# Changelog of OCPP CSMS Smoke Test — Virtual Charge Point (`tiger19935/ocpp-csms-smoke-test`) Actor

- **URL**: https://apify.com/tiger19935/ocpp-csms-smoke-test/changelog.md
- **Full Actor documentation**: https://apify.com/tiger19935/ocpp-csms-smoke-test.md

## Changelog

### 1.0.1 (2026-10)

- Documentation: pricing section no longer hard-codes a price (see the Pricing tab); three ready-made example tasks (boot, charging session, responder).

### 1.0 (2026-10)

- First release: a virtual OCPP 1.6J charge point with the scenarios `connect`, `boot`, `basic-charge` and `responder`, and a step-by-step PASS / WARN / FAIL report (request, response, latency per message).
- Hand-written validators for the BootNotification, Heartbeat, StatusNotification, Authorize, StartTransaction, MeterValues and StopTransaction responses; detection of CALLERROR, timeouts, invalid JSON, wrong message ids / types, closed connections, oversized frames and message floods.
- Responder scenario: Reset, RemoteStartTransaction, RemoteStopTransaction, ChangeConfiguration, GetConfiguration, TriggerMessage, UnlockConnector, ChangeAvailability, DataTransfer and ClearCache are acknowledged without executing anything; unknown calls get CALLERROR NotImplemented.
- Abuse controls: mandatory consent, wss only, ports 443 / 8000-9999, no URL credentials, no private / internal targets (DNS resolved once, rebinding safe), no redirects, 3 runs per hour per target host, identifying handshake headers, hard limits (120 s, 200 messages, 1 MB).
- HTTP Basic authentication; the password is never logged, stored or returned.
- Pay-per-event pricing: one `smoke-run` per run that reached the CSMS; restart safe and within the user's maximum cost per run.
- Review hardening: rate limit keyed on a canonical host (case, trailing dot, IPv6 / mapped IPv4 forms) plus per-server-address (10/h) and per-account (30/h) caps, one storage key per run so parallel runs cannot overwrite each other; cleanup `StopTransaction` after a failure inside an open transaction; a date-time without time zone is a warning; `TriggerMessage` is only accepted in the responder scenario.