frugal-iot-server 0.3.7 → 0.3.9

package/frugal-iot-server.js

@@ -127,12 +127,36 @@ import sqlite3 from 'sqlite3'; // https://www.npmjs.com/package/sqlite3
 import crypto from 'crypto'; /* https://nodejs.org/api/crypto.html */
 // import cookieParser from 'cookie-parser'; // https://www.npmjs.com/package/cookie-parser (note comment on https://www.npmjs.com/package/express-session that not needed and conflicts with session)
 import {waterfall, each} from 'async';
+import { mailInit, mailConfigured, sendMail } from './lib/mailer.js';
+import { resetCodeMake, resetCodeCheck, resetRateOk } from './lib/resetcode.js';
 // import { openDB } from 'sqlite-express-package'; /* appContent, appSelect, validateId, validateAlias, tagCloud, atom, rss,*/
 
 export let config; // Live binding - lib/api-routes.js reads the current value at request time
 let mqttLogger = new MqttLogger();
 const loginUrl = '/dashboard/login.html';
 
+// Back to the login page with something to say. A form POST can only be answered with a redirect
+// and there is no session to hang a message on, so it all goes in the query string, where
+// mqtt-login reads it as attributes. "mode" is which of the four forms to show;
+// "messagetype" is error or info, which is the difference between a red box and a green one.
+function loginRedirect(res, { mode = 'signin', message, messagetype, url }) {
+  const q = new URLSearchParams({ mode });
+  if (message) { q.set('message', message); }
+  if (messagetype) { q.set('messagetype', messagetype); }
+  if (url) { q.set('url', url); }   // Encoded here: a return url usually has a query string of its own
+  res.redirect(`${loginUrl}?${q}`);
+}
+// A password reset link carries its token in the query string, and everything that logs a URL goes
+// to the journal, which outlives the ten minutes the token is good for.
+function redactUrl(url) {
+  return String(url).replace(/([?&]code=)[^&]*/, '$1REDACTED');
+}
+// Where this server can be reached from outside, for the link in a reset email. Behind a proxy that
+// does not set X-Forwarded-Host there is nothing in the request to go on, hence the config override.
+function publicBase(req) {
+  return (config.email && config.email.baseurl) || `${req.protocol}://${req.get('host')}`;
+}
+
 const optionsHeaders = {
   'Access-Control-Allow-Origin': '*',
   // Probably Needs: GET, OPTIONS HEAD, do not believe can do POST, PUT, DELETE yet but could be wrong about that.
@@ -255,6 +279,13 @@ function send_people_list(req, res) {
   });
 }
 
+// Sessions older than this hold that user's permissions from before the change - see the middleware
+// after passport.authenticate('session')
+const permissionsChangedAt = new Map(); // user id -> when it last changed
+function notePermissionsChanged(id) {
+  permissionsChangedAt.set(Number(id), Date.now());
+}
+
 function add_permission(id, capability, org, cb) {
   if ((id === undefined)
     || (capability === undefined) || (capability.length < 2)
@@ -267,6 +298,7 @@ function add_permission(id, capability, org, cb) {
       (cb) => db.get('SELECT COUNT(id) FROM permissions WHERE id = ? AND capability = ? AND org = ?', [id, capability, org], cb),
       (n_perms, cb) => { if (n_perms["COUNT(id)"] != 0) { cb(new Error("Duplicate permission")); } else { cb(null); }},
       (cb) => db.run(sqlAddPermission, [id, capability, org], cb),
+      (cb) => { notePermissionsChanged(id); cb(null); },
     ], cb);
   }
 }
@@ -278,6 +310,7 @@ function permissions_delete(id, capability, org, cb) {
   } else {
     waterfall([
       (cb) => db.get('DELETE FROM permissions WHERE id = ? AND capability = ? AND org = ?', [id,capability,org], cb),
+      (cb) => { notePermissionsChanged(id); cb(null); },
     ], cb);
   }
 }
@@ -450,10 +483,20 @@ function execSqlStart(cb) {
   });
 }
 
+// Look somebody up by whatever they typed into the one "Username or email" box on the login page.
+// Username first, so that a username with an "@" in it still works, then email - which is not
+// declared UNIQUE in the schema, so take the first match rather than assuming there is only one.
+function findUserByLogin(login, cb) {
+  db.get('SELECT * FROM users WHERE username = ?', [ login ], function(err, user) {
+    if (err || user || !String(login || '').includes('@')) { return cb(err, user); }
+    db.get('SELECT * FROM users WHERE email = ? COLLATE NOCASE', [ login ], cb);
+  });
+}
+
 // This verifies the user, and if successful returns a data structure via cb
 // see passport.authenticate('local'... for where it gets used
 passport.use(new LocalStrategy(function verify(username, password, cb) {
-  db.get('SELECT * FROM users WHERE username = ?', [ username ], function(err, user) {
+  findUserByLogin(username, function(err, user) {
     if (err) { return cb(err); }
     if (!user) { return cb(null, false, { message: 'Incorrect username or password+' }); }
     // TODO- - maybe just import pbkdf2 and timingSafeEqual ?
@@ -485,7 +528,8 @@ function loggedInOrRedirect(req, res, next) {
     next();
   } else {
     // If originalUrl is /private/index.html then req.url is just /index.html
-    res.redirect(307, `${loginUrl}?register=false&message=Please%20login&url=` + req.originalUrl);
+    const q = new URLSearchParams({ mode: 'signin', message: 'Please login', url: req.originalUrl });
+    res.redirect(307, `${loginUrl}?${q}`);
   }
 }
 function hasPermissions(user, org, permission) {
@@ -567,8 +611,9 @@ function shouldIBeLoggedIn(req, res, next) {
     // intact), encoded so its own query string can't corrupt this redirect's query string. Carry "lang"
     // over as its own top-level param (from req.query, not duplicated into "url") so login.html itself
     // renders in the right language.
-    const langParam = req.query.lang ? `&lang=${encodeURIComponent(req.query.lang)}` : '';
-    res.redirect(307, `${loginUrl}?register=false&message=Please%20login${langParam}&url=${encodeURIComponent(req.originalUrl)}`);
+    const q = new URLSearchParams({ mode: 'signin', message: 'Please login', url: req.originalUrl });
+    if (req.query.lang) { q.set('lang', req.query.lang); }
+    res.redirect(307, `${loginUrl}?${q}`);
   } else {
     next();
   }
@@ -680,6 +725,7 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
     // Summarize rather than dumping the whole config: it is mostly the sensor schema, and it holds
     // each organization's mqtt_password, which should not be going to the console and the journal.
     console.log("Broker", config.mqtt.broker, "- organizations:", Object.keys(config.organizations).join(", ") || "(none)");
+    console.log(mailInit(config.email));
     // Could genericize config defaults
     // HTTP request logging. "morgan: false" in config.d/server.yaml turns it off completely, which
     // matters on a machine running from an SD card: every request logged is a line to the journal,
@@ -693,6 +739,7 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
         morganFormat = ':method :url :req[range] :status :res[content-length] :response-time ms :req[referer]'
       }
       // Seems to be writing to syslog which is being cycled.
+      morgan.token('url', (req) => redactUrl(req.originalUrl || req.url)); // see redactUrl
       app.use(morgan(morganFormat)); // see https://www.npmjs.com/package/morgan )
     }
 
@@ -712,7 +759,7 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
     // Just log the request for now
     // noinspection JSCheckFunctionSignatures
     app.use('/', (req, res, next) => {
-      console.log(req.url);
+      console.log(redactUrl(req.url));
       next();
     })
 
@@ -806,6 +853,7 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
               email: user.email,
               phone: user.phone,
               permissions: user.permissions,
+              loginAt: Date.now(), // So a permission change can tell which sessions predate it
             });
           });
         });
@@ -822,6 +870,30 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
         // Check if have a session, and if so store in req.user, uses function defined in deserializeUser above
         app.use(passport.authenticate('session')); // Add user to req.user
 
+        // End any session that predates a change to that user's permissions.
+        //
+        // The session carries the permissions read at login, and can_READ, can_ADMIN and the rest
+        // read them from there - so without this a change takes effect only when the user next logs
+        // in. Granting is merely confusing; revoking is worse, because someone whose ADMIN has been
+        // taken away keeps it until their session ends.
+        //
+        // Rather than re-reading the table on every request to catch something this rare, note when
+        // a user's permissions changed and end the sessions older than that. They log in again,
+        // which is a small price for a change that happens a handful of times.
+        //
+        // In memory on purpose: express-session's default store keeps the sessions in this process
+        // too, so the two are lost together on a restart and neither can outlive the other.
+        app.use((req, res, next) => {
+          const changedAt = req.user && permissionsChangedAt.get(Number(req.user.id));
+          if (changedAt && (!req.user.loginAt || (changedAt > req.user.loginAt))) {
+            console.log("Permissions changed for", req.user.id, "- ending the session made before it");
+            // Carry on unauthenticated: a page redirects to login, /config.json answers 401 and the
+            // client redirects itself
+            return req.logout((err) => (err ? next(err) : next()));
+          }
+          next();
+        });
+
         // ===== API Integration: Farm IoT Interoperability Standard =====
         // Its tables are in frugal-iot-createdb.sql, already run by execSqlStart above, so there is
         // nothing to initialize here (lib/database.js still exports initializeSchema for the tests).
@@ -864,11 +936,18 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
           (req,res,next) => {
             console.log("Trying to login with redirect to",req.body.url);
             // This is ugly, but I cannot see how to pass the URL to passport.authenticate options
+            // Default the destination rather than trusting every caller to supply one: with no
+            // successRedirect, passport calls next() on success and the request 404s as
+            // "Cannot POST /login" - a confusing way to report a missing form field.
+            const returnTo = req.body.url || '/dashboard';
+            const failureQuery = new URLSearchParams({
+              mode: 'signin', messagetype: 'error',
+              message: 'Incorrect username or password', url: returnTo });
             passport.authenticate('local', {
               session: true,
               //failWithError: true,
-              failureRedirect: `${loginUrl}?register=false&message=Incorrect+username+or+password&url=${req.body.url}`,
-              successRedirect: req.body.url,
+              failureRedirect: `${loginUrl}?${failureQuery}`,
+              successRedirect: returnTo,
               // In failure case will also be messages in the session which need clearing out TODO-N89
               //failureRedirect: `${loginUrl}?register=false&message=Incorrect+username+or+password&url=${req.body.url}`,
             })(req, res, next);
@@ -893,9 +972,11 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
                     [username, hashedPassword, salt, organization, req.body.name, req.body.email, req.body.phone], (err) => {
                       if (err) {
                         console.log(err);
-                        res.redirect(`${loginUrl}?register=true&message=Registration%20failed&url=${req.body.url}`);
+                        loginRedirect(res, { mode: 'register', messagetype: 'error',
+                          message: 'Registration failed', url: req.body.url });
                       } else {
-                        res.redirect(`${loginUrl}?register=false&message=Registration%20successful%20-%20please%20login&url=${req.body.url}`);
+                        loginRedirect(res, { mode: 'signin', messagetype: 'info',
+                          message: 'Registration successful - please login', url: req.body.url });
                       }
                     });
                 }
@@ -904,6 +985,86 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
           });
         });
 
+        // ---------- Forgotten password ----------
+        // Nothing is stored: the code is an HMAC over the account and a five-minute slot, so it
+        // expires by arithmetic and stops working the moment the password changes. See
+        // lib/resetcode.js. The mail carries both a link (a long token) and six digits to type.
+        app.post('/forgotpassword', (req, res) => {
+          const login = String(req.body.username || '').trim();
+          const url = req.body.url;
+          // The same answer whether or not the account exists, so this form cannot be used to find
+          // out who has an account here.
+          const sameAnswer = { mode: 'reset', messagetype: 'info', url,
+            message: 'If that account exists we have emailed a reset code' };
+          if (!mailConfigured()) {
+            return loginRedirect(res, { mode: 'signin', messagetype: 'error', url,
+              message: 'Password reset is not available on this server' });
+          }
+          if (!resetRateOk('send', login.toLowerCase())) {
+            return loginRedirect(res, { mode: 'forgot', messagetype: 'error', url,
+              message: 'Too many attempts - please wait a few minutes' });
+          }
+          findUserByLogin(login, (err, user) => {
+            if (err) { console.error("Looking up", login, "for a password reset:", err.message); }
+            if (!user || !user.email) { return loginRedirect(res, sameAnswer); }
+            const { code, token } = resetCodeMake(user);
+            const q = new URLSearchParams({ mode: 'reset', username: user.username, code: token });
+            if (url) { q.set('url', url); }
+            const link = `${publicBase(req)}${loginUrl}?${q}`;
+            const text = [
+              `Somebody asked to reset the Frugal IoT password for ${user.username}.`,
+              ``,
+              `Open this link:`,
+              link,
+              ``,
+              `or type this code into the reset form: ${code}`,
+              ``,
+              `Either works for the next ten minutes at most. If it was not you, ignore this mail -`,
+              `nothing has changed and nothing will until the code is used.`,
+            ].join('\n');
+            sendMail({ to: user.email, subject: 'Frugal IoT password reset', text }, (err) => {
+              // Still the same answer: telling them the mail failed would also tell an outsider
+              // that the account exists. It is logged loudly instead, because a server whose SMTP
+              // is broken looks from the outside exactly like one that is working.
+              if (err) { console.error("Could not send reset mail for", user.username, "-", err.message); }
+              loginRedirect(res, sameAnswer);
+            });
+          });
+        });
+        app.post('/resetpassword', (req, res) => {
+          const login = String(req.body.username || '').trim();
+          const url = req.body.url;
+          const notValid = { mode: 'reset', messagetype: 'error', url,
+            message: 'That code is not valid or has expired' };
+          if (!resetRateOk('check', login.toLowerCase())) {
+            return loginRedirect(res, { mode: 'reset', messagetype: 'error', url,
+              message: 'Too many attempts - please wait a few minutes' });
+          }
+          if (!req.body.password) { return loginRedirect(res, notValid); }
+          findUserByLogin(login, (err, user) => {
+            if (err) { console.error("Looking up", login, "to reset a password:", err.message); }
+            if (!user || !resetCodeCheck(user, String(req.body.code || '').trim())) {
+              return loginRedirect(res, notValid);
+            }
+            crypto.randomBytes(16, (err, salt) => {
+              if (err) { return res.status(500).send('Internal error 1101'); }
+              crypto.pbkdf2(req.body.password, salt, 310000, 32, 'sha256', (err, hashedPassword) => {
+                if (err) { return res.status(500).send('Internal error 1103'); }
+                db.run('UPDATE users SET hashed_password = ?, salt = ? WHERE id = ?',
+                  [hashedPassword, salt, user.id], (err) => {
+                    if (err) {
+                      console.error("Could not reset the password for", user.username, "-", err.message);
+                      return loginRedirect(res, notValid);
+                    }
+                    console.log("Password reset for", user.username);
+                    loginRedirect(res, { mode: 'signin', messagetype: 'info', url,
+                      message: 'Password reset - please sign in' });
+                  });
+              });
+            });
+          });
+        });
+
         app.get('/config.json',
           loggedInOrFail,  // Config is only returned if user is logged in.
           (req,res) => {
@@ -1021,6 +1182,16 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
           },
           send_projects_list,
         );
+        // Log out and go back to the login page. There was no way to do this at all before, which
+        // matters more now that a permissions change ends the session and people log in again.
+        app.get('/logout', (req, res, next) => {
+          // With a url to come back to: without one, POST /login has no successRedirect, so on a
+          // *successful* login passport calls next(), nothing else handles POST /login, and express
+          // answers "Cannot POST /login" - which looks like a broken login rather than a missing
+          // parameter.
+          req.logout((err) => (err ? next(err) : loginRedirect(res, { url: '/dashboard' })));
+        });
+
         //  /dashboard is served statically, to logged in users //TODO-N89 restrict orgs to those have permissions for (maybe handled via /config.org )
         const routerDashboard = express.Router();
         app.use('/dashboard', routerDashboard);
@@ -1091,9 +1262,18 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
             if (isUnsafe([req.body.organization, req.body.project, req.body.deviceid, req.body.otakey])) {
               return cb(new Error("Parameters may not contain '/'"));
             }
+            // An upload that names no organization is a different fault from one the user is not
+            // allowed to make, and without this they are indistinguishable: hasPermissions can
+            // never match an undefined org, so a form that fails to send the field reports itself
+            // as a permission problem and sends whoever is debugging it to the permissions table.
+            // Note multer fills req.body only from the parts that arrive before the file, so a
+            // field the form sends *after* the file is missing here too, even though it was sent.
+            if (!req.body.organization) {
+              return cb(new Error("No organization sent with the upload - the form must send an 'organization' field, ahead of the file"));
+            }
             // Shouldnt actually happen, as dashboard should only show compliant orgs, so this would be a hack (or bad timing)
             if (!hasPermissions(req.user, req.body.organization, "OTAUPDATE")) {
-              return cb(new Error("Permission denied to OTAUPDATE"));
+              return cb(new Error(`Permission denied to OTAUPDATE for organization '${req.body.organization}'`));
             }
             let dir;
             if (!req.body.otakey) {

package/lib/housekeeping.js

@@ -19,7 +19,12 @@
  * appending to them.
  */
 
-import { createReadStream, createWriteStream, readdir, rename, stat, statfs, unlink, readFile, writeFile } from 'fs';
+import { createReadStream, createWriteStream, readdir, rename, stat, unlink, readFile, writeFile } from 'fs';
+// statfs arrived in node 18.15, and this package says it needs node 18. Taken off the namespace
+// rather than imported by name, because a named import of something a builtin does not have fails
+// when the module loads - which would stop the server outright on an 18.x older than that, instead
+// of just doing without the one check that needs it (see freePercent below).
+import fs from 'fs';
 import { createGzip, gunzip, gzip } from 'zlib';
 import path from 'path';
 import { each, eachSeries, waterfall } from 'async';
@@ -147,8 +152,8 @@ function deleteFiles(files, callback) {
  * How much of the filesystem holding "dir" is free, as a percentage, or null if it cannot be told.
  */
 function freePercent(dir, callback) {
-  if (typeof statfs !== 'function') { callback(null, null); return; } // Older node
-  statfs(dir, (err, st) => {
+  if (typeof fs.statfs !== 'function') { callback(null, null); return; } // node older than 18.15
+  fs.statfs(dir, (err, st) => {
     if (err || !st || !st.blocks) { callback(null, null); return; }
     callback(null, (st.bavail / st.blocks) * 100);
   });
@@ -189,7 +194,8 @@ export function housekeep(datadir, config, callback) {
         // Delete oldest days until there is enough room. The shortfall is worked out in bytes so
         // that the number of days removed matches what is actually needed.
         console.log(`Housekeeping: ${free.toFixed(1)}% of the disk free, below the ${freeWanted}% wanted - removing the oldest readings`);
-        statfs(datadir, (err3, st) => {
+        // Reached only when freePercent returned a number, so statfs exists on this node
+        fs.statfs(datadir, (err3, st) => {
           let shortfall = (err3 || !st) ? 0 : ((freeWanted / 100) * st.blocks - st.bavail) * st.bsize;
           let toRemove = [];
           let planned = 0;

package/lib/mailer.js

@@ -0,0 +1,43 @@
+/*
+ * Sending mail, configured in config.d/email.yaml.
+ *
+ * Absent or incomplete configuration means this server does not send mail. That is a supported
+ * state - most installations are a Pi in a shed - so mailConfigured() lets a caller say so plainly
+ * instead of accepting a request and dropping it.
+ */
+import nodemailer from 'nodemailer';
+
+let transport = null;
+let mailFrom = null;
+
+// emailConfig is config.email, i.e. config.d/email.yaml. Returns a line for the startup log.
+function mailInit(emailConfig) {
+  transport = null;
+  mailFrom = null;
+  if (!emailConfig || !emailConfig.host || !emailConfig.from) {
+    return "Not sending mail (no host/from in config.d/email.yaml) - password reset is unavailable";
+  }
+  const port = emailConfig.port || 587;
+  transport = nodemailer.createTransport({
+    host: emailConfig.host,
+    port,
+    // 465 is TLS from the first byte; 587 and 25 start plain and STARTTLS. Wrong either way is a
+    // connection that hangs rather than an error that says what is wrong, so derive it.
+    secure: (emailConfig.secure !== undefined) ? emailConfig.secure : (port === 465),
+    auth: emailConfig.user ? { user: emailConfig.user, pass: emailConfig.pass } : undefined,
+  });
+  mailFrom = emailConfig.from;
+  return `Sending mail via ${emailConfig.host}:${port} as ${mailFrom}`;
+}
+
+function mailConfigured() { return !!transport; }
+
+// cb(err) - nodemailer is promise-based, wrapped here because the rest of this codebase is callbacks
+function sendMail({ to, subject, text, html }, cb) {
+  if (!transport) { return cb(new Error("Mail is not configured on this server")); }
+  transport.sendMail({ from: mailFrom, to, subject, text, html })
+    .then(() => cb(null))
+    .catch((err) => cb(err));
+}
+
+export { mailInit, mailConfigured, sendMail };

package/lib/resetcode.js

@@ -0,0 +1,103 @@
+/*
+ * Password reset codes, held nowhere.
+ *
+ * A code is an HMAC over (user id, email, current password hash, five-minute slot), keyed by a
+ * secret this process made at startup. Nothing is written to the database and nothing expires by
+ * being deleted - a code stops verifying because the slot has moved on, the password has changed,
+ * or the server has restarted. Two slots are accepted, so a code lasts between 5 and 10 minutes.
+ *
+ * Including the current hashed_password is what makes a code single-use: resetting the password
+ * changes the hash, and every code derived from the old one stops matching immediately.
+ *
+ * Two forms come out of the same digest:
+ *   code  - six digits, short enough to read off a phone and type in
+ *   token - 32 hex characters, put in the emailed link, where length costs nothing
+ * Six digits is only a million guesses, so the six-digit form is worth having only alongside the
+ * rate limiting below; the link form does not depend on it.
+ */
+import crypto from 'crypto';
+
+const SLOT_MS = 5 * 60 * 1000;   // a code is valid for its own slot and the one before it
+const SLOTS_ACCEPTED = 2;
+// Regenerated every start: a restart invalidates outstanding codes, which is the right way round.
+const secret = crypto.randomBytes(32);
+
+// Rate limits, per identifier, in memory. Lost on restart, which also invalidates every code, so
+// there is nothing to carry over. Not a defence against a distributed attacker - it is here so that
+// a million guesses at a six-digit code cannot be made in the ten minutes one is alive.
+const SEND_LIMIT = 3;            // reset emails per identifier
+const CHECK_LIMIT = 10;          // verification attempts per identifier
+const LIMIT_WINDOW_MS = 15 * 60 * 1000;
+const buckets = { send: new Map(), check: new Map() };
+
+function slotNow() { return Math.floor(Date.now() / SLOT_MS); }
+
+function digestFor(user, slot) {
+  // The password hash is a BLOB from sqlite; a user with no password yet has none.
+  const hashed = user.hashed_password ? Buffer.from(user.hashed_password).toString('hex') : '';
+  return crypto.createHmac('sha256', secret)
+    .update([user.id, user.email || '', hashed, slot].join('\n'))
+    .digest();
+}
+function formsFor(user, slot) {
+  const d = digestFor(user, slot);
+  return {
+    code: String(d.readUInt32BE(0) % 1000000).padStart(6, '0'),
+    token: d.toString('hex').slice(0, 32),
+  };
+}
+// Constant-time, and safe on differing lengths - timingSafeEqual throws on those rather than
+// returning false.
+function sameSecret(a, b) {
+  const ba = Buffer.from(String(a));
+  const bb = Buffer.from(String(b));
+  if (ba.length !== bb.length) { return false; }
+  return crypto.timingSafeEqual(ba, bb);
+}
+
+// { code, token } for the current slot - what goes in the email
+function resetCodeMake(user) {
+  return formsFor(user, slotNow());
+}
+// True if "supplied" is either form, for this slot or the one before
+function resetCodeCheck(user, supplied) {
+  if (!supplied) { return false; }
+  const now = slotNow();
+  let ok = false;
+  for (let i = 0; i < SLOTS_ACCEPTED; i++) {
+    const { code, token } = formsFor(user, now - i);
+    // No early return: keep the work the same whichever slot matches
+    ok = sameSecret(supplied, code) || sameSecret(supplied, token) || ok;
+  }
+  return ok;
+}
+
+// True if this identifier may make another attempt of this kind, and counts it if so.
+// bucket is 'send' (asking for an email) or 'check' (trying a code).
+function resetRateOk(bucket, key) {
+  const limit = (bucket === 'send') ? SEND_LIMIT : CHECK_LIMIT;
+  const map = buckets[bucket];
+  const now = Date.now();
+  const hits = (map.get(key) || []).filter((t) => (now - t) < LIMIT_WINDOW_MS);
+  if (hits.length >= limit) {
+    map.set(key, hits);
+    return false;
+  }
+  hits.push(now);
+  map.set(key, hits);
+  // Nothing else prunes this, and an attacker can name any identifier they like, so drop entries
+  // whose window has passed whenever the map gets big rather than growing without bound.
+  if (map.size > 1000) {
+    for (const [k, v] of map) {
+      if (!v.some((t) => (now - t) < LIMIT_WINDOW_MS)) { map.delete(k); }
+    }
+  }
+  return true;
+}
+// So a test can start from a clean slate without waiting out the window
+function resetRateClear() {
+  buckets.send.clear();
+  buckets.check.clear();
+}
+
+export { resetCodeMake, resetCodeCheck, resetRateOk, resetRateClear, SLOT_MS, SLOTS_ACCEPTED };

package/package.json

@@ -12,12 +12,14 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^1.3.13",
-    "frugal-iot-logger": "^1.1.18",
+    "frugal-iot-client": "^1.3.15",
+    "frugal-iot-logger": "^1.1.21",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
+    "mqtt": "^5.15.2",
     "multer": "^2.1.1",
+    "nodemailer": "^9.0.6",
     "passport": "^0.7.0",
     "passport-local": "^1.0.0",
     "sqlite3": "^5.1.7"
@@ -27,7 +29,10 @@
     "frugal-iot-init": "scripts/init.zsh",
     "frugal-iot-addorganization": "scripts/addorganization.zsh",
     "frugal-iot-setpassword": "scripts/setpassword.zsh",
-    "frugal-iot-diagnostic": "scripts/diagnostic.zsh"
+    "frugal-iot-diagnostic": "scripts/diagnostic.zsh",
+    "frugal-iot-clearretained": "scripts/clearretained.js",
+    "frugal-iot-addbridge-prod": "scripts/addbridge-prod.zsh",
+    "frugal-iot-addbridge-pi": "scripts/addbridge-pi.zsh"
   },
   "description": "Frugal IoT client and server",
   "//files": "An allowlist, not an ignore list - anything not named here is never published, so a stray file (a database backup, a credential) cannot leak by default. Check with: npm pack --dry-run",
@@ -35,6 +40,7 @@
     "frugal-iot-server.js",
     "frugal-iot-createdb.sql",
     "config.yaml",
+    "config.d/email.yaml",
     "config.d/logger.yaml",
     "config.d/mqtt.yaml",
     "config.d/server.yaml",
@@ -44,6 +50,7 @@
     "private/",
     "scripts/",
     "extras/mosquitto.conf",
+    "extras/mosquitto-bridge.conf.example",
     "extras/frugaliot.service",
     "API.md",
     "INSTALLATION.md"
@@ -68,8 +75,9 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "check-schema": "node scripts/check-schema.js",
-    "prerelease": "zsh scripts/prerelease.zsh"
+    "prerelease": "zsh scripts/prerelease.zsh",
+    "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "0.3.7"
+  "version": "0.3.9"
 }

package/public/index.html

@@ -167,6 +167,14 @@
 <div class="nav-section">
     <h2>Other examples</h2>
     <div class="box-grid">
+        <!-- The display the Dashboard used before the cards. Kept reachable while people get used
+             to the new one; it will go once nothing needs it. -->
+        <div class="nav-box">
+            <div class="nav-box-background" style="background-image: url('/images/icon-dashboard.png')"></div>
+            <div class="nav-box-content">
+                <a href="/dashboard/index-old.html">Previous dashboard</a>
+            </div>
+        </div>
         <div class="nav-box">
             <div class="nav-box-background" style="background-image: url('/images/icon-dashboard.png')"></div>
             <div class="nav-box-content">
@@ -189,6 +197,14 @@
 </div>
     <script>
       if (typeof navigator !== 'undefined' && 'serviceWorker' in navigator) {
+            // The worker calls skipWaiting(), so a new one can take over a page whose scripts came
+            // from the old one. Reload once to get a consistent set - but not on a first install,
+            // where there was no previous controller and nothing is stale.
+            const hadController = !!navigator.serviceWorker.controller;
+            let reloading = false;
+            navigator.serviceWorker.addEventListener('controllerchange', () => {
+                if (hadController && !reloading) { reloading = true; location.reload(); }
+            });
             navigator.serviceWorker.register('/service-worker.js')
                 .then(reg => console.log('Service Worker registered'))
                 .catch(err => console.log('Service Worker registration failed', err));