Improve warning messages for insecure inclusion

[marcelveldt]

Issues/improvements

1. Show right after the node was added, not at the end of the interview --> Z-Wave JS: Notification for error during secure inclusion is only shown after the interview home-assistant/core#117636

2. Distinguish between the different reasons for insecure inclusion instead of "an error". See feat: include reason for low security in "node added" parameter node-zwave-js#5570 for details

3. If a node has been security bootstrapped with the S0 Command Class in an S2 capable network, the SIS / Primary controller MUST issue a warning message to the user informing that the node has not been included securely. Requires 2. on the HA side

TODO Home Assistant (frontend):

1. Show big fat warning that the node is being included insecurely at the start of the process.

2. Show specific error message when inclusion failed, so show as much info as possible. The Driver has been adjusted to deliver this info.

3. Show warning that the node was NOT added securely (despite the fact that the user choose secure inclusion).

[MindFreeze]

@marcelveldt I don't understand point 3. We already show a warning when the interview is finished. Is this about showing the specific error? Then it would just part of point 2, no?

[marcelveldt]

@marcelveldt I don't understand point 3. We already show a warning when the interview is finished. Is this about showing the specific error? Then it would just part of point 2, no?

@AlCalzone can explain this better than me but apparently it can be true that you choose secure inclusion but in the end the controller did not do that and the node got included without security.

[MindFreeze]

Sounds like displaying the reason after the node is added covers this, so if 1 & 2 are done, 3 is also covered

[AlCalzone]

I'll have to double check 3. - don't remember right now whether that required additional work.

[AlCalzone]

I'm getting this error now when a device was granted the S0 key in an S2-capable network:

node-zwave-js SHOULD expose the reason SecurityBootstrapFailure.S0Downgrade, so we should be able to warn that a possible S0 downgrade attack has happened.

Will need to investigate to see where this info got lost.