frugal-iot-server 2.0.7 → 2.0.9

package/lib/schema-columns.js

@@ -9,6 +9,7 @@
  */
 const ADDED = [
   { table: 'bridges', column: 'credential', type: 'TEXT' },
+  { table: 'grafana_tokens', column: 'user_id', type: 'INTEGER' },
 ];
 
 export function addMissingColumns(db, cb) {

package/package.json

@@ -12,8 +12,8 @@
     "cookie-parser": "^1.4.7",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
-    "frugal-iot-client": "^2.0.7",
-    "frugal-iot-logger": "^2.0.7",
+    "frugal-iot-client": "^2.0.9",
+    "frugal-iot-logger": "^2.0.9",
     "hash-wasm": "^4.12.0",
     "js-yaml": "^4.2.0",
     "morgan": "^1.11.0",
@@ -35,7 +35,9 @@
     "frugal-iot-addbridge-pi": "scripts/addbridge-pi.zsh",
     "frugal-iot-rebuild-dynsec": "scripts/rebuild-dynsec.js",
     "frugal-iot-dynsec-init": "scripts/dynsec-init.js",
-    "frugal-iot-resetnode": "scripts/resetnode.js"
+    "frugal-iot-resetnode": "scripts/resetnode.js",
+    "frugal-iot-grafana-token": "scripts/grafana-token.js",
+    "frugal-iot-backfill-opensearch": "scripts/backfill-opensearch.js"
   },
   "description": "Frugal IoT client and server",
   "//files": "An allowlist, not an ignore list - anything not named here is never published, so a stray file (a database backup, a credential) cannot leak by default. Check with: npm pack --dry-run",
@@ -46,12 +48,14 @@
     "config.d/email.yaml",
     "config.d/logger.yaml",
     "config.d/mqtt.yaml",
+    "config.d/opensearch.yaml",
     "config.d/server.yaml",
     "config.d/schema/",
     "lib/",
     "public/",
     "private/",
     "scripts/",
+    "extras/grafana/",
     "extras/mosquitto.conf",
     "extras/aclfile",
     "extras/mosquitto-bridge.conf.example",
@@ -60,6 +64,8 @@
     "extras/frugaliot-ap-watchdog.service",
     "extras/frugaliot-ap-watchdog.timer",
     "API.md",
+    "GRAFANA.md",
+    "INSTALL-OPENSEARCH.md",
     "INSTALLATION.md"
   ],
   "devDependencies": {
@@ -87,7 +93,7 @@
     "check-files": "node scripts/check-published-files.js"
   },
   "type": "module",
-  "version": "2.0.7",
+  "version": "2.0.9",
   "overrides": {
     "uuid": "^11.1.1"
   }

package/public/service-worker.js

@@ -6,7 +6,7 @@
 // it, an installed browser keeps serving the files it already cached - and since the list now covers
 // the dashboard's own code, that means old JS behind freshly fetched HTML. Any edit to the list
 // needs this bumped, or it does not reach anyone who already has the old one.
-const CACHE_NAME = 'frugal-iot-cache-2.0.7';
+const CACHE_NAME = 'frugal-iot-cache-2.0.9';
 /*
  * Everything the app needs, so that a phone on a poor or expensive link fetches it once.
  *

package/scripts/backfill-opensearch.js

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+/*
+ * Load an organization's recorded readings into OpenSearch - the history from before its OpenSearch
+ * forwarder was switched on, or a gap from while OpenSearch was down.
+ *
+ *   npx --no frugal-iot-backfill-opensearch <org>                       everything
+ *   npx --no frugal-iot-backfill-opensearch <org> 2026-09-01            only files from that day on
+ *   npx --no frugal-iot-backfill-opensearch <org> dry-run               count, and send nothing
+ *
+ * Run from the server's own directory. It uses the organization's OpenSearch forwarder as set up on
+ * the dashboard's Forwarders card (a switched-off one is not used), and its "Only these topics" list.
+ * Safe to repeat, and to run while the server is: a reading's id comes from its topic and time, so one
+ * already in OpenSearch is replaced rather than doubled.
+ *
+ * Positional arguments, no flags: npm swallows any --flag it does not recognise. See the npx note in
+ * claude.md.
+ */
+
+import sqlite3 from 'sqlite3';
+import { MqttLogger, backfillOpenSearch } from 'frugal-iot-logger';
+import { initializeSchema } from '../lib/database.js';
+import { enabledConfigs } from '../lib/forwarders.js';
+
+const [org, ...rest] = process.argv.slice(2);
+const dryRun = rest.includes('dry-run');
+const since = rest.find((a) => /^\d{4}-\d{2}-\d{2}$/.test(a));
+if (!org || rest.some((a) => a !== 'dry-run' && a !== since)) {
+  console.error('Usage: npx --no frugal-iot-backfill-opensearch <org> [YYYY-MM-DD] [dry-run]');
+  process.exit(1);
+}
+
+const realLog = console.log;
+console.log = () => {};                       // the config reader logs a line per file
+new MqttLogger().readYamlConfig('.', (err, config) => {
+  console.log = realLog;
+  if (err) { console.error(`Could not read the configuration: ${err.message}`); process.exit(1); }
+  if (!(config.organizations || {})[org]) { console.error(`No organization "${org}"`); process.exit(1); }
+  const db = new sqlite3.Database('./frugal-iot.db', async (dberr) => {
+    if (dberr) { console.error(`Could not open ./frugal-iot.db: ${dberr.message}`); process.exit(1); }
+    try {
+      await initializeSchema(db); // makes the table if this database is from before it existed
+      const fromDb = (await enabledConfigs(db, org, config.opensearch)).filter((c) => c.type === 'opensearch');
+      // Still honoured while YAML forwarders are supported, so a server not yet moved over works
+      const fromFile = (config.organizations[org].forwarders || []).filter((c) => c && c.type === 'opensearch');
+      const forwarders = [...fromDb, ...fromFile];
+      if (forwarders.length === 0) {
+        console.error(`${org} has no OpenSearch forwarder - add one on the dashboard's Forwarders card first`);
+        process.exitCode = 1;
+        return;
+      }
+      for (const fconfig of forwarders) {
+        const { sent, skippedFiles } = await backfillOpenSearch({
+          config: fconfig, org, dataDir: config.server.datadir, since, dryRun,
+          progress: (n) => process.stdout.write(`\r${n} readings`),
+        });
+        console.log(`\n${dryRun ? 'Would send' : 'Sent'} ${sent} readings to ${fconfig.node}` +
+          (skippedFiles ? `; ${skippedFiles} files skipped by its topics list` : ''));
+      }
+    } catch (e) {
+      console.error(e.message);
+      process.exitCode = 1;
+    } finally {
+      db.close();
+    }
+  });
+});

package/scripts/grafana-token.js

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/*
+ * Issue, list or revoke the tokens Grafana uses to read an organization's history (GRAFANA.md).
+ *
+ *   npx --no frugal-iot-grafana-token add <org> <username> <name>   prints the token - once, it is not kept
+ *   npx --no frugal-iot-grafana-token list <org>
+ *   npx --no frugal-iot-grafana-token revoke <org> <name>
+ *
+ * Run from the server's own directory. Adding a name that exists replaces its token, which is how
+ * one is rotated. A token is read-only, for that one organization, and acts as <username>: it sees
+ * what that user may READ, and stops working when they lose access.
+ *
+ * Positional arguments, no flags: npm swallows any --flag it does not recognise. See the npx note
+ * in claude.md.
+ */
+
+import sqlite3 from 'sqlite3';
+import { initializeSchema } from '../lib/database.js';
+import { addMissingColumns } from '../lib/schema-columns.js';
+import { issueToken, listTokens, revokeToken } from '../lib/grafana.js';
+
+const [action, org, ...rest] = process.argv.slice(2);
+const [username, name] = action === 'add' ? rest : [undefined, rest[0]];
+const usage = () => {
+  console.error('Usage: npx --no frugal-iot-grafana-token add <org> <username> <name>');
+  console.error('       npx --no frugal-iot-grafana-token list <org>');
+  console.error('       npx --no frugal-iot-grafana-token revoke <org> <name>');
+  process.exit(1);
+};
+if (!['add', 'list', 'revoke'].includes(action) || !org || (action === 'add' && !username) || (action !== 'list' && !name)) usage();
+if (name && !/^[A-Za-z0-9][A-Za-z0-9 _.-]{0,39}$/.test(name)) {
+  console.error('The name must be 1-40 characters: letters, digits, space, _ . -');
+  process.exit(1);
+}
+
+const db = new sqlite3.Database('./frugal-iot.db', async (err) => {
+  if (err) { console.error(`Could not open ./frugal-iot.db: ${err.message}`); process.exit(1); }
+  try {
+    await initializeSchema(db); // adds the table to a database from before it existed; changes nothing else
+    await new Promise((res, rej) => addMissingColumns(db, (e) => (e ? rej(e) : res())));
+    if (action === 'add') {
+      const user = await new Promise((res, rej) => db.get('SELECT id FROM users WHERE username = ?', [username], (e, r) => (e ? rej(e) : res(r))));
+      if (!user) throw new Error(`No user "${username}"`);
+      const token = await issueToken(db, org, name, user.id);
+      console.log(`Token for ${org} "${name}" (acting as ${username}) - shown once, put it in Grafana now:\n\n${token}\n`);
+    } else if (action === 'list') {
+      const rows = await listTokens(db, org);
+      if (rows.length === 0) console.log(`No Grafana tokens for ${org}`);
+      for (const r of rows) {
+        console.log(`${r.name}\tissued ${new Date(r.created_at).toISOString()}\tlast used ${r.last_used ? new Date(r.last_used).toISOString() : 'never'}`);
+      }
+    } else {
+      const done = await revokeToken(db, org, name);
+      console.log(done ? `Revoked "${name}" for ${org}` : `No token "${name}" for ${org}`);
+      if (!done) process.exitCode = 1;
+    }
+  } catch (e) {
+    console.error(e.message);
+    process.exitCode = 1;
+  }
+  db.close();
+});