always set new device to default security level when first added

bubble-server/src/main/java/bubble/dao/device/DeviceDAO.java

@@ -120,12 +120,12 @@ public class DeviceDAO extends AccountOwnedEntityDAO<Device> {
     }
 
     @Override @NonNull public Device update(@NonNull final Device updateRequest) {
-        final var toUpdate = (Device) readOnlySession().get(Device.class, updateRequest.getUuid());
+        final Device toUpdate = (Device) readOnlySession().get(Device.class, updateRequest.getUuid());
         if (toUpdate == null) die("Cannot find device to update with uuid: " + updateRequest.getUuid());
         if (toUpdate.uninitialized()) die("Cannot update special devices: " + updateRequest.getName());
 
         toUpdate.update(updateRequest);
-        final var updated = super.update(toUpdate);
+        final Device updated = super.update(toUpdate);
         deviceService.setDeviceSecurityLevel(updated);
         refreshVpnUsers();
         return updated;

bubble-server/src/main/java/bubble/dao/device/FlexRouterDAO.java

@@ -83,9 +83,9 @@ public class FlexRouterDAO extends AccountOwnedEntityDAO<FlexRouter> implements
     @Override public void deleteDevice(String uuid) {
         final int count = bulkDelete("device", uuid);
         if (count <= 1) {
-            log.info("deleteDevice: deleted "+count+" TrustedClient records for device "+uuid);
+            log.info("deleteDevice: deleted "+count+" FlexRouter records for device "+uuid);
         } else {
-            log.warn("deleteDevice: deleted "+count+" TrustedClient records (expected only 1) for device "+uuid);
+            log.warn("deleteDevice: deleted "+count+" FlexRouter records (expected only 1) for device "+uuid);
         }
     }
 

bubble-server/src/main/java/bubble/resources/device/DevicesResource.java

@@ -86,9 +86,10 @@ public class DevicesResource extends AccountOwnedResource<Device, DeviceDAO> {
             device.initTotpKey();
         }
 
+        // always set to default level upon registration. user can change later.
         final DeviceSecurityLevel defaultSecurityLevel = deviceService.getDefaultSecurityLevel(device.getDeviceType());
-        log.info("setReferences: no securityLevel, setting to default for type "+device.getDeviceType()+": "+ defaultSecurityLevel);
-        if (!device.hasSecurityLevel()) device.setSecurityLevel(defaultSecurityLevel);
+        device.setSecurityLevel(defaultSecurityLevel);
+        log.info("setReferences: set securityLevel="+defaultSecurityLevel+" for device: "+device+" with type="+device.getDeviceType());
 
         return super.setReferences(ctx, caller, device);
     }