@actual-app/core 26.3.0

package/src/server/encryption/encryption-internals.electron.ts

@@ -0,0 +1,89 @@
+// @ts-strict-ignore
+import crypto from 'crypto';
+
+import type * as T from './encryption-internals';
+
+const ENCRYPTION_ALGORITHM = 'aes-256-gcm' as const;
+
+export const randomBytes: typeof T.randomBytes = n => {
+  return crypto.randomBytes(n);
+};
+
+export const encrypt: typeof T.encrypt = async (masterKey, value) => {
+  const masterKeyBuffer = masterKey.getValue().raw;
+  // let iv = createKeyBuffer({ numBytes: 12, secret: masterKeyBuffer });
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv(
+    ENCRYPTION_ALGORITHM,
+    masterKeyBuffer,
+    iv,
+  );
+  let encrypted = cipher.update(value);
+  encrypted = Buffer.concat([encrypted, cipher.final()]);
+
+  const authTag = cipher.getAuthTag();
+
+  return {
+    value: encrypted,
+    meta: {
+      keyId: masterKey.getId(),
+      algorithm: ENCRYPTION_ALGORITHM,
+      iv: iv.toString('base64'),
+      authTag: authTag.toString('base64'),
+    },
+  };
+};
+
+export const decrypt: typeof T.decrypt = async (masterKey, encrypted, meta) => {
+  const masterKeyBuffer = masterKey.getValue().raw;
+  const { algorithm, iv: originalIv, authTag: originalAuthTag } = meta;
+  const iv = Buffer.from(originalIv, 'base64');
+  const authTag = Buffer.from(originalAuthTag, 'base64');
+
+  const decipher = crypto.createDecipheriv(algorithm, masterKeyBuffer, iv);
+  decipher.setAuthTag(authTag);
+
+  let decrypted = decipher.update(encrypted);
+  decrypted = Buffer.concat([decrypted, decipher.final()]);
+  return decrypted;
+};
+
+// @ts-expect-error fix me
+export const createKey: typeof T.createKey = async ({ secret, salt }) => {
+  const buffer = createKeyBuffer({ secret, salt });
+  return {
+    raw: buffer,
+    base64: buffer.toString('base64'),
+  };
+};
+
+// @ts-expect-error fix me
+export const importKey: typeof T.importKey = str => {
+  return {
+    raw: Buffer.from(str, 'base64'),
+    base64: str,
+  };
+};
+
+/**
+ * Generates a Buffer of a desired byte length to be used as either an encryption key or an initialization vector.
+ *
+ * @private
+ */
+function createKeyBuffer({
+  numBytes,
+  secret,
+  salt,
+}: {
+  numBytes?: number;
+  secret?: string;
+  salt?: string;
+}) {
+  return crypto.pbkdf2Sync(
+    secret || crypto.randomBytes(128).toString('base64'),
+    salt || crypto.randomBytes(32).toString('base64'),
+    10000,
+    numBytes || 32,
+    'sha512',
+  );
+}

package/src/server/encryption/encryption-internals.ts

@@ -0,0 +1,109 @@
+// @ts-strict-ignore
+const ENCRYPTION_ALGORITHM = 'aes-256-gcm';
+
+function browserAlgorithmName(name) {
+  switch (name) {
+    case 'aes-256-gcm':
+      return 'AES-GCM';
+    default:
+      throw new Error('unsupported crypto algorithm: ' + name);
+  }
+}
+
+export function randomBytes(n) {
+  return Buffer.from(crypto.getRandomValues(new Uint8Array(n)));
+}
+
+export async function encrypt(masterKey, value) {
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+
+  const encryptedArrayBuffer = await crypto.subtle.encrypt(
+    {
+      name: browserAlgorithmName(ENCRYPTION_ALGORITHM),
+      iv,
+      tagLength: 128,
+    },
+    masterKey.getValue().raw,
+    value,
+  );
+
+  const encrypted = Buffer.from(encryptedArrayBuffer);
+
+  // Strip the auth tag off the end
+  const authTag = encrypted.slice(-16);
+  const strippedEncrypted = encrypted.slice(0, -16);
+
+  return {
+    value: strippedEncrypted,
+    meta: {
+      keyId: masterKey.getId(),
+      algorithm: ENCRYPTION_ALGORITHM,
+      iv: Buffer.from(iv).toString('base64'),
+      authTag: authTag.toString('base64'),
+    },
+  };
+}
+
+export async function decrypt(masterKey, encrypted, meta) {
+  const { algorithm, iv, authTag } = meta;
+
+  const decrypted = await crypto.subtle.decrypt(
+    {
+      name: browserAlgorithmName(algorithm),
+      iv: Buffer.from(iv, 'base64'),
+      tagLength: 128,
+    },
+    masterKey.getValue().raw,
+    Buffer.concat([encrypted, Buffer.from(authTag, 'base64')]),
+  );
+
+  return Buffer.from(decrypted);
+}
+
+export async function createKey({ secret, salt }) {
+  const passwordBuffer = Buffer.from(secret);
+  const saltBuffer = Buffer.from(salt);
+
+  const passwordKey = await crypto.subtle.importKey(
+    'raw',
+    passwordBuffer,
+    { name: 'PBKDF2' },
+    false,
+    ['deriveBits', 'deriveKey'],
+  );
+
+  const derivedKey = await crypto.subtle.deriveKey(
+    {
+      name: 'PBKDF2',
+      hash: 'SHA-512',
+      salt: saltBuffer,
+      iterations: 10000,
+    },
+    passwordKey,
+    { name: 'AES-GCM', length: 256 },
+    true,
+    ['encrypt', 'decrypt'],
+  );
+
+  const exported = await crypto.subtle.exportKey('raw', derivedKey);
+
+  return {
+    raw: derivedKey,
+    base64: Buffer.from(exported).toString('base64'),
+  };
+}
+
+export async function importKey(str) {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    Buffer.from(str, 'base64'),
+    { name: 'AES-GCM' },
+    false,
+    ['encrypt', 'decrypt'],
+  );
+
+  return {
+    raw: key,
+    base64: str,
+  };
+}

package/src/server/encryption/encryption.test.ts

@@ -0,0 +1,19 @@
+import * as encryption from '.';
+
+afterEach(() => encryption.unloadAllKeys());
+
+describe('Encryption', () => {
+  test('should encrypt and decrypt', async () => {
+    const key = await encryption.createKey({
+      id: 'foo',
+      password: 'mypassword',
+      salt: 'salt',
+    });
+    await encryption.loadKey(key);
+
+    const data = await encryption.encrypt('hello', 'foo');
+
+    const output = await encryption.decrypt(data.value, data.meta);
+    expect(output.toString()).toBe('hello');
+  });
+});

package/src/server/encryption/index.test.ts

@@ -0,0 +1,19 @@
+import * as encryption from '.';
+
+afterEach(() => encryption.unloadAllKeys());
+
+describe('Encryption', () => {
+  test('should encrypt and decrypt', async () => {
+    const key = await encryption.createKey({
+      id: 'foo',
+      password: 'mypassword',
+      salt: 'salt',
+    });
+    await encryption.loadKey(key);
+
+    const data = await encryption.encrypt('hello', 'foo');
+
+    const output = await encryption.decrypt(data.value, data.meta);
+    expect(output.toString()).toBe('hello');
+  });
+});

package/src/server/encryption/index.ts

@@ -0,0 +1,89 @@
+// @ts-strict-ignore
+import { v4 as uuidv4 } from 'uuid';
+
+import * as internals from './encryption-internals';
+
+// A map of all possible master encryption keys to use, keyed by
+// unique id
+let keys = {};
+
+class Key {
+  id;
+  value;
+
+  constructor({ id }) {
+    this.id = id || uuidv4();
+  }
+
+  async createFromPassword({ password, salt }) {
+    this.value = await internals.createKey({ secret: password, salt });
+  }
+
+  async createFromBase64(str) {
+    this.value = await internals.importKey(str);
+  }
+
+  getId() {
+    return this.id;
+  }
+
+  getValue() {
+    return this.value;
+  }
+
+  serialize() {
+    return {
+      id: this.id,
+      base64: this.value.base64,
+    };
+  }
+}
+
+export function getKey(keyId) {
+  if (keyId == null || keys[keyId] == null) {
+    throw new Error('missing-key');
+  }
+  return keys[keyId];
+}
+
+export function hasKey(keyId) {
+  return keyId in keys;
+}
+
+export async function encrypt(value, keyId) {
+  return internals.encrypt(getKey(keyId), value);
+}
+
+export async function decrypt(encrypted, meta) {
+  return internals.decrypt(getKey(meta.keyId), encrypted, meta);
+}
+
+export function randomBytes(n) {
+  return internals.randomBytes(n);
+}
+
+export async function loadKey(key) {
+  let keyInstance;
+  if (!(key instanceof Key)) {
+    keyInstance = new Key({ id: key.id });
+    await keyInstance.createFromBase64(key.base64);
+  } else {
+    keyInstance = key;
+  }
+
+  keys[keyInstance.getId()] = keyInstance;
+}
+
+export function unloadKey(key) {
+  delete keys[key.getId()];
+}
+
+export function unloadAllKeys() {
+  keys = {};
+}
+
+export async function createKey({ id, password, salt }) {
+  const key = new Key({ id });
+  await key.createFromPassword({ password, salt });
+  return key;
+}

package/src/server/errors.ts

@@ -0,0 +1,110 @@
+// TODO: normalize error types
+export class PostError extends Error {
+  meta: { meta: string } | undefined;
+  reason: string;
+  type: 'PostError';
+
+  constructor(reason: string, meta?: { meta: string }) {
+    super('PostError: ' + reason);
+    this.type = 'PostError';
+    this.reason = reason;
+    this.meta = meta;
+  }
+}
+
+export class BankSyncError extends Error {
+  reason: string;
+  category: string;
+  code: string;
+  type: 'BankSyncError';
+
+  constructor(reason: string, category: string, code: string) {
+    super('BankSyncError: ' + reason);
+    this.type = 'BankSyncError';
+    this.reason = reason;
+    this.category = category;
+    this.code = code;
+  }
+}
+
+export class HTTPError extends Error {
+  statusCode: number;
+  responseBody: string;
+
+  constructor(code: number, body: string) {
+    super(`HTTPError: unsuccessful status code (${code}): ${body}`);
+    this.statusCode = code;
+    this.responseBody = body;
+  }
+}
+
+export class SyncError extends Error {
+  meta:
+    | {
+        isMissingKey: boolean;
+      }
+    | {
+        error: { message: string; stack: string };
+        query: { sql: string; params: Array<string | number> };
+      }
+    | undefined;
+  reason: string;
+
+  constructor(
+    reason: string,
+    meta?:
+      | {
+          isMissingKey: boolean;
+        }
+      | {
+          error: { message: string; stack: string };
+          query: { sql: string; params: Array<string | number> };
+        },
+  ) {
+    super('SyncError: ' + reason);
+    this.reason = reason;
+    this.meta = meta;
+  }
+}
+
+export class ValidationError extends Error {}
+
+export class TransactionError extends Error {}
+
+export class RuleError extends Error {
+  type: string;
+
+  constructor(name: string, message: string) {
+    super('RuleError: ' + message);
+    this.type = name;
+  }
+}
+
+export function APIError(
+  msg: string,
+  meta?: {
+    conditionErrors: string[];
+    actionErrors: string[];
+  },
+) {
+  return { type: 'APIError', message: msg, meta };
+}
+
+export function FileDownloadError(
+  reason: string,
+  meta?: {
+    fileId?: string;
+    isMissingKey?: boolean;
+    name?: string;
+    id?: string;
+  },
+) {
+  return { type: 'FileDownloadError', reason, meta };
+}
+
+export function FileUploadError(
+  reason: string,
+  meta?: { isMissingKey: boolean },
+) {
+  return { type: 'FileUploadError', reason, meta };
+}

package/src/server/filters/app.ts

@@ -0,0 +1,191 @@
+// @ts-strict-ignore
+import { v4 as uuidv4 } from 'uuid';
+
+import type { TransactionFilterEntity } from '../../types/models';
+import { createApp } from '../app';
+import * as db from '../db';
+import { requiredFields } from '../models';
+import { mutator } from '../mutators';
+import { parseConditionsOrActions } from '../transactions/transaction-rules';
+import { undoable } from '../undo';
+
+const filterModel = {
+  validate(filter, { update }: { update?: boolean } = {}) {
+    requiredFields('transaction_filters', filter, ['conditions'], update);
+
+    if (!update || 'conditionsOp' in filter) {
+      if (!['and', 'or'].includes(filter.conditionsOp)) {
+        throw new Error('Invalid filter conditionsOp: ' + filter.conditionsOp);
+      }
+    }
+
+    return filter;
+  },
+
+  toJS(row) {
+    const { conditions, conditions_op, ...fields } = row;
+    return {
+      ...fields,
+      conditionsOp: conditions_op,
+      conditions: parseConditionsOrActions(conditions),
+    };
+  },
+
+  fromJS(filter) {
+    const { conditionsOp, ...row } = filter;
+    if (conditionsOp) {
+      row.conditions_op = conditionsOp;
+    }
+    return row;
+  },
+};
+
+async function filterNameExists(name, filterId, newItem) {
+  const idForName = await db.first<Pick<db.DbTransactionFilter, 'id'>>(
+    'SELECT id from transaction_filters WHERE tombstone = 0 AND name = ?',
+    [name],
+  );
+
+  if (idForName === null) {
+    return false;
+  }
+  if (!newItem) {
+    return idForName.id !== filterId;
+  }
+  return true;
+}
+
+function conditionExists(item, filters, newItem) {
+  const { conditions, conditionsOp } = item;
+  let fConditionFound = null;
+
+  filters.some(filter => {
+    if (
+      (conditions.length === 1 || filter.conditionsOp === conditionsOp) &&
+      !filter.tombstone &&
+      filter.conditions.length === conditions.length
+    ) {
+      const allConditionsMatch = !conditions.some(
+        cond =>
+          !filter.conditions.some(
+            fcond =>
+              cond.value === fcond.value &&
+              cond.op === fcond.op &&
+              cond.field === fcond.field &&
+              filterOptionsMatch(cond.options, fcond.options),
+          ),
+      );
+
+      if (allConditionsMatch) {
+        fConditionFound = filter;
+        return true;
+      }
+    }
+    return false;
+  });
+
+  if (!newItem) {
+    return fConditionFound
+      ? fConditionFound.id !== item.id
+        ? fConditionFound.name
+        : false
+      : false;
+  }
+
+  return fConditionFound ? fConditionFound.name : false;
+}
+
+function filterOptionsMatch(options1, options2) {
+  const opt1 = options1 ?? {};
+  const opt2 = options2 ?? {};
+
+  const keys1 = Object.keys(opt1);
+  const keys2 = Object.keys(opt2);
+
+  if (keys1.length !== keys2.length) {
+    return false;
+  }
+
+  return keys1.every(key => opt1[key] === opt2[key]);
+}
+
+async function createFilter(filter): Promise<TransactionFilterEntity['id']> {
+  const filterId = uuidv4();
+  const item = {
+    id: filterId,
+    conditions: filter.state.conditions,
+    conditionsOp: filter.state.conditionsOp,
+    name: filter.state.name,
+  };
+
+  if (item.name) {
+    if (await filterNameExists(item.name, item.id, true)) {
+      throw new Error('There is already a filter named ' + item.name);
+    }
+  } else {
+    throw new Error('Filter name is required');
+  }
+
+  if (item.conditions.length > 0) {
+    const condExists = conditionExists(item, filter.filters, true);
+    if (condExists) {
+      throw new Error(
+        'Duplicate filter warning: conditions already exist. Filter name: ' +
+          condExists,
+      );
+    }
+  } else {
+    throw new Error('Conditions are required');
+  }
+
+  // Create the filter here based on the info
+  await db.insertWithSchema('transaction_filters', filterModel.fromJS(item));
+
+  return filterId;
+}
+
+async function updateFilter(filter) {
+  const item = {
+    id: filter.state.id,
+    conditions: filter.state.conditions,
+    conditionsOp: filter.state.conditionsOp,
+    name: filter.state.name,
+  };
+  if (item.name) {
+    if (await filterNameExists(item.name, item.id, false)) {
+      throw new Error('There is already a filter named ' + item.name);
+    }
+  } else {
+    throw new Error('Filter name is required');
+  }
+
+  if (item.conditions.length > 0) {
+    const condExists = conditionExists(item, filter.filters, false);
+    if (condExists) {
+      throw new Error(
+        'Duplicate filter warning: conditions already exist. Filter name: ' +
+          condExists,
+      );
+    }
+  } else {
+    throw new Error('Conditions are required');
+  }
+
+  await db.updateWithSchema('transaction_filters', filterModel.fromJS(item));
+}
+
+async function deleteFilter(id: TransactionFilterEntity['id']) {
+  await db.delete_('transaction_filters', id);
+}
+
+export type FiltersHandlers = {
+  'filter-create': typeof createFilter;
+  'filter-update': typeof updateFilter;
+  'filter-delete': typeof deleteFilter;
+};
+
+export const app = createApp<FiltersHandlers>();
+
+app.method('filter-create', mutator(createFilter));
+app.method('filter-update', mutator(updateFilter));
+app.method('filter-delete', mutator(undoable(deleteFilter)));

package/src/server/importers/actual.ts

@@ -0,0 +1,49 @@
+// @ts-strict-ignore
+import * as fs from '../../platform/server/fs';
+import * as sqlite from '../../platform/server/sqlite';
+import * as cloudStorage from '../cloud-storage';
+import { handlers } from '../main';
+import { waitOnSpreadsheet } from '../sheet';
+
+export async function importActual(_filepath: string, buffer: Buffer) {
+  // Importing Actual files is a special case because we can directly
+  // write down the files, but because it doesn't go through the API
+  // layer we need to duplicate some of the workflow
+  await handlers['close-budget']();
+
+  let id;
+  try {
+    ({ id } = await cloudStorage.importBuffer(
+      { cloudFileId: null, groupId: null },
+      buffer,
+    ));
+  } catch (e) {
+    if (e.type === 'FileDownloadError') {
+      return { error: e.reason };
+    }
+    throw e;
+  }
+
+  // We never want to load cached data from imported files, so
+  // delete the cache
+  const sqliteDb = await sqlite.openDatabase(
+    fs.join(fs.getBudgetDir(id), 'db.sqlite'),
+  );
+  sqlite.execQuery(
+    sqliteDb,
+    `
+          DELETE FROM kvcache;
+          DELETE FROM kvcache_key;
+        `,
+  );
+  sqlite.closeDatabase(sqliteDb);
+
+  // Load the budget, force everything to be computed, and try
+  // to upload it as a cloud file
+  await handlers['load-budget']({ id });
+  await handlers['get-budget-bounds']();
+  await waitOnSpreadsheet();
+  await cloudStorage.upload().catch(() => {
+    // Ignore errors
+  });
+}