 4884812, upload-time = "2026-05-01T23:38:43.919Z" },
+]
+
+[[package]]
+name = "jedi-language-server"
+version = "0.47.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cattrs" },
+    { name = "docstring-to-markdown" },
+    { name = "jedi" },
+    { name = "lsprotocol" },
+    { name = "pygls" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f5/00/0cc9fc9996f79f1935a39236f300e6b2399aed34b8170248c5108e38e652/jedi_language_server-0.47.0.tar.gz", hash = "sha256:43d9b89d07b504470544b80d76739449856a2be6565571cb362ee0681f6f0b86", size = 91714, upload-time = "2026-05-31T14:02:43.312Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/05/e1/ad4afa632b4ea58f422391d11e86b5100b5578879af6bf04bf5aaf4beede/jedi_language_server-0.47.0-py3-none-any.whl", hash = "sha256:0e00d5af41c1a966c9ec73221e81b1af3b8c0243d29477e5441c661d5b61ec3e", size = 33844, upload-time = "2026-05-31T14:02:42.161Z" },
+]
+
 [[package]]
 name = "jeepney"
 version = "0.9.0"
@@ -842,6 +933,25 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/81/db/e655086b7f3a705df045bf0933bdd9c2f79bb3c97bfef1384598bb79a217/keyring-25.7.0-py3-none-any.whl", hash = "sha256:be4a0b195f149690c166e850609a477c532ddbfbaed96a404d4e43f8d5e2689f", size = 39160, upload-time = "2025-11-16T16:26:08.402Z" },
 ]
 
+[[package]]
+name = "lgpio"
+version = "0.2.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/56/33/26ec2e8049eaa2f077bf23a12dc61ca559fbfa7bea0516bf263d657ae275/lgpio-0.2.2.0.tar.gz", hash = "sha256:11372e653b200f76a0b3ef8a23a0735c85ec678a9f8550b9893151ed0f863fff", size = 90087, upload-time = "2024-03-29T21:59:55.901Z" }
+
+[[package]]
+name = "lsprotocol"
+version = "2025.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "cattrs" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e9/26/67b84e6ec1402f0e6764ef3d2a0aaf9a79522cc1d37738f4e5bb0b21521a/lsprotocol-2025.0.0.tar.gz", hash = "sha256:e879da2b9301e82cfc3e60d805630487ac2f7ab17492f4f5ba5aaba94fe56c29", size = 74896, upload-time = "2025-06-17T21:30:18.156Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7b/f0/92f2d609d6642b5f30cb50a885d2bf1483301c69d5786286500d15651ef2/lsprotocol-2025.0.0-py3-none-any.whl", hash = "sha256:f9d78f25221f2a60eaa4a96d3b4ffae011b107537facee61d3da3313880995c7", size = 76250, upload-time = "2025-06-17T21:30:19.455Z" },
+]
+
 [[package]]
 name = "mako"
 version = "1.3.12"
@@ -980,6 +1090,24 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7a/c2/920ef838e2f0028c8262f16101ec09ebd5969864e5a64c4c05fad0617c56/packaging-26.1-py3-none-any.whl", hash = "sha256:5d9c0669c6285e491e0ced2eee587eaf67b670d94a19e94e3984a481aba6802f", size = 95831, upload-time = "2026-04-14T21:12:47.56Z" },
 ]
 
+[[package]]
+name = "paho-mqtt"
+version = "2.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/39/15/0a6214e76d4d32e7f663b109cf71fb22561c2be0f701d67f93950cd40542/paho_mqtt-2.1.0.tar.gz", hash = "sha256:12d6e7511d4137555a3f6ea167ae846af2c7357b10bc6fa4f7c3968fc1723834", size = 148848, upload-time = "2024-04-29T19:52:55.591Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c4/cb/00451c3cf31790287768bb12c6bec834f5d292eaf3022afc88e14b8afc94/paho_mqtt-2.1.0-py3-none-any.whl", hash = "sha256:6db9ba9b34ed5bc6b6e3812718c7e06e2fd7444540df2455d2c51bd58808feee", size = 67219, upload-time = "2024-04-29T19:52:48.345Z" },
+]
+
+[[package]]
+name = "parso"
+version = "0.8.7"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/30/4b/90c937815137d43ce71ba043cd3566221e9df6b9c805f24b5d138c9d40a7/parso-0.8.7.tar.gz", hash = "sha256:eaaac4c9fdd5e9e8852dc778d2d7405897ec510f2a298071453e5e3a07914bb1", size = 401824, upload-time = "2026-05-01T23:13:02.138Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/99/5d/8268b644392ee874ee82a635cd0df1773de230bde356c38de28e298392cc/parso-0.8.7-py2.py3-none-any.whl", hash = "sha256:a8926eb2a1b915486941fdbd31e86a4baf88fe8c210f25f2f35ecec5b574ca1c", size = 107025, upload-time = "2026-05-01T23:12:58.867Z" },
+]
+
 [[package]]
 name = "pbs-installer"
 version = "2026.4.7"
@@ -1221,6 +1349,20 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/00/4b/ccc026168948fec4f7555b9164c724cf4125eac006e176541483d2c959be/pydantic_settings-2.13.1-py3-none-any.whl", hash = "sha256:d56fd801823dbeae7f0975e1f8c8e25c258eb75d278ea7abb5d9cebb01b56237", size = 58929, upload-time = "2026-02-19T13:45:06.034Z" },
 ]
 
+[[package]]
+name = "pygls"
+version = "2.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "attrs" },
+    { name = "cattrs" },
+    { name = "lsprotocol" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/da/2e/7bbe061d175c0baddde8fc9edb908a4c31ba5d9165b8c68e3439c3a9f138/pygls-2.1.1.tar.gz", hash = "sha256:1da03ba9053201bb337dcdd8d121df70feb2a91e1a0dcc74de5da79755b1a201", size = 55091, upload-time = "2026-03-25T11:19:10.541Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fd/1a/208293b6c350f5abea6941d5606080d4a492644052504f5312e5de30a902/pygls-2.1.1-py3-none-any.whl", hash = "sha256:510a6dea2476177230c7d851125e5948efdf3fdb9ebfd8543fc434972f8faed4", size = 68975, upload-time = "2026-03-25T11:19:11.374Z" },
+]
+
 [[package]]
 name = "pygments"
 version = "2.20.0"
@@ -1914,6 +2056,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/fd/19/4b4e3e2ea5fa213ff4220e84450628fecde042b0961e7b4e6d845e555ade/xattr-1.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1e6c216927b16fd4b72df655d5124b69b2a406cb3132b5231179021182f0f0d1", size = 19023, upload-time = "2025-10-13T22:16:34.395Z" },
 ]
 
+[[package]]
+name = "zipp"
+version = "4.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b9/d8/eab98a517c14134c0b2eb4e2387bc5f457334293ec5d2dd3857ec2966802/zipp-4.1.0.tar.gz", hash = "sha256:4cb57381f544315db7688e976e922a2b18cdb513d21cc194eb42232ba2a3e602", size = 26214, upload-time = "2026-05-18T20:08:57.967Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/3a/13/547360d81e6d88d58492968ffda9f9542854f11310ee556fef14260cc886/zipp-4.1.0-py3-none-any.whl", hash = "sha256:25ad4e16390cd314347dd8f1de67a2ac538ae658ed4ab9db16029c07c188e97f", size = 10238, upload-time = "2026-05-18T20:08:57.045Z" },
+]
+
 [[package]]
 name = "zstandard"
 version = "0.25.0"