update dependencies

docs/api/admin.md

@@ -100,7 +100,10 @@ request properties: ``purchaseToken``, ``purchaseId`` and ``dryRun``
 
 - ``purchasetoken`` is a string which the client shows at the purchase screen
 - ``purchaseId`` is the ID that is used at the bill
-- ``dryRun`` is a boolean; setting true will skip the actual unlocking
+- ``dryRun`` is a boolean
+  - setting true will skip the actual unlocking
+  - false will add a four week tolerance to the token expiry to permit checking now and unlocking later
+- ``type`` is a string and must be ``year``, ``month`` or ``unpaid14``
 
 ### response
 
@@ -121,6 +124,7 @@ The response contains the following properties:
   - optional object
   - should be shown to the support
 - ``wasAlreadyExecuted`` (boolean, set if and only if ``ok`` is true)
+- ``mail`` (string, set if and only if ``ok`` is true)
 
 If the request was malformed: HTTP status code 400 Bad Request
 

docs/api/purchase.md

@@ -23,8 +23,7 @@ On a invalid request body: HTTP status code 400 Bad request
 
 On a invalid auth token: HTTP status code 401 Unauthorized
 
-On success: a JSON object with the property ``canDoPurchase`` (string), ``googlePlayPublicKey`` (string, base64)
-and ``permitDebts`` (boolean, optional, default false).
+On success: a JSON object with the property ``canDoPurchase`` (string) and ``googlePlayPublicKey`` (string, base64)
 
 possible values of ``canDoPurchase``:
 
@@ -34,26 +33,6 @@ possible values of ``canDoPurchase``:
 
 The ``googlePlayPublicKey`` is the key by which purchases using google play should be signed.
 
-## POST /purchase/finish-purchase-by-debts
-
-Use this to unlock without payment. Limitations apply.
-
-### request
-
-see [this JSON schema](../schema/candopurchaserequest.md)
-
-Note that ``type`` is not used at all.
-
-### response
-
-On a invalid request body: HTTP status code 400 Bad request
-
-On a invalid auth token: HTTP status code 401 Unauthorized
-
-If not granted: HTTP status code 409 Conflict
-
-On success: HTTP status code 200
-
 ## POST /purchase/finish-purchase-by-google-play
 
 Use this to report a purchase to the server/ unlock all features after a purchase

package-lock.json

@@ -285,15 +285,15 @@
       }
     },
     "node_modules/@eslint/config-array/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "dev": true,
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@eslint/config-array/node_modules/minimatch": {
@@ -959,9 +959,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
       "dev": true,
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -1198,9 +1198,9 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
       "dependencies": {
         "bytes": "~3.1.2",
         "content-type": "~1.0.5",
@@ -1269,9 +1269,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
       "dev": true,
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -1881,15 +1881,15 @@
       }
     },
     "node_modules/eslint/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "dev": true,
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/eslint/node_modules/eslint-visitor-keys": {
@@ -2170,9 +2170,9 @@
       "dev": true
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw==",
       "funding": [
         {
           "type": "github",
@@ -2230,9 +2230,9 @@
       }
     },
     "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-      "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
@@ -4757,9 +4757,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.21",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.21.tgz",
+      "integrity": "sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==",
       "optional": true,
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
@@ -5590,9 +5590,9 @@
           "dev": true
         },
         "brace-expansion": {
-          "version": "5.0.6",
-          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-          "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+          "version": "5.0.8",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+          "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
           "dev": true,
           "requires": {
             "balanced-match": "^4.0.2"
@@ -6106,9 +6106,9 @@
       },
       "dependencies": {
         "brace-expansion": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-          "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+          "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
           "dev": true,
           "requires": {
             "balanced-match": "^1.0.0"
@@ -6271,9 +6271,9 @@
       }
     },
     "body-parser": {
-      "version": "1.20.5",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
-      "integrity": "sha512-3grm+/2tUOvu2cjJkvsIxrv/wVpfXQW4PsQHYm7yk4vfpu7Ekl6nEsYBoJUL6qDwZUx8wUhQ8tR2qz+ad9c9OA==",
+      "version": "1.20.6",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
       "requires": {
         "bytes": "~3.1.2",
         "content-type": "~1.0.5",
@@ -6327,9 +6327,9 @@
       }
     },
     "brace-expansion": {
-      "version": "1.1.13",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.13.tgz",
-      "integrity": "sha512-9ZLprWS6EENmhEOpjCYW2c8VkmOvckIJZfkr7rBW6dObmfgJ/L1GpSYW5Hpo9lDz4D1+n0Ckz8rU7FwHDQiG/w==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
       "dev": true,
       "requires": {
         "balanced-match": "^1.0.0",
@@ -6737,9 +6737,9 @@
           "dev": true
         },
         "brace-expansion": {
-          "version": "5.0.6",
-          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-          "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+          "version": "5.0.8",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+          "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
           "dev": true,
           "requires": {
             "balanced-match": "^4.0.2"
@@ -6971,9 +6971,9 @@
       "dev": true
     },
     "fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ=="
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.4.tgz",
+      "integrity": "sha512-8JnbkQ4juDyvYs4mgFGQqg4yCYtFDtUtmp2QIQq11ZZe5CFQ5wcqm1rqDgAh/QdMySuBnPzMUiJUNZG5N/AiQw=="
     },
     "fastestsmallesttextencoderdecoder": {
       "version": "1.0.22",
@@ -7018,9 +7018,9 @@
       },
       "dependencies": {
         "brace-expansion": {
-          "version": "2.0.3",
-          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.3.tgz",
-          "integrity": "sha512-MCV/fYJEbqx68aE58kv2cA/kiky1G8vux3OR6/jbS+jIMe/6fJWa0DTzJU7dqijOWYwHi1t29FlfYI9uytqlpA==",
+          "version": "2.1.2",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+          "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
           "requires": {
             "balanced-match": "^1.0.0"
           }
@@ -8762,9 +8762,9 @@
       }
     },
     "tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.21",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.21.tgz",
+      "integrity": "sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==",
       "optional": true,
       "requires": {
         "@isaacs/fs-minipass": "^4.0.0",

src/api/admin.ts

@@ -141,7 +141,8 @@ export const createAdminRouter = ({ database, websocket, eventHandler }: {
         typeof req.body !== 'object' ||
         typeof req.body.purchaseToken !== 'string' ||
         typeof req.body.purchaseId !== 'string' ||
-        typeof req.body.dryRun !== 'boolean'
+        typeof req.body.dryRun !== 'boolean' ||
+        typeof req.body.type !== 'string'
       ) {
         throw new BadRequest()
       }
@@ -149,8 +150,13 @@ export const createAdminRouter = ({ database, websocket, eventHandler }: {
       const purchaseToken: string = req.body.purchaseToken
       const purchaseId: string = req.body.purchaseId
       const dryRun: boolean = req.body.dryRun
+      const type: string = req.body.type
 
-      const tokenContent = await verifyIdentitifyToken(purchaseToken)
+      if (type !== 'month' && type !== 'year' && type !== 'unpaid14') {
+        throw new BadRequest()
+      }
+
+      const tokenContent = await verifyIdentitifyToken(purchaseToken, dryRun)
 
       if (tokenContent.purpose !== 'purchase') {
         res.json({ ok: false, error: 'token invalid', detail: 'wrong purpose' })
@@ -259,7 +265,7 @@ export const createAdminRouter = ({ database, websocket, eventHandler }: {
             await addPurchase({
               database,
               familyId: tokenContent.familyId,
-              type: 'year',
+              type,
               service: 'directpurchase',
               transactionId: purchaseId,
               websocket,

src/api/purchase.ts

@@ -37,16 +37,16 @@ export const createPurchaseRouter = ({ database, websocket }: {
   const router = Router()
 
   router.post('/can-do-purchase', json(), async (req, res, next) => {
-    if (!areGooglePlayPaymentsPossible) {
-      res.json({ canDoPurchase: 'no because not supported by the server' })
-      return
-    }
-
     try {
       if (!isCanDoPurchaseRequest(req.body)) {
         throw new BadRequest()
       }
 
+      if (req.body.type === 'googleplay' && !areGooglePlayPaymentsPossible) {
+        res.json({ canDoPurchase: 'no because not supported by the server' })
+        return
+      }
+
       const result: boolean = await database.transaction(async (transaction) => {
         const familyEntry = await requireFamilyEntry({
           database,

src/database/purchase.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2022 Jonas Lochmann
+ * Copyright (C) 2019 - 2026 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -23,7 +23,7 @@ export interface PurchaseAttributes {
   familyId: string
   service: 'googleplay' | 'directpurchase'
   transactionId: string
-  type: 'month' | 'year'
+  type: 'month' | 'year' | 'unpaid14'
   loggedAt: string
   previousFullVersionEndTime: string
   newFullVersionEndTime: string
@@ -44,7 +44,7 @@ export const attributes: SequelizeAttributes<PurchaseAttributes> = {
     type: Sequelize.STRING,
     primaryKey: true
   },
-  type: createEnumColumn(['month', 'year']),
+  type: createEnumColumn(['month', 'year', 'unpaid14']),
   loggedAt: { ...timestampColumn },
   previousFullVersionEndTime: { ...timestampColumn },
   newFullVersionEndTime: { ...timestampColumn }

src/function/purchase/add-purchase.ts

@@ -21,13 +21,14 @@ import { notifyClientsAboutChangesDelayed } from '../../function/websocket'
 import { WebsocketApi } from '../../websocket'
 
 const day = 1000 * 60 * 60 * 24
+const week = day * 7
 const month = day * 31
 const year = day * 366
 
 export const addPurchase = async ({ database, familyId, type, service, transactionId, websocket, transaction }: {
   database: Database
   familyId: string
-  type: 'month' | 'year'
+  type: 'month' | 'year' | 'unpaid14'
   service: 'googleplay' | 'directpurchase'
   transactionId: string
   websocket: WebsocketApi
@@ -59,16 +60,39 @@ export const addPurchase = async ({ database, familyId, type, service, transacti
   const previousFullVersionEndTime = familyEntry.fullVersionUntil
   const previousFullVersionDebts = parseInt(familyEntry.fullVersionDebts, 10)
 
-  const typeDuration = type === 'year' ? year : month
+  if (type === 'month' || type === 'year') {
+    const typeDuration = type === 'year' ? year : month
 
-  if (typeDuration > previousFullVersionDebts) {
-    const newFullVersionUntil = Math.max(parseInt(familyEntry.fullVersionUntil, 10), Date.now()) + typeDuration - previousFullVersionDebts
+    if (typeDuration > previousFullVersionDebts) {
+      const newFullVersionUntil = Math.max(parseInt(familyEntry.fullVersionUntil, 10), Date.now()) + typeDuration - previousFullVersionDebts
+
+      familyEntry.fullVersionUntil = newFullVersionUntil.toString(10)
+      familyEntry.fullVersionDebts = '0'
+      familyEntry.hasFullVersion = true
+    } else {
+      familyEntry.fullVersionDebts = (previousFullVersionDebts - typeDuration).toString(10)
+    }
+  } else if (type === 'unpaid14') {
+    const debtsAdd = 2 * week
+    const debtsMax = 3 * week
+
+    const newDebts = Math.min(debtsMax, previousFullVersionDebts + debtsAdd)
+
+    if (newDebts <= previousFullVersionDebts) {
+      // do not save anything
+
+      return
+    }
+
+    const durationToAdd = newDebts - previousFullVersionDebts
+
+    const newFullVersionUntil = Math.max(parseInt(familyEntry.fullVersionUntil, 10), Date.now()) + durationToAdd
 
     familyEntry.fullVersionUntil = newFullVersionUntil.toString(10)
-    familyEntry.fullVersionDebts = '0'
+    familyEntry.fullVersionDebts = newDebts.toString(10)
     familyEntry.hasFullVersion = true
   } else {
-    familyEntry.fullVersionDebts = (previousFullVersionDebts - typeDuration).toString(10)
+    throw new Error()
   }
 
   await familyEntry.save({ transaction })

src/function/sync/apply-actions/dispatch-parent-action/updatetimelimitrule.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2024 Jonas Lochmann
+ * Copyright (C) 2019 - 2026 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -67,6 +67,9 @@ export async function dispatchUpdateTimelimitRule ({
     const wasSessionDurationLimitationEnabled =
       ruleEntry.sessionPauseMilliseconds > 0 && ruleEntry.sessionDurationMilliseconds > 0
 
+    const isSessionDurationLimitationEnabled =
+      action.sessionPauseMilliseconds > 0 && action.sessionDurationMilliseconds > 0
+
     const countOldAffectedDays = Array(7)
       .fill(0)
       .reduce((sum, _, index) => sum + ((ruleEntry.dayMaskAsBitmask >> index) & 1), 0)
@@ -78,6 +81,7 @@ export async function dispatchUpdateTimelimitRule ({
       action.start <= ruleEntry.startMinuteOfDay &&
       action.end >= ruleEntry.endMinuteOfDay &&
       (!wasSessionDurationLimitationEnabled || (
+          isSessionDurationLimitationEnabled &&
           action.sessionDurationMilliseconds <= ruleEntry.sessionDurationMilliseconds &&
           action.sessionPauseMilliseconds >= ruleEntry.sessionPauseMilliseconds
       )) &&

src/function/sync/get-server-data-status/campaign.ts

@@ -0,0 +1,64 @@
+/*
+ * server component for the TimeLimit App
+ * Copyright (C) 2019 - 2026 Jonas Lochmann
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, version 3 of the License.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import { createHash } from 'crypto'
+
+const updateMessage =
+  'Please update the TimeLimit App to the latest release. ' +
+  'In your current version, synchronization and purchases may not work as expected.' +
+  '\n\n' +
+  'Bitte die TimeLimit-App aktualisieren. ' +
+  'Mit der momentan installierten Version kann es zu Einschränkungen bei der Synchronisation und bei Käufen kommen.'
+
+export function getCampaign({ familyId, isClient750OrNewer }: {
+  familyId: string
+  isClient750OrNewer: boolean
+}): string | undefined {
+  const now = Date.now()
+
+  const campaigns = [
+    {
+      enable: !isClient750OrNewer,
+      seed: 'Q05NwM4nyUfiYg6K', // require('crypto').randomBytes(12).toString('base64')
+      startTime: 1784160000000, // new Date('2026-07-16').valueOf()
+      endTime: 1785369600000, // new Date('2026-07-30').valueOf()
+      startPercentage: 0,
+      endPercentage: 10,
+      message: updateMessage,
+    }
+  ]
+
+  for (const campaign of campaigns) {
+    if (!campaign.enable) continue
+    if (now < campaign.startTime) continue
+
+    const progress = Math.min((now - campaign.startTime) / (campaign.endTime - campaign.startTime), 1)
+    const chanceInPercent = campaign.startPercentage + progress * (campaign.endPercentage - campaign.startPercentage)
+
+    const hasher = createHash('SHA3-224')
+
+    hasher.update(campaign.seed, 'base64')
+    hasher.update(familyId)
+
+    const hash = hasher.digest().readUInt32BE(0)
+    const match = hash < chanceInPercent * Math.pow(2, 32) / 100
+
+    if (match) return campaign.message
+  }
+
+  return undefined
+}

src/function/sync/get-server-data-status/index.ts

@@ -22,6 +22,7 @@ import { getStatusMessage } from '../../../function/statusmessage'
 import { ClientDataStatus } from '../../../object/clientdatastatus'
 import { ServerDataStatus } from '../../../object/serverdatastatus'
 import { EventHandler } from '../../../monitoring/eventhandler'
+import { getCampaign } from './campaign'
 import {
   getCategoryAssignedApps, getCategoryBaseDatas, getCategoryDataToSync,
   getRules, getTasks, getUsedTimes
@@ -54,12 +55,18 @@ export const generateServerDataStatus = async ({
   const doesClientSupportDh = clientLevel >= 5
   const doesClientSupportU2f = clientLevel >= 6
   const doesClientSupportPing = clientLevel >= 7
+  const isClient750OrNewer = clientLevel >= 8 // first release in the post gplay time
+
+  const message: string | undefined =
+    await getStatusMessage({ database, transaction }) ||
+    getCampaign({ familyId, isClient750OrNewer }) ||
+    undefined
 
   const result: ServerDataStatus = {
     fullVersion: config.alwaysPro ? 1 : (
       familyEntry.hasFullVersion ? parseInt(familyEntry.fullVersionUntil, 10) : 0
     ),
-    message: await getStatusMessage({ database, transaction }) || undefined,
+    message,
     apiLevel: 9
   }
 

src/util/identity-token.ts

@@ -1,6 +1,6 @@
 /*
  * server component for the TimeLimit App
- * Copyright (C) 2019 - 2022 Jonas Lochmann
+ * Copyright (C) 2019 - 2026 Jonas Lochmann
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -33,12 +33,15 @@ export async function createIdentityToken({ purpose, familyId, userId, mail }: I
     .join('\n')
 }
 
-export async function verifyIdentitifyToken(token: string): Promise<IdentityTokenPayload> {
+export async function verifyIdentitifyToken(token: string, dryRun: boolean): Promise<IdentityTokenPayload> {
   try {
     const { payload } = await jwtVerify(
       Buffer.from(token, 'base64').toString('ascii'),
       getSignSecret(),
-      { algorithms: ['HS512'] }
+      {
+        algorithms: ['HS512'],
+        clockTolerance: dryRun ? 0 : '4w',
+      }
     )
 
     if (!isIdentityTokenPayload(payload)) throw new BadPayloadException()