bbj/src/db.py

"""
This module contains all of the interaction with the SQLite database. It
doesnt hold a connection itself, rather, a connection is passed in as
an argument to all the functions and is maintained by CherryPy's threading
system. This is clunky but fuck it, it works (for now at least).

All post and thread data are stored in the database without formatting.
This is questionable, as it causes formatting to be reapplied with each
pull for the database. Im debating whether posts should be stored in all
4 formats, or if maybe a caching system should be used.

The database, nor ANY part of the server, DOES NOT HANDLE PASSWORD HASHING!
Clients are responsible for creation of hashes and passwords should never
be sent unhashed. User registration and update endpoints will not accept
hashes that != 64 characters in length, as a basic measure to enforce the
use of sha256.
"""

# TODO: Move methods from requiring an author id to requiring a
# database user object: these user objects are always resolved on
# incoming requests and re-resolving them from their ID is wasteful.

from src.exceptions import BBJParameterError, BBJUserError
from src.utils import ordered_keys, schema_values
from src import schema
from uuid import uuid1
from time import time
import json
import os

anon = None


def message_feed(connection, time):
    """
    Returns a special object representing all activity on the board since
    the argument `time`, a unix/epoch timestamp.

    {
        "threads": {
            "thread_id": {
                ...thread object
            },
            ...more thread_id/object pairs
        },
        "messages": [...standard message object array sorted by date]
    }

    The message objects in "messages" are the same objects returned
    in threads normally. They each have a thread_id parameter, and
    you can access metadata for these threads by the "threads" object
    which is also provided.

    The "messages" array is already sorted by submission time, newest
    first. The order in the threads object is undefined and you should
    instead use their `last_mod` attribute if you intend to list them
    out visually.
    """
    threads = {
        obj[0]: schema.thread(*obj) for obj in
            connection.execute(
                "SELECT * FROM threads WHERE last_mod > ?", (time,))
    }

    messages = list()
    for thread in threads.values():
        messages += [
            schema.message(*obj) for obj in
                connection.execute("""
                SELECT * FROM messages WHERE thread_id = ?
                    AND created > ? """, (thread["thread_id"], time))
        ]

    return {
        "threads": threads,
        "messages": sorted(messages, key=lambda m: m["created"], reverse=True)
    }


### THREADS ###

def thread_get(connection, thread_id, messages=True, op_only=False):
    """
    Fetch the thread_id from the database. Formatting is be handled
    elsewhere.

    MESSAGES, if False, will omit the inclusion of a thread's messages
    and only get its metadata, such as title, author, etc.
    """
    c = connection.cursor()
    thread = c.execute(
        "SELECT * FROM threads WHERE thread_id = ?",
        (thread_id,)).fetchone()

    if not thread:
        raise BBJParameterError("Thread does not exist.")
    thread = schema.thread(*thread)

    if messages or op_only:
        query = "SELECT * FROM messages WHERE thread_id = ? %s"
        c.execute(query % (
            "AND post_id = 0" if op_only else "ORDER BY post_id"
        ), (thread_id,))
        # create a list where each post_id matches its list[index]
        thread["messages"] = [schema.message(*values) for values in c.fetchall()]

    return thread


def thread_index(connection, include_op=False):
    """
    Return a list with each thread, ordered by the date they
    were last modifed (which could be when it was submitted
    or its last reply)

    Please note that thred["messages"] is omitted.
    """
    c = connection.execute("""
        SELECT thread_id FROM threads
          ORDER BY last_mod DESC""")

    threads = [
        thread_get(connection, obj[0], False, include_op)
            for obj in c.fetchall()
    ]
    return threads


def thread_set_pin(connection, thread_id, pin_bool):
    """
    Set the pinned status of thread_id to pin_bool.
    """
    # can never be too sure :^)
    pin_bool = bool(pin_bool)
    connection.execute("""
        UPDATE threads SET
        pinned = ?
        WHERE thread_id = ?
    """, (pin_bool, thread_id))
    connection.commit()
    return pin_bool


def thread_create(connection, author_id, body, title, send_raw=False):
    """
    Create a new thread and return it.
    """
    validate([
        ("body",  body),
        ("title", title)
    ])

    now = time()
    thread_id = uuid1().hex
    scheme = schema.thread(
        thread_id, author_id, title,
        now, now, -1, # see below for why i set -1 instead of 0
        False, author_id)

    connection.execute("""
        INSERT INTO threads
        VALUES (?,?,?,?,?,?,?,?)
    """, schema_values("thread", scheme))
    connection.commit()
    # the thread is initially commited with reply_count -1 so that i can
    # just pass the message to the reply method, instead of duplicating
    # its code here. It then increments to 0.
    thread_reply(connection, author_id, thread_id, body, send_raw, time_override=now)
    # fetch the new thread out of the database instead of reusing the returned
    # objects, just to be 100% sure what is returned is what was committed
    return thread_get(connection, thread_id)


def thread_reply(connection, author_id, thread_id, body, send_raw=False, time_override=None):
    """
    Submit a new reply for thread_id. Return the new reply object.

    time_overide can be a time() value to set as the new message time.
    This is to keep post_id 0 in exact parity with its parent thread.
    """
    validate([("body", body)])

    now = time_override or time()
    thread = thread_get(connection, thread_id, messages=False)
    thread["reply_count"] += 1
    count = thread["reply_count"]
    scheme = schema.message(
        thread_id, count, author_id,
        now, False, body, bool(send_raw))

    connection.execute("""
        INSERT INTO messages
        VALUES (?,?,?,?,?,?,?)
    """, schema_values("message", scheme))

    connection.execute("""
        UPDATE threads SET
        reply_count = ?,
        last_author = ?,
        last_mod = ?
        WHERE thread_id = ?
    """, (count, author_id, now, thread_id))

    connection.commit()
    return scheme


def message_delete(connection, author, thread_id, post_id):
    """
    'Delete' a message from a thread. If the message being
    deleted is an OP [post_id == 0], delete the whole thread.

    Requires an author id, the thread_id, and post_id.
    The same rules for edits apply to deletions: the same
    error objects are returned. Returns True on success.
    """
    message_edit_query(connection, author, thread_id, post_id)

    if post_id == 0:
        # NUKE NUKE NUKE NUKE
        connection.execute("DELETE FROM threads WHERE thread_id = ?", (thread_id,))
        connection.execute("DELETE FROM messages WHERE thread_id = ?", (thread_id,))

    else:
        connection.execute("""
            UPDATE messages SET
            author = ?,
            body = ?,
            edited = ?
            WHERE thread_id = ?
            AND post_id = ?
        """, (anon["user_id"], "[deleted]", False, thread_id, post_id))
        # DONT deincrement the reply_count of this thread,
        # or even delete the message itself. This breaks
        # balance between post_id and the post's index when
        # the thread is served with the messages in an array.
        # *actually* deleting messages, which would be ideal,
        # would increase implementation complexity for clients.
        # IMO, that is not worth it. Threads are fair game.

    connection.commit()
    return True


def message_edit_query(connection, author, thread_id, post_id):
    """
    Perform all the neccesary sanity checks required to edit a post
    and then return the requested message object without any changes.
    """
    user = user_resolve(connection, author)
    thread = thread_get(connection, thread_id)

    try: message = thread["messages"][post_id]
    except IndexError:
        raise BBJParameterError("post_id out of bounds for requested thread")

    if not user["is_admin"]:
        if not user["user_id"] == message["author"]:
            raise BBJUserError(
                "non-admin attempt to edit another user's message")

        elif (time() - message["created"]) > 86400:
            raise BBJUserError(
                "message is too old to edit (24hr limit)")

    return message


def message_edit_commit(
        connection,
        author_id,
        thread_id,
        post_id,
        new_body,
        send_raw=None,
        set_display=True):
    """
    Attempt to commit new_body, and optionally send_raw (default doesnt modify),
    to the existing message.

    The send_raw and set_display paramter may be specified as the NoneType
    to leave its old value intact. Otherwise its given value is coerced to
    a boolean and is set on the message. send_raw when not explicitly specified
    will keep its old value, while an unspecified set_display will set it to True.

    new_body may also be a NoneType to retain its old value.

    Touches base with message_edit_query first. Returns
    the newly updated message object.
    """
    message = message_edit_query(connection, author_id, thread_id, post_id)

    if new_body == None:
        new_body = message["body"]
    validate([("body", new_body)])

    if send_raw == None:
        send_raw = message["send_raw"]
    else:
        send_raw = bool(send_raw)

    if set_display == None:
        display = message["edited"]
    else:
        display = bool(set_display)

    connection.execute("""
        UPDATE messages SET
        body = ?,
        send_raw = ?,
        edited = ?
        WHERE thread_id = ?
          AND post_id = ?
    """, (new_body, send_raw, display, thread_id, post_id))
    connection.commit()

    message["body"] = new_body
    message["send_raw"] = send_raw
    message["edited"] = display

    return message


### USERS ####


def user_register(connection, user_name, auth_hash):
    """
    Registers a new user into the system. Ensures the user
    is not already registered, and that the hash and name
    meet the requirements of their respective sanity checks
    """
    validate([
        ("user_name", user_name),
        ("auth_hash", auth_hash)
    ])

    if user_resolve(connection, user_name):
        raise BBJUserError("Username already registered")

    scheme = schema.user_internal(
        uuid1().hex, user_name, auth_hash,
        "", "", 0, False, time())

    connection.execute("""
         INSERT INTO users
         VALUES (?,?,?,?,?,?,?,?)
    """, schema_values("user", scheme))

    connection.commit()
    return scheme


def user_resolve(connection, name_or_id, externalize=False, return_false=True):
    """
    Accepts a name or id and returns the full user object for it.

    EXTERNALIZE determines whether to strip the object of private data.

    RETURN_FALSE determines whether to raise an exception or just
    return bool False if the user doesn't exist
    """
    user = connection.execute("""
         SELECT * FROM users
         WHERE user_name = ?
            OR user_id = ? """,
        (name_or_id, name_or_id)).fetchone()

    if user:
        user = schema.user_internal(*user)
        if externalize:
            return user_externalize(user)
        return user

    if return_false:
        return False
    raise BBJParameterError(
        "Requested user element ({})"
        " is not registered".format(name_or_id))


def user_update(connection, user_object, parameters):
    """
    Accepts new parameters for a user object and then
    commits the changes to the database. Parameters
    that are not suitable for editing (like user_id
    and anything undefined) are ignored completely.
    """
    user_id = user_object["user_id"]
    for key in ("user_name", "auth_hash", "quip", "bio", "color"):
        value = parameters.get(key)
        # bool(0) == False hur hur hurrrrrr ::drools::
        if value == 0 or value:
            validate([(key, value)])
            if key == "auth_hash":
                value = value.lower()
            user_object[key] = value

    values = ordered_keys(user_object,
        "user_name", "quip", "auth_hash",
        "bio", "color", "user_id")

    connection.execute("""
        UPDATE users SET
        user_name = ?, quip = ?,
        auth_hash = ?, bio = ?,
        color = ? WHERE user_id = ?
        """, values)

    connection.commit()
    return user_resolve(connection, user_id)


def set_admins(connection, users):
    """
    Set the server admins to be the content of `users`.
    Any other users that previously had admin rights
    not included in `users` will have their privledge
    revoked.
    """
    connection.execute("UPDATE users SET is_admin = 0")
    for user in users:
        connection.execute(
            "UPDATE users SET is_admin = 1 WHERE user_name = ?",
            (user,))
    connection.commit()


def user_externalize(user_object):
    """
    Cleanse private/internal data from a user object
    and make it suitable to serve.
    """
    # only secret value right now is the auth_hash,
    # but this may change in the future
    for key in ("auth_hash",):
        user_object.pop(key)
    return user_object


### SANITY CHECKS ###

def contains_nonspaces(string):
    return any([char in string for char in "\t\n\r\x0b\x0c"])


def validate(keys_and_values):
    """
    The line of defense against garbage user input.

    Recieves an iterable containing iterables, where [0]
    is a string representing the value type, and [1]
    is the value to compare against a set of rules for
    it's type. The function returns the boolean value
    True when everything is okay, or raises a BBJException
    to be handled by higher levels of the program if something
    is wrong (immediately stopping execution at the db level)
    """
    for key, value in keys_and_values:

        if key == "user_name":
            if not value:
                raise BBJUserError(
                    "Username may not be empty.")

            elif contains_nonspaces(value):
                raise BBJUserError(
                    "Username cannot contain whitespace characters besides spaces.")

            elif not value.strip():
                raise BBJUserError(
                    "Username must contain at least one non-space character")

            elif len(value) > 24:
                raise BBJUserError(
                    "Username is too long (max 24 chars)")

        elif key == "auth_hash":
            if not value:
                raise BBJParameterError(
                    "auth_hash may not be empty")

            elif len(value) != 64:
                raise BBJParameterError(
                    "Client error: invalid SHA-256 hash.")

        elif key == "quip":
            if contains_nonspaces(value):
                raise BBJUserError(
                    "Quip cannot contain whitespace characters besides spaces.")

            elif len(value) > 120:
                raise BBJUserError(
                    "Quip is too long (max 120 chars)")

        elif key == "bio":
            if len(value) > 4096:
                raise BBJUserError(
                    "Bio is too long (max 4096 chars)")

        elif key == "title":
            if not value:
                raise BBJUserError(
                    "Title cannot be empty")

            elif contains_nonspaces(value):
                raise BBJUserError(
                    "Titles cannot contain whitespace characters besides spaces.")

            elif not value.strip():
                raise BBJUserError(
                    "Title must contain at least one non-space character")

            elif len(value) > 120:
                raise BBJUserError(
                    "Title is too long (max 120 chars)")

        elif key == "body":
            if not value:
                raise BBJUserError(
                    "Post body cannot be empty")


        elif key == "color":
            if value in range(0, 7):
                continue
            raise BBJParameterError(
                "Color specification out of range (int 0-6)")

    return True