From f9fb9f59f427e410281a89468edbbca1b13c6965 Mon Sep 17 00:00:00 2001
From: Brent Perteet <brent.perteet@gmail.com>
Date: Thu, 20 Aug 2026 15:43:42 -0500
Subject: [PATCH] fix(S2-b): use authenticated WSS on standard TLS port

---
 FieldLogger/Services/SettingsService.cs      |  2 +-
 FieldLogger/Services/Sync/MqttSyncService.cs |  3 +++
 FieldLogger/ViewModels/SettingsViewModel.cs  |  2 +-
 FieldLogger/Views/SettingsPage.xaml          |  2 +-
 src/FieldLogger.Sync/MqttnetTransport.cs     | 14 +++++++++++---
 5 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/FieldLogger/Services/SettingsService.cs b/FieldLogger/Services/SettingsService.cs
index 0710eb7..d9a582a 100644
--- a/FieldLogger/Services/SettingsService.cs
+++ b/FieldLogger/Services/SettingsService.cs
@@ -73,7 +73,7 @@ public sealed class SettingsService
 
     public int MqttPort
     {
-        get => Preferences.Default.Get(MqttPortKey, 8884);
+        get => Preferences.Default.Get(MqttPortKey, 443);
         set => Preferences.Default.Set(MqttPortKey, value);
     }
 
diff --git a/FieldLogger/Services/Sync/MqttSyncService.cs b/FieldLogger/Services/Sync/MqttSyncService.cs
index 4044d47..542fc6e 100644
--- a/FieldLogger/Services/Sync/MqttSyncService.cs
+++ b/FieldLogger/Services/Sync/MqttSyncService.cs
@@ -185,6 +185,9 @@ public sealed class MqttSyncService : IMqttSyncService
             {
                 Host = _settings.MqttHost,
                 Port = _settings.MqttPort,
+                WebSocketUri = _settings.MqttPort == 443
+                    ? $"wss://{_settings.MqttHost}/mqtt"
+                    : null,
                 ClientId = _settings.MqttClientId,
                 Username = _settings.MqttOrgId,
                 Password = password,
diff --git a/FieldLogger/ViewModels/SettingsViewModel.cs b/FieldLogger/ViewModels/SettingsViewModel.cs
index 2868b24..73586ec 100644
--- a/FieldLogger/ViewModels/SettingsViewModel.cs
+++ b/FieldLogger/ViewModels/SettingsViewModel.cs
@@ -24,7 +24,7 @@ public sealed partial class SettingsViewModel : ObservableObject
     private string _mqttHost = "";
 
     [ObservableProperty]
-    private string _mqttPort = "8884";
+    private string _mqttPort = "443";
 
     [ObservableProperty]
     private string _mqttOrgId = "";
diff --git a/FieldLogger/Views/SettingsPage.xaml b/FieldLogger/Views/SettingsPage.xaml
index 6b2ff2e..62a7ccb 100644
--- a/FieldLogger/Views/SettingsPage.xaml
+++ b/FieldLogger/Views/SettingsPage.xaml
@@ -58,7 +58,7 @@
                         <Switch Grid.Column="1" IsToggled="{Binding MqttEnabled}" />
                     </Grid>
                     <Entry Text="{Binding MqttHost}" Placeholder="dev.hub.umagul.net" />
-                    <Entry Text="{Binding MqttPort}" Placeholder="8884" Keyboard="Numeric" />
+                    <Entry Text="{Binding MqttPort}" Placeholder="443 (WSS) or 8884 (MQTTS)" Keyboard="Numeric" />
                     <Entry Text="{Binding MqttOrgId}" Placeholder="Organization ID / MQTT username" />
                     <Entry Text="{Binding MqttPassword}" Placeholder="New MQTT password (stored securely)" IsPassword="True" />
                     <Label Text="{Binding MqttClientId, StringFormat='Client: {0}'}" FontSize="10" TextColor="Gray" />
diff --git a/src/FieldLogger.Sync/MqttnetTransport.cs b/src/FieldLogger.Sync/MqttnetTransport.cs
index 0299e95..391ea57 100644
--- a/src/FieldLogger.Sync/MqttnetTransport.cs
+++ b/src/FieldLogger.Sync/MqttnetTransport.cs
@@ -11,7 +11,10 @@ namespace FieldLogger.Sync;
 public sealed record MqttBrokerConfig
 {
     public required string Host { get; init; }
-    public int Port { get; init; } = 8884;
+    public int Port { get; init; } = 443;
+    /// <summary>When set, use MQTT over secure WebSockets (normally
+    /// wss://dev.hub.umagul.net/mqtt) instead of raw MQTTS.</summary>
+    public string? WebSocketUri { get; init; }
     public bool UseTls { get; init; } = true;
     public required string ClientId { get; init; }
     /// <summary>Interim credential (username = orgId, password = scoped per-org secret).
@@ -52,8 +55,13 @@ public sealed class MqttnetTransport : IMqttTransport, IAsyncDisposable
 
         _ackTopic = ackTopic;
 
-        var options = new MqttClientOptionsBuilder()
-            .WithTcpServer(_config.Host, _config.Port)
+        var builder = new MqttClientOptionsBuilder();
+        if (string.IsNullOrWhiteSpace(_config.WebSocketUri))
+            builder.WithTcpServer(_config.Host, _config.Port);
+        else
+            builder.WithWebSocketServer(options => options.WithUri(_config.WebSocketUri));
+
+        var options = builder
             .WithClientId(_config.ClientId)
             .WithProtocolVersion(MQTTnet.Formatter.MqttProtocolVersion.V500)
             .WithCleanSession(false)                                  // persistent session (durable)