frugal-iot-server 2.0.2 → 2.0.4

package/INSTALLATION.md

@@ -978,48 +978,65 @@ installed by hand, the written procedure for doing that.
 > Note the asymmetry with the Pi end below: a *certificate* change needs only `reload`, but adding
 > or changing a *bridge* needs a full `restart`, because Mosquitto does not reload bridges.
 
-#### 11b. Authorizing this Pi (run on the production server)
+#### 11b. Authorizing this Pi (on the production server)
 
-Once per Pi. On the production server, from its own directory:
+Once per Pi, and there are two ways. **Use the dashboard** unless that server's broker has no
+dynamic security plugin.
+
+**From the dashboard** — no shell account on the production server needed, which is the point:
+
+1. Log in to production as someone with ADMIN on the organization.
+2. Open the organization, gear icon → **Bridges**.
+3. Under "Add a bridge", give the Pi a short name — `northfield`, `shed`, `village2`. It only
+   distinguishes one Pi from another within an organization, and becomes part of the broker account
+   name, so it cannot be changed afterwards without reconfiguring that Pi.
+4. Copy the **broker password** and the **replica token** it shows. Both are shown once.
+
+**From a shell on the production server**, which is what to use if its broker predates the plugin:
 
 ```
 npx --no frugal-iot-addbridge-prod <org-id> <site-name>
 ```
 
-The site name only distinguishes one Pi from another within an organization — `northfield`,
-`shed`, `village2` — and becomes part of the account name. The script creates the broker account,
-adds its access-control rule, reloads the broker, and prints both the password and the exact
-command to run in 11c.
+Either way you end up with a broker account `bridge-<site-name>`, its access-control rules, a
+replica token, and the command to run in 11c.
 
-Three things it checks, because each of them is a way this quietly fails:
+Three things worth knowing, because each is a way this quietly fails:
 
 * **The organization must already exist on the production server**, or the readings will arrive at
   its broker and nothing will record them — that server's logger subscribes per organization,
   driven by the files in its `config.d/organizations/`. If it is missing, add it there first with
   `frugal-iot-addorganization`, using the *same* organization id as this Pi.
-* **Each Pi gets its own account**, rather than sharing the organization's. The organization's
-  broker password is handed to every browser that logs in, so it is not a secret; a per-Pi account
-  can be confined to one site and revoked on its own.
-* **An existing account is left alone.** Re-running it for a site that already has one is refused
-  rather than quietly issuing a new password, which would stop that Pi relaying without anyone
-  touching it.
+* **Each Pi gets its own account**, rather than sharing the organization's, so it can be confined to
+  one site and revoked on its own.
+* **Doing it again for a site that already exists re-issues both credentials**, and the ones that Pi
+  is using stop working — from the dashboard it asks first. That is how to recover from having lost
+  them, and how to revoke a Pi you no longer trust; it is not a way to look them up again.
 
-The password is shown once and is not stored anywhere you can read back — copy it before you lose
-the output.
+Neither credential is stored anywhere you can read back, so copy both before you lose the output.
 
 #### 11c. Bridging this Pi (run on the Pi)
 
-Once per Pi. Run the command 11b printed, from this installation's directory:
+Once per Pi. Have both credentials from 11b to hand first — it asks for each in turn:
+
+* the **broker password** for `bridge-<site-name>`, which the MQTT bridge authenticates with;
+* the **replica token**, which lets this Pi pull production's logins so the same people can log in
+  here. Press Enter to skip it: a bridge relays readings perfectly well without one, and you can
+  re-run this later to add it.
+
+They are two different credentials for two different connections — MQTT on port 8883 for the first,
+HTTPS for the second — so neither substitutes for the other.
 
 ```
 cd ~/frugal-iot
 npx --no frugal-iot-addbridge-pi <org-id> <prod-host> bridge-<site-name>
 ```
 
-It asks for the password, then it checks the far end is reachable and that its certificate is valid for that name,
-writes `/etc/mosquitto/conf.d/frugal-iot-bridge.conf`, restarts the broker, and reports whether the
-bridge actually connected. It briefly disconnects every node, 
-which they recover from on their own.
+Having asked for those, it checks the far end is reachable and that its certificate is valid for
+that name, writes `/etc/mosquitto/conf.d/frugal-iot-bridge.conf` and — if you gave a token —
+`config.d/replica.yaml` with the token in `config.d/secrets.yaml`, restarts the broker, and reports
+whether the bridge actually connected. It briefly disconnects every node, which they recover from on
+their own.
 
 > The configuration goes into `/etc/mosquitto/conf.d/` and not into this installation's
 > `config.d/`, to keep the password out of `/config.json`. The file is written mode 600 for the same reason.

package/config.d/schema/modules.yaml

@@ -249,6 +249,21 @@ gps:
     - leaf:     hdop
     - leaf:     position
     - leaf:     utc_time
+# HC-SR04 ultrasonic module, timed trigger/echo - Sensor_HCSR04. The distance is the same shape
+# as the Modbus `ultrasonic` module's, but the module is only rated to 4m. The temperature is a
+# compensation input for the speed of sound, not a reading - so controlfloat, as for ens160.
+hcsr04:
+  name: "HC-SR04 Distance"
+  topics:
+    - leaf: hcsr04
+      leaf_from: ultrasonic
+      max:  4000
+    - leaf: temperature
+      leaf_from: controlfloat
+      name: Air Temperature
+      min:  -20
+      max:  50
+      color: "#ff0000"
 health:
   name: System
   insidefrugaliot: true

package/frugal-iot-server.js

@@ -109,7 +109,7 @@ import { MqttLogger } from "frugal-iot-logger";  // https://github.com/mitra42/f
 import { createAPIRouter, createAPIErrorHandler } from './lib/api-routes.js';
 import { buildConfigFor, hasPermissions } from './lib/config-for-user.js';
 import { ensureSecrets, addEnrolmentSecret, removeEnrolmentSecret } from './lib/secrets.js';
-import { syncUser, syncUserById, syncLoggers, syncNode, dropNode } from './lib/dynsec-server.js';
+import { syncUser, syncUserById, syncLoggers, syncNode, dropNode, syncBridge } from './lib/dynsec-server.js';
 import { enrol, ENROL, enrolmentSecretsFor, makeRateLimiter, forgetNode,
          makeAttemptLog, setGrant, clearGrant, readGrants } from './lib/enrol.js';
 import { deleteRetained } from './lib/retained.js';
@@ -1616,6 +1616,66 @@ mqttLogger.readYamlConfig('.', (err, configobj) => {
             });
           },
         );
+        /*
+         * Add a Pi bridge, or re-issue an existing one's credentials.
+         *
+         * The dashboard equivalent of frugal-iot-addbridge-prod, and it exists because that script
+         * needs root: it writes the password file and edits /etc/mosquitto/aclfile. Here the
+         * account and its rules go into the dynamic-security plugin, which the server can drive
+         * with the credential it already holds - so an organization's admin can add a bridge
+         * without anybody having a shell on this machine.
+         *
+         * The password is DERIVED from user_secret and the row's created_at, so nothing new is
+         * stored and frugal-iot-rebuild-dynsec can recreate the account exactly. Re-running this
+         * for a site that already exists moves created_at, which changes the derived password and
+         * mints a new replica token - deliberately, since that is how a Pi's credentials are
+         * rotated, and it revokes the old ones.
+         *
+         * POST because it changes things: a GET here could be triggered against a live admin
+         * session by any page that can make this browser fetch a URL (SEC-17).
+         */
+        app.post('/bridge_add/:org',
+          loggedInOrFail,
+          can_ADMIN,  // Gets org from URL - an admin may add a bridge only to their own organization
+          express.json({ limit: '4kb' }),
+          (req, res) => {
+            const org = req.params.org;
+            const site = String((req.body && req.body.site) || '').trim();
+            // The site becomes a broker account name and an MQTT topic level, so keep it to what
+            // is safe in both, and to what the Pi's own config can carry unquoted.
+            if (!/^[a-z0-9][a-z0-9-]{0,19}$/.test(site)) {
+              return res.status(400).json({ error:
+                'Site must be 1-20 characters, lower-case letters, digits and hyphens, starting with a letter or digit' });
+            }
+            const now = Date.now();
+            const token = crypto.randomBytes(32).toString('base64url');
+            db.run(`INSERT INTO bridges (org, site, token, created_at) VALUES (?, ?, ?, ?)
+                    ON CONFLICT(org, site) DO UPDATE SET token = excluded.token,
+                                                         created_at = excluded.created_at`,
+              [org, site, token, now], (err) => {
+                if (err) { return res.status(500).json({ error: err.message }); }
+                syncBridge(config, { org, site, createdAt: now }, (serr, result) => {
+                  if (serr) {
+                    // The row is written but the broker has no account, so the Pi could not connect.
+                    // Say so plainly rather than handing over a credential that does not work.
+                    return res.status(500).json({ error:
+                      `The bridge was recorded but its broker account could not be created: ${serr.message}` });
+                  }
+                  console.log("Bridge added by", req.user.username, "-", org, site);
+                  res.status(200).json({
+                    site,
+                    account: result.username,
+                    password: result.password,
+                    replica_token: token,
+                    // The command to run on the Pi. Neither secret is in it on purpose: that
+                    // script prompts for both precisely so they stay out of the Pi's shell history,
+                    // and putting them here would undo that.
+                    command: `npx --no frugal-iot-addbridge-pi ${org} <this-server-fqdn> ${result.username}`,
+                  });
+                });
+              });
+          },
+        );
         app.post('/node_reset/:org',
           loggedInOrFail,
           can_ADMIN,  // Gets org from URL - an organization admin may reset only their own nodes

package/lib/dynsec-plan.js

@@ -75,6 +75,18 @@ export const names = {
    */
   orgAdminClient: (org) => `${org}-admin`,
   clearRole: (org) => `${org}-clear`,
+
+  /*
+   * A Pi bridge. The account name is fixed by history: addbridge-prod.zsh has always called it
+   * "bridge-<site>", the Pi's mosquitto config carries that as remote_clientid, and the state topic
+   * the dashboard reads is named after it - so this cannot be renamed without reconfiguring every
+   * bridge that exists.
+   *
+   * Its role is per-bridge, not per-organization, because one of its rules names the account:
+   * a bridge may publish its OWN connection state and no one else's.
+   */
+  bridgeClient: (site) => `bridge-${site}`,
+  bridgeRole:   (site) => `bridge-${site}`,
 };
 
 // Topic filters, in one place for the same reason.
@@ -92,6 +104,8 @@ const topics = {
   // dashboard showing no devices while the readings themselves went through perfectly.
   discovery:   (org, project) => `${org}/${project}`,
   bridgeState: '$SYS/broker/connection/+/state',
+  // One bridge's own state, which only that bridge may publish
+  bridgeOwnState: (account) => `$SYS/broker/connection/${account}/state`,
 };
 
 /*
@@ -139,7 +153,7 @@ export function groupsForUser(rows) {
  *   scopes    [{org, project}]  - '' project meaning organization-wide
  *   publics   [{org, project}]  - the id-0 READ rows, as ACLs on the one shared public role
  */
-export function desiredRolesAndGroups(scopes, publics, projects) {
+export function desiredRolesAndGroups(scopes, publics, projects, bridges) {
   const roles = {};
   const groups = {};
 
@@ -223,6 +237,25 @@ export function desiredRolesAndGroups(scopes, publics, projects) {
       roles: [names.readRole(org, ORGWIDE), names.ownSubtreeRole, names.discoverRole(org)] };
     groups[names.gatewayGroup(org)] = { roles: [names.gatewayRole(org)] };
   }
+
+  /*
+   * One role per bridge: the whole of its organization, plus its own connection state.
+   *
+   * The state rule is what the dashboard's Bridges card depends on. A bridge's LOCAL side is exempt
+   * from access control, so a Pi always has its own state; the REMOTE side is an ordinary client,
+   * and without this it is refused - silently, which is how a bridge that was up and relaying
+   * perfectly still showed as "Unknown".
+   */
+  for (const { org, site } of bridges || []) {
+    if (!org || !site) continue;
+    const account = names.bridgeClient(site);
+    roles[names.bridgeRole(site)] = [
+      { acltype: 'subscribePattern', topic: topics.orgTree(org, ORGWIDE), allow: true },
+      { acltype: 'publishClientSend', topic: topics.orgTree(org, ORGWIDE), allow: true },
+      { acltype: 'publishClientReceive', topic: topics.orgTree(org, ORGWIDE), allow: true },
+      { acltype: 'publishClientSend', topic: topics.bridgeOwnState(account), allow: true },
+    ];
+  }
   return { roles, groups };
 }
 
@@ -248,6 +281,23 @@ export function deriveLoggerPassword(userSecret, org) {
  * then a confused or compromised logger could invent sensor data - and the readings are the whole
  * point of the system. The <org>-write role is set/-only, which is exactly that.
  */
+/*
+ * A bridge's password. Derived, like the logger's and the org admin's, so nothing has to be stored
+ * and "the broker can be rebuilt from the database" stays true - a bridge account recreated by
+ * frugal-iot-rebuild-dynsec gets exactly the password the Pi is already configured with.
+ *
+ * created_at is in the input so that a bridge CAN be given a new password: updating that column
+ * changes the derivation, which is what re-running the add makes happen, and the old credential
+ * stops working. Without it a bridge password could never be rotated short of changing user_secret,
+ * which would reset every account on the broker.
+ */
+export function deriveBridgePassword(userSecret, site, createdAt) {
+  if (!userSecret) throw new Error('No user_secret - run frugal-iot-init');
+  return createHmac('sha256', userSecret)
+    .update('bridge:').update(String(site)).update(':').update(String(createdAt))
+    .digest('base64url').slice(0, 22);
+}
+
 // The server's administrative account for one organization. Derived, like the logger's, with its
 // own label so the two can never collide.
 export function deriveOrgAdminPassword(userSecret, org) {

package/lib/dynsec-server.js

@@ -9,7 +9,8 @@
  */
 
 import { dynsecConnect } from './dynsec.js';
-import { readUserRows, applyUser, applyLogger, applyNode, removeUser } from './dynsec-sync.js';
+import { readUserRows, applyUser, applyLogger, applyNode, removeUser,
+         applyRolesAndGroups, applyBridge, removeBridge } from './dynsec-sync.js';
 import { derivePassword, deriveLoggerPassword, names } from './dynsec-plan.js';
 
 let unavailableReported = false;
@@ -226,6 +227,45 @@ export function dropNode(config, org, project, nodeid, cb) {
   });
 }
 
+/*
+ * Create or re-issue one Pi bridge's broker account, and its role.
+ *
+ * Both the role and the client, because a bridge's role names the bridge - unlike a user, whose
+ * groups exist already. applyRolesAndGroups is given just this one bridge: it is idempotent and
+ * only ever adds, so the roles and groups of everything else are left as they are.
+ *
+ * Unlike addbridge-prod.zsh this needs no root and no shell: the account goes into the plugin
+ * rather than the password file, and the ACL into a dynsec role rather than /etc/mosquitto/aclfile.
+ * That is what lets an organization's admin add a bridge from the dashboard.
+ */
+export function syncBridge(config, { org, site, createdAt }, cb) {
+  const userSecret = config.secrets && config.secrets.user_secret;
+  if (!userSecret) return cb(new Error('No user_secret in config.d/secrets.yaml'));
+  if (!dynsecConfigured(config)) {
+    return cb(new Error('This server has no dynamic security credential, so it cannot create '
+      + 'broker accounts. Use frugal-iot-addbridge-prod from a shell on the server instead.'));
+  }
+  withDynsec(config, (cerr, dynsec, done) => {
+    if (cerr) { reportUnavailable(`bridge ${site}`, cerr); return cb(cerr); }
+    applyRolesAndGroups(dynsec, [], [], [], [{ org, site }], (rerr) => {
+      if (rerr) { done(); return cb(rerr); }
+      applyBridge(dynsec, { org, site, createdAt, userSecret }, (err, res) => { done(); cb(err, res); });
+    });
+  });
+}
+
+// Remove a bridge's account and its role, for when a Pi is retired.
+export function dropBridge(config, site, cb) {
+  cb = cb || (() => {});
+  withDynsec(config, (cerr, dynsec, done) => {
+    if (cerr) { reportUnavailable(`removing bridge ${site}`, cerr); return cb(cerr); }
+    removeBridge(dynsec, site, (err) => {
+      done();
+      cb(err && !/not found/i.test(err.message) ? err : null);
+    });
+  });
+}
+
 // When an account goes away. Not wired up yet - nothing deletes users - but the rebuild tool cannot
 // notice a user that is no longer in the database, so this is what the deletion path will need.
 export function dropUser(config, username, cb) {

package/lib/dynsec-sync.js

@@ -7,7 +7,7 @@
  */
 
 import { desiredRolesAndGroups, groupsForUser, groupsForNode, groupsForLogger,
-         derivePassword, deriveLoggerPassword, deriveOrgAdminPassword, names } from './dynsec-plan.js';
+         derivePassword, deriveLoggerPassword, deriveOrgAdminPassword, deriveBridgePassword, names } from './dynsec-plan.js';
 
 // ---- reading the database -------------------------------------------------------------------
 // Every (org, project) any permission row mentions, plus every organization in the config, so an
@@ -51,8 +51,8 @@ export function readUserRows(db, id, cb) {
  * Create every role and group the plan calls for, and set their ACLs. Idempotent: re-running is how
  * the rebuild tool works, and how a release that adds a rule delivers it.
  */
-export function applyRolesAndGroups(dynsec, scopes, publics, projects, cb) {
-  const { roles, groups } = desiredRolesAndGroups(scopes, publics, projects);
+export function applyRolesAndGroups(dynsec, scopes, publics, projects, bridges, cb) {
+  const { roles, groups } = desiredRolesAndGroups(scopes, publics, projects, bridges);
   const create = [];
   const acls = [];
   for (const [rolename, list] of Object.entries(roles)) {
@@ -171,6 +171,37 @@ export function applyOrgAdmin(dynsec, { org, userSecret }, cb) {
   });
 }
 
+/*
+ * One Pi bridge's broker account.
+ *
+ * Its role is attached DIRECTLY rather than through a group, like the org admin's, because the role
+ * names this one account in its state rule - a group would invite a second bridge being put in it,
+ * which would let each publish the other's connection state.
+ *
+ * Nothing here needs root, which is the point: addbridge-prod.zsh had to run mosquitto_passwd and
+ * edit /etc/mosquitto/aclfile, so only someone with a shell on the server could add a bridge.
+ */
+export function applyBridge(dynsec, { org, site, createdAt, userSecret }, cb) {
+  const username = names.bridgeClient(site);
+  const password = deriveBridgePassword(userSecret, site, createdAt);
+  const role = names.bridgeRole(site);
+  dynsec.idempotent([{ command: 'createClient', username, password }], (err) => {
+    if (err) return cb(err);
+    dynsec.getClient(username, (err2, client) => {
+      if (err2) return cb(err2);
+      const haveRoles = ((client && client.roles) || []).map((r) => r.rolename || r);
+      const cmds = [{ command: 'setClientPassword', username, password }];
+      if (!haveRoles.includes(role)) cmds.push({ command: 'addClientRole', username, rolename: role });
+      dynsec.idempotent(cmds, (err3) => cb(err3, { username, password, org }));
+    });
+  });
+}
+
+export function removeBridge(dynsec, site, cb) {
+  dynsec.raw([{ command: 'deleteClient', username: names.bridgeClient(site) },
+              { command: 'deleteRole', rolename: names.bridgeRole(site) }], (err) => cb(err));
+}
+
 export function removeUser(dynsec, username, cb) {
   dynsec.raw([{ command: 'deleteClient', username: names.userClient(username) }], (err) => {
     if (err && /not found/i.test(err.message)) return cb(null);
@@ -184,7 +215,7 @@ export function removeUser(dynsec, username, cb) {
  * frugal-iot-rebuild-dynsec --check reports and what scripts/diagnostic.zsh calls: reporting drift
  * is useful more often than repairing it.
  */
-export function checkRolesAndGroups(dynsec, scopes, publics, projects, cb) {
+export function checkRolesAndGroups(dynsec, scopes, publics, projects, bridges, cb) {
   const { roles, groups } = desiredRolesAndGroups(scopes, publics, projects);
   const differences = [];
   dynsec.listRoles((err, haveRoles) => {

package/package.json

@@ -12,8 +12,8 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^2.0.2",
-    "frugal-iot-logger": "^2.0.2",
+    "frugal-iot-client": "^2.0.4",
+    "frugal-iot-logger": "^2.0.4",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
@@ -86,5 +86,5 @@
     "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "2.0.2"
+  "version": "2.0.4"
 }

package/public/service-worker.js

@@ -6,7 +6,7 @@
 // it, an installed browser keeps serving the files it already cached - and since the list now covers
 // the dashboard's own code, that means old JS behind freshly fetched HTML. Any edit to the list
 // needs this bumped, or it does not reach anyone who already has the old one.
-const CACHE_NAME = 'frugal-iot-cache-2.0.2';
+const CACHE_NAME = 'frugal-iot-cache-2.0.4';
 /*
  * Everything the app needs, so that a phone on a poor or expensive link fetches it once.
  *

package/scripts/addbridge-prod.zsh

@@ -190,15 +190,42 @@ if [[ -n "$ACLFILE" ]]; then
     echo "The account has been created but cannot reach anything until that is sorted out." >&2
     exit 1
   fi
-  if sudo grep -qE "^[[:space:]]*user[[:space:]]+${ACCOUNT}[[:space:]]*$" "$ACLFILE"; then
-    echo "ACL rule for ${ACCOUNT} is already in ${ACLFILE} - leaving it alone."
+  #
+  # Two grants, and the second is easy to leave out.
+  #
+  # A bridge with "notifications true" publishes a retained 1/0 to
+  # $SYS/broker/connection/<clientid>/state on the local AND the remote broker, and that is what the
+  # dashboard's Bridges card reads. The bridge's LOCAL side is exempt from the ACL, so the Pi always
+  # has it; the remote side is not, and on a deny-by-default broker the write is refused silently -
+  # so the card said "Unknown" for a bridge that was up and relaying perfectly. Measured on
+  # mosquitto 2.0.20: the write is allowed once the ACL says so, so this is an ACL matter and not
+  # one of mosquitto refusing $SYS writes outright.
+  ACL_ORG_RULE=0; ACL_SYS_RULE=0
+  sudo grep -qE "^[[:space:]]*user[[:space:]]+${ACCOUNT}[[:space:]]*$" "$ACLFILE" && ACL_ORG_RULE=1
+  sudo grep -qF "topic write \$SYS/broker/connection/${ACCOUNT}/state" "$ACLFILE" && ACL_SYS_RULE=1
+
+  if (( ACL_ORG_RULE && ACL_SYS_RULE )); then
+    echo "ACL rules for ${ACCOUNT} are already in ${ACLFILE} - leaving them alone."
+  elif (( ACL_ORG_RULE )); then
+    # An existing bridge from before the state grant existed. A second "user" stanza for the same
+    # account is valid and additive, which is simpler and safer than editing the first one in place.
+    echo "Adding the connection-state ACL rule for ${ACCOUNT} to ${ACLFILE} ..."
+    sudo tee -a "$ACLFILE" >/dev/null <<EOF
+
+# Lets the bridge report whether it is connected, for the dashboard's Bridges card
+user ${ACCOUNT}
+topic write \$SYS/broker/connection/${ACCOUNT}/state
+EOF
+    echo "  Restart the Pi's broker to have it republish that state: it is sent on connect only."
   else
-    echo "Adding ACL rule to ${ACLFILE} ..."
+    echo "Adding ACL rules to ${ACLFILE} ..."
     sudo tee -a "$ACLFILE" >/dev/null <<EOF
 
 # Pi bridge for site "${SITE}", confined to its organization's topics
 user ${ACCOUNT}
 topic readwrite ${ORG_ID}/#
+# ... and its own connection state, which the dashboard's Bridges card reads
+topic write \$SYS/broker/connection/${ACCOUNT}/state
 EOF
   fi
 else
@@ -288,11 +315,14 @@ if [[ -n "$REPLICA_TOKEN" ]]; then
 fi
 echo "Then, on the Pi at site '${SITE}':"
 echo ""
+echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <fqdn-from-1-above> ${ACCOUNT}"
+echo ""
 if [[ -n "$REPLICA_TOKEN" ]]; then
-  echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <fqdn-from-1-above> ${ACCOUNT} -- --replica-token <token-from-3>"
+  echo "It asks for the password from 2, then for the replica token from 3. Neither is given on the"
+  echo "command line on purpose, so that neither ends up in that Pi's shell history."
 else
-  echo "  npx --no frugal-iot-addbridge-pi ${ORG_ID} <fqdn-from-1-above> ${ACCOUNT}"
+  echo "It asks for the password from 2. Neither secret is given on the command line on purpose, so"
+  echo "that neither ends up in that Pi's shell history."
 fi
-echo ""
-echo "The first three are positional on purpose: npm swallows any --flag it does not recognise and"
-echo "passes only the value on, so the --org form would arrive at that script as a bare word."
+echo "The arguments are positional because npm swallows any --flag it does not recognise and passes"
+echo "only the value on, so the --org form would arrive at that script as a bare word."

package/scripts/rebuild-dynsec.js

@@ -21,7 +21,8 @@ import { MqttLogger } from 'frugal-iot-logger';
 import { dynsecConnect } from '../lib/dynsec.js';
 import {
   readScopes, readPublics, readProjects, readUserRows,
-  applyRolesAndGroups, applyUser, applyNode, applyLogger, applyOrgAdmin, checkRolesAndGroups,
+  applyRolesAndGroups, applyUser, applyNode, applyLogger, applyOrgAdmin, applyBridge,
+  checkRolesAndGroups,
 } from '../lib/dynsec-sync.js';
 import { names } from '../lib/dynsec-plan.js';
 
@@ -71,9 +72,11 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
           if (e2) return fail(e2.message);
          readProjects(db, (e2b, projects) => {
           if (e2b) return fail(e2b.message);
+          readBridges(db, (e2c, bridges) => {
+           if (e2c) return fail(e2c.message);
 
           if (CHECK) {
-            checkRolesAndGroups(dynsec, scopes, publics, projects, (e3, differences) => {
+            checkRolesAndGroups(dynsec, scopes, publics, projects, bridges, (e3, differences) => {
               if (e3) return fail(e3.message);
               db.all('SELECT id, username FROM users WHERE id > 0 AND username IS NOT NULL', [], (e4, users) => {
                 if (e4) return fail(e4.message);
@@ -87,6 +90,10 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
                     const want = names.loggerClient(org);
                     if (!clients.includes(want)) differences.push(`client missing: ${want}`);
                   }
+                  for (const b of bridges) {
+                    const want = names.bridgeClient(b.site);
+                    if (!clients.includes(want)) differences.push(`client missing: ${want}`);
+                  }
                   report(differences);
                   dynsec.end(() => process.exit(differences.length ? 3 : 0));
                 });
@@ -95,7 +102,7 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
             return;
           }
 
-          applyRolesAndGroups(dynsec, scopes, publics, projects, (e3) => {
+          applyRolesAndGroups(dynsec, scopes, publics, projects, bridges, (e3) => {
             if (e3) return fail(`Setting up roles and groups: ${e3.message}`);
             console.log(`Roles and groups for ${scopes.length} organization/project scope(s), ` +
                         `${projects.length} project(s), ${publics.length} publicly readable`);
@@ -111,12 +118,17 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
                   syncOrgAdmins(dynsec, orgs, userSecret, (e7, j) => {
                     if (e7) return fail(`Syncing admin accounts: ${e7.message}`);
                     console.log(`${j} server admin account(s)`);
-                    dynsec.end(() => process.exit(0));
+                    syncBridges(dynsec, bridges, userSecret, (e8, b) => {
+                      if (e8) return fail(`Syncing bridge accounts: ${e8.message}`);
+                      console.log(`${b} bridge account(s)`);
+                      dynsec.end(() => process.exit(0));
+                    });
                   });
                 });
               });
             });
           });
+          });
          });
         });
       });
@@ -124,6 +136,31 @@ new MqttLogger().readYamlConfig('.', (err, config) => {
   });
 });
 
+/*
+ * The Pi bridges, which are accounts like any other and so belong in a rebuild.
+ *
+ * The table arrives with the first bridge ever added, so its absence is normal rather than an
+ * error - the same treatment the nodes table gets below.
+ */
+function readBridges(db, cb) {
+  db.all("SELECT name FROM sqlite_master WHERE type='table' AND name='bridges'", [], (err, t) => {
+    if (err) return cb(err);
+    if (!t.length) return cb(null, []);
+    db.all('SELECT org, site, created_at FROM bridges', [], (e, rows) => cb(e, rows || []));
+  });
+}
+
+function syncBridges(dynsec, bridges, userSecret, cb) {
+  let i = 0;
+  const next = () => {
+    if (i >= bridges.length) return cb(null, bridges.length);
+    const b = bridges[i++];
+    applyBridge(dynsec, { org: b.org, site: b.site, createdAt: b.created_at, userSecret },
+      (e) => (e ? cb(e) : next()));
+  };
+  next();
+}
+
 function report(differences) {
   if (!differences.length) {
     console.log('The broker matches the database.');