add code 2

README.md

@@ -38,8 +38,9 @@ cargo leptos watch
 
 Copy `dev.env` to `.env`, then replace the placeholder with a unique secret
 before starting the server. The `.env` file is loaded automatically at startup
-and is ignored by Git. `DEV_SECRET_KEY` authorizes server status changes and
-submission-history access:
+and is ignored by Git. Startup validates the required settings and stops with a
+clear error if any are missing or malformed. `DEV_SECRET_KEY` authorizes server
+status changes and submission-history access:
 
 ```powershell
 Copy-Item dev.env .env
@@ -48,6 +49,99 @@ Copy-Item dev.env .env
 You can also provide `DEV_SECRET_KEY` through the process environment. Do not
 commit secrets or expose them in client-side code.
 
+Code 1 sends an SMS through TextBee when the server is live. Set
+`TEXTBEE_API_KEY`, `RECIPIENT_SELF`, `RECIPIENT_1`, and `RECIPIENT_2` (each a
+single E.164 number) in `.env`; `TEXTBEE_DEVICE_ID` is optional and selects a
+specific paired device. When live, code 1 sends a notification to self, the
+congratulations message to recipients 1 and 2, then `CHALLENGE_1_FIRST` to
+recipient 1 and `CHALLENGE_1_SECOND` to recipient 2. The latter two are sent
+literally as written. When offline, the planned messages are logged instead.
+TextBee acceptance means a message was queued, not necessarily delivered.
+
+Code 2 uses the former manual code value (`Qj4eAn`). On successful submission,
+it sends a notification to `RECIPIENT_SELF` while the server is live (and logs
+the notification instead while offline). The result page displays
+`NEXT_STEP_TEXT` from `src/codes/code2.rs`; replace its TODO text with the next
+step when ready.
+
+The robot submits code 1 with `POST /event/buzz` and a JSON body containing
+`delta_ms` (a signed integer) and `signature` (hex-encoded HMAC-SHA256). The
+signature is the HMAC of the UTF-8 decimal representation of `delta_ms`, using
+`CODE1_HMAC_SECRET` as the key. Set `CODE1_HMAC_SECRET` to a unique random
+secret of at least 32 bytes in `.env`; for example:
+
+```json
+{"delta_ms":-42,"signature":"<64 hex characters>"}
+```
+
+### Test code1 with Postman
+
+Create a `POST` request to `http://127.0.0.1:3000/event/buzz`, select **Body >
+raw > JSON**, and use this body:
+
+```json
+{
+  "delta_ms": {{delta_ms}},
+  "signature": "{{buzz_signature}}"
+}
+```
+
+Add a Postman pre-request script to calculate the signature:
+
+```javascript
+const deltaMs = pm.environment.get("delta_ms") || "-42";
+const secret = pm.environment.get("CODE1_HMAC_SECRET");
+
+if (!secret) {
+  throw new Error("Set CODE1_HMAC_SECRET in the active Postman environment");
+}
+
+pm.environment.set("delta_ms", deltaMs);
+pm.environment.set(
+  "buzz_signature",
+  CryptoJS.HmacSHA256(String(deltaMs), secret).toString(CryptoJS.enc.Hex)
+);
+```
+
+Set `CODE1_HMAC_SECRET` in the active Postman environment to the same value as
+in `.env`. Set `delta_ms` to a signed integer (for example `-42`) to change the
+test event. A successful request returns HTTP `202`.
+
+### Test code1 with Node.js
+
+With the server running and `CODE1_HMAC_SECRET` set in your shell, this sends a
+single test event:
+
+```javascript
+const { createHmac } = require("node:crypto");
+
+async function main() {
+  const deltaMs = -42;
+  const secret = process.env.CODE1_HMAC_SECRET;
+  if (!secret) throw new Error("CODE1_HMAC_SECRET is not set");
+
+  const signature = createHmac("sha256", secret)
+    .update(String(deltaMs), "utf8")
+    .digest("hex");
+
+  const response = await fetch("http://127.0.0.1:3000/event/buzz", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ delta_ms: deltaMs, signature }),
+  });
+
+  console.log(response.status, await response.text());
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});
+```
+
+When the server is live, a successful test event sends the configured TextBee
+SMS to the configured recipients. When it is offline, it only logs the message.
+
 ## Installing Additional Tools
 
 By default, `cargo-leptos` uses `nightly` Rust, `cargo-generate`, and `sass`. If you run into any trouble, you may need to install one or more of these tools.