Move Media::AccountLogin cluster to match the spec

examples/all-clusters-minimal-app/all-clusters-common/all-clusters-minimal-app.matter

@@ -3645,11 +3645,11 @@ server cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   timed command Logout(): DefaultSuccess = 3;
 }
 

examples/placeholder/linux/apps/app1/config.matter

@@ -6449,7 +6449,7 @@ client cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
   request struct LoginRequest {
@@ -6458,9 +6458,9 @@ client cluster AccountLogin = 1294 {
   }
 
   /** Upon receipt, the Content App checks if the account associated with the client Temp Account Identifier Rotating ID is the same acount that is active on the given Content App. If the accounts are the same, then the Content App includes the Setup PIN in the GetSetupPIN Response. */
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
   /** Upon receipt, the Content App checks if the account associated with the client’s Temp Account Identifier (Rotating ID) has a current active Setup PIN with the given value. If the Setup PIN is valid for the user account associated with the Temp Account Identifier, then the Content App MAY make that user account active. */
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   /** The purpose of this command is to instruct the Content App to clear the current user account. This command SHOULD be used by clients of a Content App to indicate the end of a user session. */
   timed command Logout(): DefaultSuccess = 3;
 }
@@ -6484,11 +6484,11 @@ server cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   timed command Logout(): DefaultSuccess = 3;
 }
 

examples/placeholder/linux/apps/app2/config.matter

@@ -6408,7 +6408,7 @@ client cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
   request struct LoginRequest {
@@ -6417,9 +6417,9 @@ client cluster AccountLogin = 1294 {
   }
 
   /** Upon receipt, the Content App checks if the account associated with the client Temp Account Identifier Rotating ID is the same acount that is active on the given Content App. If the accounts are the same, then the Content App includes the Setup PIN in the GetSetupPIN Response. */
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
   /** Upon receipt, the Content App checks if the account associated with the client’s Temp Account Identifier (Rotating ID) has a current active Setup PIN with the given value. If the Setup PIN is valid for the user account associated with the Temp Account Identifier, then the Content App MAY make that user account active. */
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   /** The purpose of this command is to instruct the Content App to clear the current user account. This command SHOULD be used by clients of a Content App to indicate the end of a user session. */
   timed command Logout(): DefaultSuccess = 3;
 }
@@ -6443,11 +6443,11 @@ server cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   timed command Logout(): DefaultSuccess = 3;
 }
 

examples/tv-app/android/include/account-login/AccountLoginManager.cpp

@@ -64,7 +64,7 @@ void AccountLoginManager::HandleGetSetupPin(CommandResponseHelper<GetSetupPINRes
     GetSetupPINResponse response;
     ChipLogProgress(Zcl, "temporary account id: %s returning pin: %s", tempAccountIdentifierString.c_str(), mSetupPin);
 
-    response.setupPIN = CharSpan::fromCharString(mSetupPin);
+    response.setupPIN.SetNonNull(CharSpan::fromCharString(mSetupPin));
     helper.Success(response);
 }
 
@@ -93,7 +93,14 @@ void AccountLoginManager::GetSetupPin(char * setupPin, size_t setupPinSize, cons
     GetSetupPINResponse pinResponse = mCommandDelegate->FormatGetSetupPINResponse(response, status);
     if (status == chip::Protocols::InteractionModel::Status::Success)
     {
-        CopyString(setupPin, setupPinSize, pinResponse.setupPIN);
+        if (pinResponse.setupPIN.IsNull())
+        {
+            setupPin[0] = '\0';
+        }
+        else
+        {
+            CopyString(setupPin, setupPinSize, pinResponse.setupPIN.Value());
+        }
     }
     else
     {

examples/tv-app/android/java/ContentAppCommandDelegate.cpp

@@ -321,11 +321,11 @@ GetSetupPINResponseType ContentAppCommandDelegate::FormatGetSetupPINResponse(Jso
         std::to_string(to_underlying(app::Clusters::AccountLogin::Commands::GetSetupPINResponse::Fields::kSetupPIN));
     if (!value[setupPINFieldId].empty())
     {
-        getSetupPINresponse.setupPIN = CharSpan::fromCharString(value[setupPINFieldId].asCString());
+        getSetupPINresponse.setupPIN.SetNonNull(CharSpan::fromCharString(value[setupPINFieldId].asCString()));
     }
     else
     {
-        getSetupPINresponse.setupPIN = "";
+        getSetupPINresponse.setupPIN.SetNull();
     }
     return getSetupPINresponse;
 }

examples/tv-app/tv-common/clusters/account-login/AccountLoginManager.cpp

@@ -60,6 +60,6 @@ void AccountLoginManager::HandleGetSetupPin(CommandResponseHelper<GetSetupPINRes
     GetSetupPINResponse response;
     ChipLogProgress(Zcl, "temporary account id: %s returning pin: %s", tempAccountIdentifierString.c_str(), mSetupPin);
 
-    response.setupPIN = CharSpan::fromCharString(mSetupPin);
+    response.setupPIN = chip::app::DataModel::MakeNullable(CharSpan::fromCharString(mSetupPin));
     helper.Success(response);
 }

examples/tv-app/tv-common/tv-app.matter

@@ -2416,11 +2416,11 @@ server cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   timed command Logout(): DefaultSuccess = 3;
 }
 

examples/tv-casting-app/tv-casting-common/tv-casting-app.matter

@@ -1969,7 +1969,7 @@ client cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
   request struct LoginRequest {
@@ -1978,9 +1978,9 @@ client cluster AccountLogin = 1294 {
   }
 
   /** Upon receipt, the Content App checks if the account associated with the client Temp Account Identifier Rotating ID is the same acount that is active on the given Content App. If the accounts are the same, then the Content App includes the Setup PIN in the GetSetupPIN Response. */
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
   /** Upon receipt, the Content App checks if the account associated with the client’s Temp Account Identifier (Rotating ID) has a current active Setup PIN with the given value. If the Setup PIN is valid for the user account associated with the Temp Account Identifier, then the Content App MAY make that user account active. */
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   /** The purpose of this command is to instruct the Content App to clear the current user account. This command SHOULD be used by clients of a Content App to indicate the end of a user session. */
   timed command Logout(): DefaultSuccess = 3;
 }

src/app/zap-templates/zcl/data-model/chip/account-login-cluster.xml

@@ -27,11 +27,13 @@ limitations under the License.
 
     <command source="client" code="0x00" name="GetSetupPIN" response="GetSetupPINResponse" mustUseTimedInvoke="true" optional="false">
       <description>Upon receipt, the Content App checks if the account associated with the client Temp Account Identifier Rotating ID is the same acount that is active on the given Content App. If the accounts are the same, then the Content App includes the Setup PIN in the GetSetupPIN Response.</description>
+      <access op="invoke" role="administer" />
       <arg name="TempAccountIdentifier" minLength="16" length="100" type="char_string"/>
     </command>
 
     <command source="client" code="0x02" name="Login" mustUseTimedInvoke="true" optional="false">
       <description>Upon receipt, the Content App checks if the account associated with the client’s Temp Account Identifier (Rotating ID) has a current active Setup PIN with the given value. If the Setup PIN is valid for the user account associated with the Temp Account Identifier, then the Content App MAY make that user account active.</description>
+      <access op="invoke" role="administer" />
       <arg name="TempAccountIdentifier" minLength="16" length="100" type="char_string"/>
       <arg name="SetupPIN" minLength="11" type="char_string"/>
     </command>
@@ -42,7 +44,7 @@ limitations under the License.
 
     <command source="server" code="0x01" name="GetSetupPINResponse" optional="false" disableDefaultResponse="true">
       <description>This message is sent in response to the GetSetupPIN Request, and contains the Setup PIN code, or null when the accounts identified in the request does not match the active account of the running Content App.</description>
-      <arg name="SetupPIN" type="char_string"/>
+      <arg name="SetupPIN" type="char_string" isNullable="true"/>
     </command>
 
   </cluster>

src/controller/data_model/controller-clusters.matter

@@ -6392,7 +6392,7 @@ client cluster AccountLogin = 1294 {
   }
 
   response struct GetSetupPINResponse = 1 {
-    char_string setupPIN = 0;
+    nullable char_string setupPIN = 0;
   }
 
   request struct LoginRequest {
@@ -6401,9 +6401,9 @@ client cluster AccountLogin = 1294 {
   }
 
   /** Upon receipt, the Content App checks if the account associated with the client Temp Account Identifier Rotating ID is the same acount that is active on the given Content App. If the accounts are the same, then the Content App includes the Setup PIN in the GetSetupPIN Response. */
-  timed command GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
+  timed command access(invoke: administer) GetSetupPIN(GetSetupPINRequest): GetSetupPINResponse = 0;
   /** Upon receipt, the Content App checks if the account associated with the client’s Temp Account Identifier (Rotating ID) has a current active Setup PIN with the given value. If the Setup PIN is valid for the user account associated with the Temp Account Identifier, then the Content App MAY make that user account active. */
-  timed command Login(LoginRequest): DefaultSuccess = 2;
+  timed command access(invoke: administer) Login(LoginRequest): DefaultSuccess = 2;
   /** The purpose of this command is to instruct the Content App to clear the current user account. This command SHOULD be used by clients of a Content App to indicate the end of a user session. */
   timed command Logout(): DefaultSuccess = 3;
 }

src/controller/java/generated/java/chip/devicecontroller/ChipClusters.java

@@ -27245,7 +27245,7 @@ public void logout(DefaultClusterCallback callback, int timedInvokeTimeoutMs) {
     private native void logout(long chipClusterPtr, DefaultClusterCallback callback, @Nullable Integer timedInvokeTimeoutMs);
 
     public interface GetSetupPINResponseCallback {
-      void onSuccess(String setupPIN);
+      void onSuccess(@Nullable String setupPIN);
       void onError(Exception error);
     }
 

src/controller/java/generated/java/chip/devicecontroller/ClusterInfoMapping.java

@@ -15196,7 +15196,7 @@ public void setCallbackDelegate(ClusterCommandCallback callback) {
     }
 
     @Override
-    public void onSuccess(String setupPIN) {
+    public void onSuccess(@Nullable String setupPIN) {
       Map<CommandResponseInfo, Object> responseValues = new LinkedHashMap<>();
 
       CommandResponseInfo setupPINResponseValue = new CommandResponseInfo("setupPIN", "String");