""" This module contains all of the interaction with the SQLite database. It doesnt hold a connection itself, rather, a connection is passed in as an argument to all the functions and is maintained by CherryPy's threading system. This is clunky but fuck it, it works (for now at least). (foreword: formatting is not currently implemented but its an important feature needed in the final version) All post and thread data are stored in the database without formatting. This is questionable, as it causes formatting to be reapplied with each pull for the database. Im debating whether posts should be stored in all 4 formats, or if maybe a caching system should be used. The database, nor ANY part of the server, DOES NOT HANDLE PASSWORD HASHING! Clients are responsible for creation of hashes and passwords should never be sent unhashed. User registration and update endpoints will not accept hashes that != 64 characters in length, as a basic measure to enforce the use of sha256. """ from src.exceptions import BBJParameterError, BBJUserError from src.utils import ordered_keys, schema_values from src import schema from uuid import uuid1 from time import time import pickle import json import os anon = None ### THREADS ### def thread_get(connection, thread_id, messages=True): """ Fetch the thread_id from the database. Formatting is be handled elsewhere. MESSAGES, if False, will omit the inclusion of a thread's messages and only get its metadata, such as title, author, etc. """ c = connection.cursor() thread = c.execute( "SELECT * FROM threads WHERE thread_id = ?", (thread_id,)).fetchone() if not thread: raise BBJParameterError("Thread does not exist.") thread = schema.thread(*thread) if messages: c.execute(""" SELECT * FROM messages WHERE thread_id = ? ORDER BY post_id""", (thread_id,)) # create a list where each post_id matches its list[index] thread["messages"] = [schema.message(*values) for values in c.fetchall()] return thread def thread_index(connection): """ Return a list with each thread, ordered by the date they were last modifed (which could be when it was submitted or its last reply) Please note that thred["messages"] is omitted. """ c = connection.execute(""" SELECT thread_id FROM threads ORDER BY last_mod DESC""") threads = [ thread_get(connection, obj[0], messages=False) for obj in c.fetchall() ] return threads def thread_create(connection, author_id, body, title): """ Create a new thread and return it. """ validate([ ("body", body), ("title", title) ]) now = time() thread_id = uuid1().hex scheme = schema.thread( thread_id, author_id, title, now, now, -1) # see below for why i set -1 instead of 0 connection.execute(""" INSERT INTO threads VALUES (?,?,?,?,?,?) """, schema_values("thread", scheme)) connection.commit() thread_reply(connection, author_id, thread_id, body, time_override=now) # fetch the new thread out of the database instead of reusing the returned # objects, just to be 100% sure what is returned is what was committed return thread_get(connection, thread_id) def thread_reply(connection, author_id, thread_id, body, time_override=None): """ Submit a new reply for thread_id. Return the new reply object. time_overide can be time() value to set as the new message time. This is to keep post_id 0 in exact parity with its parent thread. """ validate([("body", body)]) now = time_override or time() thread = thread_get(connection, thread_id, messages=False) count = thread["reply_count"] + 1 scheme = schema.message( thread_id, count, author_id, now, False, body) connection.execute(""" INSERT INTO messages VALUES (?,?,?,?,?,?) """, schema_values("message", scheme)) connection.execute(""" UPDATE threads SET reply_count = ?, last_mod = ? WHERE thread_id = ? """, (count, now, thread_id)) connection.commit() return scheme def message_edit_query(connection, author, thread_id, post_id): """ Perform all the neccesary sanity checks required to edit a post and then return the requested message object without any changes. """ user = user_resolve(connection, author) thread = thread_get(connection, thread_id) try: message = thread["messages"][post_id] except IndexError: raise BBJParameterError("post_id out of bounds for requested thread") if not user["is_admin"]: if not user["user_id"] == message["author"]: raise BBJUserError( "non-admin attempt to edit another user's message") elif (time() - message["created"]) > 86400: raise BBJUserError( "message is too old to edit (24hr limit)") return message def message_edit_commit(connection, author_id, thread_id, post_id, new_body): """ Attempt to commit new_body to the existing message. Touches base with message_edit_query first. Returns the newly updated message object. """ validate([("body", new_body)]) message = message_edit_query(connection, author_id, thread_id, post_id) message["body"] = new_body message["edited"] = True connection.execute(""" UPDATE messages SET body = ?, edited = ? WHERE thread_id = ? AND post_id = ? """, (new_body, True, thread_id, post_id)) connection.commit() return message ### USERS #### def user_register(connection, user_name, auth_hash): """ Registers a new user into the system. Ensures the user is not already registered, and that the hash and name meet the requirements of their respective sanity checks """ validate([ ("user_name", user_name), ("auth_hash", auth_hash) ]) if user_resolve(connection, user_name): raise BBJUserError("Username already registered") scheme = schema.user_internal( uuid1().hex, user_name, auth_hash, "", "", 0, False, time()) connection.execute(""" INSERT INTO users VALUES (?,?,?,?,?,?,?,?) """, schema_values("user", scheme)) connection.commit() return scheme def user_resolve(connection, name_or_id, externalize=False, return_false=True): """ Accepts a name or id and returns the full user object for it. EXTERNALIZE determines whether to strip the object of private data. RETURN_FALSE determines whether to raise an exception or just return bool False if the user doesn't exist """ user = connection.execute(""" SELECT * FROM users WHERE user_name = ? OR user_id = ? """, (name_or_id, name_or_id)).fetchone() if user: user = schema.user_internal(*user) if externalize: return user_externalize(user) return user if return_false: return False raise BBJParameterError( "Requested user element ({})" " is not registered".format(name_or_id)) def user_update(connection, user_object, parameters): """ Accepts new parameters for a user object and then commits the changes to the database. Parameters that are not suitable for editing (like user_id and anything undefined) are ignored completely. """ user_id = user_object["user_id"] for key in ("user_name", "auth_hash", "quip", "bio", "color"): value = parameters.get(key) if value: validate([(key, value)]) user_object[key] = value values = ordered_keys(user_object, "user_name", "quip", "auth_hash", "bio", "color", "user_id") connection.execute(""" UPDATE users SET user_name = ?, quip = ?, auth_hash = ?, bio = ?, color = ? WHERE user_id = ? """, values) connection.commit() return user_resolve(connection, user_id) def user_externalize(user_object): """ Cleanse private/internal data from a user object and make it suitable to serve. """ # only secret value right now is the auth_hash, # but this may change in the future for key in ("auth_hash",): user_object.pop(key) return user_object ### SANITY CHECKS ### def contains_nonspaces(string): return any([char in string for char in "\t\n\r\x0b\x0c"]) def validate(keys_and_values): """ The line of defense against garbage user input. Recieves an iterable containing iterables, where [0] is a string representing the value type, and [1] is the value to compare against a set of rules for it's type. The function returns the boolean value True when everything is okay, or raises a BBJException to be handled by higher levels of the program if something is wrong (immediately stopping execution at the db level) """ for key, value in keys_and_values: if key == "user_name": if not value: raise BBJUserError( "Username may not be empty.") elif contains_nonspaces(value): raise BBJUserError( "Username cannot contain whitespace chars besides spaces.") elif not value.strip(): raise BBJUserError( "Username must contain at least one non-space character") elif len(value) > 24: raise BBJUserError( "Username is too long (max 24 chars)") elif key == "auth_hash": if not value: raise BBJParameterError( "auth_hash may not be empty") elif len(value) != 64: raise BBJParameterError( "Client error: invalid SHA-256 hash.") elif key == "quip": if contains_nonspaces(value): raise BBJUserError( "Quip cannot contain whitespace chars besides spaces.") elif len(value) > 120: raise BBJUserError( "Quip is too long (max 120 chars)") elif key == "bio": if len(value) > 4096: raise BBJUserError( "Bio is too long (max 4096 chars)") elif key == "title": if not value: raise BBJUserError( "Title cannot be empty") elif contains_nonspaces(value): raise BBJUserError( "Titles cannot contain whitespace chars besides spaces.") elif len(value) > 120: raise BBJUserError( "Title is too long (max 120 chars)") elif key == "body": if not value: raise BBJUserError( "Post body cannot be empty") elif key == "color": if color in range(0, 9): continue raise BBJParameterError( "Color specification out of range (int 0-8)") return True