Manage s2 keys in zwave_js (#56783)

homeassistant/components/zwave_js/__init__.py

@@ -55,9 +55,17 @@ from .const import (
     ATTR_VALUE_RAW,
     CONF_ADDON_DEVICE,
     CONF_ADDON_NETWORK_KEY,
+    CONF_ADDON_S0_LEGACY_KEY,
+    CONF_ADDON_S2_ACCESS_CONTROL_KEY,
+    CONF_ADDON_S2_AUTHENTICATED_KEY,
+    CONF_ADDON_S2_UNAUTHENTICATED_KEY,
     CONF_DATA_COLLECTION_OPTED_IN,
     CONF_INTEGRATION_CREATED_ADDON,
     CONF_NETWORK_KEY,
+    CONF_S0_LEGACY_KEY,
+    CONF_S2_ACCESS_CONTROL_KEY,
+    CONF_S2_AUTHENTICATED_KEY,
+    CONF_S2_UNAUTHENTICATED_KEY,
     CONF_USB_PATH,
     CONF_USE_ADDON,
     DATA_CLIENT,
@@ -653,29 +661,61 @@ async def async_ensure_addon_running(hass: HomeAssistant, entry: ConfigEntry) ->
         raise ConfigEntryNotReady from err
 
     usb_path: str = entry.data[CONF_USB_PATH]
-    network_key: str = entry.data[CONF_NETWORK_KEY]
+    # s0_legacy_key was saved as network_key before s2 was added.
+    s0_legacy_key: str = entry.data.get(CONF_S0_LEGACY_KEY, "")
+    if not s0_legacy_key:
+        s0_legacy_key = entry.data.get(CONF_NETWORK_KEY, "")
+    s2_access_control_key: str = entry.data.get(CONF_S2_ACCESS_CONTROL_KEY, "")
+    s2_authenticated_key: str = entry.data.get(CONF_S2_AUTHENTICATED_KEY, "")
+    s2_unauthenticated_key: str = entry.data.get(CONF_S2_UNAUTHENTICATED_KEY, "")
     addon_state = addon_info.state
 
     if addon_state == AddonState.NOT_INSTALLED:
         addon_manager.async_schedule_install_setup_addon(
-            usb_path, network_key, catch_error=True
+            usb_path,
+            s0_legacy_key,
+            s2_access_control_key,
+            s2_authenticated_key,
+            s2_unauthenticated_key,
+            catch_error=True,
         )
         raise ConfigEntryNotReady
 
     if addon_state == AddonState.NOT_RUNNING:
         addon_manager.async_schedule_setup_addon(
-            usb_path, network_key, catch_error=True
+            usb_path,
+            s0_legacy_key,
+            s2_access_control_key,
+            s2_authenticated_key,
+            s2_unauthenticated_key,
+            catch_error=True,
         )
         raise ConfigEntryNotReady
 
     addon_options = addon_info.options
     addon_device = addon_options[CONF_ADDON_DEVICE]
-    addon_network_key = addon_options[CONF_ADDON_NETWORK_KEY]
+    # s0_legacy_key was saved as network_key before s2 was added.
+    addon_s0_legacy_key = addon_options.get(CONF_ADDON_S0_LEGACY_KEY, "")
+    if not addon_s0_legacy_key:
+        addon_s0_legacy_key = addon_options.get(CONF_ADDON_NETWORK_KEY, "")
+    addon_s2_access_control_key = addon_options.get(
+        CONF_ADDON_S2_ACCESS_CONTROL_KEY, ""
+    )
+    addon_s2_authenticated_key = addon_options.get(CONF_ADDON_S2_AUTHENTICATED_KEY, "")
+    addon_s2_unauthenticated_key = addon_options.get(
+        CONF_ADDON_S2_UNAUTHENTICATED_KEY, ""
+    )
     updates = {}
     if usb_path != addon_device:
         updates[CONF_USB_PATH] = addon_device
-    if network_key != addon_network_key:
+    if s0_legacy_key != addon_s0_legacy_key:
-        updates[CONF_NETWORK_KEY] = addon_network_key
+        updates[CONF_S0_LEGACY_KEY] = addon_s0_legacy_key
+    if s2_access_control_key != addon_s2_access_control_key:
+        updates[CONF_S2_ACCESS_CONTROL_KEY] = addon_s2_access_control_key
+    if s2_authenticated_key != addon_s2_authenticated_key:
+        updates[CONF_S2_AUTHENTICATED_KEY] = addon_s2_authenticated_key
+    if s2_unauthenticated_key != addon_s2_unauthenticated_key:
+        updates[CONF_S2_UNAUTHENTICATED_KEY] = addon_s2_unauthenticated_key
     if updates:
         hass.config_entries.async_update_entry(entry, data={**entry.data, **updates})
 

homeassistant/components/zwave_js/addon.py

@@ -24,7 +24,16 @@ from homeassistant.core import HomeAssistant, callback
 from homeassistant.exceptions import HomeAssistantError
 from homeassistant.helpers.singleton import singleton
 
-from .const import ADDON_SLUG, CONF_ADDON_DEVICE, CONF_ADDON_NETWORK_KEY, DOMAIN, LOGGER
+from .const import (
+    ADDON_SLUG,
+    CONF_ADDON_DEVICE,
+    CONF_ADDON_S0_LEGACY_KEY,
+    CONF_ADDON_S2_ACCESS_CONTROL_KEY,
+    CONF_ADDON_S2_AUTHENTICATED_KEY,
+    CONF_ADDON_S2_UNAUTHENTICATED_KEY,
+    DOMAIN,
+    LOGGER,
+)
 
 F = TypeVar("F", bound=Callable[..., Any])  # pylint: disable=invalid-name
 
@@ -170,7 +179,13 @@ class AddonManager:
 
     @callback
     def async_schedule_install_setup_addon(
-        self, usb_path: str, network_key: str, catch_error: bool = False
+        self,
+        usb_path: str,
+        s0_legacy_key: str,
+        s2_access_control_key: str,
+        s2_authenticated_key: str,
+        s2_unauthenticated_key: str,
+        catch_error: bool = False,
     ) -> asyncio.Task:
         """Schedule a task that installs and sets up the Z-Wave JS add-on.
 
@@ -180,7 +195,14 @@ class AddonManager:
             LOGGER.info("Z-Wave JS add-on is not installed. Installing add-on")
             self._install_task = self._async_schedule_addon_operation(
                 self.async_install_addon,
-                partial(self.async_configure_addon, usb_path, network_key),
+                partial(
+                    self.async_configure_addon,
+                    usb_path,
+                    s0_legacy_key,
+                    s2_access_control_key,
+                    s2_authenticated_key,
+                    s2_unauthenticated_key,
+                ),
                 self.async_start_addon,
                 catch_error=catch_error,
             )
@@ -260,13 +282,23 @@ class AddonManager:
         """Stop the Z-Wave JS add-on."""
         await async_stop_addon(self._hass, ADDON_SLUG)
 
-    async def async_configure_addon(self, usb_path: str, network_key: str) -> None:
+    async def async_configure_addon(
+        self,
+        usb_path: str,
+        s0_legacy_key: str,
+        s2_access_control_key: str,
+        s2_authenticated_key: str,
+        s2_unauthenticated_key: str,
+    ) -> None:
         """Configure and start Z-Wave JS add-on."""
         addon_info = await self.async_get_addon_info()
 
         new_addon_options = {
             CONF_ADDON_DEVICE: usb_path,
-            CONF_ADDON_NETWORK_KEY: network_key,
+            CONF_ADDON_S0_LEGACY_KEY: s0_legacy_key,
+            CONF_ADDON_S2_ACCESS_CONTROL_KEY: s2_access_control_key,
+            CONF_ADDON_S2_AUTHENTICATED_KEY: s2_authenticated_key,
+            CONF_ADDON_S2_UNAUTHENTICATED_KEY: s2_unauthenticated_key,
         }
 
         if new_addon_options != addon_info.options:
@@ -274,7 +306,13 @@ class AddonManager:
 
     @callback
     def async_schedule_setup_addon(
-        self, usb_path: str, network_key: str, catch_error: bool = False
+        self,
+        usb_path: str,
+        s0_legacy_key: str,
+        s2_access_control_key: str,
+        s2_authenticated_key: str,
+        s2_unauthenticated_key: str,
+        catch_error: bool = False,
     ) -> asyncio.Task:
         """Schedule a task that configures and starts the Z-Wave JS add-on.
 
@@ -283,7 +321,14 @@ class AddonManager:
         if not self._start_task or self._start_task.done():
             LOGGER.info("Z-Wave JS add-on is not running. Starting add-on")
             self._start_task = self._async_schedule_addon_operation(
-                partial(self.async_configure_addon, usb_path, network_key),
+                partial(
+                    self.async_configure_addon,
+                    usb_path,
+                    s0_legacy_key,
+                    s2_access_control_key,
+                    s2_authenticated_key,
+                    s2_unauthenticated_key,
+                ),
                 self.async_start_addon,
                 catch_error=catch_error,
             )

homeassistant/components/zwave_js/config_flow.py

@@ -31,8 +31,15 @@ from .const import (
     CONF_ADDON_EMULATE_HARDWARE,
     CONF_ADDON_LOG_LEVEL,
     CONF_ADDON_NETWORK_KEY,
+    CONF_ADDON_S0_LEGACY_KEY,
+    CONF_ADDON_S2_ACCESS_CONTROL_KEY,
+    CONF_ADDON_S2_AUTHENTICATED_KEY,
+    CONF_ADDON_S2_UNAUTHENTICATED_KEY,
     CONF_INTEGRATION_CREATED_ADDON,
-    CONF_NETWORK_KEY,
+    CONF_S0_LEGACY_KEY,
+    CONF_S2_ACCESS_CONTROL_KEY,
+    CONF_S2_AUTHENTICATED_KEY,
+    CONF_S2_UNAUTHENTICATED_KEY,
     CONF_USB_PATH,
     CONF_USE_ADDON,
     DOMAIN,
@@ -59,7 +66,10 @@ ADDON_LOG_LEVELS = {
 }
 ADDON_USER_INPUT_MAP = {
     CONF_ADDON_DEVICE: CONF_USB_PATH,
-    CONF_ADDON_NETWORK_KEY: CONF_NETWORK_KEY,
+    CONF_ADDON_S0_LEGACY_KEY: CONF_S0_LEGACY_KEY,
+    CONF_ADDON_S2_ACCESS_CONTROL_KEY: CONF_S2_ACCESS_CONTROL_KEY,
+    CONF_ADDON_S2_AUTHENTICATED_KEY: CONF_S2_AUTHENTICATED_KEY,
+    CONF_ADDON_S2_UNAUTHENTICATED_KEY: CONF_S2_UNAUTHENTICATED_KEY,
     CONF_ADDON_LOG_LEVEL: CONF_LOG_LEVEL,
     CONF_ADDON_EMULATE_HARDWARE: CONF_EMULATE_HARDWARE,
 }
@@ -113,7 +123,10 @@ class BaseZwaveJSFlow(FlowHandler):
 
     def __init__(self) -> None:
         """Set up flow instance."""
-        self.network_key: str | None = None
+        self.s0_legacy_key: str | None = None
+        self.s2_access_control_key: str | None = None
+        self.s2_authenticated_key: str | None = None
+        self.s2_unauthenticated_key: str | None = None
         self.usb_path: str | None = None
         self.ws_address: str | None = None
         self.restart_addon: bool = False
@@ -460,7 +473,16 @@ class ConfigFlow(BaseZwaveJSFlow, config_entries.ConfigFlow, domain=DOMAIN):
         if addon_info.state == AddonState.RUNNING:
             addon_config = addon_info.options
             self.usb_path = addon_config[CONF_ADDON_DEVICE]
-            self.network_key = addon_config.get(CONF_ADDON_NETWORK_KEY, "")
+            self.s0_legacy_key = addon_config.get(CONF_ADDON_S0_LEGACY_KEY, "")
+            self.s2_access_control_key = addon_config.get(
+                CONF_ADDON_S2_ACCESS_CONTROL_KEY, ""
+            )
+            self.s2_authenticated_key = addon_config.get(
+                CONF_ADDON_S2_AUTHENTICATED_KEY, ""
+            )
+            self.s2_unauthenticated_key = addon_config.get(
+                CONF_ADDON_S2_UNAUTHENTICATED_KEY, ""
+            )
             return await self.async_step_finish_addon_setup()
 
         if addon_info.state == AddonState.NOT_RUNNING:
@@ -476,13 +498,19 @@ class ConfigFlow(BaseZwaveJSFlow, config_entries.ConfigFlow, domain=DOMAIN):
         addon_config = addon_info.options
 
         if user_input is not None:
-            self.network_key = user_input[CONF_NETWORK_KEY]
+            self.s0_legacy_key = user_input[CONF_S0_LEGACY_KEY]
+            self.s2_access_control_key = user_input[CONF_S2_ACCESS_CONTROL_KEY]
+            self.s2_authenticated_key = user_input[CONF_S2_AUTHENTICATED_KEY]
+            self.s2_unauthenticated_key = user_input[CONF_S2_UNAUTHENTICATED_KEY]
             self.usb_path = user_input[CONF_USB_PATH]
 
             new_addon_config = {
                 **addon_config,
                 CONF_ADDON_DEVICE: self.usb_path,
-                CONF_ADDON_NETWORK_KEY: self.network_key,
+                CONF_ADDON_S0_LEGACY_KEY: self.s0_legacy_key,
+                CONF_ADDON_S2_ACCESS_CONTROL_KEY: self.s2_access_control_key,
+                CONF_ADDON_S2_AUTHENTICATED_KEY: self.s2_authenticated_key,
+                CONF_ADDON_S2_UNAUTHENTICATED_KEY: self.s2_unauthenticated_key,
             }
 
             if new_addon_config != addon_config:
@@ -491,12 +519,32 @@ class ConfigFlow(BaseZwaveJSFlow, config_entries.ConfigFlow, domain=DOMAIN):
             return await self.async_step_start_addon()
 
         usb_path = self.usb_path or addon_config.get(CONF_ADDON_DEVICE) or ""
-        network_key = addon_config.get(CONF_ADDON_NETWORK_KEY, self.network_key or "")
+        s0_legacy_key = addon_config.get(
+            CONF_ADDON_S0_LEGACY_KEY, self.s0_legacy_key or ""
+        )
+        s2_access_control_key = addon_config.get(
+            CONF_ADDON_S2_ACCESS_CONTROL_KEY, self.s2_access_control_key or ""
+        )
+        s2_authenticated_key = addon_config.get(
+            CONF_ADDON_S2_AUTHENTICATED_KEY, self.s2_authenticated_key or ""
+        )
+        s2_unauthenticated_key = addon_config.get(
+            CONF_ADDON_S2_UNAUTHENTICATED_KEY, self.s2_unauthenticated_key or ""
+        )
 
         data_schema = vol.Schema(
             {
                 vol.Required(CONF_USB_PATH, default=usb_path): str,
-                vol.Optional(CONF_NETWORK_KEY, default=network_key): str,
+                vol.Optional(CONF_S0_LEGACY_KEY, default=s0_legacy_key): str,
+                vol.Optional(
+                    CONF_S2_ACCESS_CONTROL_KEY, default=s2_access_control_key
+                ): str,
+                vol.Optional(
+                    CONF_S2_AUTHENTICATED_KEY, default=s2_authenticated_key
+                ): str,
+                vol.Optional(
+                    CONF_S2_UNAUTHENTICATED_KEY, default=s2_unauthenticated_key
+                ): str,
             }
         )
 
@@ -531,7 +579,10 @@ class ConfigFlow(BaseZwaveJSFlow, config_entries.ConfigFlow, domain=DOMAIN):
             updates={
                 CONF_URL: self.ws_address,
                 CONF_USB_PATH: self.usb_path,
-                CONF_NETWORK_KEY: self.network_key,
+                CONF_S0_LEGACY_KEY: self.s0_legacy_key,
+                CONF_S2_ACCESS_CONTROL_KEY: self.s2_access_control_key,
+                CONF_S2_AUTHENTICATED_KEY: self.s2_authenticated_key,
+                CONF_S2_UNAUTHENTICATED_KEY: self.s2_unauthenticated_key,
             }
         )
         return self._async_create_entry_from_vars()
@@ -548,7 +599,10 @@ class ConfigFlow(BaseZwaveJSFlow, config_entries.ConfigFlow, domain=DOMAIN):
             data={
                 CONF_URL: self.ws_address,
                 CONF_USB_PATH: self.usb_path,
-                CONF_NETWORK_KEY: self.network_key,
+                CONF_S0_LEGACY_KEY: self.s0_legacy_key,
+                CONF_S2_ACCESS_CONTROL_KEY: self.s2_access_control_key,
+                CONF_S2_AUTHENTICATED_KEY: self.s2_authenticated_key,
+                CONF_S2_UNAUTHENTICATED_KEY: self.s2_unauthenticated_key,
                 CONF_USE_ADDON: self.use_addon,
                 CONF_INTEGRATION_CREATED_ADDON: self.integration_created_addon,
             },
@@ -658,13 +712,19 @@ class OptionsFlowHandler(BaseZwaveJSFlow, config_entries.OptionsFlow):
         addon_config = addon_info.options
 
         if user_input is not None:
-            self.network_key = user_input[CONF_NETWORK_KEY]
+            self.s0_legacy_key = user_input[CONF_S0_LEGACY_KEY]
+            self.s2_access_control_key = user_input[CONF_S2_ACCESS_CONTROL_KEY]
+            self.s2_authenticated_key = user_input[CONF_S2_AUTHENTICATED_KEY]
+            self.s2_unauthenticated_key = user_input[CONF_S2_UNAUTHENTICATED_KEY]
             self.usb_path = user_input[CONF_USB_PATH]
 
             new_addon_config = {
                 **addon_config,
                 CONF_ADDON_DEVICE: self.usb_path,
-                CONF_ADDON_NETWORK_KEY: self.network_key,
+                CONF_ADDON_S0_LEGACY_KEY: self.s0_legacy_key,
+                CONF_ADDON_S2_ACCESS_CONTROL_KEY: self.s2_access_control_key,
+                CONF_ADDON_S2_AUTHENTICATED_KEY: self.s2_authenticated_key,
+                CONF_ADDON_S2_UNAUTHENTICATED_KEY: self.s2_unauthenticated_key,
                 CONF_ADDON_LOG_LEVEL: user_input[CONF_LOG_LEVEL],
                 CONF_ADDON_EMULATE_HARDWARE: user_input[CONF_EMULATE_HARDWARE],
             }
@@ -674,6 +734,8 @@ class OptionsFlowHandler(BaseZwaveJSFlow, config_entries.OptionsFlow):
                     self.restart_addon = True
                 # Copy the add-on config to keep the objects separate.
                 self.original_addon_config = dict(addon_config)
+                # Remove legacy network_key
+                new_addon_config.pop(CONF_ADDON_NETWORK_KEY, None)
                 await self._async_set_addon_config(new_addon_config)
 
             if addon_info.state == AddonState.RUNNING and not self.restart_addon:
@@ -689,14 +751,34 @@ class OptionsFlowHandler(BaseZwaveJSFlow, config_entries.OptionsFlow):
             return await self.async_step_start_addon()
 
         usb_path = addon_config.get(CONF_ADDON_DEVICE, self.usb_path or "")
-        network_key = addon_config.get(CONF_ADDON_NETWORK_KEY, self.network_key or "")
+        s0_legacy_key = addon_config.get(
+            CONF_ADDON_S0_LEGACY_KEY, self.s0_legacy_key or ""
+        )
+        s2_access_control_key = addon_config.get(
+            CONF_ADDON_S2_ACCESS_CONTROL_KEY, self.s2_access_control_key or ""
+        )
+        s2_authenticated_key = addon_config.get(
+            CONF_ADDON_S2_AUTHENTICATED_KEY, self.s2_authenticated_key or ""
+        )
+        s2_unauthenticated_key = addon_config.get(
+            CONF_ADDON_S2_UNAUTHENTICATED_KEY, self.s2_unauthenticated_key or ""
+        )
         log_level = addon_config.get(CONF_ADDON_LOG_LEVEL, "info")
         emulate_hardware = addon_config.get(CONF_ADDON_EMULATE_HARDWARE, False)
 
         data_schema = vol.Schema(
             {
                 vol.Required(CONF_USB_PATH, default=usb_path): str,
-                vol.Optional(CONF_NETWORK_KEY, default=network_key): str,
+                vol.Optional(CONF_S0_LEGACY_KEY, default=s0_legacy_key): str,
+                vol.Optional(
+                    CONF_S2_ACCESS_CONTROL_KEY, default=s2_access_control_key
+                ): str,
+                vol.Optional(
+                    CONF_S2_AUTHENTICATED_KEY, default=s2_authenticated_key
+                ): str,
+                vol.Optional(
+                    CONF_S2_UNAUTHENTICATED_KEY, default=s2_unauthenticated_key
+                ): str,
                 vol.Optional(CONF_LOG_LEVEL, default=log_level): vol.In(
                     ADDON_LOG_LEVELS
                 ),
@@ -746,7 +828,10 @@ class OptionsFlowHandler(BaseZwaveJSFlow, config_entries.OptionsFlow):
                 **self.config_entry.data,
                 CONF_URL: self.ws_address,
                 CONF_USB_PATH: self.usb_path,
-                CONF_NETWORK_KEY: self.network_key,
+                CONF_S0_LEGACY_KEY: self.s0_legacy_key,
+                CONF_S2_ACCESS_CONTROL_KEY: self.s2_access_control_key,
+                CONF_S2_AUTHENTICATED_KEY: self.s2_authenticated_key,
+                CONF_S2_UNAUTHENTICATED_KEY: self.s2_unauthenticated_key,
                 CONF_USE_ADDON: True,
                 CONF_INTEGRATION_CREATED_ADDON: self.integration_created_addon,
             }
@@ -779,6 +864,7 @@ class OptionsFlowHandler(BaseZwaveJSFlow, config_entries.OptionsFlow):
         addon_config_input = {
             ADDON_USER_INPUT_MAP[addon_key]: addon_val
             for addon_key, addon_val in self.original_addon_config.items()
+            if addon_key in ADDON_USER_INPUT_MAP
         }
         _LOGGER.debug("Reverting add-on options, reason: %s", reason)
         return await self.async_step_configure_addon(addon_config_input)

homeassistant/components/zwave_js/const.py

@@ -9,8 +9,16 @@ CONF_ADDON_DEVICE = "device"
 CONF_ADDON_EMULATE_HARDWARE = "emulate_hardware"
 CONF_ADDON_LOG_LEVEL = "log_level"
 CONF_ADDON_NETWORK_KEY = "network_key"
+CONF_ADDON_S0_LEGACY_KEY = "s0_legacy_key"
+CONF_ADDON_S2_ACCESS_CONTROL_KEY = "s2_access_control_key"
+CONF_ADDON_S2_AUTHENTICATED_KEY = "s2_authenticated_key"
+CONF_ADDON_S2_UNAUTHENTICATED_KEY = "s2_unauthenticated_key"
 CONF_INTEGRATION_CREATED_ADDON = "integration_created_addon"
 CONF_NETWORK_KEY = "network_key"
+CONF_S0_LEGACY_KEY = "s0_legacy_key"
+CONF_S2_ACCESS_CONTROL_KEY = "s2_access_control_key"
+CONF_S2_AUTHENTICATED_KEY = "s2_authenticated_key"
+CONF_S2_UNAUTHENTICATED_KEY = "s2_unauthenticated_key"
 CONF_USB_PATH = "usb_path"
 CONF_USE_ADDON = "use_addon"
 CONF_DATA_COLLECTION_OPTED_IN = "data_collection_opted_in"

tests/components/zwave_js/test_config_flow.py

@@ -164,7 +164,10 @@ async def test_manual(hass):
     assert result2["data"] == {
         "url": "ws://localhost:3000",
         "usb_path": None,
-        "network_key": None,
+        "s0_legacy_key": None,
+        "s2_access_control_key": None,
+        "s2_authenticated_key": None,
+        "s2_unauthenticated_key": None,
         "use_addon": False,
         "integration_created_addon": False,
     }
@@ -278,7 +281,10 @@ async def test_supervisor_discovery(
     await setup.async_setup_component(hass, "persistent_notification", {})
 
     addon_options["device"] = "/test"
-    addon_options["network_key"] = "abc123"
+    addon_options["s0_legacy_key"] = "new123"
+    addon_options["s2_access_control_key"] = "new456"
+    addon_options["s2_authenticated_key"] = "new789"
+    addon_options["s2_unauthenticated_key"] = "new987"
 
     result = await hass.config_entries.flow.async_init(
         DOMAIN,
@@ -300,7 +306,10 @@ async def test_supervisor_discovery(
     assert result["data"] == {
         "url": "ws://host1:3001",
         "usb_path": "/test",
-        "network_key": "abc123",
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
         "use_addon": True,
         "integration_created_addon": False,
     }
@@ -336,7 +345,10 @@ async def test_clean_discovery_on_user_create(
     await setup.async_setup_component(hass, "persistent_notification", {})
 
     addon_options["device"] = "/test"
-    addon_options["network_key"] = "abc123"
+    addon_options["s0_legacy_key"] = "new123"
+    addon_options["s2_access_control_key"] = "new456"
+    addon_options["s2_authenticated_key"] = "new789"
+    addon_options["s2_unauthenticated_key"] = "new987"
 
     result = await hass.config_entries.flow.async_init(
         DOMAIN,
@@ -380,7 +392,10 @@ async def test_clean_discovery_on_user_create(
     assert result["data"] == {
         "url": "ws://localhost:3000",
         "usb_path": None,
-        "network_key": None,
+        "s0_legacy_key": None,
+        "s2_access_control_key": None,
+        "s2_authenticated_key": None,
+        "s2_unauthenticated_key": None,
         "use_addon": False,
         "integration_created_addon": False,
     }
@@ -433,6 +448,7 @@ async def test_abort_hassio_discovery_with_existing_flow(
     assert result2["reason"] == "already_in_progress"
 
 
+@pytest.mark.parametrize("discovery_info", [{"config": ADDON_DISCOVERY_INFO}])
 async def test_usb_discovery(
     hass,
     supervisor,
@@ -467,11 +483,28 @@ async def test_usb_discovery(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -491,14 +524,21 @@ async def test_usb_discovery(
 
     assert result["type"] == "create_entry"
     assert result["title"] == TITLE
-    assert result["data"]["usb_path"] == "/test"
+    assert result["data"] == {
-    assert result["data"]["integration_created_addon"] is True
+        "url": "ws://host1:3001",
-    assert result["data"]["use_addon"] is True
+        "usb_path": "/test",
-    assert result["data"]["network_key"] == "abc123"
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
+        "use_addon": True,
+        "integration_created_addon": True,
+    }
     assert len(mock_setup.mock_calls) == 1
     assert len(mock_setup_entry.mock_calls) == 1
 
 
+@pytest.mark.parametrize("discovery_info", [{"config": ADDON_DISCOVERY_INFO}])
 async def test_usb_discovery_addon_not_running(
     hass,
     supervisor,
@@ -528,18 +568,35 @@ async def test_usb_discovery_addon_not_running(
     data_schema = result["data_schema"]
     assert data_schema({}) == {
         "usb_path": USB_DISCOVERY_INFO["device"],
-        "network_key": "",
+        "s0_legacy_key": "",
+        "s2_access_control_key": "",
+        "s2_authenticated_key": "",
+        "s2_unauthenticated_key": "",
     }
 
     result = await hass.config_entries.flow.async_configure(
         result["flow_id"],
-        {"usb_path": USB_DISCOVERY_INFO["device"], "network_key": "abc123"},
+        {
+            "usb_path": USB_DISCOVERY_INFO["device"],
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
         hass,
         "core_zwave_js",
-        {"options": {"device": USB_DISCOVERY_INFO["device"], "network_key": "abc123"}},
+        {
+            "options": {
+                "device": USB_DISCOVERY_INFO["device"],
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -559,10 +616,16 @@ async def test_usb_discovery_addon_not_running(
 
     assert result["type"] == "create_entry"
     assert result["title"] == TITLE
-    assert result["data"]["usb_path"] == USB_DISCOVERY_INFO["device"]
+    assert result["data"] == {
-    assert result["data"]["integration_created_addon"] is False
+        "url": "ws://host1:3001",
-    assert result["data"]["use_addon"] is True
+        "usb_path": USB_DISCOVERY_INFO["device"],
-    assert result["data"]["network_key"] == "abc123"
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
+        "use_addon": True,
+        "integration_created_addon": False,
+    }
     assert len(mock_setup.mock_calls) == 1
     assert len(mock_setup_entry.mock_calls) == 1
 
@@ -589,11 +652,28 @@ async def test_discovery_addon_not_running(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -616,7 +696,10 @@ async def test_discovery_addon_not_running(
     assert result["data"] == {
         "url": "ws://host1:3001",
         "usb_path": "/test",
-        "network_key": "abc123",
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
         "use_addon": True,
         "integration_created_addon": False,
     }
@@ -661,11 +744,28 @@ async def test_discovery_addon_not_installed(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -688,7 +788,10 @@ async def test_discovery_addon_not_installed(
     assert result["data"] == {
         "url": "ws://host1:3001",
         "usb_path": "/test",
-        "network_key": "abc123",
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
         "use_addon": True,
         "integration_created_addon": True,
     }
@@ -808,7 +911,10 @@ async def test_not_addon(hass, supervisor):
     assert result["data"] == {
         "url": "ws://localhost:3000",
         "usb_path": None,
-        "network_key": None,
+        "s0_legacy_key": None,
+        "s2_access_control_key": None,
+        "s2_authenticated_key": None,
+        "s2_unauthenticated_key": None,
         "use_addon": False,
         "integration_created_addon": False,
     }
@@ -826,7 +932,10 @@ async def test_addon_running(
 ):
     """Test add-on already running on Supervisor."""
     addon_options["device"] = "/test"
-    addon_options["network_key"] = "abc123"
+    addon_options["s0_legacy_key"] = "new123"
+    addon_options["s2_access_control_key"] = "new456"
+    addon_options["s2_authenticated_key"] = "new789"
+    addon_options["s2_unauthenticated_key"] = "new987"
     await setup.async_setup_component(hass, "persistent_notification", {})
 
     result = await hass.config_entries.flow.async_init(
@@ -852,7 +961,10 @@ async def test_addon_running(
     assert result["data"] == {
         "url": "ws://host1:3001",
         "usb_path": "/test",
-        "network_key": "abc123",
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
         "use_addon": True,
         "integration_created_addon": False,
     }
@@ -928,13 +1040,20 @@ async def test_addon_running_already_configured(
 ):
     """Test that only one unique instance is allowed when add-on is running."""
     addon_options["device"] = "/test_new"
-    addon_options["network_key"] = "def456"
+    addon_options["s0_legacy_key"] = "new123"
+    addon_options["s2_access_control_key"] = "new456"
+    addon_options["s2_authenticated_key"] = "new789"
+    addon_options["s2_unauthenticated_key"] = "new987"
     entry = MockConfigEntry(
         domain=DOMAIN,
         data={
             "url": "ws://localhost:3000",
             "usb_path": "/test",
-            "network_key": "abc123",
+            "network_key": "old123",
+            "s0_legacy_key": "old123",
+            "s2_access_control_key": "old456",
+            "s2_authenticated_key": "old789",
+            "s2_unauthenticated_key": "old987",
         },
         title=TITLE,
         unique_id=1234,
@@ -957,7 +1076,10 @@ async def test_addon_running_already_configured(
     assert result["reason"] == "already_configured"
     assert entry.data["url"] == "ws://host1:3001"
     assert entry.data["usb_path"] == "/test_new"
-    assert entry.data["network_key"] == "def456"
+    assert entry.data["s0_legacy_key"] == "new123"
+    assert entry.data["s2_access_control_key"] == "new456"
+    assert entry.data["s2_authenticated_key"] == "new789"
+    assert entry.data["s2_unauthenticated_key"] == "new987"
 
 
 @pytest.mark.parametrize("discovery_info", [{"config": ADDON_DISCOVERY_INFO}])
@@ -988,11 +1110,28 @@ async def test_addon_installed(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -1015,7 +1154,10 @@ async def test_addon_installed(
     assert result["data"] == {
         "url": "ws://host1:3001",
         "usb_path": "/test",
-        "network_key": "abc123",
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
         "use_addon": True,
         "integration_created_addon": False,
     }
@@ -1054,11 +1196,28 @@ async def test_addon_installed_start_failure(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -1113,11 +1272,28 @@ async def test_addon_installed_failures(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -1163,11 +1339,28 @@ async def test_addon_installed_set_options_failure(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "abort"
@@ -1192,7 +1385,11 @@ async def test_addon_installed_already_configured(
         data={
             "url": "ws://localhost:3000",
             "usb_path": "/test",
-            "network_key": "abc123",
+            "network_key": "old123",
+            "s0_legacy_key": "old123",
+            "s2_access_control_key": "old456",
+            "s2_authenticated_key": "old789",
+            "s2_unauthenticated_key": "old987",
         },
         title=TITLE,
         unique_id=1234,
@@ -1215,13 +1412,28 @@ async def test_addon_installed_already_configured(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test_new", "network_key": "def456"}
+        result["flow_id"],
+        {
+            "usb_path": "/test_new",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
         hass,
         "core_zwave_js",
-        {"options": {"device": "/test_new", "network_key": "def456"}},
+        {
+            "options": {
+                "device": "/test_new",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -1236,7 +1448,10 @@ async def test_addon_installed_already_configured(
     assert result["reason"] == "already_configured"
     assert entry.data["url"] == "ws://host1:3001"
     assert entry.data["usb_path"] == "/test_new"
-    assert entry.data["network_key"] == "def456"
+    assert entry.data["s0_legacy_key"] == "new123"
+    assert entry.data["s2_access_control_key"] == "new456"
+    assert entry.data["s2_authenticated_key"] == "new789"
+    assert entry.data["s2_unauthenticated_key"] == "new987"
 
 
 @pytest.mark.parametrize("discovery_info", [{"config": ADDON_DISCOVERY_INFO}])
@@ -1279,11 +1494,28 @@ async def test_addon_not_installed(
     assert result["step_id"] == "configure_addon"
 
     result = await hass.config_entries.flow.async_configure(
-        result["flow_id"], {"usb_path": "/test", "network_key": "abc123"}
+        result["flow_id"],
+        {
+            "usb_path": "/test",
+            "s0_legacy_key": "new123",
+            "s2_access_control_key": "new456",
+            "s2_authenticated_key": "new789",
+            "s2_unauthenticated_key": "new987",
+        },
     )
 
     assert set_addon_options.call_args == call(
-        hass, "core_zwave_js", {"options": {"device": "/test", "network_key": "abc123"}}
+        hass,
+        "core_zwave_js",
+        {
+            "options": {
+                "device": "/test",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
+            }
+        },
     )
 
     assert result["type"] == "progress"
@@ -1306,7 +1538,10 @@ async def test_addon_not_installed(
     assert result["data"] == {
         "url": "ws://host1:3001",
         "usb_path": "/test",
-        "network_key": "abc123",
+        "s0_legacy_key": "new123",
+        "s2_access_control_key": "new456",
+        "s2_authenticated_key": "new789",
+        "s2_unauthenticated_key": "new987",
         "use_addon": True,
         "integration_created_addon": True,
     }
@@ -1431,10 +1666,20 @@ async def test_options_not_addon(hass, client, supervisor, integration):
         (
             {"config": ADDON_DISCOVERY_INFO},
             {},
-            {"device": "/test", "network_key": "abc123"},
+            {
+                "device": "/test",
+                "network_key": "old123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
+            },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1443,10 +1688,20 @@ async def test_options_not_addon(hass, client, supervisor, integration):
         (
             {"config": ADDON_DISCOVERY_INFO},
             {"use_addon": True},
-            {"device": "/test", "network_key": "abc123"},
+            {
+                "device": "/test",
+                "network_key": "old123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
+            },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1519,7 +1774,18 @@ async def test_options_addon_running(
     assert result["type"] == "create_entry"
     assert entry.data["url"] == "ws://host1:3001"
     assert entry.data["usb_path"] == new_addon_options["device"]
-    assert entry.data["network_key"] == new_addon_options["network_key"]
+    assert entry.data["s0_legacy_key"] == new_addon_options["s0_legacy_key"]
+    assert (
+        entry.data["s2_access_control_key"]
+        == new_addon_options["s2_access_control_key"]
+    )
+    assert (
+        entry.data["s2_authenticated_key"] == new_addon_options["s2_authenticated_key"]
+    )
+    assert (
+        entry.data["s2_unauthenticated_key"]
+        == new_addon_options["s2_unauthenticated_key"]
+    )
     assert entry.data["use_addon"] is True
     assert entry.data["integration_created_addon"] is False
     assert client.connect.call_count == 2
@@ -1534,13 +1800,20 @@ async def test_options_addon_running(
             {},
             {
                 "device": "/test",
-                "network_key": "abc123",
+                "network_key": "old123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
             {
                 "usb_path": "/test",
-                "network_key": "abc123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1599,7 +1872,18 @@ async def test_options_addon_running_no_changes(
     assert result["type"] == "create_entry"
     assert entry.data["url"] == "ws://host1:3001"
     assert entry.data["usb_path"] == new_addon_options["device"]
-    assert entry.data["network_key"] == new_addon_options["network_key"]
+    assert entry.data["s0_legacy_key"] == new_addon_options["s0_legacy_key"]
+    assert (
+        entry.data["s2_access_control_key"]
+        == new_addon_options["s2_access_control_key"]
+    )
+    assert (
+        entry.data["s2_authenticated_key"] == new_addon_options["s2_authenticated_key"]
+    )
+    assert (
+        entry.data["s2_unauthenticated_key"]
+        == new_addon_options["s2_unauthenticated_key"]
+    )
     assert entry.data["use_addon"] is True
     assert entry.data["integration_created_addon"] is False
     assert client.connect.call_count == 2
@@ -1625,13 +1909,20 @@ async def different_device_server_version(*args):
             {},
             {
                 "device": "/test",
-                "network_key": "abc123",
+                "network_key": "old123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1705,6 +1996,9 @@ async def test_options_different_device(
     result = await hass.config_entries.options.async_configure(result["flow_id"])
     await hass.async_block_till_done()
 
+    # Legacy network key is not reset.
+    old_addon_options.pop("network_key")
+
     assert set_addon_options.call_count == 2
     assert set_addon_options.call_args == call(
         hass,
@@ -1737,13 +2031,20 @@ async def test_options_different_device(
             {},
             {
                 "device": "/test",
-                "network_key": "abc123",
+                "network_key": "old123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1755,13 +2056,20 @@ async def test_options_different_device(
             {},
             {
                 "device": "/test",
-                "network_key": "abc123",
+                "network_key": "old123",
+                "s0_legacy_key": "old123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1838,6 +2146,8 @@ async def test_options_addon_restart_failed(
     result = await hass.config_entries.options.async_configure(result["flow_id"])
     await hass.async_block_till_done()
 
+    # The legacy network key should not be reset.
+    old_addon_options.pop("network_key")
     assert set_addon_options.call_count == 2
     assert set_addon_options.call_args == call(
         hass,
@@ -1871,12 +2181,19 @@ async def test_options_addon_restart_failed(
             {
                 "device": "/test",
                 "network_key": "abc123",
+                "s0_legacy_key": "abc123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
             {
                 "usb_path": "/test",
-                "network_key": "abc123",
+                "s0_legacy_key": "abc123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1945,10 +2262,20 @@ async def test_options_addon_running_server_info_failure(
         (
             {"config": ADDON_DISCOVERY_INFO},
             {},
-            {"device": "/test", "network_key": "abc123"},
+            {
+                "device": "/test",
+                "network_key": "abc123",
+                "s0_legacy_key": "abc123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
+            },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -1957,10 +2284,20 @@ async def test_options_addon_running_server_info_failure(
         (
             {"config": ADDON_DISCOVERY_INFO},
             {"use_addon": True},
-            {"device": "/test", "network_key": "abc123"},
+            {
+                "device": "/test",
+                "network_key": "abc123",
+                "s0_legacy_key": "abc123",
+                "s2_access_control_key": "old456",
+                "s2_authenticated_key": "old789",
+                "s2_unauthenticated_key": "old987",
+            },
             {
                 "usb_path": "/new",
-                "network_key": "new123",
+                "s0_legacy_key": "new123",
+                "s2_access_control_key": "new456",
+                "s2_authenticated_key": "new789",
+                "s2_unauthenticated_key": "new987",
                 "log_level": "info",
                 "emulate_hardware": False,
             },
@@ -2048,7 +2385,7 @@ async def test_options_addon_not_installed(
     assert result["type"] == "create_entry"
     assert entry.data["url"] == "ws://host1:3001"
     assert entry.data["usb_path"] == new_addon_options["device"]
-    assert entry.data["network_key"] == new_addon_options["network_key"]
+    assert entry.data["s0_legacy_key"] == new_addon_options["s0_legacy_key"]
     assert entry.data["use_addon"] is True
     assert entry.data["integration_created_addon"] is True
     assert client.connect.call_count == 2

tests/components/zwave_js/test_init.py

@@ -272,15 +272,28 @@ async def test_start_addon(
 ):
     """Test start the Z-Wave JS add-on during entry setup."""
     device = "/test"
-    network_key = "abc123"
+    s0_legacy_key = "s0_legacy"
+    s2_access_control_key = "s2_access_control"
+    s2_authenticated_key = "s2_authenticated"
+    s2_unauthenticated_key = "s2_unauthenticated"
     addon_options = {
         "device": device,
-        "network_key": network_key,
+        "s0_legacy_key": s0_legacy_key,
+        "s2_access_control_key": s2_access_control_key,
+        "s2_authenticated_key": s2_authenticated_key,
+        "s2_unauthenticated_key": s2_unauthenticated_key,
     }
     entry = MockConfigEntry(
         domain=DOMAIN,
         title="Z-Wave JS",
-        data={"use_addon": True, "usb_path": device, "network_key": network_key},
+        data={
+            "use_addon": True,
+            "usb_path": device,
+            "s0_legacy_key": s0_legacy_key,
+            "s2_access_control_key": s2_access_control_key,
+            "s2_authenticated_key": s2_authenticated_key,
+            "s2_unauthenticated_key": s2_unauthenticated_key,
+        },
     )
     entry.add_to_hass(hass)
 
@@ -303,15 +316,28 @@ async def test_install_addon(
     """Test install and start the Z-Wave JS add-on during entry setup."""
     addon_installed.return_value["version"] = None
     device = "/test"
-    network_key = "abc123"
+    s0_legacy_key = "s0_legacy"
+    s2_access_control_key = "s2_access_control"
+    s2_authenticated_key = "s2_authenticated"
+    s2_unauthenticated_key = "s2_unauthenticated"
     addon_options = {
         "device": device,
-        "network_key": network_key,
+        "s0_legacy_key": s0_legacy_key,
+        "s2_access_control_key": s2_access_control_key,
+        "s2_authenticated_key": s2_authenticated_key,
+        "s2_unauthenticated_key": s2_unauthenticated_key,
     }
     entry = MockConfigEntry(
         domain=DOMAIN,
         title="Z-Wave JS",
-        data={"use_addon": True, "usb_path": device, "network_key": network_key},
+        data={
+            "use_addon": True,
+            "usb_path": device,
+            "s0_legacy_key": s0_legacy_key,
+            "s2_access_control_key": s2_access_control_key,
+            "s2_authenticated_key": s2_authenticated_key,
+            "s2_unauthenticated_key": s2_unauthenticated_key,
+        },
     )
     entry.add_to_hass(hass)
 
@@ -357,8 +383,27 @@ async def test_addon_info_failure(
 
 
 @pytest.mark.parametrize(
-    "old_device, new_device, old_network_key, new_network_key",
+    (
-    [("/old_test", "/new_test", "old123", "new123")],
+        "old_device, new_device, "
+        "old_s0_legacy_key, new_s0_legacy_key, "
+        "old_s2_access_control_key, new_s2_access_control_key, "
+        "old_s2_authenticated_key, new_s2_authenticated_key, "
+        "old_s2_unauthenticated_key, new_s2_unauthenticated_key"
+    ),
+    [
+        (
+            "/old_test",
+            "/new_test",
+            "old123",
+            "new123",
+            "old456",
+            "new456",
+            "old789",
+            "new789",
+            "old987",
+            "new987",
+        )
+    ],
 )
 async def test_addon_options_changed(
     hass,
@@ -370,12 +415,21 @@ async def test_addon_options_changed(
     start_addon,
     old_device,
     new_device,
-    old_network_key,
+    old_s0_legacy_key,
-    new_network_key,
+    new_s0_legacy_key,
+    old_s2_access_control_key,
+    new_s2_access_control_key,
+    old_s2_authenticated_key,
+    new_s2_authenticated_key,
+    old_s2_unauthenticated_key,
+    new_s2_unauthenticated_key,
 ):
     """Test update config entry data on entry setup if add-on options changed."""
     addon_options["device"] = new_device
-    addon_options["network_key"] = new_network_key
+    addon_options["s0_legacy_key"] = new_s0_legacy_key
+    addon_options["s2_access_control_key"] = new_s2_access_control_key
+    addon_options["s2_authenticated_key"] = new_s2_authenticated_key
+    addon_options["s2_unauthenticated_key"] = new_s2_unauthenticated_key
     entry = MockConfigEntry(
         domain=DOMAIN,
         title="Z-Wave JS",
@@ -383,7 +437,10 @@ async def test_addon_options_changed(
             "url": "ws://host1:3001",
             "use_addon": True,
             "usb_path": old_device,
-            "network_key": old_network_key,
+            "s0_legacy_key": old_s0_legacy_key,
+            "s2_access_control_key": old_s2_access_control_key,
+            "s2_authenticated_key": old_s2_authenticated_key,
+            "s2_unauthenticated_key": old_s2_unauthenticated_key,
         },
     )
     entry.add_to_hass(hass)
@@ -393,7 +450,10 @@ async def test_addon_options_changed(
 
     assert entry.state == ConfigEntryState.LOADED
     assert entry.data["usb_path"] == new_device
-    assert entry.data["network_key"] == new_network_key
+    assert entry.data["s0_legacy_key"] == new_s0_legacy_key
+    assert entry.data["s2_access_control_key"] == new_s2_access_control_key
+    assert entry.data["s2_authenticated_key"] == new_s2_authenticated_key
+    assert entry.data["s2_unauthenticated_key"] == new_s2_unauthenticated_key
     assert install_addon.call_count == 0
     assert start_addon.call_count == 0