Initial commit

src/function/parent/can-recover-password.ts

@@ -0,0 +1,37 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Database } from '../../database'
+import { requireMailByAuthToken } from '../authentication'
+
+export const canRecoverPassword = async ({ database, mailAuthToken, parentUserId }: {
+  database: Database
+  mailAuthToken: string
+  parentUserId: string
+}) => {
+  const mail = await requireMailByAuthToken({ mailAuthToken, database })
+
+  const entry = await database.user.findOne({
+    where: {
+      mail,
+      userId: parentUserId,
+      type: 'parent'
+    }
+  })
+
+  return !!entry
+}

src/function/parent/create-add-device-token.ts

@@ -0,0 +1,43 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Database } from '../../database'
+import { randomWords } from '../../util/random-words'
+import { generateIdWithinFamily } from '../../util/token'
+
+export const createAddDeviceToken = async ({ familyId, database }: {
+  familyId: string
+  database: Database
+}) => {
+  const token = randomWords(5)
+  const deviceId = generateIdWithinFamily()
+
+  await database.addDeviceToken.destroy({
+    where: {
+      familyId
+    }
+  })
+
+  await database.addDeviceToken.create({
+    familyId,
+    token: token.toLowerCase(),
+    deviceId,
+    createdAt: Date.now().toString()
+  })
+
+  return { token, deviceId }
+}

src/function/parent/create-family.ts

@@ -0,0 +1,102 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Conflict } from 'http-errors'
+import { NewDeviceInfo, ParentPassword } from '../../api/schema'
+import { Database } from '../../database'
+import {
+  generateAuthToken, generateFamilyId, generateIdWithinFamily, generateVersionId
+} from '../../util/token'
+import { requireMailByAuthToken } from '../authentication'
+import { prepareDeviceEntry } from '../device/prepare-device-entry'
+
+export const createFamily = async ({ database, mailAuthToken, firstParentDevice, password, timeZone, parentName, deviceName }: {
+  database: Database,
+  mailAuthToken: string,
+  firstParentDevice: NewDeviceInfo,
+  password: ParentPassword,
+  timeZone: string,
+  parentName: string,
+  deviceName: string
+}) => {
+  const now = Date.now().toString(10)
+  const mail = await requireMailByAuthToken({ database, mailAuthToken })
+
+  return database.transaction(async (transaction) => {
+    // ensure that no family was created for this mail yet
+    const exisitngUserEntry = await database.user.findOne({
+      where: {
+        mail
+      },
+      transaction
+    })
+
+    if (exisitngUserEntry) {
+      throw new Conflict()
+    }
+
+    const familyId = generateFamilyId()
+    const userId = generateIdWithinFamily()
+    const deviceId = generateIdWithinFamily()
+    const deviceAuthToken = generateAuthToken()
+
+    // create family
+    await database.family.create({
+      familyId,
+      name: '',
+      createdAt: now,
+      userListVersion: generateVersionId(),
+      deviceListVersion: generateVersionId(),
+      // 14 days demo version
+      fullVersionUntil: (Date.now() + 1000 * 60 * 60 * 24 * 14).toString(10),
+      hasFullVersion: true
+    }, { transaction })
+
+    // create parent user
+    await database.user.create({
+      familyId,
+      userId,
+      name: parentName,
+      passwordHash: password.hash,
+      secondPasswordHash: password.secondHash,
+      secondPasswordSalt: password.secondSalt,
+      type: 'parent',
+      mail,
+      timeZone,
+      disableTimelimitsUntil: '0',
+      currentDevice: '',
+      categoryForNotAssignedApps: '',
+      relaxPrimaryDeviceRule: false,
+      mailNotificationFlags: 1  // enable warning notifications
+    }, { transaction })
+
+    // add parent device
+    await database.device.create(prepareDeviceEntry({
+      familyId,
+      deviceId,
+      deviceName,
+      newDeviceInfo: firstParentDevice,
+      userId,
+      deviceAuthToken
+    }), { transaction })
+
+    return {
+      deviceAuthToken,
+      deviceId
+    }
+  })
+}

src/function/parent/get-status-by-mail-address.ts

@@ -0,0 +1,44 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Database } from '../../database'
+import { requireMailByAuthToken } from '../authentication'
+
+const getStatusByMailAddress = async ({ mail, database }: {mail: string, database: Database}) => {
+  if (!mail) {
+    throw new Error('no mail address')
+  }
+
+  const entry = await database.user.findOne({
+    where: {
+      mail
+    }
+  })
+
+  if (entry) {
+    return 'with family'
+  } else {
+    return 'without family'
+  }
+}
+
+export const getStatusByMailToken = async ({ mailAuthToken, database }: {mailAuthToken: string, database: Database}) => {
+  const mail = await requireMailByAuthToken({ mailAuthToken, database })
+  const status = await getStatusByMailAddress({ mail, database })
+
+  return { mail, status }
+}

src/function/parent/link-mail-address.ts

@@ -0,0 +1,107 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Conflict, Unauthorized } from 'http-errors'
+import * as Sequelize from 'sequelize'
+import { Database } from '../../database'
+import { generateVersionId } from '../../util/token'
+import { WebsocketApi } from '../../websocket'
+import { requireMailByAuthToken } from '../authentication'
+import { notifyClientsAboutChanges } from '../websocket'
+
+export const linkMailAddress = async ({ mailAuthToken, deviceAuthToken, parentUserId, parentPasswordSecondHash, database, websocket }: {
+  mailAuthToken: string
+  deviceAuthToken: string
+  parentUserId: string
+  parentPasswordSecondHash: string
+  database: Database
+  websocket: WebsocketApi
+}) => {
+  const deviceEntry = await database.device.findOne({
+    where: {
+      deviceAuthToken
+    }
+  })
+
+  if (!deviceEntry) {
+    throw new Unauthorized()
+  }
+
+  const familyId = deviceEntry.familyId
+
+  const mailAddress = await requireMailByAuthToken({ mailAuthToken, database })
+
+  const exisitingUser = await database.user.findOne({
+    where: {
+      mail: mailAddress
+    }
+  })
+
+  if (exisitingUser) {
+    throw new Conflict()
+  }
+
+  await database.transaction(async (transaction) => {
+    const parentEntry = await database.user.findOne({
+      where: {
+        type: 'parent',
+        familyId,
+        userId: parentUserId
+      },
+      transaction,
+      lock: Sequelize.Transaction.LOCK.UPDATE
+    })
+
+    if (!parentEntry) {
+      throw new Conflict()
+    }
+
+    if (parentEntry.mail !== '') {
+      throw new Conflict()
+    }
+
+    if (parentEntry.secondPasswordHash !== parentPasswordSecondHash) {
+      throw new Conflict()
+    }
+
+    if (!parentEntry.secondPasswordSalt) {
+      throw new Conflict()
+    }
+
+    parentEntry.mail = mailAddress
+
+    await parentEntry.save({ transaction })
+
+    // invalidiate client caches
+    await database.family.update({
+      userListVersion: generateVersionId()
+    }, {
+      where: {
+        familyId
+      },
+      transaction
+    })
+  })
+
+  await notifyClientsAboutChanges({
+    familyId,
+    sourceDeviceId: null,
+    database,
+    websocket,
+    isImportant: true
+  })
+}

src/function/parent/recover-parent-password.ts

@@ -0,0 +1,79 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Conflict } from 'http-errors'
+import * as Sequelize from 'sequelize'
+import { ParentPassword } from '../../api/schema'
+import { Database } from '../../database'
+import { generateVersionId } from '../../util/token'
+import { WebsocketApi } from '../../websocket'
+import { requireMailByAuthToken } from '../authentication'
+import { notifyClientsAboutChanges } from '../websocket'
+
+export const recoverParentPassword = async ({ database, websocket, password, mailAuthToken }: {
+  database: Database
+  websocket: WebsocketApi
+  password: ParentPassword
+  mailAuthToken: string
+}) => {
+  const mail = await requireMailByAuthToken({ mailAuthToken, database })
+
+  const { familyId } = await database.transaction(async (transaction) => {
+    // update the user entry
+    const userEntry = await database.user.findOne({
+      where: {
+        mail
+      },
+      transaction,
+      lock: Sequelize.Transaction.LOCK.UPDATE
+    })
+
+    if (!userEntry) {
+      return { familyId: null }
+    }
+
+    userEntry.passwordHash = password.hash
+    userEntry.secondPasswordHash = password.secondHash
+    userEntry.secondPasswordSalt = password.secondSalt
+
+    await userEntry.save({ transaction })
+
+    // invalidate the user list
+    await database.family.update({
+      userListVersion: generateVersionId()
+    }, {
+      where: {
+        familyId: userEntry.familyId
+      },
+      transaction
+    })
+
+    return { familyId: userEntry.familyId }
+  })
+
+  if (familyId === null) {
+    throw new Conflict()
+  }
+
+  await notifyClientsAboutChanges({
+    database,
+    familyId,
+    websocket,
+    isImportant: true,
+    sourceDeviceId: null
+  })
+}

src/function/parent/sign-in-into-family.ts

@@ -0,0 +1,96 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { Conflict } from 'http-errors'
+import { NewDeviceInfo } from '../../api/schema'
+import { Database } from '../../database'
+import { generateAuthToken, generateIdWithinFamily, generateVersionId } from '../../util/token'
+import { WebsocketApi } from '../../websocket'
+import { requireMailByAuthToken } from '../authentication'
+import { prepareDeviceEntry } from '../device/prepare-device-entry'
+import { notifyClientsAboutChanges } from '../websocket'
+
+export const signInIntoFamily = async ({ database, mailAuthToken, newDeviceInfo, deviceName, websocket }: {
+  database: Database
+  mailAuthToken: string
+  newDeviceInfo: NewDeviceInfo
+  deviceName: string
+  websocket: WebsocketApi
+}) => {
+  const mail = await requireMailByAuthToken({ database, mailAuthToken })
+
+  const { response, familyId, sourceDeviceId } = await database.transaction(async (transaction) => {
+    const userEntryUnsafe = await database.user.findOne({
+      where: {
+        mail
+      },
+      attributes: ['familyId', 'userId'],
+      transaction
+    })
+
+    if (!userEntryUnsafe) {
+      throw new Conflict()
+    }
+
+    const userEntry = {
+      familyId: userEntryUnsafe.familyId,
+      userId: userEntryUnsafe.userId,
+      transaction
+    }
+
+    const deviceAuthToken = generateAuthToken()
+    const deviceId = generateIdWithinFamily()
+
+    await database.device.create(prepareDeviceEntry({
+      familyId: userEntry.familyId,
+      deviceId,
+      userId: userEntry.userId,
+      deviceName,
+      deviceAuthToken,
+      newDeviceInfo
+    }), { transaction })
+
+    // notify about changes
+    await database.family.update({
+      deviceListVersion: generateVersionId()
+    }, {
+      where: {
+        familyId: userEntry.familyId
+      },
+      transaction
+    })
+
+    return {
+      response: {
+        deviceId,
+        deviceAuthToken
+      },
+      sourceDeviceId: deviceId,
+      familyId: userEntry.familyId
+    }
+  })
+
+  await notifyClientsAboutChanges({
+    familyId,
+    websocket,
+    database,
+    isImportant: true,
+    sourceDeviceId
+  })
+
+  return response
+}