Export CACs only on explicit request

[KrishnaIyer]

Summary

Export CACs only on explicit request.

Changes

• Export CACs only if the export-cacs flag is set. This is to allow users of older TTS versions to export CACs to register them separately in TTJS.

Testing

Local

Export devices by Device ID

Usage:
  ttn-lw-migrate tts device ... [flags]

Aliases:
  device, end-devices, end-device, devices, devs, dev, d

Flags:
      --app-api-key string                       TTS Application Access Key (with 'devices' permissions) (default "NNSXS.ISRMVNVKICT3SF5U5YUYOLX4CRLKHMAEOGIY55I.KAD3BCKHBLPG5CHXJJHKBAWC7LIAY6ZWJUVR7VCV6Z557WFKQVKA")
      --app-id string                            TTS Application ID (default "test-app")
      --application-server-grpc-address string   TTS Application Server GRPC Address (default "localhost:1884")
      --ca-file string                           TTS Path to a CA file (optional)
      --default-grpc-address string              TTS default GRPC Address (optional)
      --delete-source-device                     TTS delete exported devices
      --export-cacs                              Export Claim Authentication Codes (CAC)
  -h, --help                                     help for device
      --identity-server-grpc-address string      TTS Identity Server GRPC Address (default "localhost:1884")
      --insecure                                 TTS allow TCP connection
      --join-server-grpc-address string          TTS Join Server GRPC Address (default "localhost:1884")
      --network-server-grpc-address string       TTS Network Server GRPC Address (default "localhost:1884")
      --no-session                               TTS export devices without session

Global Flags:
      --dry-run                      Do everything except resetting root and session keys of exported devices
      --frequency-plans-url string   URL for fetching frequency plans (default "https://raw.githubusercontent.com/TheThingsNetwork/lorawan-frequency-plans/master")
      --verbose                      Verbose output
-----------------------------------------------------

 ./ttn-lw-migrate tts device eui-1234234324532454 --dry-run --insecure
{"level":"warn","ts":1688551220.134939,"caller":"config/config.go:167","msg":"Using insecure connection to API"}
{"ids":{"device_id":"eui-1234234324532454","application_ids":{"application_id":"test-app"},"dev_eui":"1234234324532454","join_eui":"2121432434354345"},"created_at":"2023-07-05T09:42:31.452333Z","updated_at":"2023-07-05T09:42:31.452333Z","version_ids":{"brand_id":"abeeway", "model_id":"abeeway-compact-tracker", "hardware_version":"1.0", "firmware_version":"2.1", "band_id":"EU_863_870"},"lorawan_version":"MAC_V1_0_2","lorawan_phy_version":"PHY_V1_0_2_REV_B","frequency_plan_id":"EU_863_870_TTN","supports_join":true,"root_keys":{"app_key":{"key":"227D012D60757387B893EBA76A28323D"}},"mac_settings":{"supports_32_bit_f_cnt":true},"lora_alliance_profile_ids":{}}


 ./ttn-lw-migrate tts device eui-1234234324532454 --export-cacs --dry-run --insecure
{"level":"warn","ts":1688551208.2782679,"caller":"config/config.go:167","msg":"Using insecure connection to API"}
{"ids":{"device_id":"eui-1234234324532454","application_ids":{"application_id":"test-app"},"dev_eui":"1234234324532454","join_eui":"2121432434354345"},"created_at":"2023-07-05T09:42:31.452333Z","updated_at":"2023-07-05T09:42:31.452333Z","version_ids":{"brand_id":"abeeway", "model_id":"abeeway-compact-tracker", "hardware_version":"1.0", "firmware_version":"2.1", "band_id":"EU_863_870"},"lorawan_version":"MAC_V1_0_2","lorawan_phy_version":"PHY_V1_0_2_REV_B","frequency_plan_id":"EU_863_870_TTN","supports_join":true,"root_keys":{"app_key":{"key":"227D012D60757387B893EBA76A28323D"}},"mac_settings":{"supports_32_bit_f_cnt":true},"claim_authentication_code":{"value":"123456"},"lora_alliance_profile_ids":{}}

Regressions

Regular export also tested.

Notes for Reviewers

There's one small bug fix with a command line flag.

Checklist

• Scope: The referenced issue is addressed, there are no unrelated changes.
• Documentation: Relevant documentation is added or updated.
• Changelog: Significant features, behavior changes, deprecations and fixes are added to CHANGELOG.md.

[adriansmares]

Wouldn't we be better served by an --unset flag, similar to how we have --unset in TTS ? Then we don't need to add a flag per path that we want to remove (and we can get rid of or deprecate things like --no-session)

[KrishnaIyer]

Wouldn't we be better served by an --unset flag, similar to how we have --unset in TTS ? Then we don't need to add a flag per path that we want to remove (and we can get rid of or deprecate things like --no-session)

That's indeed one possibility. The reason for the current implementation is that I'm in favour of an explicit include vs an explicit exclude.
CACs are not necessary unless someone really used TTS as a Join Server and needs to export the CACs.

[johanstokking]

Why would we export them anyway?

[KrishnaIyer]

Why would we export them anyway?

If someone is using an older version of TTS and using the IS/JS as a CAC store.

[johanstokking]

I think we can remove this but ok if there are good reasons we can make this a flag.