frugal-iot-server 0.3.9 → 2.0.0

package/scripts/not-published.txt

@@ -25,3 +25,8 @@ test/**
 # --- Placeholders ---
 # Keeps the ota directory present in a clone; a real installation gets one from frugal-iot-init
 ota/README.md
+
+# Describes how the security works, and would be useful in an installation - but it ends with an
+# open-issues section listing what is currently exploitable, which must not ship to everyone who
+# installs the package. Published by hand, without that section.
+SECURITY.md

package/scripts/rebuild-dynsec.js

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/*
+ * Make the broker's dynamic-security state match this server's database, or just report where it
+ * differs.
+ *
+ *   npx --no frugal-iot-rebuild-dynsec          apply
+ *   npx --no frugal-iot-rebuild-dynsec check    report only, change nothing
+ *
+ * Run from the server's own directory. Everything it writes is either stored in the database or
+ * derivable from it, so it is safe to re-run: after restoring a database, after a release that adds
+ * a rule, or when something looks wrong. "check" is what scripts/diagnostic.zsh calls.
+ *
+ * "check", not "--check": npm parses the whole command line itself and swallows any --flag it does
+ * not recognise, so "npx --no frugal-iot-rebuild-dynsec --check" arrives here with no arguments and
+ * would silently APPLY instead of reporting. That is the npx trap in claude.md, and this command hit
+ * it - "--check" is still accepted for a direct "node scripts/rebuild-dynsec.js --check".
+ */
+
+import sqlite3 from 'sqlite3';
+import { MqttLogger } from 'frugal-iot-logger';
+import { dynsecConnect } from '../lib/dynsec.js';
+import {
+  readScopes, readPublics, readProjects, readUserRows,
+  applyRolesAndGroups, applyUser, applyNode, applyLogger, applyOrgAdmin, checkRolesAndGroups,
+} from '../lib/dynsec-sync.js';
+import { names } from '../lib/dynsec-plan.js';
+
+const userClientName = names.userClient;
+
+const ARGS = process.argv.slice(2);
+const CHECK = ARGS.includes('check') || ARGS.includes('--check');
+const DB = './frugal-iot.db';
+
+function fail(msg, code = 1) {
+  console.error(msg);
+  process.exit(code);
+}
+
+// The same reader the server uses, so this sees exactly the configuration the server sees -
+// config.yaml plus config.d, including config.d/secrets.yaml.
+//
+// It logs a line per file it reads, which is fine at server startup and noise in a command whose
+// output scripts/diagnostic.zsh includes - so it is quietened for the duration of the read only.
+const realLog = console.log;
+console.log = () => {};
+new MqttLogger().readYamlConfig('.', (err, config) => {
+  console.log = realLog;
+  if (err) return fail(`Could not read the configuration: ${err.message}`);
+  const orgs = Object.keys((config && config.organizations) || {});
+  const userSecret = config.secrets && config.secrets.user_secret;
+  if (!CHECK && !userSecret) {
+    return fail('No user_secret in config.d/secrets.yaml - run: npx --no frugal-iot-init');
+  }
+
+  const db = new sqlite3.Database(DB, sqlite3.OPEN_READONLY, (dberr) => {
+    if (dberr) return fail(`Could not open ${DB}: ${dberr.message}. Run this from the server's own directory.`);
+
+    dynsecConnect(config, (cerr, dynsec) => {
+      if (cerr) {
+        // Being unable to reach the plugin is a normal state on a broker that has none, so say what
+        // it means rather than only what failed.
+        console.error(`Cannot reach the dynamic security plugin: ${cerr.message}`);
+        console.error('If this broker has no plugin, per-user accounts are unavailable and that is');
+        console.error('all this means. frugal-iot-diagnostic reports which case you are in.');
+        process.exit(2);
+      }
+
+      readScopes(db, orgs, (e1, scopes) => {
+        if (e1) return fail(e1.message);
+        readPublics(db, (e2, publics) => {
+          if (e2) return fail(e2.message);
+         readProjects(db, (e2b, projects) => {
+          if (e2b) return fail(e2b.message);
+
+          if (CHECK) {
+            checkRolesAndGroups(dynsec, scopes, publics, projects, (e3, differences) => {
+              if (e3) return fail(e3.message);
+              db.all('SELECT id, username FROM users WHERE id > 0 AND username IS NOT NULL', [], (e4, users) => {
+                if (e4) return fail(e4.message);
+                dynsec.listClients((e5, clients) => {
+                  if (e5) return fail(e5.message);
+                  for (const u of users) {
+                    const want = userClientName(u.username);
+                    if (!clients.includes(want)) differences.push(`client missing: ${want}`);
+                  }
+                  for (const org of orgs) {
+                    const want = names.loggerClient(org);
+                    if (!clients.includes(want)) differences.push(`client missing: ${want}`);
+                  }
+                  report(differences);
+                  dynsec.end(() => process.exit(differences.length ? 3 : 0));
+                });
+              });
+            });
+            return;
+          }
+
+          applyRolesAndGroups(dynsec, scopes, publics, projects, (e3) => {
+            if (e3) return fail(`Setting up roles and groups: ${e3.message}`);
+            console.log(`Roles and groups for ${scopes.length} organization/project scope(s), ` +
+                        `${projects.length} project(s), ${publics.length} publicly readable`);
+            syncUsers(db, dynsec, userSecret, (e4, n) => {
+              if (e4) return fail(`Syncing users: ${e4.message}`);
+              console.log(`${n} user account(s)`);
+              syncNodes(db, dynsec, (e5, m) => {
+                if (e5) return fail(`Syncing nodes: ${e5.message}`);
+                console.log(`${m} node account(s)`);
+                syncLoggers(dynsec, orgs, userSecret, (e6, k) => {
+                  if (e6) return fail(`Syncing logger accounts: ${e6.message}`);
+                  console.log(`${k} logger account(s)`);
+                  syncOrgAdmins(dynsec, orgs, userSecret, (e7, j) => {
+                    if (e7) return fail(`Syncing admin accounts: ${e7.message}`);
+                    console.log(`${j} server admin account(s)`);
+                    dynsec.end(() => process.exit(0));
+                  });
+                });
+              });
+            });
+          });
+         });
+        });
+      });
+    });
+  });
+});
+
+function report(differences) {
+  if (!differences.length) {
+    console.log('The broker matches the database.');
+  } else {
+    console.log(`${differences.length} difference(s) between the database and the broker:`);
+    for (const d of differences) console.log(`  ${d}`);
+    console.log('Run without --check to correct them.');
+  }
+}
+
+// One at a time on purpose: a Pi Zero has one core, there is no hurry, and a batch that fails
+// half-way is harder to reason about than a sequence that stops.
+function syncUsers(db, dynsec, userSecret, cb) {
+  db.all('SELECT id, username, hashed_password FROM users WHERE id > 0 AND username IS NOT NULL', [], (err, users) => {
+    if (err) return cb(err);
+    let i = 0;
+    const next = () => {
+      if (i >= users.length) return cb(null, users.length);
+      const u = users[i++];
+      readUserRows(db, u.id, (e, rows) => {
+        if (e) return cb(e);
+        applyUser(dynsec, { username: u.username, hashedPassword: u.hashed_password, rows, userSecret },
+          (e2) => (e2 ? cb(e2) : next()));
+      });
+    };
+    next();
+  });
+}
+
+function syncLoggers(dynsec, orgs, userSecret, cb) {
+  let i = 0;
+  const next = () => {
+    if (i >= orgs.length) return cb(null, orgs.length);
+    applyLogger(dynsec, { org: orgs[i++], userSecret }, (e) => (e ? cb(e) : next()));
+  };
+  next();
+}
+
+function syncOrgAdmins(dynsec, orgs, userSecret, cb) {
+  let i = 0;
+  const next = () => {
+    if (i >= orgs.length) return cb(null, orgs.length);
+    applyOrgAdmin(dynsec, { org: orgs[i++], userSecret }, (e) => (e ? cb(e) : next()));
+  };
+  next();
+}
+
+function syncNodes(db, dynsec, cb) {
+  // The nodes table arrives with S6; until then there is nothing to do and that is not an error.
+  db.all("SELECT name FROM sqlite_master WHERE type='table' AND name='nodes'", [], (err, t) => {
+    if (err) return cb(err);
+    if (!t.length) return cb(null, 0);
+    db.all('SELECT org, project, nodeid, password, lora FROM nodes', [], (e, nodes) => {
+      if (e) return cb(e);
+      let i = 0;
+      const next = () => {
+        if (i >= nodes.length) return cb(null, nodes.length);
+        const n = nodes[i++];
+        applyNode(dynsec, { ...n, lora: !!n.lora }, (e2) => (e2 ? cb(e2) : next()));
+      };
+      next();
+    });
+  });
+}

package/scripts/resetnode.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+/*
+ * Forget a node, so it can enrol again.
+ *
+ *   npx --no frugal-iot-resetnode <org> <project> <nodeid>
+ *
+ * Run from the server's own directory.
+ *
+ * A node proves it is itself by presenting the credential it already holds, so only the node can be
+ * issued a new one - otherwise anyone with the organization's enrolment secret could take over any
+ * node by quoting its id, which is public (it comes from the chip's MAC). The cost of that is this
+ * command: a node whose filesystem has been erased can prove nothing, and somebody has to say "yes,
+ * that really is my node".
+ *
+ * Rare in the field. Common while developing, where erasing flash is routine - two ways to avoid it
+ * there are to keep using the older configure_mqtt(host, user, password) form, which does not enrol
+ * at all, or to give a development organization its own looser policy.
+ *
+ * Positional arguments, no flags: npm swallows any --flag it does not recognise, so a flag would
+ * arrive here as nothing at all. See the npx note in claude.md.
+ */
+
+import sqlite3 from 'sqlite3';
+import { MqttLogger } from 'frugal-iot-logger';
+import { forgetNode } from '../lib/enrol.js';
+import { dropNode } from '../lib/dynsec-server.js';
+
+const [org, project, nodeid] = process.argv.slice(2);
+if (!org || !project || !nodeid) {
+  console.error('Usage: npx --no frugal-iot-resetnode <org> <project> <nodeid>');
+  console.error('Example: npx --no frugal-iot-resetnode myfarm lotus esp32-abc123');
+  process.exit(1);
+}
+
+const realLog = console.log;
+console.log = () => {};                       // the config reader logs a line per file
+new MqttLogger().readYamlConfig('.', (err, config) => {
+  console.log = realLog;
+  if (err) {
+    console.error(`Could not read the configuration: ${err.message}`);
+    process.exit(1);
+  }
+  const db = new sqlite3.Database('./frugal-iot.db', (dberr) => {
+    if (dberr) {
+      console.error(`Could not open ./frugal-iot.db: ${dberr.message}`);
+      console.error("Run this from the server's own directory.");
+      process.exit(1);
+    }
+    forgetNode(db, org, project, nodeid, (ferr, changes) => {
+      if (ferr) { console.error(ferr.message); process.exit(1); }
+      if (!changes) {
+        console.log(`No enrolled node ${org}/${project}/${nodeid} - nothing to forget.`);
+        console.log('It can enrol as soon as it asks. Check the spelling if you expected one.');
+        process.exit(0);
+      }
+      console.log(`Forgot ${org}/${project}/${nodeid} - it will enrol again on its next attempt.`);
+      // Remove the broker account too, so nothing is left that the database no longer knows about.
+      // Best effort: enrolling recreates it, and a broker that cannot be reached now is reported by
+      // frugal-iot-diagnostic as drift.
+      dropNode(config, org, project, nodeid, (derr) => {
+        if (derr) {
+          console.log(`The broker account was not removed: ${derr.message}`);
+          console.log('Harmless - re-enrolling replaces it. frugal-iot-rebuild-dynsec tidies up.');
+        }
+        db.close(() => process.exit(0));
+      });
+    });
+  });
+});