From 10526907ef0239b279d48a51e5697974bb364c57 Mon Sep 17 00:00:00 2001
From: Niko <d.papa@simwide.com>
Date: Sat, 6 Jun 2026 18:01:21 +0200
Subject: [PATCH] feat: v0.3.0...

---
 boot_manager.py     | 14 +++++++++++---
 provisioning_nfc.py | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 3 deletions(-)
 create mode 100644 provisioning_nfc.py

diff --git a/boot_manager.py b/boot_manager.py
index cf97843..761989e 100644
--- a/boot_manager.py
+++ b/boot_manager.py
@@ -250,9 +250,17 @@ def run():
 
         # ------------------------------------------------------------------
         elif state == 'PROVISIONING':
-            from provisioning_server import run_provisioning
-            _show_state('PROVISIONING', 'Waiting app...')
-            cfg = run_provisioning()        # blocks until config received
+            if caps.get('has_nfc'):
+                from provisioning_nfc import run_provisioning_nfc
+                _show(['PROVISIONING', 'NFC mode', '', 'Tap writer badge', ''])
+                cfg = run_provisioning_nfc()
+            else:
+                from provisioning_server import run_provisioning
+                import network as _net
+                _wlan = _net.WLAN(_net.STA_IF)
+                _ip = _wlan.ifconfig()[0] if _wlan.isconnected() else '0.0.0.0'
+                _show(['PROVISIONING', 'IP: ' + _ip, 'HTTP:8080', 'UDP :5000', 'Waiting app...'])
+                cfg = run_provisioning()
             save_config(cfg)
             print('[provisioning] config saved — rebooting')
             _show_state('CONFIG SAVED', 'Rebooting...')
diff --git a/provisioning_nfc.py b/provisioning_nfc.py
new file mode 100644
index 0000000..2e00e26
--- /dev/null
+++ b/provisioning_nfc.py
@@ -0,0 +1,32 @@
+# ============================================================+
+# Identity IoT — Provisioning via NFC
+# (c) Copyright : ae Aeonian Engineering Limited - Hong Kong
+# (c) Copyright : WIDE di D. Papa - Naples - Italy
+# ============================================================+
+# Used when has_nfc = True and no config.json found.
+# Waits for writer badge tap, reads AES-encrypted config payload
+# from NTAG424, decrypts with PROG_KEY/PROG_IV.
+# ============================================================+
+
+import utime
+from provisioning_server import PROG_KEY, PROG_IV
+from identity_iot_aes import aes_cbc_decrypt
+import ujson
+
+
+def run_provisioning_nfc():
+    """
+    Block until writer badge is tapped.
+    Reads encrypted config from NTAG424, returns config dict.
+    """
+    print('[provisioning_nfc] waiting for writer badge...')
+
+    # TODO: init PN532
+    # TODO: wait for NTAG424 tap
+    # TODO: read encrypted config payload from tag memory
+    # TODO: aes_cbc_decrypt(payload, PROG_KEY, PROG_IV)
+    # TODO: validate and return config dict
+
+    while True:
+        print('[provisioning_nfc] tap writer badge...')
+        utime.sleep(2)