The Big Renaming - etherpad is now an NPM module

src/node/db/API.js

@@ -0,0 +1,520 @@
+/**
+ * This module provides all API functions
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var ERR = require("async-stacktrace");
+var customError = require("../utils/customError");
+var padManager = require("./PadManager");
+var padMessageHandler = require("../handler/PadMessageHandler");
+var readOnlyManager = require("./ReadOnlyManager");
+var groupManager = require("./GroupManager");
+var authorManager = require("./AuthorManager");
+var sessionManager = require("./SessionManager");
+var async = require("async");
+var exportHtml = require("../utils/ExportHtml");
+var importHtml = require("../utils/ImportHtml");
+var cleanText = require("./Pad").cleanText;
+
+/**********************/
+/**GROUP FUNCTIONS*****/
+/**********************/
+
+exports.createGroup = groupManager.createGroup;
+exports.createGroupIfNotExistsFor = groupManager.createGroupIfNotExistsFor;
+exports.deleteGroup = groupManager.deleteGroup;
+exports.listPads = groupManager.listPads;
+exports.createGroupPad = groupManager.createGroupPad;
+
+/**********************/
+/**AUTHOR FUNCTIONS****/
+/**********************/
+
+exports.createAuthor = authorManager.createAuthor;
+exports.createAuthorIfNotExistsFor = authorManager.createAuthorIfNotExistsFor;
+
+/**********************/
+/**SESSION FUNCTIONS***/
+/**********************/
+
+exports.createSession = sessionManager.createSession;
+exports.deleteSession = sessionManager.deleteSession;
+exports.getSessionInfo = sessionManager.getSessionInfo;
+exports.listSessionsOfGroup = sessionManager.listSessionsOfGroup;
+exports.listSessionsOfAuthor = sessionManager.listSessionsOfAuthor;
+
+/************************/
+/**PAD CONTENT FUNCTIONS*/
+/************************/
+
+/**
+getText(padID, [rev]) returns the text of a pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: {text:"Welcome Text"}}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.getText = function(padID, rev, callback)
+{
+  //check if rev is set
+  if(typeof rev == "function")
+  {
+    callback = rev;
+    rev = undefined;
+  }
+  
+  //check if rev is a number
+  if(rev !== undefined && typeof rev != "number")
+  {
+    //try to parse the number
+    if(!isNaN(parseInt(rev)))
+    {
+      rev = parseInt(rev);
+    }
+    else
+    {
+      callback(new customError("rev is not a number", "apierror"));
+      return;
+    }
+  }
+  
+  //ensure this is not a negativ number
+  if(rev !== undefined && rev < 0)
+  {
+    callback(new customError("rev is a negativ number","apierror"));
+    return;
+  }
+  
+  //ensure this is not a float value
+  if(rev !== undefined && !is_int(rev))
+  {
+    callback(new customError("rev is a float value","apierror"));
+    return;
+  }
+  
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    //the client asked for a special revision
+    if(rev !== undefined)
+    {
+      //check if this is a valid revision
+      if(rev > pad.getHeadRevisionNumber())
+      {
+        callback(new customError("rev is higher than the head revision of the pad","apierror"));
+        return;
+      }
+      
+      //get the text of this revision
+      pad.getInternalRevisionAText(rev, function(err, atext)
+      {
+        if(ERR(err, callback)) return;
+        
+        data = {text: atext.text};
+        
+        callback(null, data);
+      })
+    }
+    //the client wants the latest text, lets return it to him
+    else
+    {
+      callback(null, {"text": pad.text()});
+    }
+  });
+}
+
+/**
+setText(padID, text) sets the text of a pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: null}
+{code: 1, message:"padID does not exist", data: null}
+{code: 1, message:"text too long", data: null}
+*/
+exports.setText = function(padID, text, callback)
+{    
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    //set the text
+    pad.setText(text);
+    
+    //update the clients on the pad
+    padMessageHandler.updatePadClients(pad, callback);
+  });
+}
+
+/**
+getHTML(padID, [rev]) returns the html of a pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: {text:"Welcome <strong>Text</strong>"}}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.getHTML = function(padID, rev, callback)
+{
+  if(typeof rev == "function")
+  {
+    callback = rev;
+    rev = undefined; 
+  }
+
+  if (rev !== undefined && typeof rev != "number")
+  {
+    if (!isNaN(parseInt(rev)))
+    {
+      rev = parseInt(rev);
+    }
+    else
+    {
+      callback(new customError("rev is not a number","apierror"));
+      return;
+    }
+  }
+
+  if(rev !== undefined && rev < 0)
+  {
+     callback(new customError("rev is a negative number","apierror"));
+     return;
+  }
+
+  if(rev !== undefined && !is_int(rev))
+  {
+    callback(new customError("rev is a float value","apierror"));
+    return;
+  }
+
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    //the client asked for a special revision
+    if(rev !== undefined)
+    {
+      //check if this is a valid revision
+      if(rev > pad.getHeadRevisionNumber())
+      {
+        callback(new customError("rev is higher than the head revision of the pad","apierror"));
+        return;
+      }
+     
+      //get the html of this revision 
+      exportHtml.getPadHTML(pad, rev, function(err, html)
+      {
+          if(ERR(err, callback)) return;
+          data = {html: html};
+          callback(null, data);
+      });
+    }
+    //the client wants the latest text, lets return it to him
+    else
+    {
+      exportHtml.getPadHTML(pad, undefined, function (err, html)
+      {
+        if(ERR(err, callback)) return;
+        
+        data = {html: html};
+          
+        callback(null, data);
+      });
+    }
+  });
+}
+
+exports.setHTML = function(padID, html, callback)
+{
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+
+    // add a new changeset with the new html to the pad
+    importHtml.setPadHTML(pad, cleanText(html));
+
+    //update the clients on the pad
+    padMessageHandler.updatePadClients(pad, callback);
+
+  });
+}
+
+/*****************/
+/**PAD FUNCTIONS */
+/*****************/
+
+/**
+getRevisionsCount(padID) returns the number of revisions of this pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: {revisions: 56}}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.getRevisionsCount = function(padID, callback)
+{
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    callback(null, {revisions: pad.getHeadRevisionNumber()});
+  });
+}
+
+/**
+createPad(padName [, text]) creates a new pad in this group 
+
+Example returns:
+
+{code: 0, message:"ok", data: null}
+{code: 1, message:"pad does already exist", data: null}
+*/
+exports.createPad = function(padID, text, callback)
+{  
+  //ensure there is no $ in the padID
+  if(padID && padID.indexOf("$") != -1)
+  {
+    callback(new customError("createPad can't create group pads","apierror"));
+    return;
+  }
+  
+  //create pad
+  getPadSafe(padID, false, text, function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback();
+  });
+}
+
+/**
+deletePad(padID) deletes a pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: null}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.deletePad = function(padID, callback)
+{
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    pad.remove(callback);
+  });
+}
+
+/**
+getReadOnlyLink(padID) returns the read only link of a pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: null}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.getReadOnlyID = function(padID, callback)
+{
+  //we don't need the pad object, but this function does all the security stuff for us
+  getPadSafe(padID, true, function(err)
+  {
+    if(ERR(err, callback)) return;
+    
+    //get the readonlyId
+    readOnlyManager.getReadOnlyId(padID, function(err, readOnlyId)
+    {
+      if(ERR(err, callback)) return;
+      callback(null, {readOnlyID: readOnlyId});
+    });
+  });
+}
+
+/**
+setPublicStatus(padID, publicStatus) sets a boolean for the public status of a pad 
+
+Example returns:
+
+{code: 0, message:"ok", data: null}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.setPublicStatus = function(padID, publicStatus, callback)
+{
+  //ensure this is a group pad
+  if(padID && padID.indexOf("$") == -1)
+  {
+    callback(new customError("You can only get/set the publicStatus of pads that belong to a group","apierror"));
+    return;
+  }
+
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    //convert string to boolean
+    if(typeof publicStatus == "string")
+      publicStatus = publicStatus == "true" ? true : false;
+    
+    //set the password
+    pad.setPublicStatus(publicStatus);
+    
+    callback();
+  });
+}
+
+/**
+getPublicStatus(padID) return true of false 
+
+Example returns:
+
+{code: 0, message:"ok", data: {publicStatus: true}}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.getPublicStatus = function(padID, callback)
+{
+  //ensure this is a group pad
+  if(padID && padID.indexOf("$") == -1)
+  {
+    callback(new customError("You can only get/set the publicStatus of pads that belong to a group","apierror"));
+    return;
+  }
+  
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    callback(null, {publicStatus: pad.getPublicStatus()});
+  });
+}
+
+/**
+setPassword(padID, password) returns ok or a error message 
+
+Example returns:
+
+{code: 0, message:"ok", data: null}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.setPassword = function(padID, password, callback)
+{
+  //ensure this is a group pad
+  if(padID && padID.indexOf("$") == -1)
+  {
+    callback(new customError("You can only get/set the password of pads that belong to a group","apierror"));
+    return;
+  }
+  
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    //set the password
+    pad.setPassword(password);
+    
+    callback();
+  });
+}
+
+/**
+isPasswordProtected(padID) returns true or false 
+
+Example returns:
+
+{code: 0, message:"ok", data: {passwordProtection: true}}
+{code: 1, message:"padID does not exist", data: null}
+*/
+exports.isPasswordProtected = function(padID, callback)
+{
+  //ensure this is a group pad
+  if(padID && padID.indexOf("$") == -1)
+  {
+    callback(new customError("You can only get/set the password of pads that belong to a group","apierror"));
+    return;
+  }
+
+  //get the pad
+  getPadSafe(padID, true, function(err, pad)
+  {
+    if(ERR(err, callback)) return;
+    
+    callback(null, {isPasswordProtected: pad.isPasswordProtected()});
+  });
+}
+
+/******************************/
+/** INTERNAL HELPER FUNCTIONS */
+/******************************/
+
+//checks if a number is an int
+function is_int(value)
+{ 
+  return (parseFloat(value) == parseInt(value)) && !isNaN(value)
+}
+
+//gets a pad safe
+function getPadSafe(padID, shouldExist, text, callback)
+{
+  if(typeof text == "function")
+  {
+    callback = text;
+    text = null;
+  }
+
+  //check if padID is a string
+  if(typeof padID != "string")
+  {
+    callback(new customError("padID is not a string","apierror"));
+    return;
+  }
+  
+  //check if the padID maches the requirements
+  if(!padManager.isValidPadId(padID))
+  {
+    callback(new customError("padID did not match requirements","apierror"));
+    return;
+  }
+  
+  //check if the pad exists
+  padManager.doesPadExists(padID, function(err, exists)
+  {
+    if(ERR(err, callback)) return;
+    
+    //does not exist, but should
+    if(exists == false && shouldExist == true)
+    {
+      callback(new customError("padID does not exist","apierror"));
+    }
+    //does exists, but shouldn't
+    else if(exists == true && shouldExist == false)
+    {
+      callback(new customError("padID does already exist","apierror"));
+    }
+    //pad exists, let's get it
+    else
+    {
+      padManager.getPad(padID, text, callback);
+    }
+  });
+}

src/node/db/AuthorManager.js

@@ -0,0 +1,181 @@
+/**
+ * The AuthorManager controlls all information about the Pad authors
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var CommonCode = require('../utils/common_code');
+var ERR = require("async-stacktrace");
+var db = require("./DB").db;
+var async = require("async");
+var randomString = CommonCode.require('/pad_utils').randomString;
+
+/**
+ * Checks if the author exists
+ */
+exports.doesAuthorExists = function (authorID, callback)
+{
+  //check if the database entry of this author exists
+  db.get("globalAuthor:" + authorID, function (err, author)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, author != null);
+  });
+}
+
+/**
+ * Returns the AuthorID for a token. 
+ * @param {String} token The token 
+ * @param {Function} callback callback (err, author) 
+ */
+exports.getAuthor4Token = function (token, callback)
+{
+  mapAuthorWithDBKey("token2author", token, function(err, author)
+  {
+    if(ERR(err, callback)) return;
+    //return only the sub value authorID
+    callback(null, author ? author.authorID : author);
+  });
+}
+
+/**
+ * Returns the AuthorID for a mapper. 
+ * @param {String} token The mapper
+ * @param {Function} callback callback (err, author) 
+ */
+exports.createAuthorIfNotExistsFor = function (authorMapper, name, callback)
+{
+  mapAuthorWithDBKey("mapper2author", authorMapper, function(err, author)
+  {
+    if(ERR(err, callback)) return;
+    
+    //set the name of this author
+    if(name)
+      exports.setAuthorName(author.authorID, name);
+      
+    //return the authorID
+    callback(null, author);
+  });
+}
+
+/**
+ * Returns the AuthorID for a mapper. We can map using a mapperkey,
+ * so far this is token2author and mapper2author
+ * @param {String} mapperkey The database key name for this mapper 
+ * @param {String} mapper The mapper
+ * @param {Function} callback callback (err, author) 
+ */
+function mapAuthorWithDBKey (mapperkey, mapper, callback)
+{  
+  //try to map to an author
+  db.get(mapperkey + ":" + mapper, function (err, author)
+  {
+    if(ERR(err, callback)) return;
+  
+    //there is no author with this mapper, so create one
+    if(author == null)
+    {
+      exports.createAuthor(null, function(err, author)
+      {
+        if(ERR(err, callback)) return;
+        
+        //create the token2author relation
+        db.set(mapperkey + ":" + mapper, author.authorID);
+        
+        //return the author
+        callback(null, author);
+      });
+    }
+    //there is a author with this mapper
+    else
+    {
+      //update the timestamp of this author
+      db.setSub("globalAuthor:" + author, ["timestamp"], new Date().getTime());
+      
+      //return the author
+      callback(null, {authorID: author});
+    }
+  });
+}
+
+/**
+ * Internal function that creates the database entry for an author 
+ * @param {String} name The name of the author 
+ */
+exports.createAuthor = function(name, callback)
+{
+  //create the new author name
+  var author = "a." + randomString(16);
+        
+  //create the globalAuthors db entry
+  var authorObj = {"colorId" : Math.floor(Math.random()*32), "name": name, "timestamp": new Date().getTime()};
+        
+  //set the global author db entry
+  db.set("globalAuthor:" + author, authorObj);
+  
+  callback(null, {authorID: author});
+}
+
+/**
+ * Returns the Author Obj of the author
+ * @param {String} author The id of the author
+ * @param {Function} callback callback(err, authorObj)
+ */
+exports.getAuthor = function (author, callback)
+{
+  db.get("globalAuthor:" + author, callback);
+}
+
+/**
+ * Returns the color Id of the author
+ * @param {String} author The id of the author
+ * @param {Function} callback callback(err, colorId)
+ */
+exports.getAuthorColorId = function (author, callback)
+{
+  db.getSub("globalAuthor:" + author, ["colorId"], callback);
+}
+
+/**
+ * Sets the color Id of the author
+ * @param {String} author The id of the author
+ * @param {Function} callback (optional)
+ */
+exports.setAuthorColorId = function (author, colorId, callback)
+{
+  db.setSub("globalAuthor:" + author, ["colorId"], colorId, callback);
+}
+
+/**
+ * Returns the name of the author
+ * @param {String} author The id of the author
+ * @param {Function} callback callback(err, name)
+ */
+exports.getAuthorName = function (author, callback)
+{
+  db.getSub("globalAuthor:" + author, ["name"], callback);
+}
+
+/**
+ * Sets the name of the author
+ * @param {String} author The id of the author
+ * @param {Function} callback (optional)
+ */
+exports.setAuthorName = function (author, name, callback)
+{
+  db.setSub("globalAuthor:" + author, ["name"], name, callback);
+}

src/node/db/DB.js

@@ -0,0 +1,57 @@
+/**
+ * The DB Module provides a database initalized with the settings 
+ * provided by the settings module
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var ueberDB = require("ueberDB");
+var settings = require("../utils/Settings");
+var log4js = require('log4js');
+
+//set database settings
+var db = new ueberDB.database(settings.dbType, settings.dbSettings, null, log4js.getLogger("ueberDB"));
+
+/**
+ * The UeberDB Object that provides the database functions
+ */
+exports.db = null;
+
+/**
+ * Initalizes the database with the settings provided by the settings module
+ * @param {Function} callback 
+ */
+exports.init = function(callback)
+{
+  //initalize the database async
+  db.init(function(err)
+  {
+    //there was an error while initializing the database, output it and stop 
+    if(err)
+    {
+      console.error("ERROR: Problem while initalizing the database");
+      console.error(err.stack ? err.stack : err);
+      process.exit(1);
+    }
+    //everything ok
+    else
+    {
+      exports.db = db;  
+      callback(null);
+    }
+  });
+}

src/node/db/GroupManager.js

@@ -0,0 +1,263 @@
+/**
+ * The Group Manager provides functions to manage groups in the database
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+ 
+var CommonCode = require('../utils/common_code');
+var ERR = require("async-stacktrace");
+var customError = require("../utils/customError");
+var randomString = CommonCode.require('/pad_utils').randomString;
+var db = require("./DB").db;
+var async = require("async");
+var padManager = require("./PadManager");
+var sessionManager = require("./SessionManager");
+ 
+exports.deleteGroup = function(groupID, callback)
+{
+  var group;
+
+  async.series([
+    //ensure group exists 
+    function (callback)
+    {
+      //try to get the group entry
+      db.get("group:" + groupID, function (err, _group)
+      {
+        if(ERR(err, callback)) return;
+        
+        //group does not exist
+        if(_group == null)
+        {
+          callback(new customError("groupID does not exist","apierror"));
+        }
+        //group exists, everything is fine
+        else
+        {
+          group = _group;
+          callback();
+        }
+      });
+    },
+    //iterate trough all pads of this groups and delete them
+    function(callback)
+    {
+      //collect all padIDs in an array, that allows us to use async.forEach
+      var padIDs = [];
+      for(var i in group.pads)
+      {
+        padIDs.push(i);
+      }
+      
+      //loop trough all pads and delete them 
+      async.forEach(padIDs, function(padID, callback)
+      {
+        padManager.getPad(padID, function(err, pad)
+        {
+          if(ERR(err, callback)) return;
+          
+          pad.remove(callback);
+        });
+      }, callback);
+    },
+    //iterate trough group2sessions and delete all sessions
+    function(callback)
+    {
+      //try to get the group entry
+      db.get("group2sessions:" + groupID, function (err, group2sessions)
+      {
+        if(ERR(err, callback)) return;
+        
+        //skip if there is no group2sessions entry
+        if(group2sessions == null) {callback(); return}
+        
+        //collect all sessions in an array, that allows us to use async.forEach
+        var sessions = [];
+        for(var i in group2sessions.sessionsIDs)
+        {
+          sessions.push(i);
+        }
+        
+        //loop trough all sessions and delete them 
+        async.forEach(sessions, function(session, callback)
+        {
+          sessionManager.deleteSession(session, callback);
+        }, callback);
+      });
+    },
+    //remove group and group2sessions entry
+    function(callback)
+    {
+      db.remove("group2sessions:" + groupID);
+      db.remove("group:" + groupID);
+      callback();
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback();
+  });
+}
+ 
+exports.doesGroupExist = function(groupID, callback)
+{
+  //try to get the group entry
+  db.get("group:" + groupID, function (err, group)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, group != null);
+  });
+}
+
+exports.createGroup = function(callback)
+{
+  //search for non existing groupID
+  var groupID = "g." + randomString(16);
+  
+  //create the group
+  db.set("group:" + groupID, {pads: {}});
+  callback(null, {groupID: groupID});
+}
+
+exports.createGroupIfNotExistsFor = function(groupMapper, callback)
+{
+  //ensure mapper is optional
+  if(typeof groupMapper != "string")
+  {
+    callback(new customError("groupMapper is no string","apierror"));
+    return;
+  }
+  
+  //try to get a group for this mapper
+  db.get("mapper2group:"+groupMapper, function(err, groupID)
+  {
+     if(ERR(err, callback)) return;
+     
+     //there is no group for this mapper, let's create a group
+     if(groupID == null)
+     {
+       exports.createGroup(function(err, responseObj)
+       {
+         if(ERR(err, callback)) return;
+         
+         //create the mapper entry for this group
+         db.set("mapper2group:"+groupMapper, responseObj.groupID);
+         
+         callback(null, responseObj);
+       });
+     }
+     //there is a group for this mapper, let's return it
+     else
+     {
+       if(ERR(err, callback)) return;
+       callback(null, {groupID: groupID});
+     }
+  });
+}
+
+exports.createGroupPad = function(groupID, padName, text, callback)
+{
+  //create the padID
+  var padID = groupID + "$" + padName;
+
+  async.series([
+    //ensure group exists 
+    function (callback)
+    {
+      exports.doesGroupExist(groupID, function(err, exists)
+      {
+        if(ERR(err, callback)) return;
+        
+        //group does not exist
+        if(exists == false)
+        {
+          callback(new customError("groupID does not exist","apierror"));
+        }
+        //group exists, everything is fine
+        else
+        {
+          callback();
+        }
+      });
+    },
+    //ensure pad does not exists
+    function (callback)
+    {
+      padManager.doesPadExists(padID, function(err, exists)
+      {
+        if(ERR(err, callback)) return;
+        
+        //pad exists already
+        if(exists == true)
+        {
+          callback(new customError("padName does already exist","apierror"));
+        }
+        //pad does not exist, everything is fine
+        else
+        {
+          callback();
+        }
+      });
+    },
+    //create the pad
+    function (callback)
+    {
+      padManager.getPad(padID, text, function(err)
+      {
+        if(ERR(err, callback)) return;
+        callback();
+      });
+    },
+    //create an entry in the group for this pad
+    function (callback)
+    {
+      db.setSub("group:" + groupID, ["pads", padID], 1);
+      callback();
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, {padID: padID});
+  });
+}
+
+exports.listPads = function(groupID, callback)
+{
+  exports.doesGroupExist(groupID, function(err, exists)
+  {
+    if(ERR(err, callback)) return;
+    
+    //group does not exist
+    if(exists == false)
+    {
+      callback(new customError("groupID does not exist","apierror"));
+    }
+    //group exists, let's get the pads
+    else
+    {
+      db.getSub("group:" + groupID, ["pads"], function(err, result)
+      {
+        if(ERR(err, callback)) return;
+        var pads = [];
+        for ( var padId in result ) {
+          pads.push(padId);
+        }
+        callback(null, {padIDs: pads});
+      });
+    }
+  });
+}

src/node/db/Pad.js

@@ -0,0 +1,488 @@
+/**
+ * The pad object, defined with joose
+ */
+
+var CommonCode = require('../utils/common_code');
+var ERR = require("async-stacktrace");
+var Changeset = CommonCode.require("/Changeset");
+var AttributePoolFactory = CommonCode.require("/AttributePoolFactory");
+var randomString = CommonCode.require('/pad_utils').randomString;
+var db = require("./DB").db;
+var async = require("async");
+var settings = require('../utils/Settings');
+var authorManager = require("./AuthorManager");
+var padManager = require("./PadManager");
+var padMessageHandler = require("../handler/PadMessageHandler");
+var readOnlyManager = require("./ReadOnlyManager");
+var crypto = require("crypto");
+
+/**
+ * Copied from the Etherpad source code. It converts Windows line breaks to Unix line breaks and convert Tabs to spaces
+ * @param txt
+ */
+exports.cleanText = function (txt) {
+  return txt.replace(/\r\n/g,'\n').replace(/\r/g,'\n').replace(/\t/g, '        ').replace(/\xa0/g, ' ');
+};
+
+
+var Pad = function Pad(id) {
+
+  this.atext = Changeset.makeAText("\n");
+  this.pool = AttributePoolFactory.createAttributePool();
+  this.head = -1;
+  this.chatHead = -1;
+  this.publicStatus = false;
+  this.passwordHash = null;
+  this.id = id;
+
+};
+
+exports.Pad = Pad;
+
+Pad.prototype.apool = function apool() {
+  return this.pool;
+};
+
+Pad.prototype.getHeadRevisionNumber = function getHeadRevisionNumber() {
+  return this.head;
+};
+
+Pad.prototype.getPublicStatus = function getPublicStatus() {
+  return this.publicStatus;
+};
+
+Pad.prototype.appendRevision = function appendRevision(aChangeset, author) {
+  if(!author)
+    author = '';
+
+  var newAText = Changeset.applyToAText(aChangeset, this.atext, this.pool);
+  Changeset.copyAText(newAText, this.atext);
+
+  var newRev = ++this.head;
+
+  var newRevData = {};
+  newRevData.changeset = aChangeset;
+  newRevData.meta = {};
+  newRevData.meta.author = author;
+  newRevData.meta.timestamp = new Date().getTime();
+
+  //ex. getNumForAuthor
+  if(author != '')
+    this.pool.putAttrib(['author', author || '']);
+
+  if(newRev % 100 == 0)
+  {
+    newRevData.meta.atext = this.atext;
+  }
+
+  db.set("pad:"+this.id+":revs:"+newRev, newRevData);
+  db.set("pad:"+this.id, {atext: this.atext,
+                          pool: this.pool.toJsonable(),
+                          head: this.head,
+                          chatHead: this.chatHead,
+                          publicStatus: this.publicStatus,
+                          passwordHash: this.passwordHash});
+};
+
+Pad.prototype.getRevisionChangeset = function getRevisionChangeset(revNum, callback) {
+  db.getSub("pad:"+this.id+":revs:"+revNum, ["changeset"], callback);
+};
+
+Pad.prototype.getRevisionAuthor = function getRevisionAuthor(revNum, callback) {
+  db.getSub("pad:"+this.id+":revs:"+revNum, ["meta", "author"], callback);
+};
+
+Pad.prototype.getRevisionDate = function getRevisionDate(revNum, callback) {
+  db.getSub("pad:"+this.id+":revs:"+revNum, ["meta", "timestamp"], callback);
+};
+
+Pad.prototype.getAllAuthors = function getAllAuthors() {
+  var authors = [];
+
+  for(key in this.pool.numToAttrib)
+  {
+    if(this.pool.numToAttrib[key][0] == "author" && this.pool.numToAttrib[key][1] != "")
+    {
+      authors.push(this.pool.numToAttrib[key][1]);
+    }
+  }
+
+  return authors;
+};
+
+Pad.prototype.getInternalRevisionAText = function getInternalRevisionAText(targetRev, callback) {
+  var _this = this;
+
+  var keyRev = this.getKeyRevisionNumber(targetRev);
+  var atext;
+  var changesets = [];
+
+  //find out which changesets are needed
+  var neededChangesets = [];
+  var curRev = keyRev;
+  while (curRev < targetRev)
+  {
+    curRev++;
+    neededChangesets.push(curRev);
+  }
+
+  async.series([
+    //get all needed data out of the database
+    function(callback)
+    {
+      async.parallel([
+        //get the atext of the key revision
+        function (callback)
+        {
+          db.getSub("pad:"+_this.id+":revs:"+keyRev, ["meta", "atext"], function(err, _atext)
+          {
+            if(ERR(err, callback)) return;
+            atext = Changeset.cloneAText(_atext);
+            callback();
+          });
+        },
+        //get all needed changesets
+        function (callback)
+        {
+          async.forEach(neededChangesets, function(item, callback)
+          {
+            _this.getRevisionChangeset(item, function(err, changeset)
+            {
+              if(ERR(err, callback)) return;
+              changesets[item] = changeset;
+              callback();
+            });
+          }, callback);
+        }
+      ], callback);
+    },
+    //apply all changesets to the key changeset
+    function(callback)
+    {
+      var apool = _this.apool();
+      var curRev = keyRev;
+
+      while (curRev < targetRev)
+      {
+        curRev++;
+        var cs = changesets[curRev];
+        atext = Changeset.applyToAText(cs, atext, apool);
+      }
+
+      callback(null);
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, atext);
+  });
+};
+
+Pad.prototype.getKeyRevisionNumber = function getKeyRevisionNumber(revNum) {
+  return Math.floor(revNum / 100) * 100;
+};
+
+Pad.prototype.text = function text() {
+  return this.atext.text;
+};
+
+Pad.prototype.setText = function setText(newText) {
+  //clean the new text
+  newText = exports.cleanText(newText);
+
+  var oldText = this.text();
+
+  //create the changeset
+  var changeset = Changeset.makeSplice(oldText, 0, oldText.length-1, newText);
+
+  //append the changeset
+  this.appendRevision(changeset);
+};
+
+Pad.prototype.appendChatMessage = function appendChatMessage(text, userId, time) {
+      this.chatHead++;
+      //save the chat entry in the database
+      db.set("pad:"+this.id+":chat:"+this.chatHead, {"text": text, "userId": userId, "time": time});
+      //save the new chat head
+      db.setSub("pad:"+this.id, ["chatHead"], this.chatHead);
+};
+
+Pad.prototype.getChatMessage = function getChatMessage(entryNum, callback) {
+  var _this = this;
+  var entry;
+
+  async.series([
+    //get the chat entry
+    function(callback)
+    {
+      db.get("pad:"+_this.id+":chat:"+entryNum, function(err, _entry)
+      {
+        if(ERR(err, callback)) return;
+        entry = _entry;
+        callback();
+      });
+    },
+    //add the authorName
+    function(callback)
+    {
+      //this chat message doesn't exist, return null
+      if(entry == null)
+      {
+        callback();
+        return;
+      }
+
+      //get the authorName
+      authorManager.getAuthorName(entry.userId, function(err, authorName)
+      {
+        if(ERR(err, callback)) return;
+        entry.userName = authorName;
+        callback();
+      });
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, entry);
+  });
+};
+
+Pad.prototype.getLastChatMessages = function getLastChatMessages(count, callback) {
+  //return an empty array if there are no chat messages
+  if(this.chatHead == -1)
+  {
+    callback(null, []);
+    return;
+  }
+
+  var _this = this;
+
+  //works only if we decrement the amount, for some reason
+  count--;
+
+  //set the startpoint
+  var start = this.chatHead-count;
+  if(start < 0)
+    start = 0;
+
+  //set the endpoint
+  var end = this.chatHead;
+
+  //collect the numbers of chat entries and in which order we need them
+  var neededEntries = [];
+  var order = 0;
+  for(var i=start;i<=end; i++)
+  {
+    neededEntries.push({entryNum:i, order: order});
+    order++;
+  }
+
+  //get all entries out of the database
+  var entries = [];
+  async.forEach(neededEntries, function(entryObject, callback)
+  {
+    _this.getChatMessage(entryObject.entryNum, function(err, entry)
+    {
+      if(ERR(err, callback)) return;
+      entries[entryObject.order] = entry;
+      callback();
+    });
+  }, function(err)
+  {
+    if(ERR(err, callback)) return;
+
+    //sort out broken chat entries
+    //it looks like in happend in the past that the chat head was
+    //incremented, but the chat message wasn't added
+    var cleanedEntries = [];
+    for(var i=0;i<entries.length;i++)
+    {
+      if(entries[i]!=null)
+        cleanedEntries.push(entries[i]);
+      else
+        console.warn("WARNING: Found broken chat entry in pad " + _this.id);
+    }
+
+    callback(null, cleanedEntries);
+  });
+};
+
+Pad.prototype.init = function init(text, callback) {
+  var _this = this;
+
+  //replace text with default text if text isn't set
+  if(text == null)
+  {
+    text = settings.defaultPadText;
+  }
+
+  //try to load the pad
+  db.get("pad:"+this.id, function(err, value)
+  {
+    if(ERR(err, callback)) return;
+
+    //if this pad exists, load it
+    if(value != null)
+    {
+      _this.head = value.head;
+      _this.atext = value.atext;
+      _this.pool = _this.pool.fromJsonable(value.pool);
+
+      //ensure we have a local chatHead variable
+      if(value.chatHead != null)
+        _this.chatHead = value.chatHead;
+      else
+        _this.chatHead = -1;
+
+      //ensure we have a local publicStatus variable
+      if(value.publicStatus != null)
+        _this.publicStatus = value.publicStatus;
+      else
+        _this.publicStatus = false;
+
+      //ensure we have a local passwordHash variable
+      if(value.passwordHash != null)
+        _this.passwordHash = value.passwordHash;
+      else
+        _this.passwordHash = null;
+    }
+    //this pad doesn't exist, so create it
+    else
+    {
+      var firstChangeset = Changeset.makeSplice("\n", 0, 0, exports.cleanText(text));
+
+      _this.appendRevision(firstChangeset, '');
+    }
+
+    callback(null);
+  });
+};
+
+Pad.prototype.remove = function remove(callback) {
+  var padID = this.id;
+  var _this = this;
+
+  //kick everyone from this pad
+  padMessageHandler.kickSessionsFromPad(padID);
+
+  async.series([
+    //delete all relations
+    function(callback)
+    {
+      async.parallel([
+        //is it a group pad? -> delete the entry of this pad in the group
+        function(callback)
+        {
+          //is it a group pad?
+          if(padID.indexOf("$")!=-1)
+          {
+            var groupID = padID.substring(0,padID.indexOf("$"));
+
+            db.get("group:" + groupID, function (err, group)
+            {
+              if(ERR(err, callback)) return;
+
+              //remove the pad entry
+              delete group.pads[padID];
+
+              //set the new value
+              db.set("group:" + groupID, group);
+
+              callback();
+            });
+          }
+          //its no group pad, nothing to do here
+          else
+          {
+            callback();
+          }
+        },
+        //remove the readonly entries
+        function(callback)
+        {
+          readOnlyManager.getReadOnlyId(padID, function(err, readonlyID)
+          {
+            if(ERR(err, callback)) return;
+
+            db.remove("pad2readonly:" + padID);
+            db.remove("readonly2pad:" + readonlyID);
+
+            callback();
+          });
+        },
+        //delete all chat messages
+        function(callback)
+        {
+          var chatHead = _this.chatHead;
+
+          for(var i=0;i<=chatHead;i++)
+          {
+            db.remove("pad:"+padID+":chat:"+i);
+          }
+
+          callback();
+        },
+        //delete all revisions
+        function(callback)
+        {
+          var revHead = _this.head;
+
+          for(var i=0;i<=revHead;i++)
+          {
+            db.remove("pad:"+padID+":revs:"+i);
+          }
+
+          callback();
+        }
+      ], callback);
+    },
+    //delete the pad entry and delete pad from padManager
+    function(callback)
+    {
+      db.remove("pad:"+padID);
+      padManager.unloadPad(padID);
+      callback();
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback();
+  });
+};
+    //set in db
+Pad.prototype.setPublicStatus = function setPublicStatus(publicStatus) {
+  this.publicStatus = publicStatus;
+  db.setSub("pad:"+this.id, ["publicStatus"], this.publicStatus);
+};
+
+Pad.prototype.setPassword = function setPassword(password) {
+  this.passwordHash = password == null ? null : hash(password, generateSalt());
+  db.setSub("pad:"+this.id, ["passwordHash"], this.passwordHash);
+};
+
+Pad.prototype.isCorrectPassword = function isCorrectPassword(password) {
+  return compare(this.passwordHash, password);
+};
+
+Pad.prototype.isPasswordProtected = function isPasswordProtected() {
+  return this.passwordHash != null;
+};
+
+/* Crypto helper methods */
+
+function hash(password, salt)
+{
+  var shasum = crypto.createHash('sha512');
+  shasum.update(password + salt);
+  return shasum.digest("hex") + "$" + salt;
+}
+
+function generateSalt()
+{
+  return randomString(86);
+}
+
+function compare(hashStr, password)
+{
+  return hash(password, hashStr.split("$")[1]) === hashStr;
+}

src/node/db/PadManager.js

@@ -0,0 +1,164 @@
+/**
+ * The Pad Manager is a Factory for pad Objects
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var ERR = require("async-stacktrace");
+var customError = require("../utils/customError");
+var Pad = require("../db/Pad").Pad;
+var db = require("./DB").db;
+
+/** 
+ * An Object containing all known Pads. Provides "get" and "set" functions,
+ * which should be used instead of indexing with brackets. These prepend a
+ * colon to the key, to avoid conflicting with built-in Object methods or with
+ * these functions themselves.
+ *
+ * If this is needed in other places, it would be wise to make this a prototype
+ * that's defined somewhere more sensible.
+ */
+var globalPads = {
+    get: function (name) { return this[':'+name]; },
+    set: function (name, value) { this[':'+name] = value; },
+    remove: function (name) { delete this[':'+name]; }
+};
+
+/**
+ * An array of padId transformations. These represent changes in pad name policy over
+ * time, and allow us to "play back" these changes so legacy padIds can be found.
+ */
+var padIdTransforms = [
+  [/\s+/g, '_']
+];
+
+/**
+ * Returns a Pad Object with the callback
+ * @param id A String with the id of the pad
+ * @param {Function} callback 
+ */
+exports.getPad = function(id, text, callback)
+{    
+  //check if this is a valid padId
+  if(!exports.isValidPadId(id))
+  {
+    callback(new customError(id + " is not a valid padId","apierror"));
+    return;
+  }
+  
+  //make text an optional parameter
+  if(typeof text == "function")
+  {
+    callback = text;
+    text = null;
+  }
+  
+  //check if this is a valid text
+  if(text != null)
+  {
+    //check if text is a string
+    if(typeof text != "string")
+    {
+      callback(new customError("text is not a string","apierror"));
+      return;
+    }
+    
+    //check if text is less than 100k chars
+    if(text.length > 100000)
+    {
+      callback(new customError("text must be less than 100k chars","apierror"));
+      return;
+    }
+  }
+  
+  var pad = globalPads.get(id);
+  
+  //return pad if its already loaded
+  if(pad != null)
+  {
+    callback(null, pad);
+  }
+  //try to load pad
+  else
+  {
+    pad = new Pad(id);
+    
+    //initalize the pad
+    pad.init(text, function(err)
+    {
+      if(ERR(err, callback)) return;
+      
+      globalPads.set(id, pad);
+      callback(null, pad);
+    });
+  }
+}
+
+//checks if a pad exists
+exports.doesPadExists = function(padId, callback)
+{
+  db.get("pad:"+padId, function(err, value)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, value != null);  
+  });
+}
+
+//returns a sanitized padId, respecting legacy pad id formats
+exports.sanitizePadId = function(padId, callback) {
+  var transform_index = arguments[2] || 0;
+  //we're out of possible transformations, so just return it
+  if(transform_index >= padIdTransforms.length)
+  {
+    callback(padId);
+  }
+  //check if padId exists
+  else
+  {
+    exports.doesPadExists(padId, function(junk, exists)
+    {
+      if(exists)
+      {
+        callback(padId);
+      }
+      else
+      {
+        //get the next transformation *that's different*
+        var transformedPadId = padId;
+        while(transformedPadId == padId && transform_index < padIdTransforms.length)
+        {
+          transformedPadId = padId.replace(padIdTransforms[transform_index][0], padIdTransforms[transform_index][1]);
+          transform_index += 1;
+        }
+        //check the next transform
+        exports.sanitizePadId(transformedPadId, callback, transform_index);
+      }
+    });
+  }
+}
+
+exports.isValidPadId = function(padId)
+{
+  return /^(g.[a-zA-Z0-9]{16}\$)?[^$]{1,50}$/.test(padId);
+}
+
+//removes a pad from the array
+exports.unloadPad = function(padId)
+{
+  if(globalPads.get(padId))
+    globalPads.remove(padId);
+}

src/node/db/ReadOnlyManager.js

@@ -0,0 +1,74 @@
+/**
+ * The ReadOnlyManager manages the database and rendering releated to read only pads
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var CommonCode = require('../utils/common_code');
+var ERR = require("async-stacktrace");
+var db = require("./DB").db;
+var async = require("async");
+var randomString = CommonCode.require('/pad_utils').randomString;
+
+/**
+ * returns a read only id for a pad
+ * @param {String} padId the id of the pad
+ */
+exports.getReadOnlyId = function (padId, callback)
+{  
+  var readOnlyId;
+  
+  async.waterfall([
+    //check if there is a pad2readonly entry
+    function(callback)
+    {
+      db.get("pad2readonly:" + padId, callback);
+    },
+    function(dbReadOnlyId, callback)
+    {
+      //there is no readOnly Entry in the database, let's create one
+      if(dbReadOnlyId == null)
+      {
+        readOnlyId = "r." + randomString(16);
+        
+        db.set("pad2readonly:" + padId, readOnlyId);
+        db.set("readonly2pad:" + readOnlyId, padId);
+      }
+      //there is a readOnly Entry in the database, let's take this one
+      else
+      {
+        readOnlyId = dbReadOnlyId;
+      }
+      
+      callback();
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    //return the results
+    callback(null, readOnlyId);
+  })
+}
+
+/**
+ * returns a the padId for a read only id
+ * @param {String} readOnlyId read only id
+ */
+exports.getPadId = function(readOnlyId, callback)
+{
+  db.get("readonly2pad:" + readOnlyId, callback);
+}

src/node/db/SecurityManager.js

@@ -0,0 +1,280 @@
+/**
+ * Controls the security of pad access
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+var CommonCode = require('../utils/common_code');
+var ERR = require("async-stacktrace");
+var db = require("./DB").db;
+var async = require("async");
+var authorManager = require("./AuthorManager");
+var padManager = require("./PadManager");
+var sessionManager = require("./SessionManager");
+var settings = require("../utils/Settings")
+var randomString = CommonCode.require('/pad_utils').randomString;
+
+/**
+ * This function controlls the access to a pad, it checks if the user can access a pad.
+ * @param padID the pad the user wants to access
+ * @param sesssionID the session the user has (set via api)
+ * @param token the token of the author (randomly generated at client side, used for public pads)
+ * @param password the password the user has given to access this pad, can be null 
+ * @param callback will be called with (err, {accessStatus: grant|deny|wrongPassword|needPassword, authorID: a.xxxxxx})
+ */ 
+exports.checkAccess = function (padID, sessionID, token, password, callback)
+{ 
+  var statusObject;
+
+  // a valid session is required (api-only mode)
+  if(settings.requireSession)
+  {
+    // no sessionID, access is denied
+    if(!sessionID)
+    {
+      callback(null, {accessStatus: "deny"});
+      return;
+    }
+  }
+  // a session is not required, so we'll check if it's a public pad
+  else
+  {
+    // it's not a group pad, means we can grant access
+    if(padID.indexOf("$") == -1)
+    {
+      //get author for this token
+      authorManager.getAuthor4Token(token, function(err, author)
+      {
+        if(ERR(err, callback)) return;
+        
+        // assume user has access
+        statusObject = {accessStatus: "grant", authorID: author};
+        // user can't create pads
+        if(settings.editOnly)
+        {
+          // check if pad exists
+          padManager.doesPadExists(padID, function(err, exists)
+          {
+            if(ERR(err, callback)) return;
+            
+            // pad doesn't exist - user can't have access
+            if(!exists) statusObject.accessStatus = "deny";
+            // grant or deny access, with author of token
+            callback(null, statusObject);
+          });
+        }
+        // user may create new pads - no need to check anything
+        else
+        {
+          // grant access, with author of token
+          callback(null, statusObject);
+        }
+      })
+      
+      //don't continue
+      return;
+    }
+  }
+   
+  var groupID = padID.split("$")[0];
+  var padExists = false;
+  var validSession = false;
+  var sessionAuthor;
+  var tokenAuthor;
+  var isPublic;
+  var isPasswordProtected;
+  var passwordStatus = password == null ? "notGiven" : "wrong"; // notGiven, correct, wrong
+
+  async.series([
+    //get basic informations from the database 
+    function(callback)
+    {
+      async.parallel([
+        //does pad exists
+        function(callback)
+        {
+          padManager.doesPadExists(padID, function(err, exists)
+          {
+            if(ERR(err, callback)) return;
+            padExists = exists;
+            callback();
+          });
+        },
+        //get informations about this session
+        function(callback)
+        {
+          sessionManager.getSessionInfo(sessionID, function(err, sessionInfo)
+          {
+            //skip session validation if the session doesn't exists
+            if(err && err.message == "sessionID does not exist")
+            {
+              callback();
+              return;
+            }
+            
+            if(ERR(err, callback)) return;
+            
+            var now = Math.floor(new Date().getTime()/1000);
+            
+            //is it for this group? and is validUntil still ok? --> validSession
+            if(sessionInfo.groupID == groupID && sessionInfo.validUntil > now)
+            {
+              validSession = true;
+            }
+            
+            sessionAuthor = sessionInfo.authorID;
+            
+            callback();
+          });
+        },
+        //get author for token
+        function(callback)
+        {
+          //get author for this token
+          authorManager.getAuthor4Token(token, function(err, author)
+          {
+            if(ERR(err, callback)) return;
+            tokenAuthor = author;
+            callback();
+          });
+        }
+      ], callback);
+    },
+    //get more informations of this pad, if avaiable
+    function(callback)
+    {
+      //skip this if the pad doesn't exists
+      if(padExists == false) 
+      {
+        callback();
+        return;
+      }
+      
+      padManager.getPad(padID, function(err, pad)
+      {
+        if(ERR(err, callback)) return;
+        
+        //is it a public pad?
+        isPublic = pad.getPublicStatus();
+        
+        //is it password protected?
+        isPasswordProtected = pad.isPasswordProtected();
+        
+        //is password correct?
+        if(isPasswordProtected && password && pad.isCorrectPassword(password))
+        {
+          passwordStatus = "correct";
+        }
+        
+        callback();
+      });
+    },
+    function(callback)
+    {
+      //- a valid session for this group is avaible AND pad exists
+      if(validSession && padExists)
+      {
+        //- the pad is not password protected
+        if(!isPasswordProtected)
+        {
+          //--> grant access
+          statusObject = {accessStatus: "grant", authorID: sessionAuthor};
+        }
+        //- the pad is password protected and password is correct
+        else if(isPasswordProtected && passwordStatus == "correct")
+        {
+          //--> grant access
+          statusObject = {accessStatus: "grant", authorID: sessionAuthor};
+        }
+        //- the pad is password protected but wrong password given
+        else if(isPasswordProtected && passwordStatus == "wrong")
+        {
+          //--> deny access, ask for new password and tell them that the password is wrong
+          statusObject = {accessStatus: "wrongPassword"};
+        }
+        //- the pad is password protected but no password given
+        else if(isPasswordProtected && passwordStatus == "notGiven")
+        {
+          //--> ask for password
+          statusObject = {accessStatus: "needPassword"};
+        }
+        else
+        {
+          throw new Error("Ops, something wrong happend");
+        }
+      } 
+      //- a valid session for this group avaible but pad doesn't exists
+      else if(validSession && !padExists)
+      {
+        //--> grant access
+        statusObject = {accessStatus: "grant", authorID: sessionAuthor};
+        //--> deny access if user isn't allowed to create the pad
+        if(settings.editOnly) statusObject.accessStatus = "deny";
+      }
+      // there is no valid session avaiable AND pad exists
+      else if(!validSession && padExists)
+      {
+        //-- its public and not password protected
+        if(isPublic && !isPasswordProtected)
+        {
+          //--> grant access, with author of token
+          statusObject = {accessStatus: "grant", authorID: tokenAuthor};
+        }
+        //- its public and password protected and password is correct
+        else if(isPublic && isPasswordProtected && passwordStatus == "correct")
+        {
+          //--> grant access, with author of token
+          statusObject = {accessStatus: "grant", authorID: tokenAuthor};
+        }
+        //- its public and the pad is password protected but wrong password given 
+        else if(isPublic && isPasswordProtected && passwordStatus == "wrong")
+        {
+          //--> deny access, ask for new password and tell them that the password is wrong
+          statusObject = {accessStatus: "wrongPassword"};
+        }
+        //- its public and the pad is password protected but no password given
+        else if(isPublic && isPasswordProtected && passwordStatus == "notGiven")
+        {
+          //--> ask for password
+          statusObject = {accessStatus: "needPassword"};
+        }
+        //- its not public
+        else if(!isPublic)
+        {
+          //--> deny access
+          statusObject = {accessStatus: "deny"};
+        }
+        else
+        {
+          throw new Error("Ops, something wrong happend");
+        }
+      }    
+      // there is no valid session avaiable AND pad doesn't exists
+      else
+      {
+         //--> deny access
+         statusObject = {accessStatus: "deny"};
+      }
+      
+      callback();
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, statusObject);
+  });
+}

src/node/db/SessionManager.js

@@ -0,0 +1,367 @@
+/**
+ * The Session Manager provides functions to manage session in the database
+ */
+
+/*
+ * 2011 Peter 'Pita' Martischka (Primary Technology Ltd)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS-IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+ 
+var CommonCode = require('../utils/common_code');
+var ERR = require("async-stacktrace");
+var customError = require("../utils/customError");
+var randomString = CommonCode.require('/pad_utils').randomString;
+var db = require("./DB").db;
+var async = require("async");
+var groupMangager = require("./GroupManager");
+var authorMangager = require("./AuthorManager");
+ 
+exports.doesSessionExist = function(sessionID, callback)
+{
+  //check if the database entry of this session exists
+  db.get("session:" + sessionID, function (err, session)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, session != null);
+  });
+}
+ 
+/**
+ * Creates a new session between an author and a group
+ */
+exports.createSession = function(groupID, authorID, validUntil, callback)
+{
+  var sessionID;
+
+  async.series([
+    //check if group exists
+    function(callback)
+    {
+      groupMangager.doesGroupExist(groupID, function(err, exists)
+      {
+        if(ERR(err, callback)) return;
+        
+        //group does not exist
+        if(exists == false)
+        {
+          callback(new customError("groupID does not exist","apierror"));
+        }
+        //everything is fine, continue
+        else
+        {
+          callback();
+        }
+      });
+    },
+    //check if author exists
+    function(callback)
+    {
+      authorMangager.doesAuthorExists(authorID, function(err, exists)
+      {
+        if(ERR(err, callback)) return;
+        
+        //author does not exist
+        if(exists == false)
+        {
+          callback(new customError("authorID does not exist","apierror"));
+        }
+        //everything is fine, continue
+        else
+        {
+          callback();
+        }
+      });
+    },
+    //check validUntil and create the session db entry
+    function(callback)
+    {
+      //check if rev is a number
+      if(typeof validUntil != "number")
+      {
+        //try to parse the number
+        if(!isNaN(parseInt(validUntil)))
+        {
+          validUntil = parseInt(validUntil);
+        }
+        else
+        {
+          callback(new customError("validUntil is not a number","apierror"));
+          return;
+        }
+      }
+      
+      //ensure this is not a negativ number
+      if(validUntil < 0)
+      {
+        callback(new customError("validUntil is a negativ number","apierror"));
+        return;
+      }
+      
+      //ensure this is not a float value
+      if(!is_int(validUntil))
+      {
+        callback(new customError("validUntil is a float value","apierror"));
+        return;
+      }
+    
+      //check if validUntil is in the future
+      if(Math.floor(new Date().getTime()/1000) > validUntil)
+      {
+        callback(new customError("validUntil is in the past","apierror"));
+        return;
+      }
+      
+      //generate sessionID
+      sessionID = "s." + randomString(16);
+      
+      //set the session into the database
+      db.set("session:" + sessionID, {"groupID": groupID, "authorID": authorID, "validUntil": validUntil});
+      
+      callback();
+    },
+    //set the group2sessions entry
+    function(callback)
+    {
+      //get the entry
+      db.get("group2sessions:" + groupID, function(err, group2sessions)
+      {
+        if(ERR(err, callback)) return;
+        
+        //the entry doesn't exist so far, let's create it
+        if(group2sessions == null)
+        {
+          group2sessions = {sessionIDs : {}};
+        }
+        
+        //add the entry for this session
+        group2sessions.sessionIDs[sessionID] = 1;
+        
+        //save the new element back
+        db.set("group2sessions:" + groupID, group2sessions);
+        
+        callback();
+      });
+    },
+    //set the author2sessions entry
+    function(callback)
+    {
+      //get the entry
+      db.get("author2sessions:" + authorID, function(err, author2sessions)
+      {
+        if(ERR(err, callback)) return;
+        
+        //the entry doesn't exist so far, let's create it
+        if(author2sessions == null)
+        {
+          author2sessions = {sessionIDs : {}};
+        }
+        
+        //add the entry for this session
+        author2sessions.sessionIDs[sessionID] = 1;
+        
+        //save the new element back
+        db.set("author2sessions:" + authorID, author2sessions);
+        
+        callback();
+      });
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    
+    //return error and sessionID
+    callback(null, {sessionID: sessionID});
+  })
+}
+
+exports.getSessionInfo = function(sessionID, callback)
+{
+  //check if the database entry of this session exists
+  db.get("session:" + sessionID, function (err, session)
+  {
+    if(ERR(err, callback)) return;
+    
+    //session does not exists
+    if(session == null)
+    {
+      callback(new customError("sessionID does not exist","apierror"))
+    }
+    //everything is fine, return the sessioninfos
+    else
+    {
+      callback(null, session);
+    }
+  });
+}
+
+/**
+ * Deletes a session
+ */
+exports.deleteSession = function(sessionID, callback)
+{
+  var authorID, groupID;
+  var group2sessions, author2sessions;
+
+  async.series([
+    function(callback)
+    {
+      //get the session entry
+      db.get("session:" + sessionID, function (err, session)
+      {
+        if(ERR(err, callback)) return;
+        
+        //session does not exists
+        if(session == null)
+        {
+          callback(new customError("sessionID does not exist","apierror"))
+        }
+        //everything is fine, return the sessioninfos
+        else
+        {
+          authorID = session.authorID;
+          groupID = session.groupID;
+          
+          callback();
+        }
+      });
+    },
+    //get the group2sessions entry
+    function(callback)
+    {
+      db.get("group2sessions:" + groupID, function (err, _group2sessions)
+      {
+        if(ERR(err, callback)) return;
+        group2sessions = _group2sessions;
+        callback();
+      });
+    },
+    //get the author2sessions entry
+    function(callback)
+    {
+      db.get("author2sessions:" + authorID, function (err, _author2sessions)
+      {
+        if(ERR(err, callback)) return;
+        author2sessions = _author2sessions;
+        callback();
+      });
+    },
+    //remove the values from the database
+    function(callback)
+    {
+      //remove the session
+      db.remove("session:" + sessionID);
+      
+      //remove session from group2sessions
+      delete group2sessions.sessionIDs[sessionID];
+      db.set("group2sessions:" + groupID, group2sessions);
+      
+      //remove session from author2sessions
+      delete author2sessions.sessionIDs[sessionID];
+      db.set("author2sessions:" + authorID, author2sessions);
+      
+      callback();
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback();
+  })
+}
+
+exports.listSessionsOfGroup = function(groupID, callback)
+{
+  groupMangager.doesGroupExist(groupID, function(err, exists)
+  {
+    if(ERR(err, callback)) return;
+    
+    //group does not exist
+    if(exists == false)
+    {
+      callback(new customError("groupID does not exist","apierror"));
+    }
+    //everything is fine, continue
+    else
+    {
+      listSessionsWithDBKey("group2sessions:" + groupID, callback);
+    }
+  });
+}
+
+exports.listSessionsOfAuthor = function(authorID, callback)
+{  
+  authorMangager.doesAuthorExists(authorID, function(err, exists)
+  {
+    if(ERR(err, callback)) return;
+    
+    //group does not exist
+    if(exists == false)
+    {
+      callback(new customError("authorID does not exist","apierror"));
+    }
+    //everything is fine, continue
+    else
+    {
+      listSessionsWithDBKey("author2sessions:" + authorID, callback);
+    }
+  });
+}
+
+//this function is basicly the code listSessionsOfAuthor and listSessionsOfGroup has in common
+function listSessionsWithDBKey (dbkey, callback)
+{
+  var sessions;
+
+  async.series([
+    function(callback)
+    {
+      //get the group2sessions entry
+      db.get(dbkey, function(err, sessionObject)
+      {
+        if(ERR(err, callback)) return;
+        sessions = sessionObject ? sessionObject.sessionIDs : null;
+        callback();
+      });
+    },
+    function(callback)
+    {           
+      //collect all sessionIDs in an arrary
+      var sessionIDs = [];
+      for (var i in sessions)
+      {
+        sessionIDs.push(i);
+      }
+      
+      //foreach trough the sessions and get the sessioninfos
+      async.forEach(sessionIDs, function(sessionID, callback)
+      {
+        exports.getSessionInfo(sessionID, function(err, sessionInfo)
+        {
+          if(ERR(err, callback)) return;
+          sessions[sessionID] = sessionInfo;
+          callback();
+        });
+      }, callback);
+    }
+  ], function(err)
+  {
+    if(ERR(err, callback)) return;
+    callback(null, sessions);
+  });
+}
+
+//checks if a number is an int
+function is_int(value)
+{ 
+  return (parseFloat(value) == parseInt(value)) && !isNaN(value)
+}