signalk-siparu 0.2.2 → 0.2.3

package/README.md

@@ -47,16 +47,24 @@ generator tab. The same gauges are also served over the API (`GET /live`,
 
 Signal K ships with security switched off, and nothing in the setup makes you turn
 it on. With it off, every plugin's HTTP surface is open to anyone who can reach
-your boat's network, this one included: the pairing endpoints below answer whoever
-asks, so anyone on the network could pair their own screen to her. (The relay
-credential itself is out of reach: it lives in a mode-600 file under the plugin's
-data directory, not in the config.)
-
-Little of that is peculiar to Siparu. On an unsecured server `GET /skServer/plugins`
-already discloses every plugin's configuration and the App Store will install code.
-What is peculiar to Siparu is the consequence: someone on the same marina wifi can
-link your boat to **their** account, and your own screen will go on saying "paired"
-while they watch her.
+your boat's network, this one included. (The relay credential itself is out of
+reach: it lives in a mode-600 file under the plugin's data directory, not in the
+config. The relay address is not a plugin option at all - it comes from the
+server process's environment, so nothing that writes plugin options can redirect
+the boat.)
+
+Because of that, the plugin locks its own writes while security is off: pairing,
+unpairing and log edits refuse until you either add an admin user in Signal K or
+tick "Allow pairing and log edits while Signal K security is off" in the plugin
+settings. The tick exists for installs that cannot easily turn security on; it is
+an acceptance of the risk, not a removal of it.
+
+The lock cannot make an unsecured server safe. On such a server
+`GET /skServer/plugins` already discloses every plugin's configuration, the
+server's own config route can change any plugin's settings - including that very
+tick - and the App Store will install code. The consequence peculiar to Siparu is
+what a stranger on the marina wifi could do with an open door: link your boat to
+**their** account while your own screen goes on saying "paired".
 
 So before you pair, add an admin user in Signal K (Security > Users). It takes a
 minute and it is the difference between a boat you share and a boat you leak.
@@ -148,20 +156,10 @@ that sends a position in the clear, because a boat whose privacy depends on the
 state of a list held elsewhere does not have any.
 
 Once a device is named, the report is encrypted to it and the relay carries a
-block it cannot read. Three things stay legible beside it, and they are worth
-stating plainly because they are what a carrier can see:
-
-- Her identifier and the time she sent the frame, so it can be routed at all.
-- How loud she is: `normal`, `warning` or `alarm`, and nothing about what is
-  wrong. A carrier has to know a notification is due, and this field is inside
-  her signature so that it cannot decide one is not.
-- When the newest audible condition began, as a moment in time. Without it a
-  second alarm raised while a first one stands is indistinguishable from the
-  first one still standing, and the second would never be announced. It says
-  that an event is a different event; what the event is stays encrypted.
-
-Taken together, a carrier can see that something is wrong aboard, roughly how
-serious, and when each one started. It cannot see what any of them is.
+block it cannot read. Two things stay legible beside it, and they are worth
+stating plainly because they are what a carrier can see: her identifier and
+the time she sent the frame, so it can be routed at all. Both are inside her
+signature, so neither can be rewritten in transit.
 
 Voyage detection opens after sustained movement, closes after sustained
 stillness, and folds short docking manoeuvres into the preceding voyage. Its

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "signalk-siparu",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Kept aboard, proven ashore. An impartial, timestamped record of every voyage: position, wind, depth and logbook, written on the boat and readable from anywhere. A read-only Signal K plugin with a built-in dashboard.",
   "keywords": [
     "signalk-node-server-plugin",

package/plugin/dist/anchor.d.ts

@@ -0,0 +1,11 @@
+import type { DeviceAnchor } from './approval';
+export declare class AnchorStore {
+    private readonly file;
+    private writeChain;
+    constructor(dataDir: string);
+    load(boatId: string | undefined, pairedAt: string | undefined): DeviceAnchor | null | 'broken';
+    set(boatId: string, pairedAt: string, anchor: DeviceAnchor): Promise<void>;
+    clear(): Promise<void>;
+    flush(): Promise<void>;
+    private write;
+}

package/plugin/dist/anchor.js

@@ -0,0 +1,103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AnchorStore = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const FILE_VERSION = 1;
+const PUB_SHAPE = /^[A-Za-z0-9_-]{43}$/;
+class AnchorStore {
+    file;
+    writeChain = Promise.resolve();
+    constructor(dataDir) {
+        this.file = path.join(dataDir, 'anchor.json');
+    }
+    load(boatId, pairedAt) {
+        let text;
+        try {
+            text = fs.readFileSync(this.file, 'utf8');
+        }
+        catch (e) {
+            return e?.code === 'ENOENT' ? null : 'broken';
+        }
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            return 'broken';
+        }
+        if (raw.v !== FILE_VERSION ||
+            typeof raw.boat !== 'string' ||
+            typeof raw.paired_at !== 'string' ||
+            typeof raw.kid !== 'string' ||
+            raw.kid.length === 0 ||
+            typeof raw.pub !== 'string' ||
+            !PUB_SHAPE.test(raw.pub)) {
+            return 'broken';
+        }
+        if (!boatId || raw.boat !== boatId)
+            return null;
+        if (!pairedAt || raw.paired_at !== pairedAt)
+            return null;
+        return { kid: raw.kid, pub: raw.pub };
+    }
+    set(boatId, pairedAt, anchor) {
+        return this.write(async () => {
+            const tmp = `${this.file}.tmp`;
+            const shape = {
+                v: FILE_VERSION,
+                boat: boatId,
+                paired_at: pairedAt,
+                kid: anchor.kid,
+                pub: anchor.pub
+            };
+            await fs.promises.writeFile(tmp, JSON.stringify(shape, null, 2), { mode: 0o600 });
+            await fs.promises.chmod(tmp, 0o600);
+            await fs.promises.rename(tmp, this.file);
+        });
+    }
+    clear() {
+        return this.write(() => fs.promises.rm(this.file, { force: true }));
+    }
+    flush() {
+        return this.writeChain.catch(() => undefined);
+    }
+    write(run) {
+        this.writeChain = this.writeChain.then(run, run);
+        return this.writeChain;
+    }
+}
+exports.AnchorStore = AnchorStore;

package/plugin/dist/approval.d.ts

@@ -0,0 +1,40 @@
+import { type KeyObject } from 'crypto';
+import type { DevicePublicKey } from './contract';
+export declare const MAC_BYTES = 32;
+export interface DeviceAnchor {
+    kid: string;
+    pub: string;
+}
+export declare function approvalInput(boat: string, approverKid: string, subjectKid: string, subjectPub: Buffer): Buffer;
+export declare function computeApproval(opts: {
+    approverPriv: KeyObject;
+    inboxPub: Buffer;
+    boat: string;
+    approverKid: string;
+    subjectKid: string;
+    subjectPub: Buffer;
+}): Buffer;
+export declare function verifyApproval(opts: {
+    inboxPriv: KeyObject;
+    approverPub: Buffer;
+    boat: string;
+    approverKid: string;
+    subjectKid: string;
+    subjectPub: Buffer;
+    mac: Buffer;
+}): boolean;
+export interface SkippedDevice {
+    kid: string;
+    reason: string;
+}
+export interface AcceptResult {
+    accepted: DevicePublicKey[];
+    skipped: SkippedDevice[];
+    pinned: boolean;
+}
+export declare function acceptDevices(opts: {
+    anchor: DeviceAnchor | null | 'broken';
+    entries: DevicePublicKey[];
+    inboxPriv: KeyObject | undefined;
+    boat: string | undefined;
+}): AcceptResult;

package/plugin/dist/approval.js

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAC_BYTES = void 0;
+exports.approvalInput = approvalInput;
+exports.computeApproval = computeApproval;
+exports.verifyApproval = verifyApproval;
+exports.acceptDevices = acceptDevices;
+const crypto_1 = require("crypto");
+const sealing_1 = require("./sealing");
+const LABEL = 'siparu/device-approval/v1';
+const APPROVAL_VERSION = 1;
+const KEY_BYTES = 32;
+exports.MAC_BYTES = 32;
+function approvalInput(boat, approverKid, subjectKid, subjectPub) {
+    return Buffer.concat([
+        Buffer.from(LABEL, 'utf8'),
+        (0, sealing_1.u16be)(APPROVAL_VERSION),
+        (0, sealing_1.lp)(Buffer.from(boat, 'utf8')),
+        (0, sealing_1.lp)(Buffer.from(approverKid, 'utf8')),
+        (0, sealing_1.lp)(Buffer.from(subjectKid, 'utf8')),
+        (0, sealing_1.lp)(subjectPub)
+    ]);
+}
+function approvalKey(shared, approverPub, boat, approverKid, subjectKid) {
+    const info = `${LABEL}/${boat}/${approverKid}/${subjectKid}`;
+    return Buffer.from((0, crypto_1.hkdfSync)('sha256', shared, approverPub, info, KEY_BYTES));
+}
+function computeApproval(opts) {
+    const shared = (0, crypto_1.diffieHellman)({
+        privateKey: opts.approverPriv,
+        publicKey: (0, sealing_1.x25519PublicFromRaw)(opts.inboxPub)
+    });
+    const approverPub = (0, sealing_1.publicFromPrivate)(opts.approverPriv);
+    const key = approvalKey(shared, approverPub, opts.boat, opts.approverKid, opts.subjectKid);
+    return (0, crypto_1.createHmac)('sha256', key)
+        .update(approvalInput(opts.boat, opts.approverKid, opts.subjectKid, opts.subjectPub))
+        .digest();
+}
+function verifyApproval(opts) {
+    if (opts.mac.length !== exports.MAC_BYTES)
+        return false;
+    let expected;
+    try {
+        const shared = (0, crypto_1.diffieHellman)({
+            privateKey: opts.inboxPriv,
+            publicKey: (0, sealing_1.x25519PublicFromRaw)(opts.approverPub)
+        });
+        const key = approvalKey(shared, opts.approverPub, opts.boat, opts.approverKid, opts.subjectKid);
+        expected = (0, crypto_1.createHmac)('sha256', key)
+            .update(approvalInput(opts.boat, opts.approverKid, opts.subjectKid, opts.subjectPub))
+            .digest();
+    }
+    catch {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(expected, opts.mac);
+}
+function acceptDevices(opts) {
+    const { anchor, entries, inboxPriv, boat } = opts;
+    if (anchor === null) {
+        return { accepted: [...entries], skipped: [], pinned: false };
+    }
+    const skipped = [];
+    if (anchor === 'broken' || !boat) {
+        return {
+            accepted: [],
+            skipped: entries.map((e) => ({
+                kid: e.kid,
+                reason: anchor === 'broken'
+                    ? 'the anchor on disk cannot be read; re-pair to pin the screens again'
+                    : 'the boat is not paired'
+            })),
+            pinned: true
+        };
+    }
+    const trusted = new Map();
+    const anchorPub = decodePub(anchor.pub);
+    if (anchorPub)
+        trusted.set(anchor.kid, anchorPub);
+    const accepted = [];
+    const pending = new Map();
+    for (const entry of entries) {
+        if (entry.kid === anchor.kid) {
+            const entryPub = decodePub(entry.pub);
+            if (anchorPub && entryPub?.equals(anchorPub)) {
+                accepted.push(entry);
+            }
+            else {
+                skipped.push({
+                    kid: entry.kid,
+                    reason: 'carries the anchor id over a different key'
+                });
+            }
+            continue;
+        }
+        pending.set(entry, '');
+    }
+    let grew = true;
+    while (grew) {
+        grew = false;
+        for (const [entry] of pending) {
+            const verdict = admissible(entry, trusted, inboxPriv, boat);
+            if (verdict === true) {
+                accepted.push(entry);
+                const pub = decodePub(entry.pub);
+                if (pub)
+                    trusted.set(entry.kid, pub);
+                pending.delete(entry);
+                grew = true;
+            }
+            else {
+                pending.set(entry, verdict);
+            }
+        }
+    }
+    for (const [entry, reason] of pending) {
+        skipped.push({ kid: entry.kid, reason });
+    }
+    return { accepted, skipped, pinned: true };
+}
+function admissible(entry, trusted, inboxPriv, boat) {
+    const approvals = entry.approvals ?? [];
+    if (approvals.length === 0) {
+        return 'carries no approval from a device this boat trusts';
+    }
+    if (!inboxPriv) {
+        return 'the boat holds no inbox key yet to verify the approval with';
+    }
+    const subjectPub = decodePub(entry.pub);
+    const refusals = [];
+    for (const { by, mac } of approvals) {
+        const approverPub = trusted.get(by);
+        if (!approverPub) {
+            refusals.push({ rank: 2, text: `approved by "${by}", which this boat does not trust` });
+            continue;
+        }
+        const raw = decodeMac(mac);
+        if (!subjectPub || !raw) {
+            refusals.push({ rank: 1, text: 'the approval is malformed' });
+            continue;
+        }
+        const ok = verifyApproval({
+            inboxPriv,
+            approverPub,
+            boat,
+            approverKid: by,
+            subjectKid: entry.kid,
+            subjectPub,
+            mac: raw
+        });
+        if (ok)
+            return true;
+        refusals.push({ rank: 0, text: 'the approval does not verify' });
+    }
+    return worst(refusals);
+}
+function worst(refusals) {
+    const first = refusals.reduce((best, r) => (r.rank < best.rank ? r : best));
+    return refusals.length === 1
+        ? first.text
+        : `${first.text} (${refusals.length} approvals, none accepted)`;
+}
+function decodePub(pub) {
+    const raw = Buffer.from(pub, 'base64url');
+    return raw.length === 32 ? raw : null;
+}
+function decodeMac(mac) {
+    const raw = Buffer.from(mac, 'base64url');
+    return raw.length === exports.MAC_BYTES ? raw : null;
+}

package/plugin/dist/config-routes.d.ts

@@ -2,6 +2,7 @@ import type { ServerAPI } from '@signalk/server-api';
 import type { IRouter } from 'express';
 interface ConfigDeps {
     app: ServerAPI;
+    acceptOpenNetwork: () => boolean;
     getConfig: () => object;
     fuelPathsView: () => {
         available: string[];

package/plugin/dist/config-routes.js

@@ -40,12 +40,18 @@ function readJsonBody(req) {
     });
 }
 function registerConfigRoutes(router, deps) {
-    const { app, getConfig, fuelPathsView, restart } = deps;
+    const { app, acceptOpenNetwork, getConfig, fuelPathsView, restart } = deps;
     router.get('/config/fuel-paths', (_req, res) => {
         res.json(fuelPathsView());
     });
     router.post('/config/fuel-paths', (0, origin_guard_1.sameOrigin)((req, res) => {
-        if (!(0, pairing_1.securityOff)(app, req) && !allowConfigure(app, req)) {
+        if ((0, pairing_1.securityOff)(app, req)) {
+            if ((0, pairing_1.writeLocked)(app, req, acceptOpenNetwork())) {
+                res.status(403).json({ error: 'security_off', message: pairing_1.WRITE_LOCKED_MESSAGE });
+                return;
+            }
+        }
+        else if (!allowConfigure(app, req)) {
             res.status(403).json({ error: 'admin_required' });
             return;
         }

package/plugin/dist/config.d.ts

@@ -21,10 +21,10 @@ export interface Options {
     maxStorageMB: number;
     chartsRemoteUrl: string;
     chartsBasemapUrl: string;
-    relayUrl: string;
     ports: PortEntry[];
     voyage: VoyageOptions;
     fuelRatePaths: string[];
+    acceptOpenNetwork: boolean;
 }
 export declare const DEFAULTS: Options;
 export declare const INTERNAL: {
@@ -37,6 +37,7 @@ export declare const INTERNAL: {
 export declare const KN_TO_MS = 0.514444;
 export declare function isCalendarMonthDay(s: string): boolean;
 export declare function safeRelayUrl(raw: unknown): string | undefined;
+export declare const RELAY_URL: string;
 export declare function resolveOptions(raw: unknown): Options;
 export declare const CONFIG_SCHEMA: {
     type: string;
@@ -165,6 +166,12 @@ export declare const CONFIG_SCHEMA: {
                 };
             };
         };
+        acceptOpenNetwork: {
+            type: string;
+            title: string;
+            description: string;
+            default: boolean;
+        };
         fuelRatePaths: {
             type: string;
             title: string;

package/plugin/dist/config.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONFIG_SCHEMA = exports.KN_TO_MS = exports.INTERNAL = exports.DEFAULTS = void 0;
+exports.CONFIG_SCHEMA = exports.RELAY_URL = exports.KN_TO_MS = exports.INTERNAL = exports.DEFAULTS = void 0;
 exports.isCalendarMonthDay = isCalendarMonthDay;
 exports.safeRelayUrl = safeRelayUrl;
 exports.resolveOptions = resolveOptions;
@@ -12,7 +12,6 @@ exports.DEFAULTS = {
     maxStorageMB: 500,
     chartsRemoteUrl: 'https://tiles.siparu.app',
     chartsBasemapUrl: 'https://tiles.openfreemap.org/planet',
-    relayUrl: 'https://relay.siparu.app',
     ports: [],
     voyage: {
         openKnots: 1.5,
@@ -23,7 +22,8 @@ exports.DEFAULTS = {
         mergeShortNm: 1.0,
         phaseMinMinutes: 10
     },
-    fuelRatePaths: []
+    fuelRatePaths: [],
+    acceptOpenNetwork: false
 };
 exports.INTERNAL = {
     samplePeriodMs: 2000,
@@ -49,6 +49,7 @@ function safeRelayUrl(raw) {
         return undefined;
     return raw.replace(/\/+$/, '');
 }
+exports.RELAY_URL = safeRelayUrl(process.env.SIPARU_RELAY_URL) ?? 'https://relay.siparu.app';
 function resolveOptions(raw) {
     const c = (raw ?? {});
     const v = (c.voyage ?? {});
@@ -65,7 +66,6 @@ function resolveOptions(raw) {
         chartsBasemapUrl: /^https?:\/\/\S+$/.test(c.chartsBasemapUrl ?? '')
             ? c.chartsBasemapUrl.replace(/\/+$/, '')
             : exports.DEFAULTS.chartsBasemapUrl,
-        relayUrl: safeRelayUrl(c.relayUrl) ?? exports.DEFAULTS.relayUrl,
         ports: Array.isArray(c.ports)
             ? c.ports
                 .filter((p) => !!p &&
@@ -89,7 +89,8 @@ function resolveOptions(raw) {
         },
         fuelRatePaths: Array.isArray(c.fuelRatePaths)
             ? c.fuelRatePaths.filter((p) => typeof p === 'string' && p.trim().length > 0).map((p) => p.trim())
-            : exports.DEFAULTS.fuelRatePaths
+            : exports.DEFAULTS.fuelRatePaths,
+        acceptOpenNetwork: c.acceptOpenNetwork === true
     };
 }
 exports.CONFIG_SCHEMA = {
@@ -206,6 +207,12 @@ exports.CONFIG_SCHEMA = {
                 }
             }
         },
+        acceptOpenNetwork: {
+            type: 'boolean',
+            title: 'Allow pairing and log edits while Signal K security is off',
+            description: 'With Signal K security off, anyone on the boat\'s network can pair this boat to their own account, unpair her or edit her log, so Siparu refuses all three until you answer for it here. It cannot protect this page: the server writes these settings itself, and on an unsecured server anyone can change them, this tick included. The real fix is an admin user in Signal K (Security > Users). Tick this only on a network you trust.',
+            default: exports.DEFAULTS.acceptOpenNetwork
+        },
         fuelRatePaths: {
             type: 'array',
             title: 'Fuel consumption source (advanced)',

package/plugin/dist/contract.d.ts

@@ -1,3 +1,4 @@
+export type DepthDatum = 'belowTransducer' | 'belowKeel' | 'belowSurface';
 export interface Snapshot {
     ts: number;
     lat: number | null;
@@ -18,6 +19,7 @@ export interface Snapshot {
     air_temp_k: number | null;
     air_pressure_pa: number | null;
     depth: number | null;
+    depth_datum?: DepthDatum | null;
     water_temp_k: number | null;
     gps_satellites: number | null;
     ais_class: string | null;
@@ -221,6 +223,15 @@ export interface HealthResult {
         mode: 'sealed' | 'blocked' | 'none';
         reason: string | null;
         screens: string[];
+        screens_pinned: boolean;
+        screens_skipped: {
+            kid: string;
+            reason: string;
+        }[];
+        screens_rejected: {
+            kid: string;
+            reason: string;
+        }[];
     };
 }
 export type PhaseKind = 'underway' | 'anchored' | 'moored' | 'stopped';
@@ -323,73 +334,16 @@ export interface SealedFrame {
     sig: string;
     [extension: string]: unknown;
 }
-export type AlertLevel = 'normal' | 'warning' | 'alarm';
-export interface StandingCondition {
-    path: string;
-    state: Exclude<AlertLevel, 'normal'>;
-    message: string | null;
-    since: number;
-}
-export interface AlertNote {
-    path: string;
-    state: Exclude<AlertLevel, 'normal'>;
-    message: string | null;
-    since: number;
-}
-export type AlertRing = 'warning' | 'alarm' | 'never';
-export interface AlertRule {
-    path: string;
-    ring_from: AlertRing;
-}
-export interface SetAlertRulesRequest {
-    type: 'setalertrules';
-    v: number;
-    id: string;
-    kid: string;
-    ts: number;
-    rules: AlertRule[];
-    proof: string;
-}
-export interface AlertRulesResult {
-    rules: AlertRule[];
-    ts: number;
-}
-export type SetAlertRulesResponse = {
-    type: 'setalertrules';
-    id: string;
-    result: AlertRulesResult;
-} | {
-    type: 'setalertrules';
-    id: string;
-    error: {
-        code: string;
-        message: string;
-    };
-};
-export interface AlertRulesRequest {
-    type: 'alertrules';
-    id: string;
-}
-export interface AlertRulesReadResult extends AlertRulesResult {
-    known: string[];
-}
-export type AlertRulesResponse = {
-    type: 'alertrules';
-    id: string;
-    result: AlertRulesReadResult;
-} | {
-    type: 'alertrules';
-    id: string;
-    error: {
-        code: string;
-        message: string;
-    };
-};
 export interface BoatPublicKeys {
     identity: string;
     inbox: string;
 }
+export interface DeviceApproval {
+    by: string;
+    mac: string;
+}
 export interface DevicePublicKey {
     kid: string;
     pub: string;
+    approvals?: DeviceApproval[];
 }