Update dependencies

Readme.md

@@ -2,219 +2,4 @@
 
 This is the server for the connected mode in TimeLimit.
 
-## Clustering
-
-This application only supports running a single instance of it.
-When clustering, push messages do not work anymore between devices
-connected to different devices and the rate limiting is per instance.
-
-## Running
-
-Option 1: Build (run ``sudo docker build -t timelimit-server .`` in this directory) and use a docker image  
-Option 2: Install Node.JS (see below for detailed usage)
-
-To test it, open ``http://server/time``, it should show a timestamp
-
-## Commands
-
-### npm start
-
-This runs all pending migrations and starts the server.
-
-### npm run build
-
-This "compiles" the application.
-
-### npm run lint:fix
-
-This fixes the causes of lint warnings (where possible).
-
-## Configuration (environment variables)
-
-- DATABASE_URL
-  - this specifies the database to use
-  - default value: ``sqlite://test.db`` (sqlite database in the source code directory)
-  - supports mysql, postgresql and sqlite (sqlite in development builds only because it's declared as dev dependency)
-  - looks like ``postgres://user:pass@example.com:5432/dbname``
-  - no extra setup needed
-      - when starting the application, the database tables are created/ migrated
-        - this only works for upgrading; if you intend to eventually downgrade, make a backup first (you should make backups in all cases before an upgrade)
-- PORT
-  - the port at which the server should listen
-  - default value: 8080
-- NODE_ENV
-  - should be set to ``production`` in production
-  - when using ``development``, then mails are not sent; instead they are written to a html file which is opened
-- GOOGLE_PLAY_PUBLIC_KEY
-  - key for validating purchases
-  - purchases using google play don't work without it/ when it is not set
-- MAIL_SENDER
-  - sender (for the from-field) for sent mails
-- MAIL_TRANSPORT
-  - a JSON encoded configuration for nodemailer
-  - supports setting a smtp server configuration, see <https://nodemailer.com/smtp/>
-  - allows easier configuration in case of a [well known services](https://nodemailer.com/smtp/well-known/)
-  - default value is ``null``
-  - examples
-    - ``{"host": "localhost", "port": 25}`` (using a local mail server which does not require any authentication)
-    - ``{"service": "1und1", "auth": {"user": "me@my.timelimit.server", "pass": "my password"}}`` (using a well known service)
-    - ``{"host": "my.mail.server", "secure": true, "auth": {"user": "me@my.timelimit.server", "pass": "my password"}}`` (using a external smtp server)
-  - in case of a docker-compose file, you should escape this, e.g. sourround it with ``'`` single quotes
-- MAIL_IMPRINT
-  - a string which is added to the footer of the sent mails
-  - default value: ``not defined``
-- ADMIN_TOKEN
-  - a password which allows to use some APIs
-  - admin APIs are disabled when this is not set
-- MAIL_SERVER_BLACKLIST
-  - list of domains, separated by comma
-  - if the user tries to use such a mail service, then he will get the notification that this provider is not supported
-  - the blacklist is empty if this is not set
-- MAIL_WHITELIST
-  - list of mail addresses (``someone@somewhere.com``) or domains (``mailbox.org``), separated by comma
-  - if a user requests signing in with a mail address which is not in this list, then the request is rejected
-  - if the list is empty/ the variable is not set, then any mail address (except with domains from the blacklist) is allowed
-  - note: this allows a third party who knows the server url to check if a certain mail address is allowed by trying to sign in with it
-- DISABLE_SIGNUP
-  - ``yes`` or ``no`` (default: no)
-  - disables creating new families if ``yes`` is selected
-  - the default value is ``no``
-- PING_INTERVAL_SEC
-  - ping interval at the websocket in seconds
-  - the default value is ``25``
-
-## HTTPS
-
-This server application itself does not support HTTPS. You have to use
-an other tool to use HTTPS. One options for this is to use nginx with the
-following site config:
-
-```
-# don't forget to update the port for your local configuration
-#
-# the max_fails is important - otherwise nginx
-# marks the server sometimes as unreachable if it is restarted
-# or starts after nginx
-upstream timelimitbackend {
-  server localhost:8080 max_fails=0;
-}
-
-server {
-  listen 443 ssl;
-  listen [::]:443 ssl;
-
-  # don't forget to update the domain
-  server_name my.domain;
-
-  # don't forget to update the paths
-  ssl_certificate /my/fullchain.pem;
-  ssl_certificate_key /my/privkey.pem;
-
-  # eventually configure the SSL parameters here
-
-  location / {
-    proxy_pass http://timelimitbackend/;
-
-    client_max_body_size 10m;
-    # the following is required for websocket support
-    #
-    # without websockets, the client will not detect
-    # that there is a connection and it will not sync
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-    proxy_http_version 1.1;
-  }
-}
-```
-
-## Admin API
-
-When the ``ADMIN_TOKEN`` environment variable was set, then there is a admin API available
-at ``http(s)://server/admin``. It can be used by the [TimeLimit Server Admin UI](https://codeberg.org/timelimit/timelimit-server-ui).
-
-## Purchases
-
-To enable the automated purchase feature, set the ``GOOGLE_PLAY_PUBLIC_KEY`` environment variable.
-The value for the official builds which are distributed using the Play Store can
-be found at <https://codeberg.org/timelimit/timelimit-android/src/commit/3da677877f4dde0b1b01523daae33745f14e08ac/app/build.gradle#L49>.
-
-Additionally, there is the admin API which allows one to unlock the
-premium features.
-
-## example docker-compose.yml with included database
-
-(don't forget to build the docker image first)
-
-```
-version: '3'
-services:
-  api:
-    image: 'timelimit-server:latest'
-    environment:
-      NODE_ENV: production
-      DATABASE_URL: mariadb://timelimit:timelimitpassword@database:3306/timelimit
-      PORT: 8080
-      MAIL_SENDER: me@my.timelimit.server
-      MAIL_TRANSPORT: '{"host": "localhost", "port": 25}'
-      # put additional config variables here
-    ports:
-     - "8080:8080"
-    restart: always
-    # you can enable logging during testing by commenting this out,
-    # but logging is not needed when everything works
-    logging:
-      driver: none
-    links:
-    - database
-  database:
-    image: 'mariadb:10'
-    environment:
-      MYSQL_ROOT_PASSWORD: rootpassword
-      MYSQL_DATABASE: timelimit
-      MYSQL_USER: timelimit
-      MYSQL_PASSWORD: timelimitpassword
-    volumes:
-     - ./database:/var/lib/mysql
-    # you can enable logging during testing by commenting this out,
-    # but logging is not needed when everything works
-    logging:
-      driver: none
-```
-
-The database files will be saved at the folder which contains the docker-compose.yml.
-You should change the passwords.
-
-Docker starts both (TimeLimit and the database) at the same time,
-so the TimeLimit server will crash a few times due to the missing database
-before it starts working.
-
-## example docker-compose.yml with external databases
-
-(don't forget to build the docker image first)
-
-```
-version: '2'
-services:
-  api:
-    image: 'timelimit-server:latest'
-    environment:
-      NODE_ENV: production
-      DATABASE_URL: postgres://user:pass@example.com:5432/dbname
-      PORT: 8080
-      MAIL_SENDER: me@my.timelimit.server
-      MAIL_TRANSPORT: '{"host": "localhost", "port": 25}'
-      # put additional config variables here
-    restart: always
-    # you can enable logging during testing by commenting this out,
-    # but logging is not needed when everything works
-    logging:
-      driver: none
-    # easy solution to use a database which does not run within docker
-    network_mode: "host"
-    # otherwise:
-    # redirect host port 9000 to guest port 8080 (to allow access to the API)
-    # ports:
-    #  - "9000:8080"
-    # in case the database runs outside of docker and you don't want to use the host network mode, see
-    # https://forums.docker.com/t/accessing-host-machine-from-within-docker-container/14248
-```
+This Readme became too long. Due to that, it was split into [mutliple files](https://codeberg.org/timelimit/timelimit-server/src/branch/master/docs/usage).

docs/api/parent.md

@@ -20,12 +20,13 @@ On a invalid request body: HTTP status code 400 Bad Request
 
 If the mail auth token is invalid/ expired: HTTP status code 401 Unauthorized
 
-On success: a object with the properties ``status`` (string), ``mail`` (string) and
-``canCreateFamily`` (boolean)
+On success: a object with the properties ``status`` (string), ``mail`` (string),
+``canCreateFamily`` (boolean) and ``alwaysPro`` (boolean)
 
 - ``status`` is ``with family`` or ``without family``
 - ``mail`` is the mail address for which the auth token was created
 - ``canCreateFamily`` is false if the sign up of new families was disabled and otherwise true
+- ``alwaysPro`` is true if the premium version is always unlocked
 
 ## POST /parent/create-family
 

docs/api/sync.md

@@ -44,6 +44,7 @@ The integrity field of a action may have got one of the following values:
 - an empty string when no user authentication is required/ for app logic actions (e.g. incrementing the used time)
 - the string ``device`` in case of parent actions if a parent is assigned to the device and asking for the password was disabled
 - ``sha512(sequence number as string with the base 10 + the device id as string + the hash of the user password using the second salt as string + the encoded action as string)`` for parent and child actions
+- the string ``childDevice`` in case the child wants to add limits for itself using parent actions; this feature must be enabled for the child and this allows only some actions with some parameters
 
 In case of a invalid integrity value, the action is ignored and the client is told to do a full sync
 

docs/usage/admin-api.md

@@ -0,0 +1,4 @@
+# Admin API
+
+When the ``ADMIN_TOKEN`` environment variable was set, then there is a admin API available
+at ``http(s)://server/admin``. It can be used by the [TimeLimit Server Admin UI](https://codeberg.org/timelimit/timelimit-server-ui).

docs/usage/clustering.md

@@ -0,0 +1,7 @@
+# Clustering
+
+This application only supports running one instance per database.
+
+Otherwise, when doing clustering, push messages do not work anymore between devices
+connected to different instances and the rate limiting is per instance and thus not
+strictly enforced.

docs/usage/configuration.md

@@ -0,0 +1,56 @@
+# Configuration/ environment variables
+
+- DATABASE_URL
+  - this specifies the database to use
+  - default value: ``sqlite://test.db`` (sqlite database in the source code directory)
+  - supports mysql, postgresql and sqlite (sqlite in development builds only because it's declared as dev dependency)
+  - looks like ``postgres://user:pass@example.com:5432/dbname``
+  - no extra setup needed
+      - when starting the application, the database tables are created/ migrated
+        - this only works for upgrading; if you intend to eventually downgrade, make a backup first (you should make backups in all cases before an upgrade)
+- PORT
+  - the port at which the server should listen
+  - default value: 8080
+- NODE_ENV
+  - should be set to ``production`` in production
+  - when using ``development``, then mails are not sent; instead they are written to a html file which is opened
+- GOOGLE_PLAY_PUBLIC_KEY
+  - key for validating purchases
+  - purchases using google play don't work without it/ when it is not set
+- MAIL_SENDER
+  - sender (for the from-field) for sent mails
+  - the sent mails contain the info that one can reply to it in case of questions ... so you should have someone who looks into the inbox and send replies (or you know that there is nobody and don't ask anything)
+- MAIL_TRANSPORT
+  - a JSON encoded configuration for nodemailer
+  - supports setting a smtp server configuration, see <https://nodemailer.com/smtp/>
+  - allows easier configuration in case of a [well known services](https://nodemailer.com/smtp/well-known/)
+  - default value is ``null``
+  - examples
+    - ``{"host": "localhost", "port": 25}`` (using a local mail server which does not require any authentication)
+    - ``{"service": "1und1", "auth": {"user": "me@my.timelimit.server", "pass": "my password"}}`` (using a well known service)
+    - ``{"host": "my.mail.server", "secure": true, "auth": {"user": "me@my.timelimit.server", "pass": "my password"}}`` (using a external smtp server)
+  - in case of a docker-compose file, you should escape this, e.g. sourround it with ``'`` single quotes
+- MAIL_IMPRINT
+  - a string which is added to the footer of the sent mails
+  - default value: ``not defined``
+- ADMIN_TOKEN
+  - a password which allows to use some APIs
+  - admin APIs are disabled when this is not set
+- MAIL_SERVER_BLACKLIST
+  - list of domains, separated by comma
+  - if the user tries to use such a mail service, then he will get the notification that this provider is not supported
+  - the blacklist is empty if this is not set
+- MAIL_WHITELIST
+  - list of mail addresses (``someone@somewhere.com``) or domains (``mailbox.org``), separated by comma
+  - if a user requests signing in with a mail address which is not in this list, then the request is rejected
+  - if the list is empty/ the variable is not set, then any mail address (except with domains from the blacklist) is allowed
+  - note: this allows a third party who knows the server url to check if a certain mail address is allowed by trying to sign in with it
+- DISABLE_SIGNUP
+  - ``yes`` or ``no`` (default: no)
+  - disables creating new families if ``yes`` is selected
+- ALWAYS_PRO
+  - ``yes`` or ``no`` (default: ``no``)
+  - if ``yes``, then the features of the premium version are unlocked for all users
+- PING_INTERVAL_SEC
+  - ping interval at the websocket in seconds
+  - the default value is ``25``

docs/usage/docker.md

@@ -0,0 +1,87 @@
+# Docker
+
+You can run the timelimit server with docker. Here are two example configuration files:
+
+## Important
+
+The ``image: 'timelimit-server:latest'`` will not work out of the box.
+You have to build this image yourself (using ``sudo docker build -t timelimit-server .``
+within the root directory of this git repository) or you can replace it by
+``image: docker.timelimit.io/timelimit-server`` which will use prebuilt docker
+images.
+
+## example docker-compose.yml with included database
+
+```
+version: '3'
+services:
+  api:
+    image: 'timelimit-server:latest'
+    environment:
+      NODE_ENV: production
+      DATABASE_URL: mariadb://timelimit:timelimitpassword@database:3306/timelimit
+      PORT: 8080
+      MAIL_SENDER: me@my.timelimit.server
+      MAIL_TRANSPORT: '{"host": "localhost", "port": 25}'
+      ALWAYS_PRO: yes
+      # put additional config variables here
+    ports:
+     - "8080:8080"
+    restart: always
+    # you can enable logging during testing by commenting this out,
+    # but logging is not needed when everything works
+    logging:
+      driver: none
+    links:
+    - database
+  database:
+    image: 'mariadb:10'
+    environment:
+      MYSQL_ROOT_PASSWORD: rootpassword
+      MYSQL_DATABASE: timelimit
+      MYSQL_USER: timelimit
+      MYSQL_PASSWORD: timelimitpassword
+    volumes:
+     - ./database:/var/lib/mysql
+    # you can enable logging during testing by commenting this out,
+    # but logging is not needed when everything works
+    logging:
+      driver: none
+```
+
+The database files will be saved at the folder which contains the docker-compose.yml.
+You should change the passwords.
+
+Docker starts both (TimeLimit and the database) at the same time,
+so the TimeLimit server will crash a few times due to the missing database
+before it starts working.
+
+## example docker-compose.yml with external databases
+
+```
+version: '2'
+services:
+  api:
+    image: 'timelimit-server:latest'
+    environment:
+      NODE_ENV: production
+      DATABASE_URL: postgres://user:pass@example.com:5432/dbname
+      PORT: 8080
+      MAIL_SENDER: me@my.timelimit.server
+      MAIL_TRANSPORT: '{"host": "localhost", "port": 25}'
+      ALWAYS_PRO: yes
+      # put additional config variables here
+    restart: always
+    # you can enable logging during testing by commenting this out,
+    # but logging is not needed when everything works
+    logging:
+      driver: none
+    # easy solution to use a database which does not run within docker
+    network_mode: "host"
+    # otherwise:
+    # redirect host port 9000 to guest port 8080 (to allow access to the API)
+    # ports:
+    #  - "9000:8080"
+    # in case the database runs outside of docker and you don't want to use the host network mode, see
+    # https://forums.docker.com/t/accessing-host-machine-from-within-docker-container/14248
+```

docs/usage/https.md

@@ -0,0 +1,43 @@
+# HTTPS
+
+This server application itself does not support HTTPS. You have to use
+an other tool to use HTTPS. One options for this is to use nginx with the
+following site config:
+
+```
+# don't forget to update the port for your local configuration
+#
+# the max_fails is important - otherwise nginx
+# marks the server sometimes as unreachable if it is restarted
+# or starts after nginx
+upstream timelimitbackend {
+  server localhost:8080 max_fails=0;
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+
+  # don't forget to update the domain
+  server_name my.domain;
+
+  # don't forget to update the paths
+  ssl_certificate /my/fullchain.pem;
+  ssl_certificate_key /my/privkey.pem;
+
+  # You can add custom SSL parameters here
+
+  location / {
+    proxy_pass http://timelimitbackend/;
+
+    client_max_body_size 10m;
+    # the following is required for websocket support
+    #
+    # without websockets, the client will not detect
+    # that there is a connection and it will not sync
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_http_version 1.1;
+  }
+}
+```

docs/usage/npm-commands.md

@@ -0,0 +1,18 @@
+# npm Commands
+
+This requires that you've installed Node.JS and NPM.
+You need this for the development, but you don't need it
+when deploying using Docker.
+
+## npm start
+
+This runs all pending migrations and starts the server.
+
+## npm run build
+
+This "compiles" the application.
+
+## npm run lint:fix
+
+This fixes the causes of lint warnings (where possible).
+

docs/usage/purchases.md

@@ -0,0 +1,8 @@
+# Purchases
+
+To enable the automated purchase feature, set the ``GOOGLE_PLAY_PUBLIC_KEY`` environment variable.
+The value for the official builds which are distributed using the Play Store can
+be found at <https://codeberg.org/timelimit/timelimit-android/src/commit/3da677877f4dde0b1b01523daae33745f14e08ac/app/build.gradle#L49>.
+
+Additionally, there is the admin API which allows one to unlock the
+premium features.

docs/usage/running.md

@@ -0,0 +1,12 @@
+# Running
+
+There are 3 options for running this application:
+
+Option 1: Build a docker image and use it  
+Option 2: Install Node.JS (see below for detailed usage)
+Option 3: Use a prebuilt docker image  
+
+After starting it, you can open ``http://server/time`` to test it,
+it should show a timestamp
+
+

package-lock.json

@@ -213,27 +213,27 @@
       "dev": true
     },
     "@babel/code-frame": {
-      "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.8.3.tgz",
-      "integrity": "sha512-a9gxpmdXtZEInkCSHUJDLHZVBgb1QS0jhss4cPP93EW7s+uC5bikET2twEF3KV+7rDblJcmNvTR7VJejqd2C2g==",
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.10.4.tgz",
+      "integrity": "sha512-vG6SvB6oYEhvgisZNFRmRCUkLz11c7rp+tbNTynGqc6mS1d5ATd/sGyV6W0KZZnXRKMTzZDRgQT3Ou9jhpAfUg==",
       "dev": true,
       "requires": {
-        "@babel/highlight": "7.9.0"
+        "@babel/highlight": "7.10.4"
       }
     },
     "@babel/helper-validator-identifier": {
-      "version": "7.9.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.9.0.tgz",
-      "integrity": "sha512-6G8bQKjOh+of4PV/ThDm/rRqlU7+IGoJuofpagU5GlEl29Vv0RGqqt86ZGRV8ZuSOY3o+8yXl5y782SMcG7SHw==",
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.10.4.tgz",
+      "integrity": "sha512-3U9y+43hz7ZM+rzG24Qe2mufW5KhvFg/NhnNph+i9mgCtdTCtMJuI1TMkrIUiK7Ix4PYlRF9I5dhqaLYA/ADXw==",
       "dev": true
     },
     "@babel/highlight": {
-      "version": "7.9.0",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.9.0.tgz",
-      "integrity": "sha512-lJZPilxX7Op3Nv/2cvFdnlepPXDxi29wxteT57Q965oc5R9v86ztx0jfxVrTcBk8C2kcPkkDa2Z4T3ZsPPVWsQ==",
+      "version": "7.10.4",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.10.4.tgz",
+      "integrity": "sha512-i6rgnR/YgPEQzZZnbTHHuZdlE8qyoBNalD6F+q4vAFlcMEcqmkoG+mPqJYJCo63qPf74+Y1UZsl3l6f7/RIkmA==",
       "dev": true,
       "requires": {
-        "@babel/helper-validator-identifier": "7.9.0",
+        "@babel/helper-validator-identifier": "7.10.4",
         "chalk": "2.4.2",
         "js-tokens": "4.0.0"
       }
@@ -270,7 +270,7 @@
         "debug": "4.1.1",
         "i18n": "0.8.6",
         "i18n-locales": "0.0.4",
-        "lodash": "4.17.15",
+        "lodash": "4.17.19",
         "moment": "2.24.0",
         "multimatch": "4.0.0",
         "qs": "6.9.3",
@@ -755,7 +755,7 @@
       "requires": {
         "babel-runtime": "6.26.0",
         "esutils": "2.0.3",
-        "lodash": "4.17.15",
+        "lodash": "4.17.19",
         "to-fast-properties": "1.0.3"
       }
     },
@@ -1456,7 +1456,7 @@
         "get-paths": "0.0.7",
         "html-to-text": "5.1.1",
         "juice": "6.0.0",
-        "lodash": "4.17.15",
+        "lodash": "4.17.19",
         "nodemailer": "6.4.6",
         "pify": "5.0.0",
         "preview-email": "2.0.1"
@@ -1959,7 +1959,7 @@
       "requires": {
         "he": "1.2.0",
         "htmlparser2": "3.10.1",
-        "lodash": "4.17.15",
+        "lodash": "4.17.19",
         "minimist": "1.2.5"
       },
       "dependencies": {
@@ -2404,9 +2404,9 @@
       }
     },
     "lodash": {
-      "version": "4.17.15",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
-      "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A=="
+      "version": "4.17.19",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz",
+      "integrity": "sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ=="
     },
     "lodash.assignin": {
       "version": "4.2.0",
@@ -3641,7 +3641,7 @@
         "debug": "4.1.1",
         "dottie": "2.0.2",
         "inflection": "1.12.0",
-        "lodash": "4.17.15",
+        "lodash": "4.17.19",
         "moment": "2.24.0",
         "moment-timezone": "0.5.28",
         "retry-as-promised": "3.2.0",
@@ -4088,18 +4088,18 @@
       }
     },
     "tslib": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.11.1.tgz",
-      "integrity": "sha512-aZW88SY8kQbU7gpV19lN24LtXh/yD4ZZg6qieAJDDg+YBsJcSmLGK9QpnUjAKVG/xefmvJGd1WUmfpT/g6AJGA==",
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.13.0.tgz",
+      "integrity": "sha512-i/6DQjL8Xf3be4K/E6Wgpekn5Qasl1usyw++dAA35Ue5orEn65VIxOA+YvNNl9HV3qv70T7CNwjODHZrLwvd1Q==",
       "dev": true
     },
     "tslint": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/tslint/-/tslint-6.1.0.tgz",
-      "integrity": "sha512-fXjYd/61vU6da04E505OZQGb2VCN2Mq3doeWcOIryuG+eqdmFUXTYVwdhnbEu2k46LNLgUYt9bI5icQze/j0bQ==",
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/tslint/-/tslint-6.1.3.tgz",
+      "integrity": "sha512-IbR4nkT96EQOvKE2PW/djGz8iGNeJ4rF2mBfiYaR/nvUWYKJhLwimoJKgjIFEIDibBtOevj7BqCRL4oHeWWUCg==",
       "dev": true,
       "requires": {
-        "@babel/code-frame": "7.8.3",
+        "@babel/code-frame": "7.10.4",
         "builtin-modules": "1.1.1",
         "chalk": "2.4.2",
         "commander": "2.20.0",
@@ -4107,11 +4107,28 @@
         "glob": "7.1.6",
         "js-yaml": "3.13.1",
         "minimatch": "3.0.4",
-        "mkdirp": "0.5.1",
+        "mkdirp": "0.5.5",
         "resolve": "1.12.0",
         "semver": "5.5.0",
-        "tslib": "1.11.1",
+        "tslib": "1.13.0",
         "tsutils": "2.29.0"
+      },
+      "dependencies": {
+        "minimist": {
+          "version": "1.2.5",
+          "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
+          "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw==",
+          "dev": true
+        },
+        "mkdirp": {
+          "version": "0.5.5",
+          "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.5.tgz",
+          "integrity": "sha512-NKmAlESf6jMGym1++R0Ra7wvhV+wFW63FaSOFPwRahvea0gMUcGUhVeAg/0BC0wiv9ih5NYPB1Wn1UEI1/L+xQ==",
+          "dev": true,
+          "requires": {
+            "minimist": "1.2.5"
+          }
+        }
       }
     },
     "tslint-config-standard": {
@@ -4157,7 +4174,7 @@
       "integrity": "sha512-g5JVHCIJwzfISaXpXE1qvNalca5Jwob6FjI4AoPlqMusJ6ftFE7IkkFoMhVLRgK+4Kx3gkzb8UZK5t5yTTvEmA==",
       "dev": true,
       "requires": {
-        "tslib": "1.11.1"
+        "tslib": "1.13.0"
       }
     },
     "tunnel-agent": {

package.json

@@ -39,7 +39,7 @@
     "@types/socket.io": "^2.1.4",
     "@types/tokgen": "^1.0.0",
     "@types/umzug": "^2.2.3",
-    "tslint": "^6.1.0",
+    "tslint": "^6.1.3",
     "tslint-config-standard": "^9.0.0",
     "typescript": "^3.8.3",
     "typescript-json-schema": "^0.42.0"
@@ -54,7 +54,7 @@
     "express": "^4.17.1",
     "http-errors": "^1.7.3",
     "iab_verifier": "^0.1.2",
-    "lodash": "^4.17.15",
+    "lodash": "^4.17.19",
     "mariadb": "^2.3.1",
     "pg": "^7.18.2",
     "pg-hstore": "^2.3.3",

src/api/parent.ts

@@ -51,7 +51,8 @@ export const createParentRouter = ({ database, websocket }: {database: Database,
       res.json({
         status,
         mail,
-        canCreateFamily: !config.disableSignup
+        canCreateFamily: !config.disableSignup,
+        alwaysPro: config.alwaysPro
       })
     } catch (ex) {
       next(ex)

src/config.ts

@@ -20,6 +20,7 @@ interface Config {
   mailWhitelist: Array<string>
   disableSignup: boolean
   pingInterval: number
+  alwaysPro: boolean
 }
 
 function parseYesNo (value: string) {
@@ -28,12 +29,13 @@ function parseYesNo (value: string) {
   } else if (value === 'no') {
     return false
   } else {
-    throw new Error('invalid value "' + value + '", expected "" or "no"')
+    throw new Error('invalid value "' + value + '", expected "yes" or "no"')
   }
 }
 
 export const config: Config = {
   mailWhitelist: (process.env.MAIL_WHITELIST || '').split(',').map((item) => item.trim()).filter((item) => item.length > 0),
   disableSignup: parseYesNo(process.env.DISABLE_SIGNUP || 'no'),
-  pingInterval: parseInt(process.env.PING_INTERVAL_SEC || '25', 10) * 1000
+  pingInterval: parseInt(process.env.PING_INTERVAL_SEC || '25', 10) * 1000,
+  alwaysPro: process.env.ALWAYS_PRO ? parseYesNo(process.env.ALWAYS_PRO) : false
 }

src/function/child/set-primary-device.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 Jonas Lochmann
+ * Copyright (C) 2019 - 2020 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -17,6 +17,7 @@
 
 import { Conflict, Unauthorized } from 'http-errors'
 import * as Sequelize from 'sequelize'
+import { config } from '../../config'
 import { Database } from '../../database'
 import { generateVersionId } from '../../util/token'
 import { WebsocketApi } from '../../websocket'
@@ -104,7 +105,7 @@ export const setPrimaryDevice = async ({ database, websocket, deviceAuthToken, c
         hasFullVersion: familyEntryUnsafe.hasFullVersion
       }
 
-      if (!familyEntry.hasFullVersion) {
+      if (!(familyEntry.hasFullVersion || config.alwaysPro)) {
         return {
           response: 'requires full version',
           sourceDeviceId: deviceEntry.deviceId,

src/function/sync/apply-actions/cache.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 Jonas Lochmann
+ * Copyright (C) 2019 - 2020 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -17,6 +17,7 @@
 
 import { memoize, uniq } from 'lodash'
 import * as Sequelize from 'sequelize'
+import { config } from '../../../config'
 import { VisibleConnectedDevicesManager } from '../../../connected-devices'
 import { Database } from '../../../database'
 import { generateVersionId } from '../../../util/token'
@@ -49,7 +50,7 @@ export class Cache {
     connectedDevicesManager: VisibleConnectedDevicesManager
   }) {
     this.familyId = familyId
-    this.hasFullVersion = hasFullVersion
+    this.hasFullVersion = hasFullVersion || config.alwaysPro
     this.database = database
     this.transaction = transaction
     this.connectedDevicesManager = connectedDevicesManager

src/function/sync/apply-actions/dispatch-parent-action/addcategoryapps.ts

@@ -18,11 +18,13 @@
 import * as Sequelize from 'sequelize'
 import { AddCategoryAppsAction } from '../../../../action'
 import { CategoryAppAttributes } from '../../../../database/categoryapp'
+import { getCategoryWithParentCategories } from '../../../../util/category'
 import { Cache } from '../cache'
 
-export async function dispatchAddCategoryApps ({ action, cache }: {
+export async function dispatchAddCategoryApps ({ action, cache, fromChildSelfLimitAddChildUserId }: {
   action: AddCategoryAppsAction
   cache: Cache
+  fromChildSelfLimitAddChildUserId: string | null
 }) {
   const categoryEntryUnsafe = await cache.database.category.findOne({
     where: {
@@ -39,14 +41,25 @@ export async function dispatchAddCategoryApps ({ action, cache }: {
 
   const { childId } = categoryEntryUnsafe
 
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    if (childId !== fromChildSelfLimitAddChildUserId) {
+      throw new Error('can not add apps to other users')
+    }
+  }
+
   const categoriesOfSameChild = await cache.database.category.findAll({
     where: {
       familyId: cache.familyId,
       childId
     },
-    attributes: ['categoryId'],
+    attributes: ['categoryId', 'parentCategoryId'],
     transaction: cache.transaction
-  }).map((item) => ({ categoryId: item.categoryId }))
+  }).map((item) => ({
+    categoryId: item.categoryId,
+    parentCategoryId: item.parentCategoryId
+  }))
+
+  const userCategoryIds = categoriesOfSameChild.map((item) => item.categoryId)
 
   const oldCategories = await cache.database.categoryApp.findAll({
     attributes: [ 'categoryId' ],
@@ -54,7 +67,7 @@ export async function dispatchAddCategoryApps ({ action, cache }: {
     where: {
       familyId: cache.familyId,
       categoryId: {
-        [Sequelize.Op.in]: categoriesOfSameChild.map((item) => item.categoryId)
+        [Sequelize.Op.in]: userCategoryIds
       },
       packageName: {
         [Sequelize.Op.in]: action.packageNames
@@ -63,6 +76,68 @@ export async function dispatchAddCategoryApps ({ action, cache }: {
     transaction: cache.transaction
   }).map((item) => item.categoryId)
 
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    const parentCategoriesOfTargetCategory = getCategoryWithParentCategories(categoriesOfSameChild, action.categoryId)
+    const userEntryUnsafe = await cache.database.user.findOne({
+      attributes: [ 'categoryForNotAssignedApps' ],
+      where: {
+        familyId: cache.familyId,
+        userId: fromChildSelfLimitAddChildUserId
+      },
+      transaction: cache.transaction
+    })
+
+    if (!userEntryUnsafe) {
+      throw new Error('illegal state')
+    }
+
+    const userEntry = { categoryForNotAssignedApps: userEntryUnsafe.categoryForNotAssignedApps }
+    const validatedDefaultCategoryId = categoriesOfSameChild.find((item) => item.categoryId === userEntry.categoryForNotAssignedApps)?.categoryId
+    const allowUnassignedElements = validatedDefaultCategoryId !== undefined &&
+      parentCategoriesOfTargetCategory.indexOf(validatedDefaultCategoryId) !== -1
+
+    const assertCanAddApp = async (packageName: string, isApp: boolean) => {
+      const categoryAppEntryUnsafe = await cache.database.categoryApp.findOne({
+        attributes: [ 'categoryId' ],
+        where: {
+          familyId: cache.familyId,
+          categoryId: {
+            [Sequelize.Op.in]: userCategoryIds
+          },
+          packageName: packageName
+        },
+        transaction: cache.transaction
+      })
+
+      const categoryAppEntry = categoryAppEntryUnsafe ? { categoryId: categoryAppEntryUnsafe.categoryId } : null
+
+      if (categoryAppEntry === null) {
+        if ((isApp && allowUnassignedElements) || (!isApp)) {
+          // allow
+        } else {
+          throw new Error('can not assign apps without category as child')
+        }
+      } else {
+        if (parentCategoriesOfTargetCategory.indexOf(categoryAppEntry.categoryId) !== -1) {
+          // allow
+        } else {
+          throw new Error('can not add app which is not contained in the parent category')
+        }
+      }
+    }
+
+    for (let i = 0; i < action.packageNames.length; i++) {
+      const packageName = action.packageNames[i]
+
+      if (packageName.indexOf(':') !== -1) {
+        await assertCanAddApp(packageName.substring(0, packageName.indexOf(':')), true)
+        await assertCanAddApp(packageName, false)
+      } else {
+        await assertCanAddApp(packageName, true)
+      }
+    }
+  }
+
   if (oldCategories.length > 0) {
     await cache.database.categoryApp.destroy({
       where: {

src/function/sync/apply-actions/dispatch-parent-action/createcategory.ts

@@ -19,10 +19,17 @@ import { CreateCategoryAction } from '../../../../action'
 import { generateVersionId } from '../../../../util/token'
 import { Cache } from '../cache'
 
-export async function dispatchCreateCategory ({ action, cache }: {
+export async function dispatchCreateCategory ({ action, cache, fromChildSelfLimitAddChildUserId }: {
   action: CreateCategoryAction
   cache: Cache
+  fromChildSelfLimitAddChildUserId: string | null
 }) {
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    if (fromChildSelfLimitAddChildUserId !== action.childId) {
+      throw new Error('can not create categories for other child users')
+    }
+  }
+
   // check that the child exists
   const childEntry = await cache.database.user.findOne({
     where: {

src/function/sync/apply-actions/dispatch-parent-action/createtimelimitrule.ts

@@ -18,16 +18,30 @@
 import { CreateTimeLimitRuleAction } from '../../../../action'
 import { Cache } from '../cache'
 
-export async function dispatchCreateTimeLimitRule ({ action, cache }: {
+export async function dispatchCreateTimeLimitRule ({ action, cache, fromChildSelfLimitAddChildUserId }: {
   action: CreateTimeLimitRuleAction
   cache: Cache
+  fromChildSelfLimitAddChildUserId: string | null
 }) {
-  const doesCategoryExist = await cache.doesCategoryExist(action.rule.categoryId)
+  const categoryEntryUnsafe = await cache.database.category.findOne({
+    where: {
+      familyId: cache.familyId,
+      categoryId: action.rule.categoryId
+    },
+    transaction: cache.transaction,
+    attributes: ['childId']
+  })
 
-  if (!doesCategoryExist) {
+  if (!categoryEntryUnsafe) {
     throw new Error('invalid category id for new rule')
   }
 
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    if (fromChildSelfLimitAddChildUserId !== categoryEntryUnsafe.childId) {
+      throw new Error('can not add rules for other users')
+    }
+  }
+
   await cache.database.timelimitRule.create({
     familyId: cache.familyId,
     ruleId: action.rule.ruleId,

src/function/sync/apply-actions/dispatch-parent-action/index.ts

@@ -102,94 +102,99 @@ import { dispatchUpdateTimelimitRule } from './updatetimelimitrule'
 import { dispatchUpdateUserFlagsAction } from './updateuserflags'
 import { dispatchUpdateUserLimitLoginCategoryAction } from './updateuserlimitlogincategory'
 
-export const dispatchParentAction = async ({ action, cache, parentUserId, sourceDeviceId }: {
+export const dispatchParentAction = async ({ action, cache, parentUserId, sourceDeviceId, fromChildSelfLimitAddChildUserId }: {
   action: ParentAction
   cache: Cache
   parentUserId: string
   sourceDeviceId: string | null
+  fromChildSelfLimitAddChildUserId: string | null
 }) => {
   if (action instanceof AddCategoryAppsAction) {
-    await dispatchAddCategoryApps({ action, cache })
-  } else if (action instanceof AddUserAction) {
-    await dispatchAddUser({ action, cache })
-  } else if (action instanceof RemoveCategoryAppsAction) {
-    await dispatchRemoveCategoryApps({ action, cache })
+    return dispatchAddCategoryApps({ action, cache, fromChildSelfLimitAddChildUserId })
   } else if (action instanceof CreateCategoryAction) {
-    await dispatchCreateCategory({ action, cache })
+    return dispatchCreateCategory({ action, cache, fromChildSelfLimitAddChildUserId })
   } else if (action instanceof CreateTimeLimitRuleAction) {
-    await dispatchCreateTimeLimitRule({ action, cache })
-  } else if (action instanceof DeleteCategoryAction) {
-    await dispatchDeleteCategory({ action, cache })
-  } else if (action instanceof UpdateCategoryTitleAction) {
-    await dispatchUpdateCategoryTitle({ action, cache })
-  } else if (action instanceof SetCategoryExtraTimeAction) {
-    await dispatchSetCategoryExtraTime({ action, cache })
-  } else if (action instanceof SetCategoryForUnassignedAppsAction) {
-    await dispatchSetCategoryForUnassignedApps({ action, cache })
-  } else if (action instanceof SetChildPasswordAction) {
-    await dispatchSetChildPassword({ action, cache })
-  } else if (action instanceof SetConsiderRebootManipulationAction) {
-    await dispatchSetConsiderRebootManipulation({ action, cache })
-  } else if (action instanceof SetDeviceDefaultUserAction) {
-    await dispatchSetDeviceDefaultUser({ action, cache })
-  } else if (action instanceof SetDeviceDefaultUserTimeoutAction) {
-    await dispatchSetDeviceDefaultUserTimeout({ action, cache })
-  } else if (action instanceof SetDeviceUserAction) {
-    await dispatchSetDeviceUser({ action, cache })
-  } else if (action instanceof SetKeepSignedInAction) {
-    await dispatchSetKeepSignedIn({ action, cache, parentUserId })
-  } else if (action instanceof SetParentCategoryAction) {
-    await dispatchSetParentCategory({ action, cache })
-  } else if (action instanceof SetRelaxPrimaryDeviceAction) {
-    await dispatchSetRelaxPrimaryDevice({ action, cache })
-  } else if (action instanceof SetSendDeviceConnected) {
-    await dispatchSetSendDeviceConnected({ action, cache, sourceDeviceId })
-  } else if (action instanceof SetUserDisableLimitsUntilAction) {
-    await dispatchUserSetDisableLimitsUntil({ action, cache })
-  } else if (action instanceof SetUserTimezoneAction) {
-    await dispatchSetUserTimezone({ action, cache })
-  } else if (action instanceof UpdateCategoryBatteryLimitAction) {
-    await dispatchUpdateCategoryBatteryLimit({ action, cache })
+    return dispatchCreateTimeLimitRule({ action, cache, fromChildSelfLimitAddChildUserId })
   } else if (action instanceof UpdateCategoryBlockAllNotificationsAction) {
-    await dispatchUpdateCategoryBlockAllNotifications({ action, cache })
-  } else if (action instanceof UpdateCategoryBlockedTimesAction) {
-    await dispatchUpdateCategoryBlockedTimes({ action, cache })
-  } else if (action instanceof UpdateCategorySortingAction) {
-    await dispatchUpdateCategorySorting({ action, cache })
-  } else if (action instanceof IncrementCategoryExtraTimeAction) {
-    await dispatchIncrementCategoryExtraTime({ action, cache })
+    return dispatchUpdateCategoryBlockAllNotifications({ action, cache, fromChildSelfLimitAddChildUserId })
+  } else if (action instanceof SetParentCategoryAction) {
+    return dispatchSetParentCategory({ action, cache, fromChildSelfLimitAddChildUserId })
   } else if (action instanceof UpdateCategoryTemporarilyBlockedAction) {
-    await dispatchUpdateCategoryTemporarilyBlocked({ action, cache })
-  } else if (action instanceof DeleteTimeLimitRuleAction) {
-    await dispatchDeleteTimeLimitRule({ action, cache })
-  } else if (action instanceof UpdateDeviceNameAction) {
-    await dispatchUpdateDeviceName({ action, cache })
-  } else if (action instanceof UpdateEnableActivityLevelBlockingAction) {
-    await dispatchUpdateEnableActivityLevelBlocking({ action, cache })
-  } else if (action instanceof UpdateNetworkTimeVerificationAction) {
-    await dispatchUpdateNetworkTimeVerification({ action, cache })
-  } else if (action instanceof UpdateParentNotificationFlagsAction) {
-    await dispatchUpdateParentNotificationFlags({ action, cache })
-  } else if (action instanceof UpdateTimelimitRuleAction) {
-    await dispatchUpdateTimelimitRule({ action, cache })
-  } else if (action instanceof RemoveUserAction) {
-    await dispatchRemoveUser({ action, cache, parentUserId })
-  } else if (action instanceof RenameChildAction) {
-    await dispatchRenameChild({ action, cache })
-  } else if (action instanceof ChangeParentPasswordAction) {
-    await dispatchChangeParentPassword({ action, cache })
-  } else if (action instanceof IgnoreManipulationAction) {
-    await dispatchIgnoreManipulation({ action, cache })
-  } else if (action instanceof UpdateCategoryTimeWarningsAction) {
-    await dispatchUpdateCategoryTimeWarnings({ action, cache })
-  } else if (action instanceof ResetParentBlockedTimesAction) {
-    await dispatchResetParentBlockedTimes({ action, cache })
-  } else if (action instanceof UpdateParentBlockedTimesAction) {
-    await dispatchUpdateParentBlockedTimes({ action, cache, parentUserId })
-  } else if (action instanceof UpdateUserFlagsAction) {
-    await dispatchUpdateUserFlagsAction({ action, cache })
-  } else if (action instanceof UpdateUserLimitLoginCategory) {
-    await dispatchUpdateUserLimitLoginCategoryAction({ action, cache, parentUserId })
+    return dispatchUpdateCategoryTemporarilyBlocked({ action, cache, fromChildSelfLimitAddChildUserId })
+  }
+
+  if (fromChildSelfLimitAddChildUserId === null) {
+    if (action instanceof AddUserAction) {
+      return dispatchAddUser({ action, cache })
+    } else if (action instanceof RemoveCategoryAppsAction) {
+      return dispatchRemoveCategoryApps({ action, cache })
+    } else if (action instanceof DeleteCategoryAction) {
+      return dispatchDeleteCategory({ action, cache })
+    } else if (action instanceof UpdateCategoryTitleAction) {
+      return dispatchUpdateCategoryTitle({ action, cache })
+    } else if (action instanceof SetCategoryExtraTimeAction) {
+      return dispatchSetCategoryExtraTime({ action, cache })
+    } else if (action instanceof SetCategoryForUnassignedAppsAction) {
+      return dispatchSetCategoryForUnassignedApps({ action, cache })
+    } else if (action instanceof SetChildPasswordAction) {
+      return dispatchSetChildPassword({ action, cache })
+    } else if (action instanceof SetConsiderRebootManipulationAction) {
+      return dispatchSetConsiderRebootManipulation({ action, cache })
+    } else if (action instanceof SetDeviceDefaultUserAction) {
+      return dispatchSetDeviceDefaultUser({ action, cache })
+    } else if (action instanceof SetDeviceDefaultUserTimeoutAction) {
+      return dispatchSetDeviceDefaultUserTimeout({ action, cache })
+    } else if (action instanceof SetDeviceUserAction) {
+      return dispatchSetDeviceUser({ action, cache })
+    } else if (action instanceof SetKeepSignedInAction) {
+      return dispatchSetKeepSignedIn({ action, cache, parentUserId })
+    } else if (action instanceof SetRelaxPrimaryDeviceAction) {
+      return dispatchSetRelaxPrimaryDevice({ action, cache })
+    } else if (action instanceof SetSendDeviceConnected) {
+      return dispatchSetSendDeviceConnected({ action, cache, sourceDeviceId })
+    } else if (action instanceof SetUserDisableLimitsUntilAction) {
+      return dispatchUserSetDisableLimitsUntil({ action, cache })
+    } else if (action instanceof SetUserTimezoneAction) {
+      return dispatchSetUserTimezone({ action, cache })
+    } else if (action instanceof UpdateCategoryBatteryLimitAction) {
+      return dispatchUpdateCategoryBatteryLimit({ action, cache })
+    } else if (action instanceof UpdateCategoryBlockedTimesAction) {
+      return dispatchUpdateCategoryBlockedTimes({ action, cache })
+    } else if (action instanceof UpdateCategorySortingAction) {
+      return dispatchUpdateCategorySorting({ action, cache })
+    } else if (action instanceof IncrementCategoryExtraTimeAction) {
+      return dispatchIncrementCategoryExtraTime({ action, cache })
+    } else if (action instanceof DeleteTimeLimitRuleAction) {
+      return dispatchDeleteTimeLimitRule({ action, cache })
+    } else if (action instanceof UpdateDeviceNameAction) {
+      return dispatchUpdateDeviceName({ action, cache })
+    } else if (action instanceof UpdateEnableActivityLevelBlockingAction) {
+      return dispatchUpdateEnableActivityLevelBlocking({ action, cache })
+    } else if (action instanceof UpdateNetworkTimeVerificationAction) {
+      return dispatchUpdateNetworkTimeVerification({ action, cache })
+    } else if (action instanceof UpdateParentNotificationFlagsAction) {
+      return dispatchUpdateParentNotificationFlags({ action, cache })
+    } else if (action instanceof UpdateTimelimitRuleAction) {
+      return dispatchUpdateTimelimitRule({ action, cache })
+    } else if (action instanceof RemoveUserAction) {
+      return dispatchRemoveUser({ action, cache, parentUserId })
+    } else if (action instanceof RenameChildAction) {
+      return dispatchRenameChild({ action, cache })
+    } else if (action instanceof ChangeParentPasswordAction) {
+      return dispatchChangeParentPassword({ action, cache })
+    } else if (action instanceof IgnoreManipulationAction) {
+      return dispatchIgnoreManipulation({ action, cache })
+    } else if (action instanceof UpdateCategoryTimeWarningsAction) {
+      return dispatchUpdateCategoryTimeWarnings({ action, cache })
+    } else if (action instanceof ResetParentBlockedTimesAction) {
+      return dispatchResetParentBlockedTimes({ action, cache })
+    } else if (action instanceof UpdateParentBlockedTimesAction) {
+      return dispatchUpdateParentBlockedTimes({ action, cache, parentUserId })
+    } else if (action instanceof UpdateUserFlagsAction) {
+      return dispatchUpdateUserFlagsAction({ action, cache })
+    } else if (action instanceof UpdateUserLimitLoginCategory) {
+      return dispatchUpdateUserLimitLoginCategoryAction({ action, cache, parentUserId })
+    }
   } else {
     throw new Error('unsupported action type')
   }

src/function/sync/apply-actions/dispatch-parent-action/setparentcategory.ts

@@ -16,11 +16,13 @@
  */
 
 import { SetParentCategoryAction } from '../../../../action'
+import { getCategoryWithParentCategories } from '../../../../util/category'
 import { Cache } from '../cache'
 
-export async function dispatchSetParentCategory ({ action, cache }: {
+export async function dispatchSetParentCategory ({ action, cache, fromChildSelfLimitAddChildUserId }: {
   action: SetParentCategoryAction
   cache: Cache
+  fromChildSelfLimitAddChildUserId: string | null
 }) {
   const categoryEntry = await cache.database.category.findOne({
     where: {
@@ -34,6 +36,12 @@ export async function dispatchSetParentCategory ({ action, cache }: {
     throw new Error('tried to set parent category of non existent category')
   }
 
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    if (categoryEntry.childId !== fromChildSelfLimitAddChildUserId) {
+      throw new Error('can not set parent category for other user')
+    }
+  }
+
   if (action.parentCategory !== '') {
     const categoriesByUserId = (await cache.database.category.findAll({
       where: {
@@ -74,6 +82,16 @@ export async function dispatchSetParentCategory ({ action, cache }: {
     if (childCategoryIds.has(action.parentCategory) || action.parentCategory === action.categoryId) {
       throw new Error('can not set a category as parent which is a child of the category')
     }
+
+    if (fromChildSelfLimitAddChildUserId !== null) {
+      const ownParentCategory = categoriesByUserId.find((item) => item.categoryId === categoryEntry.parentCategoryId)
+      const enableDueToLimitAddingWhenChild = ownParentCategory === undefined ||
+        getCategoryWithParentCategories(categoriesByUserId, action.parentCategory).indexOf(ownParentCategory.categoryId) !== -1
+
+      if (!enableDueToLimitAddingWhenChild) {
+        throw new Error('can not change parent categories in a way which reduces limits')
+      }
+    }
   }
 
   await cache.database.category.update({

src/function/sync/apply-actions/dispatch-parent-action/updatecategoryblockallnotifications.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 Jonas Lochmann
+ * Copyright (C) 2019 - 2020 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -18,10 +18,34 @@
 import { UpdateCategoryBlockAllNotificationsAction } from '../../../../action'
 import { Cache } from '../cache'
 
-export async function dispatchUpdateCategoryBlockAllNotifications ({ action, cache }: {
+export async function dispatchUpdateCategoryBlockAllNotifications ({ action, cache, fromChildSelfLimitAddChildUserId }: {
   action: UpdateCategoryBlockAllNotificationsAction
   cache: Cache
+  fromChildSelfLimitAddChildUserId: string | null
 }) {
+  const categoryEntryUnsafe = await cache.database.category.findOne({
+    where: {
+      familyId: cache.familyId,
+      categoryId: action.categoryId
+    },
+    transaction: cache.transaction,
+    attributes: ['childId']
+  })
+
+  if (!categoryEntryUnsafe) {
+    throw new Error('invalid category id for updating notification blocking')
+  }
+
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    if (fromChildSelfLimitAddChildUserId !== categoryEntryUnsafe.childId) {
+      throw new Error('can not add rules for other users')
+    }
+
+    if (!action.blocked) {
+      throw new Error('can not disable filter as child')
+    }
+  }
+
   const [affectedRows] = await cache.database.category.update({
     blockAllNotifications: action.blocked
   }, {

src/function/sync/apply-actions/dispatch-parent-action/updatecategorytemporarilyblocked.ts

@@ -18,9 +18,10 @@
 import { UpdateCategoryTemporarilyBlockedAction } from '../../../../action'
 import { Cache } from '../cache'
 
-export async function dispatchUpdateCategoryTemporarilyBlocked ({ action, cache }: {
+export async function dispatchUpdateCategoryTemporarilyBlocked ({ action, cache, fromChildSelfLimitAddChildUserId }: {
   action: UpdateCategoryTemporarilyBlockedAction
   cache: Cache
+  fromChildSelfLimitAddChildUserId: string | null
 }) {
   if (action.blocked === true) {
     if (!cache.hasFullVersion) {
@@ -28,6 +29,41 @@ export async function dispatchUpdateCategoryTemporarilyBlocked ({ action, cache
     }
   }
 
+  const categoryEntryUnsafe = await cache.database.category.findOne({
+    where: {
+      familyId: cache.familyId,
+      categoryId: action.categoryId
+    },
+    transaction: cache.transaction,
+    attributes: ['childId', 'temporarilyBlocked', 'temporarilyBlockedEndTime']
+  })
+
+  if (!categoryEntryUnsafe) {
+    throw new Error('invalid category id for updating temporarily blocking')
+  }
+
+  const categoryEntry = {
+    childId: categoryEntryUnsafe.childId,
+    temporarilyBlocked: categoryEntryUnsafe.temporarilyBlocked,
+    temporarilyBlockedEndTime: categoryEntryUnsafe.temporarilyBlockedEndTime
+  }
+
+  if (fromChildSelfLimitAddChildUserId !== null) {
+    if (fromChildSelfLimitAddChildUserId !== categoryEntry.childId) {
+      throw new Error('can not update temporarily blocking as child for other users')
+    }
+
+    if (action.endTime === undefined || !action.blocked) {
+      throw new Error('the child may only enable a temporarily blocking')
+    }
+
+    if (categoryEntry.temporarilyBlocked) {
+      if (action.endTime < categoryEntry.temporarilyBlockedEndTime || categoryEntry.temporarilyBlockedEndTime === 0) {
+        throw new Error('the child may not reduce the temporarily blocking')
+      }
+    }
+  }
+
   const [affectedRows] = await cache.database.category.update({
     temporarilyBlocked: action.blocked,
     temporarilyBlockedEndTime: action.blocked ? (action.endTime ?? 0) : 0

src/function/sync/apply-actions/index.ts

@@ -22,6 +22,7 @@ import { ClientPushChangesRequest } from '../../../api/schema'
 import { isSerializedAppLogicAction, isSerializedChildAction, isSerializedParentAction } from '../../../api/validator'
 import { VisibleConnectedDevicesManager } from '../../../connected-devices'
 import { Database } from '../../../database'
+import { UserFlags } from '../../../model/userflags'
 import { EventHandler } from '../../../monitoring/eventhandler'
 import { WebsocketApi } from '../../../websocket'
 import { notifyClientsAboutChanges } from '../../websocket'
@@ -106,6 +107,8 @@ export const applyActionsFromDevice = async ({ database, request, websocket, con
         // update the next sequence number
         nextSequenceNumber = action.sequenceNumber + 1
 
+        let isChildLimitAdding = false
+
         if (action.type === 'parent') {
           if (action.integrity === 'device') {
             const deviceEntryUnsafe2 = await cache.database.device.findOne({
@@ -125,6 +128,9 @@ export const applyActionsFromDevice = async ({ database, request, websocket, con
 
             // this ensures that the parent exists
             await cache.getSecondPasswordHashOfParent(action.userId)
+          } else if (action.integrity === 'childDevice') {
+            // will be checked later
+            isChildLimitAdding = true
           } else {
             const parentSecondHash = await cache.getSecondPasswordHashOfParent(action.userId)
 
@@ -191,19 +197,68 @@ export const applyActionsFromDevice = async ({ database, request, websocket, con
             throw new Error('invalid action' + action.encodedAction)
           }
 
-          eventHandler.countEvent('applyActionsFromDevice action:' + parsedSerializedAction.type)
+          eventHandler.countEvent('applyActionsFromDevice, childAddLimit: ' + isChildLimitAdding + ' action:' + parsedSerializedAction.type)
 
           const parsedAction = parseParentAction(parsedSerializedAction)
 
           try {
-            await dispatchParentAction({
-              action: parsedAction,
-              cache,
-              parentUserId: action.userId,
-              sourceDeviceId: deviceEntry.deviceId
-            })
+            if (isChildLimitAdding) {
+              const deviceEntryUnsafe2 = await cache.database.device.findOne({
+                attributes: ['currentUserId'],
+                where: {
+                  familyId: cache.familyId,
+                  deviceId: deviceEntry.deviceId,
+                  currentUserId: action.userId
+                },
+                transaction: cache.transaction
+              })
+
+              if (!deviceEntryUnsafe2) {
+                throw new Error('illegal state')
+              }
+
+              const deviceUserId = deviceEntryUnsafe2.currentUserId
+
+              if (!deviceUserId) {
+                throw new Error('no device user id set but child add self limit action requested')
+              }
+
+              const deviceUserEntryUnsafe = await cache.database.user.findOne({
+                attributes: ['flags'],
+                where: {
+                  familyId: cache.familyId,
+                  userId: deviceUserId,
+                  type: 'child'
+                },
+                transaction: cache.transaction
+              })
+
+              if (!deviceUserEntryUnsafe) {
+                throw new Error('no child user found for child limit adding action')
+              }
+
+              if ((parseInt(deviceUserEntryUnsafe.flags, 10) & UserFlags.ALLOW_SELF_LIMIT_ADD) !== UserFlags.ALLOW_SELF_LIMIT_ADD) {
+                throw new Error('child add limit action found but not allowed')
+              }
+
+              await dispatchParentAction({
+                action: parsedAction,
+                cache,
+                parentUserId: action.userId,
+                sourceDeviceId: deviceEntry.deviceId,
+                fromChildSelfLimitAddChildUserId: deviceUserId
+              })
+            } else {
+              await dispatchParentAction({
+                action: parsedAction,
+                cache,
+                parentUserId: action.userId,
+                sourceDeviceId: deviceEntry.deviceId,
+                fromChildSelfLimitAddChildUserId: null
+              })
+            }
           } catch (ex) {
-            eventHandler.countEvent('applyActionsFromDevice actionWithError:' + parsedSerializedAction.type)
+            eventHandler.countEvent('applyActionsFromDeviceWithError, childAddLimit: ' + isChildLimitAdding + ' action:' + parsedSerializedAction.type)
 
             throw ex
           }

src/function/sync/get-server-data-status.ts

@@ -17,6 +17,7 @@
 
 import { difference, filter, intersection } from 'lodash'
 import * as Sequelize from 'sequelize'
+import { config } from '../../config'
 import { Database } from '../../database'
 import { getStatusMessage } from '../../function/statusmessage'
 import { ClientDataStatus } from '../../object/clientdatastatus'
@@ -58,7 +59,9 @@ export const generateServerDataStatus = async ({ database, clientStatus, familyI
   }
 
   let result: ServerDataStatus = {
-    fullVersion: familyEntry.hasFullVersion ? parseInt(familyEntry.fullVersionUntil, 10) : 0,
+    fullVersion: config.alwaysPro ? 1 : (
+      familyEntry.hasFullVersion ? parseInt(familyEntry.fullVersionUntil, 10) : 0
+    ),
     message: await getStatusMessage({ database, transaction }) || undefined
   }
 

src/model/userflags.ts

@@ -17,5 +17,6 @@
 
 export const UserFlags = {
   RESTRICT_VIEWING_TO_PARENTS: 1,
-  ALL_FLAGS: 1
+  ALLOW_SELF_LIMIT_ADD: 2,
+  ALL_FLAGS: 1 | 2
 }

src/util/category.ts

@@ -0,0 +1,40 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2020 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+export function getCategoryWithParentCategories (categories: Array<{ categoryId: string, parentCategoryId: string }>, startCategoryId: string): Array<string> {
+  const categoryById = new Map<string, { categoryId: string, parentCategoryId: string }>()
+
+  categories.forEach((category) => categoryById.set(category.categoryId, category))
+
+  const startCategory = categoryById.get(startCategoryId)
+
+  if (!startCategory) {
+    throw new Error('start category not found')
+  }
+
+  const categoryIds = [ startCategoryId ]
+
+  let currentCategory = categoryById.get(startCategory.parentCategoryId)
+
+  while (currentCategory !== undefined && categoryIds.indexOf(currentCategory.categoryId) === -1) {
+    categoryIds.push(currentCategory.categoryId)
+
+    currentCategory = categoryById.get(currentCategory.parentCategoryId)
+  }
+
+  return categoryIds
+}