__init__.py

Go to the documentation of this file.

#!/usr/bin/python
# -*- coding: utf-8 -*- 
#
# Main system APIs for querying and controlling the site.
#
# Be aware that you'll need to be an administrator to use most 
# of the APIs.
 
import json
import os
import traceback
import types
import importlib
import shutil
import base64
import random
import uuid
import hashlib
 
from flask import Response
 
from pafera.types import *
from pafera.db import *
 
from apps.system.user import *
from apps.system.group import *
from apps.system.page import *
from apps.system.session import *
from apps.system.file import *
from apps.system.loginattempt import *
 
# =====================================================================
def sessionvars(g):
  """In order to enable caching for static pages, we place all session
  and user specific information in this special handler. Using this
  technique, we can use nginx to rapidly serve static files while this
  function only has minimal work to do.
  """
  r = Response(f"""
P.wallpaper   = '{g.session['wallpaper']}';
P.texttheme   = '{g.session['texttheme']}';
P.userid      = '{ToShortCode(g.session.userid) if g.session.userid else ''}';
P.groups      = {g.session['groups'] if g.session.userid else []};
P.lang        = '{g.session.lang}';
P.langcodes   = {g.session.langcodes};
P.languages   = {g.siteconfig['languages']};
 
let chooselanguageicon  = E('.ChooseLanguageIcon');
 
if (chooselanguageicon)
{{
  chooselanguageicon.innerHTML  = `<img class="Square200" src="/files/flag-${{P.lang}}.png">`
}}
 
let systemusericon  = E('.SystemUserIcon');
 
if (systemusericon && P.userid)
{{
  systemusericon.innerHTML  = `<img class="Square200" src="/system/headshots/${{P.CodeDir(P.userid)}}.webp">`
}}
""")
 
  r.headers["Cache-Control"] = "no-cache, no-store, must-revalidate"
  r.headers["Pragma"] = "no-cache"
  r.headers["Expires"] = "0"
  r.headers['Cache-Control'] = 'public, max-age=0'  
 
  return r
  
# =====================================================================
def fileapi(g):
  """Standard API to search through the files on the system and change 
  names or descriptions. Note that files are one of the few objects 
  where security is enabled by default, so we rely on the system 
  security protection to block unauthorized access. 
  """
  results = {}
  
  try:
    d = json.loads(g.request.get_data())
    
    command = StrV(d, 'command')
    
    if command == 'search':
      keyword        = StrV(d, 'keyword')
      filename       = StrV(d, 'filename', keyword)
      filetype       = StrV(d, 'filetype')
      modified       = StrV(d, 'modified')
      size           = IntV(d, 'size')
      start          = IntV(d, 'start')
      limit          = IntV(d, 'limit', 1, 1000, 20)
      orderby        = StrV(d, 'orderby', 'filename')
      filefilter     = StrV(d, 'filter')
      fileids        = ArrayV(d, 'fileids')
      showallfiles   = IntV(d, 'showallfiles')
      
      conds   = []
      params  = []
      
      if not showallfiles:
        conds.append('dbowner = ?')
        params.append(g.session.userid)
      
      if fileids:
        conds.append('rid IN (' + [', '.join(['?' for x in fileids])] + ')')
        params.extend([FromShortCode(x) for x in fileids])
      else:      
        if filename:
          conds.append("filename LIKE ? OR descriptions LIKE ?")
          params.append(EscapeSQL('%' + filename + '%'))
          params.append(EscapeSQL('%' + filename + '%'))
        
        if filetype:
          if filetype in system_file.TYPES.keys():
            filetype  = system_file.TYPES[filetype]
            conds.append("filetype = ?")
            params.append(filetype)
          
        if modified:
          conds.append("modified LIKE ?")
          params.append(EscapeSQL('%' + modified + '%'))
          orderby = 'modified'
        
        if size:
          conds.append("size > ?")
          params.append(size)
          orderby = 'size'
      
      conds = "WHERE " + (" AND ").join(conds)
      
      files = g.db.Find(
          system_file, 
          conds, 
          params, 
          start   = start, 
          limit   = limit,
          orderby = orderby,
          fields  = 'rid, filename, extension, descriptions, modified, size, filetype, flags',
        )
        
      ls  = []
      
      for r in files:
        o = r.ToJSON('filename, extension, modified, size, flags')
        o['modified']     = o['modified'][:19]
        o['description']  = BestTranslation(r.descriptions, g.session.langcodes)
        o['idcode']       = ToShortCode(r.rid)
        o['thumbnail']    = r.ThumbnailURL()
        ls.append(o)
        
      results['data']   = ls
      results['count']  = len(files)
    elif command == 'load':
      idcode  = StrV(d, 'idcode')
      
      if not idcode:
        raise Exception(g.T.missingparams)
      
      r = g.db.Load(system_file, FromShortCode(idcode)).ToJSON()
      
      o = r.ToJSON('filename, modified, size, flags')
      
      o['modified']     = o['modified'][:19]
      o['description']  = BestTranslation(r.descriptions, g.session.langcodes)
      o['idcode']       = ToShortCode(r.rid)
      o['thumbnail']    = r.ThumbnailURL()
      
      results['data'] = o
    elif command == 'save':
      """The save API is only able to change filename and descriptions. The 
      rest of the statistics are automatically handled on upload.
      """
      newinfo  = DictV(d, 'data')
      
      if not V(newinfo, 'idcode'):
        raise Exception(g.T.cantcreate)
      
      s = g.db.Load(system_file, FromShortCode(newinfo['idcode']))
      
      filename      = StrV(newinfo, 'filename')
      descriptions  = DictV(newinfo, 'descriptions')
      
      if filename or descriptions:
        if filename:
          s.Set(filename = filename)
          
        if descriptions:
          s.Set(descriptions = descriptions)
          
        g.db.Save(s)
        
        g.db.Commit()
    elif command == 'delete':
      ids  = ArrayV(d, 'ids')
      
      if not ids:
        raise Exception(g.T.missingparams)
      
      for r in g.db.LoadMany(system_file, [FromShortCode(x) for x in ids]):
        filepath  = r.FullPath()
        
        g.db.Delete(r)
        
        os.remove(filepath)
        
      g.db.Commit()
    else:
      results['error']  = f'{g.T.cantunderstand} "{command}"'
  except Exception as e:
    traceback.print_exc()
    results['error']  = str(e)
  
  return results
 
# =====================================================================
def upload(g):
  """Handles uploads for the whole system. Files in Pafera are stored 
  under their shortcodes, and can be private or public. Note that you'll
  need ImageMagick and ffmpegthumbnailer installed on your system for
  automatic thumbnail generation.
  """
  
  if len(g.urlargs) < 3:
    errordict  = {}
    errordict[g.session.lang] = g.T.missingparams
    return json.dumps(errordict)
  
  fileid, filename, title = g.urlargs[:3]
  
  security  = 'public'
  
  if len(g.urlargs) > 3:
    security = g.urlargs[3]
  
  if fileid == '_':
    fileid  = ''
  
  g.db.RequireGroup('uploaders', g.T.cantchange)
      
  bytesleft   = int(g.request.headers.get('content-length'))
  filesize    = bytesleft
  
  # The special headshot fileid is used to set user images
  if fileid == 'headshot':
    userid  = FromShortCode(filename)
    
    if (userid != g.session.userid 
        and not g.db.HasLink(system_user, g.session.userid, system_user, userid, USER_LINK_MANAGE)
      ):
      return json.dumps({'error': g.T.cantchange})
    
    basename  = 'static/system/headshots/' + CodeDir(filename)
    jpgfile   = basename + '.jpg'
    webpfile  = basename + '.webp'
    
    with open(jpgfile, 'wb') as f:
      while bytesleft > 0:
        chunk = g.request.stream.read(65536)
        f.write(chunk)
        bytesleft -= len(chunk)
        
    subprocess.call(['convert', jpgfile, '-quality', '70', '-resize', '512x512>', webpfile])
                     
    os.remove(jpgfile)
    
    return '{}'
  
  cachedir      = '/srv/flasksite/private/uploads'
  uploadedfile  = cachedir + '/' + uuid.uuid4().hex
  
  hasher  = hashlib.sha1()
  
  with open(uploadedfile, 'wb') as f:
    while bytesleft > 0:
      chunk = g.request.stream.read(65536)
      f.write(chunk)
      hasher.update(chunk)
      bytesleft -= len(chunk)
      
  finalhash = hasher.hexdigest()
  
  # See if the file already exists on the system and is not private
  f = g.db.Find(
    system_file, 
    'WHERE hash = ? AND size = ? AND NOT flags & ?', 
    (hash, filesize, FILE_PRIVATE)
  )
  
  if f:
    f = f[0]
    os.remove(uploadedfile)
  else:
    # If it's a new file, then let the file class process statistics.
    basename, extension = os.path.splitext(filename)
    
    descriptions  = {}
    
    descriptions[g.session.lang]  = title
    
    f = system_file()
    
    f.Set(
      filename      = filename,
      extension     = extension,
      descriptions  = descriptions,
      hash          = finalhash,
    )
    
    if security == 'protected':
      f.Set(flags = FILE_PROTECTED)
    elif security == 'private':
      f.Set(flags = FILE_PRIVATE)
    else:
      f.Set(flags = FILE_PUBLIC)
    
    g.db.Insert(f)
    
    idcode    = ToShortCode(f.rid)
    fullpath  = 'static/data/files' + CodeDir(idcode) + '.' + extension
    
    os.rename(uploadedfile, fullpath)
    
    f.Process()
    
    g.db.Commit()
    
  returninfo  = {
    'id':         idcode,
    'thumbnail':  f.ThumbnailURL(),
  }
  
  return json.dumps(returninfo)
 
# =====================================================================
def userapi(g):
  """Handles logins, registrations, approvals, and user information.
  Also handles adding friends, following other users, and so forth.
  
  Note that normal users cannot search for other users. You must be 
  an administrator or have managed users assigned to you in order to 
  see and change other users.
  """
  results = {}
  
  try:
    LoadTranslation(g, 'system', 'admin', g.session.lang)
    
    d = json.loads(g.request.get_data())
    
    command = StrV(d, 'command')
    
    if command == 'login':
      phonenumber = StrV(d, 'phonenumber').strip()
      place       = StrV(d, 'place').strip()
      password    = StrV(d, 'password').strip()
      
      if not phonenumber or not place or not password:
        raise Exception(g.T.missingparams)
      
      # Limit login attempts to once every two seconds per IP. It's a
      # crude but effective way to counter login spamming.
      previousattempt = g.db.Find(
        system_loginattempt,
        'WHERE ip = ? ORDER BY eventtime DESC',
        [g.session.ip]
      )
      
      currenttime = time.time()
      
      if previousattempt and previousattempt[0].eventtime.timestamp() > currenttime - 2:
        time.sleep(2)
        raise Exception(g.T.nothingfound)
      
      loginattempt = system_loginattempt()
      loginattempt.Set(
        ip          = g.session.ip,
        eventtime   = currenttime,
      )
      g.db.Insert(loginattempt)
      g.db.Commit()
      
      u = g.db.Find(
        system_user, 
        'WHERE phonenumber = ? AND place = ?',
        [phonenumber, place]
      )
      
      if u:
        u = u[0]
        if u.CheckPassword('password', password):
          g.session.Set(
            userid    = u.rid
          )
          g.session.data.update(u.settings)
          
          groups    = []
          groupids  = []
          
          for group in g.db.Linked(u, system_group):
            groups.append(group.groupname)
            groupids.append(group.rid)
            
          g.session['groups']   = groups
          g.session['groupids'] = groupids
          
          g.session.needupdate  = 1
        else:
          time.sleep(2)
          raise Exception(g.T.nothingfound)      
      else:
        time.sleep(2)
        raise Exception(g.T.nothingfound)      
    elif command == 'register':
      phonenumber = StrV(d, 'phonenumber').strip()
      place       = StrV(d, 'place').strip()
      password    = StrV(d, 'password').strip()
      password2   = StrV(d, 'password2').strip()
      email       = StrV(d, 'email').strip()
      headshot    = StrV(d, 'headshot').strip()
      extrainfo   = DictV(d, 'extrainfo')
      
      if not phonenumber or not place or not password or not password2 or not headshot or len(headshot) < 60:
        raise Exception(g.T.missingparams)
      
      u = g.db.Find(
        system_newuser, 
        'WHERE phonenumber = ? AND place = ?',
        [phonenumber, place]
      )
      
      if u and g.session.userid != u[0].rid:
        raise Exception(g.T.phonenumberalreadytaken)
      
      imgdata = b64decodepad(headshot[23:])
      
      if not imgdata:
        raise Exception(g.T.wrongfileformat)
      
      if u:
        u = u[0]
      else:
        u = system_newuser()
      
      u.Set(
        phonenumber   = phonenumber,
        place         = place,
        email         = email,
        extrainfo     = extrainfo
      )
      
      u.SetPassword('password', password)
      
      g.db.Save(u)
      g.db.Commit()
      
      headshotdir = 'static/system/newheadshots/' + idcode[:3]
      
      os.makedirs(headshotdir, exist_ok = True)
      
      with open(headshotdir + '/' + idcode[3:] + '.webp', 'wb') as f:
        f.write(imgdata)
      
      results['registrationid'] = ToShortCode(u.rid)
    elif command == 'listneedapprovals':
      if 'admins' not in g.session['groups']:
        raise Exception(g.T.cantview)
      
      start     = IntV(d, 'start', 0, 99999999, 0)
      limit     = IntV(d, 'limit', 10, 1000, 100)
      
      results['data'] = [
        x.ToJSON() 
        for x in g.db.Find(
          system_newuser,
          start     = start,
          limit     = limit,
          orderby   = 'place, phonenumber'
        )
      ]
    elif command == 'approve':
      if 'admins' not in g.session['groups']:
        raise Exception(g.T.cantchange)      
      
      userid  = StrV(d, 'userid')
      approve = IntV(d, 'approve')
      
      userid    = FromShortCode(userid)
      
      u = g.db.Load(system_newuser, userid)
      
      if approve:
        user  = system_user()
        user.Set(**u.ToJSON())
        user.Set(rid = 0)
        
        g.db.Save(user)
        
        newuserimage  = 'static/system/newheadshots/' + CodeDir(ToShortCode(u.rid)) + '.webp'
        userimage     = 'static/system/headshots/' + CodeDir(ToShortCode(user.rid)) + '.webp'
        
        os.makedirs(os.path.split(userimage)[0], exist_ok = True)
        
        os.rename(newuserimage, userimage)
      else:
        pass
      
      g.db.Delete(u)
      g.db.Commit()
    elif command == 'search':
      keyword   = StrV(d, 'keyword')
      start     = IntV(d, 'start', 0, 2147483647, 0)
      limit     = IntV(d, 'limit', 1, 2147483647, 100)
      
      conds   = []
      params  = []
      
      if keyword:
        conds.append('phonenumber LIKE ?')
        params.append(EscapeSQL('%' + keyword + '%'))
        
        conds.append('displayname LIKE ?')
        params.append(EscapeSQL('%' + keyword + '%'))
      
      if conds:
        conds = ' OR '.join(conds)
      else:
        conds = ''
        
      currentuser = g.db.Load(system_user, g.session.userid, 'rid, canmanage, managedby')
        
      userids   = ArrayV(d, 'userids')
      
      if userids:
        validuserids  = []
        
        for r in userids:
          if r in currentuser.canmanage or r in currentuser.managedby:
            validuserids.append(r)
            
        if not validuserids:
          return results
        
        cond    = 'WHERE rid IN (' + (', '.join(['?' for x in validuserids])) + ') '
        
        if conds:
          cond  += ' AND (' + conds + ')'
        
        params  = [FromShortCode(x) for x in validuserids] + params
        
        validusers  = g.db.Find(
          system_user,
          cond,
          params,
          start     = start,
          limit     = limit,
          orderby   = 'phonenumber',
          fields    = 'rid, phonenumber, place, displayname'
        )
        
        results['data'] = [
          x.ToJSON('rid, phonenumber, place, displayname')
          for x in validusers
        ]
        results['count']  = len(validusers)
        return results        
      
      allusers  = []
        
      if 'admins' in g.session['groups']:
        allusers  = g.db.Find(
          system_user,
          'WHERE ' + conds if conds else '',
          params,
          start     = start,
          limit     = limit,
          orderby   = 'phonenumber',
        )
        
      results['allusers'] = [
        x.ToJSON('rid, phonenumber, place, displayname')
        for x in allusers
      ]
      results['alluserscount']  = len(allusers)
        
      if currentuser.canmanage:
        cond    = 'WHERE rid IN (' + (', '.join(['?' for x in currentuser.canmanage])) + ') '
        
        if conds:
          cond  += ' AND (' + conds + ')'
        
        params  = [FromShortCode(x) for x in currentuser.canmanage] + params
      
        managedusers  = g.db.Find(
          system_user,
          cond,
          params,
          start   = start,
          limit   = limit,
          orderby = 'phonenumber',
          fields  = 'rid, phonenumber, place, displayname, expiredate, storagequota, numcanmanage, canmanage, managedby',
        )
      else:
        managedusers  = []
          
      results['data'] = [
        x.ToJSON('rid, phonenumber, place, displayname, expiredate, storagequota, numcanmanage, canmanage, managedby')
        for x in managedusers
      ]
      results['count']  = len(managedusers)
    elif command == 'save':
      data     = DictV(d, 'data')
      userid   = StrV(data, 'idcode')
      
      if not userid:
        raise Exception(g.T.missingparams)
      
      useridcode  = userid
      userid      = FromShortCode(userid)
      
      u = g.db.Load(system_user, userid, 'rid, numcanmanage, canmanage, managedby, flags')
      
      isadmin   = 'admins' in g.session['groups']
      canmanage = isadmin or ToShortCode(g.session.userid) in u.managedby
      
      if userid != g.session.userid and not canmanage:
        raise Exception(g.T.cantchange)
      
      newvalues = {}
      
      # If the user is not allowed to manage itself, then only the password
      # can be changed
      if not isadmin and userid == g.session.userid and not u.flags & USER_CAN_MANAGE_SELF:
        newpassword = StrV(data, 'password')
        
        if not newpassword:
          return results
        
        newvalues = {
          'password': newpassword
        }
      else:
        for r in [
            'phonenumber',
            'place',
            'email',
            'password',
          ]:
          
          value = StrV(data, r)
          
          if value:
            newvalues[r]  = value
      
      if isadmin:
        expiredate  = StrV(data, 'expiredate')
        
        if expiredate:
          newvalues['expiredate'] = expiredate
          
        storagequota  = IntV(data, 'storagequota')
          
        if storagequota:
          newvalues['storagequota'] = storagequota
        
        numcanmanage  = IntV(data, 'numcanmanage')
        
        if numcanmanage:
          newvalues['numcanmanage'] = numcanmanage
          
        canmanagetoadd    = []
        canmanagetodelete = []
        
        managedbytoadd    = []
        managedbytodelete = []
        
        canmanage  = ArrayV(data, 'canmanage')
        
        if 'canmanage' in data:
          oldcanmanage  = set(u.canmanage)
          newcanmanage  = set(canmanage)
          
          newvalues['canmanage'] = list(newcanmanage)
          
          canmanagetoadd      = list(newcanmanage - oldcanmanage)
          canmanagetodelete   = list(oldcanmanage - newcanmanage)
          
          if not isadmin and len(canmanage) > u.numcanmanage:
            raise Exception(g.T.reachedmanagelimit)
          
        managedby  = ArrayV(data, 'managedby')
        
        if 'managedby' in data:
          newvalues['managedby'] = managedby
          
          oldmanagedby  = set(u.managedby)
          newmanagedby  = set(managedby)
        
          managedbytoadd      = list(newmanagedby - oldmanagedby)
          managedbytodelete   = list(oldmanagedby - newmanagedby)
          
        userstoedit = canmanagetoadd + canmanagetodelete + managedbytoadd + managedbytodelete
        
        if userstoedit:
          for r in g.db.Find(
              system_user,
              'WHERE rid IN (' + ', '.join(['?' for x in userstoedit]) + ')',
              [FromShortCode(x) for x in userstoedit],
              fields  = 'rid, canmanage, managedby'
            ):
            
            thisuserid  = ToShortCode(r.rid)
            
            if thisuserid in canmanagetoadd:
              r.managedby.append(useridcode)
              r.UpdateFields('managedby')
              
            if thisuserid in canmanagetodelete and useridcode in r.managedby:
              r.managedby.remove(useridcode)
              r.UpdateFields('managedby')
            
            if thisuserid in managedbytoadd:
              r.canmanage.append(useridcode)
              r.UpdateFields('canmanage')
              
            if thisuserid in managedbytodelete and useridcode in r.canmanage:
              r.canmanage.remove(useridcode)
              r.UpdateFields('canmanage')
              
            g.db.Update(r)
            
      u.Set(**newvalues)
            
      if 'password' in data:
        u.SetPassword('password', data['password'])
      
      g.db.Save(u) 
      g.db.Commit()
    elif command == 'delete':
      ids    = ArrayV(d, 'ids')
      
      if not ids:
        raise Exception(g.T.missingparams)
      
      for r in ids:
        userid  = FromShortCode(r)
        
        u = g.db.Load(system_user, userid, 'rid, managedby')
        
        if 'admins' not in g.session['groups'] and ToShortCode(g.session.userid) not in u.managedby:
          raise Exception(g.T.cantdelete)
        
        g.db.Delete(u) 
      
      g.db.Commit()
    elif command == 'load':
      userid    = StrV(d, 'userid')
      
      if userid:
        userid  = FromShortCode(userid)
      else:
        userid  = g.session.userid
      
      u = g.db.Load(system_user, g.session.userid, 'rid, phonenumber, place, displayname, storageused, storagequota, numcanmanage, canmanage, managedby, accesstokens, flags')
      
      canmanage = 'admins' in g.session['groups'] or ToShortCode(g.session.userid) in u.managedby
      
      if userid != g.session.userid and not canmanage:
        raise Exception(g.T.cantchange)
      
      results['data'] = u.ToJSON('rid, phonenumber, place, displayname, storageused, storagequota, numcanmanage, canmanage, managedby, accesstokens, flags')
    elif command == 'setlanguage':
      newlang = StrV(d, 'data')
      
      if newlang not in g.siteconfig['languages']:
        raise Exception(newlang + ' is not supported.')
      
      newlangcodes  = [newlang]
      
      [newlangcodes.append(x) for x in g.session.langcodes if x not in newlangcodes]
      
      g.session.Set(
        lang        = newlang,
        langcodes   = newlangcodes,
      )
      
      g.db.Update(g.session)
      g.db.Commit()
    elif command == 'searchgroups':
      keyword     = StrV(d, 'keyword')
      grouptype   = StrV(d, 'grouptype', 'friends')
      start       = IntV(d, 'start', 0, 99999999, 0)
      limit       = IntV(d, 'limit', 10, 99999999, 100)
      
      cond    = []
      params  = []
      
      if keyword:
        conds.append('(phonenumber LIKE ? OR displayname LIKE ?)')
        params.append(EscapeSQL('%' + keyword + '%'))
        params.append(EscapeSQL('%' + keyword + '%'))
        
      if cond:
        cond  = 'WHERE ' + ' AND '.join(conds)
      
      objs  = []
      users = []
        
      if 'admins' in g.session['groups']:
        users = g.db.Find(
          system_user,
          cond,
          params,
          start   = start,
          limit   = limit,
          fields  = 'rid, displayname, phonenumber'
        )
      else:
        linktype  = USER_FRIEND
        
        if grouptype == 'friends':
          pass
        elif grouptype == 'acquaintances':
          linktype  = USER_ACQUAINTANCE
        elif grouptype == 'follow':
          linktype  = USER_FOLLOW
        elif grouptype == 'blocked':
          linktype  = USER_BLOCKED
        else:
          raise Exception(g.T.cantunderstand + grouptype)
        
        users = g.db.LinkedToID(
          system_user, 
          g.session.userid, 
          fields  = 'rid, displayname, phonenumber'
        )
      
      results['count']  = len(users)
      
      for r in users:
        objs.append({
          'idcode':       ToShortCode(r.rid),
          'displayname':  BestTranslation(r.displayname, g.session.lang),
          'phonenumber':  r.phonenumber
        })
        
      results['data']   = objs      
    else:
      results['error']  = f'{g.T.cantunderstand} "{command}"'
  except Exception as e:
    traceback.print_exc()
    results['error']  = str(e)
  
  return results
            
# =====================================================================
def controlpanelapi(g):
  """Configures settings for the whole site. You must be an 
  administrator in order to see and change settings. 
  """
  results = {}
  
  try:
    if 'admins' not in g.session['groups']:
      raise Exception(g.T.cantchange)
      
    d = json.loads(g.request.get_data())
  
    command = StrV(d, 'command')
    
    if command == 'getinfo':
      with open('private/system/pafera.cfg', 'r') as f:
        results['data'] = json.load(f)
    elif command == 'setinfo':
      oldinfo = {}
      newinfo = DictV(d, 'data')
      
      if not V(newinfo, 'dbflags'):
        newinfo['dbflags']  = 0
      
      with open('private/system/pafera.cfg', 'r') as f:
        oldinfo = json.load(f)
        
      try:
        newdb  = DB(
          connectionname  = 'newdb',
          dbhost          = newinfo['dbhost'],
          dbname          = newinfo['dbname'], 
          dbtype          = newinfo['dbtype'],
          dbuser          = newinfo['dbuser'],
          dbpassword      = newinfo['dbpassword'],
          dbflags         = newinfo['dbflags'],
        )
        
        import pafera.initsite
        newg  = types.SimpleNamespace()
        newg.db = newdb
        newg.T  = g.T
        pafera.initsite.InitDB(newg)
      except Exception as e:
        traceback.print_exc()
        raise Exception(g.T.cantconnect + newinfo['dbname'])
      
      admin = g.db.Find(
        system_user, 
        'WHERE phonenumber = ? AND place = ?',
        ['admin', 'pafera']
      )[0]
      
      sitepassword  = StrV(newinfo, 'sitepassword')
      
      if not sitepassword and admin.CheckPassword('password', 'pafera'):
        raise Exception(g.T.pleasesetnewpassword)
      else:
        admin.SetPassword('password', sitepassword)
        g.db.Update(admin)
        g.db.Commit()
        newinfo.pop('sitepassword')
        
      oldinfo.update(newinfo)
      
      newinfo['sessiontimeout']  = IntV(newinfo, 'sessiontimeout', 600, 2678400, 604800)
        
      with open('private/system/pafera.cfg', 'w') as f:
        f.write(json.dumps(oldinfo, sort_keys = True, indent = 2))
        
      if newinfo['production']:
        subprocess.run(['/srv/flasksite/scripts/minifyall'])
    else:
      results['error']  = f'{g.T.cantunderstand} "{command}"'
  except Exception as e:
    results['error']  = str(e)
  
  return results
            
# =====================================================================
def dbapi(g):
  """Used by the web database management interface to handle objects
  in the system. You must be an administrator to use this API.
  """
  results = {}
  
  try:
    if 'admins' not in g.session['groups']:
      raise Exception(g.T.cantchange)
    
    d = json.loads(g.request.get_data())
  
    command = StrV(d, 'command')
    
    if command == 'getmodels':
      results['data'] = list(g.db.objtypes.keys())
    elif command == 'getmodelinfo':
      model = GetModel(StrV(d, 'model'))
      
      if not model:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model)
      
      data  = {}
      
      # No need to specify validators
      for k, v in model._dbfields.items():
        data[k] = v[:2]
      
      results['data']           = data
      results['modelid']        = model._dbid
      results['managejs']       = getattr(model, '_managejs', '')
      results['links']          = getattr(model, '_dblinks', [])
      results['displayfields']  = getattr(model, '_dbdisplay', model._dbid)
    elif command == 'search':
      model   = GetModel(StrV(d, 'model'))
      fields  = ArrayV(d, 'fields')
      cond    = StrV(d, 'condition')
      params  = ArrayV(d, 'params')
      start   = IntV(d, 'start', 0, 99999999, 0)
      limit   = IntV(d, 'limit', 10, 99999999, 100)
      orderby = StrV(d, 'orderby')
      
      if not model:
        raise Exception(g.T.missingparams)
      
      if not fields:
        fields  = []
      
      g.db.RegisterModel(model)
      
      objs  = g.db.Find(
        model,
        cond,
        params,
        start     = start,
        limit     = limit,
        fields    = ', '.join(fields) if fields else '*',
        orderby   = orderby,
      )
      
      results['count']  = len(objs)
      
      fieldnames  = ', '.join(fields)
      
      results['data']   = [x.ToJSON(fieldnames) for x in objs]
    elif command == 'save':
      model = GetModel(StrV(d, 'model'))
      data  = DictV(d, 'data')
      
      if not model or not data:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model)
      
      dbid  = V(data, model._dbid)
      
      if dbid == '0':
        raise Exception(g.T.missingparams)
      
      if dbid:
        # Try to load the object if it already exists
        if 'INT' in model._dbfields[model._dbid][0]:
          dbid  = int(dbid)
        
        try:
          obj = g.db.Load(model, dbid)
        except Exception as e:
          print('dbapi.save():\tCould not load model ', model, dbid)
          obj = model()
      else:
        obj = model()
        
      for k, v in model._dbfields.items():
        if v[0] == 'PASSWORD':
          if V(data, k):
            obj.SetPassword(k, data[k])
            
          data.pop(k, None)
        elif v[0] == 'JSON':
          if not V(data, k):
            data[k] = {}
            
      obj.Set(**data)
      
      g.db.Save(obj)
        
      g.db.Commit()
      
      results['data']   = obj.ToJSON()
    elif command == 'load':
      model   = GetModel(StrV(d, 'model'))
      modelid = V(d, 'modelid')
      
      if not model or not modelid:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model)
      
      obj  = g.db.Load(model, modelid)
      
      results['data']   = obj.ToJSON()
    elif command == 'delete':
      model = GetModel(StrV(d, 'model'))
      ids   = ArrayV(d, 'data')
      
      if not model:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model)
      
      if not ids:
        results['error']  = 'No IDs provided to delete.'
      else:
        for objid in ids:
          if objid == '0':
            raise Exception(g.T.missingparams)
          
          if not objid:
            continue
          
          obj = g.db.Load(model, FromShortCode(objid))
          
          g.db.Delete(obj)
          
        g.db.Commit()
    elif command == 'linked':
      model1    = GetModel(StrV(d, 'model1'))
      model2    = GetModel(StrV(d, 'model2'))
      id1       = V(d, 'id1')
      linktype  = IntV(d, 'type')
      
      if not model1 or not model2 or not id1:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model1)
      g.db.RegisterModel(model2)
      
      obj1  = g.db.Load(model1, id1)
      
      displayfields = getattr(model2, '_dbdisplay', [])
      
      if displayfields:
        displayfields = displayfields + [model2._dbid]
      
      results['data'] = [x.ToJSON(', '.join(displayfields)) for x in g.db.Linked(obj1, model2, linktype)]
    elif command == 'link' or command == 'linkarray':
      model1    = GetModel(StrV(d, 'model1'))
      model2    = GetModel(StrV(d, 'model2'))
      id1       = V(d, 'id1')
      id2s      = ArrayV(d, 'id2s')
      linktype  = IntV(d, 'type')
      
      if not model1 or not model2 or not id1:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model1)
      g.db.RegisterModel(model2)
      
      obj1  = g.db.Load(model1, id1)
      
      ls  = []
      
      for id in id2s:
        ls.append(g.db.Load(model2, id))
        
      if len(ls) == 1 and command == 'link':
        g.db.Link(obj1, ls[0], linktype)
      else:
        if ls:
          g.db.LinkArray(obj1, ls, linktype)
        else:
          g.db.Unlink(obj1, model2, linktype)
        
      g.db.Commit()
    elif command == 'cleanlinks':
      """Look for broken links where the original objects don't exist
      anymore and clean them from the system. 
      """
      report  = []
      
      nummodels       = 0
      numlinkscleaned = 0
      
      for r in list(g.db.objtypes.keys()):
        m1 = GetModel(r)
        
        nummodels += 1
        
        report.append(f'Found model {r}')
        
        for l in m1._dblinks:
          m2  = GetModel(l)
          
          linktable = g.db.GetLinkTable(m1, m2)
          
          linkobj1, linkobj2  = linktable.split('__')
          
          if r == linkobj1:
            linkobj1id  = m1._dbid
            linkobj2id  = m2._dbid
          else:
            linkobj1id  = m2._dbid
            linkobj2id  = m1._dbid
          
          report.append(f'\tFound link {linktable}')
          
          if g.db.HasTable(linktable):
            brokenlinks = []
            
            for a in g.db.Execute(f'''
                SELECT lt.linkaid, lt.linkbid
                FROM {linktable} AS lt
                LEFT JOIN {linkobj1} AS l1 ON lt.linkaid = l1.{linkobj1id}
                WHERE l1.{linkobj1id} IS NULL
              '''):
              report.append(f'''\t\tFound broken link {a[0]} -> {a[1]}''')
              brokenlinks.append((a[0], a[1]))              
              numlinkscleaned += 1
              
            for a in g.db.Execute(f'''
                SELECT lt.linkaid, lt.linkbid
                FROM {linktable} AS lt
                LEFT JOIN {linkobj2} AS l2 ON lt.linkbid = l2.{linkobj2id}
                WHERE l2.{linkobj2id} IS NULL
              '''):
              report.append(f'''\t\tFound broken link {a[0]} -> {a[1]}''')
              brokenlinks.append((a[0], a[1]))
              numlinkscleaned += 1
              
            if brokenlinks:
              g.db.ExecuteMany(f'''
                DELETE FROM {linktable}
                WHERE linkaid = ? AND linkbid = ?
                ''',
                brokenlinks
              )
      
      g.db.Commit()
      
      report.append(f'''Cleaned {numlinkscleaned} broken links from {nummodels} models''')
      
      results['report'] = '\n'.join(report)
    else:
      results['error']  = f'{g.T.cantunderstand} "{command}"'          
  except Exception as e:
    traceback.print_exc()
    results['error']  = str(e)
  
  return results
 
# =====================================================================
def translationsapi(g):
  """Handles frequently used translations for the system. You must be 
  an administrator or be part of the translators group in order to use
  this API.
  """
  results = {}
  
  try:
    if ('admins' not in g.session['groups'] 
        and 'translators' not in g.session['groups']
      ):
      raise Exception(g.T.cantchange)
    
    d = json.loads(g.request.get_data())
  
    command = StrV(d, 'command')
    
    if command == 'list':
      apps = {}
      
      for f in os.listdir('static'):
        apppath = os.path.join('static', f)
        
        if os.path.isdir(apppath):
          translations = {}
          
          for l in g.siteconfig['languages']:
            translationspath  = os.path.join(apppath, 'translations', l)
            
            if os.path.exists(translationspath):
              for t in os.listdir(translationspath):
                translations[os.path.splitext(t)[0]]  = 1
            
          apps[f] = list(translations.keys())
      
      results['data'] = apps
    elif command == 'load':
      app         = StrV(d, 'app')
      translation = StrV(d, 'translation')
      languages   = ArrayV(d, 'languages')
      
      if not app or not translation or not languages:
        raise Exception(g.T.missingparams)
      
      translations  = {}
      
      for lang in languages:
        try:
          T = types.SimpleNamespace()
          
          with open('static/' + app + '/translations/' + lang + '/' + translation + '.js', 'r') as f:
            exec(f.read())
          
          translations[lang]  = T.__dict__
        except Exception as e:
          pass
        
      results['data'] = translations
    elif command == 'save':
      app         = StrV(d, 'app')
      translation = StrV(d, 'translation')
      data        = DictV(d, 'data')
      
      if not app or not translation:
        raise Exception(g.T.missingparams)
      
      # Create blank files for new translations
      if not data:
        for l in g.siteconfig['languages']:
          data[l] = {}
      
      results['error']  = '';
      
      for lang, translations in data.items():
        try:
          dirname = 'static/' + app + '/translations/' + lang
          
          os.makedirs(dirname, 0o777, True)
          
          with open(dirname + '/' + translation + '.js', 'w') as f:
            for k, v in data[lang].items():
              f.write(f'T.{k}={json.dumps(v)}\n')
              
            f.write('\n')
        except Exception as e:
          traceback.print_exc()
          results['error']  += str(e) + '\n'
    elif command == 'rename' or command == 'copy':
      app         = StrV(d, 'app')
      newname     = StrV(d, 'newname')
      oldname     = StrV(d, 'oldname')
      
      if not app or not newname or not oldname:
        raise Exception(g.T.missingparams)
      
      apppath = os.path.join('static', app)
      
      for l in g.siteconfig['languages']:
        translationsdir  = os.path.join(apppath, 'translations', l)
        
        translationsfile  = os.path.join(translationsdir, oldname + '.js')
        
        if os.path.exists(translationsfile):
          if command == 'rename':
            os.replace(translationsfile, os.path.join(translationsdir, newname + '.js'))
          else:
            shutil.copy(translationsfile, os.path.join(translationsdir, newname + '.js'))
    elif command == 'delete':
      app         = StrV(d, 'app')
      translation = StrV(d, 'translation')
      
      for l in g.siteconfig['languages']:
        translationsfile  = os.path.join('static', app, 'translations', l, translation + '.js')
        
        if os.path.exists(translationsfile):
          os.remove(translationsfile)
    else:
      results['error']  = f'{g.T.cantunderstand} "{command}"'
  except Exception as e:
    traceback.print_exc()
    results['error']  = str(e)
  
  return results
 
# =====================================================================
def securityapi(g):
  """Sets security for database objects. Note that the DB_SECURE flag
  must be set on both the database and the model in order to apply.
  """
  results = {}
  
  try:
    d = json.loads(g.request.get_data())
    
    command = StrV(d, 'command')
    
    if command == 'load':
      modelname = StrV(d, 'model')
      model     = GetModel(modelname)
      objid     = StrV(d, 'objid')
      
      if not model or not objid:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model)
      
      if not model._dbflags & DB_SECURE:
        raise Exception(g.T.cantchange + modelname)
      
      obj = g.db.Load(model, FromShortCode(objid), model._dbid)
      
      results['dbowner']        = ToShortCode(obj.dbowner)
      results['dbaccess']       = obj.dbaccess
      results['dbgroup']        = ToShortCode(obj.dbgroup) if obj.dbgroup else ''
      results['dbgroupaccess']  = obj.dbgroupaccess
      
      acl = obj.GetACL(g.db)
      
      acljson = {
        'users':  {},
        'groups': {}
      }
      
      if not acl:
        results['dbacl']  = acljson
      else:
        for k, v in acl['users'].items():
          userobj = {
            'displayname':  '',
            'access':       v
          }
          
          if 'admins' in g.session['groups']:
            try:
              userobj['displayname']  = BestTranslation(
                g.db.Load(system_user, k, 'displayname').displayname, 
                g.session.langcodes
              )
            except Exception as e:
              userobj['displayname']  = f'Error: {e}'
            
          acljson['users'][k] = userobj
          
        for k, v in acl['groups'].items():
          groupobj = {
            'displayname':  '',
            'access':       v
          }
          
          if 'admins' in g.session['groups']:
            try:
              groupobj['displayname']  = BestTranslation(
                g.db.Load(system_group, k, 'displayname').displayname, 
                g.session.langcodes
              )
            except Exception as e:
              groupobj['displayname']  = f'Error: {e}'
            
          acljson['groups'][k] = groupobj
          
        results['dbacl']  = acljson            
      
      if 'admins' in g.session['groups']:
        try:
          results['ownername']  = BestTranslation(
            g.db.Load(system_user, obj.dbowner, 'displayname').displayname, 
            g.session.langcodes
          )
        except Exception as e:
          results['ownername']  = f'Error: {e}'
      else:
        results['ownername']  = results['dbowner']
      
      if obj.dbgroup:
        try:
          group = g.db.Load(system_group, obj.dbgroup, 'displayname')
          
          results['groupname']         = group.groupname
          results['groupdisplayname']  = BestTranslation(
            group.displayname, 
            g.session.langcodes
          )
        except Exception as e:
          results['groupname']          = ''
          results['groupdisplayname']   = f'Error: {e}'
      else:
        results['groupname']        = ''
        results['groupdisplayname'] = '[None]'
    elif command == 'searchgroups':
      keyword = StrV(d, 'keyword')
      start   = IntV(d, 'start', 0, 99999999, 0)
      limit   = IntV(d, 'limit', 10, 99999999, 100)
      
      cond    = []
      params  = []
      
      if keyword:
        conds.append('(groupname LIKE ? OR displayname LIKE ?)')
        params.append(EscapeSQL('%' + keyword + '%'))
        params.append(EscapeSQL('%' + keyword + '%'))
        
      if cond:
        cond  = 'WHERE ' + ' AND '.join(conds)
      
      objs    = []
      groups  = []
        
      if 'admins' in g.session['groups']:
        groups  = g.db.Find(
          system_group,
          cond,
          params,
          start   = start,
          limit   = limit,
          fields  = 'rid, groupname, displayname'
        )
      else:
        groups  = g.db.Linked(
          g.db.Load(system_user, g.session.userid, 'rid'),
          cond    = cond,
          params  = params,
          start   = start,
          limit   = limit,
          fields  = 'rid, groupname, displayname'
        )
      
      for r in groups:
        objs.append({
          'idcode':       ToShortCode(r.rid),
          'displayname':  BestTranslation(r.displayname, g.session.langcodes),
          'groupname':    r.groupname
        })
          
      results['count']  = len(groups)
      results['data']   = objs      
    elif command == 'save':
      modelname       = StrV(d, 'model')
      model           = GetModel(modelname)
      objid           = StrV(d, 'objid')
      dbowner         = StrV(d, 'dbowner')
      dbaccess        = IntV(d, 'dbaccess')
      dbgroup         = StrV(d, 'dbgroup')
      dbgroupaccess   = StrV(d, 'dbgroupaccess')
      dbacl           = DictV(d, 'dbacl')
      
      if not model or not objid or not dbowner:
        raise Exception(g.T.missingparams)
      
      g.db.RegisterModel(model)
      
      if not model._dbflags & DB_SECURE:
        raise Exception(g.T.cantchange + modelname)
      
      obj = g.db.Load(model, FromShortCode(objid), model._dbid)
      
      acl = obj.GetACL(g.db)
      
      acljson = {
        'users':  {},
        'groups': {}
      }
      
      if not acl:
        results['dbacl']  = acljson
      else:
        for k, v in acl['users'].items():
          userobj = {
            'displayname':  '',
            'access':       v
          }
          
          if 'admins' in g.session['groups']:
            try:
              userobj['displayname']  = BestTranslation(
                g.db.Load(system_user, k, 'displayname').displayname, 
                g.session.langcodes
              )
            except Exception as e:
              userobj['displayname']  = f'Error: {e}'
            
          acljson['users'][k] = userobj
          
        for k, v in acl['groups'].items():
          groupobj = {
            'displayname':  '',
            'access':       v
          }
          
          if 'admins' in g.session['groups']:
            try:
              groupobj['displayname']  = BestTranslation(
                g.db.Load(system_group, k, 'displayname').displayname, 
                g.session.langcodes
              )
            except Exception as e:
              groupobj['displayname']  = f'Error: {e}'
            
          acljson['groups'][k] = groupobj
          
        results['dbacl']  = acljson            
      
      if 'admins' in g.session['groups']:
        try:
          results['ownername']  = BestTranslation(
            g.db.Load(system_user, obj.dbowner, 'displayname').displayname, 
            g.session.langcodes
          )
        except Exception as e:
          results['ownername']  = f'Error: {e}'
      else:
        results['ownername']  = results['dbowner']
      
      if obj.dbgroup:
        try:
          group = g.db.Load(system_group, obj.dbgroup, 'displayname')
          
          results['groupname']         = group.groupname
          results['groupdisplayname']  = BestTranslation(
            group.displayname, 
            g.session.langcodes
          )
        except Exception as e:
          results['groupname']          = ''
          results['groupdisplayname']   = f'Error: {e}'
      else:
        results['groupname']        = ''
        results['groupdisplayname'] = '[None]'      
    else:
      results['error']  = f'{g.T.cantunderstand} "{command}"'
  except Exception as e:
    traceback.print_exc()
    results['error']  = str(e)
  
  return results
 
# *********************************************************************
ROUTES  = {
  'fileapi':          fileapi,
  'upload':           upload,
  'controlpanelapi':  controlpanelapi,
  'dbapi':            dbapi,
  'userapi':          userapi,
  'sessionvars':      sessionvars,
  'translationsapi':  translationsapi,
  'securityapi':      securityapi,
}