I suspect the app-id is stored in the lock after pairing and the belongs to the authorization id?
So why can/should you set it again during a lock action?
It is possible to add authorizations via an invitation as well instead of direct BLE pairing.
In that case the app-id of the new authorization is not known until the user redeems the invitation and uses the Smart Lock for the first time.
Therefore the Smart Lock will store the app-id once the first lock action is executed by the user and no app-id has been stored yet.
Just wondering… is there key exchange being done when a device with an invitation connects for the first time? Or is this sent along with the invitation (how is this security wise handled?..)
In that case a random key is generated when adding the authorization to the Smart Lock and before sending the invitation to the recipient. It is part of the payload of command 0x000B.