From 1927330c881850405de27772c29b45ec5434224f Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Thu, 23 Jul 2026 12:47:15 +0200
Subject: [PATCH 1/4] hotspot-to-wpa: rework for RouterOS 7.24 compatibility

---
 README.md                         |   2 +-
 doc/hotspot-to-wpa.md             |  21 +++---
 global-functions.rsc              |   2 +-
 hotspot-to-wpa-lease.capsman.rsc  | 100 ++++++++++++++++++++++++
 hotspot-to-wpa-lease.template.rsc | 120 +++++++++++++++++++++++++++++
 hotspot-to-wpa-lease.wifi.rsc     |  97 ++++++++++++++++++++++++
 hotspot-to-wpa.capsman.rsc        | 103 ++++++-------------------
 hotspot-to-wpa.template.rsc       | 121 ++++++------------------------
 hotspot-to-wpa.wifi.rsc           | 100 ++++++------------------
 news-and-changes.rsc              |   2 +
 10 files changed, 408 insertions(+), 260 deletions(-)
 create mode 100644 hotspot-to-wpa-lease.capsman.rsc
 create mode 100644 hotspot-to-wpa-lease.template.rsc
 create mode 100644 hotspot-to-wpa-lease.wifi.rsc

diff --git a/README.md b/README.md
index 9985bb2b..1af57a07 100644
--- a/README.md
+++ b/README.md
@@ -288,7 +288,7 @@ Available scripts
 * [Download, import and update firewall address-lists](doc/fw-addr-lists.md) (`fw-addr-lists`)
 * [Wait for global functions und modules](doc/global-wait.md) (`global-wait`)
 * [Send GPS position to server](doc/gps-track.md) (`gps-track`)
-* [Use WPA network with hotspot credentials](doc/hotspot-to-wpa.md) (`hotspot-to-wpa` & `hotspot-to-wpa-cleanup`)
+* [Use WPA network with hotspot credentials](doc/hotspot-to-wpa.md) (`hotspot-to-wpa`, `hotspot-to-wpa-lease` & `hotspot-to-wpa-cleanup`)
 * [Create DNS records for IPSec peers](doc/ipsec-to-dns.md) (`ipsec-to-dns`)
 * [Update configuration on IPv6 prefix change](doc/ipv6-update.md) (`ipv6-update`)
 * [Manage IP addresses with bridge status](doc/ip-addr-bridge.md) (`ip-addr-bridge`)
diff --git a/doc/hotspot-to-wpa.md b/doc/hotspot-to-wpa.md
index 9b3b1976..5a00f44e 100644
--- a/doc/hotspot-to-wpa.md
+++ b/doc/hotspot-to-wpa.md
@@ -26,35 +26,38 @@ Requirements and installation
 You need a properly configured hotspot on one (open) SSID and a WPA enabled
 SSID with suffix "`-wpa`".
 
-Then install the script.
-Depending on whether you use `wifi` package (`/interface/wifi`)or legacy
-wifi with CAPsMAN (`/caps-man`) you need to install a different script and
-set it as `on-login` script in hotspot.
+Then install the scripts. Depending on whether you use `wifi` package
+(`/interface/wifi`) or legacy wireless with CAPsMAN (`/caps-man`) you need
+to install a different set of scripts. Then set the `on-login` script in hotspot.
 
 For `wifi`:
 
-    $ScriptInstallUpdate hotspot-to-wpa.wifi;
+    $ScriptInstallUpdate hotspot-to-wpa.wifi,hotspot-to-wpa-lease.wifi,dhcpv4-server-lease;
     /ip/hotspot/user/profile/set on-login="hotspot-to-wpa.wifi" [ find ];
 
 For legacy CAPsMAN:
 
-    $ScriptInstallUpdate hotspot-to-wpa.capsman;
+    $ScriptInstallUpdate hotspot-to-wpa.wifi,hotspot-to-wpa-lease.capsman,dhcpv4-server-lease;
     /ip/hotspot/user/profile/set on-login="hotspot-to-wpa.capsman" [ find ];
 
+Finally ad add the lease script your hotspot interfaces' dhcp server.
+
+    /ip/dhcp-server/set lease-script="dhcpv4-server-lease" hotspot;
+
 ### Automatic cleanup
 
-With just `hotspot-to-wpa` installed the mac addresses will last in the
+With just the above scripts installed the mac addresses will last in the
 access list forever. Install the optional script for automatic cleanup
 and add a scheduler.
 
 For `wifi`:
 
-    $ScriptInstallUpdate hotspot-to-wpa-cleanup.wifi,dhcpv4-server-lease;
+    $ScriptInstallUpdate hotspot-to-wpa-cleanup.wifi;
     /system/scheduler/add interval=1d name="hotspot-to-wpa-cleanup" on-event="/system/script/run hotspot-to-wpa-cleanup.wifi;" start-time=startup;
 
 For legacy CAPsMAN:
 
-    $ScriptInstallUpdate hotspot-to-wpa-cleanup.capsman,dhcpv4-server-lease;
+    $ScriptInstallUpdate hotspot-to-wpa-cleanup.capsman;
     /system/scheduler/add interval=1d name="hotspot-to-wpa-cleanup" on-event="/system/script/run hotspot-to-wpa-cleanup.capsman;" start-time=startup;
 
 And add the lease script and matcher comment to your wpa interfaces' dhcp
diff --git a/global-functions.rsc b/global-functions.rsc
index 6da5e740..414f70c5 100644
--- a/global-functions.rsc
+++ b/global-functions.rsc
@@ -15,7 +15,7 @@
 # Git commit id & info, expected configuration version
 :global CommitId "unknown";
 :global CommitInfo "unknown";
-:global ExpectedConfigVersion 144;
+:global ExpectedConfigVersion 145;
 
 # global variables not to be changed by user
 :global GlobalFunctionsReady false;
diff --git a/hotspot-to-wpa-lease.capsman.rsc b/hotspot-to-wpa-lease.capsman.rsc
new file mode 100644
index 00000000..e237eae6
--- /dev/null
+++ b/hotspot-to-wpa-lease.capsman.rsc
@@ -0,0 +1,100 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa-lease.capsman
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# provides: dhcpv4-server-lease, order=40
+# requires RouterOS, version=7.21
+# requires device-mode, hotspot
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+#
+# !! Do not edit this file, it is generated from template!
+
+:local ExitOK false;
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
+  :local ScriptName [ :jobname ];
+
+  :global EitherOr;
+  :global LogPrint;
+  :global ParseKeyValueStore;
+  :global ScriptLock;
+
+  :if ([ $ScriptLock $ScriptName ] = false) do={
+    :set ExitOK true;
+    :error false;
+  }
+
+  :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+    /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
+  }
+  :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
+    :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+    /ip/dhcp-server/lease/remove $Lease;
+
+    :if (($LeaseVal->"hotspot-to-wpa") != true) do={
+      :continue;
+    }
+
+    :local MacAddress $"mac-address";
+    :local UserName $username;
+
+    :local Date [ /system/clock/get date ];
+    :local UserVal ({});
+    :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+      :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+    }
+    :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
+    :if ([ :len [ /caps-man/access-list/find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
+      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+    }
+    :local Template [ /caps-man/access-list/get ([ find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+
+    $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
+      " (user " . $UserName . ").");
+    /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+        mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+        action=reject place-before=$PlaceBefore;
+
+    :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
+        comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
+    :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
+    :if ([ :len $PrivatePassphrase ] > 0) do={
+      :if ($PrivatePassphrase = "ignore") do={
+        /caps-man/access-list/set $Entry !private-passphrase;
+      } else={
+        /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
+      }
+    }
+    :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
+    :if ([ :len $SsidRegexp ] > 0) do={
+      /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
+    }
+    :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
+    :if ([ :len $VlanId ] > 0) do={
+      /caps-man/access-list/set $Entry vlan-id=$VlanId;
+    }
+    :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
+    :if ([ :len $VlanMode] > 0) do={
+      /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
+    }
+
+    :delay 2s;
+    /caps-man/access-list/set $Entry action=accept;
+  }
+} do={
+  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+}
diff --git a/hotspot-to-wpa-lease.template.rsc b/hotspot-to-wpa-lease.template.rsc
new file mode 100644
index 00000000..b432a756
--- /dev/null
+++ b/hotspot-to-wpa-lease.template.rsc
@@ -0,0 +1,120 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa-lease%TEMPL%
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# provides: dhcpv4-server-lease, order=40
+# requires RouterOS, version=7.21
+# requires device-mode, hotspot
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+#
+# !! This is just a template to generate the real script!
+# !! Pattern '%TEMPL%' is replaced, paths are filtered.
+
+:local ExitOK false;
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
+  :local ScriptName [ :jobname ];
+
+  :global EitherOr;
+  :global LogPrint;
+  :global ParseKeyValueStore;
+  :global ScriptLock;
+
+  :if ([ $ScriptLock $ScriptName ] = false) do={
+    :set ExitOK true;
+    :error false;
+  }
+
+  :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+  :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+    /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+    /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
+  }
+  :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+  :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
+    :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+    /ip/dhcp-server/lease/remove $Lease;
+
+    :if (($LeaseVal->"hotspot-to-wpa") != true) do={
+      :continue;
+    }
+
+    :local MacAddress $"mac-address";
+    :local UserName $username;
+
+    :local Date [ /system/clock/get date ];
+    :local UserVal ({});
+    :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+      :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+    }
+    :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
+    :if ([ :len [ /caps-man/access-list/find where \
+    :if ([ :len [ /interface/wifi/access-list/find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
+      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+    }
+    :local Template [ /caps-man/access-list/get ([ find where \
+    :local Template [ /interface/wifi/access-list/get ([ find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+
+    $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
+      " (user " . $UserName . ").");
+    /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+    /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+        mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+        action=reject place-before=$PlaceBefore;
+
+    :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
+    :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
+        comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
+# NOT /caps-man/ #
+    :set ($Template->"private-passphrase") ($Template->"passphrase");
+# NOT /caps-man/ #
+    :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
+    :if ([ :len $PrivatePassphrase ] > 0) do={
+      :if ($PrivatePassphrase = "ignore") do={
+        /caps-man/access-list/set $Entry !private-passphrase;
+        /interface/wifi/access-list/set $Entry !passphrase;
+      } else={
+        /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
+        /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
+      }
+    }
+    :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
+    :if ([ :len $SsidRegexp ] > 0) do={
+      /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
+      /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
+    }
+    :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
+    :if ([ :len $VlanId ] > 0) do={
+      /caps-man/access-list/set $Entry vlan-id=$VlanId;
+      /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
+    }
+# NOT /interface/wifi/ #
+    :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
+    :if ([ :len $VlanMode] > 0) do={
+      /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
+    }
+# NOT /interface/wifi/ #
+
+    :delay 2s;
+    /caps-man/access-list/set $Entry action=accept;
+    /interface/wifi/access-list/set $Entry action=accept;
+  }
+} do={
+  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+}
diff --git a/hotspot-to-wpa-lease.wifi.rsc b/hotspot-to-wpa-lease.wifi.rsc
new file mode 100644
index 00000000..7e152863
--- /dev/null
+++ b/hotspot-to-wpa-lease.wifi.rsc
@@ -0,0 +1,97 @@
+#!rsc by RouterOS
+# RouterOS script: hotspot-to-wpa-lease.wifi
+# Copyright (c) 2019-2026 Christian Hesse <mail@eworm.de>
+# https://rsc.eworm.de/COPYING.md
+#
+# provides: dhcpv4-server-lease, order=40
+# requires RouterOS, version=7.21
+# requires device-mode, hotspot
+#
+# add private WPA passphrase after hotspot login
+# https://rsc.eworm.de/doc/hotspot-to-wpa.md
+#
+# !! Do not edit this file, it is generated from template!
+
+:local ExitOK false;
+:onerror Err {
+  :global GlobalConfigReady; :global GlobalFunctionsReady;
+  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
+      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
+  :local ScriptName [ :jobname ];
+
+  :global EitherOr;
+  :global LogPrint;
+  :global ParseKeyValueStore;
+  :global ScriptLock;
+
+  :if ([ $ScriptLock $ScriptName ] = false) do={
+    :set ExitOK true;
+    :error false;
+  }
+
+  :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
+    /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
+    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
+  }
+  :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
+
+  :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
+    :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+    /ip/dhcp-server/lease/remove $Lease;
+
+    :if (($LeaseVal->"hotspot-to-wpa") != true) do={
+      :continue;
+    }
+
+    :local MacAddress $"mac-address";
+    :local UserName $username;
+
+    :local Date [ /system/clock/get date ];
+    :local UserVal ({});
+    :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
+      :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
+    }
+    :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
+    :if ([ :len [ /interface/wifi/access-list/find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
+      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+    }
+    :local Template [ /interface/wifi/access-list/get ([ find where \
+        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+
+    $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
+      " (user " . $UserName . ").");
+    /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
+    /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
+        mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
+        action=reject place-before=$PlaceBefore;
+
+    :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
+        comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
+    :set ($Template->"private-passphrase") ($Template->"passphrase");
+    :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
+    :if ([ :len $PrivatePassphrase ] > 0) do={
+      :if ($PrivatePassphrase = "ignore") do={
+        /interface/wifi/access-list/set $Entry !passphrase;
+      } else={
+        /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
+      }
+    }
+    :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
+    :if ([ :len $SsidRegexp ] > 0) do={
+      /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
+    }
+    :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
+    :if ([ :len $VlanId ] > 0) do={
+      /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
+    }
+
+    :delay 2s;
+    /interface/wifi/access-list/set $Entry action=accept;
+  }
+} do={
+  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+}
diff --git a/hotspot-to-wpa.capsman.rsc b/hotspot-to-wpa.capsman.rsc
index f0662706..a97837ee 100644
--- a/hotspot-to-wpa.capsman.rsc
+++ b/hotspot-to-wpa.capsman.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.21
 # requires device-mode, hotspot
+# requires policy, policy=read;write
 #
 # add private WPA passphrase after hotspot login
 # https://rsc.eworm.de/doc/hotspot-to-wpa.md
@@ -13,93 +14,39 @@
 
 :local ExitOK false;
 :onerror Err {
-  :global GlobalConfigReady; :global GlobalFunctionsReady;
-  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
-      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
   :local ScriptName [ :jobname ];
 
-  :global EitherOr;
-  :global LogPrint;
-  :global ParseKeyValueStore;
-  :global ScriptLock;
-
+  :local Address $"address";
+  :local Interface $"interface";
   :local MacAddress $"mac-address";
-  :local UserName $username;
+  :local UserName $"username";
 
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :set ExitOK true;
-    :error false;
-  }
-
-  :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
-    $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
-    :set ExitOK true;
-    :error false;
-  }
-
-  :local Date [ /system/clock/get date ];
-  :local UserVal ({});
-  :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
-    :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
-  }
-  :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
   :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-
-  :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-    /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
-  }
-  :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-
   :if ([ :len [ /caps-man/access-list/find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-    /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
-  }
-  :local Template [ /caps-man/access-list/get ([ find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
-
-  :if ($Template->"action" = "reject") do={
-    $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
+       comment=("hotspot-to-wpa template " . $Hotspot) disabled action="reject" ] ] > 0) do={
+    :log info ($ScriptName . ": Ignoring login for " . $MacAddress . " on hotspot '" . $Hotspot . "'.");
     :set ExitOK true;
-    :error true;
+    :error false;
   }
 
-  # allow login page to load
+  :local Lease [ /ip/dhcp-server/lease/find where mac-address=$MacAddress address=$Address ];
+
+  :if ([ :len $Lease ] != 1) do={
+    :log warning ($ScriptName . ": Did not find exactly one lease for " . $MacAddress . "!");
+    :set ExitOK true;
+    :error false;
+  }
+
+  /ip/dhcp-server/lease/set \
+    comment=[ :serialize to=json ({ \
+      "hotspot-to-wpa"=true; \
+      "address"=$Address; \
+      "interface"=$Interface; \
+      "mac-address"=$MacAddress; \
+      "username"=$UserName }) ] $Lease;
+  /ip/dhcp-server/lease/make-static $Lease;
   :delay 1s;
-
-  $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
-    " (user " . $UserName . ").");
-  /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-      mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-      action=reject place-before=$PlaceBefore;
-
-  :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
-      comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
-  :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
-  :if ([ :len $PrivatePassphrase ] > 0) do={
-    :if ($PrivatePassphrase = "ignore") do={
-      /caps-man/access-list/set $Entry !private-passphrase;
-    } else={
-      /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
-    }
-  }
-  :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
-  :if ([ :len $SsidRegexp ] > 0) do={
-    /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
-  }
-  :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
-  :if ([ :len $VlanId ] > 0) do={
-    /caps-man/access-list/set $Entry vlan-id=$VlanId;
-  }
-  :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
-  :if ([ :len $VlanMode] > 0) do={
-    /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
-  }
-
-  :delay 2s;
-  /caps-man/access-list/set $Entry action=accept;
+  /ip/dhcp-server/lease/disable $Lease;
 } do={
-  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+  :if ($ExitOK = false) do={ :log error ([ :jobname ] . ": " . $Err); }
 }
diff --git a/hotspot-to-wpa.template.rsc b/hotspot-to-wpa.template.rsc
index 03905bd9..d37c610f 100644
--- a/hotspot-to-wpa.template.rsc
+++ b/hotspot-to-wpa.template.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.21
 # requires device-mode, hotspot
+# requires policy, policy=read;write
 #
 # add private WPA passphrase after hotspot login
 # https://rsc.eworm.de/doc/hotspot-to-wpa.md
@@ -14,112 +15,40 @@
 
 :local ExitOK false;
 :onerror Err {
-  :global GlobalConfigReady; :global GlobalFunctionsReady;
-  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
-      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
   :local ScriptName [ :jobname ];
 
-  :global EitherOr;
-  :global LogPrint;
-  :global ParseKeyValueStore;
-  :global ScriptLock;
-
+  :local Address $"address";
+  :local Interface $"interface";
   :local MacAddress $"mac-address";
-  :local UserName $username;
+  :local UserName $"username";
 
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :set ExitOK true;
-    :error false;
-  }
-
-  :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
-    $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
-    :set ExitOK true;
-    :error false;
-  }
-
-  :local Date [ /system/clock/get date ];
-  :local UserVal ({});
-  :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
-    :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
-  }
-  :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
   :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-
-  :if ([ :len [ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-  :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-    /caps-man/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
-  }
-  :local PlaceBefore ([ /caps-man/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-  :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-
   :if ([ :len [ /caps-man/access-list/find where \
   :if ([ :len [ /interface/wifi/access-list/find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-    /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
-  }
-  :local Template [ /caps-man/access-list/get ([ find where \
-  :local Template [ /interface/wifi/access-list/get ([ find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
-
-  :if ($Template->"action" = "reject") do={
-    $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
+       comment=("hotspot-to-wpa template " . $Hotspot) disabled action="reject" ] ] > 0) do={
+    :log info ($ScriptName . ": Ignoring login for " . $MacAddress . " on hotspot '" . $Hotspot . "'.");
     :set ExitOK true;
-    :error true;
+    :error false;
   }
 
-  # allow login page to load
+  :local Lease [ /ip/dhcp-server/lease/find where mac-address=$MacAddress address=$Address ];
+
+  :if ([ :len $Lease ] != 1) do={
+    :log warning ($ScriptName . ": Did not find exactly one lease for " . $MacAddress . "!");
+    :set ExitOK true;
+    :error false;
+  }
+
+  /ip/dhcp-server/lease/set \
+    comment=[ :serialize to=json ({ \
+      "hotspot-to-wpa"=true; \
+      "address"=$Address; \
+      "interface"=$Interface; \
+      "mac-address"=$MacAddress; \
+      "username"=$UserName }) ] $Lease;
+  /ip/dhcp-server/lease/make-static $Lease;
   :delay 1s;
-
-  $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
-    " (user " . $UserName . ").");
-  /caps-man/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /caps-man/access-list/add private-passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-  /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-      mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-      action=reject place-before=$PlaceBefore;
-
-  :local Entry [ /caps-man/access-list/find where mac-address=$MacAddress \
-  :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
-      comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
-# NOT /caps-man/ #
-  :set ($Template->"private-passphrase") ($Template->"passphrase");
-# NOT /caps-man/ #
-  :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
-  :if ([ :len $PrivatePassphrase ] > 0) do={
-    :if ($PrivatePassphrase = "ignore") do={
-      /caps-man/access-list/set $Entry !private-passphrase;
-      /interface/wifi/access-list/set $Entry !passphrase;
-    } else={
-      /caps-man/access-list/set $Entry private-passphrase=$PrivatePassphrase;
-      /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
-    }
-  }
-  :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
-  :if ([ :len $SsidRegexp ] > 0) do={
-    /caps-man/access-list/set $Entry ssid-regexp=$SsidRegexp;
-    /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
-  }
-  :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
-  :if ([ :len $VlanId ] > 0) do={
-    /caps-man/access-list/set $Entry vlan-id=$VlanId;
-    /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
-  }
-# NOT /interface/wifi/ #
-  :local VlanMode [ $EitherOr ($UserInfo->"vlan-mode") ($Template->"vlan-mode") ];
-  :if ([ :len $VlanMode] > 0) do={
-    /caps-man/access-list/set $Entry vlan-mode=$VlanMode;
-  }
-# NOT /interface/wifi/ #
-
-  :delay 2s;
-  /caps-man/access-list/set $Entry action=accept;
-  /interface/wifi/access-list/set $Entry action=accept;
+  /ip/dhcp-server/lease/disable $Lease;
 } do={
-  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+  :if ($ExitOK = false) do={ :log error ([ :jobname ] . ": " . $Err); }
 }
diff --git a/hotspot-to-wpa.wifi.rsc b/hotspot-to-wpa.wifi.rsc
index 09c8923a..cbd6798a 100644
--- a/hotspot-to-wpa.wifi.rsc
+++ b/hotspot-to-wpa.wifi.rsc
@@ -5,6 +5,7 @@
 #
 # requires RouterOS, version=7.21
 # requires device-mode, hotspot
+# requires policy, policy=read;write
 #
 # add private WPA passphrase after hotspot login
 # https://rsc.eworm.de/doc/hotspot-to-wpa.md
@@ -13,90 +14,39 @@
 
 :local ExitOK false;
 :onerror Err {
-  :global GlobalConfigReady; :global GlobalFunctionsReady;
-  :retry { :if ($GlobalConfigReady != true || $GlobalFunctionsReady != true) \
-      do={ :error ("Global config and/or functions not ready."); }; } delay=500ms max=50;
   :local ScriptName [ :jobname ];
 
-  :global EitherOr;
-  :global LogPrint;
-  :global ParseKeyValueStore;
-  :global ScriptLock;
-
+  :local Address $"address";
+  :local Interface $"interface";
   :local MacAddress $"mac-address";
-  :local UserName $username;
+  :local UserName $"username";
 
-  :if ([ $ScriptLock $ScriptName ] = false) do={
-    :set ExitOK true;
-    :error false;
-  }
-
-  :if ([ :typeof $MacAddress ] = "nothing" || [ :typeof $UserName ] = "nothing") do={
-    $LogPrint error $ScriptName ("This script is supposed to run from hotspot on login.");
-    :set ExitOK true;
-    :error false;
-  }
-
-  :local Date [ /system/clock/get date ];
-  :local UserVal ({});
-  :if ([ :len [ /ip/hotspot/user/find where name=$UserName ] ] > 0) do={
-    :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
-  }
-  :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
   :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-
-  :if ([ :len [ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ] ] = 0) do={
-    /interface/wifi/access-list/add comment="--- hotspot-to-wpa above ---" disabled=yes;
-    $LogPrint warning $ScriptName ("Added disabled access-list entry with comment '--- hotspot-to-wpa above ---'.");
-  }
-  :local PlaceBefore ([ /interface/wifi/access-list/find where comment="--- hotspot-to-wpa above ---" disabled ]->0);
-
   :if ([ :len [ /interface/wifi/access-list/find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-    /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-    $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
-  }
-  :local Template [ /interface/wifi/access-list/get ([ find where \
-      comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
-
-  :if ($Template->"action" = "reject") do={
-    $LogPrint info $ScriptName ("Ignoring login for hotspot '" . $Hotspot . "'.");
+       comment=("hotspot-to-wpa template " . $Hotspot) disabled action="reject" ] ] > 0) do={
+    :log info ($ScriptName . ": Ignoring login for " . $MacAddress . " on hotspot '" . $Hotspot . "'.");
     :set ExitOK true;
-    :error true;
+    :error false;
   }
 
-  # allow login page to load
+  :local Lease [ /ip/dhcp-server/lease/find where mac-address=$MacAddress address=$Address ];
+
+  :if ([ :len $Lease ] != 1) do={
+    :log warning ($ScriptName . ": Did not find exactly one lease for " . $MacAddress . "!");
+    :set ExitOK true;
+    :error false;
+  }
+
+  /ip/dhcp-server/lease/set \
+    comment=[ :serialize to=json ({ \
+      "hotspot-to-wpa"=true; \
+      "address"=$Address; \
+      "interface"=$Interface; \
+      "mac-address"=$MacAddress; \
+      "username"=$UserName }) ] $Lease;
+  /ip/dhcp-server/lease/make-static $Lease;
   :delay 1s;
-
-  $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
-    " (user " . $UserName . ").");
-  /interface/wifi/access-list/remove [ find where mac-address=$MacAddress comment~"^hotspot-to-wpa: " ];
-  /interface/wifi/access-list/add passphrase=($UserVal->"password") ssid-regexp="-wpa\$" \
-      mac-address=$MacAddress comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) \
-      action=reject place-before=$PlaceBefore;
-
-  :local Entry [ /interface/wifi/access-list/find where mac-address=$MacAddress \
-      comment=("hotspot-to-wpa: " . $UserName . ", " . $MacAddress . ", " . $Date) ];
-  :set ($Template->"private-passphrase") ($Template->"passphrase");
-  :local PrivatePassphrase [ $EitherOr ($UserInfo->"private-passphrase") ($Template->"private-passphrase") ];
-  :if ([ :len $PrivatePassphrase ] > 0) do={
-    :if ($PrivatePassphrase = "ignore") do={
-      /interface/wifi/access-list/set $Entry !passphrase;
-    } else={
-      /interface/wifi/access-list/set $Entry passphrase=$PrivatePassphrase;
-    }
-  }
-  :local SsidRegexp [ $EitherOr ($UserInfo->"ssid-regexp") ($Template->"ssid-regexp") ];
-  :if ([ :len $SsidRegexp ] > 0) do={
-    /interface/wifi/access-list/set $Entry ssid-regexp=$SsidRegexp;
-  }
-  :local VlanId [ $EitherOr ($UserInfo->"vlan-id") ($Template->"vlan-id") ];
-  :if ([ :len $VlanId ] > 0) do={
-    /interface/wifi/access-list/set $Entry vlan-id=$VlanId;
-  }
-
-  :delay 2s;
-  /interface/wifi/access-list/set $Entry action=accept;
+  /ip/dhcp-server/lease/disable $Lease;
 } do={
-  :global ExitError; $ExitError $ExitOK [ :jobname ] $Err;
+  :if ($ExitOK = false) do={ :log error ([ :jobname ] . ": " . $Err); }
 }
diff --git a/news-and-changes.rsc b/news-and-changes.rsc
index 1b3adb26..87195292 100644
--- a/news-and-changes.rsc
+++ b/news-and-changes.rsc
@@ -69,6 +69,7 @@
   142="Added a setting for 'mod/notification-email' to check availability of certificate chain.";
   143="Made backup scripts 'backup-email' and 'backup-upload' support date & time in filenames.";
   144="Split and reworked 'mode-button' for compatibility with RouterOS 7.24, configuration was updated automatically.";
+  145="Split and reworked 'hotspot-to-wpa' for compatibility with RouterOS 7.24, configuration was updated automatically.";
 };
 
 # Migration steps to be applied on script updates
@@ -81,4 +82,5 @@
   138="/certificate/set trusted=yes [ find where trusted=yes ];";
   140=":if ([ :len [ /system/script/find where name=\"lease-script\" ] ] > 0) do={ /system/script/set name=\"dhcpv4-server-lease\" \"lease-script\"; :global ScriptInstallUpdate; \$ScriptInstallUpdate; /ip/dhcp-server/set lease-script=\"dhcpv4-server-lease\" [ find where lease-script=\"lease-script\" ]; };";
   144=":if ([ :len [ /system/script/find where name=\"mode-button\" ] ] > 0) do={ :global ScriptInstallUpdate; \$ScriptInstallUpdate mode-button-scheduler; };";
+  145=":local Script [ /system/script/find where name~\"^hotspot-to-wpa\\\\.\" ]; :if ([ :len \$Script ] > 0) do={ :local Type ([ :toarray delimiter=\".\" [ /system/script/get \$Script name ] ]->1); :global ScriptInstallUpdate; \$ScriptInstallUpdate (\"dhcpv4-server-lease,hotspot-to-wpa-lease.\" . \$Type); :foreach Hotspot in=[ /ip/hotspot/find ] do={ /ip/dhcp-server/set lease-script=\"dhcpv4-server-lease\" [ find where interface=[ /ip/hotspot/get \$Hotspot interface ] ]; }; };";
 };

From 94ea51da09281ae80f44823ea9a0ab44849a42fd Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Fri, 31 Jul 2026 21:37:45 +0200
Subject: [PATCH 2/4] FIXUP

---
 hotspot-to-wpa-lease.capsman.rsc  | 2 +-
 hotspot-to-wpa-lease.template.rsc | 2 +-
 hotspot-to-wpa-lease.wifi.rsc     | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hotspot-to-wpa-lease.capsman.rsc b/hotspot-to-wpa-lease.capsman.rsc
index e237eae6..89ab7ae4 100644
--- a/hotspot-to-wpa-lease.capsman.rsc
+++ b/hotspot-to-wpa-lease.capsman.rsc
@@ -52,7 +52,7 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress ] server ];
 
     :if ([ :len [ /caps-man/access-list/find where \
         comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
diff --git a/hotspot-to-wpa-lease.template.rsc b/hotspot-to-wpa-lease.template.rsc
index b432a756..67e71fe6 100644
--- a/hotspot-to-wpa-lease.template.rsc
+++ b/hotspot-to-wpa-lease.template.rsc
@@ -56,7 +56,7 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress ] server ];
 
     :if ([ :len [ /caps-man/access-list/find where \
     :if ([ :len [ /interface/wifi/access-list/find where \
diff --git a/hotspot-to-wpa-lease.wifi.rsc b/hotspot-to-wpa-lease.wifi.rsc
index 7e152863..78ae2442 100644
--- a/hotspot-to-wpa-lease.wifi.rsc
+++ b/hotspot-to-wpa-lease.wifi.rsc
@@ -52,7 +52,7 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress ] server ];
 
     :if ([ :len [ /interface/wifi/access-list/find where \
         comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={

From 8678792837a8b5d4c5f5a57acf875109c9283198 Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Fri, 31 Jul 2026 21:47:46 +0200
Subject: [PATCH 3/4] FIXUP

---
 hotspot-to-wpa-lease.capsman.rsc  | 4 ++--
 hotspot-to-wpa-lease.template.rsc | 4 ++--
 hotspot-to-wpa-lease.wifi.rsc     | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hotspot-to-wpa-lease.capsman.rsc b/hotspot-to-wpa-lease.capsman.rsc
index 89ab7ae4..2533e12d 100644
--- a/hotspot-to-wpa-lease.capsman.rsc
+++ b/hotspot-to-wpa-lease.capsman.rsc
@@ -37,7 +37,6 @@
 
   :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
     :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
-    /ip/dhcp-server/lease/remove $Lease;
 
     :if (($LeaseVal->"hotspot-to-wpa") != true) do={
       :continue;
@@ -52,7 +51,8 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress ] server ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+    /ip/dhcp-server/lease/remove $Lease;
 
     :if ([ :len [ /caps-man/access-list/find where \
         comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
diff --git a/hotspot-to-wpa-lease.template.rsc b/hotspot-to-wpa-lease.template.rsc
index 67e71fe6..348f3726 100644
--- a/hotspot-to-wpa-lease.template.rsc
+++ b/hotspot-to-wpa-lease.template.rsc
@@ -41,7 +41,6 @@
 
   :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
     :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
-    /ip/dhcp-server/lease/remove $Lease;
 
     :if (($LeaseVal->"hotspot-to-wpa") != true) do={
       :continue;
@@ -56,7 +55,8 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress ] server ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+    /ip/dhcp-server/lease/remove $Lease;
 
     :if ([ :len [ /caps-man/access-list/find where \
     :if ([ :len [ /interface/wifi/access-list/find where \
diff --git a/hotspot-to-wpa-lease.wifi.rsc b/hotspot-to-wpa-lease.wifi.rsc
index 78ae2442..2a90c06a 100644
--- a/hotspot-to-wpa-lease.wifi.rsc
+++ b/hotspot-to-wpa-lease.wifi.rsc
@@ -37,7 +37,6 @@
 
   :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
     :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
-    /ip/dhcp-server/lease/remove $Lease;
 
     :if (($LeaseVal->"hotspot-to-wpa") != true) do={
       :continue;
@@ -52,7 +51,8 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress ] server ];
+    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+    /ip/dhcp-server/lease/remove $Lease;
 
     :if ([ :len [ /interface/wifi/access-list/find where \
         comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={

From f2bffb1c686be2dddc670848f006d4a1280c6e9c Mon Sep 17 00:00:00 2001
From: Christian Hesse <mail@eworm.de>
Date: Fri, 31 Jul 2026 23:38:04 +0200
Subject: [PATCH 4/4] FIXUP

---
 hotspot-to-wpa-lease.capsman.rsc  | 11 +++++------
 hotspot-to-wpa-lease.template.rsc | 13 ++++++-------
 hotspot-to-wpa-lease.wifi.rsc     | 11 +++++------
 hotspot-to-wpa.capsman.rsc        |  3 +++
 hotspot-to-wpa.template.rsc       |  3 +++
 hotspot-to-wpa.wifi.rsc           |  3 +++
 6 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/hotspot-to-wpa-lease.capsman.rsc b/hotspot-to-wpa-lease.capsman.rsc
index 2533e12d..da86b9d5 100644
--- a/hotspot-to-wpa-lease.capsman.rsc
+++ b/hotspot-to-wpa-lease.capsman.rsc
@@ -37,6 +37,7 @@
 
   :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
     :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+    /ip/dhcp-server/lease/remove $Lease;
 
     :if (($LeaseVal->"hotspot-to-wpa") != true) do={
       :continue;
@@ -51,16 +52,14 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-    /ip/dhcp-server/lease/remove $Lease;
 
     :if ([ :len [ /caps-man/access-list/find where \
-        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+        comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled ] ] = 0) do={
+      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $LeaseVal->"hotspot" . "'.");
     }
     :local Template [ /caps-man/access-list/get ([ find where \
-        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+        comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled ]->0) ];
 
     $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
       " (user " . $UserName . ").");
diff --git a/hotspot-to-wpa-lease.template.rsc b/hotspot-to-wpa-lease.template.rsc
index 348f3726..4f02a3db 100644
--- a/hotspot-to-wpa-lease.template.rsc
+++ b/hotspot-to-wpa-lease.template.rsc
@@ -41,6 +41,7 @@
 
   :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
     :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+    /ip/dhcp-server/lease/remove $Lease;
 
     :if (($LeaseVal->"hotspot-to-wpa") != true) do={
       :continue;
@@ -55,19 +56,17 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-    /ip/dhcp-server/lease/remove $Lease;
 
     :if ([ :len [ /caps-man/access-list/find where \
     :if ([ :len [ /interface/wifi/access-list/find where \
-        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+        comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled ] ] = 0) do={
+      /caps-man/access-list/add comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled=yes place-before=$PlaceBefore;
+      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $LeaseVal->"hotspot" . "'.");
     }
     :local Template [ /caps-man/access-list/get ([ find where \
     :local Template [ /interface/wifi/access-list/get ([ find where \
-        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+        comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled ]->0) ];
 
     $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
       " (user " . $UserName . ").");
diff --git a/hotspot-to-wpa-lease.wifi.rsc b/hotspot-to-wpa-lease.wifi.rsc
index 2a90c06a..89a33836 100644
--- a/hotspot-to-wpa-lease.wifi.rsc
+++ b/hotspot-to-wpa-lease.wifi.rsc
@@ -37,6 +37,7 @@
 
   :foreach Lease in=[ /ip/dhcp-server/lease/find where !dynamic disabled comment~"\\bhotspot-to-wpa\\b" ] do={
     :local LeaseVal [ $ParseKeyValueStore [ /ip/dhcp-server/lease/get $Lease comment ] ];
+    /ip/dhcp-server/lease/remove $Lease;
 
     :if (($LeaseVal->"hotspot-to-wpa") != true) do={
       :continue;
@@ -51,16 +52,14 @@
       :set UserVal [ /ip/hotspot/user/get [ find where name=$UserName ] ];
     }
     :local UserInfo [ $ParseKeyValueStore ($UserVal->"comment") ];
-    :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
-    /ip/dhcp-server/lease/remove $Lease;
 
     :if ([ :len [ /interface/wifi/access-list/find where \
-        comment=("hotspot-to-wpa template " . $Hotspot) disabled ] ] = 0) do={
-      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $Hotspot) disabled=yes place-before=$PlaceBefore;
-      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $Hotspot . "'.");
+        comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled ] ] = 0) do={
+      /interface/wifi/access-list/add comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled=yes place-before=$PlaceBefore;
+      $LogPrint warning $ScriptName ("Added template in access-list for hotspot '" . $LeaseVal->"hotspot" . "'.");
     }
     :local Template [ /interface/wifi/access-list/get ([ find where \
-        comment=("hotspot-to-wpa template " . $Hotspot) disabled ]->0) ];
+        comment=("hotspot-to-wpa template " . $LeaseVal->"hotspot") disabled ]->0) ];
 
     $LogPrint info $ScriptName ("Adding/updating access-list entry for mac address " . $MacAddress . \
       " (user " . $UserName . ").");
diff --git a/hotspot-to-wpa.capsman.rsc b/hotspot-to-wpa.capsman.rsc
index a97837ee..938d0042 100644
--- a/hotspot-to-wpa.capsman.rsc
+++ b/hotspot-to-wpa.capsman.rsc
@@ -37,9 +37,12 @@
     :error false;
   }
 
+  :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
   /ip/dhcp-server/lease/set \
     comment=[ :serialize to=json ({ \
       "hotspot-to-wpa"=true; \
+      "hotspot"=$Hotspot; \
       "address"=$Address; \
       "interface"=$Interface; \
       "mac-address"=$MacAddress; \
diff --git a/hotspot-to-wpa.template.rsc b/hotspot-to-wpa.template.rsc
index d37c610f..84bb4181 100644
--- a/hotspot-to-wpa.template.rsc
+++ b/hotspot-to-wpa.template.rsc
@@ -39,9 +39,12 @@
     :error false;
   }
 
+  :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
   /ip/dhcp-server/lease/set \
     comment=[ :serialize to=json ({ \
       "hotspot-to-wpa"=true; \
+      "hotspot"=$Hotspot; \
       "address"=$Address; \
       "interface"=$Interface; \
       "mac-address"=$MacAddress; \
diff --git a/hotspot-to-wpa.wifi.rsc b/hotspot-to-wpa.wifi.rsc
index cbd6798a..db6a44b2 100644
--- a/hotspot-to-wpa.wifi.rsc
+++ b/hotspot-to-wpa.wifi.rsc
@@ -37,9 +37,12 @@
     :error false;
   }
 
+  :local Hotspot [ /ip/hotspot/host/get [ find where mac-address=$MacAddress authorized ] server ];
+
   /ip/dhcp-server/lease/set \
     comment=[ :serialize to=json ({ \
       "hotspot-to-wpa"=true; \
+      "hotspot"=$Hotspot; \
       "address"=$Address; \
       "interface"=$Interface; \
       "mac-address"=$MacAddress; \