sailkick-boat 0.14.1 → 0.14.3

package/README.md

@@ -7,8 +7,8 @@
 > and a **local proxy that keeps the sailkick app and its charts/maps fully usable
 > offline** on board. The service runs at **[www.sailkick.io](https://www.sailkick.io)**.
 >
-> **Pairing needs an invite code** — there is no open registration yet, so installing
-> this plugin from the Signal K Appstore is not enough on its own. Expect breaking
+> **Registration is invite-only** and happens on the website, not in the plugin — so
+> installing this from the Signal K Appstore is not enough on its own. Expect breaking
 > changes while the version is 0.x.
 >
 > **Want an invite, or more information?** Get in touch:
@@ -159,22 +159,36 @@ works **offline** with the boat's own data. Only when neither a local InfluxDB n
 telemetry is available do these paths **fall through to the cloud mirror**, so an
 online boat is never worse off than before.
 
-## Setup: pair the boat once
-Fill the **Sailkick account** section — **invite code + boat name + password** — and
-save. The plugin calls the app's `POST /api/auth/signup` once: that creates your
-account, provisions its cloud storage, and returns the write token, bucket, org and
-InfluxDB URL for your boat. The bundle is cached (0600) in the plugin data dir and
-reused on every later start, so sync keeps working **offline** and across restarts.
+## Setup: register on the web, then paste the token
+1. Register your boat at **[www.sailkick.io](https://www.sailkick.io)** (an invite code
+   is needed — see above). The signup screen shows your boat's ingest credentials.
+2. **Copy the "Write token"** — it is shown **once** and cannot be recovered. If you
+   lose it you need a new one minted.
+3. In Plugin Config, fill the **Sailkick account** section — **boat name + write
+   token** — and save.
 
-Pairing is **one-time by design** — the invite code is single-use, so the plugin never
-calls signup twice. Once `account.json` exists the account fields are no longer read;
-delete that file to re-pair (which needs a fresh invite).
+That is the whole handshake. The plugin resolves everything else locally (`bucket` =
+`<slug>_raw`, `org` = `sailkick`) and never calls the app for configuration, so setup
+works with no internet and there is nothing to re-fetch after a restart.
+
+> **Ignore the "Influx URL", "Organization" and "Bucket" on that screen** — they are for
+> the community `signalk-to-influxdb-v2` plugin. This plugin always writes to
+> `https://sync.sailkick.io`; the endpoint is fleet-wide and cannot be set from the UI,
+> so a wrong value can never redirect your telemetry. (Self-hosters: hand-edit
+> `sync.influxUrl` in the plugin config JSON.) If the status line ever warns that sync is
+> writing to a local address, telemetry is not leaving the boat.
+
+Registration deliberately happens **only** in the web app. The plugin cannot sign up,
+so there is no way to half-create an account or burn an invite from the boat.
+
+> Changing the token later — after a rotation, say — is just editing the field and
+> saving. Pasted values are trimmed, and the boat name is lower-cased for you.
 
 ## Config
 The page is deliberately small — everything else has a right answer and is a constant
 in `index.js`.
 
-- **Sailkick account**: `invite`, `slug` (boat name), `password`
+- **Sailkick account**: `slug` (boat name), `writeToken`
 - **Telemetry sync → cloud**: `enabled`
 - **Offline app & maps**: `enabled`, `proxyPort` (default 8080), `localSignalkUrl`
   (default `http://127.0.0.1:3000`), `dataDir`, `seedEnabled`, `prefetchRadiusNm`,

package/index.js

@@ -45,6 +45,17 @@ const HISTORY_TUNING = {
   ringSampleSec: 15
 }
 
+// A *cloud* endpoint on loopback means telemetry never leaves the boat. On the wire it
+// is indistinguishable from a normal offline backlog — the spool just grows — so it has
+// to be called out explicitly. (The local history DB is legitimately on 127.0.0.1; this
+// check is only ever applied to the sync path.)
+function isLoopbackUrl (u) {
+  try {
+    const h = new URL(u).hostname.replace(/^\[|\]$/g, '')
+    return h === 'localhost' || h === '::1' || /^127\./.test(h)
+  } catch { return false }
+}
+
 module.exports = function (app) {
   let sync = null
   let proxy = null
@@ -52,6 +63,7 @@ module.exports = function (app) {
   let history = null
   let statusTimer = null
   let accountStatus = null
+  let syncWarning = null
 
   const plugin = {
     id: 'sailkick-boat',
@@ -66,12 +78,11 @@ module.exports = function (app) {
     properties: {
       account: {
         type: 'object',
-        title: 'Sailkick account (one-time pairing)',
-        description: 'Pair this boat with your sailkick account once. The plugin creates the account, provisions its cloud storage, and stores the result locally — so it keeps syncing offline and after restarts. Your invite code is single-use; once paired these fields are no longer read.',
+        title: 'Sailkick account',
+        description: 'Register your boat at www.sailkick.io first — the signup screen shows a write token. Paste it here together with your boat name. Keep that token safe: it is shown only once and cannot be recovered.',
         properties: {
-          invite: { type: 'string', title: 'Invite code' },
-          slug: { type: 'string', title: 'Boat name', description: '2–40 characters: lowercase letters, numbers, dashes. This is your permanent boat id.' },
-          password: { type: 'string', title: 'Password', description: 'At least 8 characters.' }
+          slug: { type: 'string', title: 'Boat name', description: 'Exactly as registered on the website.' },
+          writeToken: { type: 'string', title: 'Write token', description: 'From the signup screen ("Write token"). Everything else — Influx URL, organization, bucket — is derived from it and your boat name.' }
         }
       },
       sync: {
@@ -115,23 +126,17 @@ module.exports = function (app) {
 
   plugin.start = function (options) {
     const opts = options || {}
-    // Pairing first: on the very first start this provisions the account and caches the
-    // bundle; on every later start it is a disk read (see lib/account — signup is
-    // single-use and must never run twice).
-    ;(async () => {
-      const r = await resolveAccountConfig(app, opts.account, { appUrl: SAILKICK_APP_URL })
-      if (r.bundle) {
-        accountStatus = r.source === 'paired'
-          ? `account: paired as ${r.bundle.slug}`
-          : `account: ${r.bundle.slug}`
-      } else if (r.error) {
-        accountStatus = `account: pairing failed — ${r.error}${r.terminal ? '' : ' (will retry on restart)'}`
-        ;(app.error || console.error)('[sailkick-boat] pairing failed: ' + r.error)
-      } else {
-        accountStatus = 'account: not paired — enter your invite code'
-      }
+    try {
+      // Purely local: the boat registers on the website, the owner pastes the write
+      // token here. Nothing to fetch, so nothing that can fail while offline.
+      const r = resolveAccountConfig(app, opts.account)
+      if (r.bundle) accountStatus = `account: ${r.bundle.slug}`
+      else if (r.error) accountStatus = `account: ${r.error}`
+      else accountStatus = 'account: not configured — register at www.sailkick.io, then paste your write token'
       startModules(opts, r.bundle)
-    })().catch((e) => (app.error || console.error)('[sailkick-boat] start failed: ' + e.message))
+    } catch (e) {
+      (app.error || console.error)('[sailkick-boat] start failed: ' + e.message)
+    }
   }
 
   function startModules (opts, bundle) {
@@ -151,7 +156,12 @@ module.exports = function (app) {
     if (s.enabled !== false) {
       const syncOpts = {
         ...SYNC_TUNING,
-        influxUrl: b.influxUrl || s.influxUrl || SAILKICK_INFLUX_URL,
+        // The cloud endpoint is fleet-wide and fixed. A pasted or cached bundle can
+        // never set it — the app's signup screen hands out its own http://localhost:8086,
+        // and a boat that believed it would spool to loopback forever, looking healthy.
+        // `sync.influxUrl` survives only as a self-hosting escape hatch: it is not in
+        // the schema, so it cannot arrive by pasting, only by editing the config JSON.
+        influxUrl: s.influxUrl || SAILKICK_INFLUX_URL,
         org: b.org || s.org || SYNC_TUNING.org,
         bucket: b.bucket || s.bucket,
         token: b.writeToken || s.token,
@@ -164,6 +174,10 @@ module.exports = function (app) {
         retryMinMs: s.retryMinMs || SYNC_TUNING.retryMinMs,
         retryMaxMs: s.retryMaxMs || SYNC_TUNING.retryMaxMs
       }
+      if (isLoopbackUrl(syncOpts.influxUrl)) {
+        syncWarning = `sync: ⚠ writing to ${syncOpts.influxUrl} — telemetry is NOT reaching the cloud`
+        ;(app.error || console.error)(`[sailkick-boat] sync target ${syncOpts.influxUrl} is a local address — telemetry will not reach the cloud`)
+      }
       try { sync = createSync(app, syncOpts); sync.start() } catch (e) {
         (app.error || console.error)('[sailkick-boat] sync start failed: ' + e.message)
         sync = null
@@ -255,6 +269,7 @@ module.exports = function (app) {
     if (!app.setPluginStatus) return
     const parts = []
     if (accountStatus) parts.push(accountStatus)
+    if (syncWarning) parts.push(syncWarning)
     if (sync) parts.push(sync.status())
     if (proxy) parts.push(proxy.status())
     if (telemetry) parts.push(telemetry.status())
@@ -274,6 +289,7 @@ module.exports = function (app) {
     history = null
     proxy = null
     accountStatus = null
+    syncWarning = null
   }
 
   // Mounted by Signal K at /plugins/sailkick-boat. Handlers dispatch to the live

package/lib/account/index.js

@@ -1,113 +1,87 @@
 'use strict'
 
-// Sailkick account pairing — ONE TIME, then cached forever.
+// Sailkick account config — a pure local resolver, no network.
 //
-// The owner enters an invite code + boat name + password once. The plugin POSTs them to
-// the app's /api/auth/signup, which provisions the boat's InfluxDB bucket + write token
-// and returns an `ingest` bundle. That bundle is cached (0600) in the plugin data dir
-// and reused on every subsequent start.
+// Registration happens in the web app: the user redeems an invite there, and the
+// signup screen shows the boat's ingest credentials once (see the app's
+// public/ui/login-overlay.js). They paste the write token into this plugin, and that
+// is the whole handshake. The plugin deliberately does NOT sign up on its own —
+// one registration path means no half-created accounts and no spent-invite dead ends.
 //
-// Cache-first is NOT an optimisation here, it is correctness: signup consumes a
-// single-use invite and creates the account, so calling it twice returns 403
-// bad-invite / 409 slug-taken. The cached bundle is the only repeatable path —
-// /auth/login issues a session cookie but no token, and the app never persists the
-// write token, so there is nothing to re-fetch.
+// Everything else about the bundle is derivable, so only two fields are asked for:
+//   bucket = "<slug>_raw"   (the app's convention — server/auth/registry.js bucketFor)
+//   org    = "sailkick"     (single org, fleet-wide)
 //
-// Dependency-free; never throws.
+// This bundle deliberately carries NO Influx URL. "Which boat am I" and "where is the
+// cloud" are separate questions, and the second one has a single fleet-wide answer that
+// index.js owns. Letting a pasted or cached value set the host is how telemetry ends up
+// spooling to a loopback address forever while the status line looks healthy — the app's
+// signup screen has been handing out its own internal http://localhost:8086.
+//
+// NB the write token cannot be re-fetched: the app shows it once at signup and never
+// stores it (registry.js keeps only passwordHash + influxReadToken). Losing it means
+// minting a new one, so the pasted value is the source of truth here.
 
 const fs = require('fs')
 const path = require('path')
 
-// Terminal = re-running with the same input can only fail the same way; the owner has
-// to change something (new invite, different boat name, longer password).
-const TERMINAL_CODES = new Set(['bad-invite', 'slug-taken', 'bad-slug', 'weak-password'])
+const DEFAULT_ORG = 'sailkick'
 
 function cacheFileFor (app) {
   const dataDir = (app.getDataDirPath && app.getDataDirPath()) || '.'
   return path.join(dataDir, 'account.json')
 }
 
+// Legacy/manual escape hatch: a hand-written (or pre-0.14.2) account.json still works,
+// so an install that was set up before the token field existed keeps syncing. Any
+// influxUrl in such a file is dropped — those were copied off the signup screen, which
+// was showing the server's own loopback address.
 function readCache (file) {
   try {
     const j = JSON.parse(fs.readFileSync(file, 'utf8'))
-    return (j && j.writeToken) ? j : null
+    if (!j || !j.writeToken) return null
+    const { influxUrl, ...rest } = j
+    return rest
   } catch { return null }
 }
 
-function writeCache (file, bundle) {
-  try {
-    fs.mkdirSync(path.dirname(file), { recursive: true })
-    const tmp = `${file}.tmp-${process.pid}`
-    fs.writeFileSync(tmp, JSON.stringify(bundle), { mode: 0o600 })
-    fs.renameSync(tmp, file)
-  } catch {}
-}
-
-// True when we could pair right now (nothing cached yet, but all three fields present).
-function pairable (account) {
-  return !!(account && account.invite && account.slug && account.password)
-}
+const clean = (v) => String(v == null ? '' : v).trim()
 
 // Returns one of:
-//   { bundle, source: 'cache' }             already paired — no network call was made
-//   { bundle, source: 'paired' }            just provisioned; bundle now cached
-//   { bundle: null, source: null }          not configured (nothing to do)
-//   { bundle: null, source: null, error, terminal }   pairing attempted and failed
+//   { bundle, source: 'config' }   token pasted into the plugin config
+//   { bundle, source: 'cache' }    from a hand-written/legacy account.json
+//   { bundle: null, source: null, error? }
 //
-// bundle = { slug, influxUrl, org, bucket, writeToken }
-async function resolveAccountConfig (app, account, opts = {}) {
-  const file = cacheFileFor(app)
-
-  const cached = readCache(file)
-  if (cached) return { bundle: cached, source: 'cache' } // paired already — never call signup again
-
-  if (!pairable(account)) return { bundle: null, source: null }
-
-  const appUrl = String(opts.appUrl || '').replace(/\/+$/, '')
-  const url = appUrl + '/api/auth/signup'
-  const slug = String(account.slug).trim().toLowerCase()
-
-  let resp
-  try {
-    resp = await fetch(url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ invite: account.invite, slug, password: account.password, name: slug }),
-      signal: AbortSignal.timeout(opts.timeoutMs || 20000)
-    })
-  } catch (e) {
-    return { bundle: null, source: null, error: `cannot reach ${appUrl} (${e.message})`, terminal: false }
+// bundle = { slug, org, bucket, writeToken } — no influxUrl by design, see above.
+function resolveAccountConfig (app, account) {
+  const acct = account || {}
+  const slug = clean(acct.slug).toLowerCase()
+  const writeToken = clean(acct.writeToken)
+
+  if (slug && writeToken) {
+    return {
+      source: 'config',
+      bundle: {
+        slug,
+        org: clean(acct.org) || DEFAULT_ORG,
+        bucket: clean(acct.bucket) || `${slug}_raw`,
+        writeToken
+      }
+    }
   }
 
-  const j = await resp.json().catch(() => null)
-
-  if (!resp.ok || !j || j.ok === false) {
-    const code = (j && j.code) || `http-${resp.status}`
-    const message = (j && j.message) || `HTTP ${resp.status}`
-    return { bundle: null, source: null, error: `${message} (${code})`, terminal: TERMINAL_CODES.has(code) }
-  }
+  const cached = readCache(cacheFileFor(app))
+  if (cached) return { bundle: cached, source: 'cache' }
 
-  const ingest = j.ingest || {}
-  if (!ingest.writeToken) {
-    return { bundle: null, source: null, error: 'signup returned no write token', terminal: false }
-  }
-
-  // NB: signup returns no readToken (the app keeps it in its own registry), so local
-  // history falls back to the DB-less ring unless a read token is set by hand.
-  const bundle = {
-    slug: (j.boat && j.boat.slug) || slug,
-    influxUrl: ingest.url,
-    org: ingest.org,
-    bucket: ingest.bucket,
-    writeToken: ingest.writeToken
-  }
-  writeCache(file, bundle)
-  return { bundle, source: 'paired' }
+  // Half-filled: say which half, so the status line is actionable.
+  if (writeToken) return { bundle: null, source: null, error: 'boat name is missing' }
+  if (slug) return { bundle: null, source: null, error: 'write token is missing' }
+  return { bundle: null, source: null }
 }
 
-// True when the plugin either holds a bundle or has enough input to obtain one.
+// True when sync has credentials to work with.
 function accountConfigured (app, account) {
-  return !!readCache(cacheFileFor(app)) || pairable(account)
+  return !!resolveAccountConfig(app, account).bundle
 }
 
-module.exports = { resolveAccountConfig, accountConfigured, cacheFileFor }
+module.exports = { resolveAccountConfig, accountConfigured, cacheFileFor, DEFAULT_ORG }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sailkick-boat",
-  "version": "0.14.1",
-  "description": "EARLY ALPHA — cloud telemetry + offline maps for sailkick boats (www.sailkick.io; pairing is invite-only). Gapless boat→cloud telemetry sync to InfluxDB, and a local proxy that keeps the sailkick app and its charts/maps working fully offline on board.",
+  "version": "0.14.3",
+  "description": "EARLY ALPHA — cloud telemetry + offline maps for sailkick boats (www.sailkick.io; register on the web, paste the write token). Gapless boat→cloud telemetry sync to InfluxDB, and a local proxy that keeps the sailkick app and its charts/maps working fully offline on board.",
   "main": "index.js",
   "scripts": {
     "test": "node --test"