frugal-iot-server 0.3.9 → 2.0.0

package/lib/replica.js

@@ -0,0 +1,246 @@
+/*
+ * Sharing a production server's logins with a bridged Pi (SECURITY.md S11).
+ *
+ * The problem: a bridge relays TOPICS, not accounts. A person who logs into production therefore has
+ * no account on the Pi's broker, and the Pi is often the only thing reachable - it goes on working
+ * when the link is down, which is why it is there.
+ *
+ * What travels: username, the stored password hash, its salt, and the permission rows for one
+ * organization. Nothing derived from a password, and no secret shared - the Pi authenticates the
+ * login itself against that hash (the same pbkdf2 comparison production does) and derives its own
+ * broker credential from its OWN user_secret. So the two brokers hand out different passwords for
+ * the same person, and neither could compute the other's.
+ *
+ * Direction: the Pi PULLS. It sits behind a home router that production cannot reach, and its
+ * broker bridge is already an outbound connection for the same reason.
+ *
+ * Revocation: each pull REPLACES that organization's replicated rows. A permission that stops being
+ * sent stops existing, with nothing to diff and no way for a stale row to survive.
+ */
+
+import { randomBytes } from 'crypto';
+
+/*
+ * Replicated users take local id OFFSET + their production id.
+ *
+ * They cannot use production's ids directly: addorganization creates a login on the Pi too, and
+ * both machines allocate from AUTOINCREMENT starting at 2, so the ids would collide. The offset
+ * holds only while no installation has OFFSET-2 local users of its own, which is a safe bet for a
+ * farm and is asserted below rather than assumed.
+ */
+export const REPLICA_ID_OFFSET = 1000;
+
+export function isReplicatedId(id) { return Number(id) >= REPLICA_ID_OFFSET; }
+
+export function newBridgeToken() { return randomBytes(32).toString('base64url'); }
+
+// ---- production side ---------------------------------------------------------------------------
+/*
+ * What one organization's bridge is allowed to know: its people and what they may do.
+ *
+ * Deliberately not the whole users table - a Pi hosting one organization has no business knowing
+ * about anyone else's. id 0 ("everyone") is included, because the Pi's own permission checks read
+ * "id = ? or id = 0" and would otherwise disagree with production about what is public.
+ */
+export function replicaFor(db, org, cb) {
+  db.all(`SELECT DISTINCT id FROM permissions WHERE org = ? AND id > 0`, [org], (err, ids) => {
+    if (err) return cb(err);
+    const list = ids.map((r) => r.id);
+    const marks = list.map(() => '?').join(',') || 'NULL';
+    db.all(`SELECT id, username, hashed_password, salt, name, email
+            FROM users WHERE id IN (${marks}) AND username IS NOT NULL`, list, (uerr, users) => {
+      if (uerr) return cb(uerr);
+      db.all('SELECT id, capability, org, project FROM permissions WHERE org = ? AND (id > 0 OR id = 0)',
+        [org], (perr, permissions) => {
+          if (perr) return cb(perr);
+          cb(null, {
+            org,
+            at: Date.now(),
+            // Buffers do not survive JSON, and the Pi needs them back as BLOBs or its
+            // timingSafeEqual comparison throws instead of failing
+            users: users.map((u) => ({
+              id: u.id,
+              username: u.username,
+              hashed_password: u.hashed_password ? Buffer.from(u.hashed_password).toString('base64') : null,
+              salt: u.salt ? Buffer.from(u.salt).toString('base64') : null,
+              name: u.name,
+              email: u.email,
+            })),
+            permissions,
+          });
+        });
+    });
+  });
+}
+
+// Which bridge a token belongs to, or nothing. Constant-timeish is not the concern here: a token is
+// 32 random bytes, and the lookup is by exact match.
+export function bridgeForToken(db, token, cb) {
+  if (!token) return cb(null, null);
+  db.get('SELECT org, site FROM bridges WHERE token = ?', [token], cb);
+}
+
+export function noteBridgePull(db, org, site, cb) {
+  cb = cb || (() => {});
+  db.run('UPDATE bridges SET last_pull = ? WHERE org = ? AND site = ?', [Date.now(), org, site], cb);
+}
+
+// ---- the Pi's side -----------------------------------------------------------------------------
+/*
+ * Apply one organization's replica, replacing whatever was there.
+ *
+ * cb(err, {users, permissions, skipped}) - skipped names logins that could not be taken because a
+ * LOCAL account already uses that name. Overwriting one would silently change who can log in as
+ * whom, so it is refused and reported.
+ */
+export function applyReplica(db, org, payload, cb) {
+  if (!payload || payload.org !== org || !Array.isArray(payload.users) || !Array.isArray(payload.permissions)) {
+    return cb(new Error('Not a replica for this organization'));
+  }
+  // A feed that named other organizations would be granting permissions the Pi does not host
+  const foreign = payload.permissions.find((p) => p.org !== org);
+  if (foreign) return cb(new Error(`Replica for ${org} carried a permission for ${foreign.org}`));
+
+  const skipped = [];
+  db.serialize(() => {
+    db.run('BEGIN IMMEDIATE');
+    // Everything replicated for THIS organization goes; other organizations, and local rows, stay.
+    db.run('DELETE FROM permissions WHERE org = ? AND id >= ?', [org, REPLICA_ID_OFFSET]);
+
+    let pending = payload.users.length;
+    const afterUsers = () => {
+      let left = payload.permissions.length;
+      const done = (err) => {
+        if (err) { return db.run('ROLLBACK', () => cb(err)); }
+        // A replicated user with no permissions left anywhere is nobody on this machine
+        db.run(`DELETE FROM users WHERE id >= ? AND id NOT IN (SELECT id FROM permissions)`,
+          [REPLICA_ID_OFFSET], (derr) => {
+            if (derr) { return db.run('ROLLBACK', () => cb(derr)); }
+            db.run('COMMIT', (cerr) => cb(cerr, {
+              users: payload.users.length - skipped.length,
+              permissions: payload.permissions.length,
+              skipped,
+            }));
+          });
+      };
+      if (!left) return done(null);
+      for (const p of payload.permissions) {
+        // id 0 is "everyone" and is local on every machine - never replicated over the top of it
+        const id = Number(p.id) === 0 ? 0 : REPLICA_ID_OFFSET + Number(p.id);
+        db.run(`INSERT OR IGNORE INTO permissions (id, capability, org, project)
+                VALUES (?, ?, ?, ?)`,
+          [id, p.capability, p.org, p.project || ''], (err) => {
+            if (err && left > 0) { left = -1; return done(err); }
+            if (--left === 0) done(null);
+          });
+      }
+    };
+    if (!pending) return afterUsers();
+    for (const u of payload.users) {
+      const id = REPLICA_ID_OFFSET + Number(u.id);
+      if (!Number.isFinite(Number(u.id)) || Number(u.id) <= 0) {
+        skipped.push(u.username); if (--pending === 0) afterUsers(); continue;
+      }
+      const hash = u.hashed_password ? Buffer.from(u.hashed_password, 'base64') : null;
+      const salt = u.salt ? Buffer.from(u.salt, 'base64') : null;
+      // Take the row only if this name is free or already replicated. A local account of the same
+      // name is left alone: replacing it would change who can log in as that person.
+      db.get('SELECT id FROM users WHERE username = ?', [u.username], (gerr, existing) => {
+        if (gerr) { skipped.push(u.username); if (--pending === 0) afterUsers(); return; }
+        if (existing && !isReplicatedId(existing.id)) {
+          skipped.push(u.username);
+          if (--pending === 0) afterUsers();
+          return;
+        }
+        db.run(`INSERT INTO users (id, username, hashed_password, salt, organization, name, email)
+                VALUES (?, ?, ?, ?, ?, ?, ?)
+                ON CONFLICT(id) DO UPDATE SET username = excluded.username,
+                  hashed_password = excluded.hashed_password, salt = excluded.salt,
+                  name = excluded.name, email = excluded.email`,
+          [id, u.username, hash, salt, org, u.name || u.username, u.email || null], () => {
+            if (--pending === 0) afterUsers();
+          });
+      });
+    }
+  });
+}
+
+/*
+ * Fetch one organization's replica from production and apply it.
+ *
+ * Configured in config.d/replica.yaml on the Pi:
+ *
+ *   url: https://frugaliot.example.org      the production server
+ *   organizations: [myfarm]                 the ones this Pi hosts
+ *   intervalSeconds: 900                    how often to re-pull
+ *
+ * with the token in config.d/secrets.yaml as replica_token - a secret, and so not in config.d
+ * anywhere a browser could reach it (lib/config-for-user.js withholds that whole section).
+ *
+ * Never fatal. A Pi whose link is down keeps the replica it already has, and people go on logging
+ * in against it: working without the internet is the reason the Pi exists, so a failed pull is an
+ * expected state rather than an error.
+ */
+export function pullReplica(config, db, { onUser } = {}, cb) {
+  cb = cb || (() => {});
+  const settings = (config && config.replica) || {};
+  const token = config && config.secrets && config.secrets.replica_token;
+  const orgs = settings.organizations || [];
+  if (!settings.url || !token || !orgs.length) {
+    return cb(null, { skipped: 'not configured' });
+  }
+  const base = String(settings.url).replace(/\/+$/, '');
+  let i = 0;
+  const results = [];
+  const next = () => {
+    if (i >= orgs.length) return cb(null, { orgs: results });
+    const org = orgs[i++];
+    fetch(`${base}/replica/${encodeURIComponent(org)}`, {
+      headers: { Authorization: `Bearer ${token}` },
+      signal: AbortSignal.timeout(30000),
+    })
+      .then((r) => (r.ok ? r.json() : Promise.reject(new Error(`${r.status} ${r.statusText}`))))
+      .then((payload) => new Promise((res, rej) =>
+        applyReplica(db, org, payload, (err, result) => (err ? rej(err) : res(result)))))
+      .then((result) => {
+        results.push({ org, ...result });
+        console.log(`Replica ${org}: ${result.users} user(s), ${result.permissions} permission(s)` +
+          (result.skipped.length ? `, skipped ${result.skipped.join(', ')} (a local account has that name)` : ''));
+        // Each replicated user's broker account, so they can connect here as well as on production
+        if (onUser) {
+          db.all('SELECT DISTINCT id FROM permissions WHERE org = ? AND id >= ?',
+            [org, REPLICA_ID_OFFSET], (err, ids) => {
+              for (const r of (ids || [])) onUser(r.id);
+              next();
+            });
+        } else {
+          next();
+        }
+      })
+      .catch((err) => {
+        // Expected whenever the link is down; the existing replica stays in place
+        console.log(`Replica ${org} not refreshed: ${err.message}`);
+        results.push({ org, error: err.message });
+        next();
+      });
+  };
+  next();
+}
+
+/*
+ * Pull now, and then on a timer.
+ *
+ * The timer lives in the server rather than in cron: it is part of being a bridge, so it should
+ * start and stop with the server rather than being a separate thing to install and remember.
+ */
+export function startReplica(config, db, deps) {
+  const settings = (config && config.replica) || {};
+  if (!settings.url) return null;
+  const seconds = Number(settings.intervalSeconds) || 900;
+  console.log(`Replicating users from ${settings.url} every ${seconds}s:`,
+    (settings.organizations || []).join(', ') || '(no organizations listed)');
+  pullReplica(config, db, deps);
+  const timer = setInterval(() => pullReplica(config, db, deps), seconds * 1000);
+  timer.unref();      // a pending timer should not hold the process open at shutdown
+  return timer;
+}

package/lib/retained.js

@@ -0,0 +1,110 @@
+/*
+ * Deleting retained messages, on the server's behalf rather than the browser's.
+ *
+ * A retained topic is removed by publishing an empty payload to it, and there is no other way: the
+ * broker keeps the last value of every topic for ever, so a misspelled field or a node tested with
+ * the wrong id goes on appearing on every dashboard after the node is fixed (see
+ * scripts/clearretained.js, which does the same thing from the command line).
+ *
+ * This used to be done by the browser, using the organization's shared broker credential. S4 gave
+ * each user their own credential instead, which may publish to "set/" topics and nothing else - so
+ * the browser's delete stopped working, and worse, stopped working SILENTLY: an MQTT 3.1.1 broker
+ * acknowledges a QoS 1 publish it is about to discard, so the client saw success and the topics
+ * stayed. That is the regression this file exists to fix.
+ *
+ * The obvious repair - let a browser publish anywhere in its organization - would hand back exactly
+ * the capability S4 removed, because the broker cannot tell "forget this reading" from "here is a
+ * reading I invented". So the publishing is done here, by the server, with an account only the
+ * server holds (names.orgAdminClient), after checking that every topic named is inside the
+ * organization the user has ADMIN of.
+ */
+
+import mqtt from 'mqtt';
+import { deriveOrgAdminPassword, names } from './dynsec-plan.js';
+
+const NAME = /^[a-z0-9]{1,32}$/;
+// One topic per node module field, and a busy organization has a few thousand. Well above anything
+// legitimate, and low enough that a mistake cannot tie the broker up for minutes.
+const MAX_TOPICS = 5000;
+
+/*
+ * Which credential to publish as.
+ *
+ * The derived per-organization admin account when there is a user_secret and the broker has the
+ * plugin; otherwise the organization's own shared account, which still exists until S8 retires it.
+ * The fallback is what makes this work on a server whose broker has no dynamic security - the same
+ * arrangement the logger uses.
+ */
+export function adminCredentialFor(config, org) {
+  const userSecret = config && config.secrets && config.secrets.user_secret;
+  if (userSecret) {
+    return { username: names.orgAdminClient(org), password: deriveOrgAdminPassword(userSecret, org) };
+  }
+  const o = (config && config.organizations && config.organizations[org]) || {};
+  if (o.mqtt_password) return { username: org, password: o.mqtt_password };
+  return null;
+}
+
+/*
+ * Publish an empty retained message to each of `topics`.
+ *
+ * cb(err, {deleted}) - err.status is an HTTP status for the route to use, because every way this
+ * can be refused is a different one.
+ */
+export function deleteRetained(config, org, topics, cb) {
+  if (!NAME.test(String(org || ''))) return refuse(cb, 400, 'Not an organization name');
+  if (!Array.isArray(topics) || !topics.length) return refuse(cb, 400, 'No topics given');
+  if (topics.length > MAX_TOPICS) return refuse(cb, 400, `More than ${MAX_TOPICS} topics at once`);
+
+  const prefix = `${org}/`;
+  for (const t of topics) {
+    if (typeof t !== 'string' || !t.length) return refuse(cb, 400, 'A topic was not a string');
+    // Inside this organization, and one exact topic - a wildcard would let "delete these" mean
+    // "delete everything", and unlike the command-line tool there is nobody here to look first.
+    if (!t.startsWith(prefix)) return refuse(cb, 403, `${t} is not in ${org}`);
+    if (t.includes('+') || t.includes('#')) return refuse(cb, 400, `${t} contains a wildcard`);
+  }
+
+  const broker = config && config.mqtt && config.mqtt.broker;
+  if (!broker) return refuse(cb, 500, 'No mqtt.broker in the configuration');
+  const cred = adminCredentialFor(config, org);
+  if (!cred) return refuse(cb, 500, `No broker credential for ${org}`);
+
+  const client = mqtt.connect(broker, {
+    username: cred.username, password: cred.password,
+    connectTimeout: 5000,
+    reconnectPeriod: 0,      // one-shot: a retry would silently double every publish
+  });
+
+  let settled = false;
+  const finish = (err, res) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    client.end(!!err, () => cb(err, res));
+  };
+  // Long enough for a few thousand publishes on a Pi, short enough that a wedged broker answers.
+  const timer = setTimeout(() => finish(err500('The broker did not answer')), 30000);
+
+  client.on('error', (err) => finish(refusal(502, `Could not reach the broker: ${err.message}`)));
+  client.on('connect', () => {
+    let left = topics.length;
+    let failed = 0;
+    for (const t of topics) {
+      // An empty payload is how MQTT spells "forget this topic". QoS 1 so the broker acknowledges
+      // it - though see the file header: the acknowledgement says "received", not "allowed".
+      client.publish(t, '', { retain: true, qos: 1 }, (err) => {
+        if (err) failed++;
+        if (--left === 0) finish(null, { deleted: topics.length - failed, failed });
+      });
+    }
+  });
+}
+
+function refusal(status, message) {
+  const e = new Error(message);
+  e.status = status;
+  return e;
+}
+function err500(message) { return refusal(500, message); }
+function refuse(cb, status, message) { return cb(refusal(status, message)); }

package/lib/secrets.js

@@ -0,0 +1,148 @@
+/*
+ * Secrets this server generates for itself, in config.d/secrets.yaml.
+ *
+ * frugal-iot-init writes that file, but a server upgraded from a release that predates it has none,
+ * and telling the operator to go and run init is a poor answer: the symptom (everybody logged out
+ * on every restart) does not point at the cause, so it would be lived with rather than fixed. So
+ * generate what is missing and write it down, which fixes itself once and stays fixed.
+ *
+ * Synchronous on purpose. This runs once, before the server listens, and doing it with callbacks
+ * would mean restructuring the startup sequence around a single small file write.
+ */
+
+import { randomBytes } from 'crypto';
+import { appendFileSync, chmodSync, existsSync, readFileSync, writeFileSync } from 'fs';
+
+const HEADER = `# Secrets belonging to this server. Never served to a browser - lib/config-for-user.js
+# withholds this whole section. Not in git, and worth backing up alongside frugal-iot.db.
+`;
+
+// What each secret is for, written into the file beside it so whoever reads the file later knows
+// what rotating it would cost.
+const NOTES = {
+  session_secret: 'Signs the session cookie. Changing it ends every session.',
+  user_secret: "Mixed into each user's derived MQTT password. Changing it invalidates every browser's\n# broker credential until its next login, and nothing else.",
+};
+
+// An organization's enrolment secret is written as a LIST, because rotating it means adding a new
+// one while the old is still accepted - otherwise every node already flashed with the old value,
+// and not yet enrolled, is stranded. Delete a line to withdraw that secret.
+const LIST_NOTE = (name) => {
+  const org = name.replace(/^enrolment_/, '');
+  return `Enrolment secrets for organization "${org}" - any of them is accepted by POST /enrol.
+# A node presents one once, to be issued its own broker credential; it grants nothing else, no read
+# and no write. To rotate: add a new line above and leave the old one until every node flashed with
+# it has enrolled, then delete it. To withdraw one immediately, delete its line.`;
+};
+const isList = (name) => name.startsWith('enrolment_');
+
+function generate() {
+  return randomBytes(32).toString('base64url');
+}
+
+/*
+ * Make sure every name in `names` has a value, generating and persisting any that do not.
+ *
+ * Returns { secrets, generated, written, error }:
+ *   secrets   - name -> value, always complete, so the caller can use it unconditionally
+ *   generated - names that had to be made up on this run
+ *   written   - true if they reached the file, false if they exist only for this process
+ *   error     - why the write failed, when it did
+ *
+ * A failed write is not fatal: the server works, and its sessions simply end when it restarts.
+ * That can happen legitimately - a read-only install directory, or running as a user who does not
+ * own it - so it is reported rather than thrown.
+ */
+export function ensureSecrets(existing, configDir, names) {
+  const secrets = { ...(existing || {}) };
+  const generated = names.filter((n) => !secrets[n]);
+  if (!generated.length) return { secrets, generated, written: true };
+
+  for (const n of generated) secrets[n] = isList(n) ? [generate()] : generate();
+
+  const path = `${configDir}/secrets.yaml`;
+  const body = generated.map((n) => (isList(n)
+    ? `\n# ${LIST_NOTE(n)}\n${n}:\n  - "${secrets[n][0]}"\n`
+    : `\n# ${NOTES[n] || n}\n${n}: "${secrets[n]}"\n`)).join('');
+  try {
+    if (existsSync(path)) {
+      appendFileSync(path, body);
+    } else {
+      writeFileSync(path, HEADER + body);
+    }
+    chmodSync(path, 0o600);
+    return { secrets, generated, written: true };
+  } catch (e) {
+    return { secrets, generated, written: false, error: e.message };
+  }
+}
+
+/*
+ * Adding and withdrawing an organization's enrolment secrets, for the dashboard (SECURITY.md S10).
+ *
+ * Rewrites just that organization's block, leaving the rest of the file - and its comments, which
+ * say what each secret costs to rotate - untouched. Loading and re-emitting the whole file as YAML
+ * would be less code and would throw those comments away.
+ *
+ * Synchronous, like ensureSecrets: one small file, changed by hand at human speed.
+ */
+
+const ENROL_NAME = (org) => `enrolment_${org}`;
+
+// The organization's block, whether or not it is there: "enrolment_x:" and the indented list items
+// under it. Anything else - a comment, another secret - ends the match.
+const blockFor = (org) =>
+  new RegExp(`^${ENROL_NAME(org)}:[ \\t]*\\n(?:[ \\t]+-[^\\n]*\\n)*`, 'm');
+
+function renderBlock(org, list) {
+  const items = list.map((v) => `  - "${v}"`).join('\n');
+  return `${ENROL_NAME(org)}:\n${items}${items ? '\n' : ''}`;
+}
+
+/*
+ * Write `list` as the organization's enrolment secrets.
+ *
+ * cb(err) - callers report and carry on. An unwritable file means the change lasts only until the
+ * next restart, which is worth saying rather than pretending it was saved.
+ */
+function writeEnrolmentSecrets(configDir, org, list, cb) {
+  const path = `${configDir}/secrets.yaml`;
+  try {
+    const block = renderBlock(org, list);
+    if (!existsSync(path)) {
+      writeFileSync(path, HEADER + `\n# ${LIST_NOTE(ENROL_NAME(org))}\n${block}`);
+    } else {
+      const text = readFileSync(path, 'utf8');
+      const re = blockFor(org);
+      if (re.test(text)) {
+        writeFileSync(path, text.replace(re, block));
+      } else {
+        // No block of its own yet - an organization added since the file was written
+        appendFileSync(path, `\n# ${LIST_NOTE(ENROL_NAME(org))}\n${block}`);
+      }
+    }
+    chmodSync(path, 0o600);
+    cb(null);
+  } catch (e) {
+    cb(e);
+  }
+}
+
+/*
+ * Add a secret, keeping the existing ones.
+ *
+ * That is the whole point of a list: a node already flashed with the old value, and not yet
+ * enrolled, would be stranded if adding replaced it. cb(err, {secret, list}).
+ */
+export function addEnrolmentSecret(configDir, org, current, cb) {
+  const list = [generate(), ...(current || [])];
+  writeEnrolmentSecrets(configDir, org, list, (err) => cb(err, { secret: list[0], list }));
+}
+
+// Withdraw one secret, by value. cb(err, {list, removed}).
+export function removeEnrolmentSecret(configDir, org, secret, current, cb) {
+  const list = (current || []).filter((v) => v !== secret);
+  const removed = list.length !== (current || []).length;
+  if (!removed) return cb(null, { list, removed });
+  writeEnrolmentSecrets(configDir, org, list, (err) => cb(err, { list, removed }));
+}

package/package.json

@@ -12,8 +12,8 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^1.3.15",
-    "frugal-iot-logger": "^1.1.21",
+    "frugal-iot-client": "^2.0.0",
+    "frugal-iot-logger": "^2.0.0",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
@@ -32,7 +32,10 @@
     "frugal-iot-diagnostic": "scripts/diagnostic.zsh",
     "frugal-iot-clearretained": "scripts/clearretained.js",
     "frugal-iot-addbridge-prod": "scripts/addbridge-prod.zsh",
-    "frugal-iot-addbridge-pi": "scripts/addbridge-pi.zsh"
+    "frugal-iot-addbridge-pi": "scripts/addbridge-pi.zsh",
+    "frugal-iot-rebuild-dynsec": "scripts/rebuild-dynsec.js",
+    "frugal-iot-dynsec-init": "scripts/dynsec-init.js",
+    "frugal-iot-resetnode": "scripts/resetnode.js"
   },
   "description": "Frugal IoT client and server",
   "//files": "An allowlist, not an ignore list - anything not named here is never published, so a stray file (a database backup, a credential) cannot leak by default. Check with: npm pack --dry-run",
@@ -50,6 +53,7 @@
     "private/",
     "scripts/",
     "extras/mosquitto.conf",
+    "extras/aclfile",
     "extras/mosquitto-bridge.conf.example",
     "extras/frugaliot.service",
     "API.md",
@@ -79,5 +83,5 @@
     "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "0.3.9"
+  "version": "2.0.0"
 }

package/public/index.html

@@ -167,14 +167,6 @@
 <div class="nav-section">
     <h2>Other examples</h2>
     <div class="box-grid">
-        <!-- The display the Dashboard used before the cards. Kept reachable while people get used
-             to the new one; it will go once nothing needs it. -->
-        <div class="nav-box">
-            <div class="nav-box-background" style="background-image: url('/images/icon-dashboard.png')"></div>
-            <div class="nav-box-content">
-                <a href="/dashboard/index-old.html">Previous dashboard</a>
-            </div>
-        </div>
         <div class="nav-box">
             <div class="nav-box-background" style="background-image: url('/images/icon-dashboard.png')"></div>
             <div class="nav-box-content">

package/public/service-worker.js

@@ -1,18 +1,68 @@
 // Changing this version is what makes an already installed PWA fetch the app again instead of
 // serving what it cached. It follows the version of frugal-iot-client this release installs, and
 // "npm run prerelease" sets it - so there is normally no reason to edit it by hand.
-const CACHE_NAME = 'frugal-iot-cache-1.3.15';
+//
+// The suffix is here because urlsToCache below CHANGED without the client version changing. Without
+// it, an installed browser keeps serving the files it already cached - and since the list now covers
+// the dashboard's own code, that means old JS behind freshly fetched HTML. Any edit to the list
+// needs this bumped, or it does not reach anyone who already has the old one.
+const CACHE_NAME = 'frugal-iot-cache-2.0.0';
+/*
+ * Everything the app needs, so that a phone on a poor or expensive link fetches it once.
+ *
+ * The dashboard's OWN code was missing from this list, which was most of the point of having one:
+ * eight files - the entry point, five modules and the stylesheet - were fetched from the network on
+ * every visit while the libraries beside them came from the cache.
+ *
+ * Two rules for anything added here:
+ *
+ * 1. It must return 200 WITHOUT a session. install() rejects the whole cache if any single entry
+ *    fails, so one 404 or one redirect-to-login means this PWA has no cache at all - and the app
+ *    goes on working online, so nothing announces it. /dashboard/*.js and the stylesheet do serve
+ *    unauthenticated; /dashboard/index.html does NOT (it 307s to the login page).
+ * 2. It must not be a session-gated PAGE. Beyond breaking install, a cached /dashboard/index.html
+ *    would be served to a logged-out visitor - which is the "accessing from service worker which
+ *    has /dashboard cached" case admin.js already had to handle.
+ *
+ * Deliberately absent:
+ *   /dashboard/index.html          session-gated, see above
+ *   /node_modules/esptool-js/*     ~1MB, wanted on one screen, and not by the phone users this list
+ *                                  exists for
+ *
+ * Every URL below was checked against a running server. Two entries in index.html's importmap were
+ * not, and are dead: "chart.js" points at dist/Chart.js, which does not exist (the file is
+ * lowercase, and graph.js imports the full path anyway), and "chartjs-adapter-luxon" points into a
+ * package that is not installed at all - its code was copied into core.js instead. Neither is
+ * reachable today; both would 404 the moment somebody used the bare specifier.
+ */
 const urlsToCache = [
+    // The public landing page and the PWA's own furniture
     '/',
     '/index.html',
+    '/manifest.json',
+    '/favicon.ico',
     '/images/icon-192x192.png',
     '/images/icon-512x512.png',
+    // The dashboard: its stylesheet, its entry point, and the modules dashboard.js imports
+    '/dashboard/frugaliot.css',
+    '/dashboard/dashboard.js',
+    '/dashboard/core.js',
+    '/dashboard/widgets.js',
+    '/dashboard/graph.js',
+    '/dashboard/admin.js',
+    '/dashboard/flash.js',
+    '/dashboard/cards.js',
+    // Logging in - the page a visitor lands on when the session has gone
+    '/dashboard/login.html',
+    '/dashboard/login.js',
+    // Libraries, at the paths index.html's importmap and the modules actually use
     '/node_modules/html-element-extended/htmlelementextended.js',
     '/node_modules/mqtt/dist/mqtt.esm.js',
     '/node_modules/js-yaml/dist/js-yaml.mjs',
     '/node_modules/async/dist/async.mjs',
     '/node_modules/csv-parse/dist/esm/index.js',
     '/node_modules/chart.js/dist/chart.js',
+    '/node_modules/@kurkle/color/dist/color.esm.js',   // chart.js needs it; was missing
     '/node_modules/dial-gauge/dial-gauge.js',
     '/node_modules/luxon/src/luxon.js'
 ];