node-fftcg/backend/db.coffee

# node libraries
bcrypt = (require 'bcrypt')
logger = (require 'logging').default 'db'
path = (require 'path')
sqlite3 = (require 'sqlite3').verbose()

# bruteforce countermeasure
saltRounds = 13

messages =
  empty:    'Empty user name or password'
  hash:     'Failed to process your data, try again later'
  exists:   'User name is already taken'
  noexists: 'Wrong user name or password'
  password: 'Wrong user name or password'
  db:       'Failed to access the database, try again later'

class FFTCGDB
  constructor: (filename, truncate) ->
    @filename = filename

    @db = new sqlite3.Database @filename, (err) =>
      if err
        logger.error err.message

      else
        logger.info "OK open '#{@filename}'"

        @db.run 'PRAGMA foreign_keys = ON;', (err) =>
          logger.error err.message if err

          if truncate == true
            @db.run 'DROP TABLE IF EXISTS users;', (err) =>
              logger.error err.message if err
              @db.run '''
                CREATE TABLE users (
                  user integer PRIMARY KEY,
                  login text NOT NULL COLLATE NOCASE,
                  pwdhash text NOT NULL,
                  settings text,
                  UNIQUE(login)
                );
                ''', (err) =>
                  logger.error err.message if err

                  @db.run 'DROP TABLE IF EXISTS decks;', (err) =>
                    logger.error err.message if err
                    @db.run '''
                      CREATE TABLE decks (
                        deck integer PRIMARY KEY,
                        user integer NOT NULL,
                        json text,
                        FOREIGN KEY (user) REFERENCES users (user)
                          ON DELETE CASCADE
                      );
                      ''', (err) =>
                        logger.error err.message if err

                        @db.run '''INSERT INTO users VALUES(1,'jmm','$2b$13$jgDdHHDWqq1RV6PXxf7aOO6AbxqY6tbxIADyIO0FeXt2BlKQCCMzS',NULL);'''
                        @db.run '''INSERT INTO decks VALUES(1,1,'{"name":"frosch"}');'''
                        @db.run '''INSERT INTO decks VALUES(2,1,'{"name":"frosch2"}');'''

            logger.info 'OK clear'

  close: ->
    logger.info 'shutting down'
    new Promise (resolve, reject) =>
      @db.close (err) ->
        if err
          logger.error "FAIL '#{err.message}'"
          reject null
        else
          logger.warn  "OK close '#{@filename}'"
          resolve null

  validate: (login, password) ->
    defined = (value) -> value? and value isnt ''

    new Promise (resolve, reject) =>
      if (defined login) and (defined password)
        # both are defined
        resolve null
      else
        # no user name or password given
        logger.info "validate: FAIL empty '#{login}' or password"
        reject null

  register: (login, password) ->
    new Promise (resolve, reject) =>
      # validate user input
      @validate login, password
      .then =>
        # hash password
        bcrypt.hash password, saltRounds, (err, hash) =>
          if err
            logger.warn "reg: FAIL hash for '#{login}'"
            reject messages.hash

          else
            # try creating row in users table
            stmt = @db.prepare 'INSERT INTO users (login, pwdhash) VALUES (?, ?)'
            stmt.run [login, hash], (err) ->
              stmt.finalize()
              if err
                logger.warn "reg: FAIL db '#{err.code}' for '#{login}'"
                # user already exists
                reject messages.exists

              else
                logger.info "reg: OK '#{login}'"
                # registration successful
                resolve null

      .catch ->
        reject messages.empty

  login: (login, password) ->
    new Promise (resolve, reject) =>
      # validate user input
      @validate login, password
      .then =>
        # get users table row
        stmt = @db.prepare 'SELECT * FROM users WHERE login = ?'
        stmt.get [login], (err, row) =>
          stmt.finalize()
          if err
            logger.warn "login: FAIL db '#{err.code}' for '#{login}'"
            reject messages.db

          else if not row
            # hash the password for timing attack reasons
            bcrypt.hash password, saltRounds, (err, hash) ->
              logger.debug "login: FAIL nonexistent '#{login}'"
              reject messages.noexists # user doesnt exist

          else
            bcrypt.compare password, row.pwdhash, (err, res) ->
              if err
                logger.warn "login: FAIL hash for '#{login}'"
                reject messages.hash

              if res == true
                logger.debug "login: OK '#{row.login}'"
                # login successful
                resolve row.user

              else
                logger.debug "login: FAIL password for '#{login}'"
                reject messages.password # login failed

      .catch ->
        reject messages.empty

  getUser: (userID) ->
    new Promise (resolve, reject) =>
      # get users table row
      stmt = @db.prepare 'SELECT * FROM users WHERE user = ?'
      stmt.get [userID], (err, row) =>
        stmt.finalize()
        if err
          logger.warn "get: FAIL db '#{err.code}' for '#{userID}'"
          reject messages.db

        else if not row
          logger.debug "get: FAIL nonexistent '#{userID}'"
          reject messages.noexists # user doesnt exist

        else
          resolve
            user: row.user
            login: row.login
            settings: row.settings

  addDeck: (userID, deckCards) ->
    new Promise (resolve, reject) =>
      # try creating row in decks table
      stmt = @db.prepare 'INSERT INTO decks (user, json) VALUES (?, ?)'
      stmt.run [userID, JSON.stringify deckCards], (err) ->
        stmt.finalize()
        if err
          logger.warn "addDeck: FAIL db '#{err.code}' for '#{userID}'"
          reject messages.db

        else
          logger.debug "addDeck: OK '#{@lastID}'"
          resolve @lastID

  modDeck: (userID, deckID, deckCards) ->
    new Promise (resolve, reject) =>
      stmt = @db.prepare 'UPDATE decks SET json = ? WHERE deck = ? AND user = ?'
      stmt.run [JSON.stringify deckCards, deckID, userID], (err) ->
        stmt.finalize()
        if err
          logger.warn "modDeck: FAIL db '#{err.code}' for '#{deckID}'"
          reject messages.db
        else
          logger.debug "modDeck: OK '#{deckID}'"
          resolve deckID

  getDecks: (userID) ->
    new Promise (resolve, reject) =>
      stmt = @db.prepare 'SELECT decks.deck, decks.json FROM decks INNER JOIN users ON decks.user = users.user WHERE users.user = ?'
      stmt.all [userID], (err, rows) ->
        stmt.finalize()
        if err
          logger.warn "getDecks: FAIL db '#{err.code}' for '#{userID}'"
          reject messages.db
        else
          logger.debug "getDecks: OK '#{userID}'"
          resolve (id: row.deck, content: JSON.parse row.json for row, i in rows)

  delDeck: (deckID) ->
    new Promise (resolve, reject) =>
      stmt = @db.prepare 'DELETE FROM decks WHERE deck = ?'
      stmt.run [deckID], (err) ->
        stmt.finalize()
        if err
          logger.warn "delDeck: FAIL db '#{err.code}' for '#{deckID}'"
          reject messages.db
        else
          logger.debug "delDeck: OK '#{deckID}'"
          resolve deckID


module.exports = new FFTCGDB path.resolve(__dirname, 'fftcg.db'), true