node-fftcg/backend/db.coffee

# node libraries
bcrypt = (require 'bcrypt')
logger = (require 'logging').default 'db'
path = (require 'path')
sqlite3 = (require 'sqlite3').verbose()

# bruteforce countermeasure
saltRounds = 13

messages =
  empty:    'Empty user name or password'
  hash:     'Failed to process your data, try again later'
  exists:   'User name is already taken'
  noexists: 'Wrong user name or password'
  password: 'Wrong user name or password'
  db:       'Failed to access the database, try again later'

class FFTCGDB
  constructor: (filename, truncate) ->
    @filename = filename

    @db = new sqlite3.Database @filename, (err) =>
      if err
        logger.error err.message

      else
        logger.info "OK open '#{@filename}'"

        @db.run 'PRAGMA foreign_keys = ON;', (err) =>
          logger.error err.message if err

          if truncate == true
            @db.run 'DROP TABLE IF EXISTS users;', (err) =>
              logger.error err.message if err
              @db.run '''
                CREATE TABLE users (
                  user integer PRIMARY KEY,
                  login text NOT NULL COLLATE NOCASE,
                  pwdhash text NOT NULL,
                  settings text,
                  UNIQUE(login)
                );
                ''', (err) =>
                  logger.error err.message if err

            @db.run 'DROP TABLE IF EXISTS decks;', (err) =>
              logger.error err.message if err
              @db.run '''
                CREATE TABLE decks (
                  deck integer PRIMARY KEY,
                  user integer NOT NULL,
                  json text,
                  FOREIGN KEY (user) REFERENCES users (user)
                    ON DELETE CASCADE
                );
                ''', (err) =>
                  logger.error err.message if err

            logger.info 'OK clear'

  close: ->
    logger.info 'shutting down'
    new Promise (resolve, reject) =>
      @db.close (err) ->
        if err
          logger.error "FAIL '#{err.message}'"
          reject null
        else
          logger.warn  "OK close '#{@filename}'"
          resolve null

  validate: (login, password) ->
    defined = (value) -> value? and value isnt ''

    new Promise (resolve, reject) =>
      if (defined login) and (defined password)
        # both are defined
        resolve null
      else
        # no user name or password given
        logger.info "validate: FAIL empty '#{login}' or password"
        reject null

  register: (login, password) ->
    new Promise (resolve, reject) =>
      # validate user input
      @validate login, password
      .then =>
        # hash password
        bcrypt.hash password, saltRounds, (err, hash) =>
          if err
            logger.warn "reg: FAIL hash for '#{login}'"
            reject messages.hash

          else
            # try creating row in users table
            stmt = @db.prepare 'INSERT INTO users (login, pwdhash) VALUES (?, ?)'
            stmt.run [login, hash], (err) ->
              stmt.finalize()
              if err
                logger.warn "reg: FAIL db '#{err.code}' for '#{login}'"
                reject messages.exists # user already exists

              else
                logger.info "reg: OK '#{login}'"
                # registration successful
                resolve
                  user: @lastID
                  login: login

      .catch ->
        reject messages.empty

  login: (login, password) ->
    new Promise (resolve, reject) =>
      # validate user input
      @validate login, password
      .then =>
        # get users table row
        stmt = @db.prepare 'SELECT user, login, pwdhash FROM users WHERE login = ?'
        stmt.get [login], (err, row) =>
          stmt.finalize()
          if err
            logger.warn "login: FAIL db '#{err.code}' for '#{login}'"
            reject messages.db

          else if not row
            # hash the password for timing attack reasons
            bcrypt.hash password, saltRounds, (err, hash) ->
              logger.debug "login: FAIL nonexistent '#{login}'"
              reject messages.noexists # user doesnt exist

          else
            bcrypt.compare password, row.pwdhash, (err, res) ->
              if err
                logger.warn "login: FAIL hash for '#{login}'"
                reject messages.hash

              if res == true
                logger.debug "login: OK '#{row.login}'"
                # login successful
                resolve
                  user: row.user
                  login: row.login

              else
                logger.debug "login: FAIL password for '#{login}'"
                reject messages.password # login failed

      .catch ->
        reject messages.empty

  addDeck: (user, deckCards) ->
    new Promise (resolve, reject) =>
      # try creating row in decks table
      stmt = @db.prepare 'INSERT INTO decks (user, json) VALUES (?, ?)'
      stmt.run [user, JSON.stringify deckCards], (err) ->
        stmt.finalize()
        if err
          logger.warn "addDeck: FAIL db '#{err.code}' for '#{user}'"
          reject messages.db

        else
          logger.debug "addDeck: OK '#{@lastID}'"
          resolve @lastID

  modDeck: (deckID, deckCards) ->
    new Promise (resolve, reject) =>
      stmt = @db.prepare 'UPDATE decks SET json = ? WHERE deck = ?'
      stmt.run [deckCards, deckID], (err) ->
        stmt.finalize()
        if err
          logger.warn "modDeck: FAIL db '#{err.code}' for '#{deckID}'"
          reject messages.db
        else
          logger.debug "modDeck: OK '#{deckID}'"
          resolve deckID

  getDecks: (user) ->
    new Promise (resolve, reject) =>
      stmt = @db.prepare 'SELECT decks.deck, decks.json FROM decks INNER JOIN users ON decks.user = users.user WHERE users.user = ?'
      stmt.all [user], (err, rows) ->
        stmt.finalize()
        if err
          logger.warn "getDeck: FAIL db '#{err.code}' for '#{deckID}'"
          reject messages.db
        else
          logger.debug "getDeck: OK '#{deckID}'"
          resolve (id: row.deck, content: JSON.parse row.json for row, i in rows)

  delDeck: (deckID) ->
    new Promise (resolve, reject) =>
      stmt = @db.prepare 'DELETE FROM decks WHERE deck = ?'
      stmt.run [deckID], (err) ->
        stmt.finalize()
        if err
          logger.warn "delDeck: FAIL db '#{err.code}' for '#{deckID}'"
          reject messages.db
        else
          logger.debug "delDeck: OK '#{deckID}'"
          resolve deckID


module.exports = new FFTCGDB path.resolve(__dirname, 'fftcg.db'), true