feat: allow containerized deployments

At the moment, it seems like it should be working, but I get:
```
lua5.1: error loading module 'bcrypt' from file '/usr/local/openresty/luajit/lib/lua/5.1/bcrypt.so':
	Error relocating /usr/local/openresty/luajit/lib/lua/5.1/bcrypt.so: luaL_setfuncs: symbol not found
```

.gitignore

@@ -1,2 +1,10 @@
 logs/
 nginx.conf.compiled
+db.*.sqlite
+.vscode/
+.local/
+static/avatars/*
+!static/avatars/default.webp
+secrets.lua
+
+.first_launch.*

LICENSE.md

@@ -0,0 +1,483 @@
+THE WORK (AS DEFINED BELOW) IS PROVIDED UNDER THE TERMS OF THIS
+COOPERATIVE NON-VIOLENT PUBLIC LICENSE (\"LICENSE\"). THE WORK IS
+PROTECTED BY COPYRIGHT AND ALL OTHER APPLICABLE LAWS. ANY USE OF THE
+WORK OTHER THAN AS AUTHORIZED UNDER THIS LICENSE OR COPYRIGHT LAW IS
+PROHIBITED. BY EXERCISING ANY RIGHTS TO THE WORK PROVIDED IN THIS
+LICENSE, YOU AGREE TO BE BOUND BY THE TERMS OF THIS LICENSE. TO THE
+EXTENT THIS LICENSE MAY BE CONSIDERED TO BE A CONTRACT, THE LICENSOR
+GRANTS YOU THE RIGHTS CONTAINED HERE IN AS CONSIDERATION FOR ACCEPTING
+THE TERMS AND CONDITIONS OF THIS LICENSE AND FOR AGREEING TO BE BOUND BY
+THE TERMS AND CONDITIONS OF THIS LICENSE.
+
+# Definitions
+
+An Act of War is any action of one country against any group either with
+an intention to provoke a conflict or an action that occurs during a
+declared war or during armed conflict between military forces of any
+origin. This includes but is not limited to enforcing sanctions or
+sieges, supplying armed forces, or profiting from the manufacture of
+tools or weaponry used in military conflict.
+
+An Adaptation is a work based upon the Work, or upon the Work and other
+pre-existing works, such as a translation, adaptation, derivative work,
+arrangement of music or other alterations of a literary or artistic
+work, or phonogram or performance and includes cinematographic
+adaptations or any other form in which the Work may be recast,
+transformed, or adapted including in any form recognizably derived from
+the original, except that a work that constitutes a Collection will not
+be considered an Adaptation for the purpose of this License. For the
+avoidance of doubt, where the Work is a musical work, performance or
+phonogram, the synchronization of the Work in timed-relation with a
+moving image (\"synching\") will be considered an Adaptation for the
+purpose of this License. In addition, where the Work is designed to
+output a neural network the output of the neural network will be
+considered an Adaptation for the purpose of this license.
+
+Bodily Harm is any physical hurt or injury to a person that interferes
+with the health or comfort of the person and that is more than merely
+transient or trifling in nature.
+
+Distribute is to make available to the public the original and copies of
+the Work or Adaptation, as appropriate, through sale, gift or any other
+transfer of possession or ownership.
+
+Incarceration is Confinement in a jail, prison, or any other place where
+individuals of any kind are held against either their will or (if their
+will cannot be determined) the will of their legal guardian or
+guardians. In the case of a conflict between the will of the individual
+and the will of their legal guardian or guardians, the will of the
+individual will take precedence.
+
+Licensor is The individual, individuals, entity, or entities that
+offer(s) the Work under the terms of this License
+
+Original Author is in the case of a literary or artistic work, the
+individual, individuals, entity or entities who created the Work or if
+no individual or entity can be identified, the publisher; and in
+addition
+
+-   in the case of a performance the actors, singers, musicians,
+    dancers, and other persons who act, sing, deliver, declaim, play in,
+    interpret or otherwise perform literary or artistic works or
+    expressions of folklore;
+
+-   in the case of a phonogram the producer being the person or legal
+    entity who first fixes the sounds of a performance or other sounds;
+    and,
+
+-   in the case of broadcasts, the organization that transmits the
+    broadcast.
+
+Work is the literary and/or artistic work offered under the terms of
+this License including without limitation any production in the
+literary, scientific and artistic domain, whatever may be the mode or
+form of its expression including digital form, such as a book, pamphlet
+and other writing; a lecture, address, sermon or other work of the same
+nature; a dramatic or dramatico-musical work; a choreographic work or
+entertainment in dumb show; a musical composition with or without words;
+a cinematographic work to which are assimilated works expressed by a
+process analogous to cinematography; a work of drawing, painting,
+architecture, sculpture, engraving or lithography; a photographic work
+to which are assimilated works expressed by a process analogous to
+photography; a work of applied art; an illustration, map, plan, sketch
+or three-dimensional work relative to geography, topography,
+architecture or science; a performance; a broadcast; a phonogram; a
+compilation of data to the extent it is protected as a copyrightable
+work; or a work performed by a variety or circus performer to the extent
+it is not otherwise considered a literary or artistic work.
+
+You means an individual or entity exercising rights under this License
+who has not previously violated the terms of this License with respect
+to the Work, or who has received express permission from the Licensor to
+exercise rights under this License despite a previous violation.
+
+Publicly Perform means to perform public recitations of the Work and to
+communicate to the public those public recitations, by any means or
+process, including by wire or wireless means or public digital
+performances; to make available to the public Works in such a way that
+members of the public may access these Works from a place and at a place
+individually chosen by them; to perform the Work to the public by any
+means or process and the communication to the public of the performances
+of the Work, including by public digital performance; to broadcast and
+rebroadcast the Work by any means including signs, sounds or images.
+
+Reproduce is to make copies of the Work by any means including without
+limitation by sound or visual recordings and the right of fixation and
+reproducing fixations of the Work, including storage of a protected
+performance or phonogram in digital form or other electronic medium.
+
+Software is any digital Work which, through use of a third-party piece
+of Software or through the direct usage of itself on a computer system,
+the memory of the computer is modified dynamically or semi-dynamically.
+\"Software\", secondly, processes or interprets information.
+
+Source Code is Any digital Work which, through use of a third-party
+piece of Software or through the direct usage of itself on a computer
+system, the memory of the computer is modified dynamically or
+semi-dynamically. \"Software\", secondly, processes or interprets
+information.
+
+Surveilling is the use of the Work to either overtly or covertly observe
+and record persons and or their activities.
+
+A Network Service is the use of a piece of Software to interpret or
+modify information that is subsequently and directly served to users
+over the Internet.
+
+To Discriminate is use of a work to differentiate between humans in a
+such a way which prioritizes some above others on the basis of percieved
+membership within certain groups.
+
+Hate Speech is Communication or any form of expression which is solely
+for the purpose of expressing hatred for some group or advocating a form
+of Discrimination between humans.
+
+Coercion is leveraging of the threat of force or use of force to
+intimidate a person in order to gain compliance, or to offer large
+incentives which aim to entice a person to act against their will.
+
+# Fair Dealing Rights
+
+Nothing in this License is intended to reduce, limit, or restrict any
+uses free from copyright or rights arising from limitations or
+exceptions that are provided for in connection with the copyright
+protection under copyright law or other applicable laws.
+
+# License Grant
+
+Subject to the terms and conditions of this License, Licensor hereby
+grants You a worldwide, royalty-free, non-exclusive, perpetual (for the
+duration of the applicable copyright) license to exercise the rights in
+the Work as stated below:
+
+To Reproduce the Work, to incorporate the Work into one or more
+Collections, and to Reproduce the Work as incorporated in the
+Collections
+
+To create and Reproduce Adaptations provided that any such Adaptation,
+including any translation in any medium, takes reasonable steps to
+clearly label, demarcate or otherwise identify that changes were made to
+the original Work. For example, a translation could be marked \"The
+original work was translated from English to Spanish,\" or a
+modification could indicate \"The original work has been modified.\"
+
+To Distribute and Publicly Perform the Work including as incorporated in
+Collections.
+
+To Distribute and Publicly Perform Adaptations. The above rights may be
+exercised in all media and formats whether now known or hereafter
+devised. The above rights include the right to make such modifications
+as are technically necessary to exercise the rights in other media and
+formats. This License constitutes the entire agreement between the
+parties with respect to the Work licensed here. There are no
+understandings, agreements or representations with respect to the Work
+not specified here. Licensor shall not be bound by any additional
+provisions that may appear in any communication from You. This License
+may not be modified without the mutual written agreement of the Licensor
+and You. All rights not expressly granted by Licensor are hereby
+reserved, including but not limited to the rights set forth in
+Non-waivable Compulsory License Schemes, Waivable Compulsory License
+Schemes, and Voluntary License Schemes in the restrictions.
+
+# Restrictions
+
+The license granted in the license grant above is expressly made subject
+to and limited by the following restrictions:
+
+You may Distribute or Publicly Perform the Work only under the terms of
+this License. You must include a copy of, or the Uniform Resource
+Identifier (URI) for, this License with every copy of the Work You
+Distribute or Publicly Perform. You may not offer or impose any terms on
+the Work that restrict the terms of this License or the ability of the
+recipient of the Work to exercise the rights granted to that recipient
+under the terms of the License. You may not sublicense the Work. You
+must keep intact all notices that refer to this License and to the
+disclaimer of warranties with every copy of the Work You Distribute or
+Publicly Perform. When You Distribute or Publicly Perform the Work, You
+may not impose any effective technological measures on the Work that
+restrict the ability of a recipient of the Work from You to exercise the
+rights granted to that recipient under the terms of the License. This
+Section applies to the Work as incorporated in a Collection, but this
+does not require the Collection apart from the Work itself to be made
+subject to the terms of this License. If You create a Collection, upon
+notice from any Licensor You must, to the extent practicable, remove
+from the Collection any credit as requested. If You create an
+Adaptation, upon notice from any Licensor You must, to the extent
+practicable, remove from the Adaptation any credit as requested.
+
+## Commercial Restrictions
+
+You may not exercise any of the rights granted to You in the above
+section in any manner that is primarily intended for or directed toward
+commercial advantage or private monetary compensation unless you meet
+the following requirements.
+
+i.  You are a worker-owned business or worker-owned collective.
+
+ii. after tax, all financial gain, surplus, profits and benefits
+    produced by the business or collective are distributed among the
+    worker-owners unless a set amount is to be allocated towards
+    community projects as decided by a previously-established consensus
+    agreement between the worker-owners where all worker-owners agreed.
+
+iii. You are not using such rights on behalf of a business other than
+     those specified in (i) or (ii) above, nor are using such rights as
+     a proxy on behalf of a business with the intent to circumvent the
+     aforementioned restrictions on such a business.
+
+The exchange of the Work for other copyrighted works by means of digital
+file-sharing or otherwise shall not be considered to be intended for or
+directed toward commercial advantage or private monetary compensation,
+provided there is no payment of any monetary compensation in connection
+with the exchange of copyrighted works.
+
+If the Work meets the definition of Software, You may exercise the
+rights granted in the license grant only if You provide a copy of the
+corresponding Source Code from which the Work was derived in digital
+form, or You provide a URI for the corresponding Source Code of the
+Work, to any recipients upon request.
+
+If the Work is used as or for a Network Service, You may exercise the
+rights granted in the license grant only if You provide a copy of the
+corresponding Source Code from which the Work was derived in digital
+form, or You provide a URI for the corresponding Source Code to the
+Work, to any recipients of the data served or modified by the Web
+Service.
+
+Any use by a business that is privately owned and managed, and that
+seeks to generate profit from the labor of employees paid by salary or
+other wages, is not permitted under this license.
+
+## 
+
+You may exercise the rights granted in the license grant for any
+purposes only if:
+
+i.  You do not use the Work for the purpose of inflicting Bodily Harm on
+    human beings (subject to criminal prosecution or otherwise) outside
+    of providing medical aid or undergoing a voluntary procedure under
+    no form of Coercion.
+
+ii. You do not use the Work for the purpose of Surveilling or tracking
+    individuals for financial gain.
+
+iii. You do not use the Work in an Act of War.
+
+iv. You do not use the Work for the purpose of supporting or profiting
+    from an Act of War.
+
+v.  You do not use the Work for the purpose of Incarceration.
+
+vi. You do not use the Work for the purpose of extracting, processing,
+    or refining, oil, gas, or coal. Or to in any other way to
+    deliberately pollute the environment as a byproduct of manufacturing
+    or irresponsible disposal of hazardous materials.
+
+vii. You do not use the Work for the purpose of expediting,
+     coordinating, or facilitating paid work undertaken by individuals
+     under the age of 12 years.
+
+viii. You do not use the Work to either Discriminate or spread Hate
+      Speech on the basis of sex, sexual orientation, gender identity,
+      race, age, disability, color, national origin, religion, caste, or
+      lower economic status.
+
+## 
+
+If You Distribute, or Publicly Perform the Work or any Adaptations or
+Collections, You must, unless a request has been made by any Licensor to
+remove credit from a Collection or Adaptation, keep intact all copyright
+notices for the Work and provide, reasonable to the medium or means You
+are utilizing:
+
+i.  the name of the Original Author (or pseudonym, if applicable) if
+    supplied, and/or if the Original Author and/or Licensor designate
+    another party or parties (e.g., a sponsor institute, publishing
+    entity, journal) for attribution (\"Attribution Parties\") in
+    Licensor\'s copyright notice, terms of service or by other
+    reasonable means, the name of such party or parties;
+
+ii. the title of the Work if supplied;
+
+iii. to the extent reasonably practicable, the URI, if any, that
+     Licensor to be associated with the Work, unless such URI does not
+     refer to the copyright notice or licensing information for the
+     Work; and,
+
+iv. in the case of an Adaptation, a credit identifying the use of the
+    Work in the Adaptation (e.g., \"French translation of the Work by
+    Original Author,\" or \"Screenplay based on original Work by
+    Original Author\").
+
+If any Licensor has sent notice to request removing credit, You must, to
+the extent practicable, remove any credit as requested. The credit
+required by this Section may be implemented in any reasonable manner;
+provided, however, that in the case of an Adaptation or Collection, at a
+minimum such credit will appear, if a credit for all contributing
+authors of the Adaptation or Collection appears, then as part of these
+credits and in a manner at least as prominent as the credits for the
+other contributing authors. For the avoidance of doubt, You may only use
+the credit required by this Section for the purpose of attribution in
+the manner set out above and, by exercising Your rights under this
+License, You may not implicitly or explicitly assert or imply any
+connection with, sponsorship or endorsement by the Original Author,
+Licensor and/or Attribution Parties, as appropriate, of You or Your use
+of the Work, without the separate, express prior written permission of
+the Original Author, Licensor and/or Attribution Parties.
+
+Non-waivable Compulsory License Schemes. In those jurisdictions in which
+the right to collect royalties through any statutory or compulsory
+licensing scheme cannot be waived, the Licensor reserves the exclusive
+right to collect such royalties for any exercise by You of the rights
+granted under this License
+
+Waivable Compulsory License Schemes. In those jurisdictions in which the
+right to collect royalties through any statutory or compulsory licensing
+scheme can be waived, the Licensor reserves the exclusive right to
+collect such royalties for any exercise by You of the rights granted
+under this License if Your exercise of such rights is for a purpose or
+use which is otherwise than noncommercial as permitted under Commercial
+Restrictions and otherwise waives the right to collect royalties through
+any statutory or compulsory licensing scheme.
+
+Voluntary License Schemes. The Licensor reserves the right to collect
+royalties, whether individually or, in the event that the Licensor is a
+member of a collecting society that administers voluntary licensing
+schemes, via that society, from any exercise by You of the rights
+granted under this License that is for a purpose or use which is
+otherwise than noncommercial as permitted under the license grant.
+
+Except as otherwise agreed in writing by the Licensor or as may be
+otherwise permitted by applicable law, if You Reproduce, Distribute or
+Publicly Perform the Work either by itself or as part of any Adaptations
+or Collections, You must not distort, mutilate, modify or take other
+derogatory action in relation to the Work which would be prejudicial to
+the Original Author\'s honor or reputation. Licensor agrees that in
+those jurisdictions (e.g. Japan), in which any exercise of the right
+granted in the license grant of this License (the right to make
+Adaptations) would be deemed to be a distortion, mutilation,
+modification or other derogatory action prejudicial to the Original
+Author\'s honor and reputation, the Licensor will waive or not assert,
+as appropriate, this Section, to the fullest extent permitted by the
+applicable national law, to enable You to reasonably exercise Your right
+under the license grant of this License (right to make Adaptations) but
+not otherwise.
+
+Do not make any legal claim against anyone accusing the Work, with or
+without changes, alone or with other works, of infringing any patent
+claim.
+
+# Representations Warranties and Disclaimer
+
+UNLESS OTHERWISE MUTUALLY AGREED TO BY THE PARTIES IN WRITING, LICENSOR
+OFFERS THE WORK AS-IS AND MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY
+KIND CONCERNING THE WORK, EXPRESS, IMPLIED, STATUTORY OR OTHERWISE,
+INCLUDING, WITHOUT LIMITATION, WARRANTIES OF TITLE, MERCHANTIBILITY,
+FITNESS FOR A PARTICULAR PURPOSE, NONINFRINGEMENT, OR THE ABSENCE OF
+LATENT OR OTHER DEFECTS, ACCURACY, OR THE PRESENCE OF ABSENCE OF ERRORS,
+WHETHER OR NOT DISCOVERABLE. SOME JURISDICTIONS DO NOT ALLOW THE
+EXCLUSION OF IMPLIED WARRANTIES, SO SUCH EXCLUSION MAY NOT APPLY TO YOU.
+
+# Limitation on Liability
+
+EXCEPT TO THE EXTENT REQUIRED BY APPLICABLE LAW, IN NO EVENT WILL
+LICENSOR BE LIABLE TO YOU ON ANY LEGAL THEORY FOR ANY SPECIAL,
+INCIDENTAL, CONSEQUENTIAL, PUNITIVE OR EXEMPLARY DAMAGES ARISING OUT OF
+THIS LICENSE OR THE USE OF THE WORK, EVEN IF LICENSOR HAS BEEN ADVISED
+OF THE POSSIBILITY OF SUCH DAMAGES.
+
+# Termination
+
+This License and the rights granted hereunder will terminate
+automatically upon any breach by You of the terms of this License.
+Individuals or entities who have received Adaptations or Collections
+from You under this License, however, will not have their licenses
+terminated provided such individuals or entities remain in full
+compliance with those licenses. The Sections on definitions, fair
+dealing rights, representations, warranties, and disclaimer, limitation
+on liability, termination, and revised license versions will survive any
+termination of this License.
+
+Subject to the above terms and conditions, the license granted here is
+perpetual (for the duration of the applicable copyright in the Work).
+Notwithstanding the above, Licensor reserves the right to release the
+Work under different license terms or to stop distributing the Work at
+any time; provided, however that any such election will not serve to
+withdraw this License (or any other license that has been, or is
+required to be, granted under the terms of this License), and this
+License will continue in full force and effect unless terminated as
+stated above.
+
+# Revised License Versions
+
+This License may receive future revisions in the original spirit of the
+license intended to strengthen This License. Each version of This
+License has an incrementing version number.
+
+Unless otherwise specified like in the below subsection The Licensor has
+only granted this current version of This License for The Work. In this
+case future revisions do not apply.
+
+The Licensor may specify that the latest available revision of This
+License be used for The Work by either explicitly writing so or by
+suffixing the License URI with a \"+\" symbol.
+
+The Licensor may specify that The Work is also available under the terms
+of This License\'s current revision as well as specific future
+revisions. The Licensor may do this by writing it explicitly or
+suffixing the License URI with any additional version numbers each
+separated by a comma.
+
+# Miscellaneous
+
+Each time You Distribute or Publicly Perform the Work or a Collection,
+the Licensor offers to the recipient a license to the Work on the same
+terms and conditions as the license granted to You under this License.
+
+Each time You Distribute or Publicly Perform an Adaptation, Licensor
+offers to the recipient a license to the original Work on the same terms
+and conditions as the license granted to You under this License.
+
+If the Work is classified as Software, each time You Distribute or
+Publicly Perform an Adaptation, Licensor offers to the recipient a copy
+and/or URI of the corresponding Source Code on the same terms and
+conditions as the license granted to You under this License.
+
+If the Work is used as a Network Service, each time You Distribute or
+Publicly Perform an Adaptation, or serve data derived from the Software,
+the Licensor offers to any recipients of the data a copy and/or URI of
+the corresponding Source Code on the same terms and conditions as the
+license granted to You under this License.
+
+If any provision of this License is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of
+the remainder of the terms of this License, and without further action
+by the parties to this agreement, such provision shall be reformed to
+the minimum extent necessary to make such provision valid and
+enforceable.
+
+No term or provision of this License shall be deemed waived and no
+breach consented to unless such waiver or consent shall be in writing
+and signed by the party to be charged with such waiver or consent.
+
+This License constitutes the entire agreement between the parties with
+respect to the Work licensed here. There are no understandings,
+agreements or representations with respect to the Work not specified
+here. Licensor shall not be bound by any additional provisions that may
+appear in any communication from You. This License may not be modified
+without the mutual written agreement of the Licensor and You.
+
+The rights granted under, and the subject matter referenced, in this
+License were drafted utilizing the terminology of the Berne Convention
+for the Protection of Literary and Artistic Works (as amended on
+September 28, 1979), the Rome Convention of 1961, the WIPO Copyright
+Treaty of 1996, the WIPO Performances and Phonograms Treaty of 1996 and
+the Universal Copyright Convention (as revised on July 24, 1971). These
+rights and subject matter take effect in the relevant jurisdiction in
+which the License terms are sought to be enforced according to the
+corresponding provisions of the implementation of those treaty
+provisions in the applicable national law. If the standard suite of
+rights granted under applicable copyright law includes additional rights
+not granted under this License, such additional rights are deemed to be
+included in the License; this License is not intended to restrict the
+license of any rights under applicable law.

README.md

@@ -0,0 +1,45 @@
+# Porom
+porous forum
+
+# License
+Released under [CNPLv7+](https://thufie.lain.haus/NPL.html).
+Please read the [full terms](./LICENSE.md) for proper wording.
+
+# installing & first time setup
+1. first, install OpenResty. instructions for linux can be found [here](https://openresty.org/en/linux-packages.html).
+2. then, install LuaJIT and Lua 5.1 (usually called `lua5.1` in package managers)
+3. then, install [LuaRocks](https://luarocks.org) (prefer your package manager instead of a local install recommended by the guide)
+4. add luarocks search dirs to path:
+
+```bash
+  # in .bashrc (or other shell equivalent)
+  eval "$(luarocks --lua-version 5.1 path)"
+```
+5. clone repo
+6. install the dependencies:
+
+```bash
+$ luarocks --local --lua-version 5.1 build --only-deps
+```
+7. create a file named `secrets.lua` in the project directory.  
+use the `secrets.lua.example` file as reference, and generate a cryptographically secure random key, for example, with:
+
+```bash
+$ openssl rand -hex 32
+```
+8. run:
+
+```bash
+$ start.sh production
+```
+the script will perform some necessary first time setup (and create a hidden file in the folder to ensure it won't do so again). it will create an administrator account and print the credentials to the console; **this will only happen once**. make sure you save them somewhere. the administrator account is the only one that can promote other users to moderator.  
+(note the `production` argument. if called with no arguments, `start.sh` will run in a development environment, which uses a separate database.)
+
+this app is made with the assumption that it is being reverse-proxied. as such, you may want to change the port to something other than the default `8080`. you can do that in [`config.lua`]([./config.lua]).
+
+after the first time setup is complete, everything is ready to go. put the app behind your reverse proxy and serve it on the web. the app does not run in https by itself, but the reverse proxy can be set up to do that.
+
+once you are able to navigate to the forum, you can log in as the administrator account. other people may also sign up, but they are not able to post until manually verified by an administrator or a moderator. the administrator can promote regular users to moderator.
+
+# icons
+the icons in the `icons/` folder are by [Gabriele Malaspina](https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license)

app.lua

@@ -1,8 +1,40 @@
 local lapis = require("lapis")
 local app = lapis.Application()
+local constants = require("constants")
 
-app:get("/", function()
-  return "Welcome to Lapis " .. require("lapis.version")
+local db = require("lapis.db")
+-- sqlite starts without foreign key enforcement
+db.query("PRAGMA foreign_keys = ON")
+
+local util = require("util")
+
+app:enable("etlua")
+app.layout = require "views.base"
+
+local function inject_constants(req)
+  req.constants = constants
+end
+
+local function inject_methods(req)
+  req.avatar_url = util.get_user_avatar_url
+  req.ntob = function(_, v)
+    return util.ntob(v)
+  end
+  req.PermissionLevelString = constants.PermissionLevelString
+
+  util.pop_infobox(req)
+end
+
+app:before_filter(inject_constants)
+app:before_filter(inject_methods)
+
+app:include("apps.users", {path = "/user"})
+app:include("apps.topics", {path = "/topics"})
+app:include("apps.threads", {path = "/threads"})
+app:include("apps.mod", {path = "/mod"})
+
+app:get("/", function(self)
+  return {redirect_to = self:url_for("all_topics")}
 end)
 
 return app

apps/mod.lua

@@ -0,0 +1,23 @@
+local app = require("lapis").Application()
+
+local util = require("util")
+
+local models = require("models")
+local Users = models.Users
+
+app:get("user_list", "/list", function(self)
+  self.me = util.get_logged_in_user(self)
+  if not self.me then
+    return {redirect_to = self:url_for("all_topics")}
+  end
+  
+  if not self.me:is_mod() then
+    return {redirect_to = self:url_for("all_topics")}
+  end
+  
+  self.users = Users:select("")
+  
+  return {render = "mod.user-list"}
+end)
+
+return app

apps/threads.lua

@@ -0,0 +1,148 @@
+local app = require("lapis").Application()
+local lapis_util = require("lapis.util")
+
+local db = require("lapis.db")
+local util = require("util")
+
+local models = require("models")
+local Topics = models.Topics
+local Threads = models.Threads
+local Posts = models.Posts
+
+local POSTS_PER_PAGE = 10
+
+app:get("thread_create", "/create", function(self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local all_topics = db.query("select * from topics limit 25;")
+  if #all_topics == 0 then
+    return "how did you get here?"
+  end
+  self.all_topics = all_topics
+  self.page_title = "creating thread"
+  self.me = user
+  return {render = "threads.create"}
+end)
+
+app:post("thread_create", "/create", function(self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local topic = Topics:find(self.params.topic_id)
+  if not topic then
+    return {redirect_to = self:url_for("topics")}
+  end
+
+  local title = lapis_util.trim(self.params.title)
+  local time = os.time()
+  local slug = lapis_util.slugify(title) .. "-" .. time
+
+  local post_content = self.params.initial_post
+
+  local thread = Threads:create({
+    topic_id = topic.id,
+    user_id = user.id,
+    title = title,
+    slug = slug,
+    created_at = time,
+  })
+
+  local post = util.create_post(thread.id, user.id, post_content)
+  if not post then
+    return {redirect_to = self:url_for("topics")}
+  end
+  
+  return {redirect_to = self:url_for("thread", {slug = slug})}
+end)
+
+app:get("thread", "/:slug", function(self)
+  local thread = Threads:find({
+    slug = self.params.slug
+  })
+  if not thread then
+    return {status = 404}
+  end
+  self.thread = thread
+
+  local post_count = Posts:count(db.clause({
+    thread_id = thread.id
+  }))
+  self.pages = math.max(math.ceil(post_count / POSTS_PER_PAGE), 1)
+
+  if self.params.after then
+    local after_id = tonumber(self.params.after)
+    local post_position = Posts:count(db.clause({
+      thread_id = thread.id,
+      {"id <= ?", after_id},
+    }))
+    self.page = math.floor((post_position - 1) / POSTS_PER_PAGE) + 1
+  else
+    self.page = math.max(1, math.min(tonumber(self.params.page) or 1, self.pages))
+  end
+
+  -- self.page = math.max(1, math.min(self.page, self.pages))
+  local posts = db.query([[
+    SELECT
+      posts.id, posts.created_at, post_history.content, post_history.edited_at, users.username, users.status, avatars.file_path AS avatar_path
+    FROM
+      posts
+    JOIN
+      post_history ON posts.current_revision_id = post_history.id
+    JOIN
+      users ON posts.user_id = users.id
+    LEFT JOIN
+      avatars ON users.avatar_id = avatars.id
+    WHERE
+      posts.thread_id = ?
+    ORDER BY
+      posts.created_at ASC
+    LIMIT ? OFFSET ?
+  ]], thread.id, POSTS_PER_PAGE, (self.page - 1) * POSTS_PER_PAGE)
+  self.topic = Topics:find(thread.topic_id)
+  self.me = util.get_logged_in_user_or_transient(self)
+  self.posts = posts
+
+  self.page_title = thread.title
+
+  return {render = "threads.thread"}
+end)
+
+app:post("thread", "/:slug", function(self)
+  local thread = Threads:find({
+    slug = self.params.slug
+  })
+  if not thread then
+    return {redirect_to = self:url_for("all_topics")}
+  end
+  local user = util.get_logged_in_user(self)
+  if not user then
+    return {redirect_to = self:url_for("all_topics")}
+  end
+
+  if user:is_guest() then
+    return {redirect_to = self:url_for("thread", {slug = thread.slug})}
+  end
+
+  if util.is_thread_locked(thread) and not user:is_mod() then
+    return {redirect_to = self:url_for("thread", {slug = thread.slug})}
+  end
+
+  local post_content = self.params.post_content
+  local post = util.create_post(thread.id, user.id, post_content)
+  local post_count = Posts:count(db.clause({
+    thread_id = thread.id
+  }))
+  local last_page = math.ceil(post_count / POSTS_PER_PAGE)
+  if not post then
+    return {redirect_to = self:url_for("thread", {slug = thread.slug}, {page = last_page}) .. "#latest-post"}
+  end
+  
+  return {redirect_to = self:url_for("thread", {slug = thread.slug}, {page = last_page}) .. "#latest-post"}
+end)
+
+return app

apps/topics.lua

@@ -0,0 +1,197 @@
+local app = require("lapis").Application()
+local lapis_util = require("lapis.util")
+
+local db = require("lapis.db")
+local constants = require("constants")
+
+local util = require("util")
+
+local models = require("models")
+local Users = models.Users
+local Avatars = models.Avatars
+local Topics = models.Topics
+local Threads = models.Threads
+
+local THREADS_PER_PAGE = 10
+
+local ThreadCreateError = {
+  OK = 0,
+  GUEST = 1,
+  LOGGED_OUT = 2,
+  TOPIC_LOCKED = 3,
+}
+
+app:get("all_topics", "", function(self)
+  self.topic_list = db.query([[
+    SELECT
+      topics.name, topics.slug, topics.description, topics.is_locked,
+      users.username AS latest_thread_username,
+      threads.title AS latest_thread_title,
+      threads.slug AS latest_thread_slug,
+      threads.created_at AS latest_thread_created_at
+    FROM
+      topics
+    LEFT JOIN (
+        SELECT
+        *,
+        row_number() OVER (PARTITION BY threads.topic_id ORDER BY threads.created_at DESC) as rn
+      FROM
+        threads
+      ) threads ON threads.topic_id = topics.id AND threads.rn = 1
+    LEFT JOIN
+      users on users.id = threads.user_id
+    ORDER BY
+      topics.sort_order ASC
+  ]])
+  self.me = util.get_logged_in_user_or_transient(self)
+  return {render = "topics.topics"}
+end)
+
+app:get("topic_create", "/create", function(self)
+  local user = util.get_logged_in_user(self) or util.TransientUser
+  if not user:is_mod() then
+    return {status = 403}
+  end
+
+  self.page_title = "creating topic"
+  self.me = user
+
+  return {render = "topics.create"}
+end)
+
+app:post("topic_create", "/create", function(self)
+  local user = util.get_logged_in_user(self) or util.TransientUser
+  if not user:is_mod() then
+    return {redirect_to = "all_topics"}
+  end
+
+  local topic_name = lapis_util.trim(self.params.name)
+  local topic_description = self.params.description
+  local time = os.time()
+  local slug = lapis_util.slugify(topic_name) .. "-" .. time
+
+  local topic_count = Topics:count()
+  local topic = Topics:create({
+    name = topic_name,
+    description = topic_description,
+    slug = slug,
+    sort_order = topic_count + 1,
+  })
+  
+  util.inject_infobox(self, "Topic created.")
+
+  return {redirect_to = self:url_for("topic", {slug = topic.slug})}
+end)
+
+app:get("topic", "/:slug", function(self)
+  local topic = Topics:find({
+    slug = self.params.slug
+  })
+  if not topic then
+    return {status = 404}
+  end
+  local threads_count = Threads:count(db.clause({
+    topic_id = topic.id
+  }))
+  self.topic = topic
+
+  self.pages = math.max(math.ceil(threads_count / THREADS_PER_PAGE), 1)
+  self.page = math.max(1, math.min(tonumber(self.params.page) or 1, self.pages))
+  -- self.threads_list = db.query("SELECT * FROM threads WHERE topic_id = ? ORDER BY is_stickied DESC, created_at DESC", topic.id)
+  self.threads_list = db.query([[
+    SELECT
+      threads.title, threads.slug, threads.created_at, threads.is_locked, threads.is_stickied,
+      users.username AS started_by,
+      u.username AS latest_post_username,
+      ph.content AS latest_post_content,
+      posts.created_at AS latest_post_created_at,
+      posts.id AS latest_post_id
+    FROM
+      threads
+    JOIN users ON users.id = threads.user_id
+    JOIN (
+      SELECT
+        posts.thread_id,
+        posts.id,
+        posts.user_id,
+        posts.created_at,
+        posts.current_revision_id,
+        ROW_NUMBER() OVER (PARTITION BY posts.thread_id ORDER BY posts.created_at DESC) AS rn
+      FROM
+        posts
+    ) posts ON posts.thread_id = threads.id AND posts.rn = 1
+    JOIN
+      post_history ph ON ph.id = posts.current_revision_id
+    JOIN
+      users u ON u.id = posts.user_id
+    WHERE
+      threads.topic_id = ?
+    ORDER BY
+      threads.is_stickied DESC,
+      threads.created_at DESC
+    LIMIT ? OFFSET ?
+  ]], topic.id, THREADS_PER_PAGE, (self.page - 1) * THREADS_PER_PAGE)
+  
+  local user = util.get_logged_in_user_or_transient(self)
+  self.me = user
+  
+  self.ThreadCreateError = ThreadCreateError
+  self.thread_create_error = ThreadCreateError.OK
+  if user:is_logged_in_guest() then
+    self.thread_create_error = ThreadCreateError.GUEST
+  elseif user:is_guest() then
+    self.thread_create_error = ThreadCreateError.LOGGED_OUT
+  elseif util.ntob(topic.is_locked) and not user:is_mod() then
+    self.thread_create_error = ThreadCreateError.TOPIC_LOCKED
+  end
+  
+  self.page_title = "browsing topic " .. topic.name
+  
+  return {render = "topics.topic"}
+end)
+
+app:get("topic_edit", "/:slug/edit", function(self)
+  local user = util.get_logged_in_user_or_transient(self)
+  if not user:is_mod() then
+    return {redirect_to = self:url_for("topic", {slug = self.params.slug})}
+  end
+  local topic = Topics:find({
+    slug = self.params.slug
+  })
+  if not topic then
+    return {redirect_to = self:url_for("all_topics")}
+  end
+  self.topic = topic
+  self.me = user
+  self.page_title = "editing topic " .. topic.name
+  
+  return {render = "topics.edit"}
+end)
+
+app:post("topic_edit", "/:slug/edit", function(self)
+  local user = util.get_logged_in_user_or_transient(self)
+  if not user:is_mod() then
+    return {redirect_to = self:url_for("topic", {slug = self.params.slug})}
+  end
+  local topic = Topics:find({
+    slug = self.params.slug
+  })
+  if not topic then
+    return {redirect_to = self:url_for("all_topics")}
+  end
+  local name = self.params.name or topic.name
+  local description = self.params.description or topic.description
+  local is_locked = topic.is_locked
+  if self.params.is_locked ~= nil then
+    is_locked = util.form_bool_to_sqlite(self.params.is_locked)
+  end
+
+  topic:update({
+    name = name,
+    description = description,
+    is_locked = is_locked,
+  })
+  return {redirect_to = self:url_for("topic", {slug = self.params.slug})}
+end)
+
+return app

apps/users.lua

@@ -0,0 +1,425 @@
+local app = require("lapis").Application()
+
+local db = require("lapis.db")
+local constants = require("constants")
+
+local util = require("util")
+
+local bcrypt = require("bcrypt")
+local rand = require("openssl.rand")
+
+local models = require("models")
+local Users = models.Users
+local Sessions = models.Sessions
+local Avatars = models.Avatars
+
+local function authenticate_user(user, password)
+  return bcrypt.verify(password, user.password_hash)
+end
+
+local function create_session_key()
+  return rand.bytes(16):gsub(".", function(c) return string.format("%02x", string.byte(c)) end)
+end
+
+local function create_session(user_id)
+  local days = 30
+  local expires_at = os.time() + (days * 24 * 60 * 60)
+
+  return Sessions:create({
+    key = create_session_key(),
+    user_id = user_id,
+    expires_at = expires_at,
+  })
+end
+
+local function validate_password(password)
+  if #password < 10 or password:match("%s") then
+    return false
+  end
+
+  if #password > 255 then
+    return false
+  end
+
+  local r = password:match("%u+") and
+            password:match("%l+") and
+            password:match("%d+") and
+            password:match("%p+")
+  return r ~= nil and true
+end
+
+local function validate_username(username)
+  if #username < 3 or #username > 20 then
+    return false
+  end
+
+  return username:match("^[%w_-]+$") and true
+end
+
+local function validate_url(url)
+  return url:match('^https?://.+$') and true
+end
+
+app:get("user", "/:username", function(self)
+  local user = Users:find({username = self.params.username})
+  if not user then
+    return {status = 404}
+  end
+
+  local me = util.get_logged_in_user_or_transient(self)
+  self.user = user
+  self.me = me
+
+  self.user_is_me = me.id == user.id
+
+  if user.permission == constants.PermissionLevel.GUEST then
+    if not (self.user_is_me or me:is_mod()) then
+      return {status = 404}
+    end
+  end
+
+  self.latest_posts = db.query([[
+    SELECT
+      posts.id, posts.created_at, post_history.content, post_history.edited_at, threads.title AS thread_title, topics.name as topic_name, threads.slug as thread_slug
+    FROM
+      posts
+    JOIN
+      post_history ON posts.current_revision_id = post_history.id
+    JOIN
+      threads ON posts.thread_id = threads.id
+    JOIN
+      topics ON threads.topic_id = topics.id
+    WHERE
+      posts.user_id = ?
+    ORDER BY posts.created_at DESC
+    LIMIT 10
+  ]], user.id)
+
+  self.page_title = user.username .. "'s profile"
+
+  return {render = "user.user"}
+end)
+
+app:post("user_delete", "/:username/delete", function(self)
+  -- this route explicitly does not handle admins deleting other users
+  -- i might make a separate route for it later, but guesting users is possible
+  local me = util.get_logged_in_user(self)
+  if me == nil then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  
+  if not authenticate_user(target_user, self.params.password) then
+    util.inject_err_infobox(self, "The password you entered is incorrect.")
+    return {redirect_to = self:url_for("user_delete_confirm", {username = me.username})}
+  end
+  
+  util.transfer_and_delete_user(target_user)
+  util.inject_infobox(self, "Your account has been added to the deletion queue.")
+  return {redirect_to = self:url_for("user_signup")}
+end)
+
+app:get("user_delete_confirm", "/:username/delete_confirm", function(self)
+  local me = util.get_logged_in_user(self)
+  if me == nil then
+    -- util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  self.me = target_user
+  self.page_title = "confirm deletion"
+
+  return {render = "user.delete_confirm"}
+end)
+
+app:post("user_clear_avatar", "/:username/clear_avatar", function(self)
+  local me = util.get_logged_in_user(self)
+  if me == nil then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  local old_avatar_id = target_user.avatar_id
+  target_user:update({
+    avatar_id = 1,
+  })
+  util.destroy_avatar(old_avatar_id)
+  util.inject_infobox(self, "Avatar cleared.")
+  return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+end)
+
+app:post("user_set_avatar", "/:username/set_avatar", function(self)
+  local me = util.get_logged_in_user(self)
+  if me == nil then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  local file = self.params.avatar
+  if not file then
+    util.inject_warn_infobox(self, "Something went wrong. Try again later.")
+    return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+  end
+  local time = os.time()
+  local filename = "u" .. target_user.id .. "d" .. time .. ".webp"
+  local proxied_filename = "/avatars/" .. filename
+  local save_path = "static" .. proxied_filename
+  local res = util.validate_and_create_image(file.content, save_path)
+  if not res then
+    util.inject_warn_infobox(self, "Something went wrong. Try again later.")
+    return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+  end
+
+  util.inject_infobox(self, "Avatar updated.")
+  local avatar = Avatars:create({
+    file_path = proxied_filename,
+    uploaded_at = time,
+  })
+
+  target_user:update({
+    avatar_id = avatar.id
+  })
+
+  return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+end)
+
+app:get("user_settings", "/:username/settings", function(self)
+  local me = util.get_logged_in_user(self)
+  if me == nil then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+  self.me = target_user
+  self.page_title = "settings"
+
+  return {render = "user.settings"}
+end)
+
+app:post("user_settings", "/:username/settings", function(self)
+  local me = util.get_logged_in_user(self)
+  if me == nil then
+    util.inject_err_infobox(self, "You must be logged in to perform this action.")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local target_user = Users:find({username = self.params.username})
+  if me.id ~= target_user.id then
+    return {redirect_to = self:url_for("user", {username = self.params.username})}
+  end
+
+  local status = self.params.status:sub(1, 100)
+
+  target_user:update({
+    status = status,
+  })
+  util.inject_infobox(self, "Status updated.")
+  return {redirect_to = self:url_for("user_settings", {username = self.params.username})}
+end)
+
+app:get("user_login", "/login", function(self)
+  if self.session.session_key then
+    local user = util.get_logged_in_user(self)
+    if user ~= nil then
+      return {redirect_to = self:url_for("user", {username = user.username})}
+    end
+  end
+
+  self.page_title = "log in"
+
+  return {render = "user.login"}
+end)
+
+app:post("user_login", "/login", function(self)
+  if self.session.session_key then
+    local user = util.get_logged_in_user(self)
+    if user ~= nil then
+      return {redirect_to = self:url_for("user", {username = user.username})}
+    end
+  end
+  local username = self.params.username
+  local password = self.params.password
+  local user = Users:find({username = username})
+  if not user then
+    util.inject_err_infobox(self, "Invalid username or password")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  if user.permission == constants.PermissionLevel.SYSTEM then
+    util.inject_err_infobox(self, "Invalid username or password")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  if not authenticate_user(user, password) then
+    util.inject_err_infobox(self, "Invalid username or password")
+    return {redirect_to = self:url_for("user_login")}
+  end
+  local session = create_session(user.id)
+  util.inject_infobox(self, "Logged in successfully.")
+  self.session.session_key = session.key
+  return {redirect_to = self:url_for("user", {username = username})}
+end)
+
+app:get("user_signup", "/signup", function(self)
+  if self.session.session_key then
+    local user = util.get_logged_in_user(self)
+    if user ~= nil then
+      return {redirect_to = self:url_for("user", {username = user.username})}
+    end
+  end
+
+  self.page_title = "sign up"
+
+  return {render = "user.signup"}
+end)
+
+app:post("user_signup", "/signup", function(self)
+  if self.session.session_key then
+    local user = util.get_logged_in_user(self)
+    if user ~= nil then
+      return {redirect_to = self:url_for("user", {username = user.username})}
+    end
+  end
+
+  local username = self.params.username
+  local password = self.params.password
+  local password2 = self.params.password2
+  local user = Users:find({username = username})
+  if user then
+    util.inject_err_infobox(self, "Username '" .. username .. "' is already taken.")
+    return {redirect_to = self:url_for("user_signup")}
+  end
+
+  if not validate_username(username) then
+    util.inject_err_infobox(self, "Username must be 3-20 characters with only upper and lowercase letters, hyphens, and underscores.")
+    return {redirect_to = self:url_for("user_signup")}
+  end
+  
+  if not validate_password(password) then
+    util.inject_err_infobox(self, "Password must be 10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces.")
+    return {redirect_to = self:url_for("user_signup")}
+  end
+  
+  if password ~= password2 then
+    util.inject_err_infobox(self, "Passwords do not match.")
+    return {redirect_to = self:url_for("user_signup")}
+  end
+
+  local new_user = Users:create({
+    username = username,
+    password_hash = bcrypt.digest(password, constants.BCRYPT_ROUNDS),
+    permission = constants.PermissionLevel.GUEST,
+  })
+
+  local session = create_session(new_user.id)
+  util.inject_infobox(self, "Siged up successfully.")
+  self.session.session_key = session.key
+  return {redirect_to = self:url_for("user", {username = username})}
+end)
+
+app:post("user_logout", "/logout", function (self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    return {redirect_to = self:url_for("user_login")}
+  end
+
+  local session = Sessions:find({key = self.session.session_key})
+  session:delete()
+  return {redirect_to = self:url_for("user_login")}
+end)
+
+app:post("confirm_user", "/confirm_user/:user_id", function (self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    return {status = 403}
+  end
+  if not user:is_mod() then
+    return {status = 403}
+  end
+  local target_user = Users:find(self.params.user_id)
+  if not target_user then
+    return {status = 404}
+  end
+  if target_user.permission > constants.PermissionLevel.GUEST then
+    return {status = 404}
+  end
+
+  target_user:update({permission = constants.PermissionLevel.USER, confirmed_on = os.time()})
+  return {redirect_to = self:url_for("user", {username = target_user.username})}
+end)
+
+app:post("mod_user", "/mod_user/:user_id", function(self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    return {status = 403}
+  end
+  if not user:is_admin() then
+    return {status = 403}
+  end
+  local target_user = Users:find(self.params.user_id)
+  if not target_user then
+    return {status = 404}
+  end
+  if target_user:is_mod() then
+    return {status = 404}
+  end
+  
+  target_user:update({permission = constants.PermissionLevel.MODERATOR})
+  return {redirect_to = self:url_for("user", {username = target_user.username})}
+end)
+
+app:post("demod_user", "/demod_user/:user_id", function(self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    return {status = 403}
+  end
+  if not user:is_admin() then
+    return {status = 403}
+  end
+  local target_user = Users:find(self.params.user_id)
+  if not target_user then
+    return {status = 404}
+  end
+  if not target_user:is_mod() then
+    return {status = 404}
+  end
+  
+  target_user:update({permission = constants.PermissionLevel.USER})
+  return {redirect_to = self:url_for("user", {username = target_user.username})}
+end)
+
+app:post("guest_user", "/guest_user/:user_id", function(self)
+  local user = util.get_logged_in_user(self)
+  if not user then
+    return {status = 403}
+  end
+  if not user:is_mod() then
+    return {status = 403}
+  end
+  local target_user = Users:find(self.params.user_id)
+  if not target_user then
+    return {status = 404}
+  end
+  if target_user:is_mod() then
+    return {status = 404}
+  end
+  
+  target_user:update({permission = constants.PermissionLevel.GUEST})
+  return {redirect_to = self:url_for("user", {username = target_user.username})}
+end)
+
+return app

config.lua

@@ -1,7 +1,26 @@
 local config = require("lapis.config")
+local secrets = require("secrets")
 
-config("development", {
+config({"development", "production"}, {
+  port = 8080,
   server = "nginx",
   code_cache = "off",
-  num_workers = "1"
+  num_workers = "1",
+  sqlite = {
+    database = "db.dev.sqlite"
+  },
+  secret = "SUPER SECRET",
+  session_name = "porom_session",
+})
+
+config("production", {
+  code_cache = "on",
+  logging = {
+    queries = false,
+  },
+  secret = secrets.key,
+  sqlite = {
+    database = "db.prod.sqlite"
+  },
+  session_name = "porom_session_s"
 })

constants.lua

@@ -0,0 +1,41 @@
+local Constants = {}
+
+Constants.PermissionLevel = {
+  GUEST = 0,
+  USER = 1,
+  MODERATOR = 2,
+  SYSTEM = 3,
+  ADMIN = 4,
+}
+
+Constants.PermissionLevelString = {
+  [Constants.PermissionLevel.GUEST] = "Guest",
+  [Constants.PermissionLevel.USER] = "User",
+  [Constants.PermissionLevel.MODERATOR] = "Moderator",
+  [Constants.PermissionLevel.SYSTEM] = "System",
+  [Constants.PermissionLevel.ADMIN] = "Administrator",
+}
+
+Constants.InfoboxKind = {
+  INFO = 0,
+  LOCK = 1,
+  WARN = 2,
+  ERROR = 3,
+}
+
+Constants.InfoboxIcons = {
+  [Constants.InfoboxKind.INFO] = "svg-icons.info",
+  [Constants.InfoboxKind.LOCK] = "svg-icons.lock",
+  [Constants.InfoboxKind.WARN] = "svg-icons.warn",
+  [Constants.InfoboxKind.ERROR] = "svg-icons.error",
+}
+Constants.InfoboxHTMLClass = {
+  [Constants.InfoboxKind.INFO] = "",
+  [Constants.InfoboxKind.LOCK] = "warn",
+  [Constants.InfoboxKind.WARN] = "warn",
+  [Constants.InfoboxKind.ERROR] = "critical",
+}
+
+Constants.BCRYPT_ROUNDS = 10
+
+return Constants

create_default_accounts.lua

@@ -0,0 +1,60 @@
+local bcrypt = require("bcrypt")
+local models = require("models")
+local constants = require("constants")
+
+local alphabet = "-_@0123456789abcdefghijklmnopqrstuvwABCDEFGHIJKLMNOPQRSTUVWXYZ"
+
+local function create_default_avatar()
+  if models.Avatars:count() > 0 then
+    print("default avatar must exist")
+    return
+  end
+  models.Avatars:create({
+    file_path = "/avatars/default.webp",
+    uploaded_at = os.time(),
+  })
+end
+
+local function create_admin()
+  local username = "admin"
+  local root_count = models.Users:count("username = ?", username)
+  if root_count ~= 0 then
+    print("admin account already exists.")
+    return
+  end
+
+  local password = ""
+  for _ = 1, 16 do
+    local randi = math.random(#alphabet)
+    password = password .. alphabet:sub(randi, randi)
+  end
+
+  local hash = bcrypt.digest(password, constants.BCRYPT_ROUNDS)
+
+  models.Users:create({
+    username = username,
+    password_hash = hash,
+    permission = constants.PermissionLevel.ADMIN,
+  })
+
+  print("Admin account created, use \"admin\" as the login and \"" .. password .. "\" as the password. This will only be shown once.")
+end
+
+local function create_deleted_user()
+  local username = "DeletedUser"
+  local root_count = models.Users:count("username = ?", username)
+  if root_count ~= 0 then
+    print("deleted user already exists")
+    return
+  end
+  
+  models.Users:create({
+    username = username,
+    password_hash = "",
+    permission = constants.PermissionLevel.SYSTEM,
+  })
+end
+
+create_default_avatar()
+create_admin()
+create_deleted_user()

docker-compose.yaml

@@ -0,0 +1,13 @@
+# Generate a random secret key
+# export PROD_SECRET_KEY=$(openssl rand -hex 32)
+# Start the container
+# docker-compose up
+version: "3"
+services:
+  porom:
+    build: 
+      context: .
+      args:
+        - PROD_SECRET_KEY=${PROD_SECRET_KEY}
+    ports: 
+      - "8080:8080"

dockerfile

@@ -0,0 +1,36 @@
+# HOW TO:
+#
+# Generate a random secret key & build the Docker image
+# ```sh
+# SECRET_KEY=$(openssl rand -hex 32) docker build --build-arg PROD_SECRET_KEY="$SECRET_KEY" -t porom:latest .
+# ```
+#
+# Then run the container
+# ```sh
+# docker run -d -p 8080:8080 --name porom porom:latest
+# ```
+#
+FROM openresty/openresty:alpine-fat
+COPY ./nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
+COPY . /usr/local/openresty/nginx/html
+WORKDIR /usr/local/openresty/nginx/html
+RUN apk add --no-cache \ 
+    make \
+    git \
+    make \
+    gcc \
+    g++ \
+    musl-dev \
+    libffi-dev \
+    openssl-dev \
+    sqlite-dev \
+    imagemagick-dev \
+    lua5.1 \
+    lua5.1-dev
+RUN eval "$(luarocks --lua-version 5.1 path)"
+RUN luarocks --lua-version 5.1 build --only-deps
+ARG PROD_SECRET_KEY
+RUN echo "return { key = \"${PROD_SECRET_KEY}\",}" > /usr/local/openresty/nginx/html/secrets.lua
+EXPOSE 8080
+RUN chmod +x /usr/local/openresty/nginx/html/start.sh
+ENTRYPOINT ["/usr/local/openresty/nginx/html/start.sh", "production"]

lib/babycode.lua

@@ -0,0 +1,53 @@
+local babycode = {}
+
+---renders babycode to html
+---@param s string input babycode
+---@param escape_html fun(s: string): string function that escapes html
+function babycode.to_html(s, escape_html)
+  if not s or s == "" then return "" end
+  -- extract code blocks first and store them as placeholders
+  -- don't want to process bbcode embedded into a code block
+  local code_blocks = {}
+  local code_count = 0
+  local text = s:gsub("%[code%](.-)%[/code%]", function(code)
+    code_count = code_count + 1
+    -- strip leading and trailing newlines, preserve others
+    code_blocks[code_count] = code:gsub("^%s*(.-)%s*$", "%1")
+    return "\1CODE:"..code_count.."\1"
+  end)
+
+  -- replace `[url=https://example.com]Example[/url] tags
+  text = text:gsub("%[url=([^%]]+)%](.-)%[/url%]", function(url, label)
+    return '<a href="'..escape_html(url)..'">'..escape_html(label)..'</a>'
+  end)
+  
+  -- replace `[url]https://example.com[/url] tags
+  text = text:gsub("%[url%]([^%]]+)%[/url%]", function(url)
+    return '<a href="'..escape_html(url)..'">'..escape_html(url)..'</a>'
+  end)
+
+  -- bold, italics, strikethrough
+  text = text:gsub("%[b%](.-)%[/b%]", "<strong>%1</strong>")
+  text = text:gsub("%[i%](.-)%[/i%]", "<em>%1</em>")
+  text = text:gsub("%[s%](.-)%[/s%]", "<del>%1</del>")
+
+  -- replace loose links
+  text = text:gsub("(https?://[%w-_%.%?%.:/%+=&~%@#%%]+[%w-/])", function(url)
+    if not text:find('<a[^>]*>'..url..'</a>') then
+      return '<a href="'..escape_html(url)..'">'..escape_html(url)..'</a>'
+    end
+    return url
+  end)
+
+  -- normalize newlines, replace them with <br>
+  text = text:gsub("\r?\n\r?\n+", "<br>"):gsub("\r?\n", "<br>")
+
+  -- replace code block placeholders back with their original contents
+  text = text:gsub("\1CODE:(%d+)\1", function(n)
+    return "<pre><code>"..code_blocks[tonumber(n)].."</code></pre>"
+  end)
+
+  return text
+end
+
+return babycode

migrations.lua

@@ -0,0 +1,66 @@
+local db = require("lapis.db")
+local schema = require("lapis.db.schema")
+local types = schema.types
+
+return {
+  [1] = function ()
+    schema.create_table("sessions", {
+      {"id", types.integer{primary_key = true}},
+      {"key", types.text{unique = true}},
+      {"user_id", "INTEGER REFERENCES users(id) ON DELETE CASCADE"},
+      {"expires_at", types.integer},
+      {"created_at", "INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP))"},
+    })
+
+    db.query("CREATE INDEX sessions_user_id ON sessions(user_id)")
+    db.query("CREATE INDEX session_keys ON sessions(key)")
+  end,
+
+  [2] = function ()
+    schema.add_column("users", "confirmed_on", types.integer{null = true})
+  end,
+
+  [3] = function ()
+    schema.add_column("users", "status", types.text{null = true, default=""})
+    schema.create_table("avatars", {
+      {"id", types.integer{primary_key = true}},
+      {"file_path", types.text{unique = true}},
+      {"uploaded_at", "INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP))"},
+    })
+    schema.add_column("users", "avatar_id", "REFERENCES avatars(id) ON DELETE SET NULL")
+  end,
+
+  [4] = function ()
+    schema.add_column("topics", "description", types.text{default=""})
+
+    -- topic locked = no new threads can be created in the topic, but posts can be made in threads
+    -- thread locked = no new posts can be created in the thread, existing posts can not be edited
+    -- admins bypass both restrictions
+    schema.add_column("topics", "is_locked", "BOOLEAN DEFAULT FALSE")
+    schema.add_column("threads", "is_locked", "BOOLEAN DEFAULT FALSE")
+    -- will appear on top of non-stickied threads in topic view
+    schema.add_column("threads", "is_stickied", "BOOLEAN DEFAULT FALSE")
+  end,
+  
+  [5] = function ()
+    db.query("CREATE INDEX idx_posts_thread ON posts(thread_id, created_at, id)")
+    db.query("CREATE INDEX idx_users_avatar ON users(avatar_id)")
+    db.query("CREATE INDEX idx_topics_slug ON topics(slug)")
+    db.query("CREATE INDEX idx_threads_slug ON threads(slug)")
+  end,
+  
+  [6] = function ()
+    schema.drop_column("post_history", "user_id")
+  end,
+  
+  [7] = function ()
+    db.query('DROP INDEX "idx_users_avatar"')
+    schema.drop_column("users", "avatar_id")
+    schema.add_column("users", "avatar_id", "REFERENCES avatars(id) DEFAULT 1")
+  end,
+  
+  [8] = function ()
+    schema.add_column("topics", "sort_order", types.integer{default = 0})
+    db.query("UPDATE topics SET sort_order = (SELECT COUNT(*) FROM topics t2 WHERE t2.ROWID <= topics.ROWID)")
+  end
+}

models.lua

@@ -1,2 +1,46 @@
-local autoload = require("lapis.util").autoload
-return autoload("models")
+local Model = require("lapis.db.model").Model
+
+local constants = require("constants")
+
+local Users, Users_mt = Model:extend("users")
+
+function Users_mt:is_guest()
+  return self.permission == constants.PermissionLevel.GUEST
+end
+
+function Users_mt:is_admin()
+  return self.permission == constants.PermissionLevel.ADMIN
+end
+
+function Users_mt:is_mod()
+  return self.permission >= constants.PermissionLevel.MODERATOR
+end
+
+function Users_mt:is_system()
+  return self.permission == constants.PermissionLevel.SYSTEM
+end
+
+function Users_mt:is_logged_in_guest()
+  return self:is_guest() and true
+end
+
+function Users_mt:is_default_avatar()
+  return self.avatar_id == 1
+end
+
+function Users_mt:is_logged_in()
+  return true
+end
+
+local ret = {
+  Users = Users,
+  Topics = Model:extend("topics"),
+  Threads = Model:extend("threads"),
+  Posts = Model:extend("posts"),
+  PostHistory = Model:extend("post_history"),
+  Sessions = Model:extend("sessions"),
+  Avatars = Model:extend("avatars"),
+}
+
+return ret
+

nginx.conf

@@ -32,5 +32,10 @@ http {
     location /favicon.ico {
       alias static/favicon.ico;
     }
+    
+    location /avatars {
+      alias static/avatars;
+      expires 1y;
+    }
   }
 }

porom-dev-1.rockspec

@@ -0,0 +1,25 @@
+package = "porom"
+version = "dev-1"
+
+source = {
+  url = "ssh://gitea@git.poto.cafe:222/yagich/porom.git"
+}
+
+description = {
+  summary = "Homegrown forum software",
+  homepage = "",
+  license = "CNPLv7+"
+}
+
+dependencies = {
+  "lua ~> 5.1",
+  "lapis == 1.16.0",
+  "lsqlite3",
+  "magick",
+  "bcrypt",
+  "luaossl",
+}
+
+build = {
+  type = "none"
+}

sass/style.scss

@@ -0,0 +1,368 @@
+/* src: */
+
+@use "sass:color";
+
+$accent_color: #c1ceb1;
+
+$dark_bg: color.scale($accent_color, $lightness: -25%, $saturation: -97%);
+$dark2: color.scale($accent_color, $lightness: -30%, $saturation: -60%);
+
+$light: color.scale($accent_color, $lightness: 40%, $saturation: -60%);
+$lighter: color.scale($accent_color, $lightness: 60%, $saturation: -60%);
+
+$main_bg: color.scale($accent_color, $lightness: -10%, $saturation: -40%);
+$button_color: color.adjust($accent_color, $hue: 90);
+
+%button-base {
+  cursor: default;
+  color: black;
+  font-size: 0.9rem;
+  text-decoration: none;
+  border: 1px solid black;
+  border-radius: 3px;
+  padding: 5px 20px;
+  margin: 10px 0;
+}
+
+@mixin button($color) {
+  @extend %button-base;
+  background-color: $color;
+  
+  &:hover {
+    background-color: color.scale($color, $lightness: 20%);
+  }
+  
+  &:active {
+    background-color: color.scale($color, $lightness: -10%, $saturation: -70%);
+  }
+  
+  &:disabled {
+    background-color: color.scale($color, $lightness: 30%, $saturation: -90%);
+  }
+}
+
+@mixin navbar($color) {
+  padding: 10px;
+  display: flex;
+  justify-content: end;
+  background-color: $color;
+}
+
+body {
+  font-family: sans-serif;
+  margin: 20px 100px;
+  background-color: $main_bg;
+}
+
+.big {
+  font-size: 1.8rem;
+}
+
+#topnav {
+  @include navbar($accent_color);
+  justify-content: space-between;
+  align-items: center;
+}
+
+#bottomnav {
+  @include navbar($dark_bg);
+}
+
+.darkbg {
+  padding-bottom: 10px;
+  padding-left: 10px;
+  padding-right: 10px;
+  background-color: $dark_bg;
+}
+
+.user-actions {
+  display: flex;
+  column-gap: 15px;
+}
+
+.site-title {
+  padding-right: 30px;
+  font-size: 1.5rem;
+  font-weight: bold;
+  text-decoration: none;
+  color: black;
+}
+
+.thread-title {
+  margin: 0;
+  font-size: 1.5rem;
+  font-weight: bold;
+}
+
+.post {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  grid-template-rows: 1fr;
+  gap: 0;
+  grid-auto-flow: row;
+  grid-template-areas:
+    "usercard post-content-container";
+  border: 2px outset $dark2;
+}
+
+.usercard {
+  grid-area: usercard;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 20px 10px;
+  border: 4px outset $light;
+  background-color: $dark_bg;
+  border-right: solid 2px;
+}
+
+.post-content-container {
+  display: grid;
+  grid-template-columns: 1fr;
+  grid-template-rows: 0.2fr 2.5fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  grid-template-areas:
+    "post-info"
+    "post-content";
+  grid-area: post-content-container;
+}
+
+.post-info {
+  grid-area: post-info;
+  display: flex;
+  justify-content: space-between;
+  padding: 5px 20px;
+  align-items: center;
+  border-top: 1px solid black;
+  border-bottom: 1px solid black;
+}
+
+.post-content {
+  grid-area: post-content;
+  padding: 5px 20px;
+}
+
+.user-posts {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  grid-template-rows: 1fr;
+  gap: 0;
+  grid-auto-flow: row;
+  grid-template-areas:
+    "user-page-usercard user-posts-container";
+  border: 2px outset $dark2;
+}
+
+.user-page-usercard {
+  grid-area: user-page-usercard;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 20px 10px;
+  border: 4px outset $light;
+  background-color: $dark_bg;
+  border-right: solid 2px;
+}
+
+.user-posts-container {
+  grid-area: user-posts-container;
+  display: grid;
+  grid-template-columns: 1fr;
+  grid-template-rows: 0.2fr 2.5fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  grid-template-areas:
+    "post-info"
+    "post-content";
+}
+
+.avatar {
+  width: 90%;
+  height: 90%;
+  object-fit: contain;
+  padding-bottom: 10px;
+}
+
+.username-link {
+  overflow-wrap: anywhere;
+}
+
+.user-status {
+  text-align: center;
+}
+
+button, input[type="submit"], .linkbutton {
+  display: inline-block;
+  @include button($button_color);
+  
+  &.critical {
+    color: white;
+    @include button(red);
+  }
+  
+  &.warn {
+    @include button(#fbfb8d);
+  }
+}
+
+// not sure why this one has to be separate, but if it's included in the rule above everything breaks
+input[type="file"]::file-selector-button {
+  @include button($button_color);
+  margin: 10px 10px;
+}
+
+p {
+  margin: 15px 0;
+}
+
+.pagebutton {
+  @include button($button_color);
+  padding: 5px 5px;
+  margin: 0;
+  display: inline-block;
+  min-width: 20px;
+  text-align: center;
+}
+
+.currentpage {
+  @extend %button-base;
+  border: none;
+  padding: 5px 5px;
+  margin: 0;
+  display: inline-block;
+  min-width: 20px;
+  text-align: center;
+}
+
+.modform {
+  display: inline;
+}
+
+.login-container > * {
+  width: 25%;
+  margin: auto;
+}
+
+.settings-container > * {
+  width: 40%;
+  margin: auto;
+}
+
+.avatar-form {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 20px 0;
+}
+
+input[type="text"], input[type="password"], textarea, select {
+  border: 1px solid black;
+  border-radius: 3px;
+  padding: 7px 10px;
+  width: 100%;
+  box-sizing: border-box;
+  resize: vertical;
+  background-color: color.scale($accent_color, $lightness: 40%);
+  
+  &:focus {
+    background-color: color.scale($accent_color, $lightness: 60%);
+  }
+}
+
+.infobox {
+  border: 2px solid black;
+  background-color: $accent_color;
+  padding: 20px 15px;
+  
+  &.critical {
+    background-color: rgb(237, 129, 129);
+  }
+  
+  &.warn {
+    background-color: #fbfb8d;
+  }
+}
+
+.infobox > span {
+  display: flex;
+  align-items: center;
+}
+
+.infobox-icon-container {
+  min-width: 60px;
+  padding-right: 15px;
+}
+
+.thread {
+  display: grid;
+  grid-template-columns: 96px 1.6fr 96px;
+  grid-template-rows: 1fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  min-height: 96px;
+  grid-template-areas:
+    "thread-sticky-container thread-info-container thread-locked-container";
+}
+
+.thread-sticky-container {
+  grid-area: thread-sticky-container;
+  border: 2px outset $light;
+}
+
+.thread-locked-container {
+  grid-area: thread-locked-container;
+  border: 2px outset $light;
+}
+
+.contain-svg {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-direction: column;
+}
+
+.contain-svg > svg {
+  height: 50%;
+  width: 50%;
+}
+
+.thread-info-container {
+  grid-area: thread-info-container;
+  background-color: $accent_color;
+  padding: 5px 20px;
+  border-top: 1px solid black;
+  border-bottom: 1px solid black;
+  display: flex;
+  flex-direction: column;
+}
+
+.thread-info-post-preview {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  display: inline;
+}
+
+.topic {
+  display: grid;
+  grid-template-columns: 1.5fr 64px;
+  grid-template-rows: 1fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  grid-template-areas:
+    "topic-info-container topic-locked-container";
+}
+
+.topic-info-container {
+  grid-area: topic-info-container;
+  background-color: $accent_color;
+  padding: 5px 20px;
+  border: 1px solid black;
+  display: flex;
+  flex-direction: column;
+}
+
+.topic-locked-container {
+  grid-area: topic-locked-container;
+  border: 2px outset $light;
+}

schema.lua

@@ -0,0 +1,48 @@
+local schema = require("lapis.db.schema")
+local db = require("lapis.db")
+
+local types = schema.types
+
+schema.create_table("users", {
+  {"id", types.integer{primary_key = true}},
+  {"username", types.text{unique = true, null = false}},
+  {"password_hash", types.text{null = false}},
+  {"permission", types.integer{default = 0}},
+  {"created_at", "INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP))"}
+})
+
+schema.create_table("topics", {
+  {"id", types.integer{primary_key = true}},
+  {"name", types.text{null = false}},
+  {"slug", types.text{null = false, unique = true}}
+})
+
+schema.create_table("threads", {
+  {"id", types.integer{primary_key = true}},
+  {"topic_id", "INTEGER REFERENCES topics(id) ON DELETE CASCADE"},
+  {"user_id", "INTEGER REFERENCES users(id) ON DELETE SET NULL"},
+  {"title", types.text{null = false}},
+  {"slug", types.text{null = false, unique = true}},
+  {"created_at", "INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP))"},
+})
+
+schema.create_table("posts", {
+  {"id", types.integer{primary_key = true}},
+  {"thread_id", "INTEGER REFERENCES threads(id) ON DELETE CASCADE"},
+  {"user_id", "INTEGER REFERENCES users(id) ON DELETE SET NULL"},
+  {"created_at", "INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP))"},
+  {"current_revision_id", "INTEGER REFERENCES post_history(id)"},
+})
+
+schema.create_table("post_history", {
+  {"id", types.integer{primary_key = true}},
+  {"post_id", "INTEGER REFERENCES posts(id) ON DELETE CASCADE"},
+  {"user_id", "INTEGER REFERENCES users(id) ON DELETE CASCADE"},
+  {"content", types.text{null = false}},
+  {"edited_at", "INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP))"},
+  {"is_initial_revision", "BOOLEAN DEFAULT FALSE"}
+})
+
+db.query("CREATE INDEX idx_threads_topic_id ON threads(topic_id)")
+db.query("CREATE INDEX idx_posts_thread_id ON posts(thread_id)")
+db.query("CREATE INDEX idx_post_history_post_id ON post_history(post_id)")

secrets.lua.example

@@ -0,0 +1,3 @@
+return {
+  key = "PROD_SECRET_KEY_HERE",
+}

start.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+start() {
+  lapis serve
+}
+
+first_launch() {
+  echo "Setting up for the first time"
+  touch ".first_launch.$LAPIS_ENVIRONMENT"
+  lua5.1 schema.lua
+  lapis migrate
+  lua5.1 create_default_accounts.lua
+}
+
+if [[ $# -ne 1 ]]; then
+  export LAPIS_ENVIRONMENT="development"
+  echo "WARN: no environment passed, assuming default (development)"
+else
+  export LAPIS_ENVIRONMENT="$1"
+fi
+
+echo "Starting in $LAPIS_ENVIRONMENT"
+
+if ! [ -f ".first_launch.$LAPIS_ENVIRONMENT" ]; then
+  first_launch
+fi
+
+start

static/style.css

@@ -0,0 +1,366 @@
+/* src: */
+.currentpage, .pagebutton, input[type=file]::file-selector-button, button.warn, input[type=submit].warn, .linkbutton.warn, button.critical, input[type=submit].critical, .linkbutton.critical, button, input[type=submit], .linkbutton {
+  cursor: default;
+  color: black;
+  font-size: 0.9rem;
+  text-decoration: none;
+  border: 1px solid black;
+  border-radius: 3px;
+  padding: 5px 20px;
+  margin: 10px 0;
+}
+
+body {
+  font-family: sans-serif;
+  margin: 20px 100px;
+  background-color: rgb(173.5214173228, 183.6737007874, 161.0262992126);
+}
+
+.big {
+  font-size: 1.8rem;
+}
+
+#topnav {
+  padding: 10px;
+  display: flex;
+  justify-content: end;
+  background-color: #c1ceb1;
+  justify-content: space-between;
+  align-items: center;
+}
+
+#bottomnav {
+  padding: 10px;
+  display: flex;
+  justify-content: end;
+  background-color: rgb(143.7039271654, 144.3879625984, 142.8620374016);
+}
+
+.darkbg {
+  padding-bottom: 10px;
+  padding-left: 10px;
+  padding-right: 10px;
+  background-color: rgb(143.7039271654, 144.3879625984, 142.8620374016);
+}
+
+.user-actions {
+  display: flex;
+  column-gap: 15px;
+}
+
+.site-title {
+  padding-right: 30px;
+  font-size: 1.5rem;
+  font-weight: bold;
+  text-decoration: none;
+  color: black;
+}
+
+.thread-title {
+  margin: 0;
+  font-size: 1.5rem;
+  font-weight: bold;
+}
+
+.post {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  grid-template-rows: 1fr;
+  gap: 0;
+  grid-auto-flow: row;
+  grid-template-areas: "usercard post-content-container";
+  border: 2px outset rgb(135.1928346457, 145.0974015748, 123.0025984252);
+}
+
+.usercard {
+  grid-area: usercard;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 20px 10px;
+  border: 4px outset rgb(217.26, 220.38, 213.42);
+  background-color: rgb(143.7039271654, 144.3879625984, 142.8620374016);
+  border-right: solid 2px;
+}
+
+.post-content-container {
+  display: grid;
+  grid-template-columns: 1fr;
+  grid-template-rows: 0.2fr 2.5fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  grid-template-areas: "post-info" "post-content";
+  grid-area: post-content-container;
+}
+
+.post-info {
+  grid-area: post-info;
+  display: flex;
+  justify-content: space-between;
+  padding: 5px 20px;
+  align-items: center;
+  border-top: 1px solid black;
+  border-bottom: 1px solid black;
+}
+
+.post-content {
+  grid-area: post-content;
+  padding: 5px 20px;
+}
+
+.user-posts {
+  display: grid;
+  grid-template-columns: 200px 1fr;
+  grid-template-rows: 1fr;
+  gap: 0;
+  grid-auto-flow: row;
+  grid-template-areas: "user-page-usercard user-posts-container";
+  border: 2px outset rgb(135.1928346457, 145.0974015748, 123.0025984252);
+}
+
+.user-page-usercard {
+  grid-area: user-page-usercard;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 20px 10px;
+  border: 4px outset rgb(217.26, 220.38, 213.42);
+  background-color: rgb(143.7039271654, 144.3879625984, 142.8620374016);
+  border-right: solid 2px;
+}
+
+.user-posts-container {
+  grid-area: user-posts-container;
+  display: grid;
+  grid-template-columns: 1fr;
+  grid-template-rows: 0.2fr 2.5fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  grid-template-areas: "post-info" "post-content";
+}
+
+.avatar {
+  width: 90%;
+  height: 90%;
+  object-fit: contain;
+  padding-bottom: 10px;
+}
+
+.username-link {
+  overflow-wrap: anywhere;
+}
+
+.user-status {
+  text-align: center;
+}
+
+button, input[type=submit], .linkbutton {
+  display: inline-block;
+  background-color: rgb(177, 206, 204.5);
+}
+button:hover, input[type=submit]:hover, .linkbutton:hover {
+  background-color: rgb(192.6, 215.8, 214.6);
+}
+button:active, input[type=submit]:active, .linkbutton:active {
+  background-color: rgb(166.6881496063, 178.0118503937, 177.4261417323);
+}
+button:disabled, input[type=submit]:disabled, .linkbutton:disabled {
+  background-color: rgb(209.535, 211.565, 211.46);
+}
+button.critical, input[type=submit].critical, .linkbutton.critical {
+  color: white;
+  background-color: red;
+}
+button.critical:hover, input[type=submit].critical:hover, .linkbutton.critical:hover {
+  background-color: #ff3333;
+}
+button.critical:active, input[type=submit].critical:active, .linkbutton.critical:active {
+  background-color: rgb(149.175, 80.325, 80.325);
+}
+button.critical:disabled, input[type=submit].critical:disabled, .linkbutton.critical:disabled {
+  background-color: rgb(174.675, 156.825, 156.825);
+}
+button.warn, input[type=submit].warn, .linkbutton.warn {
+  background-color: #fbfb8d;
+}
+button.warn:hover, input[type=submit].warn:hover, .linkbutton.warn:hover {
+  background-color: rgb(251.8, 251.8, 163.8);
+}
+button.warn:active, input[type=submit].warn:active, .linkbutton.warn:active {
+  background-color: rgb(198.3813559322, 198.3813559322, 154.4186440678);
+}
+button.warn:disabled, input[type=submit].warn:disabled, .linkbutton.warn:disabled {
+  background-color: rgb(217.55, 217.55, 209.85);
+}
+
+input[type=file]::file-selector-button {
+  background-color: rgb(177, 206, 204.5);
+  margin: 10px 10px;
+}
+input[type=file]::file-selector-button:hover {
+  background-color: rgb(192.6, 215.8, 214.6);
+}
+input[type=file]::file-selector-button:active {
+  background-color: rgb(166.6881496063, 178.0118503937, 177.4261417323);
+}
+input[type=file]::file-selector-button:disabled {
+  background-color: rgb(209.535, 211.565, 211.46);
+}
+
+p {
+  margin: 15px 0;
+}
+
+.pagebutton {
+  background-color: rgb(177, 206, 204.5);
+  padding: 5px 5px;
+  margin: 0;
+  display: inline-block;
+  min-width: 20px;
+  text-align: center;
+}
+.pagebutton:hover {
+  background-color: rgb(192.6, 215.8, 214.6);
+}
+.pagebutton:active {
+  background-color: rgb(166.6881496063, 178.0118503937, 177.4261417323);
+}
+.pagebutton:disabled {
+  background-color: rgb(209.535, 211.565, 211.46);
+}
+
+.currentpage {
+  border: none;
+  padding: 5px 5px;
+  margin: 0;
+  display: inline-block;
+  min-width: 20px;
+  text-align: center;
+}
+
+.modform {
+  display: inline;
+}
+
+.login-container > * {
+  width: 25%;
+  margin: auto;
+}
+
+.settings-container > * {
+  width: 40%;
+  margin: auto;
+}
+
+.avatar-form {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  padding: 20px 0;
+}
+
+input[type=text], input[type=password], textarea, select {
+  border: 1px solid black;
+  border-radius: 3px;
+  padding: 7px 10px;
+  width: 100%;
+  box-sizing: border-box;
+  resize: vertical;
+  background-color: rgb(217.8, 225.6, 208.2);
+}
+input[type=text]:focus, input[type=password]:focus, textarea:focus, select:focus {
+  background-color: rgb(230.2, 235.4, 223.8);
+}
+
+.infobox {
+  border: 2px solid black;
+  background-color: #c1ceb1;
+  padding: 20px 15px;
+}
+.infobox.critical {
+  background-color: rgb(237, 129, 129);
+}
+.infobox.warn {
+  background-color: #fbfb8d;
+}
+
+.infobox > span {
+  display: flex;
+  align-items: center;
+}
+
+.infobox-icon-container {
+  min-width: 60px;
+  padding-right: 15px;
+}
+
+.thread {
+  display: grid;
+  grid-template-columns: 96px 1.6fr 96px;
+  grid-template-rows: 1fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  min-height: 96px;
+  grid-template-areas: "thread-sticky-container thread-info-container thread-locked-container";
+}
+
+.thread-sticky-container {
+  grid-area: thread-sticky-container;
+  border: 2px outset rgb(217.26, 220.38, 213.42);
+}
+
+.thread-locked-container {
+  grid-area: thread-locked-container;
+  border: 2px outset rgb(217.26, 220.38, 213.42);
+}
+
+.contain-svg {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  flex-direction: column;
+}
+
+.contain-svg > svg {
+  height: 50%;
+  width: 50%;
+}
+
+.thread-info-container {
+  grid-area: thread-info-container;
+  background-color: #c1ceb1;
+  padding: 5px 20px;
+  border-top: 1px solid black;
+  border-bottom: 1px solid black;
+  display: flex;
+  flex-direction: column;
+}
+
+.thread-info-post-preview {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  display: inline;
+}
+
+.topic {
+  display: grid;
+  grid-template-columns: 1.5fr 64px;
+  grid-template-rows: 1fr;
+  gap: 0px 0px;
+  grid-auto-flow: row;
+  grid-template-areas: "topic-info-container topic-locked-container";
+}
+
+.topic-info-container {
+  grid-area: topic-info-container;
+  background-color: #c1ceb1;
+  padding: 5px 20px;
+  border: 1px solid black;
+  display: flex;
+  flex-direction: column;
+}
+
+.topic-locked-container {
+  grid-area: topic-locked-container;
+  border: 2px outset rgb(217.26, 220.38, 213.42);
+}

svg-icons/error.etlua

@@ -0,0 +1,5 @@
+<!-- https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license -->
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="60px" height="60px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M18.364 5.63604C19.9926 7.26472 21 9.51472 21 12C21 16.9706 16.9706 21 12 21C9.51472 21 7.26472 19.9926 5.63604 18.364M18.364 5.63604C16.7353 4.00736 14.4853 3 12 3C7.02944 3 3 7.02944 3 12C3 14.4853 4.00736 16.7353 5.63604 18.364M18.364 5.63604L5.63604 18.364" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

svg-icons/info.etlua

@@ -0,0 +1,5 @@
+<!-- https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license -->
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="60px" height="60px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M12 8V8.5M12 12V16M12 21C16.9706 21 21 16.9706 21 12C21 7.02944 16.9706 3 12 3C7.02944 3 3 7.02944 3 12C3 16.9706 7.02944 21 12 21Z" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

svg-icons/lock.etlua

@@ -0,0 +1,5 @@
+<!-- https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license -->
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="60px" height="60px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M12 14V16M8 9V6C8 3.79086 9.79086 2 12 2C14.2091 2 16 3.79086 16 6V9M7 21H17C18.1046 21 19 20.1046 19 19V11C19 9.89543 18.1046 9 17 9H7C5.89543 9 5 9.89543 5 11V19C5 20.1046 5.89543 21 7 21Z" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

svg-icons/sticky.etlua

@@ -0,0 +1,5 @@
+<!-- https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license -->
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="24px" height="24px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M13 20H6C4.89543 20 4 19.1046 4 18V6C4 4.89543 4.89543 4 6 4H18C19.1046 4 20 4.89543 20 6V13M13 20L20 13M13 20V14C13 13.4477 13.4477 13 14 13H20" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

svg-icons/warn.etlua

@@ -0,0 +1,5 @@
+<!-- https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license -->
+<?xml version="1.0" encoding="utf-8"?>
+<svg width="60px" height="60px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M12 15H12.01M12 12V9M4.98207 19H19.0179C20.5615 19 21.5233 17.3256 20.7455 15.9923L13.7276 3.96153C12.9558 2.63852 11.0442 2.63852 10.2724 3.96153L3.25452 15.9923C2.47675 17.3256 3.43849 19 4.98207 19Z" stroke="#000000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

util.lua

@@ -0,0 +1,202 @@
+local util = {}
+local magick = require("magick")
+local db = require("lapis.db")
+local html_escape = require("lapis.html").escape
+local constants   = require("constants")
+
+local Avatars = require("models").Avatars
+local Users = require("models").Users
+local Posts = require("models").Posts
+local PostHistory = require("models").PostHistory
+
+local babycode = require("lib.babycode")
+
+util.TransientUser = {
+  is_admin = function (self)
+    return false
+  end,
+  is_mod = function (self)
+    return false
+  end,
+  is_guest = function (self)
+    return true
+  end,
+  is_system = function (self)
+    return false
+  end,
+  is_logged_in_guest = function (self)
+    return false
+  end,
+  is_logged_in = function (self)
+    return false
+  end,
+  username = "Deleted User",
+}
+
+function util.get_user_avatar_url(req, user)
+  return Avatars:find(user.avatar_id).file_path
+end
+
+function util.validate_and_create_image(input_image, filename)
+  local img = magick.load_image_from_blob(input_image)
+
+  if not img then
+    return false
+  end
+
+  img:strip()
+  img:set_gravity("CenterGravity")
+
+  local width, height = img:get_width(), img:get_height()
+  local min_dim = math.min(width, height)
+  if min_dim > 256 then
+    local ratio = 256.0 / min_dim
+    local new_w, new_h = width * ratio, height * ratio
+    img:resize(new_w, new_h)
+  end
+
+  width, height = img:get_width(), img:get_height()
+  local crop_size = math.min(width, height)
+  local x_offset = (width - crop_size) / 2
+  local y_offset = (height - crop_size) / 2
+  img:crop(crop_size, crop_size, x_offset, y_offset)
+
+  img:set_format("webp")
+  img:set_quality(85)
+
+  img:write(filename)
+  img:destroy()
+  return true
+end
+
+function util.destroy_avatar(avatar_id)
+  if avatar_id == 1 then
+    print("won't delete default avatar")
+    return
+  end
+  
+  local avatar = Avatars:find(avatar_id)
+  
+  if not avatar then
+    return
+  end
+  
+  local file_path = "static" .. avatar.file_path
+  local f = io.open(file_path, "r")
+  if not f then
+    print("can't open avatar file")
+  else
+    f:close()
+    os.remove(file_path)
+    avatar:delete()
+  end
+end
+
+function util.get_logged_in_user(req)
+  if req.session.session_key == nil then
+    return nil
+  end
+
+  local session = db.select('* FROM "sessions" WHERE "key" = ? AND "expires_at" > "?" LIMIT 1', req.session.session_key, os.time())
+  if #session > 0 then
+    return Users:find({id = session[1].user_id})
+  end
+
+  return nil
+end
+
+function util.get_logged_in_user_or_transient(req)
+  return util.get_logged_in_user(req) or util.TransientUser
+end
+
+function util.ntob(v)
+  return v ~= 0
+end
+
+function util.bton(b)
+  return 1 and b or 0
+end
+
+function util.stob(s)
+  if s == "true" then
+    return true
+  end
+  if s == "false" then
+    return false
+  end
+end
+
+function util.form_bool_to_sqlite(s)
+  return util.bton(util.stob(s))
+end
+
+function util.is_thread_locked(thread)
+  return util.ntob(thread.is_locked)
+end
+
+function util.create_post(thread_id, user_id, content)
+  db.query("BEGIN")
+  local post = Posts:create({
+    thread_id = thread_id,
+    user_id = user_id,
+    current_revision_id = db.NULL,
+  })
+  
+  local bb_content = babycode.to_html(content, html_escape)
+  
+  local revision = PostHistory:create({
+    post_id = post.id,
+    content = bb_content,
+    is_initial_revision = true,
+  })
+  
+  post:update({current_revision_id = revision.id})
+  
+  db.query("COMMIT")
+  return post
+end
+
+function util.transfer_and_delete_user(user)
+  local deleted_user = Users:find({
+    username = "DeletedUser",
+  })
+  -- this needs to be atomic
+  db.query("BEGIN")
+  db.query('UPDATE "threads" SET "user_id" = ? WHERE "user_id" = ?', deleted_user.id, user.id)
+  db.query('UPDATE "posts" SET "user_id" = ? WHERE "user_id" = ?', deleted_user.id, user.id)
+  user:delete() -- uncomment later
+  db.query("COMMIT")
+end
+
+function util.pop_infobox(req)
+  if not req.session.infobox then return end
+  req.infobox = req.session.infobox
+  req.session.infobox = nil
+end
+
+function util.inject_infobox(req, message, kind)
+  kind = kind or constants.InfoboxKind.INFO
+  local ib = {
+    msg = message,
+    kind = kind,
+  }
+  req.session.infobox = ib
+end
+
+function util.inject_err_infobox(req, message)
+  local ib = {
+    msg = message,
+    kind = constants.InfoboxKind.ERROR,
+  }
+  req.session.infobox = ib
+end
+
+function util.inject_warn_infobox(req, message)
+  local ib = {
+    msg = message,
+    kind = constants.InfoboxKind.WARN,
+  }
+  req.session.infobox = ib
+end
+
+return util

views/base.etlua

@@ -0,0 +1,17 @@
+<!DOCTYPE HTML>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <% if page_title then %>
+    <title>Porom - <%= page_title %></title>
+  <% else %>
+    <title>Porom</title>
+  <% end %>
+  <% math.randomseed(os.time()) %>
+  <link rel="stylesheet" href="<%= "/static/style.css?" .. math.random(1, 100) %>">
+</head>
+<body>
+  <% render("views.common.topnav") -%>
+  <% content_for("inner") %>
+</body>
+</html>

views/common/bbcode_help.etlua

@@ -0,0 +1,11 @@
+<details>
+  <summary>Supported babycode tags</summary>
+  <ul>
+    <li>[b]<b>bold</b>[/b]</li>
+    <li>[i]<i>italic</i>[/i]</li>
+    <li>[s]<del>strikethrough</del>[/s]</li>
+    <li>[url=https://example.com]<a href="https://example.com">labeled URL</a>[/url]</li>
+    <li>[url]<a href="https://unlabeled-url.example.com">https://unlabeled-url.example.com</a>[/url]</li>
+    <li>[code]<code>code block</code>[/code]</li>
+  </ul>
+</details>

views/common/infobox.etlua

@@ -0,0 +1,13 @@
+<%
+  local class = "infobox " .. constants.InfoboxHTMLClass[kind]
+  local icon = constants.InfoboxIcons[kind]
+%>
+
+<div class="<%= class %>">
+  <span>
+  <div class="infobox-icon-container">
+  <% render(icon) %>
+  </div>
+    <%= msg %>
+  </span>
+</div>

views/common/pagination.etlua

@@ -0,0 +1,27 @@
+<% local left_start = math.max(1, current_page - 5) %>
+<% local right_end = math.min(page_count, current_page + 5) %>
+
+<div class="pager">
+  <span>Page:</span>
+  <% if current_page > 5 then %>
+    <a href="?page=1" class="pagebutton">1</a>
+    <% if left_start > 2 then %>
+      <span class="currentpage">&hellip;</span>
+    <% end %>
+  <% end %>
+  <% for i = left_start, current_page - 1 do%>
+    <a href="?page=<%= i %>" class="pagebutton"><%= i %></a>
+  <% end %>
+  <% if page_count > 0 then %>
+    <span class="currentpage"><%= current_page %></span>
+  <% end %>
+  <% for i = current_page + 1, right_end do %>
+    <a href="?page=<%= i %>" class="pagebutton"><%= i %></a>
+  <% end %>
+  <% if right_end < page_count then %>
+    <% if right_end < page_count - 1 then %>
+      <span class="currentpage">&hellip;</span>
+    <% end %>
+    <a href="?page=<%= page_count %>" class="pagebutton"><%= page_count %></a>
+  <% end %>
+</div>

views/common/topnav.etlua

@@ -0,0 +1,18 @@
+<nav id="topnav">
+  <span>
+    <% local topics_url = url_for("all_topics") %>
+    <a class="site-title" href="<%= topics_url %>">Porom</a>
+    <a href="<%= topics_url %>">All topics</a>
+  </span>
+  <span>
+    <% if me and me:is_logged_in() then -%>
+      Welcome, <a href="<%= url_for("user", {username = me.username}) %>"><%= me.username %></a>
+      <% if me:is_mod() then %>
+        &bullet;
+        <a href="<%= url_for("user_list") %>">User list</a>
+      <% end %>
+    <% else -%>
+      Welcome, guest. Please <a href="<%= url_for("user_signup") %>">sign up</a> or <a href="<%= url_for("user_login") %>">log in</a>
+    <% end -%>
+  </span>
+</nav>

views/mod/user-list.etlua

@@ -0,0 +1,8 @@
+<div class="darkbg settings-container">
+  <h1>All users</h1>
+  <ul>
+    <% for _, user in ipairs(users) do %>
+      <li><a href="<%= url_for("user", {username = user.username}) %>"><%= user.username %></a></li>
+    <% end %>
+  </ul>
+</div>

views/threads/create.etlua

@@ -0,0 +1,17 @@
+<div class="darkbg settings-container">
+  <h1>New thread</h1>
+    <form method="post">
+      <label for="topic_id">Topic</label>
+      <select name="topic_id", id="topic_id" autocomplete="off">
+        <% for _, topic in ipairs(all_topics) do %>
+          <option value="<%= topic.id %>" <%- params.topic_id == tostring(topic.id) and "selected" or "" %>><%= topic.name %></value>
+        <% end %>
+      </select><br>
+      <label for="title">Thread title</label>
+      <input type="text" id="title" name="title" placeholder="Required" required>
+      <label for="initial_post">Post body</label>
+      <textarea id="initial_post" name="initial_post" placeholder="Required" rows=5 required></textarea>
+      <% render "views.common.bbcode_help" %>
+      <input type="submit" value="Create thread">
+    </form>
+</div>

views/threads/post.etlua

@@ -0,0 +1,26 @@
+<div class="post" id="post-<%= post.id %>">
+  <div class="usercard">
+    <a href="<%= url_for("user", {username = post.username}) %>" style="display: contents;">
+    <img src="<%= post.avatar_path %>" class="avatar">
+    </a>
+    <a href="<%= url_for("user", {username = post.username}) %>" class="username-link"><%= post.username %></a>
+    <% if post.status ~= "" then %>
+      <em class="user-status"><%= post.status %></em>
+    <% end %>
+  </div>
+  <div class="post-content-container"<%= is_latest and 'id=latest-post' or "" %>>
+    <div class="post-info">
+        <div><a href="<%= "#post-" .. post.id %>" title="Permalink"><i>
+          <% if tonumber(post.edited_at) > tonumber(post.created_at) then -%>
+            Edited at <%= os.date("%c", post.edited_at) %>
+          <% else -%>
+            Posted at <%= os.date("%c", post.created_at) %>
+          <% end -%>
+        </i></a></div>
+        <div><button>Reply</button></div>
+    </div>
+    <div class="post-content">
+      <%- post.content %>
+    </div>
+  </div>
+</div>

views/threads/thread.etlua

@@ -0,0 +1,25 @@
+<% local is_locked = ntob(thread.is_locked) %>
+<main>
+  <nav class="darkbg">
+    <h1 class="thread-title"><%= thread.title %></h1>
+    <span>Posted in <a href="<%= url_for("topic", {slug = topic.slug}) %>"><%= topic.name %></a></span>
+  </nav>
+  <% for i, post in ipairs(posts) do %>
+    <% render("views.threads.post", {post = post, is_latest = i == #posts}) %>
+  <% end %>
+</main>
+
+<nav id="bottomnav">
+  <% render("views.common.pagination", {page_count = pages, current_page = page}) %>
+</nav>
+
+<% if is_locked then -%>
+  <% render("views.common.infobox", {kind = constants.InfoboxKind.LOCK, msg = "This thread is locked."}) %>
+<% end -%>
+<% if not me:is_guest() and not is_locked then %>
+<h1>Respond to "<%= thread.title %>"</h1>
+<form method="post">
+  <textarea id="post_content" name="post_content" placeholder="Response body" required></textarea><br>
+  <input type="submit" value="Post reply">
+</form>
+<% end %>

views/topics/create.etlua

@@ -0,0 +1,10 @@
+<div class="darkbg settings-container">
+  <h1>Create topic</h1>
+  <form method="post">
+    <label for=name>Name</label>
+    <input type="text" name="name" id="name" required><br>
+    <label for=description>Description</label>
+    <textarea id="description" name="description" required rows=5></textarea><br>
+    <input type="submit" value="Create topic">
+  </form>
+</div>

views/topics/edit.etlua

@@ -0,0 +1,12 @@
+<div class="darkbg settings-container">
+  <h1>Editing topic <%= topic.name %></h1>
+  <form method="post">
+    <label for=name>Name</label>
+    <input type="text" name="name" id="name" value="<%= topic.name %>" placeholder="Topic name" required>
+    <label for=description>Description</label>
+    <textarea id="description" name="description" placeholder="Topic description" rows=4><%= topic.description %></textarea>
+    <input type="submit" value="Save changes">
+    <a class="linkbutton" href="<%= url_for("topic", {slug = topic.slug}) %>">Cancel</a><br>
+  <i>Note: to preserve history, you cannot change the topic URL.</i>
+  </form>
+</div>

views/topics/topic.etlua

@@ -0,0 +1,68 @@
+<% if infobox then %>
+  <% render("views.common.infobox", infobox) %>
+<% end %>
+
+<nav class="darkbg">
+  <h1 class="thread-title">All threads in "<%= topic.name %>"</h1>
+  <span><%= topic.description %></span>
+  <div>
+  <% if thread_create_error == ThreadCreateError.OK then %>
+    <a class="linkbutton" href=<%= url_for("thread_create", nil, {topic_id = topic.id}) %>>New thread</a>
+  <% elseif thread_create_error == ThreadCreateError.GUEST then %>
+    <p>Your account is still pending confirmation by a moderator. You are not able to create a new thread or post at this time.</p>
+  <% elseif thread_create_error == ThreadCreateError.LOGGED_OUT then %>
+    <p>Only logged in users can create threads. <a href="<%= url_for("user_signup") %>">Sign up</a> or <a href="<%= url_for("user_login")%>">log in</a> to create a thread.</p>
+  <% else %>
+    <p>This topic is locked.</p>
+  <% end %>
+  <% if me:is_mod() then %>
+    <a class="linkbutton" href="<%= url_for("topic_edit", {slug = topic.slug}) %>">Edit topic</a>
+    <form class="modform" method="post" action="<%= url_for("topic_edit", {slug = topic.slug}) %>">
+      <input type="hidden" name="is_locked" value="<%= not ntob(topic.is_locked) %>">
+      <input class="warn" type="submit" id="lock" value="<%= ntob(topic.is_locked) and "Unlock topic" or "Lock topic" %>">
+    </form>
+  <% end %>
+  </div>
+</nav>
+
+<% if #threads_list == 0 then %>
+  <p>There are no threads in this topic.</p>
+<% else %>
+  <% for _, thread in ipairs(threads_list) do %>
+    <% local is_stickied = ntob(thread.is_stickied) %>
+    <% local is_locked = ntob(thread.is_locked) %>
+    <div class="thread">
+      <div class="thread-sticky-container contain-svg">
+        <% if is_stickied then -%>
+          <% render("svg-icons.sticky") %>
+          <i>Stickied</i>
+        <% end -%>
+      </div>
+      <div class="thread-info-container">
+        <span>
+          <span class="thread-title"><a href="<%= url_for("thread", {slug = thread.slug}) %>"><%= thread.title %></a></span>
+          &bullet;
+          Started by <a href=<%= url_for("user", {username = thread.started_by}) %>><%= thread.started_by %></a>
+          on <%= os.date("%c", thread.created_at) %>
+        </span>
+        <span>
+          Latest post by <a href="<%= url_for("user", {username = thread.latest_post_username}) %>"><%= thread.latest_post_username %></a>
+          <a href="<%= url_for("thread", {slug = thread.slug}, {after = thread.latest_post_id}) .. "#post-" .. thread.latest_post_id %>">on <%= os.date("%c", thread.latest_post_created_at) %></a>:
+        </span>
+        <span class="thread-info-post-preview">
+          <%- thread.latest_post_content %>
+        </span>
+      </div>
+      <div class="thread-locked-container contain-svg">
+        <% if is_locked then -%>
+          <% render("svg-icons.lock") %>
+          <i>Locked</i>
+        <% end -%>
+      </div>
+    </div>
+  <% end %>
+<% end %>
+
+<nav id="bottomnav">
+  <% render("views.common.pagination", {page_count = pages, current_page = page}) %>
+</nav>

views/topics/topics.etlua

@@ -0,0 +1,33 @@
+<nav class="darkbg">
+  <h1 class="thread-title">All topics</h1>
+  <% if me:is_mod() then %>
+    <a class="linkbutton" href="<%= url_for("topic_create") %>">Create new topic</a>
+  <% end %>
+</nav>
+
+<% if #topic_list == 0 then %>
+  <p>There are no topics.</p>
+<% else %>
+  <% for _, topic in ipairs(topic_list) do %>
+    <% local is_locked = ntob(topic.is_locked) %>
+    <div class="topic">
+      <div class="topic-info-container">
+        <a href=<%= url_for("topic", {slug = topic.slug}) %>><%= topic.name %></a>
+        <%= topic.description %>
+        <% if topic.latest_thread_username then %>
+        <span>
+          Latest thread: <a href="<%= url_for("thread", {slug = topic.latest_thread_slug}) %>"><%= topic.latest_thread_title %></a> by <a href="<%= url_for("user", {username = topic.latest_thread_username}) %>"><%= topic.latest_thread_username %></a> on <%= os.date("%c", topic.latest_thread_created_at) %>
+        </span>
+        <% else %>
+        <i>No threads yet.</i>
+        <% end %>
+      </div>
+      <div class="topic-locked-container contain-svg">
+        <% if is_locked then -%>
+          <% render("svg-icons.lock") %>
+          <i>Locked</i>
+        <% end -%>
+      </div>
+    </div>
+  <% end %>
+<% end %>

views/user/delete_confirm.etlua

@@ -0,0 +1,14 @@
+<div class="darkbg settings-container">
+  <h1>Are you sure you want to delete your account, <%= me.username %>?</h1>
+  <p>This cannot be undone. This will not delete your posts, only anonymize them.</p>
+  <p>If you are sure, please type your password below.</p>
+
+  <% if infobox then %>
+    <% render("views.common.infobox", infobox) %>
+  <% end %>
+
+  <form method="post" action="<%= url_for("user_delete", {username = me.username}) %>">
+    <input type="password" name="password" id="password" autocomplete="current-password" placeholder="Password" required><br>
+    <input class="critical" type="submit" value="Delete my account (NO UNDO)">
+  </form>
+</div>

views/user/login.etlua

@@ -0,0 +1,13 @@
+<div class="darkbg login-container">
+  <h1>Log In</h1>
+  <% if infobox then %>
+    <% render("views.common.infobox", infobox) %>
+  <% end %>
+  <form method="post" action="<%= url_for('user_login') %>" enctype="multipart/form-data">
+    <label for="username">Username</label><br>
+    <input type="text" id="username" name="username" required autocomplete="username"><br>
+    <label for="password">Password</label><br>
+    <input type="password" id="password" name="password" required autocomplete="current-password"><br>
+    <input type="submit" value="Log in">
+  </form>
+</div>

views/user/settings.etlua

@@ -0,0 +1,25 @@
+<% local disable_avatar = me:is_logged_in_guest() %>
+<div class="darkbg settings-container">
+  <h1>User settings</h1>
+  <% if infobox then %>
+    <% render("views.common.infobox", infobox) %>
+  <% end %>
+  <form class="avatar-form" method="post" action="<%= url_for("user_set_avatar", {username = me.username}) %>" enctype="multipart/form-data">
+    <img src="<%= avatar_url(me) %>">
+    <input id="file" type="file" name="avatar" accept="image/*" required>
+    <div>
+    <input type="submit" value="Update avatar" <%= disable_avatar and "disabled=disabled" %>>
+  <% if not me:is_default_avatar() then %>
+    <input type="submit" value="Clear avatar" formaction="<%= url_for("user_clear_avatar", {username = me.username}) %>" formnovalidate>
+  <% end %>
+  </div>
+  </form>
+  <form method="post" action="">
+    <label for="status">Status</label>
+    <input type="text" id="status" name="status" value="<%= me.status %>" maxlength="30">
+    <input type="submit" value="Save status">
+  </form>
+  <div>
+  <a class="linkbutton critical" href="<%= url_for("user_delete_confirm", {username = me.username}) %>">Delete account</a>
+  </div>
+</div>

views/user/signup.etlua

@@ -0,0 +1,16 @@
+<div class="darkbg login-container">
+  <h1>Sign up</h1>
+  <% if infobox then %>
+    <% render("views.common.infobox", infobox) %>
+  <% end %>
+  <form method="post" action="<%= url_for('user_signup') %>" enctype="multipart/form-data">
+    <label for="username">Username</label><br>
+    <input type="text" id="username" name="username" pattern="[\w\-]{3,20}" title="3-20 characters. Only upper and lowercase letters, hyphens, and underscores" required autocomplete="username"><br>
+    <label for="password">Password</label><br>
+    <input type="password" id="password" name="password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
+    <label for="password2">Confirm Password</label><br>
+    <input type="password" id="password2" name="password2" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
+    <input type="submit" value="Sign up">
+  </form>
+  <p>After you sign up, a moderator will need to confirm your account before you will be allowed to post.</p>
+</div>

views/user/user.etlua

@@ -0,0 +1,73 @@
+<% if infobox then %>
+  <% render("views.common.infobox", pop_infobox) %>
+<% end %>
+<div class="darkbg">
+  <h1 class="thread-title">Latest posts by <i><%= user.username %></i></h1>
+  <div>
+  User permission: <i><%= PermissionLevelString[user.permission] %></i>
+  </div>
+  <% if user_is_me then -%>
+  <div class="user-actions">
+    <a class="linkbutton" href="<%= url_for("user_settings", {username = user.username}) %>">Settings</a>
+    <form method="post" action="<%= url_for("user_logout", {user_id = me.id}) %>">
+      <input class="warn" type="submit" value="Log out">
+    </form>
+  </div>
+  <% end %>
+</div>
+<% --[[ duplicating code, maybe i'll refactor the post subview later to work anywhere <clown emoji>]] %>
+<% for i, post in ipairs(latest_posts) do %>
+  <div class="user-posts">
+    <div class="user-page-usercard">
+      <img class="avatar" src="<%= avatar_url(user) %>">
+      <b class="big"><%= user.username %></b>
+      <em class="user-status"><%= user.status %></em>
+    </div>
+    <div class="user-posts-container">
+      <div class="post-info">
+        <div><a href="<%= url_for("thread", {slug = post.thread_slug}, {after = post.id}) .. "#post-" .. post.id %>" title="Permalink"><i>
+        <% if tonumber(post.edited_at) > tonumber(post.created_at) then -%>
+            Edited in <%= post.thread_title %> at <%= os.date("%c", post.edited_at) %>
+          <% else -%>
+            Posted in <%= post.thread_title %> at <%= os.date("%c", post.created_at) %>
+          <% end -%>
+      </i></a></div>
+      </div>
+      <div class="post-content">
+        <%- post.content %>
+      </div>
+    </div>
+  </div>
+<% end %>
+
+<% if user:is_guest() and user_is_me then %>
+  <h2>You are a guest. A Moderator needs to approve your account before you will be able to post.</h2>
+<% end %>
+
+<% if me:is_mod() and not user:is_system() then %>
+  <div class="darkbg">
+    <h1>Moderator controls</h2>
+    <% if user:is_guest() then %>
+      <p>This user is a guest. They signed up on <%= os.date("%c", user.created_at) %>.</p>
+      <form class="modform" method="post" action="<%= url_for("confirm_user", {user_id = user.id}) %>">
+        <input type="submit" value="Confirm user">
+      </form>
+    <% else %> <% --[[ user is not guest ]] %>
+      <p>This user signed up on <%= os.date("%c", user.created_at) %> and was confirmed on <%= os.date("%c", user.confirmed_on) %>.</p>
+      <% if user.permission < me.permission then %>
+      <form class="modform" method="post" action="<%= url_for("guest_user", {user_id = user.id}) %>">
+        <input class="warn" type="submit" value="Demote user to guest (soft ban)">
+      </form>
+      <% end %>
+      <% if me:is_admin() and not user:is_mod() then %>
+        <form class="modform" method="post" action="<%= url_for("mod_user", {user_id = user.id}) %>">
+          <input class="warn" type="submit" value="Promote user to moderator">
+        </form>
+      <% elseif user:is_mod() and user.permission < me.permission then %>
+        <form class="modform" method="post" action="<%= url_for("demod_user", {user_id = user.id}) %>">
+          <input class="critical" type="submit" value="Demote user to regular user">
+        </form>
+      <% end %>
+    <% end %>
+  </div>
+<% end %>