Harden geofence automation and home editing

README.md

@@ -19,6 +19,7 @@ Android-клиент для self-hosted backend [Ignis Core](https://git.akokos.
 Это не polling каждые 15 минут. Основной триггер здесь событийный:
 - geofence регистрируется нативно через Android geofencing API;
 - сетевое выключение выполняется отдельным one-off worker;
+- ошибки отдельных групп не должны блокировать выключение остальных;
 - при отсутствии координат или выключенной опции geofence не армится.
 
 ## Стек
@@ -104,7 +105,9 @@ flutter test
 4. Выдать Android-разрешения на геолокацию, включая background location.
 5. Разрешить уведомления, если нужны подтверждения о срабатывании geofence.
 
-API-ключи хранятся отдельно от списка домов в `flutter_secure_storage`. Старые ключи из `SharedPreferences` мигрируются автоматически.
+API-ключи хранятся отдельно от списка домов в `flutter_secure_storage`. Для нативного geofence active-home config и текущий API-ключ дополнительно шифруются на Android-стороне. Старые ключи из `SharedPreferences` мигрируются автоматически.
+
+При редактировании существующего дома приложение не требует онлайн-проверку backend, если URL и API-ключ не менялись: локальные правки имени, координат и geofence-параметров можно сохранять отдельно.
 
 ## Ограничения
 

android/app/src/main/AndroidManifest.xml

@@ -6,7 +6,7 @@
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <application
-        android:label="ignis_app"
+        android:label="@string/app_name"
         android:name="${applicationName}"
         android:icon="@mipmap/ic_launcher">
         <activity

android/app/src/main/kotlin/ru/akokos/ignis_app/GeofenceActiveHomeCredentials.kt

@@ -0,0 +1,43 @@
+package ru.akokos.ignis_app
+
+import android.content.Context
+import androidx.core.content.edit
+
+class GeofenceActiveHomeCredentials(context: Context) {
+    private val prefs =
+        context.getSharedPreferences(credentialsPrefsName, Context.MODE_PRIVATE)
+    private val cipher = GeofenceConfigCipher()
+
+    fun saveApiKey(homeId: String, apiKey: String) {
+        prefs.edit { putString(prefKey(homeId), cipher.encrypt(apiKey)) }
+    }
+
+    fun loadApiKey(homeId: String): String? {
+        val stored = prefs.getString(prefKey(homeId), null) ?: return null
+        val decoded =
+            runCatching { cipher.decrypt(stored) }
+                .getOrElse { stored }
+                .trim()
+        if (decoded.isEmpty()) {
+            return null
+        }
+        if (decoded == stored) {
+            saveApiKey(homeId, decoded)
+        }
+        return decoded
+    }
+
+    fun clear(homeId: String) {
+        prefs.edit { remove(prefKey(homeId)) }
+    }
+
+    fun clearAll() {
+        prefs.edit { clear() }
+    }
+
+    private fun prefKey(homeId: String): String = "api_key_$homeId"
+
+    companion object {
+        private const val credentialsPrefsName = "ignis_geofence_credentials"
+    }
+}

android/app/src/main/kotlin/ru/akokos/ignis_app/GeofenceAutomationManager.kt

@@ -25,7 +25,6 @@ data class StoredGeofenceConfig(
     val homeId: String,
     val homeName: String,
     val baseUrl: String,
-    val apiKey: String,
     val latitude: Double,
     val longitude: Double,
     val radiusMeters: Int,
@@ -40,35 +39,39 @@ enum class GeofencePresenceState {
 
 class GeofenceNativeStore(context: Context) {
     private val prefs = context.getSharedPreferences("ignis_geofence_native", Context.MODE_PRIVATE)
+    private val cipher = GeofenceConfigCipher()
 
     fun loadConfig(): StoredGeofenceConfig? {
         val raw = prefs.getString("config", null) ?: return null
         return runCatching {
-                val json = JSONObject(raw)
+                val json = JSONObject(decodeConfig(raw))
-                StoredGeofenceConfig(
+                val config =
+                    StoredGeofenceConfig(
                     homeId = json.getString("homeId"),
                     homeName = json.optString("homeName"),
                     baseUrl = json.getString("baseUrl"),
-                    apiKey = json.getString("apiKey"),
                     latitude = json.getDouble("latitude"),
                     longitude = json.getDouble("longitude"),
                     radiusMeters = json.getInt("radiusMeters"),
                 )
+                if (json.has("apiKey")) {
+                    saveConfig(config)
+                }
+                config
             }
             .getOrNull()
     }
 
     fun saveConfig(config: StoredGeofenceConfig) {
-        val json =
+        val plainJson =
             JSONObject()
                 .put("homeId", config.homeId)
                 .put("homeName", config.homeName)
                 .put("baseUrl", config.baseUrl)
-                .put("apiKey", config.apiKey)
                 .put("latitude", config.latitude)
                 .put("longitude", config.longitude)
                 .put("radiusMeters", config.radiusMeters)
-        prefs.edit().putString("config", json.toString()).apply()
+        prefs.edit().putString("config", cipher.encrypt(plainJson.toString())).apply()
     }
 
     fun clear() {
@@ -87,6 +90,14 @@ class GeofenceNativeStore(context: Context) {
     fun setState(state: GeofencePresenceState) {
         prefs.edit().putString("presence_state", state.name).apply()
     }
+
+    private fun decodeConfig(raw: String): String {
+        val trimmed = raw.trimStart()
+        if (trimmed.startsWith("{")) {
+            return raw
+        }
+        return cipher.decrypt(raw)
+    }
 }
 
 object GeofenceAutomationManager {
@@ -124,6 +135,7 @@ object GeofenceAutomationManager {
     fun disarm(context: Context, onComplete: (() -> Unit)? = null) {
         WorkManager.getInstance(context).cancelUniqueWork(exitWorkName)
         GeofenceNativeStore(context).clear()
+        GeofenceActiveHomeCredentials(context).clearAll()
 
         val client = LocationServices.getGeofencingClient(context)
         client.removeGeofences(buildPendingIntent(context)).addOnCompleteListener {

android/app/src/main/kotlin/ru/akokos/ignis_app/GeofenceConfigCipher.kt

@@ -0,0 +1,81 @@
+package ru.akokos.ignis_app
+
+import android.security.keystore.KeyGenParameterSpec
+import android.security.keystore.KeyProperties
+import android.util.Base64
+import java.nio.ByteBuffer
+import java.security.KeyStore
+import javax.crypto.Cipher
+import javax.crypto.KeyGenerator
+import javax.crypto.SecretKey
+import javax.crypto.spec.GCMParameterSpec
+
+class GeofenceConfigCipher {
+    fun encrypt(plainText: String): String {
+        val cipher = Cipher.getInstance(transformation)
+        cipher.init(Cipher.ENCRYPT_MODE, getOrCreateSecretKey())
+        val iv = cipher.iv
+        val encrypted = cipher.doFinal(plainText.toByteArray(Charsets.UTF_8))
+
+        val payload =
+            ByteBuffer.allocate(Int.SIZE_BYTES + iv.size + encrypted.size)
+                .putInt(iv.size)
+                .put(iv)
+                .put(encrypted)
+                .array()
+
+        return Base64.encodeToString(payload, Base64.NO_WRAP)
+    }
+
+    fun decrypt(payload: String): String {
+        val bytes = Base64.decode(payload, Base64.NO_WRAP)
+        val buffer = ByteBuffer.wrap(bytes)
+        val ivSize = buffer.int
+        require(ivSize in 12..32) { "Invalid IV size: $ivSize" }
+
+        val iv = ByteArray(ivSize)
+        buffer.get(iv)
+        val encrypted = ByteArray(buffer.remaining())
+        buffer.get(encrypted)
+
+        val cipher = Cipher.getInstance(transformation)
+        cipher.init(
+            Cipher.DECRYPT_MODE,
+            getOrCreateSecretKey(),
+            GCMParameterSpec(gcmTagLengthBits, iv),
+        )
+        val decrypted = cipher.doFinal(encrypted)
+        return decrypted.toString(Charsets.UTF_8)
+    }
+
+    private fun getOrCreateSecretKey(): SecretKey {
+        val keyStore = KeyStore.getInstance(androidKeyStore).apply { load(null) }
+        val existing = keyStore.getKey(keyAlias, null) as? SecretKey
+        if (existing != null) {
+            return existing
+        }
+
+        val keyGenerator =
+            KeyGenerator.getInstance(
+                KeyProperties.KEY_ALGORITHM_AES,
+                androidKeyStore,
+            )
+        keyGenerator.init(
+            KeyGenParameterSpec.Builder(
+                keyAlias,
+                KeyProperties.PURPOSE_ENCRYPT or KeyProperties.PURPOSE_DECRYPT,
+            ).setBlockModes(KeyProperties.BLOCK_MODE_GCM)
+                .setEncryptionPaddings(KeyProperties.ENCRYPTION_PADDING_NONE)
+                .setKeySize(256)
+                .build(),
+        )
+        return keyGenerator.generateKey()
+    }
+
+    companion object {
+        private const val androidKeyStore = "AndroidKeyStore"
+        private const val keyAlias = "ignis_geofence_config_key"
+        private const val transformation = "AES/GCM/NoPadding"
+        private const val gcmTagLengthBits = 128
+    }
+}

android/app/src/main/kotlin/ru/akokos/ignis_app/GeofenceExitWorker.kt

@@ -23,28 +23,51 @@ class GeofenceExitWorker(
         }
 
         val config = GeofenceNativeStore(applicationContext).loadConfig() ?: return Result.success()
+        val apiKey = GeofenceActiveHomeCredentials(applicationContext).loadApiKey(homeId)
+            ?: return Result.retry()
 
         return runCatching {
-                val groupIds = fetchGroupIds(config)
+                val groupIds = fetchGroupIds(config, apiKey)
-                val activeGroupIds = groupIds.filter { isGroupOn(config, it) }
+                var turnedOffGroups = 0
+                var hadFailures = false
 
-                if (activeGroupIds.isNotEmpty()) {
+                for (groupId in groupIds) {
-                    activeGroupIds.forEach { turnOffGroup(config, it) }
+                    val isOn =
+                        runCatching { isGroupOn(config, apiKey, groupId) }
+                            .getOrElse {
+                                hadFailures = true
+                                false
+                            }
+
+                    if (!isOn) {
+                        continue
+                    }
+
+                    runCatching { turnOffGroup(config, apiKey, groupId) }
+                        .onSuccess { turnedOffGroups += 1 }
+                        .onFailure { hadFailures = true }
                 }
 
-                GeofenceAutomationManager.markTriggered(applicationContext)
+                if (hadFailures) {
-                GeofenceAutomationNotifier.showExitProcessed(
+                    Result.retry()
-                    context = applicationContext,
+                } else {
-                    homeName = config.homeName,
+                    GeofenceAutomationManager.markTriggered(applicationContext)
-                    turnedOffGroups = activeGroupIds.size,
+                    GeofenceAutomationNotifier.showExitProcessed(
-                )
+                        context = applicationContext,
-                Result.success()
+                        homeName = config.homeName,
+                        turnedOffGroups = turnedOffGroups,
+                    )
+                    Result.success()
+                }
             }
             .getOrElse { Result.retry() }
     }
 
-    private fun fetchGroupIds(config: StoredGeofenceConfig): List<String> {
+    private fun fetchGroupIds(
-        val payload = requestJson(config, "/devices/groups")
+        config: StoredGeofenceConfig,
+        apiKey: String,
+    ): List<String> {
+        val payload = requestJson(config, apiKey, "/devices/groups")
         return when (payload) {
             is JSONArray ->
                 buildList {
@@ -78,15 +101,23 @@ class GeofenceExitWorker(
             }
         }
 
-    private fun isGroupOn(config: StoredGeofenceConfig, groupId: String): Boolean {
+    private fun isGroupOn(
+        config: StoredGeofenceConfig,
+        apiKey: String,
+        groupId: String,
+    ): Boolean {
         val encodedId = URLEncoder.encode(groupId, Charsets.UTF_8.name())
-        val payload = requestJson(config, "/control/group/$encodedId/status")
+        val payload = requestJson(config, apiKey, "/control/group/$encodedId/status")
         return extractState(payload) ?: false
     }
 
-    private fun turnOffGroup(config: StoredGeofenceConfig, groupId: String) {
+    private fun turnOffGroup(
+        config: StoredGeofenceConfig,
+        apiKey: String,
+        groupId: String,
+    ) {
         val encodedId = URLEncoder.encode(groupId, Charsets.UTF_8.name())
-        performRequest(config, "/control/group/$encodedId?state=false", method = "POST")
+        performRequest(config, apiKey, "/control/group/$encodedId?state=false", method = "POST")
     }
 
     private fun extractState(payload: Any?): Boolean? =
@@ -113,13 +144,18 @@ class GeofenceExitWorker(
             else -> null
         }
 
-    private fun requestJson(config: StoredGeofenceConfig, path: String): Any? {
+    private fun requestJson(
-        val body = performRequest(config, path, method = "GET")
+        config: StoredGeofenceConfig,
+        apiKey: String,
+        path: String,
+    ): Any? {
+        val body = performRequest(config, apiKey, path, method = "GET")
         return JSONTokener(body).nextValue()
     }
 
     private fun performRequest(
         config: StoredGeofenceConfig,
+        apiKey: String,
         path: String,
         method: String,
     ): String {
@@ -128,7 +164,7 @@ class GeofenceExitWorker(
                 requestMethod = method
                 connectTimeout = 15_000
                 readTimeout = 15_000
-                setRequestProperty("X-API-Key", config.apiKey)
+                setRequestProperty("X-API-Key", apiKey)
                 setRequestProperty("Accept", "application/json")
                 doInput = true
             }

android/app/src/main/kotlin/ru/akokos/ignis_app/MainActivity.kt

@@ -14,6 +14,9 @@ import io.flutter.plugin.common.MethodChannel
 
 class MainActivity : FlutterActivity() {
     private var pendingNotificationPermissionResult: MethodChannel.Result? = null
+    private val notificationPrefs by lazy {
+        getSharedPreferences(notificationPrefsName, MODE_PRIVATE)
+    }
 
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
@@ -48,6 +51,11 @@ class MainActivity : FlutterActivity() {
                         return@setMethodCallHandler
                     }
 
+                    GeofenceActiveHomeCredentials(applicationContext).clearAll()
+                    GeofenceActiveHomeCredentials(applicationContext).saveApiKey(
+                        homeId,
+                        apiKey,
+                    )
                     GeofenceAutomationManager.arm(
                         context = applicationContext,
                         config =
@@ -55,7 +63,6 @@ class MainActivity : FlutterActivity() {
                                 homeId = homeId,
                                 homeName = homeName ?: "",
                                 baseUrl = baseUrl,
-                                apiKey = apiKey,
                                 latitude = latitude,
                                 longitude = longitude,
                                 radiusMeters = radiusMeters,
@@ -127,6 +134,7 @@ class MainActivity : FlutterActivity() {
         }
 
         pendingNotificationPermissionResult = result
+        notificationPrefs.edit().putBoolean(notificationPermissionRequestedKey, true).apply()
         ActivityCompat.requestPermissions(
             this,
             arrayOf(Manifest.permission.POST_NOTIFICATIONS),
@@ -146,10 +154,20 @@ class MainActivity : FlutterActivity() {
                     Manifest.permission.POST_NOTIFICATIONS,
                 ) == PackageManager.PERMISSION_GRANTED
 
-        return if (!runtimePermissionGranted) {
+        if (!runtimePermissionGranted) {
-            "requestable"
+            val wasRequestedBefore =
+                notificationPrefs.getBoolean(notificationPermissionRequestedKey, false)
+            val canShowPromptAgain =
+                Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
+                    shouldShowRequestPermissionRationale(Manifest.permission.POST_NOTIFICATIONS)
+
+            return if (!wasRequestedBefore || canShowPromptAgain) {
+                "requestable"
+            } else {
+                "settings_required"
+            }
         } else {
-            "settings_required"
+            return "settings_required"
         }
     }
 
@@ -166,5 +184,8 @@ class MainActivity : FlutterActivity() {
 
     companion object {
         private const val notificationPermissionRequestCode = 4102
+        private const val notificationPrefsName = "ignis_notification_permissions"
+        private const val notificationPermissionRequestedKey =
+            "post_notifications_requested"
     }
 }

android/app/src/main/res/values/strings.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">Ignis App</string>
+</resources>

lib/features/homes/providers/location_providers.dart

@@ -5,6 +5,8 @@ import 'package:flutter/foundation.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:geolocator/geolocator.dart';
 
+import '../services/location_platform_service.dart';
+
 enum UserLocationIssue {
   servicesDisabled,
   permissionDenied,
@@ -46,6 +48,10 @@ final userLocationProvider =
       () => UserLocationNotifier(),
     );
 
+final locationPlatformServiceProvider = Provider<LocationPlatformService>(
+  (ref) => DeviceLocationPlatformService(),
+);
+
 class UserLocationNotifier extends Notifier<UserLocation> {
   StreamSubscription<Position>? _sub;
   int _watchers = 0;
@@ -71,9 +77,21 @@ class UserLocationNotifier extends Notifier<UserLocation> {
   /// стрим остановится только когда все вызовут stopWatching.
   Future<void> startWatching() async {
     _watchers++;
+    await _startWatchingIfPossible();
+  }
+
+  Future<void> ensureWatchingStarted() async {
+    if (_watchers == 0 || _sub != null) {
+      return;
+    }
+    await _startWatchingIfPossible();
+  }
+
+  Future<void> _startWatchingIfPossible() async {
+    final locationService = ref.read(locationPlatformServiceProvider);
     if (_sub != null) return;
 
-    final permissionState = await _ensurePermission();
+    final permissionState = await _ensurePermission(requestIfDenied: false);
     if (!permissionState.isGranted) {
       state = permissionState.toLocation();
       return;
@@ -81,7 +99,7 @@ class UserLocationNotifier extends Notifier<UserLocation> {
 
     if (!state.hasPosition) {
       try {
-        final last = await Geolocator.getLastKnownPosition();
+        final last = await locationService.getLastKnownPosition();
         if (last != null) {
           state = _fromPosition(last);
         }
@@ -93,17 +111,19 @@ class UserLocationNotifier extends Notifier<UserLocation> {
       distanceFilter: 20,
     );
 
-    _sub = Geolocator.getPositionStream(locationSettings: settings).listen(
+    _sub = locationService
-      (pos) => state = _fromPosition(pos),
+        .getPositionStream(locationSettings: settings)
-      onError: (e) {
+        .listen(
-        debugPrint('Ошибка стрима геолокации: $e');
+          (pos) => state = _fromPosition(pos),
-        state = UserLocation(
+          onError: (e) {
-          error: 'Не удалось отслеживать позицию: $e',
+            debugPrint('Ошибка стрима геолокации: $e');
-          issue: UserLocationIssue.unavailable,
+            state = UserLocation(
-          updatedAt: state.updatedAt,
+              error: 'Не удалось отслеживать позицию: $e',
+              issue: UserLocationIssue.unavailable,
+              updatedAt: state.updatedAt,
+            );
+          },
         );
-      },
-    );
   }
 
   /// Остановить отслеживание. Вызывать из dispose экрана.
@@ -116,20 +136,21 @@ class UserLocationNotifier extends Notifier<UserLocation> {
   }
 
   Future<void> refresh() async {
-    final permissionState = await _ensurePermission();
+    final locationService = ref.read(locationPlatformServiceProvider);
+    final permissionState = await _ensurePermission(requestIfDenied: false);
     if (!permissionState.isGranted) {
       state = permissionState.toLocation();
       return;
     }
 
     try {
-      final last = await Geolocator.getLastKnownPosition();
+      final last = await locationService.getLastKnownPosition();
       if (last != null) {
         state = _fromPosition(last);
         return;
       }
 
-      final pos = await Geolocator.getCurrentPosition(
+      final pos = await locationService.getCurrentPosition(
         locationSettings: const LocationSettings(
           accuracy: LocationAccuracy.low,
           timeLimit: Duration(seconds: 10),
@@ -146,35 +167,40 @@ class UserLocationNotifier extends Notifier<UserLocation> {
   }
 
   Future<void> requestPermission() async {
-    await Geolocator.requestPermission();
+    final locationService = ref.read(locationPlatformServiceProvider);
+    await locationService.requestPermission();
     if (_watchers > 0 && _sub == null) {
-      await startWatching();
+      await _startWatchingIfPossible();
       return;
     }
     await refresh();
   }
 
   Future<void> openAppSettings() async {
-    await Geolocator.openAppSettings();
+    await ref.read(locationPlatformServiceProvider).openAppSettings();
   }
 
   Future<void> openLocationSettings() async {
-    await Geolocator.openLocationSettings();
+    await ref.read(locationPlatformServiceProvider).openLocationSettings();
   }
 
   /// Проверить сервис и пермишены. Возвращает null если всё ок,
   /// иначе строку с причиной ошибки.
-  Future<_LocationPermissionState> _ensurePermission() async {
+  Future<_LocationPermissionState> _ensurePermission({
-    if (!await Geolocator.isLocationServiceEnabled()) {
+    required bool requestIfDenied,
+  }) async {
+    final locationService = ref.read(locationPlatformServiceProvider);
+
+    if (!await locationService.isLocationServiceEnabled()) {
       return const _LocationPermissionState(
         issue: UserLocationIssue.servicesDisabled,
         message: 'Геолокация выключена',
       );
     }
 
-    var perm = await Geolocator.checkPermission();
+    var perm = await locationService.checkPermission();
-    if (perm == LocationPermission.denied) {
+    if (perm == LocationPermission.denied && requestIfDenied) {
-      perm = await Geolocator.requestPermission();
+      perm = await locationService.requestPermission();
     }
     if (perm == LocationPermission.denied) {
       return const _LocationPermissionState(

lib/features/homes/services/home_connection_change.dart

@@ -0,0 +1,14 @@
+import '../../../models/home_config.dart';
+
+bool hasHomeConnectionChanges({
+  required HomeConfig? originalHome,
+  required String normalizedUrl,
+  required String apiKey,
+  required String originalApiKey,
+}) {
+  if (originalHome == null) {
+    return true;
+  }
+
+  return normalizedUrl != originalHome.url || apiKey != originalApiKey;
+}

lib/features/homes/services/location_platform_service.dart

@@ -0,0 +1,69 @@
+import 'package:geolocator/geolocator.dart';
+
+abstract class LocationPlatformService {
+  Future<bool> isLocationServiceEnabled();
+
+  Future<LocationPermission> checkPermission();
+
+  Future<LocationPermission> requestPermission();
+
+  Future<Position?> getLastKnownPosition();
+
+  Future<Position> getCurrentPosition({
+    required LocationSettings locationSettings,
+  });
+
+  Stream<Position> getPositionStream({
+    required LocationSettings locationSettings,
+  });
+
+  Future<bool> openAppSettings();
+
+  Future<bool> openLocationSettings();
+}
+
+class DeviceLocationPlatformService implements LocationPlatformService {
+  @override
+  Future<bool> isLocationServiceEnabled() {
+    return Geolocator.isLocationServiceEnabled();
+  }
+
+  @override
+  Future<LocationPermission> checkPermission() {
+    return Geolocator.checkPermission();
+  }
+
+  @override
+  Future<LocationPermission> requestPermission() {
+    return Geolocator.requestPermission();
+  }
+
+  @override
+  Future<Position?> getLastKnownPosition() {
+    return Geolocator.getLastKnownPosition();
+  }
+
+  @override
+  Future<Position> getCurrentPosition({
+    required LocationSettings locationSettings,
+  }) {
+    return Geolocator.getCurrentPosition(locationSettings: locationSettings);
+  }
+
+  @override
+  Stream<Position> getPositionStream({
+    required LocationSettings locationSettings,
+  }) {
+    return Geolocator.getPositionStream(locationSettings: locationSettings);
+  }
+
+  @override
+  Future<bool> openAppSettings() {
+    return Geolocator.openAppSettings();
+  }
+
+  @override
+  Future<bool> openLocationSettings() {
+    return Geolocator.openLocationSettings();
+  }
+}

lib/features/settings/providers/settings_providers.dart

@@ -1,12 +1,13 @@
-import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
-import 'package:geolocator/geolocator.dart';
 
 import '../../homes/providers/homes_providers.dart';
+import '../../homes/providers/location_providers.dart';
 import '../../shared/providers/core_providers.dart';
 import '../models/app_theme_preset.dart';
 import '../models/geofence_system_state.dart';
 import '../models/notification_permission_status.dart';
+import '../services/geofence_system_status_service.dart';
+import '../services/notification_permission_status_service.dart';
 
 final initialAppThemePresetProvider = Provider<AppThemePreset>(
   (ref) => AppThemePreset.fallback,
@@ -29,53 +30,11 @@ class AppThemeNotifier extends Notifier<AppThemePreset> {
   }
 }
 
-abstract class GeofenceSystemStatusService {
-  Future<GeofenceSystemState> inspect({
-    required bool hasActiveHome,
-    required bool hasCoordinates,
-  });
-}
-
-class DeviceGeofenceSystemStatusService implements GeofenceSystemStatusService {
-  @override
-  Future<GeofenceSystemState> inspect({
-    required bool hasActiveHome,
-    required bool hasCoordinates,
-  }) async {
-    if (!hasActiveHome) {
-      return const GeofenceSystemState(GeofenceSystemIssue.noActiveHome);
-    }
-    if (!hasCoordinates) {
-      return const GeofenceSystemState(GeofenceSystemIssue.missingCoordinates);
-    }
-    if (!await Geolocator.isLocationServiceEnabled()) {
-      return const GeofenceSystemState(
-        GeofenceSystemIssue.locationServicesDisabled,
-      );
-    }
-
-    final permission = await Geolocator.checkPermission();
-    return switch (permission) {
-      LocationPermission.denied => const GeofenceSystemState(
-        GeofenceSystemIssue.permissionDenied,
-      ),
-      LocationPermission.deniedForever => const GeofenceSystemState(
-        GeofenceSystemIssue.permissionDeniedForever,
-      ),
-      LocationPermission.whileInUse => const GeofenceSystemState(
-        GeofenceSystemIssue.backgroundPermissionRequired,
-      ),
-      LocationPermission.always => const GeofenceSystemState(
-        GeofenceSystemIssue.ready,
-      ),
-      _ => const GeofenceSystemState(GeofenceSystemIssue.permissionDenied),
-    };
-  }
-}
-
 final geofenceSystemStatusServiceProvider =
     Provider<GeofenceSystemStatusService>(
-      (ref) => DeviceGeofenceSystemStatusService(),
+      (ref) => DeviceGeofenceSystemStatusService(
+        locationPlatformService: ref.read(locationPlatformServiceProvider),
+      ),
     );
 
 final geofenceSystemStatusProvider = FutureProvider<GeofenceSystemState>((
@@ -90,49 +49,6 @@ final geofenceSystemStatusProvider = FutureProvider<GeofenceSystemState>((
       );
 });
 
-abstract class NotificationPermissionStatusService {
-  Future<NotificationPermissionStatus> inspect();
-
-  Future<void> requestPermission();
-
-  Future<void> openSettings();
-}
-
-class DeviceNotificationPermissionStatusService
-    implements NotificationPermissionStatusService {
-  static const _channel = MethodChannel('ignis/geofence_automation');
-
-  @override
-  Future<NotificationPermissionStatus> inspect() async {
-    try {
-      final value = await _channel.invokeMethod<String>(
-        'getNotificationPermissionStatus',
-      );
-      return NotificationPermissionStatus.fromPlatformValue(value);
-    } on MissingPluginException {
-      return NotificationPermissionStatus.unsupported;
-    }
-  }
-
-  @override
-  Future<void> requestPermission() async {
-    try {
-      await _channel.invokeMethod<void>('requestNotificationPermission');
-    } on MissingPluginException {
-      return;
-    }
-  }
-
-  @override
-  Future<void> openSettings() async {
-    try {
-      await _channel.invokeMethod<void>('openNotificationSettings');
-    } on MissingPluginException {
-      return;
-    }
-  }
-}
-
 final notificationPermissionStatusServiceProvider =
     Provider<NotificationPermissionStatusService>(
       (ref) => DeviceNotificationPermissionStatusService(),

lib/features/settings/services/geofence_system_status_service.dart

@@ -0,0 +1,52 @@
+import 'package:geolocator/geolocator.dart';
+
+import '../../homes/services/location_platform_service.dart';
+import '../models/geofence_system_state.dart';
+
+abstract class GeofenceSystemStatusService {
+  Future<GeofenceSystemState> inspect({
+    required bool hasActiveHome,
+    required bool hasCoordinates,
+  });
+}
+
+class DeviceGeofenceSystemStatusService implements GeofenceSystemStatusService {
+  final LocationPlatformService locationPlatformService;
+
+  DeviceGeofenceSystemStatusService({required this.locationPlatformService});
+
+  @override
+  Future<GeofenceSystemState> inspect({
+    required bool hasActiveHome,
+    required bool hasCoordinates,
+  }) async {
+    if (!hasActiveHome) {
+      return const GeofenceSystemState(GeofenceSystemIssue.noActiveHome);
+    }
+    if (!hasCoordinates) {
+      return const GeofenceSystemState(GeofenceSystemIssue.missingCoordinates);
+    }
+    if (!await locationPlatformService.isLocationServiceEnabled()) {
+      return const GeofenceSystemState(
+        GeofenceSystemIssue.locationServicesDisabled,
+      );
+    }
+
+    final permission = await locationPlatformService.checkPermission();
+    return switch (permission) {
+      LocationPermission.denied => const GeofenceSystemState(
+        GeofenceSystemIssue.permissionDenied,
+      ),
+      LocationPermission.deniedForever => const GeofenceSystemState(
+        GeofenceSystemIssue.permissionDeniedForever,
+      ),
+      LocationPermission.whileInUse => const GeofenceSystemState(
+        GeofenceSystemIssue.backgroundPermissionRequired,
+      ),
+      LocationPermission.always => const GeofenceSystemState(
+        GeofenceSystemIssue.ready,
+      ),
+      _ => const GeofenceSystemState(GeofenceSystemIssue.permissionDenied),
+    };
+  }
+}

lib/features/settings/services/notification_permission_status_service.dart

@@ -0,0 +1,46 @@
+import 'package:flutter/services.dart';
+
+import '../models/notification_permission_status.dart';
+
+abstract class NotificationPermissionStatusService {
+  Future<NotificationPermissionStatus> inspect();
+
+  Future<void> requestPermission();
+
+  Future<void> openSettings();
+}
+
+class DeviceNotificationPermissionStatusService
+    implements NotificationPermissionStatusService {
+  static const _channel = MethodChannel('ignis/geofence_automation');
+
+  @override
+  Future<NotificationPermissionStatus> inspect() async {
+    try {
+      final value = await _channel.invokeMethod<String>(
+        'getNotificationPermissionStatus',
+      );
+      return NotificationPermissionStatus.fromPlatformValue(value);
+    } on MissingPluginException {
+      return NotificationPermissionStatus.unsupported;
+    }
+  }
+
+  @override
+  Future<void> requestPermission() async {
+    try {
+      await _channel.invokeMethod<void>('requestNotificationPermission');
+    } on MissingPluginException {
+      return;
+    }
+  }
+
+  @override
+  Future<void> openSettings() async {
+    try {
+      await _channel.invokeMethod<void>('openNotificationSettings');
+    } on MissingPluginException {
+      return;
+    }
+  }
+}

lib/screens/home_edit_screen.dart

@@ -1,6 +1,7 @@
 import 'package:flutter/material.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import '../app/error_message.dart';
+import '../features/homes/services/home_connection_change.dart';
 import '../models/home_config.dart';
 import '../providers/providers.dart';
 import '../services/api_client.dart';
@@ -23,6 +24,8 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
   final _latCtrl = TextEditingController();
   final _lonCtrl = TextEditingController();
   bool _saving = false;
+  bool _loadingApiKey = false;
+  String _originalApiKey = '';
 
   bool get _isEdit => widget.home != null;
 
@@ -42,6 +45,7 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
       if (widget.home!.longitude != null) {
         _lonCtrl.text = widget.home!.longitude.toString();
       }
+      _loadingApiKey = true;
       _loadApiKey();
     }
 
@@ -51,11 +55,19 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
   }
 
   Future<void> _loadApiKey() async {
-    final apiKey = await ref
+    try {
-        .read(settingsServiceProvider)
+      final apiKey = await ref
-        .getHomeApiKey(widget.home!.id);
+          .read(settingsServiceProvider)
-    if (mounted && apiKey != null) {
+          .getHomeApiKey(widget.home!.id);
-      _keyCtrl.text = apiKey;
+      _originalApiKey = apiKey ?? '';
+      if (!mounted) {
+        return;
+      }
+      _keyCtrl.text = _originalApiKey;
+    } finally {
+      if (mounted) {
+        setState(() => _loadingApiKey = false);
+      }
     }
   }
 
@@ -130,10 +142,12 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
               const SizedBox(height: 12),
               TextFormField(
                 controller: _keyCtrl,
-                decoration: const InputDecoration(
+                decoration: InputDecoration(
                   labelText: 'API Key',
-                  helperText: 'Ключ проверяется перед сохранением дома',
+                  helperText: _loadingApiKey
-                  prefixIcon: Icon(Icons.key),
+                      ? 'Загружаем сохранённый ключ...'
+                      : 'Ключ проверяется только при изменении подключения',
+                  prefixIcon: const Icon(Icons.key),
                 ),
                 obscureText: true,
                 validator: (value) =>
@@ -236,7 +250,7 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
                     backgroundColor: Colors.deepOrange,
                     foregroundColor: Colors.white,
                   ),
-                  onPressed: _saving ? null : _save,
+                  onPressed: (_saving || _loadingApiKey) ? null : _save,
                   child: _saving
                       ? const SizedBox(
                           width: 20,
@@ -259,6 +273,12 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
 
   Future<void> _save() async {
     FocusScope.of(context).unfocus();
+    if (_loadingApiKey) {
+      ScaffoldMessenger.of(context).showSnackBar(
+        const SnackBar(content: Text('Подождите, API key ещё загружается')),
+      );
+      return;
+    }
     if (!_formKey.currentState!.validate()) {
       return;
     }
@@ -319,6 +339,12 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
     setState(() => _saving = true);
 
     final clearCoords = latText.isEmpty && lonText.isEmpty;
+    final credentialsChanged = hasHomeConnectionChanges(
+      originalHome: widget.home,
+      normalizedUrl: url,
+      apiKey: key,
+      originalApiKey: _originalApiKey,
+    );
 
     final home = _isEdit
         ? widget.home!.copyWith(
@@ -337,17 +363,25 @@ class _HomeEditScreenState extends ConsumerState<HomeEditScreen> {
           );
 
     try {
-      await ref.read(apiProvider).validateCredentials(url, key);
+      if (credentialsChanged) {
+        await ref.read(apiProvider).validateCredentials(url, key);
+      }
 
       if (_isEdit) {
-        await ref.read(homesProvider.notifier).update(home, apiKey: key);
+        await ref
+            .read(homesProvider.notifier)
+            .update(home, apiKey: credentialsChanged ? key : null);
       } else {
         await ref.read(homesProvider.notifier).add(home, apiKey: key);
       }
 
       final currentHome = ref.read(currentHomeProvider);
       if (currentHome?.id == home.id) {
-        await ref.read(currentHomeProvider.notifier).select(home);
+        if (credentialsChanged) {
+          await ref.read(currentHomeProvider.notifier).select(home);
+        } else {
+          await ref.read(currentHomeProvider.notifier).switchTo(home);
+        }
       }
 
       if (mounted) Navigator.of(context).pop();

lib/screens/homes_screen.dart

@@ -277,6 +277,11 @@ class _HomesScreenState extends ConsumerState<HomesScreen>
     final shouldWatch = ref
         .read(homesProvider)
         .any((home) => home.hasCoordinates);
+    if (shouldWatch && _isWatchingLocation) {
+      await _userLocationNotifier.ensureWatchingStarted();
+      return;
+    }
+
     if (shouldWatch == _isWatchingLocation) {
       return;
     }

test/forms_widget_test.dart

@@ -189,7 +189,10 @@ void main() {
     expect(savedHome.latitude, 55.75);
     expect(savedHome.longitude, 37.61);
     expect(savedHome.geofenceEnabled, isFalse);
-    expect(savedHome.geofenceRadiusMeters, HomeConfig.defaultGeofenceRadiusMeters);
+    expect(
+      savedHome.geofenceRadiusMeters,
+      HomeConfig.defaultGeofenceRadiusMeters,
+    );
     expect(savedApiKey, 'secret-key');
   });
 }

test/geofence_system_status_provider_test.dart

@@ -1,6 +1,7 @@
 import 'package:flutter_test/flutter_test.dart';
 import 'package:ignis_app/features/settings/models/geofence_system_state.dart';
 import 'package:ignis_app/features/settings/providers/settings_providers.dart';
+import 'package:ignis_app/features/settings/services/geofence_system_status_service.dart';
 import 'package:ignis_app/providers/providers.dart';
 import 'package:ignis_app/services/settings_service.dart';
 import 'package:shared_preferences/shared_preferences.dart';

test/home_connection_change_test.dart

@@ -0,0 +1,64 @@
+import 'package:flutter_test/flutter_test.dart';
+import 'package:ignis_app/features/homes/services/home_connection_change.dart';
+import 'package:ignis_app/models/home_config.dart';
+
+void main() {
+  test('new home always requires connection validation', () {
+    expect(
+      hasHomeConnectionChanges(
+        originalHome: null,
+        normalizedUrl: 'https://ignis.akokos.ru',
+        apiKey: 'secret-key',
+        originalApiKey: '',
+      ),
+      isTrue,
+    );
+  });
+
+  test('local-only home edits do not require connection validation', () {
+    final originalHome = HomeConfig(
+      id: 'home-1',
+      name: 'Квартира',
+      url: 'https://ignis.akokos.ru',
+      latitude: 55.75,
+      longitude: 37.61,
+    );
+
+    expect(
+      hasHomeConnectionChanges(
+        originalHome: originalHome,
+        normalizedUrl: originalHome.url,
+        apiKey: 'saved-key',
+        originalApiKey: 'saved-key',
+      ),
+      isFalse,
+    );
+  });
+
+  test('url or api key changes still require connection validation', () {
+    final originalHome = HomeConfig(
+      id: 'home-1',
+      name: 'Квартира',
+      url: 'https://ignis.akokos.ru',
+    );
+
+    expect(
+      hasHomeConnectionChanges(
+        originalHome: originalHome,
+        normalizedUrl: 'https://new.ignis.akokos.ru',
+        apiKey: 'saved-key',
+        originalApiKey: 'saved-key',
+      ),
+      isTrue,
+    );
+    expect(
+      hasHomeConnectionChanges(
+        originalHome: originalHome,
+        normalizedUrl: originalHome.url,
+        apiKey: 'new-key',
+        originalApiKey: 'saved-key',
+      ),
+      isTrue,
+    );
+  });
+}

test/notification_permission_status_provider_test.dart

@@ -2,6 +2,7 @@ import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:flutter_test/flutter_test.dart';
 import 'package:ignis_app/features/settings/models/notification_permission_status.dart';
 import 'package:ignis_app/features/settings/providers/settings_providers.dart';
+import 'package:ignis_app/features/settings/services/notification_permission_status_service.dart';
 
 void main() {
   TestWidgetsFlutterBinding.ensureInitialized();

test/user_location_provider_test.dart

@@ -0,0 +1,127 @@
+import 'dart:async';
+
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+import 'package:flutter_test/flutter_test.dart';
+import 'package:geolocator/geolocator.dart';
+import 'package:ignis_app/features/homes/providers/location_providers.dart';
+import 'package:ignis_app/features/homes/services/location_platform_service.dart';
+
+void main() {
+  TestWidgetsFlutterBinding.ensureInitialized();
+
+  test(
+    'location watcher does not auto-request permission when denied',
+    () async {
+      final service = _FakeLocationPlatformService();
+      final container = ProviderContainer(
+        overrides: [locationPlatformServiceProvider.overrideWithValue(service)],
+      );
+      addTearDown(() async {
+        await service.dispose();
+        container.dispose();
+      });
+
+      final notifier = container.read(userLocationProvider.notifier);
+      await notifier.startWatching();
+      await notifier.refresh();
+
+      expect(service.requestPermissionCalls, 0);
+      expect(service.getPositionStreamCalls, 0);
+      expect(
+        container.read(userLocationProvider).issue,
+        UserLocationIssue.permissionDenied,
+      );
+    },
+  );
+
+  test('location watcher resumes after permission is granted later', () async {
+    final service = _FakeLocationPlatformService();
+    final container = ProviderContainer(
+      overrides: [locationPlatformServiceProvider.overrideWithValue(service)],
+    );
+    addTearDown(() async {
+      await service.dispose();
+      container.dispose();
+    });
+
+    final notifier = container.read(userLocationProvider.notifier);
+    await notifier.startWatching();
+
+    service.permission = LocationPermission.always;
+    await notifier.ensureWatchingStarted();
+
+    expect(service.requestPermissionCalls, 0);
+    expect(service.getPositionStreamCalls, 1);
+  });
+
+  test('explicit location request asks Android and starts watching', () async {
+    final service = _FakeLocationPlatformService();
+    service.requestPermissionResult = LocationPermission.always;
+    final container = ProviderContainer(
+      overrides: [locationPlatformServiceProvider.overrideWithValue(service)],
+    );
+    addTearDown(() async {
+      await service.dispose();
+      container.dispose();
+    });
+
+    final notifier = container.read(userLocationProvider.notifier);
+    await notifier.startWatching();
+    await notifier.requestPermission();
+
+    expect(service.requestPermissionCalls, 1);
+    expect(service.getPositionStreamCalls, 1);
+  });
+}
+
+class _FakeLocationPlatformService implements LocationPlatformService {
+  final StreamController<Position> _positionController =
+      StreamController<Position>.broadcast();
+
+  bool locationServiceEnabled = true;
+  LocationPermission permission = LocationPermission.denied;
+  LocationPermission requestPermissionResult = LocationPermission.denied;
+  int requestPermissionCalls = 0;
+  int getPositionStreamCalls = 0;
+
+  Future<void> dispose() async {
+    await _positionController.close();
+  }
+
+  @override
+  Future<LocationPermission> checkPermission() async => permission;
+
+  @override
+  Stream<Position> getPositionStream({
+    required LocationSettings locationSettings,
+  }) {
+    getPositionStreamCalls += 1;
+    return _positionController.stream;
+  }
+
+  @override
+  Future<Position> getCurrentPosition({
+    required LocationSettings locationSettings,
+  }) {
+    throw UnimplementedError();
+  }
+
+  @override
+  Future<Position?> getLastKnownPosition() async => null;
+
+  @override
+  Future<bool> isLocationServiceEnabled() async => locationServiceEnabled;
+
+  @override
+  Future<bool> openAppSettings() async => true;
+
+  @override
+  Future<bool> openLocationSettings() async => true;
+
+  @override
+  Future<LocationPermission> requestPermission() async {
+    requestPermissionCalls += 1;
+    permission = requestPermissionResult;
+    return permission;
+  }
+}