shlist

sl (24141B)

---

 #!/usr/bin/perl -I.
 use warnings;
 use strict;
 
 use BSD::arc4random qw(arc4random_bytes arc4random_stir);
 use Digest::SHA qw(sha256_base64);
 use File::Temp;
 use Getopt::Std;
 use IO::Socket::SSL;
 use IO::Socket::UNIX;
 use JSON::XS;
 use Log::Log4perl qw(:easy :no_extra_logdie_message);
 use Scalar::Util qw(looks_like_number);
 
 use SL::Database;
 
 require "msgs.pl";
 our (%msg_num, @msg_str, @msg_func, $protocol_ver);
 
 my %args;
 getopts("p:tv", \%args);
 
 # This is used by the parent to create the database if it doesn't already
 # exist. Each child then opens $db_file afterwards to do queries.
 my $db_file = "db";
 $db_file = File::Temp->new(SUFFIX => '.db', EXLOCK => 0) if ($args{t});
 
 my $level = $ERROR;
 $level = $DEBUG if ($args{v});
 
 Log::Log4perl->easy_init( {
 		level	=> $level,
 		utf8 	=> 1,
 		layout	=> '%d %P %p> %m%n' } );
 my $logger = get_logger('shlist.server');
 
 $logger->info("using database '$db_file'\n");
 
 my $db = SL::Database->new($db_file);
 $db->create_tables();
 
 # Create TCP listening socket on port given by '-p' or 5437.
 # All incoming connection requests will be accepted by this socket.
 # SSL Shouldn't be enabled here, see 'man IO::Socket::SSL'.
 my $server_socket = new IO::Socket::INET (
 	LocalPort => $args{p} || '5437',
 	Proto => 'tcp',
 	Listen => 1,
 	ReuseAddr => 1,
 );
 die "Could not create socket: $!\n" unless($server_socket);
 
 my ($addr, $port) = ($server_socket->sockhost(), $server_socket->sockport());
 $logger->info("accepting connections on $addr:$port\n");
 
 # Children who have exited do not have to be waited on with this
 $SIG{CHLD} = 'IGNORE';
 $SIG{TERM} = sub { exit 0 };
 
 # Accept new plain TCP connections and handle them in separate processes
 while (my $client_socket = $server_socket->accept()) {
 
 	# Create a child process to handle this client
 	my $pid = fork();
 	if (!defined $pid) {
 		die "error: can't fork: $!\n";
 	} elsif ($pid) {
 		# In parent: close our copy of the client socket and listen again
 		close $client_socket;
 		next;
 	}
 
 	close $server_socket;
 	# Stir the random pool after fork() just in case
 	arc4random_stir();
 
 	my $peer_addr = $client_socket->peerhost();
 	$logger->debug("new connection from $peer_addr\n");
 
 	# Upgrade plain TCP connection to SSL
 	my $ret = IO::Socket::SSL->start_SSL($client_socket,
 		SSL_server => 1,
 		SSL_cert_file => 'certs/cert_chain.pem',
 		SSL_key_file => 'certs/privkey.pem'
 	);
 	$logger->logdie("error: $SSL_ERROR\n") unless ($ret);
 
 	my $ssl_ver = $client_socket->get_sslversion();
 	my $ssl_cipher = $client_socket->get_cipher();
 	$logger->debug("ssl ok, ver = '$ssl_ver' cipher = '$ssl_cipher'\n");
 
 	my $db = SL::Database->new($db_file);
 	$db->prepare_stmt_handles();
 
 	# Handle messages until this client disconnects
 	handle_message($client_socket, $db) while (1);
 }
 
 # Receives a request and sends a response. Also sometimes sends push
 # notifications. Returns nothing.
 sub handle_message {
 	my ($client_socket, $db) = @_;
 
 	# Make sure this gets reset
 	undef $@;
 
 	# Wait for an entire message to be received
 	my ($ver, $msg_type, $request) = recv_msg($client_socket);
 
 	$db->{dbh}->begin_work;
 
 	# Every message type except 'device_add' needs to include 'device_id' in
 	# the request. Check that here.
 	my $device = undef;
 	if ($msg_type != $msg_num{device_add}) {
 		(my $err, $device) = get_device($db, $request->{device_id});
 
 		if ($err) {
 			send_msg($client_socket, $ver, $msg_type, make_error($err));
 			$db->{dbh}->commit;
 			return;
 		}
 	}
 
 	# Call appropriate message handler. Each handler returns both data that
 	# should be sent back over the main socket and notification data that
 	# gets sent over vendor specific API.
 	my ($response, $notify) = $msg_func[$msg_type]->($db, $request->{data}, $device);
 
 	$db->{dbh}->commit;
 	if ($@) {
 		$logger->error("db transaction aborted: $@\n");
 
 		# now rollback to undo the incomplete changes but do it in an
 		# eval{} as it may also fail
 		eval { $db->{dbh}->rollback };
 
 		$response->{status} = 'err';
 		$response->{reason} = 'database transaction aborted';
 
 		send_msg($client_socket, $ver, $msg_type, $response);
 		return;
 	}
 
 	# Respond to client over the main socket
 	send_msg($client_socket, $ver, $msg_type, $response);
 
 	# Some messages don't send notifications
 	return if (! defined $notify);
 
 	# Don't send notifications when there was en error
 	return if ($response->{status} eq 'err');
 
 	return if (@{ $notify->{devices} } == 0);
 
 	# Encode the notification message and find its size
 	my $msg = encode_json($notify);
 	my $msg_len = length($msg);
 
 	# Send to notification daemons
 	send_unix("../apnd.socket", $msg, $msg_len) unless ($args{t});
 	send_unix("../gcmd.socket", $msg, $msg_len) unless ($args{t});
 	send_unix("testd.socket", $msg, $msg_len) if ($args{t});
 }
 
 # Takes a device id and verifies it is present and valid.
 sub get_device {
 	my ($db, $device_id) = @_;
 
 	unless (defined $device_id) {
 		$logger->error("bad request, missing key 'device_id'\n");
 		return ("a missing message argument was required");
 	}
 
 	unless ($device_id && $device_id =~ m/^[a-zA-Z0-9+\/=]+$/) {
 		$logger->error("bad device id\n");
 		return ('the client sent a device id that was not base64');
 	}
 
 	$db->{select_device_id}->execute($device_id);
 	if (my ($num, $id, $phnum) = $db->{select_device_id}->fetchrow_array()) {
 		my $device = {
 			num => $num,
 			fp => fingerprint($id),
 			phnum => $phnum,
 			id => $id
 		};
 		return (undef, $device);
 	}
 
 	$logger->error("unknown device '$device_id'\n");
 	return ('the client sent an unknown device id');
 }
 
 # Connect to a Unix domain socket and send a message.
 # Returns nothing.
 sub send_unix {
 	my ($socket_path, $msg, $msg_len) = @_;
 
 	my $socket = IO::Socket::UNIX->new(
 		Type => SOCK_STREAM(),
 		Peer => $socket_path
 	);
 	unless ($socket) {
 		$logger->error("$socket_path: connect failed: $!\n");
 		return;
 	}
 
 	# This is the same function we use for TCP data sending
 	send_all($socket, $msg, $msg_len);
 
 	close($socket);
 }
 
 # Receive a complete message from the network. Validates:
 # - version, message type, payload size
 # - payload is JSON and the root was an object
 # Returns ($version, $msg_type, $payload) on success, exits on error.
 sub recv_msg {
 	my ($sock) = @_;
 
 	# First read the fixed size 6 byte header
 	my $header = read_all($sock, 6);
 	my ($version, $msg_type, $payload_size) = unpack("nnn", $header);
 
 	# Check version and message type are in range
 	$logger->logdie("error: unsupported protocol version $version\n") if ($version != 0);
 	$logger->logdie("error: unknown message type $msg_type\n") if ($msg_type >= @msg_str);
 
 	# Server requests are limited to 4KB size, a 0 byte payload will not be
 	# valid JSON so reject that here too.
 	if ($payload_size > 4096 || $payload_size == 0) {
 		$logger->logdie("error: $payload_size byte payload invalid\n");
 	}
 
 	# Now that we know the size of the message we can try and read the
 	# entire thing exactly
 	my $payload = read_all($sock, $payload_size);
 
 	# Throws an exception when $payload is bad JSON
 	my $request = decode_json($payload);
 
 	if (ref($request) ne "HASH") {
 		$logger->logdie("error: json payload didn't have dictionary root\n");
 	}
 	return ($version, $msg_type, $request);
 }
 
 # Read an exact amount of bytes from a socket.
 # Returns the data read from the socket on success, exits on error.
 sub read_all {
 	my ($sock, $bytes_total) = @_;
 
 	my $data;
 	my $bytes_read = 0;
 	while ($bytes_total > 0) {
 		my $read = $sock->sysread($data, $bytes_total, $bytes_read);
 
 		$logger->logdie("error: read failed: $!\n") if (!defined $read);
 		$logger->logdie("disconnected!\n") if ($read == 0);
 
 		$bytes_total -= $read;
 		$bytes_read += $read;
 	}
 
 	return $data;
 }
 
 # Creates and sends a complete message by concatentating the following together:
 # - version, message type, payload size
 # - encoded JSON response (we can't send native UTF-8 strings here)
 # Returns number of bytes sent on success, exits on failure.
 sub send_msg {
 	my ($sock, $ver, $msg_type, $response) = @_;
 
 	# Transform $response into JSON string with no character values > 255.
 	my $payload = encode_json($response);
 
 	my $header_len = 6;
 	my $payload_len = length($payload);
 
 	if ($payload_len > 65535) {
 		# Don't send a response that's too large.
 		# But do send an error *saying* the response was too large.
 		$logger->error("error: $payload_len byte response too large to send");
 
 		my $err = make_error("response too large");
 		return send_msg($sock, $ver, $msg_type, $err);
 	}
 
 	send_all($sock, pack("nnn", $ver, $msg_type, $payload_len), $header_len);
 	send_all($sock, $payload, $payload_len);
 
 	return $header_len + $payload_len;
 }
 
 # Send an exact amount of bytes to a socket. SSL sends max 16KB per frame.
 # Returns the number of bytes wrote, exits on write failure.
 sub send_all {
 	my ($socket, $data, $bytes_total) = @_;
 
 	my $bytes_written = 0;
 	while ($bytes_total) {
 		my $wrote = $socket->syswrite($data, $bytes_total, $bytes_written);
 
 		$logger->logdie("error: write failed: $!\n") unless (defined $wrote);
 
 		$bytes_total -= $wrote;
 		$bytes_written += $wrote;
 	}
 
 	return $bytes_written;
 }
 
 # 'device_add' message handler. Validates incoming phone number, makes sure this
 # phone number has not registered already and then creates a new device_id.
 # Does not return any push notifications because this device has no friends yet.
 sub msg_device_add {
 	my ($db, $request) = @_;
 
 	# XXX: check that these exists first
 	my $ph_num = $request->{'phone_number'};
 	my $os = $request->{'os'};
 
 	unless (looks_like_number($ph_num)) {
 		$logger->error("phone number invalid\n");
 		return make_error("the sent phone number is not a number");
 	}
 
 	$db->{ph_num_exists}->execute($ph_num);
 	if ($db->{ph_num_exists}->fetchrow_array()) {
 		$logger->error("phone number '$ph_num' already exists\n");
 		return make_error("the sent phone number already exists");
 	}
 	# Only accept a white list of operating systems
 	if ($os ne 'unix' && $os ne 'android' && $os ne 'ios') {
 		$logger->error("unknown operating system '$os'\n");
 		return make_error("operating system not supported");
 	}
 
 	# Create new 256 bit random hashed string that we use as the unique
 	# device id
 	my $device_id = sha256_base64(arc4random_bytes(32));
 	my $fp = fingerprint($device_id);
 
 	# Check the database to make sure this isn't duplicate
 	$db->{select_device_id}->execute($device_id);
 	if ($db->{select_device_id}->fetchrow_array()) {
 		$logger->error("id generation collision for '$device_id'\n");
 		return make_error("device id collision, please try again");
 	}
 
 	$db->{new_device}->execute($device_id, $ph_num, $os, undef, time, time);
 	$logger->debug("success, '$ph_num':'$fp' os '$os'\n");
 
 	return (make_ok( { data => $device_id } ), undef);
 }
 
 # 'device_update' message handler. Takes a device_id and a token and updates the
 # devices table with the new token. Used so that the notification infrastructure
 # knows about the latest token a device has.
 # Returns with an ok message.
 sub msg_device_update {
 	my ($db, $request, $dev) = @_;
 
 	$db->{update_device}->execute($request, $dev->{num});
 	$logger->debug("push token = '$request'\n");
 
 	return make_ok( { data => {} });
 }
 
 # Takes a device_id and a list structure and records this list in the database.
 # Also prepares an friend_added_list notification that should be sent to all my
 # mutual friends.
 sub msg_list_add {
 	my ($db, $list, $dev) = @_;
 
 	# XXX: check that $list contains the necessary keys!
 
 	$logger->debug("device '$dev->{fp}'\n");
 	#$log->print("new list name '$list->{name}'\n");
 
 	my $now = time;
 	# Create new list, use null for primary key so the new row automatically
 	# gets the lowest numbered integer that isn't used
 	$db->{new_list}->execute($list->{name}, $list->{date}, $now, $now);
 	my $list_num = $db->{dbh}->last_insert_id("", "", "", "");
 
 	# Assign first reference count to the new list: the lists creator
 	$db->{new_list_member}->execute($list_num, $dev->{num}, $now);
 
 	# Send back a full list structure. Be extra careful about types here as
 	# this is serialized by encode_json and types in Perl can be... tricky.
 	my $resp_list = {
 		num => $list_num,
 		name => $list->{name},
 		date => $list->{date},
 		items_complete => 0,
 		items_total => 0,
 		members => [ $dev->{phnum} ],
 		num_members => 1
 	};
 	my $response = make_ok( { data => $resp_list } );
 
 	$logger->debug("new list number is '$list_num'\n");
 
 	# For push notifications a list add on your part means all your friends
 	# gain a list in their other lists section. Create the same response
 	# that lists_get_other gives back for the notify payload
 	$db->{mutual_friend_notify_select}->execute($dev->{num});
 	my $notify->{devices} = $db->{mutual_friend_notify_select}->fetchall_arrayref();
 
 	# Prepare a smaller list structure that will be sent to every device
 	# selected above. Their client shows your new lists in their other lists
 	# section, which doesn't need a lot of information.
 	$notify->{msg_type} = 'friend_added_list';
 	$notify->{data} = {
 		num => $resp_list->{num},
 		name => $list->{name},
 		members => [ $dev->{phnum} ],
 		num_members => 1
 	};
 
 	return ($response, $notify);
 }
 
 sub msg_list_update {
 	my ($db, $list, $dev) = @_;
 
 	my ($err) = list_number_valid($db, $list->{num});
 	return make_error($err) if ($err);
 
 	# Check that the device is in the list it wants to update
 	$db->{check_list_member}->execute($list->{num}, $dev->{num});
 	unless ($db->{check_list_member}->fetchrow_array()) {
 		$logger->error("device '$dev->{fp}' not in list '$list->{num}'\n");
 		return make_error("client tried to update a list it was not in");
 	}
 
 	# Notify all of my mutual friends that my list changed
 	$db->{mutual_friend_notify_select}->execute($dev->{num});
 	my $mutual_friends = $db->{mutual_friend_notify_select}->fetchall_arrayref();
 
 	# Notify all of the other list members that this list changed
 	$db->{select_list_members}->execute($list->{num}, $dev->{num});
 	my $list_members = $db->{select_list_members}->fetchall_arrayref();
 
 	my $notify;
 	$notify->{devices} = [@{ $mutual_friends }, @{ $list_members }];
 
 	$notify->{msg_type} = 'updated_list';
 	$notify->{data} = {
 		num => $list->{num},
 		name => $list->{name},
 		date => $list->{date}
 	};
 	# print Dumper($notify);
 
 	# Update list row, note that some values here can be optional
 	$db->{update_list}->execute($list->{name}, $list->{date}, time, $list->{num});
 	$logger->debug("num  = '$list->{num}'\n");
 	$logger->debug("name = '$list->{name}'\n") if (exists $list->{name});
 	$logger->debug("date = $list->{date}\n") if (exists $list->{date});
 
 	return (make_ok( { data => {} } ), $notify);
 }
 
 sub msg_list_item_add {
     my ($db, $request, $device) = @_;
 
     return make_error("unimplemented");
 
     # my ($list_id, $position, $text) = split ("\0", $msg);
     
     # print "info: $addr: list $list_id\n";
     # print "info: $addr: position\n";
     # print "info: $addr: text $text\n";
 
     # check that list exists
     # check if item exists
     # check for "" owner on a stack
     # either create or add to unowned stack
     # owner will be emtpy
     # last_update 
 }
 
 sub msg_list_join {
     my ($db, $list_num, $dev) = @_;
 
     my ($list_err, $list_num_num, $list_name, $list_date) = list_number_valid($db, $list_num);
     return make_error($list_err) if ($list_err);
 
     my $time = time;
     $db->{check_list_member}->execute($list_num, $dev->{num});
 
     if (!$db->{check_list_member}->fetchrow_array()) {
         $db->{new_list_member}->execute($list_num, $dev->{num}, $time);
         $logger->debug("device '$dev->{fp}' has been added to list '$list_num'\n");
     } else {
         $logger->error("tried to create a duplicate list member entry for device '$dev->{fp}' and list '$list_num'\n");
 	return make_error("the device is already part of this list");
     }
 
     $db->{list_members_phnums}->execute($list_num);
     my $members_ref = $db->{list_members_phnums}->fetchall_arrayref();
     # $members_ref comes back as an array of arrays, flatten it
     my @members = map {@$_} @$members_ref;
 
     my $list = {
         num => $list_num_num,
         name => $list_name,
         date => $list_date,
         items_complete => 0,
         items_total => 0,
         members => \@members,
         num_members => scalar(@members)
     };
 
     $logger->debug("device '$dev->{fp}'\n");
     $logger->debug("list '$list_num'\n");
 
     return make_ok( { data => $list } );
 }
 
 sub msg_list_leave {
     my ($db, $list_num, $dev) = @_;
 
     my ($err) = list_number_valid($db, $list_num);
     return make_error($err) if ($err);
 
     $db->{check_list_member}->execute($list_num, $dev->{num});
 
     my $tmp_list_num = $list_num;
     if ($db->{check_list_member}->fetchrow_array()) {
         $db->{remove_list_member}->execute($list_num, $dev->{num});
         $logger->debug("device '$dev->{fp}' has been removed from list '$tmp_list_num'\n");
     } else {
         $logger->error("tried to leave a list the user was not in for device '$dev->{fp}' and list '$tmp_list_num'\n");
         return make_error("the client was not a member of the list");
     }
     $db->{check_list_member}->finish();
 
     $db->{get_list_members}->execute($list_num);
     
     my $list_empty = 0;
 
     if (!$db->{get_list_members}->fetchrow_array()) {
         $logger->debug("list '$tmp_list_num' is empty... deleting\n");
         $db->{delete_list}->execute($list_num);
         $db->{delete_list_data}->execute($list_num);
         $list_empty = 1;
     }
 
     my $response = {
         list_num => $list_num,
         list_empty => $list_empty
     };
 
     $logger->debug("device '$dev->{fp}'\n");
     $logger->debug("list '$list_num'\n");
 
     return make_ok( { data => $response } );
 }
 
 sub msg_friend_add {
 	my ($db, $friend_phnum, $dev) = @_;
 
 	$logger->debug("'$dev->{fp}' adding '$friend_phnum'\n");
 
 	unless (looks_like_number($friend_phnum)) {
 		$logger->error("bad friends number '$friend_phnum'\n");
 		return make_error("friends phone number is not a valid phone number");
 	}
 
 	# Check if I'm adding myself as a friend
 	if ($dev->{phnum} eq $friend_phnum) {
 		$logger->error("device '$dev->{fp}' tried adding itself\n");
 		return make_error("device cannot add itself as a friend");
 	}
 
 	# Add a 1 way friendship for this person
 	$db->{friends_insert}->execute($dev->{num}, $friend_phnum);
 
 	# Check if the added friend has registered their phone number
 	$db->{ph_num_exists}->execute($friend_phnum);
 	if (my ($friend_num, $friend_devid) = $db->{ph_num_exists}->fetchrow_array()) {
 
 		$logger->debug("added friend is a member\n");
 		my $friend_fp = fingerprint($friend_devid);
 		$logger->debug("friends device id is '$friend_fp'\n");
 
 		# Check if my phone number is in their friends list
 		$db->{friends_select}->execute($friend_num, $dev->{phnum});
 		if ($db->{friends_select}->fetchrow_array()) {
 			$logger->debug("found mutual friendship\n");
 
 			# Adding both is not necessary but makes lookups easier
 			$db->{mutual_friend_insert}->execute($dev->{num}, $friend_num);
 			$db->{mutual_friend_insert}->execute($friend_num, $dev->{num});
 		}
 	}
 
 	return make_ok( { data => $friend_phnum } );
 }
 
 sub msg_friend_delete {
 	my ($db, $friend_phnum, $dev) = @_;
 
 	unless (looks_like_number($friend_phnum)) {
 		$logger->error("bad friends number '$friend_phnum'\n");
 		return make_error("friends phone number is not a valid phone number");
 	}
 
 	$db->{friends_select}->execute($dev->{num}, $friend_phnum);
 	if ($db->{friends_select}->fetchrow_array()) {
 		$logger->debug("removing '$friend_phnum' from friends list\n");
 		$db->{friends_delete}->execute($dev->{num}, $friend_phnum);
 	}
 	else {
 		$logger->error("tried deleting friend '$friend_phnum' but they weren't a friend\n");
 		return make_error("friend sent for deletion was not a friend");
 	}
 
 	# Check for and delete any mutual friend references
 	$db->{ph_num_exists}->execute($friend_phnum);
 	if (my ($friend_num) = $db->{ph_num_exists}->fetchrow_array()) {
 
 		$logger->debug("also removing mutual friend relationship\n");
 		$db->{mutual_friends_delete}->execute($dev->{num}, $friend_num);
 		$db->{mutual_friends_delete}->execute($friend_num, $dev->{num});
 	}
 
 	return make_ok( { data => $friend_phnum } );
 }
 
 # Takes no arguments and finds all of the lists that the given device_id is in.
 # Fills out complete list structures to send back.
 # This message doesn't send any notifications.
 sub msg_lists_get {
 	my ($db, $request, $dev) = @_;
 
 	$logger->debug("gathering lists for '$dev->{fp}'\n");
 
 	my @lists;
 	# Find all lists that this device number is a member of
 	$db->{get_lists}->execute($dev->{num});
 	while (my ($num, $name, $date) = $db->{get_lists}->fetchrow_array()) {
 
 		# Get the phone numbers of all the list members
 		$db->{list_members_phnums}->execute($num);
 		my $members_ref = $db->{list_members_phnums}->fetchall_arrayref();
 
 		# $members_ref comes back as an array of arrays, flatten it
 		my @members = map {@$_} @$members_ref;
 
 		my $num_members = scalar(@members);
 		my $list = {
 			num => $num,
 			name => $name,
 			date => $date,
 			items_complete => 0,
 			items_total => 0,
 			members => \@members,
 			num_members => $num_members
 		};
 		push @lists, $list;
 
 		$logger->debug("found list '$num':'$name'\n");
 		$logger->debug("list has $num_members members\n");
 		$logger->debug("list has 0 items\n");
 	}
 
 	return make_ok( { data => \@lists} );
 }
 
 sub msg_lists_get_other {
 	my ($db, $request, $dev) = @_;
 
 	$logger->debug("gathering lists for '$dev->{fp}'\n");
 
 	my %list_nums;
 	# Find all mutual friends of this device
 	$db->{mutual_friend_select}->execute($dev->{num});
 	while (my @row = $db->{mutual_friend_select}->fetchrow_array()) {
 
 		my ($friend_num, $friend_phnum) = @row;
 		$logger->debug("found mutual friend '$friend_phnum'\n");
 
 		# Find all of the lists my mutual friend is in (but not me)
 		$db->{get_other_lists}->execute($friend_num, $dev->{num});
 		while (my ($list_num) = $db->{get_other_lists}->fetchrow_array()) {
 
 			my $lookup = $list_num;
 			if (exists $list_nums{$lookup}) {
 				# Append member and move on
 				push @{ $list_nums{$lookup}->{members} }, $friend_phnum;
 				$list_nums{$lookup}->{num_members} += 1;
 				next
 			}
 
 			$db->{list_select}->execute($list_num);
 			my (undef, $name) = $db->{list_select}->fetchrow_array();
 
 			my $list = {
 				num => $list_num,
 				name => $name,
 				members => [ $friend_phnum ],
 				num_members => 1
 			};
 			$list_nums{$list_num} = $list;
 			$logger->debug("found list '$name'\n");
 		}
 	}
 
 	my @other_lists = values(%list_nums);
 	return make_ok( { data => \@other_lists } );
 }
 
 sub msg_list_items_get {
 	my ($db, $request, $dev) = @_;
 
 	my $list_id = $request->{'list_num'};
 
 	if (!$list_id) {
 		$logger->error("received null list id");
 		return make_error("the sent list id was empty");
 	}
 	# unless ($dbh->selectrow_array($sth{check_list_member}, undef, $list_id, $device_id)) {
 	# 	# XXX: table list_members list_id's should always exist in table lists
 	# 	$log->print("list_items: $device_id not a member of $list_id\n");
 	# 	return "err\0the sent device id is not a member of the list";
 	# }
 	$logger->debug("$dev->{id} request items for $list_id\n");
 
 	$db->{get_list_items}->execute($list_id);
 
 	my @items;
 	while (my ($list_id, $pos, $name, $status, $owner, undef) =
 		$db->{get_list_items}->fetchrow_array()) {
 		$logger->error("list item #$pos $name\n");
 
 		push @items, "$pos:$name:$owner:$status";
 	}
 
 	my $out = join("\0", @items);
 	return make_ok();
 }
 
 sub fingerprint {
 	return substr shift, 0, 8;
 }
 
 sub list_number_valid {
 	my ($db, $list_num) = @_;
 
 	unless (defined $list_num) {
 		$logger->error("list number key not found\n");
 		return ("the client did not send a list number");
 	}
 
 	unless (looks_like_number($list_num)) {
 		$logger->error("'$list_num' is not a number\n");
 		return ("the client sent a list number that was not a number");
 	}
 
 	$db->{list_select}->execute($list_num);
 	if (my @row = $db->{list_select}->fetchrow_array()) {
 		return (undef, @row);
 	}
 
 	$logger->error("unknown list number '$list_num'\n");
 	return ("the client sent an unknown list number");
 }
 
 sub make_error {
 	my ($reason) = @_;
 	return { status => 'err', reason => $reason };
 }
 
 sub make_ok {
 	my ($args) = @_;
 
 	$args->{status} = 'ok';
 	return $args;
 }