@actual-app/sync-server 25.4.0-alpha.0

package/src/scripts/health-check.js

@@ -0,0 +1,23 @@
+import fetch from 'node-fetch';
+
+import { config } from '../load-config.js';
+
+const protocol =
+  config.get('https.key') && config.get('https.cert') ? 'https' : 'http';
+const hostname =
+  config.get('hostname') === '::' ? 'localhost' : config.get('hostname');
+
+fetch(`${protocol}://${hostname}:${config.get('port')}/health`)
+  .then(res => res.json())
+  .then(res => {
+    if (res.status !== 'UP') {
+      throw new Error(
+        'Health check failed: Server responded to health check with status ' +
+          res.status,
+      );
+    }
+  })
+  .catch(err => {
+    console.log('Health check failed:', err);
+    process.exit(1);
+  });

package/src/scripts/reset-password.js

@@ -0,0 +1,51 @@
+import { bootstrap, needsBootstrap } from '../account-db.js';
+import { changePassword } from '../accounts/password.js';
+import { promptPassword } from '../util/prompt.js';
+
+if (needsBootstrap()) {
+  console.log(
+    'It looks like you don’t have a password set yet. Let’s set one up now!',
+  );
+
+  try {
+    const password = await promptPassword();
+    const { error } = await bootstrap({ password });
+    if (error) {
+      console.log('Error setting password:', error);
+      console.log(
+        'Please report this as an issue: https://github.com/actualbudget/actual-server/issues',
+      );
+      process.exit(1);
+    }
+    console.log('Password set!');
+  } catch (err) {
+    console.log('Unexpected error:', err);
+    console.log(
+      'Please report this as an issue: https://github.com/actualbudget/actual-server/issues',
+    );
+    process.exit(1);
+  }
+} else {
+  console.log('It looks like you already have a password set. Let’s reset it!');
+  try {
+    const password = await promptPassword();
+    const { error } = await changePassword(password);
+    if (error) {
+      console.log('Error changing password:', error);
+      console.log(
+        'Please report this as an issue: https://github.com/actualbudget/actual-server/issues',
+      );
+      process.exit(1);
+    }
+    console.log('Password changed!');
+    console.log(
+      'Note: you will need to log in with the new password on any browsers or devices that are currently logged in.',
+    );
+  } catch (err) {
+    console.log('Unexpected error:', err);
+    console.log(
+      'Please report this as an issue: https://github.com/actualbudget/actual-server/issues',
+    );
+    process.exit(1);
+  }
+}

package/src/secrets.test.js

@@ -0,0 +1,83 @@
+import request from 'supertest';
+
+import { handlers as app } from './app-secrets.js';
+import { secretsService } from './services/secrets-service.js';
+describe('secretsService', () => {
+  const testSecretName = 'testSecret';
+  const testSecretValue = 'testValue';
+
+  it('should set a secret', () => {
+    const result = secretsService.set(testSecretName, testSecretValue);
+    expect(result).toBeDefined();
+    expect(result.changes).toBe(1);
+  });
+
+  it('should get a secret', () => {
+    const result = secretsService.get(testSecretName);
+    expect(result).toBeDefined();
+    expect(result).toBe(testSecretValue);
+  });
+
+  it('should check if a secret exists', () => {
+    const exists = secretsService.exists(testSecretName);
+    expect(exists).toBe(true);
+
+    const nonExistent = secretsService.exists('nonExistentSecret');
+    expect(nonExistent).toBe(false);
+  });
+
+  it('should update a secret', () => {
+    const newValue = 'newValue';
+    const setResult = secretsService.set(testSecretName, newValue);
+    expect(setResult).toBeDefined();
+    expect(setResult.changes).toBe(1);
+
+    const getResult = secretsService.get(testSecretName);
+    expect(getResult).toBeDefined();
+    expect(getResult).toBe(newValue);
+  });
+
+  describe('secrets api', () => {
+    it('returns 401 if the user is not authenticated', async () => {
+      secretsService.set(testSecretName, testSecretValue);
+      const res = await request(app).get(`/${testSecretName}`);
+
+      expect(res.statusCode).toEqual(401);
+      expect(res.body).toEqual({
+        details: 'token-not-found',
+        reason: 'unauthorized',
+        status: 'error',
+      });
+    });
+
+    it('returns 404 if secret does not exist', async () => {
+      const res = await request(app)
+        .get(`/thiskeydoesnotexist`)
+        .set('x-actual-token', 'valid-token');
+
+      expect(res.statusCode).toEqual(404);
+    });
+
+    it('returns 204 if secret exists', async () => {
+      secretsService.set(testSecretName, testSecretValue);
+      const res = await request(app)
+        .get(`/${testSecretName}`)
+        .set('x-actual-token', 'valid-token');
+
+      expect(res.statusCode).toEqual(204);
+    });
+
+    it('returns 200 if secret was set', async () => {
+      secretsService.set(testSecretName, testSecretValue);
+      const res = await request(app)
+        .post(`/`)
+        .set('x-actual-token', 'valid-token')
+        .send({ name: testSecretName, value: testSecretValue });
+
+      expect(res.statusCode).toEqual(200);
+      expect(res.body).toEqual({
+        status: 'ok',
+      });
+    });
+  });
+});

package/src/services/secrets-service.js

@@ -0,0 +1,94 @@
+import createDebug from 'debug';
+
+import { getAccountDb } from '../account-db.js';
+
+/**
+ * An enum of valid secret names.
+ * @readonly
+ * @enum {string}
+ */
+export const SecretName = {
+  gocardless_secretId: 'gocardless_secretId',
+  gocardless_secretKey: 'gocardless_secretKey',
+  simplefin_token: 'simplefin_token',
+  simplefin_accessKey: 'simplefin_accessKey',
+  pluggyai_clientId: 'pluggyai_clientId',
+  pluggyai_clientSecret: 'pluggyai_clientSecret',
+  pluggyai_itemIds: 'pluggyai_itemIds',
+};
+
+class SecretsDb {
+  constructor() {
+    this.debug = createDebug('actual:secrets-db');
+    this.db = null;
+  }
+
+  open() {
+    return getAccountDb();
+  }
+
+  set(name, value) {
+    if (!this.db) {
+      this.db = this.open();
+    }
+
+    this.debug(`setting secret '${name}' to '${value}'`);
+    const result = this.db.mutate(
+      `INSERT OR REPLACE INTO secrets (name, value) VALUES (?,?)`,
+      [name, value],
+    );
+    return result;
+  }
+
+  get(name) {
+    if (!this.db) {
+      this.db = this.open();
+    }
+
+    this.debug(`getting secret '${name}'`);
+    const result = this.db.first(`SELECT value FROM secrets WHERE name =?`, [
+      name,
+    ]);
+    return result;
+  }
+}
+
+const secretsDb = new SecretsDb();
+const _cachedSecrets = new Map();
+/**
+ * A service for managing secrets stored in `secretsDb`.
+ */
+export const secretsService = {
+  /**
+   * Retrieves the value of a secret by name.
+   * @param {SecretName} name - The name of the secret to retrieve.
+   * @returns {string|null} The value of the secret, or null if the secret does not exist.
+   */
+  get: name => {
+    return _cachedSecrets.get(name) ?? secretsDb.get(name)?.value ?? null;
+  },
+
+  /**
+   * Sets the value of a secret by name.
+   * @param {SecretName} name - The name of the secret to set.
+   * @param {string} value - The value to set for the secret.
+   * @returns {Object}
+   */
+  set: (name, value) => {
+    const result = secretsDb.set(name, value);
+
+    if (result.changes === 1) {
+      _cachedSecrets.set(name, value);
+    }
+    return result;
+  },
+
+  /**
+   * Determines whether a secret with the given name exists.
+   * @param {SecretName} name - The name of the secret to check for existence.
+   * @returns {boolean} True if a secret with the given name exists, false otherwise.
+   */
+  exists: name => {
+    return Boolean(secretsService.get(name));
+  },
+};

package/src/services/user-service.js

@@ -0,0 +1,272 @@
+import { getAccountDb } from '../account-db.js';
+
+export function getUserByUsername(userName) {
+  if (!userName || typeof userName !== 'string') {
+    return null;
+  }
+  const { id } =
+    getAccountDb().first('SELECT id FROM users WHERE user_name = ?', [
+      userName,
+    ]) || {};
+  return id || null;
+}
+
+export function getUserById(userId) {
+  if (!userId) {
+    return null;
+  }
+  const { id } =
+    getAccountDb().first('SELECT * FROM users WHERE id = ?', [userId]) || {};
+  return id || null;
+}
+
+export function getFileById(fileId) {
+  if (!fileId) {
+    return null;
+  }
+  const { id } =
+    getAccountDb().first('SELECT * FROM files WHERE files.id = ?', [fileId]) ||
+    {};
+  return id || null;
+}
+
+export function validateRole(roleId) {
+  const possibleRoles = ['BASIC', 'ADMIN'];
+  return possibleRoles.some(a => a === roleId);
+}
+
+export function getOwnerCount() {
+  const { ownerCount } = getAccountDb().first(
+    `SELECT count(*) as ownerCount FROM users WHERE users.user_name <> '' and users.owner = 1`,
+  ) || { ownerCount: 0 };
+  return ownerCount;
+}
+
+export function getOwnerId() {
+  const { id } =
+    getAccountDb().first(
+      `SELECT users.id FROM users WHERE users.user_name <> '' and users.owner = 1`,
+    ) || {};
+  return id;
+}
+
+export function getFileOwnerId(fileId) {
+  const { owner } =
+    getAccountDb().first(`SELECT files.owner FROM files WHERE files.id = ?`, [
+      fileId,
+    ]) || {};
+  return owner;
+}
+
+export function getAllUsers() {
+  return getAccountDb().all(
+    `SELECT users.id, user_name as userName, display_name as displayName, enabled, ifnull(owner,0) as owner, role
+     FROM users
+     WHERE users.user_name <> ''`,
+  );
+}
+
+export function insertUser(userId, userName, displayName, enabled, role) {
+  getAccountDb().mutate(
+    'INSERT INTO users (id, user_name, display_name, enabled, owner, role) VALUES (?, ?, ?, ?, 0, ?)',
+    [userId, userName, displayName, enabled, role],
+  );
+}
+
+export function updateUser(userId, userName, displayName, enabled) {
+  if (!userId || !userName) {
+    throw new Error('Invalid user parameters');
+  }
+  try {
+    getAccountDb().mutate(
+      'UPDATE users SET user_name = ?, display_name = ?, enabled = ? WHERE id = ?',
+      [userName, displayName, enabled, userId],
+    );
+  } catch (error) {
+    throw new Error(`Failed to update user: ${error.message}`);
+  }
+}
+
+export function updateUserWithRole(
+  userId,
+  userName,
+  displayName,
+  enabled,
+  roleId,
+) {
+  getAccountDb().transaction(() => {
+    getAccountDb().mutate(
+      'UPDATE users SET user_name = ?, display_name = ?, enabled = ?, role = ? WHERE id = ?',
+      [userName, displayName, enabled, roleId, userId],
+    );
+  });
+}
+
+export function deleteUser(userId) {
+  return getAccountDb().mutate('DELETE FROM users WHERE id = ? and owner = 0', [
+    userId,
+  ]).changes;
+}
+export function deleteUserAccess(userId) {
+  try {
+    return getAccountDb().mutate('DELETE FROM user_access WHERE user_id = ?', [
+      userId,
+    ]).changes;
+  } catch (error) {
+    throw new Error(`Failed to delete user access: ${error.message}`);
+  }
+}
+
+export function transferAllFilesFromUser(ownerId, oldUserId) {
+  if (!ownerId || !oldUserId) {
+    throw new Error('Invalid user IDs');
+  }
+  try {
+    getAccountDb().transaction(() => {
+      const ownerExists = getUserById(ownerId);
+      if (!ownerExists) {
+        throw new Error('New owner not found');
+      }
+      getAccountDb().mutate('UPDATE files set owner = ? WHERE owner = ?', [
+        ownerId,
+        oldUserId,
+      ]);
+    });
+  } catch (error) {
+    throw new Error(`Failed to transfer files: ${error.message}`);
+  }
+}
+
+export function updateFileOwner(ownerId, fileId) {
+  if (!ownerId || !fileId) {
+    throw new Error('Invalid parameters');
+  }
+  try {
+    const result = getAccountDb().mutate(
+      'UPDATE files set owner = ? WHERE id = ?',
+      [ownerId, fileId],
+    );
+    if (result.changes === 0) {
+      throw new Error('File not found');
+    }
+  } catch (error) {
+    throw new Error(`Failed to update file owner: ${error.message}`);
+  }
+}
+
+export function getUserAccess(fileId, userId, isAdmin) {
+  return getAccountDb().all(
+    `SELECT users.id as userId, user_name as userName, files.owner, display_name as displayName
+     FROM users
+     JOIN user_access ON user_access.user_id = users.id
+     JOIN files ON files.id = user_access.file_id
+     WHERE files.id = ? and (files.owner = ? OR 1 = ?)`,
+    [fileId, userId, isAdmin ? 1 : 0],
+  );
+}
+
+export function countUserAccess(fileId, userId) {
+  const { accessCount } =
+    getAccountDb().first(
+      `SELECT COUNT(*) as accessCount
+       FROM files
+       WHERE files.id = ? AND (files.owner = ? OR EXISTS (
+         SELECT 1 FROM user_access
+         WHERE user_access.user_id = ? AND user_access.file_id = ?)
+       )`,
+      [fileId, userId, userId, fileId],
+    ) || {};
+
+  return accessCount || 0;
+}
+
+export function checkFilePermission(fileId, userId) {
+  return (
+    getAccountDb().first(
+      `SELECT 1 as granted
+       FROM files
+       WHERE files.id = ? and (files.owner = ?)`,
+      [fileId, userId],
+    ) || { granted: 0 }
+  );
+}
+
+export function addUserAccess(userId, fileId) {
+  if (!userId || !fileId) {
+    throw new Error('Invalid parameters');
+  }
+  try {
+    const userExists = getUserById(userId);
+    const fileExists = getFileById(fileId);
+    if (!userExists || !fileExists) {
+      throw new Error('User or file not found');
+    }
+    getAccountDb().mutate(
+      'INSERT INTO user_access (user_id, file_id) VALUES (?, ?)',
+      [userId, fileId],
+    );
+  } catch (error) {
+    if (error.message.includes('UNIQUE constraint')) {
+      throw new Error('Access already exists');
+    }
+    throw new Error(`Failed to add user access: ${error.message}`);
+  }
+}
+
+export function deleteUserAccessByFileId(userIds, fileId) {
+  if (!Array.isArray(userIds) || userIds.length === 0) {
+    throw new Error('The provided userIds must be a non-empty array.');
+  }
+
+  const CHUNK_SIZE = 999;
+  let totalChanges = 0;
+
+  try {
+    getAccountDb().transaction(() => {
+      for (let i = 0; i < userIds.length; i += CHUNK_SIZE) {
+        const chunk = userIds.slice(i, i + CHUNK_SIZE);
+        const placeholders = chunk.map(() => '?').join(',');
+
+        const sql = `DELETE FROM user_access WHERE user_id IN (${placeholders}) AND file_id = ?`;
+
+        const result = getAccountDb().mutate(sql, [...chunk, fileId]);
+        totalChanges += result.changes;
+      }
+    });
+  } catch (error) {
+    throw new Error(`Failed to delete user access: ${error.message}`);
+  }
+
+  return totalChanges;
+}
+
+export function getAllUserAccess(fileId) {
+  //This can't be used here until we can create user invite links:
+  //const isLoginMode = config.get('userCreationMode') === 'login';
+  const isLoginMode = false;
+  const joinType = isLoginMode ? 'JOIN' : 'LEFT JOIN';
+
+  return getAccountDb().all(
+    `
+      SELECT
+        users.id as userId,
+        user_name     as userName,
+        display_name  as displayName,
+        CASE WHEN user_access.file_id IS NULL THEN 0 ELSE 1 END as haveAccess,
+        CASE WHEN files.id IS NULL THEN 0 ELSE 1 END as owner
+      FROM users
+      ${joinType} user_access ON user_access.file_id = ? AND user_access.user_id = users.id
+      ${joinType} files       ON files.id = ? AND files.owner = users.id
+      WHERE users.enabled = 1
+        AND users.user_name <> ''
+    `,
+    [fileId, fileId],
+  );
+}
+
+export function getOpenIDConfig() {
+  return (
+    getAccountDb().first(`SELECT * FROM auth WHERE method = ?`, ['openid']) ||
+    null
+  );
+}

package/src/sql/messages.sql

@@ -0,0 +1,9 @@
+
+CREATE TABLE messages_binary
+  (timestamp TEXT PRIMARY KEY,
+   is_encrypted BOOLEAN,
+   content bytea);
+
+CREATE TABLE messages_merkles
+  (id INTEGER PRIMARY KEY,
+   merkle TEXT);

package/src/sync-simple.js

@@ -0,0 +1,95 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { merkle, SyncProtoBuf, Timestamp } from '@actual-app/crdt';
+
+import { openDatabase } from './db.js';
+import { sqlDir } from './load-config.js';
+import { getPathForGroupFile } from './util/paths.js';
+
+function getGroupDb(groupId) {
+  const path = getPathForGroupFile(groupId);
+  const needsInit = !existsSync(path);
+
+  const db = openDatabase(path);
+
+  if (needsInit) {
+    const sql = readFileSync(join(sqlDir, 'messages.sql'), 'utf8');
+    db.exec(sql);
+  }
+
+  return db;
+}
+
+function addMessages(db, messages) {
+  let returnValue;
+  db.transaction(() => {
+    let trie = getMerkle(db);
+
+    if (messages.length > 0) {
+      for (const msg of messages) {
+        const info = db.mutate(
+          `INSERT OR IGNORE INTO messages_binary (timestamp, is_encrypted, content)
+             VALUES (?, ?, ?)`,
+          [
+            msg.getTimestamp(),
+            msg.getIsencrypted() ? 1 : 0,
+            Buffer.from(msg.getContent()),
+          ],
+        );
+
+        if (info.changes > 0) {
+          trie = merkle.insert(trie, Timestamp.parse(msg.getTimestamp()));
+        }
+      }
+    }
+
+    trie = merkle.prune(trie);
+
+    db.mutate(
+      'INSERT INTO messages_merkles (id, merkle) VALUES (1, ?) ON CONFLICT (id) DO UPDATE SET merkle = ?',
+      [JSON.stringify(trie), JSON.stringify(trie)],
+    );
+
+    returnValue = trie;
+  });
+
+  return returnValue;
+}
+
+function getMerkle(db) {
+  const rows = db.all('SELECT * FROM messages_merkles');
+
+  if (rows.length > 0) {
+    return JSON.parse(rows[0].merkle);
+  } else {
+    // No merkle trie exists yet (first sync of the app), so create a
+    // default one.
+    return {};
+  }
+}
+
+export function sync(messages, since, groupId) {
+  const db = getGroupDb(groupId);
+  const newMessages = db.all(
+    `SELECT * FROM messages_binary
+         WHERE timestamp > ?
+         ORDER BY timestamp`,
+    [since],
+  );
+
+  const trie = addMessages(db, messages);
+
+  db.close();
+
+  return {
+    trie,
+    newMessages: newMessages.map(msg => {
+      const envelopePb = new SyncProtoBuf.MessageEnvelope();
+      envelopePb.setTimestamp(msg.timestamp);
+      envelopePb.setIsencrypted(msg.is_encrypted);
+      envelopePb.setContent(msg.content);
+      return envelopePb;
+    }),
+  };
+}

package/src/util/hash.js

@@ -0,0 +1,5 @@
+import crypto from 'crypto';
+
+export async function sha256String(str) {
+  return crypto.createHash('sha256').update(str).digest('base64');
+}

package/src/util/middlewares.js

@@ -0,0 +1,62 @@
+import * as expressWinston from 'express-winston';
+import * as winston from 'winston';
+
+import { validateSession } from './validate-user.js';
+
+/**
+ * @param {Error} err
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+async function errorMiddleware(err, req, res, next) {
+  if (res.headersSent) {
+    // If you call next() with an error after you have started writing the response
+    // (for example, if you encounter an error while streaming the response
+    // to the client), the Express default error handler closes
+    // the connection and fails the request.
+
+    // So when you add a custom error handler, you must delegate
+    // to the default Express error handler, when the headers
+    // have already been sent to the client
+    // Source: https://expressjs.com/en/guide/error-handling.html
+    return next(err);
+  }
+
+  console.log(`Error on endpoint %s`, {
+    requestUrl: req.url,
+    stacktrace: err.stack,
+  });
+  res.status(500).send({ status: 'error', reason: 'internal-error' });
+}
+
+/**
+ * @param {import('express').Request} req
+ * @param {import('express').Response} res
+ * @param {import('express').NextFunction} next
+ */
+const validateSessionMiddleware = async (req, res, next) => {
+  const session = await validateSession(req, res);
+  if (!session) {
+    return;
+  }
+
+  res.locals = session;
+  next();
+};
+
+const requestLoggerMiddleware = expressWinston.logger({
+  transports: [new winston.transports.Console()],
+  format: winston.format.combine(
+    winston.format.colorize(),
+    winston.format.timestamp(),
+    winston.format.printf(args => {
+      const { timestamp, level, meta } = args;
+      const { res, req } = meta;
+
+      return `${timestamp} ${level}: ${req.method} ${res.statusCode} ${req.url}`;
+    }),
+  ),
+});
+
+export { validateSessionMiddleware, errorMiddleware, requestLoggerMiddleware };