rewrite topics routes to include id

.dockerignore

@@ -4,5 +4,7 @@
 data/db/*
 data/static/avatars/*
 !data/static/avatars/default.webp
+data/static/badges/user
+data/_cached
 
 .local/

.gitignore

@@ -4,7 +4,10 @@
 data/db/*
 data/static/avatars/*
 !data/static/avatars/default.webp
+data/static/badges/user
+data/_cached
 
 config/secrets.prod.env
+config/pyrom_config.toml
 
 .local/

README.md

@@ -1,18 +1,70 @@
 # Pyrom
-python/flask port of [porom](https://git.poto.cafe/yagich/porom)
+pyrom is a playful home-grown forum software for the indie web borne out of frustration with social media and modern forums imitating it.
 
-this is now the canonical implementation of porom. it's compatible with the database of porom.
+the aim is not to recreate the feeling of forums from any time period. rather, it aims to serve as a lightweight alternative to other forum software packages. pyrom is lean and "fire-and-forget"; there is little necessary configuration, making it a great fit for smaller communities (though nothing prevents it from being used in larger ones.)
 
-# License
+a live example can be seen in action over at [Porom](https://forum.poto.cafe/).
-Released under [CNPLv7+](https://thufie.lain.haus/NPL.html).
+
-Please read the [full terms](./LICENSE.md) for proper wording.
+## stack & structure
+on the server side, pyrom is built in Python using the Flask framework. content is rendered mostly server-side with Jinja templates. the database used is SQLite.
+
+on the client side, JS with only one library ([Bitty](https://bitty-js.com)) is used. for CSS, pyrom uses Sass.
+
+below is an explanation of the folder structure:
+
+- `/`
+  - `app/`
+    - `lib/` - utility libraries
+    - `routes/` - each `.py` file represents a "sub-app", usually the first part of the URL
+    - `templates/` - Jinja templates used by the routes. each subfolder corresponds to the "sub-app" that uses that template.
+    - `__init__.py` - creates the app
+    - `auth.py` - authentication helper
+    - `constants.py` - constant values used throughout the forum
+    - `db.py` - database abstraction layer and ORM library
+    - `migrations.py` - database migrations
+    - `models.py` - ORM model definitions
+    - `run.py` - runner script for development
+    - `schema.py` - database schema definition
+  - `config/` - configuration for the forum
+  - `data/`
+    - `_cached/` - cached versions of certain endpoints are stored here
+    - `db/` - the SQLite database is stored here
+    - `static/` - static files
+      - `avatars/` - user avatar uploads
+      - `badges/` - user badge uploads
+      - `css/` - CSS files generated from Sass sources
+      - `emoji/` - emoji images used on the forum
+      - `fonts/`
+      - `js/`
+  - `sass/`
+    - `_default.scss` - the default theme. Sass variables that other themes modify are defined here, along with the default styles. other files define the available themes.
+  - `build-themes.sh` - script for building Sass files into CSS
+  - `nginx.conf` - nginx config (production only)
+  - `uwsgi.ini` - uwsgi config (production only)
+
+# license
+released under [CNPLv7+](https://thufie.lain.haus/NPL.html).
+please read the [full terms](./LICENSE.md) for proper wording.
+
+# acknowledgments
+
+pyrom uses many open-source and otherwise free-culture components. see the [THIRDPARTY](./THIRDPARTY.md) file for full credit.
 
 # installing & first time setup
 ## docker (production)
-create `config/secrets.prod.env` according to `config/secrets.prod.env.example`
+1. clone the repo
+2. create `config/secrets.prod.env` according to `config/secrets.prod.env.example`
+3. create `config/pyrom_config.toml` according to `config/pyrom_config.toml.example` and modify as needed
+4. make sure the `data/` folder is writable by the app:
 
 ```bash
-$ docker compose up
+$ chmod -R 777 data/
+```
+
+5. bring up the container:
+
+```bash
+$ docker compose up --build
 ```
 
 - opens port 8080
@@ -20,10 +72,10 @@ $ docker compose up
 
 make sure to run it in an interactive session the first time, because it will spit out the password to the auto-created admin account.
 
-alternatively, if you already had porom running before, put the db file (`db.prod.sqlite`) in `data/db` and it will Just Work.
+6. point your favorite proxy at `localhost:8080`
 
 ## manual (development)
-1. install python >= 3.11, sqlite3, libargon2, and imagemagick & clone repo
+1. install python >= 3.13, sqlite3, libargon2, and imagemagick & clone repo
 2. create a venv:
 
 ```bash
@@ -59,6 +111,3 @@ $ source .venv/bin/activate
 $ python -m app.run
 ```
 
-# acknowledgments
-
-pyrom uses many open-source and otherwise free-culture components. see the [THIRDPARTY](./THIRDPARTY.md) file for full credit.

THIRDPARTY.md

@@ -30,13 +30,6 @@ Copyright: Copyright 2020-2024 The Atkinson Hyperlegible Mono Project Authors (h
 License: SIL Open Font License 1.1  
 Designers: Elliott Scott, Megan Eiswerth, Braille Institute, Applied Design Works, Letters From Sweden
 
-## ICONCINO
-
-Affected files: [`app/templates/common/icons.html`](./app/templates/common/icons.html)  
-URL: https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license  
-Designers: Gabriele Malaspina  
-License: CC0 1.0
-
 ## Forumoji
 
 Affected files: everything in [`data/static/emoji`](./data/static/emoji) except [`data/static/emoji/scissors.png`](data/static/emoji/scissors.png)  
@@ -80,8 +73,33 @@ Repo: https://github.com/emcconville/wand
 
 ## Bitty
 
-Affected files: [`data/static/js/vnd/bitty-6.0.0-rc3.min.js`](./data/static/js/vnd/bitty-6.0.0-rc3.min.js)  
+Affected files: [`data/static/js/vnd/bitty-7.0.0.js`](./data/static/js/vnd/bitty-7.0.0.js)  
-URL: https://bitty.alanwsmith.com/  
+URL: https://bitty-js.com/  
 License: CC0 1.0  
 Author: alan w smith https://www.alanwsmith.com/  
 Repo: https://github.com/alanwsmith/bitty  
+
+## Flask-Caching
+
+URL: https://flask-caching.readthedocs.io/  
+Copyright:
+
+```
+Copyright (c) 2010 by Thadeus Burgess.
+Copyright (c) 2016 by Peter Justin.
+
+Some rights reserved.
+```
+
+License: BSD-3-Clause ([see more](https://github.com/pallets-eco/flask-caching/blob/e59bc040cd47cd2b43e501d636d43d442c50b3ff/LICENSE))  
+Repo: https://github.com/pallets-eco/flask-caching
+
+# Legacy
+
+this section lists credits for files/libraries that are no longer used by the project.
+
+## ICONCINO
+
+URL: https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license  
+Designers: Gabriele Malaspina  
+License: CC0 1.0

app/__init__.py

@@ -1,59 +1,74 @@
-from flask import Flask, session, request, render_template
+from flask import Flask, session, request, render_template, redirect, url_for
 from dotenv import load_dotenv
-from .models import Avatars, Users, PostHistory, Posts, MOTD
+from .models import Avatars, Users, PostHistory, Posts, MOTD, BadgeUploads, Sessions
-from .auth import digest
+from .auth import digest, is_logged_in, get_active_user
-from .routes.users import is_logged_in, get_active_user, get_prefers_theme
-from .routes.threads import get_post_url
 from .constants import (
     PermissionLevel, permission_level_string,
     InfoboxKind, InfoboxHTMLClass,
     REACTION_EMOJI, MOTD_BANNED_TAGS,
     SIG_BANNED_TAGS, STRICT_BANNED_TAGS,
     )
-from .lib.babycode import babycode_to_html, EMOJI, BABYCODE_VERSION
+from .lib.babycode import babycode_to_html, babycode_to_rssxml, EMOJI, BABYCODE_VERSION
-from datetime import datetime
+from .lib.exceptions import SiteNameMissingException
+from .util import get_post_url, dict_to_query_string, csrf_input, get_csrf_token
+from datetime import datetime, timezone
+from flask_caching import Cache
 import os
 import time
 import secrets
+import hmac
 import tomllib
+import json
 
 def create_default_avatar():
     if Avatars.count() == 0:
-        print("Creating default avatar reference")
+        print('Creating default avatar reference')
         Avatars.create({
-            "file_path": "/static/avatars/default.webp",
+            'file_path': '/static/avatars/default.webp',
-            "uploaded_at": int(time.time())
+            'uploaded_at': int(time.time())
             })
 
 def create_admin():
-    username = "admin"
+    username = 'admin'
-    if Users.count({"username": username}) == 0:
+    if Users.count({'username': username}) == 0:
-        print("!!!!!Creating admin account!!!!!")
+        print('!!!!!Creating admin account!!!!!')
         password_length = 16
         password = secrets.token_urlsafe(password_length)
         hashed = digest(password)
         Users.create({
-            "username": username,
+            'username': username,
-            "password_hash": hashed,
+            'password_hash': hashed,
-            "permission": PermissionLevel.ADMIN.value,
+            'permission': PermissionLevel.ADMIN.value,
         })
         print(f"!!!!!Administrator account created, use '{username}' as the login and '{password}' as the password. This will only be shown once!!!!!")
 
 def create_deleted_user():
-    username = "DeletedUser"
+    username = 'DeletedUser'
-    if Users.count({"username": username.lower()}) == 0:
+    if Users.count({'username': username.lower()}) == 0:
-        print("Creating DeletedUser")
+        print('Creating DeletedUser')
         Users.create({
-            "username": username.lower(),
+            'username': username.lower(),
-            "display_name": username,
+            'display_name': username,
-            "password_hash": "",
+            'password_hash': '',
-            "permission": PermissionLevel.SYSTEM.value,
+            'permission': PermissionLevel.SYSTEM.value,
         })
 
 def reparse_babycode():
     print('Re-parsing babycode, this may take a while...')
     from .db import db
     from .constants import MOTD_BANNED_TAGS
+
+    post_histories_without_rss = PostHistory.findall([
+        ('markup_language', '=', 'babycode'),
+        ('content_rss', 'IS', None),
+    ])
+
+    with db.transaction():
+        for ph in post_histories_without_rss:
+            ph.update({
+                'content_rss': babycode_to_rssxml(ph['original_markup']),
+            })
+
     post_histories = PostHistory.findall([
         ('markup_language', '=', 'babycode'),
         ('format_version', 'IS NOT', BABYCODE_VERSION)
@@ -64,6 +79,7 @@ def reparse_babycode():
             for ph in post_histories:
                 ph.update({
                     'content': babycode_to_html(ph['original_markup']).result,
+                    'content_rss': babycode_to_rssxml(ph['original_markup']),
                     'format_version': BABYCODE_VERSION,
                     })
         print('Re-parsing posts done.')
@@ -99,35 +115,102 @@ def reparse_babycode():
 
     print('Re-parsing done.')
 
+def bind_default_badges(path):
+    from .db import db
+    with db.transaction():
+        potential_stales = BadgeUploads.get_default()
+        d = os.listdir(path)
+        for bu in potential_stales:
+            if os.path.basename(bu.file_path) not in d:
+                print(f'Deleted stale default badge{os.path.basename(bu.file_path)}')
+                bu.delete()
+
+        for f in d:
+            real_path = os.path.join(path, f)
+            if not os.path.isfile(real_path):
+                continue
+            if not f.endswith('.webp'):
+                continue
+            proxied_path = f'/static/badges/{f}'
+            bu = BadgeUploads.find({'file_path': proxied_path})
+            if not bu:
+                BadgeUploads.create({
+                    'file_path': proxied_path,
+                    'uploaded_at': int(os.path.getmtime(real_path)),
+                })
+
+def clear_stale_sessions():
+    from .db import db
+    with db.transaction():
+        now = int(time.time())
+        stale_sessions = Sessions.findall([
+            ('expires_at', '<', now)
+        ])
+        for sess in stale_sessions:
+            sess.delete()
+
+
+cache = Cache()
+
 def create_app():
     app = Flask(__name__)
-    app.config.from_file('../config/pyrom_config.toml', load=tomllib.load, text=False)
+    app.config['SITE_NAME'] = 'Pyrom'
+    app.config['DISABLE_SIGNUP'] = False
+    app.config['MODS_CAN_INVITE'] = True
+    app.config['USERS_CAN_INVITE'] = False
+    app.config['ADMIN_CONTACT_INFO'] = ''
+    app.config['GUIDE_DESCRIPTION'] = ''
 
-    if os.getenv("PYROM_PROD") is None:
+    app.config['CACHE_TYPE'] = 'FileSystemCache'
-        app.static_folder = os.path.join(os.path.dirname(__file__), "../data/static")
+    app.config['CACHE_DEFAULT_TIMEOUT'] = 300
+
+    try:
+        app.config.from_file('../config/pyrom_config.toml', load=tomllib.load, text=False)
+    except FileNotFoundError:
+        print('No configuration file found, leaving defaults.')
+
+    if os.getenv('PYROM_PROD') is None:
+        app.static_folder = os.path.join(os.path.dirname(__file__), '../data/static')
         app.debug = True
-        app.config["DB_PATH"] = "data/db/db.dev.sqlite"
+        app.config['DB_PATH'] = 'data/db/db.dev.sqlite'
+        app.config['SERVER_NAME'] = 'localhost:8080'
         load_dotenv()
     else:
-        app.config["DB_PATH"] = "data/db/db.prod.sqlite"
+        app.config['DB_PATH'] = 'data/db/db.prod.sqlite'
+        if not app.config['SERVER_NAME']:
+            raise SiteNameMissingException()
 
-    app.config["SECRET_KEY"] = os.getenv("FLASK_SECRET_KEY")
+    app.config['SECRET_KEY'] = os.getenv('FLASK_SECRET_KEY')
 
     app.config['AVATAR_UPLOAD_PATH'] = 'data/static/avatars/'
-    app.config['MAX_CONTENT_LENGTH'] = 1000 * 1000
+    app.config['BADGES_PATH'] = 'data/static/badges/'
+    app.config['BADGES_UPLOAD_PATH'] = 'data/static/badges/user/'
+    app.config['MAX_CONTENT_LENGTH'] = 3 * 1000 * 1000 # 3M total, subject to further limits per route
 
-    os.makedirs(os.path.dirname(app.config["DB_PATH"]), exist_ok = True)
+    os.makedirs(os.path.dirname(app.config['DB_PATH']), exist_ok = True)
+    os.makedirs(os.path.dirname(app.config['BADGES_UPLOAD_PATH']), exist_ok = True)
 
-    css_dir = 'data/static/css/'
+    if app.config['CACHE_TYPE'] == 'FileSystemCache':
-    allowed_themes = []
+        cache_dir = app.config.get('CACHE_DIR', 'data/_cached')
-    for f in os.listdir(css_dir):
+        os.makedirs(cache_dir, exist_ok = True)
-        if not os.path.isfile(os.path.join(css_dir, f)):
+        app.config['CACHE_DIR'] = cache_dir
-            continue
-        theme_name = os.path.splitext(os.path.basename(f))[0]
-        allowed_themes.append(theme_name)
 
-    allowed_themes.sort(key=(lambda x: (x != 'style', x)))
+    cache.init_app(app)
-    app.config['allowed_themes'] = allowed_themes
+
+    from app.routes.app import bp as app_bp
+    from app.routes.topics import bp as topics_bp
+    from app.routes.threads import bp as threads_bp
+    from app.routes.users import bp as users_bp
+    from app.routes.guides import bp as guides_bp
+    from app.routes.mod import bp as mod_bp
+    from app.routes.posts import bp as posts_bp
+    app.register_blueprint(app_bp)
+    app.register_blueprint(topics_bp)
+    app.register_blueprint(threads_bp)
+    app.register_blueprint(users_bp)
+    app.register_blueprint(guides_bp)
+    app.register_blueprint(mod_bp)
+    app.register_blueprint(posts_bp)
 
     with app.app_context():
         from .schema import create as create_tables
@@ -139,94 +222,94 @@ def create_app():
         create_admin()
         create_deleted_user()
 
+        clear_stale_sessions()
+
         reparse_babycode()
 
-    from app.routes.app import bp as app_bp
+        bind_default_badges(app.config['BADGES_PATH'])
-    from app.routes.topics import bp as topics_bp
-    from app.routes.threads import bp as threads_bp
-    from app.routes.users import bp as users_bp
-    from app.routes.mod import bp as mod_bp
-    from app.routes.api import bp as api_bp
-    from app.routes.posts import bp as posts_bp
-    from app.routes.hyperapi import bp as hyperapi_bp
-    from app.routes.guides import bp as guides_bp
-    app.register_blueprint(app_bp)
-    app.register_blueprint(topics_bp)
-    app.register_blueprint(threads_bp)
-    app.register_blueprint(users_bp)
-    app.register_blueprint(mod_bp)
-    app.register_blueprint(api_bp)
-    app.register_blueprint(posts_bp)
-    app.register_blueprint(hyperapi_bp)
-    app.register_blueprint(guides_bp)
 
     app.config['SESSION_COOKIE_SECURE'] = True
 
     @app.before_request
-    def make_session_permanent():
+    def revoke_session():
-        session.permanent = True
+        if is_logged_in():
+            sess = Sessions.find({'key': session['pyrom_session_key']})
+            if int(time.time()) > int(sess.expires_at):
+                sess.delete()
+                session.clear()
+                return redirect(url_for('topics.all_topics'))
 
-    commit = ""
+    @app.before_request
+    def generate_csrf_token():
+        if is_logged_in() and not session.get('csrf'):
+            rng = secrets.token_bytes(32)
+            session_key = session['pyrom_session_key']
+            message = f'd${len(session_key)}${session_key}@{len(rng)}@{rng.hex()}'
+            hashed = hmac.digest(app.config['SECRET_KEY'].encode('utf-8'), message.encode('utf-8'), 'SHA256')
+            csrf_token = f'{hashed.hex()}.{rng.hex()}'
+
+            session['csrf'] = csrf_token
+
+    commit = ''
     with open('.git/refs/heads/main') as f:
         commit = f.read().strip()
 
     @app.context_processor
     def inject_constants():
         return {
-            "InfoboxHTMLClass": InfoboxHTMLClass,
+            'InfoboxHTMLClass': InfoboxHTMLClass,
-            "InfoboxKind": InfoboxKind,
+            'InfoboxKind': InfoboxKind,
-            "PermissionLevel": PermissionLevel,
+            'PermissionLevel': PermissionLevel,
-            "__commit": commit,
+            '__commit': commit,
-            "__emoji": EMOJI,
+            '__emoji': EMOJI,
-            "REACTION_EMOJI": REACTION_EMOJI,
+            'REACTION_EMOJI': REACTION_EMOJI,
-            "MOTD_BANNED_TAGS": MOTD_BANNED_TAGS,
+            'MOTD_BANNED_TAGS': MOTD_BANNED_TAGS,
-            "SIG_BANNED_TAGS": SIG_BANNED_TAGS,
+            'SIG_BANNED_TAGS': SIG_BANNED_TAGS,
         }
 
-    @app.context_processor
-    def inject_auth():
-        return {"is_logged_in": is_logged_in, "get_active_user": get_active_user, "active_user": get_active_user()}
-
     @app.context_processor
     def inject_funcs():
         return {
-            'get_post_url': get_post_url,
-            'get_prefers_theme': get_prefers_theme,
             'get_motds': MOTD.get_all,
+            'get_time_now': lambda: int(time.time()),
+            'is_logged_in': is_logged_in,
+            'is_mod': lambda: is_logged_in() and get_active_user().is_mod(),
+            'get_active_user': get_active_user,
+            'get_post_url': get_post_url,
+            'csrf_input': csrf_input,
+            'get_csrf_token': get_csrf_token,
         }
 
-    @app.template_filter("ts_datetime")
+    @app.template_filter('ts_datetime')
     def ts_datetime(ts, format):
         return datetime.utcfromtimestamp(ts or int(time.time())).strftime(format)
 
-    @app.template_filter("pluralize")
+    @app.template_filter('dict_to_query_string')
-    def pluralize(subject, num=1, singular = "", plural = "s"):
+    def d2q(d):
+        return dict_to_query_string(d)
+
+    @app.template_filter('pluralize')
+    def pluralize(subject, num=1, singular = '', plural = 's'):
         if int(num) == 1:
             return subject + singular
 
         return subject + plural
 
-    @app.template_filter("permission_string")
+    @app.template_filter('permission_string')
     def permission_string(term):
         return permission_level_string(term)
 
     @app.template_filter('babycode')
-    def babycode_filter(markup):
+    def babycode_filter(markup, nofrag=False):
-        return babycode_to_html(markup).result
+        return babycode_to_html(markup, fragment=not nofrag).result
 
     @app.template_filter('babycode_strict')
-    def babycode_strict_filter(markup):
+    def babycode_strict_filter(markup, nofrag=False):
-        return babycode_to_html(markup, STRICT_BANNED_TAGS).result
+        return babycode_to_html(markup, banned_tags=STRICT_BANNED_TAGS, fragment=not nofrag).result
 
-    @app.template_filter('extract_h2')
+    @app.template_filter('basename_noext')
-    def extract_h2(content):
+    def basename_noext(subj):
-        import re
+        return os.path.splitext(os.path.basename(subj))[0]
-        pattern = r'<h2\s+id="([^"]+)"[^>]*>(.*?)<\/h2>'
-        matches = re.findall(pattern, content, re.IGNORECASE | re.DOTALL)
-        return [
-            {'id': id_.strip(), 'text': text.strip()}
-            for id_, text in matches
-        ]
 
     @app.errorhandler(404)
     def _handle_404(e):
@@ -236,19 +319,36 @@ def create_app():
             return {'error': 'not found'}, e.code
         else:
             return render_template('common/404.html'), e.code
+    #
+    # @app.errorhandler(413)
+    # def _handle_413(e):
+    #     if request.path.startswith('/hyperapi/'):
+    #         return '<h1>request body too large</h1>', e.code
+    #     elif request.path.startswith('/api/'):
+    #         return {'error': 'body too large'}, e.code
+    #     else:
+    #         return render_template('common/413.html'), e.code
 
     # this only happens at build time but
     # build time is when updates are done anyway
     # sooo... /shrug
     @app.template_filter('cachebust')
     def cachebust(subject):
-        return f"{subject}?v={str(int(time.time()))}"
+        return f'{subject}?v={str(int(time.time()))}'
 
     @app.template_filter('theme_name')
     def get_theme_name(subject: str):
         if subject == 'style':
             return 'Default'
 
-        return f'{subject.removeprefix('theme-').capitalize()} (beta)'
+        return f'{subject.removeprefix('theme-').replace('-', ' ').capitalize()} (beta)'
+
+    @app.template_filter('fromjson')
+    def fromjson(subject: str):
+        return json.loads(subject)
+
+    @app.template_filter('iso8601')
+    def unix_to_iso8601(subject: str):
+        return datetime.fromtimestamp(int(subject), timezone.utc).isoformat()
 
     return app

app/auth.py

@@ -1,7 +1,25 @@
+from flask import session, flash, redirect, url_for, abort, request, current_app
+from .models import Sessions, Users
 from argon2 import PasswordHasher
+from functools import wraps
+import secrets
+import hmac
+import time
+import re
 
 ph = PasswordHasher()
 
+FORBIDDEN_USERNAMES = (
+    'administrator', 'administration', 'administrators',
+    'system',
+    'mod', 'moderator', 'moderators', 'moderation',
+    'deleted-user', 'deleted_user',
+    'support',
+    #routes
+    'log-in', 'log_in', 'login',
+    'sign-up', 'sign_up', 'signup',
+)
+
 def digest(password):
     return ph.hash(password)
 
@@ -10,3 +28,97 @@ def verify(expected, given):
         return ph.verify(expected, given)
     except:
         return False
+
+def is_logged_in() -> bool:
+    if 'pyrom_session_key' not in session:
+        return False
+    sess = Sessions.find({'key': session['pyrom_session_key']})
+    if not sess:
+        return False
+    if sess.expires_at < int(time.time()):
+        session.clear()
+        sess.delete()
+        # flash('Your session expired.;Please log in again.', InfoboxKind.INFO)
+        return False
+    return True
+
+def get_active_user() -> Users | None:
+    if not is_logged_in():
+        return None
+
+    sess = Sessions.find({'key': session['pyrom_session_key']})
+    return Users.find({'id': sess.user_id})
+
+def create_session(user_id, temporary=False):
+    expires_days = 2 if temporary else 31
+    return Sessions.create({
+        'key': secrets.token_hex(16),
+        'user_id': user_id,
+        'expires_at': int(time.time()) + (expires_days * 24 * 60 * 60),
+    })
+
+def parse_username(username: str) -> Tuple[str, str]:
+    """first is the unmodified name/display name, second is username"""
+    if len(username) < 3:
+        raise ValueError
+
+    if username.lower() in FORBIDDEN_USERNAMES:
+        raise ValueError
+
+    invalid_regex = r'[^a-zA-Z0-9_-]'
+    return re.sub(invalid_regex, '_', username.lower())[:24], username
+
+def is_password_valid(password: str) -> bool:
+    return re.match(r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,255}$', password) is not None
+
+# annotations
+def login_required(view_func):
+    @wraps(view_func)
+    def wrapper(*args, **kwargs):
+        if not is_logged_in():
+            return redirect(url_for('users.log_in'))
+        return view_func(*args, **kwargs)
+    return wrapper
+
+def mod_only(view_func):
+    @wraps(view_func)
+    def wrapper(*args, **kwargs):
+        if not is_logged_in():
+            abort(403)
+        if not get_active_user().is_mod():
+            abort(403)
+        return view_func(*args, **kwargs)
+    return wrapper
+
+def csrf_verified(view_func):
+    """
+    protects a request with a form against csrf and invalidates the csrf token stored in the session.
+
+    requires @login_requred.
+    """
+
+    @wraps(view_func)
+    def wrapper(*args, **kwargs):
+        if not session.get('csrf'):
+            abort(403)
+        if not request.form.get('csrf'):
+            abort(403)
+
+        parts = request.form['csrf'].split('.')
+        if len(parts) != 2:
+            abort(403)
+
+        given_message = parts[0]
+        rng = bytes.fromhex(parts[1])
+        session_key = session['pyrom_session_key']
+        message = f'd${len(session_key)}${session_key}@{len(rng)}@{rng.hex()}'
+        expected = hmac.digest(current_app.config['SECRET_KEY'].encode('utf-8'), message.encode('utf-8'), 'SHA256').hex()
+
+        if not hmac.compare_digest(given_message, expected):
+            abort(403)
+
+        session.pop('csrf')
+
+        return view_func(*args, **kwargs)
+    return wrapper
+

app/constants.py

@@ -70,8 +70,8 @@ class InfoboxKind(IntEnum):
     ERROR = 3
 
 InfoboxHTMLClass = {
-    InfoboxKind.INFO: "",
+    InfoboxKind.INFO: '',
-    InfoboxKind.LOCK: "warn",
+    InfoboxKind.LOCK: 'warn',
-    InfoboxKind.WARN: "warn",
+    InfoboxKind.WARN: 'warn',
-    InfoboxKind.ERROR: "critical",
+    InfoboxKind.ERROR: 'critical',
 }

app/db.py

@@ -31,6 +31,7 @@ class DB:
         except Exception as e:
             if in_transaction and self._connection:
                 conn.rollback()
+            raise
         finally:
             if in_transaction:
                 self._transaction_depth -= 1
@@ -126,7 +127,7 @@ class DB:
         def where(self, condition, operator = "="):
             if isinstance(condition, dict):
                 for key, value in condition.items():
-                    self._where.append((key, "=", value))
+                    self._where.append((key, operator, value))
             elif isinstance(condition, list):
                 for c in condition:
                     self._where.append(c)

app/lib/babycode.py

@@ -6,17 +6,203 @@ from pygments.lexers import get_lexer_by_name
 from pygments.util import ClassNotFound as PygmentsClassNotFound
 import re
 
-class BabycodeParseResult:
+BABYCODE_VERSION = 10
+
+
+class BabycodeError(Exception):
+    pass
+
+
+class BabycodeRenderError(BabycodeError):
+    pass
+
+
+class UnknownASTElementError(BabycodeRenderError):
+    def __init__(self, element_type, element=None):
+        self.element_type = element_type
+        self.element = element
+
+        message = f'Unknown AST element: {element_type}'
+        if element:
+            message += f' (element: {element})'
+        super().__init__(message)
+
+
+class BabycodeRenderResult:
     def __init__(self, result, mentions=[]):
         self.result = result
         self.mentions = mentions
 
-
     def __str__(self):
         return self.result
 
 
-BABYCODE_VERSION = 5
+class BabycodeRenderer:
+    def __init__(self, tag_map, void_tag_map, emote_map, fragment=False):
+        self.tag_map = tag_map
+        self.void_tag_map = void_tag_map
+        self.emote_map = emote_map
+        self.fragment = fragment
+
+    def make_mention(self, element):
+        raise NotImplementedError
+
+    def transform_para_whitespace(self, text):
+        # markdown rules:
+        # two spaces at end of line -> <br>
+        text = re.sub(r'  +\n', '<br>', text)
+        # single newlines -> space (collapsed)
+        text = re.sub(r'\n', ' ', text)
+        return text
+
+    def wrap_in_paragraphs(self, nodes, context_is_block=True, is_root=False):
+        result = []
+        current_paragraph = []
+        is_first_para = is_root and self.fragment
+
+        def flush_paragraph():
+            # TIL nonlocal exists
+            nonlocal result, current_paragraph, is_first_para
+            if not current_paragraph:
+                return
+
+            para_content = ''.join(current_paragraph)
+            if para_content.strip(): # skip empty paragraphs
+                if is_first_para:
+                    result.append(para_content)
+                    is_first_para = False
+                else:
+                    result.append(f"<p>{para_content}</p>")
+            current_paragraph.clear()
+
+        for node in nodes:
+            if isinstance(node, str):
+                paras = re.split(r'\n\n+', node)
+                for i, para in enumerate(paras):
+                    if i > 0 and context_is_block:
+                        flush_paragraph()
+
+                    if para:
+                        processed = self.transform_para_whitespace(para)
+                        current_paragraph.append(processed)
+            else:
+                inline = is_inline(node)
+
+                if inline and context_is_block:
+                    # inline child within a paragraph context
+                    current_paragraph.append(self.fold(node))
+                elif not inline and context_is_block:
+                    # block child within a block context
+                    flush_paragraph()
+                    if is_root:
+                        # this is relevant for fragment.
+                        # fragment only applies to the first inline node(s).
+                        # if the first element is a block, reset "fragment mode".
+                        is_first_para = False
+                    result.append(self.fold(node))
+                else:
+                    # either inline in inline context, or block in inline context
+                    current_paragraph.append(self.fold(node))
+
+        if context_is_block:
+            # flush final para if we're in a block context
+            flush_paragraph()
+        elif current_paragraph:
+            # inline context - just append whatever we collected
+            result.append(''.join(current_paragraph))
+
+        return ''.join(result)
+
+    def fold(self, element):
+        if isinstance(element, str):
+            return element
+
+        match element['type']:
+            case 'bbcode':
+                tag_name = element['name']
+
+                if is_inline(element):
+                    # inline tag
+                    # since its inline, all children should be processed inline
+                    content = "".join(self.fold(child) for child in element['children'])
+                    return self.tag_map[tag_name](content, element['attr'])
+                else:
+                    # block tag
+                    if tag_name in {'ul', 'ol', 'code', 'img'}:
+                        # these handle their own internal structure
+                        content = ''.join(
+                            child if isinstance(child, str) else self.fold(child)
+                            for child in element['children']
+                        )
+                        return self.tag_map[tag_name](content, element['attr'])
+                    else:
+                        # block elements that can contain paragraphs
+                        content = self.wrap_in_paragraphs(element['children'], context_is_block=True, is_root=False)
+                        return self.tag_map[tag_name](content, element['attr'])
+            case 'bbcode_void':
+                return self.void_tag_map[element['name']](element['attr'])
+            case 'link':
+                return f"<a href=\"{element['url']}\">{element['url']}</a>"
+            case 'emote':
+                return self.emote_map[element['name']]
+            case 'rule':
+                return '<hr>'
+            case 'mention':
+                return self.make_mention(element)
+            case _:
+                raise UnknownASTElementError(
+                    element_type=element['type'],
+                    element=element
+                )
+
+    def render(self, ast):
+        out = self.wrap_in_paragraphs(ast, context_is_block=True, is_root=True)
+        return out
+
+
+class HTMLRenderer(BabycodeRenderer):
+    def __init__(self, fragment=False):
+        super().__init__(TAGS, VOID_TAGS, EMOJI, fragment)
+
+        self.mentions = []
+
+    def make_mention(self, e):
+        from ..models import Users
+        from flask import url_for, current_app
+        with current_app.test_request_context('/'):
+            target_user = Users.find({'username': e['name'].lower()})
+            if not target_user:
+                return f"@{e['name']}"
+
+            mention_data = {
+                'mention_text': f"@{e['name']}",
+                'mentioned_user_id': int(target_user.id),
+                "start": e['start'],
+                "end": e['end'],
+            }
+            if mention_data not in self.mentions:
+                self.mentions.append(mention_data)
+
+            return f"<a class='mention{' display' if target_user.has_display_name() else ''}' href='{url_for('users.user_page', username=target_user.username)}' title='@{target_user.username}' data-init='highlightMentions' data-username='{target_user.username}'>{'@' if not target_user.has_display_name() else ''}{target_user.get_readable_name()}</a>"
+
+    def render(self, ast):
+        out = super().render(ast)
+        return BabycodeRenderResult(out, self.mentions)
+
+
+class RSSXMLRenderer(BabycodeRenderer):
+    def __init__(self, fragment=False):
+        super().__init__(RSS_TAGS, VOID_TAGS, RSS_EMOJI, fragment)
+
+    def make_mention(self, e):
+        from ..models import Users
+        from flask import url_for
+        target_user = Users.find({'username': e['name'].lower()})
+        if not target_user:
+            return f"@{e['name']}"
+
+        return f'<a href="{url_for('users.user_page', username=target_user.username, _external=True)}" title="@{target_user.username}">{'@' if not target_user.has_display_name() else ''}{target_user.get_readable_name()}</a>'
+
 
 NAMED_COLORS = [
     'black', 'silver', 'gray', 'white', 'maroon', 'red',
@@ -49,113 +235,10 @@ NAMED_COLORS = [
     'violet', 'wheat', 'white', 'whitesmoke', 'yellow', 'yellowgreen',
 ]
 
-def is_tag(e, tag=None):
-    if e is None:
-        return False
-    if isinstance(e, str):
-        return False
-    if e['type'] != 'bbcode':
-        return False
-
-    if tag is None:
-        return True
-
-    return e['name'] == tag
-
-def is_text(e):
-    return isinstance(e, str)
-
-def tag_code(children, attr, surrounding):
-    is_inline = children.find('\n') == -1
-    if is_inline:
-        return f"<code class=\"inline-code\">{children}</code>"
-    else:
-        input_code = children.strip()
-        button = f"<button type=button class=\"copy-code\" value=\"{input_code}\" data-send=\"copyCode\" data-receive=\"copyCode\">Copy</button>"
-        unhighlighted = f"<pre><span class=\"copy-code-container\"><span class=\"code-language-identifier\">code block</span>{button}</span><code>{input_code}</code></pre>"
-        if not attr:
-            return unhighlighted
-        try:
-            lexer = get_lexer_by_name(attr.strip())
-            formatter = HtmlFormatter(nowrap=True)
-            return f"<pre><span class=\"copy-code-container\"><span class=\"code-language-identifier\">{lexer.name}</span>{button}</span><code>{highlight(input_code.unescape(), lexer, formatter)}</code></pre>"
-        except PygmentsClassNotFound:
-            return unhighlighted
-
-def tag_list(children):
-    list_body = re.sub(r"  +\n", "<br>", children.strip())
-    list_body = re.sub(r"\n\n+", "\1", list_body)
-    return " ".join([f"<li>{x}</li>" for x in list_body.split("\1") if x])
-
-def tag_color(children, attr, surrounding):
-    if not attr:
-        return f"[color]{children}[/color]"
-
-    hex_re = r"^#?([0-9a-f]{6}|[0-9a-f]{3})$"
-    potential_color = attr.lower().strip()
-
-    if potential_color in NAMED_COLORS:
-        return f"<span style='color: {potential_color};'>{children}</span>"
-
-    m = re.match(hex_re, potential_color)
-    if m:
-        return f"<span style='color: #{m.group(1)};'>{children}</span>"
-
-    # return just the way it was if we can't parse it
-    return f"[color={attr}]{children}[/color]"
-
-def tag_spoiler(children, attr, surrounding):
-    spoiler_name = attr if attr else "Spoiler"
-    content = f"<div class='accordion-content post-accordion-content hidden'>{children}</div>"
-    container = f"""<div class='accordion hidden' data-receive='toggleAccordion'><div class='accordion-header'><button type='button' class='accordion-toggle' data-send='toggleAccordion'>+</button><span>{spoiler_name}</span></div>{content}</div>"""
-    return container
-
-def tag_image(children, attr, surrounding):
-    img = f"<img class=\"post-image\" src=\"{attr}\" alt=\"{children}\">"
-    if not is_tag(surrounding[0], 'img'):
-        img = f"<div class=post-img-container>{img}"
-    if not is_tag(surrounding[1], 'img'):
-        img = f"{img}</div>"
-    return img
-
-TAGS = {
-    "b": lambda children, attr, _: f"<strong>{children}</strong>",
-    "i": lambda children, attr, _: f"<em>{children}</em>",
-    "s": lambda children, attr, _: f"<del>{children}</del>",
-    "u": lambda children, attr, _: f"<u>{children}</u>",
-
-    "img": tag_image,
-    "url": lambda children, attr, _: f"<a href={attr}>{children}</a>",
-    "quote": lambda children, attr, _: f"<blockquote>{children}</blockquote>",
-    "code": tag_code,
-    "ul": lambda children, attr, _: f"<ul>{tag_list(children)}</ul>",
-    "ol": lambda children, attr, _: f"<ol>{tag_list(children)}</ol>",
-
-    "big": lambda children, attr, _: f"<span style='font-size: 2rem;'>{children}</span>",
-    "small": lambda children, attr, _: f"<span style='font-size: 0.75rem;'>{children}</span>",
-    "color": tag_color,
-
-    "center": lambda children, attr, _: f"<div style='text-align: center;'>{children}</div>",
-    "right": lambda children, attr, _: f"<div style='text-align: right;'>{children}</div>",
-
-    "spoiler": tag_spoiler,
-}
-
-VOID_TAGS = {
-    'lb': lambda attr: '[',
-    'rb': lambda attr: ']',
-    '@': lambda attr: '@',
-}
-
-# [img] is considered block for the purposes of collapsing whitespace,
-# despite being potentially inline (since the resulting <img> tag is inline, but creates a block container around itself and sibling images).
-# [code] has a special case in is_inline().
-INLINE_TAGS = {
-    'b', 'i', 's', 'u', 'color', 'big', 'small', 'url'
-}
 
 def make_emoji(name, code):
-    return f' <img class=emoji src="/static/emoji/{name}.png" alt="{name}" title=":{code}:">'
+    return f'<img class=emoji src="/static/emoji/{name}.png" alt="{name}" title=":{code}:">'
+
 
 EMOJI = {
     'angry': make_emoji('angry', 'angry'),
@@ -203,12 +286,218 @@ EMOJI = {
     'wink': make_emoji('wink', 'wink'),
 }
 
+
+RSS_EMOJI = {
+    **EMOJI,
+
+    'angry': '😡',
+
+    '(': '🙁',
+
+    'D': '😃',
+
+    'imp': '😈',
+
+    'angryimp': '👿',
+    'impangry': '👿',
+
+    'lobster': '🦞',
+
+    '|': '😐',
+
+    'pensive': '😔',
+
+    'scissors': '✂️',
+
+    ')': '🙂',
+
+    'smiletear': '🥲',
+    'crytear': '🥲',
+
+    ',': '😭',
+    'T': '😭',
+    'cry': '😭',
+    'sob': '😭',
+
+    'o': '😮',
+    'O': '😮',
+
+    'hmm': '🤔',
+    'think': '🤔',
+    'thinking': '🤔',
+
+    'P': '😛',
+    'p': '😛',
+
+    'weary': '😩',
+
+    ';': '😉',
+    'wink': '😉',
+}
+
+
 TEXT_ONLY = ["code"]
 
-def break_lines(text):
+
-    text = re.sub(r"  +\n", "<br>", text)
+def tag_code(children, attr):
-    text = re.sub(r"\n\n+", "<br><br>", text)
+    is_inline = children.find('\n') == -1
-    return text
+    if is_inline:
+        return f"<code class=\"inline-code\">{children}</code>"
+    else:
+        input_code = children.strip()
+        language = 'code block'
+        if attr:
+            try:
+                lexer = get_lexer_by_name(attr.strip())
+                formatter = HtmlFormatter(nowrap=True)
+                language = lexer.name
+                code = highlight(Markup(input_code).unescape(), lexer, formatter)
+            except PygmentsClassNotFound:
+                code = input_code
+        else:
+            code = input_code
+
+        button = f'<button type=button class="copy-code" data-s="copyCode">Copy</button>'
+        block = f'<fieldset data-r="copyCode" value="{input_code}" class="code-block-container plank minimal no-shadow secondary-bg"><legend>{language}</legend>{button}<pre><code>{code}</code></pre></fieldset>'
+        return block
+
+
+def tag_list(children):
+    list_body = re.sub(r"  +\n", "<br>", children.strip())
+    list_body = re.sub(r"\n\n+", "\1", list_body)
+    return " ".join([f"<li>{x}</li>" for x in list_body.split("\1") if x])
+
+
+def tag_color(children, attr):
+    if not attr:
+        return f"[color]{children}[/color]"
+
+    hex_re = r"^#?([0-9a-f]{6}|[0-9a-f]{3})$"
+    potential_color = attr.lower().strip()
+
+    if potential_color in NAMED_COLORS:
+        return f"<span style='color: {potential_color};'>{children}</span>"
+
+    m = re.match(hex_re, potential_color)
+    if m:
+        return f"<span style='color: #{m.group(1)};'>{children}</span>"
+
+    # return just the way it was if we can't parse it
+    return f"[color={attr}]{children}[/color]"
+
+
+def tag_spoiler(children, attr):
+    spoiler_name = attr if attr else "Spoiler"
+    content = f"<div class='plank minimal even no-shadow hidden'>{children}</div>"
+    container = f"""<details><summary class='plank secondary-bg no-shadow even'>{spoiler_name}</summary>{content}</details>"""
+    return container
+
+
+def tag_image(children, attr):
+    img = f"<img class=\"post-image\" src=\"{attr}\" alt=\"{children}\">"
+    return img
+
+
+def tag_quote(children, attr):
+    if attr:
+        quotee = f'Quoting: {attr.strip()}'
+    else:
+        quotee = 'Quote'
+
+    return f'<fieldset class="plank minimal no-shadow secondary-bg"><legend>{quotee}</legend><blockquote>{children}</blockquote></fieldset>'
+
+TAGS = {
+    "b": lambda children, attr: f"<strong>{children}</strong>",
+    "i": lambda children, attr: f"<em>{children}</em>",
+    "s": lambda children, attr: f"<del>{children}</del>",
+    "u": lambda children, attr: f"<u>{children}</u>",
+
+    "img": tag_image,
+    "url": lambda children, attr: f"<a href={attr}>{children}</a>",
+    "quote": tag_quote,
+    "code": tag_code,
+    "ul": lambda children, attr: f"<ul>{tag_list(children)}</ul>",
+    "ol": lambda children, attr: f"<ol>{tag_list(children)}</ol>",
+
+    "big": lambda children, attr: f"<span style='font-size: 2rem;'>{children}</span>",
+    "small": lambda children, attr: f"<span style='font-size: 0.75rem;'>{children}</span>",
+    "color": tag_color,
+
+    "center": lambda children, attr: f"<div style='text-align: center;'>{children}</div>",
+    "right": lambda children, attr: f"<div style='text-align: right;'>{children}</div>",
+
+    "spoiler": tag_spoiler,
+}
+
+
+def tag_code_rss(children, attr):
+    is_inline = children.find('\n') == -1
+    if is_inline:
+        return f'<code>{children}</code>'
+    else:
+        return f'<pre><code>{children}</code></pre>'
+
+
+def tag_url_rss(children, attr):
+    if attr.startswith('/'):
+        from flask import current_app
+        uri = f"{current_app.config['PREFERRED_URL_SCHEME']}://{current_app.config['SERVER_NAME']}{attr}"
+        return f"<a href={uri}>{children}</a>"
+
+    return f"<a href={attr}>{children}</a>"
+
+
+def tag_image_rss(children, attr):
+    if attr.startswith('/'):
+        from flask import current_app
+        uri = f"{current_app.config['PREFERRED_URL_SCHEME']}://{current_app.config['SERVER_NAME']}{attr}"
+        return f'<img src="{uri}" alt={children} />'
+
+    return f'<img src="{attr}" alt={children} />'
+
+
+RSS_TAGS = {
+    **TAGS,
+    'img': tag_image_rss,
+    'url': tag_url_rss,
+    'spoiler': lambda children, attr: f'<details><summary>{attr or "Spoiler"} (click to reveal)</summary>{children}</details>',
+    'code': tag_code_rss,
+
+    'big': lambda children, attr: f'<span style="font-size: 1.2em">{children}</span>',
+    'small': lambda children, attr: f'<small>{children}</small>'
+}
+
+
+VOID_TAGS = {
+    'lb': lambda attr: '[',
+    'rb': lambda attr: ']',
+    'at': lambda attr: '@',
+    'd': lambda attr: '-',
+}
+
+
+INLINE_TAGS = {
+    'b', 'i', 's', 'u', 'color', 'big', 'small', 'url', 'lb', 'rb', 'at', 'd', 'img'
+}
+
+
+def is_tag(e, tag=None):
+    if e is None:
+        return False
+    if isinstance(e, str):
+        return False
+    if e['type'] != 'bbcode' and e['type'] != 'bbcode_void':
+        return False
+
+    if tag is None:
+        return True
+
+    return e['name'] == tag
+
+
+def is_text(e):
+    return isinstance(e, str)
+
 
 def is_inline(e):
     if e is None:
@@ -219,29 +508,12 @@ def is_inline(e):
 
     if is_tag(e):
         if is_tag(e, 'code'): # special case, since [code] can be inline OR block
-            return '\n' not in e['children']
+            return '\n' not in e['children'][0]
 
         return e['name'] in INLINE_TAGS
 
     return e['type'] != 'rule'
 
-def make_mention(e, mentions):
-    from ..models import Users
-    from flask import url_for
-    target_user = Users.find({'username': e['name'].lower()})
-    if not target_user:
-        return f"@{e['name']}"
-
-    mention_data = {
-        'mention_text': f"@{e['name']}",
-        'mentioned_user_id': int(target_user.id),
-        "start": e['start'],
-        "end": e['end'],
-    }
-    if mention_data not in mentions:
-        mentions.append(mention_data)
-
-    return f"<a class='mention{' display' if target_user.has_display_name() else ''}' href='{url_for('users.page', username=target_user.username)}' title='@{target_user.username}' data-init='highlightMentions' data-username='{target_user.username}'>{'@' if not target_user.has_display_name() else ''}{target_user.get_readable_name()}</a>"
 
 def should_collapse(text, surrounding):
     if not isinstance(text, str):
@@ -255,10 +527,30 @@ def should_collapse(text, surrounding):
 
     return False
 
+
 def sanitize(s):
     return escape(s.strip().replace('\r\n', '\n').replace('\r', '\n'))
 
-def babycode_to_html(s, banned_tags=[]):
+
+def babycode_ast(s: str, banned_tags=[]):
+    """
+    transforms a string of babycode into an AST.
+    the AST is a list of strings or dicts.
+
+    a string element is plain unformatted text.
+
+    a dict element is a node that contains at least the key `type`.
+
+    possible types are:
+    - bbcode
+    - bbcode_void
+    - link
+    - emote
+    - rule
+    - mention
+
+    bbcode type elements have a children key that is a list of children of that node. the children are themselves elements (string or dict).
+    """
     allowed_tags = set(TAGS.keys())
     if banned_tags is not None:
         for tag in banned_tags:
@@ -281,44 +573,38 @@ def babycode_to_html(s, banned_tags=[]):
             )
         if not should_collapse(e, surrounding):
             elements.append(e)
+    return elements
 
-    out = ""
-    mentions = []
-    def fold(element, nobr, surrounding):
-        if isinstance(element, str):
-            if nobr:
-                return element
-            return break_lines(element)
 
-        match element['type']:
+def babycode_to_html(s: str, banned_tags=[], fragment=False) -> BabycodeRenderResult:
-            case "bbcode":
+    """
-                c = ""
+    transforms a string of babycode into html.
-                for i in range(len(element['children'])):
-                    child = element['children'][i]
-                    _surrounding = (
-                        element['children'][i - 1] if i-1 >= 0 else None,
-                        element['children'][i + 1] if i+1 < len(element['children']) else None
-                        )
-                    _nobr = element['name'] == "code" or element['name'] == "ul" or element['name'] == "ol"
-                    c = c + Markup(fold(child, _nobr, _surrounding))
-                res = TAGS[element['name']](c, element['attr'], surrounding)
-                return res
-            case "bbcode_void":
-                return VOID_TAGS[element['name']](element['attr'])
-            case "link":
-                return f"<a href=\"{element['url']}\">{element['url']}</a>"
-            case 'emote':
-                return EMOJI[element['name']]
-            case "rule":
-                return "<hr>"
-            case "mention":
-                return make_mention(element, mentions)
 
-    for i in range(len(elements)):
+    parameters:
-        e = elements[i]
+
-        surrounding = (
+        s (str) - babycode string
-            elements[i - 1] if i-1 >= 0 else None,
+
-            elements[i + 1] if i+1 < len(elements) else None
+        banned_tags (list) - babycode tags to exclude from being parsed. they will remain as plain text in the transformation.
-            )
+
-        out = out + fold(e, False, surrounding)
+        fragment (bool) - skip adding an html p tag to the first element if it is inline.
-    return BabycodeParseResult(out, mentions)
+    """
+    ast = babycode_ast(s, banned_tags)
+    r = HTMLRenderer(fragment=fragment)
+    return r.render(ast)
+
+
+def babycode_to_rssxml(s: str, banned_tags=[], fragment=False) -> str:
+    """
+    transforms a string of babycode into rss-compatible x/html.
+
+    parameters:
+
+        s (str) - babycode string
+
+        banned_tags (list) - babycode tags to exclude from being parsed. they will remain as plain text in the transformation.
+
+        fragment (bool) - skip adding an html p tag to the first element if it is inline.
+    """
+    ast = babycode_ast(s, banned_tags)
+    r = RSSXMLRenderer(fragment=fragment)
+    return r.render(ast)

app/lib/exceptions.py

@@ -0,0 +1,9 @@
+class MissingConfigurationException(Exception):
+    def __init__(self, configuration_field: str):
+        message = f"Missing configuration field '{configuration_field}'"
+        super().__init__(message)
+
+
+class SiteNameMissingException(MissingConfigurationException):
+    def __init__(self):
+        super().__init__('SITE_NAME')

app/lib/render_atom.py

@@ -0,0 +1,10 @@
+from flask import make_response, render_template, request
+
+def render_atom_template(template, *args, **kwargs):
+    injects = {
+        **kwargs,
+        '__current_page': request.url,
+    }
+    r = make_response(render_template(template, *args, **injects))
+    r.mimetype = 'application/xml'
+    return r

app/migrations.py

@@ -43,6 +43,7 @@ MIGRATIONS = [
     add_signature_format,
     create_default_bookmark_collections,
     add_display_name,
+    'ALTER TABLE "post_history" ADD COLUMN "content_rss" STRING DEFAULT NULL'
 ]
 
 def run_migrations():
@@ -52,11 +53,11 @@ def run_migrations():
         )
     """)
     if len(MIGRATIONS) == 0:
-        print("No migrations defined.")
+        print('No migrations defined.')
         return
-    print("Running migrations...")
+    print('Running migrations...')
     ran = 0
-    completed = {int(row["id"]) for row in db.query("SELECT id FROM _migrations")}
+    completed = {int(row['id']) for row in db.query('SELECT id FROM _migrations')}
     to_run = {idx: migration_obj for idx, migration_obj in enumerate(MIGRATIONS) if idx not in completed}
     if not to_run:
         print('No migrations need to run.')
@@ -73,4 +74,4 @@ def run_migrations():
 
             db.execute('INSERT INTO _migrations (id) VALUES (?)', migration_id)
             ran += 1
-    print(f"Ran {ran} migrations.")
+    print(f'Ran {ran} migrations.')

app/models.py

@@ -4,10 +4,10 @@ from flask import current_app
 import time
 
 class Users(Model):
-    table = "users"
+    table = 'users'
 
     def get_avatar_url(self):
-        return Avatars.find({"id": self.avatar_id}).file_path
+        return Avatars.find({'id': self.avatar_id}).file_path
 
     def is_default_avatar(self):
         return int(Avatars.find({'id': self.avatar_id}).id) == 1
@@ -30,23 +30,6 @@ class Users(Model):
     def is_default_avatar(self):
         return self.avatar_id == 1
 
-    def get_latest_posts(self):
-        q = """SELECT
-                posts.id, posts.created_at, post_history.content, post_history.edited_at, threads.title AS thread_title, topics.name as topic_name, threads.slug as thread_slug
-            FROM
-                posts
-            JOIN
-                post_history ON posts.current_revision_id = post_history.id
-            JOIN
-                threads ON posts.thread_id = threads.id
-            JOIN
-                topics ON threads.topic_id = topics.id
-            WHERE
-                posts.user_id = ?
-            ORDER BY posts.created_at DESC
-            LIMIT 10"""
-        return db.query(q, self.id)
-
     def get_post_stats(self):
         q = """SELECT
                 COUNT(DISTINCT posts.id) AS post_count,
@@ -116,93 +99,102 @@ class Users(Model):
     def has_display_name(self):
         return self.display_name != ''
 
+    def get_badges(self):
+        return Badges.findall({'user_id': int(self.id)})
+
 
 class Topics(Model):
-    table = "topics"
+    table = 'topics'
 
     @classmethod
     def get_list(_cls):
         q = """
             SELECT
                 topics.id, topics.name, topics.slug, topics.description, topics.is_locked,
-                users.username AS latest_thread_username,
+                COUNT(DISTINCT threads.id) as threads_count,
-                users.display_name AS latest_thread_display_name,
+                COUNT(posts.id) AS posts_count,
-                threads.title AS latest_thread_title,
+                MAX(posts.created_at) as latest_post_timestamp
-                threads.slug AS latest_thread_slug,
-                threads.created_at AS latest_thread_created_at
             FROM
                 topics
-            LEFT JOIN (
-                SELECT
-                *,
-                row_number() OVER (PARTITION BY threads.topic_id ORDER BY threads.created_at DESC) as rn
-            FROM
-                threads
-            ) threads ON threads.topic_id = topics.id AND threads.rn = 1
             LEFT JOIN
-                users on users.id = threads.user_id
+                threads ON threads.topic_id = topics.id
-            ORDER BY
+            LEFT JOIN
-                topics.sort_order ASC"""
+                posts ON posts.thread_id = threads.id
+            GROUP BY topics.id ORDER BY topics.sort_order ASC"""
         return db.query(q)
 
     @classmethod
-    def get_active_threads(cls):
+    def new(_cls, name: str, description: str) -> Topics:
+        from slugify import slugify
+        name = name.strip()
+        description = description.strip()
+        now = int(time.time())
+        slug = f'{slugify(name)}-{now}'
+
+        topic_count = Topics.count()
+        return Topics.create({
+            'name': name,
+            'description': description,
+            'slug': slug,
+            'sort_order': topic_count + 1,
+        })
+
+    def get_threads(self, per_page, page, sort_by = 'activity'):
+        order_clause = ''
+        if sort_by == 'thread':
+            order_clause = 'ORDER BY threads.is_stickied DESC, threads.created_at DESC'
+        else:
+            order_clause = 'ORDER BY threads.is_stickied DESC, latest_post_created_at DESC'
+
         q = """
-            WITH ranked_threads AS (
+            WITH latest_posts AS (
                 SELECT
-                    threads.topic_id, threads.id AS thread_id, threads.title AS thread_title, threads.slug AS thread_slug,
+                    thread_id,
-                    posts.id AS post_id, posts.created_at AS post_created_at,
+                    id AS latest_post_id,
-                    users.username, users.display_name,
+                    user_id AS latest_post_user_id,
-                    ROW_NUMBER() OVER (PARTITION BY threads.topic_id ORDER BY posts.created_at DESC) AS rn
+                    created_at AS latest_post_created_at,
-                FROM
+                    ROW_NUMBER() OVER (PARTITION BY thread_id ORDER BY created_at DESC) AS rn
-                    threads
+                FROM posts
-                JOIN
+            ),
-                    posts ON threads.id = posts.thread_id
+            post_counts AS (
-                LEFT JOIN
+                SELECT
-                    users ON posts.user_id = users.id
+                    thread_id,
+                    COUNT(*) AS posts_count
+                FROM posts
+                GROUP BY thread_id
             )
             SELECT
-                topic_id,
+                threads.id,
-                thread_id, thread_title, thread_slug,
+                threads.title,
-                post_id, post_created_at,
+                threads.slug,
-                username, display_name
+                threads.created_at,
-            FROM
+                threads.is_locked,
-                ranked_threads
+                threads.is_stickied,
-            WHERE
+                starter.username AS started_by,
-                rn = 1
+                starter.display_name AS started_by_display_name,
-            ORDER BY
+                latest_poster.username AS latest_post_username,
-                topic_id"""
+                latest_poster.display_name AS latest_post_display_name,
+                latest_posts.latest_post_created_at,
+                latest_posts.latest_post_id,
+                COALESCE(post_counts.posts_count, 0) AS posts_count
+            FROM threads
+            JOIN users AS starter ON starter.id = threads.user_id
+            LEFT JOIN latest_posts ON latest_posts.thread_id = threads.id AND latest_posts.rn = 1
+            LEFT JOIN users AS latest_poster ON latest_poster.id = latest_posts.latest_post_user_id
+            LEFT JOIN post_counts ON post_counts.thread_id = threads.id
+            WHERE threads.topic_id = ?
+        """ + order_clause + ' LIMIT ? OFFSET ?'
 
-        active_threads_raw = db.query(q)
+        return db.query(q, self.id, per_page, (page - 1) * per_page)
-        active_threads = {}
-        for thread in active_threads_raw:
-            active_threads[int(thread['topic_id'])] = {
-                'thread_title': thread['thread_title'],
-                'thread_slug': thread['thread_slug'],
-                'post_id': thread['post_id'],
-                'username': thread['username'],
-                'display_name': thread['display_name'],
-                'post_created_at': thread['post_created_at']
-            }
-        return active_threads
-
-    def get_threads(self, per_page, page, sort_by = "activity"):
-        order_clause = ""
-        if sort_by == "thread":
-            order_clause = "ORDER BY threads.is_stickied DESC, threads.created_at DESC"
-        else:
-            order_clause = "ORDER BY threads.is_stickied DESC, latest_post_created_at DESC"
 
+    def get_threads_with_op_rss(self):
         q = """
             SELECT
                 threads.id, threads.title, threads.slug, threads.created_at, threads.is_locked, threads.is_stickied,
                 users.username AS started_by,
                 users.display_name AS started_by_display_name,
-                u.username AS latest_post_username,
+                ph.content_rss AS original_post_content,
-                u.display_name AS latest_post_display_name,
+                posts.id AS original_post_id
-                ph.content AS latest_post_content,
-                posts.created_at AS latest_post_created_at,
-                posts.id AS latest_post_id
             FROM
                 threads
             JOIN users ON users.id = threads.user_id
@@ -213,7 +205,7 @@ class Topics(Model):
                     posts.user_id,
                     posts.created_at,
                     posts.current_revision_id,
-                    ROW_NUMBER() OVER (PARTITION BY posts.thread_id ORDER BY posts.created_at DESC) AS rn
+                    ROW_NUMBER() OVER (PARTITION BY posts.thread_id ORDER BY posts.created_at ASC) AS rn
             FROM
                 posts
             ) posts ON posts.thread_id = threads.id AND posts.rn = 1
@@ -223,17 +215,24 @@ class Topics(Model):
                 users u ON u.id = posts.user_id
             WHERE
             threads.topic_id = ?
-        """ + order_clause + " LIMIT ? OFFSET ?"
+            ORDER BY threads.created_at DESC"""
 
-        return db.query(q, self.id, per_page, (page - 1) * per_page)
+        return db.query(q, self.id)
+
+    def locked(self):
+        return bool(self.is_locked)
 
 
 class Threads(Model):
-    table = "threads"
+    table = 'threads'
 
-    def get_posts(self, limit, offset):
+    def get_posts(self, per_page, page):
-        q = Posts.FULL_POSTS_QUERY + " WHERE posts.thread_id = ? ORDER BY posts.created_at ASC LIMIT ? OFFSET ?"
+        q = Posts.FULL_POSTS_QUERY + ' WHERE posts.thread_id = ? ORDER BY posts.created_at ASC LIMIT ? OFFSET ?'
-        return db.query(q, self.id, limit, offset)
+        return db.query(q, self.id, per_page, (page - 1) * per_page)
+
+    def get_posts_rss(self):
+        q = Posts.FULL_POSTS_QUERY + ' WHERE posts.thread_id = ?'
+        return db.query(q, self.id)
 
     def locked(self):
         return bool(self.is_locked)
@@ -241,16 +240,49 @@ class Threads(Model):
     def stickied(self):
         return bool(self.is_stickied)
 
+    @classmethod
+    def new(cls, user_id: int, topic_id: int, title: str, content: str, language: str = 'babycode') -> Threads:
+        from slugify import slugify
+        now = int(time.time())
+        slug = f'{slugify(title)}-{now}'
+        thread = Threads.create({
+            'topic_id': topic_id,
+            'user_id': user_id,
+            'title': title.strip(),
+            'slug': slug,
+            'created_at': int(time.time()),
+        })
+        post = Posts.new(user_id, thread.id, content, language)
+        return thread
+
 class Posts(Model):
     FULL_POSTS_QUERY = """
+        WITH user_badges AS (
+            SELECT
+                b.user_id,
+                json_group_array(
+                    json_object(
+                        'label', b.label,
+                        'link', b.link,
+                        'sort_order', b.sort_order,
+                        'file_path', bu.file_path
+                    )
+                ) AS badges_json
+            FROM badges b
+            LEFT JOIN badge_uploads bu ON b.upload = bu.id
+            GROUP BY b.user_id
+            ORDER BY b.sort_order
+        )
+
         SELECT
             posts.id, posts.created_at,
-            post_history.content, post_history.edited_at,
+            post_history.content, post_history.edited_at, post_history.content_rss,
             users.username, users.display_name, users.status,
             avatars.file_path AS avatar_path, posts.thread_id,
             users.id AS user_id, post_history.original_markup,
             users.signature_rendered, threads.slug AS thread_slug,
-            threads.is_locked AS thread_is_locked, threads.title AS thread_title
+            threads.is_locked AS thread_is_locked, threads.title AS thread_title,
+            COALESCE(user_badges.badges_json, '[]') AS badges_json
         FROM
             posts
         JOIN
@@ -260,25 +292,60 @@ class Posts(Model):
         JOIN
             threads ON posts.thread_id = threads.id
         LEFT JOIN
-            avatars ON users.avatar_id = avatars.id"""
+            avatars ON users.avatar_id = avatars.id
+        LEFT JOIN
+            user_badges ON users.id = user_badges.user_id"""
 
-    table = "posts"
+    table = 'posts'
 
     def get_full_post_view(self):
         q = f'{self.FULL_POSTS_QUERY} WHERE posts.id = ?'
         return db.fetch_one(q, self.id)
 
+    @classmethod
+    def new(cls, user_id: int, thread_id: int, content: str, language: str = 'babycode') -> Posts:
+        from .lib.babycode import babycode_to_html, babycode_to_rssxml, BABYCODE_VERSION
+        html_content = babycode_to_html(content)
+        rssxml_content = babycode_to_rssxml(content)
+        with db.transaction():
+            post = Posts.create({
+                'thread_id': thread_id,
+                'user_id': user_id,
+                'current_revision_id': None,
+            })
+
+            revision = PostHistory.create({
+                'post_id': post.id,
+                'content': html_content.result,
+                'content_rss': rssxml_content,
+                'is_initial_revision': True,
+                'original_markup': content,
+                'markup_language': language,
+                'format_version': BABYCODE_VERSION,
+            })
+
+            for mention in html_content.mentions:
+                Mentions.create({
+                    'revision_id': revision.id,
+                    'mentioned_iser_id': mention['mentioned_iser_id'],
+                    'start_index': mention['start'],
+                    'end_index': mention['end'],
+                })
+
+            post.update({'current_revision_id': revision.id})
+            return post
+
 class PostHistory(Model):
-    table = "post_history"
+    table = 'post_history'
 
 class Sessions(Model):
-    table = "sessions"
+    table = 'sessions'
 
 class Avatars(Model):
-    table = "avatars"
+    table = 'avatars'
 
 class Subscriptions(Model):
-    table = "subscriptions"
+    table = 'subscriptions'
 
     def get_unread_count(self):
         q = """SELECT COUNT(*) AS unread_count
@@ -315,15 +382,15 @@ class APIRateLimits(Model):
             return False
 
 class Reactions(Model):
-    table = "reactions"
+    table = 'reactions'
 
     @classmethod
     def for_post(cls, post_id):
         qb = db.QueryBuilder(cls.table)\
-            .select("reaction_text, COUNT(*) as c")\
+            .select('reaction_text, COUNT(*) as c')\
-            .where({"post_id": post_id})\
+            .where({'post_id': post_id})\
-            .group_by("reaction_text")\
+            .group_by('reaction_text')\
-            .order_by("c", False)
+            .order_by('c', False)
         result = qb.all()
         return result if result else []
 
@@ -341,7 +408,7 @@ class Reactions(Model):
 
 
 class PasswordResetLinks(Model):
-    table = "password_reset_links"
+    table = 'password_reset_links'
 
 
 class InviteKeys(Model):
@@ -434,3 +501,31 @@ class MOTD(Model):
 
 class Mentions(Model):
     table = 'mentions'
+
+
+class BadgeUploads(Model):
+    table = 'badge_uploads'
+
+    @classmethod
+    def get_default(cls):
+        return BadgeUploads.findall({'user_id': None}, 'IS')
+
+    @classmethod
+    def get_for_user(cls, user_id):
+        q = 'SELECT * FROM badge_uploads WHERE user_id = ? OR user_id IS NULL ORDER BY uploaded_at'
+        res = db.query(q, int(user_id))
+        return [cls.from_data(row) for row in res]
+
+    @classmethod
+    def get_unused_for_user(cls, user_id):
+        q = 'SELECT bu.* FROM badge_uploads bu LEFT JOIN badges b ON bu.id = b.upload WHERE bu.user_id = ? AND b.upload IS NULL'
+        res = db.query(q, int(user_id))
+        return [cls.from_data(row) for row in res]
+
+
+class Badges(Model):
+    table = 'badges'
+
+    def get_image_url(self):
+        bu = BadgeUploads.find({'id': int(self.upload)})
+        return bu.file_path

app/routes/api.py

@@ -1,228 +0,0 @@
-from flask import Blueprint, request, url_for
-from ..lib.babycode import babycode_to_html
-from ..constants import REACTION_EMOJI
-from .users import is_logged_in, get_active_user
-from ..models import APIRateLimits, Threads, Reactions, Users, BookmarkCollections, BookmarkedThreads, BookmarkedPosts
-from ..db import db
-
-bp = Blueprint("api", __name__, url_prefix="/api/")
-
-
-@bp.post('/thread-updates/<thread_id>')
-def thread_updates(thread_id):
-    thread = Threads.find({'id': thread_id})
-    if not thread:
-        return {'error': 'no such thread'}, 404
-    target_time = request.json.get('since')
-    if not target_time:
-        return {'error': 'missing parameter "since"'}, 400
-    try:
-        target_time = int(target_time)
-    except:
-        return {'error': 'parameter "since" is not/cannot be converted to a number'}, 400
-
-    q = 'SELECT id FROM posts WHERE thread_id = ? AND posts.created_at > ? ORDER BY posts.created_at ASC LIMIT 1'
-    new_post = db.fetch_one(q, thread_id, target_time)
-    if not new_post:
-        return {'status': 'none'}
-
-    url = url_for('threads.thread', slug=thread.slug, after=new_post['id'], _anchor=f"post-{new_post['id']}")
-    return {'status': 'new_post', 'url': url}
-
-
-@bp.post('/babycode-preview')
-def babycode_preview():
-    if not is_logged_in():
-        return {'error': 'not authorized'}, 401
-    user = get_active_user()
-    if not APIRateLimits.is_allowed(user.id, 'babycode_preview', 5):
-        return {'error': 'too many requests'}, 429
-    markup = request.json.get('markup')
-    if not markup or not isinstance(markup, str):
-        return {'error': 'markup field missing or invalid type'}, 400
-    banned_tags = request.json.get('banned_tags', [])
-    rendered = babycode_to_html(markup, banned_tags).result
-    return {'html': rendered}
-
-
-@bp.post('/add-reaction/<post_id>')
-def add_reaction(post_id):
-    if not is_logged_in():
-        return {'error': 'not authorized', 'error_code': 401}, 401
-    user = get_active_user()
-    reaction_text = request.json.get('emoji')
-    if not reaction_text or not isinstance(reaction_text, str):
-        return {'error': 'emoji field missing or invalid type', 'error_code': 400}, 400
-    if reaction_text not in REACTION_EMOJI:
-        return {'error': 'unsupported reaction', 'error_code': 400}, 400
-
-    reaction = Reactions.find({
-        'user_id': user.id,
-        'post_id': int(post_id),
-        'reaction_text': reaction_text,
-    })
-
-    if reaction:
-        return {'error': 'reaction already exists', 'error_code': 409}, 409
-
-    reaction = Reactions.create({
-        'user_id': user.id,
-        'post_id': int(post_id),
-        'reaction_text': reaction_text,
-    })
-
-    return {'status': 'added'}
-
-
-@bp.post('/remove-reaction/<post_id>')
-def remove_reaction(post_id):
-    if not is_logged_in():
-        return {'error': 'not authorized'}, 401
-    user = get_active_user()
-    reaction_text = request.json.get('emoji')
-    if not reaction_text or not isinstance(reaction_text, str):
-        return {'error': 'emoji field missing or invalid type'}, 400
-    if reaction_text not in REACTION_EMOJI:
-        return {'error': 'unsupported reaction'}, 400
-
-    reaction = Reactions.find({
-        'user_id': user.id,
-        'post_id': int(post_id),
-        'reaction_text': reaction_text,
-    })
-
-    if not reaction:
-        return {'error': 'reaction does not exist'}, 404
-
-    reaction.delete()
-
-    return {'status': 'removed'}
-
-@bp.post('/manage-bookmark-collections/<user_id>')
-def manage_bookmark_collections(user_id):
-    if not is_logged_in():
-        return {'error': 'not authorized', 'error_code': 401}, 401
-
-    target_user = Users.find({'id': user_id})
-    if target_user.id != get_active_user().id:
-        return {'error': 'forbidden', 'error_code': 403}, 403
-
-    if target_user.is_guest():
-        return {'error': 'forbidden', 'error_code': 403}, 403
-
-    collections_data = request.json
-    for idx, coll_data in enumerate(collections_data.get('collections')):
-        if coll_data['is_new']:
-            collection = BookmarkCollections.create({
-                'name': coll_data['name'],
-                'user_id': target_user.id,
-                'sort_order': idx,
-            })
-        else:
-            collection = BookmarkCollections.find({'id': coll_data['id']})
-            if not collection:
-                continue
-
-            update = {'name': coll_data['name']}
-            if not collection.is_default:
-                update['sort_order'] = idx
-            collection.update(update)
-
-    for removed_id in collections_data.get('removed_collections'):
-        collection = BookmarkCollections.find({'id': removed_id})
-        if not collection:
-            continue
-
-        if collection.is_default:
-            continue
-
-        collection.delete()
-
-
-    return {'status': 'ok'}, 200
-
-
-@bp.post('/bookmark-post/<post_id>')
-def bookmark_post(post_id):
-    if not is_logged_in():
-        return {'error': 'not authorized', 'error_code': 401}, 401
-
-    operation = request.json.get('operation')
-    if operation == 'remove' and request.json.get('collection_id', '') == '':
-        return {'status': 'not modified'}, 304
-    collection_id = int(request.json.get('collection_id'))
-    post_id = int(post_id)
-    memo = request.json.get('memo', '')
-
-    if operation == 'move':
-        bm = BookmarkedPosts.find({'post_id': post_id})
-        if not bm:
-            BookmarkedPosts.create({
-                'post_id': post_id,
-                'collection_id': collection_id,
-                'note': memo,
-            })
-        else:
-            bm.update({
-                'collection_id': collection_id,
-                'note': memo,
-            })
-    elif operation == 'remove':
-        bm = BookmarkedPosts.find({'post_id': post_id})
-        if bm:
-            bm.delete()
-    else:
-        return {'error': 'bad request'}, 400
-
-    return {'status': 'ok'}, 200
-
-
-@bp.post('/bookmark-thread/<thread_id>')
-def bookmark_thread(thread_id):
-    if not is_logged_in():
-        return {'error': 'not authorized', 'error_code': 401}, 401
-
-    operation = request.json.get('operation')
-    if operation == 'remove' and request.json.get('collection_id', '') == '':
-        return {'status': 'not modified'}, 304
-    collection_id = int(request.json.get('collection_id'))
-    thread_id = int(thread_id)
-    memo = request.json.get('memo', '')
-
-    if operation == 'move':
-        bm = BookmarkedThreads.find({'thread_id': thread_id})
-        if not bm:
-            BookmarkedThreads.create({
-                'thread_id': thread_id,
-                'collection_id': collection_id,
-                'note': memo,
-            })
-        else:
-            bm.update({
-                'collection_id': collection_id,
-                'note': memo,
-            })
-    elif operation == 'remove':
-        bm = BookmarkedThreads.find({
-            'thread_id': thread_id,
-            'note': memo,
-        })
-        if bm:
-            bm.delete()
-    else:
-        return {'error': 'bad request'}, 400
-
-    return {'status': 'ok'}, 200
-
-@bp.get('/current-user')
-def get_current_user_info():
-    if not is_logged_in():
-        return {'user': None}
-
-    user = get_active_user()
-    return {
-            'user': {
-                'username': user.username,
-                'display_name': user.display_name,
-            }
-        }

app/routes/app.py

@@ -1,7 +1,6 @@
 from flask import Blueprint, redirect, url_for, render_template
+bp = Blueprint('app', __name__, url_prefix = '/')
 
-bp = Blueprint("app", __name__, url_prefix = "/")
+@bp.get('/')
-
-@bp.route("/")
 def index():
-    return redirect(url_for("topics.all_topics"))
+    return redirect(url_for('topics.all_topics'))

app/routes/guides.py

@@ -1,111 +1,11 @@
-from flask import Blueprint, render_template, render_template_string, current_app, abort
+from flask import Blueprint
-from pathlib import Path
-import re
-
-bp = Blueprint('guides', __name__, url_prefix='/guides/')
-
-
-def parse_guide_title(content: str):
-    lines = content.strip().split('\n', 1)
-    fline = lines[0].strip()
-    if fline.startswith('#'):
-        title = fline[2:].strip()
-        content = lines[1] if len(lines) > 1 else ''
-        return title, content.strip()
-
-    return None, content.strip()
-
-
-def get_guides_by_category():
-    guides_dir = Path(current_app.root_path) / 'templates' / 'guides'
-    categories = {}
-
-    for item in guides_dir.iterdir():
-        if item.is_dir() and not item.name.startswith('_'):
-            category = item.name
-            categories[category] = []
-            for guide_file in sorted(item.glob('*.html')):
-                if guide_file.name.startswith('_'):
-                    continue
-
-                m = re.match(r'(\d+)-(.+)\.html', guide_file.name)
-                if not m:
-                    continue
-
-                sort_num = int(m.group(1))
-                slug = m.group(2)
-
-                try:
-                    with open(guide_file, 'r') as f:
-                        content = f.read()
-
-                    title, template = parse_guide_title(content)
-                    if not title:
-                        title = slug.replace('-', ' ').title()
-
-                    categories[category].append(({
-                        'sort': sort_num,
-                        'slug': slug,
-                        'filename': guide_file.name,
-                        'title': title,
-                        'path': f'{category}/{guide_file.name}',
-                        'url': f'/guides/{category}/{slug}',
-                        'template': template,
-                    }))
-                except Exception as e:
-                    current_app.logger.warning(f'failed to read {guide_file}: {e}')
-                    continue
-
-            categories[category].sort(key=lambda x: x['sort'])
-
-    return categories
-
-
-@bp.get('/babycode')
-def babycode():
-    # print(get_guides_by_category())
-    return '<h1>no</h1>'
-
-
-@bp.get('/<category>/<slug>')
-def guide_page(category, slug):
-    categories = get_guides_by_category()
-    if category not in categories:
-        abort(404)
-        return
-
-    for i, guide in enumerate(categories[category]):
-        if guide['slug'] != slug:
-            continue
-
-        next_guide = None
-        prev_guide = None
-        if i != 0:
-            prev_guide = categories[category][i - 1]
-
-        if i + 1 < len(categories[category]):
-            next_guide = categories[category][i + 1]
-
-        return render_template_string(guide['template'], next_guide=next_guide, prev_guide=prev_guide, category=category, guide=guide)
-
-    abort(404)
-
-
-@bp.get('/<category>/')
-def category_index(category):
-    categories = get_guides_by_category()
-    if category not in categories:
-        abort(404)
-        return
-
-    return render_template('guides/category_index.html', category=category, pages=categories[category])
 
+bp = Blueprint('guides', __name__, url_prefix = '/guides/')
 
 @bp.get('/')
-def guides_index():
+def index():
-    return render_template('guides/guides_index.html', categories=get_guides_by_category())
+    return 'stub'
-
 
 @bp.get('/contact')
 def contact():
-    return render_template('guides/contact.html')
+    return 'stub'

app/routes/hyperapi.py

@@ -1,53 +0,0 @@
-from flask import Blueprint, render_template, abort, request
-from .users import get_active_user, is_logged_in
-from ..models import BookmarkCollections, BookmarkedPosts, BookmarkedThreads
-from functools import wraps
-
-bp = Blueprint('hyperapi', __name__, url_prefix='/hyperapi/')
-
-def login_required(view_func):
-    @wraps(view_func)
-    def dec(*args, **kwargs):
-        if not is_logged_in():
-            abort(403)
-        return view_func(*args, **kwargs)
-    return dec
-
-def account_required(view_func):
-    @wraps(view_func)
-    def dec(*args, **kwargs):
-        if get_active_user().is_guest():
-            abort(403)
-        return view_func(*args, **kwargs)
-    return dec
-
-@bp.errorhandler(403)
-def handle_403(e):
-    return "<h1>forbidden</h1>", 403
-
-
-@bp.get('bookmarks-dropdown/<bookmark_type>')
-@login_required
-@account_required
-def bookmarks_dropdown(bookmark_type):
-    collections = BookmarkCollections.findall({'user_id': get_active_user().id})
-    concept_id = request.args.get('id')
-    require_reload = bool(int(request.args.get('require_reload', default=0)))
-    if bookmark_type.lower() == 'thread':
-        selected = next(filter(lambda bc: bc.has_thread(concept_id), collections), None)
-    elif bookmark_type.lower() == 'post':
-        selected = next(filter(lambda bc: bc.has_post(concept_id), collections), None)
-    else:
-        abort(400)
-        return
-
-    if selected:
-        if bookmark_type.lower() == 'thread':
-            memo = BookmarkedThreads.find({'collection_id': selected.id, 'thread_id': int(concept_id)}).note
-        else:
-            memo = BookmarkedPosts.find({'collection_id': selected.id, 'post_id': int(concept_id)}).note
-    else:
-        memo = ''
-
-
-    return render_template('components/bookmarks_dropdown.html', collections=collections, id=concept_id, selected=selected, type=bookmark_type, memo=memo, require_reload=require_reload)

app/routes/mod.py

@@ -1,104 +1,96 @@
-from flask import (
+from flask import Blueprint, abort, redirect, url_for, request, render_template
-    Blueprint, render_template, request, redirect, url_for,
+from ..auth import is_logged_in, get_active_user, csrf_verified
-    flash
+from ..models import Topics, Threads
-    )
+bp = Blueprint('mod', __name__, url_prefix='/mod/')
-from .users import get_active_user, is_logged_in
-from ..models import Users, PasswordResetLinks, MOTD
-from ..constants import InfoboxKind, MOTD_BANNED_TAGS
-from ..lib.babycode import babycode_to_html, BABYCODE_VERSION
-from ..db import db
-import secrets
-import time
-
-bp = Blueprint("mod", __name__, url_prefix = "/mod/")
 
 @bp.before_request
-def _before_request():
+def mod_only():
     if not is_logged_in():
-        return redirect(url_for("users.log_in"))
+        abort(403)
-
     if not get_active_user().is_mod():
-        return redirect(url_for("topics.all_topics"))
+        abort(403)
 
+@bp.get('/')
+def index():
+    return 'stub'
 
-@bp.get("/sort-topics")
+@bp.get('/topics/new/')
+def new_topic():
+    return render_template('mod/new_topic.html')
+
+@bp.post('/topics/new/')
+def new_topic_post():
+    topic = Topics.new(request.form.get('name'), request.form.get('description'))
+    return redirect(url_for('topics.topic_by_id', topic_id=topic.id))
+
+@bp.get('/topics/sort/')
 def sort_topics():
-    topics = db.query("SELECT * FROM topics ORDER BY sort_order ASC")
+    return 'stub'
-    return render_template("mod/sort-topics.html", topics = topics)
 
+@bp.get('/topics/<int:topic_id>/edit/')
+def edit_topic(topic_id):
+    topic = Topics.find({'id': topic_id})
+    if not topic:
+        abort(404)
+    return render_template('mod/edit_topic.html', topic=topic)
 
-@bp.post("/sort-topics")
+@bp.post('/topics/<int:topic_id>/edit/')
-def sort_topics_post():
+def edit_topic_post(topic_id):
-    with db.transaction():
+    topic = Topics.find({'id': topic_id})
-        for topic_id, new_order in request.form.items():
+    if not topic:
-            db.execute("UPDATE topics SET sort_order = ? WHERE id = ?", new_order, topic_id)
+        abort(404)
-
+    topic.update({
-    return redirect(url_for(".sort_topics"))
+        'name': request.form.get('name').strip(),
-
+        'description': request.form.get('description').strip(),
-
-@bp.get("/user-list")
-def user_list():
-    users = Users.select()
-    return render_template("mod/user-list.html", users = users)
-
-
-@bp.post("/reset-pass/<user_id>")
-def create_reset_pass(user_id):
-    now = int(time.time())
-    key = secrets.token_urlsafe(20)
-    reset_link = PasswordResetLinks.create({
-        'user_id': int(user_id),
-        'expires_at': now + 24 * 60 * 60,
-        'key': key,
     })
+    return redirect(url_for('topics.topic_by_id', topic_id=topic.id))
 
-    return redirect(url_for('users.reset_link_login', key=key))
+@bp.post('/topics/<int:topic_id>/lock/')
+def lock_topic(topic_id):
+    topic = Topics.find({'id': topic_id})
+    if not topic:
+        abort(404)
+    topic.update({'is_locked': request.form.get('lock', default=0)})
+    return redirect(url_for('topics.topic_by_id', topic_id=topic.id))
 
+@bp.post('/threads/<int:thread_id>/move/')
+def move_thread(thread_id):
+    thread = Threads.find({'id': thread_id})
+    if not thread:
+        abort(404)
+    target_topic = Topics.find({'id': request.form.get('new_topic_id', default=None)})
+    if not target_topic:
+        abort(404)
+    thread.update({'topic_id': target_topic.id})
+    return redirect(url_for('threads.thread_by_id', thread_id=thread.id))
 
-@bp.get('/panel')
+@bp.post('/threads/<int:thread_id>/lock/')
-def panel():
+def lock_thread(thread_id):
-    return render_template('mod/panel.html')
+    thread = Threads.find({'id': thread_id})
+    if not thread:
+        abort(404)
+    thread.update({'is_locked': request.form.get('lock')})
+    return redirect(url_for('threads.thread_by_id', thread_id=thread.id))
 
+@bp.post('/threads/<int:thread_id>/sticky/')
+def sticky_thread(thread_id):
+    thread = Threads.find({'id': thread_id})
+    if not thread:
+        abort(404)
+    thread.update({'is_stickied': request.form.get('sticky')})
+    return redirect(url_for('threads.thread_by_id', thread_id=thread.id))
 
-@bp.get('/motd')
+@bp.post('/users/<int:user_id>/make-guest/')
-def motd_editor():
+@csrf_verified
-    current = MOTD.get_all()[0] if MOTD.has_motd() else None
+def make_user_guest(user_id):
-    return render_template('mod/motd.html', current=current)
+    return 'stub'
 
+@bp.post('/users/<int:user_id>/make-user/')
+@csrf_verified
+def make_user_regular(user_id):
+    return 'stub'
 
-@bp.post('/motd')
+@bp.post('/users/<int:user_id>/make-mod/')
-def motd_editor_form():
+@csrf_verified
-    orig_body = request.form.get('body', default='')
+def make_user_mod(user_id):
-    title = request.form.get('title', default='')
+    return 'stub'
-    data = {
-            'title': title,
-            'body_original_markup': orig_body,
-            'body_rendered': babycode_to_html(orig_body, banned_tags=MOTD_BANNED_TAGS).result,
-            'format_version': BABYCODE_VERSION,
-            'edited_at': int(time.time()),
-    }
-
-    if MOTD.has_motd():
-        motd = MOTD.get_all()[0]
-        motd.update(data)
-        message = 'MOTD updated.'
-    else:
-        data['created_at'] = int(time.time())
-        data['user_id'] = get_active_user().id
-        motd = MOTD.create(data)
-        message = 'MOTD created.'
-
-    flash(message, InfoboxKind.INFO)
-    return redirect(url_for('.motd_editor'))
-
-
-@bp.post('/motd/delete')
-def motd_delete():
-    if not MOTD.has_motd():
-        flash('No MOTD to delete.', InfoboxKind.WARN)
-        return redirect(url_for('.motd_editor'))
-
-    current = MOTD.get_all()[0]
-    current.delete()
-    flash('MOTD deleted.', InfoboxKind.INFO)
-    return redirect(url_for('.motd_editor'))

app/routes/posts.py

@@ -1,149 +1,44 @@
-from flask import (
+from flask import Blueprint, abort
-    Blueprint, redirect, url_for, flash, render_template, request
+from functools import wraps
-    )
+from ..auth import login_required, get_active_user
-from .users import login_required, get_active_user
+from ..models import Posts
-from ..lib.babycode import babycode_to_html, BABYCODE_VERSION
-from ..constants import InfoboxKind
-from ..db import db
-from ..models import Posts, PostHistory, Threads, Topics, Mentions
 
-bp = Blueprint("posts", __name__, url_prefix = "/post")
+bp = Blueprint('posts', __name__, url_prefix='/posts/')
 
-
+def ownership_required(view_func):
-def create_post(thread_id, user_id, content, markup_language="babycode"):
+    @wraps(view_func)
-    parsed_content = babycode_to_html(content)
+    def wrapper(*args, **kwargs):
-    with db.transaction():
+        post = Posts.find({'id': kwargs.get('post_id', None)})
-        post = Posts.create({
-            "thread_id": thread_id,
-            "user_id": user_id,
-            "current_revision_id": None,
-        })
-
-        revision = PostHistory.create({
-            "post_id": post.id,
-            "content": parsed_content.result,
-            "is_initial_revision": True,
-            "original_markup": content,
-            "markup_language": markup_language,
-            "format_version": BABYCODE_VERSION,
-        })
-
-        for mention in parsed_content.mentions:
-            Mentions.create({
-                'revision_id': revision.id,
-                'mentioned_user_id': mention['mentioned_user_id'],
-                'original_mention_text': mention['mention_text'],
-                'start_index': mention['start'],
-                'end_index': mention['end'],
-            })
-
-        post.update({"current_revision_id": revision.id})
-        return post
-
-
-def update_post(post_id, new_content, markup_language='babycode'):
-    parsed_content = babycode_to_html(new_content)
-    with db.transaction():
-        post = Posts.find({'id': post_id})
-        new_revision = PostHistory.create({
-            'post_id': post.id,
-            'content': parsed_content.result,
-            'is_initial_revision': False,
-            'original_markup': new_content,
-            'markup_language': markup_language,
-            'format_version': BABYCODE_VERSION,
-        })
-
-        for mention in parsed_content.mentions:
-            Mentions.create({
-                'revision_id': new_revision.id,
-                'mentioned_user_id': mention['mentioned_user_id'],
-                'original_mention_text': mention['mention_text'],
-                'start_index': mention['start'],
-                'end_index': mention['end'],
-            })
-
-        post.update({'current_revision_id': new_revision.id})
-
-
-@bp.post("/<post_id>/delete")
-@login_required
-def delete(post_id):
-    post = Posts.find({'id': post_id})
         if not post:
             abort(404)
-        return
 
-    thread = Threads.find({'id': post.thread_id})
+        if post.user_id != get_active_user().id:
-    user = get_active_user()
+            abort(403)
-    if not user:
-        return redirect(url_for('threads.thread', slug=thread.slug))
 
-    if user.is_mod() or post.user_id == user.id:
+        return view_func(*args, **kwargs)
-        post.delete()
+    return wrapper
 
-        post_count = Posts.count({
+def ownership_or_mod_required(view_func):
-            'thread_id': thread.id,
+    @wraps(view_func)
-        })
+    def wrapper(*args, **kwargs):
+        post = Posts.find({'id': kwargs.get('post_id', None)})
+        if not post:
+            abort(404)
 
-        if post_count == 0:
+        if post.user_id != get_active_user().id and not get_active_user().is_mod():
-            topic = Topics.find({
+            abort(403)
-                'id': thread.topic_id,
-            })
-            thread.delete()
-            flash('Thread deleted.', InfoboxKind.INFO)
-            return redirect(url_for('topics.topic', slug=topic.slug))
 
-        flash('Post deleted.', InfoboxKind.INFO)
+        return view_func(*args, **kwargs)
+    return wrapper
 
-    return redirect(url_for('threads.thread', slug=thread.slug))
+@bp.get('/<int:post_id>/edit/')
-
-
-@bp.get("/<post_id>/edit")
 @login_required
+@ownership_required
 def edit(post_id):
-    post = Posts.find({'id': post_id})
+    return 'stub'
-    if not post:
-        abort(404)
-        return
 
-    user = get_active_user()
+@bp.get('/<int:post_id>/delete/')
-    q = f"{Posts.FULL_POSTS_QUERY} WHERE posts.id = ?"
-    editing_post = db.fetch_one(q, post_id)
-    if not editing_post:
-        abort(404)
-        return
-    if editing_post['user_id'] != user.id:
-        return redirect(url_for('topics.all_topics'))
-
-    thread = Threads.find({'id': editing_post['thread_id']})
-
-    thread_predicate = f'{Posts.FULL_POSTS_QUERY} WHERE posts.thread_id = ?'
-
-    context_prev_q = f'{thread_predicate} AND posts.created_at < ? ORDER BY posts.created_at DESC LIMIT 2'
-    context_next_q = f'{thread_predicate} AND posts.created_at > ? ORDER BY posts.created_at ASC LIMIT 2'
-    prev_context = db.query(context_prev_q, thread.id, editing_post['created_at'])
-    next_context = db.query(context_next_q, thread.id, editing_post['created_at'])
-
-    return render_template('posts/edit.html',
-                           editing_post = editing_post,
-                           thread = thread,
-                           prev_context = prev_context,
-                           next_context = next_context,
-                           )
-
-
-@bp.post("/<post_id>/edit")
 @login_required
-def edit_form(post_id):
+@ownership_or_mod_required
-    user = get_active_user()
+def delete(post_id):
-    post = Posts.find({'id': post_id})
+    return 'stub'
-    if not post:
-        abort(404)
-        return
-    if post.user_id != user.id:
-        return redirect(url_for('topics.all_topics'))
-
-    update_post(post.id, request.form.get('new_content', default=''))
-    thread = Threads.find({'id': post.thread_id})
-    return redirect(url_for('threads.thread', slug=thread.slug, after=post.id, _anchor=f'post-{post.id}'))

app/routes/threads.py

@@ -1,247 +1,102 @@
-from flask import (
+from flask import Blueprint, redirect, url_for, render_template, request, abort
-    Blueprint, render_template, request, redirect, url_for, flash,
+from ..auth import login_required, get_active_user
-    abort,
+from ..models import Threads, Posts, Topics, Users, Reactions
-    )
-from .users import login_required, mod_only, get_active_user, is_logged_in
-from ..db import db
-from ..models import Threads, Topics, Posts, Subscriptions, Reactions
-from ..constants import InfoboxKind
-from .posts import create_post
-from slugify import slugify
 import math
-import time
 
-bp = Blueprint("threads", __name__, url_prefix = "/threads/")
+bp = Blueprint('threads', __name__, url_prefix='/threads/')
 
-
+@bp.get('/<int:thread_id>/')
-def get_post_url(post_id, _anchor=False):
+def thread_by_id(thread_id):
-    post = Posts.find({'id': post_id})
+    thread = Threads.find({'id': thread_id})
-    if not post:
-        return ""
-
-    thread = Threads.find({'id': post.thread_id})
-
-    res = url_for('threads.thread', slug=thread.slug, after=post_id)
-    if not _anchor:
-        return res
-
-    return f"{res}#post-{post_id}"
-
-
-@bp.get("/<slug>")
-def thread(slug):
-    POSTS_PER_PAGE = 10
-    thread = Threads.find({"slug": slug})
     if not thread:
         abort(404)
-        return
+    return redirect(url_for('.thread', thread_id=thread_id, slug=thread.slug, **request.args))
 
-    post_count = Posts.count({"thread_id": thread.id})
+@bp.get('/<int:thread_id>/<slug>/')
-    page_count = max(math.ceil(post_count / POSTS_PER_PAGE), 1)
+def thread(thread_id, slug):
+    thread = Threads.find({'id': thread_id})
+    if not thread:
+        abort(404)
+    if thread.slug != slug:
+        return redirect(url_for('.thread', thread_id=thread_id, slug=thread.slug, **request.kwargs))
 
+    topic = Topics.find({'id': thread.topic_id})
+    started_by = Users.find({'id': thread.user_id})
+    PER_PAGE = 10
+    posts_count = Posts.count({'thread_id': thread.id})
+    page_count = max(1, math.ceil(posts_count / PER_PAGE))
     page = 1
-    after = request.args.get("after", default=None)
+    after = request.args.get('after')
     if after is not None:
+        try:
             after_id = int(after)
             post_position = Posts.count([
-            ("thread_id", "=", thread.id),
+                ('thread_id', '=', thread.id),
-            ("id", "<=", after_id),
+                ('id', '<=', after_id),
             ])
-        page = math.ceil((post_position) / POSTS_PER_PAGE)
+            page = math.ceil((post_position) / PER_PAGE)
+        except ValueError:
+            abort(404)
     else:
-        page = max(1, min(page_count, int(request.args.get("page", default = 1))))
+        try:
-    posts = thread.get_posts(POSTS_PER_PAGE, (page - 1) * POSTS_PER_PAGE)
+            page = max(1, min(int(request.args.get('page', default=1)), page_count))
-    topic = Topics.find({"id": thread.topic_id})
+        except ValueError:
-    other_topics = Topics.select()
+            abort(404)
+    return render_template('threads/thread.html', thread=thread, posts=thread.get_posts(PER_PAGE, page), page=page, page_count=page_count, topic=topic, started_by=started_by, topics=Topics.get_list(), Reactions=Reactions)
 
-    is_subscribed = False
+@bp.post('/<int:thread_id>/reply/')
-    unread_count = None
-    if is_logged_in():
-        subscription = Subscriptions.find({
-            'thread_id': thread.id,
-            'user_id': get_active_user().id,
-        })
-        if subscription:
-            unread_count = subscription.get_unread_count()
-            if int(posts[-1]['created_at']) > int(subscription.last_seen):
-                subscription.update({
-                    'last_seen': int(posts[-1]['created_at'])
-                })
-            is_subscribed = True
-
-    return render_template(
-        "threads/thread.html",
-        thread = thread,
-        current_page = page,
-        page_count = page_count,
-        posts = posts,
-        topic = topic,
-        topics = other_topics,
-        is_subscribed = is_subscribed,
-        Reactions = Reactions,
-        unread_count = unread_count,
-    )
-
-
-@bp.post("/<slug>")
 @login_required
-def reply(slug):
+def reply(thread_id):
-    thread = Threads.find({"slug": slug})
+    user = get_active_user()
+    thread = Threads.find({'id': thread_id})
     if not thread:
         abort(404)
-        return
-    user = get_active_user()
-    if user.is_guest():
-        return redirect(url_for('.thread', slug=slug))
     if thread.locked() and not user.is_mod():
-        return redirect(url_for('.thread', slug=slug))
+        # TODO: flash
+        return redirect(url_for('.thread_by_id', thread_id=thread_id))
+    post = Posts.new(user.id, thread.id, request.form.get('babycode_content'))
+    return redirect(url_for('.thread_by_id', thread_id=thread_id, after=post.id, _anchor=f'post-{post.id}'))
 
-    post_content = request.form['post_content']
+@bp.get('/<int:thread_id>/feed.atom/')
-    post = create_post(thread.id, user.id, post_content)
+def feed(thread_id):
+    return 'stub'
 
-    subscription = Subscriptions.find({'user_id': user.id, 'thread_id': thread.id})
+@bp.get('/new/')
-
-    if subscription:
-        subscription.update({'last_seen': int(time.time())})
-    elif request.form.get('subscribe', default=None) == 'on':
-        Subscriptions.create({'user_id': user.id, 'thread_id': thread.id, 'last_seen': int(time.time())})
-
-    return redirect(url_for(".thread", slug=slug, after=post.id, _anchor="latest-post"))
-
-
-@bp.get("/create")
 @login_required
-def create():
+def new():
-    all_topics = Topics.select()
+    topics = Topics.select()
-    return render_template("threads/create.html", all_topics = all_topics)
+    try:
+        selected_topic = int(request.args.get('topic_id'))
+    except ValueError, TypeError:
+        selected_topic = None
+    return render_template('threads/new_thread.html', topics=topics, selected_topic=selected_topic)
 
-
+@bp.post('/new/')
-@bp.post("/create")
 @login_required
-def create_form():
+def new_post():
-    topic = Topics.find({"id": request.form['topic_id']})
+    try:
-    user = get_active_user()
+        topic_id = int(request.form.get('topic_id'))
+    except ValueError, TypeError:
+        abort(404)
+    topic_id = int(topic_id)
+    topic = Topics.find({'id': topic_id})
     if not topic:
-        flash('Invalid topic', InfoboxKind.ERROR)
-        return redirect(url_for('.create'))
-
-    if topic.is_locked and not get_active_user().is_mod():
-        flash(f'Topic "{topic.name}" is locked', InfoboxKind.ERROR)
-        return redirect(url_for('.create'))
-
-    title = request.form['title'].strip()
-    now = int(time.time())
-    slug = f"{slugify(title)}-{now}"
-
-    post_content = request.form['initial_post']
-    thread = Threads.create({
-        "topic_id": topic.id,
-        "user_id": user.id,
-        "title": title,
-        "slug": slug,
-        "created_at": now,
-    })
-    post = create_post(thread.id, user.id, post_content)
-    return redirect(url_for(".thread", slug = thread.slug))
-
-
-@bp.post("/<slug>/lock")
-@login_required
-def lock(slug):
-    user = get_active_user()
-    thread = Threads.find({'slug': slug})
-    if not thread:
         abort(404)
-        return
-    if not ((thread.user_id == user.id) or user.is_mod()):
-        return redirect(url_for('.thread', slug=slug))
-    target_op = request.form.get('target_op')
-    thread.update({
-        'is_locked': target_op
-    })
-    return redirect(url_for('.thread', slug=slug))
 
-
-@bp.post("/<slug>/sticky")
-@login_required
-@mod_only(".thread", slug = lambda slug: slug)
-def sticky(slug):
     user = get_active_user()
-    thread = Threads.find({'slug': slug})
+    if not user.can_post_to_topic(topic):
-    if not thread:
         abort(404)
-        return
-    if not ((thread.user_id == user.id) or user.is_mod()):
-        return redirect(url_for('.thread', slug=slug))
-    target_op = request.form.get('target_op')
-    thread.update({
-        'is_stickied': target_op
-    })
-    return redirect(url_for('.thread', slug=slug))
 
+    title = request.form.get('title')
+    if not title:
+        abort(404)
 
-@bp.post("/<slug>/move")
+    if not title.strip():
-@login_required
+        abort(404)
-@mod_only(".thread", slug = lambda slug: slug)
-def move(slug):
-    user = get_active_user()
 
-    new_topic_id = request.form.get('new_topic_id', default=None)
+    title = title.strip()
-    if new_topic_id is None:
-        flash('Thread is already in this topic.', InfoboxKind.ERROR)
-        return redirect(url_for('.thread', slug=slug))
 
-    new_topic = Topics.find({
+    content = request.form.get('babycode_content')
-        'id': new_topic_id
-    })
-    if not new_topic:
-        return redirect(url_for('topics.all_topics'))
-    thread = Threads.find({
-        'slug': slug
-    })
-    if not thread:
-        return redirect(url_for('topics.all_topics'))
-    if new_topic.id == thread.topic_id:
-        flash('Thread is already in this topic.', InfoboxKind.ERROR)
-        return redirect(url_for('.thread', slug=slug))
 
-    old_topic = Topics.find({'id': thread.topic_id})
+    thread = Threads.new(user.id, topic.id, title, content)
-    thread.update({'topic_id': new_topic_id})
+    return redirect(url_for('.thread', slug=thread.slug))
-    flash(f'Topic moved from "{old_topic.name}" to "{new_topic.name}".', InfoboxKind.INFO)
-    return redirect(url_for('.thread', slug=slug))
-
-
-@bp.post("/<slug>/subscribe")
-@login_required
-def subscribe(slug):
-    user = get_active_user()
-    thread = Threads.find({'slug': slug})
-    if not thread:
-        return redirect(url_for('topics.all_topics'))
-    subscription = Subscriptions.find({
-        'user_id': user.id,
-        'thread_id': thread.id,
-    })
-    if request.form['subscribe'] == 'subscribe':
-        if subscription:
-            subscription.delete()
-        Subscriptions.create({
-            'user_id': user.id,
-            'thread_id': thread.id,
-            'last_seen': int(time.time()),
-        })
-    elif request.form['subscribe'] == 'unsubscribe':
-        if not subscription:
-            return redirect(url_for('.thread', slug=slug))
-        subscription.delete()
-    elif request.form['subscribe'] == 'read':
-        if not subscription:
-            return redirect(url_for('.thread', slug=slug))
-        subscription.update({
-            'last_seen': int(time.time())
-        })
-    last_visible_post = request.form.get('last_visible_post', default=None)
-    if last_visible_post is not None:
-        return redirect(url_for('.thread', slug=thread.slug, after=last_visible_post))
-    else:
-        return redirect(url_for('users.inbox', username=user.username))

app/routes/topics.py

@@ -1,128 +1,40 @@
-from flask import (
+from flask import Blueprint, redirect, url_for, render_template, request, session, abort
-    Blueprint, render_template, request, redirect, url_for, flash, session,
+
-    abort,
+from ..models import Topics, Threads
-    )
-from .users import login_required, mod_only, get_active_user, is_logged_in
-from ..models import Users, Topics, Threads, Subscriptions
-from ..constants import InfoboxKind
-from slugify import slugify
-import time
 import math
 
-bp = Blueprint("topics", __name__, url_prefix = "/topics/")
+bp = Blueprint('topics', __name__, url_prefix = '/topics/')
 
-
+@bp.get('/')
-@bp.get("/")
 def all_topics():
-    return render_template("topics/topics.html", topic_list = Topics.get_list(), active_threads = Topics.get_active_threads())
+    topic_list = Topics.get_list()
+    return render_template('topics/topics.html', topics=topic_list)
 
-
+@bp.get('/<int:topic_id>/')
-@bp.get("/create")
+def topic_by_id(topic_id):
-@login_required
+    topic = Topics.find({'id': topic_id})
-@mod_only(".all_topics")
+    if not topic:
-def create():
-    return render_template("topics/create.html")
-
-
-@bp.post("/create")
-@login_required
-@mod_only(".all_topics")
-def create_post():
-    topic_name = request.form['name'].strip()
-    now = int(time.time())
-    slug = f"{slugify(topic_name)}-{now}"
-
-    topic_count = Topics.count()
-    topic = Topics.create({
-        "name": topic_name,
-        "description": request.form['description'],
-        "slug": slug,
-        "sort_order": topic_count + 1,
-    })
-
-    flash("Topic created.", InfoboxKind.INFO)
-    return redirect(url_for("topics.topic", slug = slug))
-
-
-@bp.get("/<slug>")
-def topic(slug):
-    THREADS_PER_PAGE = 10
-    target_topic = Topics.find({
-        "slug": slug
-    })
-    if not target_topic:
         abort(404)
-        return
+    return redirect(url_for('.topic', topic_id=topic_id, slug=topic.slug, **request.args))
 
-    threads_count = Threads.count({
+@bp.get('/<int:topic_id>/<slug>/')
-        "topic_id": target_topic.id
+def topic(topic_id, slug):
-    })
+    topic = Topics.find({'id': topic_id})
+    if not topic:
+        abort(404)
+    if topic.slug != slug:
+        return redirect(url_for('.topic', topic_id=topic_id, slug=topic.slug, **request.args))
 
-    sort_by = session.get('sort_by', default="activity")
+    sort_by = request.args.get('sort_by', default=session.get('sort_by', default='activity'))
-
+    PER_PAGE = 10
-    page_count = max(math.ceil(threads_count / THREADS_PER_PAGE), 1)
+    threads_count = Threads.count({'topic_id': topic.id})
+    page_count = max(1, math.ceil(threads_count / PER_PAGE))
+    try:
         page = max(1, min(int(request.args.get('page', default=1)), page_count))
-
+    except ValueError:
-    threads_list = target_topic.get_threads(THREADS_PER_PAGE, page, sort_by)
-    subscriptions = {}
-    if is_logged_in():
-        for thread in threads_list:
-            subscription = Subscriptions.find({
-                'user_id': get_active_user().id,
-                'thread_id': thread['id'],
-                })
-            if subscription:
-                subscriptions[thread['id']] = subscription.get_unread_count()
-
-    return render_template(
-        "topics/topic.html",
-        threads_list = threads_list,
-        subscriptions = subscriptions,
-        topic = target_topic,
-        current_page = page,
-        page_count = page_count
-    )
-
-
-@bp.get("/<slug>/edit")
-@login_required
-@mod_only(".topic", slug = lambda slug: slug)
-def edit(slug):
-    topic = Topics.find({"slug": slug})
-    if not topic:
         abort(404)
-        return
+    return render_template('topics/topic.html', topic=topic, threads=topic.get_threads(PER_PAGE, page, sort_by), sort_by=sort_by, page=page, page_count=page_count)
-    return render_template("topics/edit.html", topic=topic)
 
-
+@bp.get('/<int:topic_id>/feed.atom/')
-@bp.post("/<slug>/edit")
+def feed(topic_id):
-@login_required
+    return 'stub'
-@mod_only(".topic", slug = lambda slug: slug)
-def edit_post(slug):
-    topic = Topics.find({"slug": slug})
-    if not topic:
-        abort(404)
-        return
-
-    topic.update({
-        "name": request.form.get('name', default = topic.name).strip(),
-        "description": request.form.get('description', default = topic.description),
-        "is_locked": int(request.form.get("is_locked", default = topic.is_locked)),
-    })
-
-    return redirect(url_for("topics.topic", slug=slug))
-
-
-@bp.post("/<slug>/delete")
-@login_required
-@mod_only(".topic", slug = lambda slug: slug)
-def delete(slug):
-    topic = Topics.find({"slug": slug})
-    if not topic:
-        abort(404)
-        return
-
-    topic.delete()
-
-    flash("Topic deleted.", InfoboxKind.INFO)
-    return redirect(url_for("topics.all_topics"))

app/routes/users.py

@@ -1,845 +1,135 @@
-from flask import (
+from flask import Blueprint, redirect, url_for, render_template, request, session
-    Blueprint, render_template, request, redirect, url_for, flash, session, current_app, abort
-    )
 from functools import wraps
-from ..db import db
-from ..lib.babycode import babycode_to_html, BABYCODE_VERSION
-from ..models import (
-    Users, Sessions, Subscriptions,
-    Avatars, PasswordResetLinks, InviteKeys,
-    BookmarkCollections, BookmarkedThreads,
-    Mentions, PostHistory,
-    )
-from ..constants import InfoboxKind, PermissionLevel, SIG_BANNED_TAGS
-from ..auth import digest, verify
-from wand.image import Image
-from wand.exceptions import WandException
-from datetime import datetime, timedelta
-import secrets
 import time
-import re
-import os
 
-bp = Blueprint("users", __name__, url_prefix = "/users/")
+from ..auth import (
+    digest, verify, create_session,
+    is_logged_in, parse_username, is_password_valid,
+    login_required
+    )
+from ..models import Users
+from ..constants import PermissionLevel
+from secrets import compare_digest as compare_timesafe
 
+bp = Blueprint('users', __name__, url_prefix='/users/')
 
-def validate_and_create_avatar(input_image, filename):
+def redirect_if_logged_in(destination='topics.all_topics'):
-    try:
-        with Image(blob=input_image) as img:
-            img.strip()
-            img.gravity = 'center'
-
-            width, height = img.width, img.height
-            min_dim = min(width, height)
-            if min_dim > 256:
-                ratio = 256.0 / min_dim
-                new_width = int(width * ratio)
-                new_height = int(height * ratio)
-                img.resize(new_width, new_height)
-
-            width, height = img.width, img.height
-            crop_size = min(width, height)
-            x_offset = (width - crop_size) // 2
-            y_offset = (height - crop_size) // 2
-            img.crop(left=x_offset, top=y_offset,
-                    width=crop_size, height=crop_size)
-
-            img.resize(256, 256)
-            img.format = 'webp'
-            img.compression_quality = 85
-            img.save(filename=filename)
-            return True
-    except WandException:
-        return False
-
-
-def is_logged_in():
-    return "pyrom_session_key" in session
-
-
-def get_active_user():
-    if not is_logged_in():
-        return None
-    sess = Sessions.find({"key": session["pyrom_session_key"]})
-    if not sess:
-        return None
-    return Users.find({"id": sess.user_id})
-
-
-def create_session(user_id):
-    key = secrets.token_hex(16)
-    expires_at = int(time.time()) + 31 * 24 * 60 * 60
-    s = Sessions.create({
-        "key": key,
-        "user_id": user_id,
-        "expires_at": expires_at,
-    })
-    return s
-
-
-def extend_session(user_id):
-    session_obj = Sessions.find({'key': session['pyrom_session_key']})
-    if not session_obj:
-        return
-    new_duration = timedelta(31)
-    current_app.permanent_session_lifetime = new_duration
-    session.modified = True
-    session_obj.update({
-        'expires_at': int(time.time()) + 31 * 24 * 60 * 60
-    })
-
-
-def validate_password(password):
-    pattern = r'^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,255}$'
-    return bool(re.fullmatch(pattern, password))
-
-
-def validate_username(username):
-    pattern = r'^[a-zA-Z0-9_-]{3,20}$'
-    return bool(re.fullmatch(pattern, username))
-
-
-def validate_display_name(display_name):
-    if not display_name:
-        return True
-
-    pattern = r'^[\w!#$%^*\(\)\-_=+\[\]\{\}\|;:,.?\s]{3,50}$'
-    display_name = display_name.replace('@', '_')
-    return bool(re.fullmatch(pattern, display_name))
-
-
-def redirect_if_logged_in(*args, **kwargs):
     def decorator(view_func):
-        @wraps(view_func)
-        def wrapper(*view_args, **view_kwargs):
-            if is_logged_in():
-                # resolve callables
-                processed_kwargs = {
-                    k: v(**view_kwargs) if callable(v) else v
-                    for k, v in kwargs.items()
-                }
-                endpoint = args[0] if args else processed_kwargs.get("endpoint")
-                if endpoint.startswith("."):
-                    blueprint = current_app.blueprints.get(view_func.__name__.split(".")[0])
-                    if blueprint:
-                        endpoint = endpoint.lstrip(".")
-                        return redirect(url_for(f"{blueprint.name}.{endpoint}", **processed_kwargs))
-                return redirect(url_for(*args, **processed_kwargs))
-            return view_func(*view_args, **view_kwargs)
-        return wrapper
-    return decorator
-
-
-def redirect_to_own(view_func):
-    @wraps(view_func)
-    def wrapper(username, *args, **kwargs):
-        user = get_active_user()
-        if username.lower() != user.username:
-            view_args = dict(request.view_args)
-            view_args.pop('username', None)
-            new_args = {**view_args, 'username': user.username}
-            return redirect(url_for(request.endpoint, **new_args))
-        return view_func(username, *args, **kwargs)
-    return wrapper
-
-
-def login_required(view_func):
         @wraps(view_func)
         def wrapper(*args, **kwargs):
-        if not is_logged_in():
+            if is_logged_in():
-            return redirect(url_for("users.log_in"))
+                return redirect(url_for(destination))
             return view_func(*args, **kwargs)
         return wrapper
-
-
-def mod_only(*args, **kwargs):
-    def decorator(view_func):
-        @wraps(view_func)
-        def wrapper(*view_args, **view_kwargs):
-            if not get_active_user().is_mod():
-                # resolve callables
-                processed_kwargs = {
-                    k: v(**view_kwargs) if callable(v) else v
-                    for k, v in kwargs.items()
-                }
-                endpoint = args[0] if args else processed_kwargs.get("endpoint")
-                if endpoint.startswith("."):
-                    blueprint = current_app.blueprints.get(view_func.__name__.split(".")[0])
-                    if blueprint:
-                        endpoint = endpoint.lstrip(".")
-                        return redirect(url_for(f"{blueprint.name}.{endpoint}", **processed_kwargs))
-                return redirect(url_for(*args, **processed_kwargs))
-            return view_func(*view_args, **view_kwargs)
-        return wrapper
     return decorator
 
-
+@bp.get('/log-in/')
-def admin_only(*args, **kwargs):
+@redirect_if_logged_in()
-    def decorator(view_func):
-        @wraps(view_func)
-        def wrapper(*view_args, **view_kwargs):
-            if not get_active_user().is_admin():
-                # resolve callables
-                processed_kwargs = {
-                    k: v(**view_kwargs) if callable(v) else v
-                    for k, v in kwargs.items()
-                }
-                endpoint = args[0] if args else processed_kwargs.get("endpoint")
-                if endpoint.startswith("."):
-                    blueprint = current_app.blueprints.get(view_func.__name__.split(".")[0])
-                    if blueprint:
-                        endpoint = endpoint.lstrip(".")
-                        return redirect(url_for(f"{blueprint.name}.{endpoint}", **processed_kwargs))
-                return redirect(url_for(*args, **processed_kwargs))
-            return view_func(*view_args, **view_kwargs)
-        return wrapper
-    return decorator
-
-
-def get_prefers_theme():
-    if not 'theme' in session:
-        return 'style'
-
-    if session['theme'] not in current_app.config['allowed_themes']:
-        return 'style'
-
-    return session['theme']
-
-
-def anonymize_user(user_id):
-    deleted_user = Users.find({'username': 'deleteduser'})
-
-    from ..models import Threads, Posts
-    from ..lib.babycode import sanitize
-    threads = Threads.findall({'user_id': user_id})
-    posts = Posts.findall({'user_id': user_id})
-
-    revs_q = """SELECT DISTINCT m.revision_id FROM mentions m
-            WHERE m.mentioned_user_id = ?"""
-
-    mentioned_revs = db.query(revs_q, int(user_id))
-    with db.transaction():
-        for thread in threads:
-            thread.update({'user_id': int(deleted_user.id)})
-        for post in posts:
-            post.update({'user_id': int(deleted_user.id)})
-
-        revs = {}
-        for rev in mentioned_revs:
-            ph = PostHistory.find({'id': int(rev['revision_id'])})
-            ms = Mentions.findall({
-                    'mentioned_user_id': int(user_id),
-                    'revision_id': int(rev['revision_id'])
-                })
-            data = {
-                'text': sanitize(ph.original_markup),
-                'mentions': ms,
-            }
-            data['mentions'] = sorted(data['mentions'], key=lambda x: int(x.end_index), reverse=True)
-            revs[rev['revision_id']] = data
-
-        for rev_id, data in revs.items():
-            text = data['text']
-            for mention in data['mentions']:
-                text = text[:mention.start_index] + '@deleteduser' + text[mention.end_index:]
-                mention.delete()
-
-            res = babycode_to_html(text)
-            ph = PostHistory.find({'id': int(rev_id)})
-            ph.update({
-                'original_markup': text.unescape(),
-                'content': res.result,
-            })
-
-
-@bp.get("/log_in")
-@redirect_if_logged_in(".page", username = lambda: get_active_user().username)
 def log_in():
-    return render_template("users/log_in.html")
+    return render_template('users/log_in.html')
 
-
+@bp.post('/log-out/')
-@bp.post("/log_in")
-@redirect_if_logged_in(".page", username = lambda: get_active_user().username)
-def log_in_post():
-    target_user = Users.find({
-        "username": request.form['username'].lower()
-    })
-    if not target_user:
-        flash("Incorrect username or password.", InfoboxKind.ERROR)
-        return redirect(url_for("users.log_in"))
-
-    if not verify(target_user.password_hash, request.form['password']):
-        flash("Incorrect username or password.", InfoboxKind.ERROR)
-        return redirect(url_for("users.log_in"))
-
-    session_obj = create_session(target_user.id)
-
-    session['pyrom_session_key'] = session_obj.key
-    flash("Logged in!", InfoboxKind.INFO)
-    return redirect(url_for("users.log_in"))
-
-
-@bp.get("/sign_up")
-@redirect_if_logged_in(".page", username = lambda: get_active_user().username)
-def sign_up():
-    if current_app.config['DISABLE_SIGNUP']:
-        key = request.args.get('key', default=None)
-        if key is None:
-            return redirect(url_for('topics.all_topics'))
-
-        invite = InviteKeys.find({'key': key})
-        if not invite:
-            return redirect(url_for('topics.all_topics'))
-
-        inviter = Users.find({'id': invite.created_by})
-        return render_template("users/sign_up.html", inviter=inviter, key=key)
-
-    return render_template("users/sign_up.html")
-
-
-@bp.post("/sign_up")
-@redirect_if_logged_in(".page", username = lambda: get_active_user().username)
-def sign_up_post():
-    key = request.form.get('key', default=None)
-
-    if current_app.config['DISABLE_SIGNUP']:
-        if not key:
-            return redirect(url_for("topics.all_topics"))
-        invite_key = InviteKeys.find({'key': key})
-        if not invite_key:
-            return redirect(url_for("topics.all_topics"))
-
-    username = request.form['username']
-    password = request.form['password']
-    password_confirm = request.form['password-confirm']
-
-    if not validate_username(username):
-        flash("Invalid username.", InfoboxKind.ERROR)
-        return redirect(url_for("users.sign_up", key=key))
-
-    user_exists = Users.count({"username": username.lower()}) > 0
-    if user_exists:
-        flash(f"Username '{username}' is already taken.", InfoboxKind.ERROR)
-        return redirect(url_for("users.sign_up", key=key))
-
-    if not validate_password(password):
-        flash("Invalid password.", InfoboxKind.ERROR)
-        return redirect(url_for("users.sign_up", key=key))
-
-    if password != password_confirm:
-        flash("Passwords do not match.", InfoboxKind.ERROR)
-        return redirect(url_for("users.sign_up", key=key))
-
-    hashed = digest(password)
-
-    if username.lower() != username:
-        display_name = username
-    else:
-        display_name = ''
-
-    with db.transaction():
-        new_user = Users.create({
-            "username": username.lower(),
-            'display_name': display_name,
-            "password_hash": hashed,
-            "permission": PermissionLevel.GUEST.value,
-        })
-
-        BookmarkCollections.create_default(new_user.id)
-
-        if current_app.config['DISABLE_SIGNUP']:
-            invite_key = InviteKeys.find({'key': key})
-            new_user.update({
-                'invited_by': invite_key.created_by,
-                'permission': PermissionLevel.USER.value,
-            })
-            invite_key.delete()
-
-        session_obj = create_session(new_user.id)
-
-        session['pyrom_session_key'] = session_obj.key
-    flash("Signed up successfully!", InfoboxKind.INFO)
-    return redirect(url_for("topics.all_topics"))
-
-
-@bp.get("/<username>")
-def page(username):
-    target_user = Users.find({"username": username.lower()})
-    if not target_user:
-        abort(404)
-    return render_template("users/user.html", target_user = target_user)
-
-
-@bp.get("/<username>/settings")
-@login_required
-@redirect_to_own
-def settings(username):
-    return render_template('users/settings.html')
-
-
-@bp.post('/<username>/settings')
-@login_required
-@redirect_to_own
-def settings_form(username):
-    # we silently ignore the passed username
-    # and grab the correct user from the session
-    user = get_active_user()
-    theme = request.form.get('theme', default='style')
-    if theme == 'style':
-        if 'theme' in session:
-            session.pop('theme')
-    else:
-        session['theme'] = theme
-    topic_sort_by = request.form.get('topic_sort_by', default='activity')
-    if topic_sort_by == 'activity' or topic_sort_by == 'thread':
-        sort_by = session['sort_by'] = topic_sort_by
-    status = request.form.get('status', default="")[:100]
-    original_sig = request.form.get('signature', default='').strip()
-    if original_sig:
-        rendered_sig = babycode_to_html(original_sig, SIG_BANNED_TAGS).result
-    else:
-        rendered_sig = ''
-    session['subscribe_by_default'] = request.form.get('subscribe_by_default', default='off') == 'on'
-    display_name = request.form.get('display_name', default='')
-    if not validate_display_name(display_name):
-        flash('Invalid display name.', InfoboxKind.ERROR)
-        return redirect('.settings', username=user.username)
-
-    old_dn = user.display_name
-
-    user.update({
-        'status': status,
-        'signature_original_markup': original_sig,
-        'signature_rendered': rendered_sig,
-        'signature_format_version': BABYCODE_VERSION,
-        'signature_markup_language': 'babycode',
-        'display_name': display_name,
-    })
-
-    if old_dn != display_name:
-        # re-parse mentions
-        q = """SELECT DISTINCT m.revision_id FROM mentions m
-            JOIN post_history ph ON m.revision_id = ph.id
-            JOIN posts p ON p.current_revision_id = ph.id
-            WHERE m.mentioned_user_id = ?"""
-        mentions = db.query(q, int(user.id))
-        with db.transaction():
-            for mention in mentions:
-                rev = PostHistory.find({'id': int(mention['revision_id'])})
-                parsed_content = babycode_to_html(rev.original_markup).result
-                rev.update({'content': parsed_content})
-
-    flash('Settings updated.', InfoboxKind.INFO)
-    return redirect(url_for('.settings', username=user.username))
-
-
-@bp.post('/<username>/set_avatar')
-@login_required
-@redirect_to_own
-def set_avatar(username):
-    user = get_active_user()
-    if user.is_guest():
-        flash('You are a guest. Your account must be confirmed by a moderator to perform this action.', InfoboxKind.ERROR)
-        return redirect(url_for('.settings', username=user.username))
-    if 'avatar' not in request.files:
-        flash('Avatar missing.', InfoboxKind.ERROR)
-        return redirect(url_for('.settings', username=user.username))
-
-    file = request.files['avatar']
-
-    if file.filename == '':
-        flash('Avatar missing.', InfoboxKind.ERROR)
-        return redirect(url_for('.settings', username=user.username))
-
-    file_bytes = file.read()
-
-    now = int(time.time())
-    filename = f"u{user.id}d{now}.webp"
-    output_path = os.path.join(current_app.config['AVATAR_UPLOAD_PATH'], filename)
-    proxied_filename = f"/static/avatars/{filename}"
-    res = validate_and_create_avatar(file_bytes, output_path)
-    if res:
-        flash('Avatar updated.', InfoboxKind.INFO)
-        avatar = Avatars.create({
-            'file_path': proxied_filename,
-            'uploaded_at': now,
-        })
-        old_avatar = Avatars.find({'id': user.avatar_id})
-        user.update({'avatar_id': avatar.id})
-        if int(old_avatar.id) != 1:
-            # delete old avi, but not default
-            filename = os.path.join(current_app.config['AVATAR_UPLOAD_PATH'], os.path.basename(old_avatar.file_path))
-            os.remove(filename)
-            old_avatar.delete()
-        return redirect(url_for('.settings', username=user.username))
-    else:
-        flash('Something went wrong. Please try again later.', InfoboxKind.WARN)
-        return redirect(url_for('.settings', username=user.username))
-
-
-@bp.post('/<username>/change_password')
-@login_required
-@redirect_to_own
-def change_password(username):
-    user = get_active_user()
-    password = request.form.get('new_password')
-    password2 = request.form.get('new_password2')
-
-    if not validate_password(password):
-        flash("Invalid password.", InfoboxKind.ERROR)
-        return redirect(url_for('.settings', username=user.username))
-
-    if password != password2:
-        flash("Passwords do not match.", InfoboxKind.ERROR)
-        return redirect(url_for('.settings', username=user.username))
-
-    hashed = digest(password)
-    user.update({'password_hash': hashed})
-    extend_session(user.id)
-    flash('Password updated.', InfoboxKind.INFO)
-    return redirect(url_for('.settings', username=user.username))
-
-
-@bp.post('/<username>/clear_avatar')
-@login_required
-@redirect_to_own
-def clear_avatar(username):
-    user = get_active_user()
-    if user.is_default_avatar():
-        return redirect(url_for('.settings', user.username))
-
-    old_avatar = Avatars.find({'id': user.avatar_id})
-    user.update({'avatar_id': 1})
-    # delete old avi
-    filename = os.path.join(current_app.config['AVATAR_UPLOAD_PATH'], os.path.basename(old_avatar.file_path))
-    os.remove(filename)
-    old_avatar.delete()
-    return redirect(url_for('.settings', username=user.username))
-
-
-@bp.post("/log_out")
 @login_required
 def log_out():
-    user = get_active_user()
+    return 'stub'
-    session_obj = Sessions.find({"key": session['pyrom_session_key']})
-    session_obj.delete()
-
-    session.clear()
-    return redirect(url_for(".log_in"))
-
-
-@bp.post("/confirm_user/<user_id>")
-@login_required
-@mod_only("topics.all_topics")
-def confirm_user(user_id):
-    target_user = Users.find({"id": user_id})
-    if not target_user:
-        return redirect(url_for('.all_topics'))
-    if int(target_user.permission) > PermissionLevel.GUEST.value:
-        return redirect(url_for('.page', username=target_user.username))
-
-    target_user.update({
-        "permission": PermissionLevel.USER.value,
-        "confirmed_on": int(time.time()),
-    })
-    return redirect(url_for(".page", username=target_user.username))
-
-
-@bp.post("/mod_user/<user_id>")
-@login_required
-@admin_only("topics.all_topics")
-def mod_user(user_id):
-    target_user = Users.find({"id": user_id})
-    if not target_user:
-        return redirect(url_for('.all_topics'))
-    if target_user.is_mod():
-        return redirect(url_for('.page', username=target_user.username))
-
-    target_user.update({
-        "permission": PermissionLevel.MODERATOR.value,
-    })
-    return redirect(url_for(".page", username=target_user.username))
-
-
-@bp.post("/demod_user/<user_id>")
-@login_required
-@admin_only("topics.all_topics")
-def demod_user(user_id):
-    target_user = Users.find({"id": user_id})
-    if not target_user:
-        return redirect(url_for('.all_topics'))
-    if not target_user.is_mod():
-        return redirect(url_for('.page', username=target_user.username))
-
-    target_user.update({
-        "permission": PermissionLevel.USER.value,
-    })
-    return redirect(url_for(".page", username=target_user.username))
-
-
-@bp.post("/guest_user/<user_id>")
-@login_required
-@mod_only("topics.all_topics")
-def guest_user(user_id):
-    target_user = Users.find({"id": user_id})
-    if not target_user:
-        return redirect(url_for('.all_topics'))
-    if get_active_user().is_mod_only() and target_user.is_mod():
-        return redirect(url_for('.page', username=target_user.username))
-
-    target_user.update({
-        "permission": PermissionLevel.GUEST.value,
-    })
-    return redirect(url_for(".page", username=target_user.username))
-
-
-@bp.get("/<username>/inbox")
-@login_required
-@redirect_to_own
-def inbox(username):
-    user = get_active_user()
-    new_posts = []
-    subscription = Subscriptions.find({"user_id": user.id})
-    all_subscriptions = None
-    total_unreads_count = None
-    if subscription:
-        all_subscriptions = user.get_all_subscriptions()
-        q = """
-            WITH thread_metadata AS (
-                SELECT
-                    posts.thread_id, threads.slug AS thread_slug, threads.title AS thread_title, COUNT(*) AS unread_count, MAX(posts.created_at) AS newest_post_time
-                FROM
-                    posts
-                LEFT JOIN
-                    threads ON threads.id = posts.thread_id
-                LEFT JOIN
-                    subscriptions ON subscriptions.thread_id = posts.thread_id
-                WHERE subscriptions.user_id = ? AND posts.created_at > subscriptions.last_seen
-                GROUP BY posts.thread_id
-            )
-
-            SELECT
-                tm.thread_id, tm.thread_slug, tm.thread_title, tm.unread_count, tm.newest_post_time,
-
-                posts.id, posts.created_at, post_history.content, post_history.edited_at, users.username, users.status, avatars.file_path AS avatar_path, posts.thread_id, users.id AS user_id, post_history.original_markup, users.signature_rendered
-            FROM
-                thread_metadata tm
-            JOIN
-                posts ON posts.thread_id = tm.thread_id
-            JOIN
-                post_history ON posts.current_revision_id = post_history.id
-            JOIN
-                users ON posts.user_id = users.id
-            LEFT JOIN
-                threads ON threads.id = posts.thread_id
-            LEFT JOIN
-                avatars ON users.avatar_id = avatars.id
-            LEFT JOIN
-                subscriptions ON subscriptions.thread_id = posts.thread_id
-            WHERE
-                subscriptions.user_id = ? AND posts.created_at > subscriptions.last_seen
-            ORDER BY
-                tm.newest_post_time DESC, posts.created_at ASC"""
-        new_posts_raw = db.query(q, user.id, user.id)
-        current_thread_id = None
-        current_thread_group = None
-        total_unreads_count = 0
-        for row in new_posts_raw:
-            if row['thread_id'] != current_thread_id:
-                current_thread_group = {
-                    'thread_id': row['thread_id'],
-                    'thread_title': row['thread_title'],
-                    'unread_count': row['unread_count'],
-                    'thread_slug': row['thread_slug'],
-                    'newest_post_time': row['newest_post_time'],
-                    'posts': [],
-                }
-                total_unreads_count += int(row['unread_count'])
-                new_posts.append(current_thread_group)
-                current_thread_id = row['thread_id']
-            current_thread_group['posts'].append({
-                'id': row['id'],
-                'created_at': row['created_at'],
-                'content': row['content'],
-                'edited_at': row['edited_at'],
-                'username': row['username'],
-                'status': row['status'],
-                'avatar_path': row['avatar_path'],
-                'thread_id': row['thread_id'],
-                'user_id': row['user_id'],
-                'original_markup': row['original_markup'],
-                'signature_rendered': row['signature_rendered'],
-
-                'thread_slug': row['thread_slug'],
-            })
-
-    return render_template("users/inbox.html", new_posts = new_posts, total_unreads_count = total_unreads_count, all_subscriptions = all_subscriptions)
-
-
-@bp.get('/reset-link/<key>')
-def reset_link_login(key):
-    reset_link = PasswordResetLinks.find({
-        'key': key
-    })
-    if not reset_link:
-        return redirect(url_for('topics.all_topics'))
-
-    if int(time.time()) > int(reset_link.expires_at):
-        reset_link.delete()
-        return redirect(url_for('topics.all_topics'))
-
-    target_user = Users.find({
-        'id': reset_link.user_id
-    })
-
-    return render_template('users/reset_link_login.html', username = target_user.username)
-
-
-@bp.post('/reset-link/<key>')
-def reset_link_login_form(key):
-    reset_link = PasswordResetLinks.find({
-        'key': key
-    })
-    if not reset_link:
-        return redirect('topics.all_topics')
-
-    if int(time.time()) > int(reset_link.expires_at):
-        reset_link.delete()
-        return redirect('topics.all_topics')
-
-    password = request.form.get('password')
-    password2 = request.form.get('password2')
-
-    if not validate_password(password):
-        flash("Invalid password.", InfoboxKind.ERROR)
-        return redirect(url_for('.reset_link_login', key=key))
-
-    if password != password2:
-        flash("Passwords do not match.", InfoboxKind.ERROR)
-        return redirect(url_for('.reset_link_login', key=key))
-
-    target_user = Users.find({
-        'id': reset_link.user_id
-    })
-    reset_link.delete()
-
-    hashed = digest(password)
-    target_user.update({'password_hash': hashed})
-    session_obj = create_session(target_user.id)
-
-    session['pyrom_session_key'] = session_obj.key
-    flash("Logged in!", InfoboxKind.INFO)
-
-    return redirect(url_for('.page', username=target_user.username))
-
-
-@bp.get('/<username>/invite-links/')
-@login_required
-@redirect_to_own
-def invite_links(username):
-    target_user = Users.find({
-        'username': username.lower()
-    })
-    if not target_user or not target_user.can_invite():
-        return redirect(url_for('.page', username=username))
-
-    invites = InviteKeys.findall({
-        'created_by': target_user.id
-    })
-
-    return render_template('users/invite_links.html', invites=invites)
-
-
-@bp.post('/<username>/invite-links/create')
-@login_required
-@redirect_to_own
-def create_invite_link(username):
-    target_user = Users.find({
-        'username': username.lower()
-    })
-    if not target_user or not target_user.can_invite():
-        return redirect(url_for('.page', username=username.lower()))
-
-    invite = InviteKeys.create({
-        'created_by': target_user.id,
-        'key': secrets.token_urlsafe(20),
-    })
-
-    return redirect(url_for('.invite_links', username=target_user.username))
-
-
-@bp.post('/<username>/invite-links/revoke')
-@login_required
-@redirect_to_own
-def revoke_invite_link(username):
-    target_user = Users.find({
-        'username': username.lower()
-    })
-    if not target_user or not target_user.can_invite():
-        return redirect(url_for('.page', username=username.lower()))
-
-    invite = InviteKeys.find({
-        'key': request.form.get('key'),
-    })
-
-    if not invite:
-        return redirect(url_for('.invite_links', username=target_user.username))
-
-    if invite.created_by != target_user.id:
-        return redirect(url_for('.invite_links', username=target_user.username))
-
-    invite.delete()
-
-    return redirect(url_for('.invite_links', username=target_user.username))
-
-
-@bp.get('/<username>/bookmarks')
-@login_required
-@redirect_to_own
-def bookmarks(username):
-    target_user = get_active_user()
-
-    collections = target_user.get_bookmark_collections()
-
-    return render_template('users/bookmarks.html', collections=collections)
-
-
-@bp.get('/<username>/bookmarks/collections')
-@login_required
-@redirect_to_own
-def bookmark_collections(username):
-    target_user = get_active_user()
-
-    collections = target_user.get_bookmark_collections()
-    return render_template('users/bookmark_collections.html', collections=collections)
-
-
-@bp.get('/<username>/delete-account')
-@login_required
-@redirect_to_own
-def delete_page(username):
-    target_user = get_active_user()
-
-    return render_template('users/delete_page.html')
-
-
-@bp.post('/<username>/delete-account')
-@login_required
-@redirect_to_own
-def delete_page_confirm(username):
-    target_user = get_active_user()
 
+@bp.post('/log-in/')
+@redirect_if_logged_in()
+def log_in_post():
+    username = request.form.get('username', default='').lower()
+    user = Users.find({'username': username})
+    if not user:
+        return redirect(url_for('.log_in', error='The username or password you entered is incorrect.'))
     password = request.form.get('password', default='')
+    if not verify(user.password_hash, password):
+        return redirect(url_for('.log_in', error='The username or password you entered is incorrect.'))
 
-    if not verify(target_user.password_hash, password):
+    session['remember'] = request.form.get('remember') == 'on'
-        flash('Incorrect password.', InfoboxKind.ERROR)
+    sess = create_session(user.id, not session['remember'])
-        return redirect(url_for('.delete_page', username=username))
+    session['pyrom_session_key'] = sess.key
+    if session['remember']:
+        session.permanent = True
+    return redirect(request.form.get('return_to', default=url_for('topics.all_topics')))
 
-    anonymize_user(target_user.id)
+@bp.get('/sign-up/')
-    sessions = Sessions.findall({'user_id': int(target_user.id)})
+@redirect_if_logged_in()
-    for session_obj in sessions:
+def sign_up():
-        session_obj.delete()
+    return render_template('users/sign_up.html')
+
+@bp.post('/sign-up/')
+@redirect_if_logged_in()
+def sign_up_post():
+    generic_error_page = redirect(url_for('.sign_up', error='The username or password you entered is invalid.'))
+    invalid_username_error_page = redirect(url_for('.sign_up', error='This username cannot be used. Please pick another.'))
+    passwords_error_page = redirect(url_for('.sign_up', error='The passwords do not match.'))
+    username = request.form.get('username', default='')
+    if not username:
+        return generic_error_page
+    if request.form.get('password') is None:
+        return generic_error_page
+    if len(request.form.getlist('password')) != 2:
+        return passwords_error_page
+    try:
+        username_pair = parse_username(username)
+    except ValueError:
+        return invalid_username_error_page
+    potential_user = Users.find({'username': username})
+    if potential_user:
+        return invalid_username_error_page
+
+    if not compare_timesafe(request.form.getlist('password')[0], request.form.getlist('password')[1]):
+        return passwords_error_page
+
+    password_hash = digest(request.form.get('password'))
+
+    user = Users.create({
+        'username': username_pair[0],
+        'password_hash': password_hash,
+        'permission': PermissionLevel.GUEST.value,
+        'created_at': int(time.time()),
+    })
+
+    if username_pair[0] != username_pair[1]:
+        user.update({
+            'display_name': username_pair[1]
+        })
+
+    session['remember'] = request.form.get('remember') == 'on'
+    sess = create_session(user.id, not session['remember'])
+    session['pyrom_session_key'] = sess.key
+    if session['remember']:
+        session.permanent = True
 
-    session.clear()
-    target_user.delete()
     return redirect(url_for('topics.all_topics'))
+
+@bp.get('/<username>/')
+def user_page(username):
+    target_user = Users.find({'username': username})
+    if not target_user:
+        abort(404)
+    return render_template('users/user_page.html', target_user=target_user)
+
+@bp.get('/<username>/posts/')
+def posts(username):
+    return 'stub'
+
+@bp.get('/<username>/threads/')
+def threads(username):
+    return 'stub'
+
+@bp.get('/<username>/comments/')
+def comments(username):
+    return 'stub'
+
+@bp.get('/<username>/settings/')
+def settings(username):
+    return 'stub'
+
+@bp.get('/<username>/inbox/')
+def inbox(username):
+    return 'stub'
+
+@bp.get('/<username>/bookmarks/')
+def bookmarks(username):
+    return 'stub'
+

app/schema.py

@@ -141,37 +141,57 @@ SCHEMA = [
     "original_mention_text" TEXT NOT NULL
     )""",
 
+    """CREATE TABLE IF NOT EXISTS "badge_uploads" (
+    "id" INTEGER NOT NULL PRIMARY KEY,
+    "file_path" TEXT NOT NULL UNIQUE,
+    "uploaded_at" INTEGER DEFAULT (unixepoch(CURRENT_TIMESTAMP)),
+    "original_filename" TEXT,
+    "user_id" REFERENCES users(id) ON DELETE CASCADE
+    )""",
+
+    """CREATE TABLE IF NOT EXISTS "badges" (
+    "id" INTEGER NOT NULL PRIMARY KEY,
+    "user_id" NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    "upload" NOT NULL REFERENCES badge_uploads(id) ON DELETE CASCADE,
+    "label" TEXT NOT NULL,
+    "link" TEXT DEFAULT '',
+    "sort_order" INTEGER NOT NULL DEFAULT 0
+    )""",
+
     # INDEXES
-    "CREATE INDEX IF NOT EXISTS idx_post_history_post_id ON post_history(post_id)",
+    'CREATE INDEX IF NOT EXISTS idx_post_history_post_id ON post_history(post_id)',
-    "CREATE INDEX IF NOT EXISTS idx_posts_thread ON posts(thread_id, created_at, id)",
+    'CREATE INDEX IF NOT EXISTS idx_posts_thread ON posts(thread_id, created_at, id)',
-    "CREATE INDEX IF NOT EXISTS idx_posts_thread_id ON posts(thread_id)",
+    'CREATE INDEX IF NOT EXISTS idx_posts_thread_id ON posts(thread_id)',
-    "CREATE INDEX IF NOT EXISTS idx_rate_limit_user_method ON api_rate_limits (user_id, method)",
+    'CREATE INDEX IF NOT EXISTS idx_rate_limit_user_method ON api_rate_limits (user_id, method)',
-    "CREATE INDEX IF NOT EXISTS idx_subscription_user_thread ON subscriptions (user_id, thread_id)",
+    'CREATE INDEX IF NOT EXISTS idx_subscription_user_thread ON subscriptions (user_id, thread_id)',
-    "CREATE INDEX IF NOT EXISTS idx_threads_slug ON threads(slug)",
+    'CREATE INDEX IF NOT EXISTS idx_threads_slug ON threads(slug)',
-    "CREATE INDEX IF NOT EXISTS idx_threads_topic_id ON threads(topic_id)",
+    'CREATE INDEX IF NOT EXISTS idx_threads_topic_id ON threads(topic_id)',
-    "CREATE INDEX IF NOT EXISTS idx_topics_slug ON topics(slug)",
+    'CREATE INDEX IF NOT EXISTS idx_topics_slug ON topics(slug)',
-    "CREATE INDEX IF NOT EXISTS session_keys ON sessions(key)",
+    'CREATE INDEX IF NOT EXISTS session_keys ON sessions(key)',
-    "CREATE INDEX IF NOT EXISTS sessions_user_id ON sessions(user_id)",
+    'CREATE INDEX IF NOT EXISTS sessions_user_id ON sessions(user_id)',
 
-    "CREATE INDEX IF NOT EXISTS reaction_post_text ON reactions(post_id, reaction_text)",
+    'CREATE INDEX IF NOT EXISTS reaction_post_text ON reactions(post_id, reaction_text)',
-    "CREATE INDEX IF NOT EXISTS reaction_user_post_text ON reactions(user_id, post_id, reaction_text)",
+    'CREATE INDEX IF NOT EXISTS reaction_user_post_text ON reactions(user_id, post_id, reaction_text)',
 
-    "CREATE INDEX IF NOT EXISTS idx_bookmark_collections_user_id ON bookmark_collections(user_id)",
+    'CREATE INDEX IF NOT EXISTS idx_bookmark_collections_user_id ON bookmark_collections(user_id)',
-    "CREATE INDEX IF NOT EXISTS idx_bookmark_collections_user_default ON bookmark_collections(user_id, is_default) WHERE is_default = 1",
+    'CREATE INDEX IF NOT EXISTS idx_bookmark_collections_user_default ON bookmark_collections(user_id, is_default) WHERE is_default = 1',
 
-    "CREATE INDEX IF NOT EXISTS idx_bookmarked_posts_collection ON bookmarked_posts(collection_id)",
+    'CREATE INDEX IF NOT EXISTS idx_bookmarked_posts_collection ON bookmarked_posts(collection_id)',
-    "CREATE INDEX IF NOT EXISTS idx_bookmarked_posts_post ON bookmarked_posts(post_id)",
+    'CREATE INDEX IF NOT EXISTS idx_bookmarked_posts_post ON bookmarked_posts(post_id)',
 
-    "CREATE INDEX IF NOT EXISTS idx_bookmarked_threads_collection ON bookmarked_threads(collection_id)",
+    'CREATE INDEX IF NOT EXISTS idx_bookmarked_threads_collection ON bookmarked_threads(collection_id)',
-    "CREATE INDEX IF NOT EXISTS idx_bookmarked_threads_thread ON bookmarked_threads(thread_id)",
+    'CREATE INDEX IF NOT EXISTS idx_bookmarked_threads_thread ON bookmarked_threads(thread_id)',
 
-    "CREATE INDEX IF NOT EXISTS idx_mentioned_user ON mentions(mentioned_user_id)",
+    'CREATE INDEX IF NOT EXISTS idx_mentioned_user ON mentions(mentioned_user_id)',
-    "CREATE INDEX IF NOT EXISTS idx_mention_revision_id ON mentions(revision_id)",
+    'CREATE INDEX IF NOT EXISTS idx_mention_revision_id ON mentions(revision_id)',
+
+    'CREATE INDEX IF NOT EXISTS idx_badge_upload_user ON badge_uploads(user_id)',
+    'CREATE INDEX IF NOT EXISTS idx_badge_user ON badges(user_id)',
 ]
 
 def create():
-    print("Creating schema...")
+    print('Creating schema...')
     with db.transaction():
         for stmt in SCHEMA:
             db.execute(stmt)
-    print("Schema completed.")
+    print('Schema completed.')

app/templates/base.html

@@ -1,29 +1,19 @@
-{% from 'common/macros.html' import infobox with context %}
+<!DOCTYPE html>
-<!DOCTYPE HTML>
 <html lang="en">
-<head>
+  <head>
-  <meta charset="UTF-8">
+    <meta charset="utf-8">
-  {% if self.title() %}
+    <meta name="viewport" content="width=device-width, initial-scale=1">
-    <title>{{config.SITE_NAME}} - {% block title %}{% endblock %}</title>
-  {% else %}
-    <title>{{config.SITE_NAME}}</title>
-  {% endif %}
-  <link rel="stylesheet" href="{{ ("/static/css/%s.css" % get_prefers_theme()) | cachebust }}">
     <link rel="icon" type="image/png" href="/static/favicon.png">
-  <script src="{{ '/static/js/vnd/bitty-7.0.0-rc1.min.js' | cachebust }}" type="module"></script>
+    <link rel="stylesheet" href="{{ "/static/css/style.css" | cachebust }}">
-</head>
+    {% if self.title() -%}
-<body>
+    <title>{{ config.SITE_NAME }} - {% block title -%}{%- endblock -%}</title>
-  <bitty-7-0 data-connect="{{ '/static/js/bitties/pyrom-bitty.js' | cachebust }}">
+    {%- else -%}
-    {% include 'common/topnav.html' %}
+    <title>{{ config.SITE_NAME }}</title>
-    {% with messages = get_flashed_messages(with_categories=true) %}
+    {%- endif -%}
-      {% if messages %}
+  </head>
-        {% for category, message in messages %}
+  <body>
-          {{ infobox(message, category) }}
+    {%- include 'common/topnav.html' -%}
-        {% endfor %}
+    {%- block content -%}{%- endblock -%}
-      {% endif %}
+    {%- include 'common/footer.html' -%}
-    {% endwith %}
+  </body>
-    {% block content %}{% endblock %}
+</html>
-    {% include 'common/footer.html' %}
-  </bitty-7-0>
-  <script src="{{ "/static/js/ui.js" | cachebust }}"></script>
-</body>

app/templates/common/404.html

@@ -1,8 +1,8 @@
-{% extends 'base.html' %}
+{%- from 'common/macros.html' import subheader -%}
-{% block title %}not found{% endblock %}
+{%- extends 'base.html' -%}
-{% block content %}
+{%- block title -%}Not found{%- endblock -%}
-  <div class="darkbg settings-container">
+{%- block content -%}
-  	<h1 class="thread-title">404 Not Found</h1>
+{%- call() subheader('404 Not Found') -%}
-  	<p>The requested URL does not exist.</p>
+<span>The requested URL was not found.</span>
-  </div>
+{%- endcall -%}
-{% endblock %}
+{%- endblock -%}

app/templates/common/footer.html

@@ -1,7 +1,7 @@
-<footer id="footer">
+<footer class="plank secondary-bg bottom">
   <span>Pyrom commit <a href="{{ "https://git.poto.cafe/yagich/pyrom/commit/" + __commit }}">{{ __commit[:8] }}</a></span>
   <ul class="horizontal">
-  	<li><a href="{{ url_for('guides.contact') }}">Contact</a></li>
+    <li><a href="{{url_for('guides.contact')}}">Contact</a></li>
-  	<li><a href="{{ url_for('guides.guides_index') }}">Guides</a></li>
+    <li><a href="{{url_for('guides.index')}}">Guides</a></li>
   </ul>
 </footer>

app/templates/common/icons.html

@@ -1,55 +0,0 @@
-{# https://www.figma.com/community/file/1136337054881623512/iconcino-v2-0-0-free-icons-cc0-1-0-license #}
-
-{% macro icn_bookmark(width=24) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path fill-rule="evenodd" clip-rule="evenodd" d="M6 6C6 4.89543 6.89543 4 8 4H16C17.1046 4 18 4.89543 18 6V18.7268C18 19.5969 16.9657 20.0519 16.3243 19.4639L12 15.5L7.67573 19.4639C7.03432 20.0519 6 19.5969 6 18.7268V6Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_error(width=60) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M18.364 5.63604C19.9926 7.26472 21 9.51472 21 12C21 16.9706 16.9706 21 12 21C9.51472 21 7.26472 19.9926 5.63604 18.364M18.364 5.63604C16.7353 4.00736 14.4853 3 12 3C7.02944 3 3 7.02944 3 12C3 14.4853 4.00736 16.7353 5.63604 18.364M18.364 5.63604L5.63604 18.364" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_info(width=60) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M12 8V8.5M12 12V16M12 21C16.9706 21 21 16.9706 21 12C21 7.02944 16.9706 3 12 3C7.02944 3 3 7.02944 3 12C3 16.9706 7.02944 21 12 21Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_lock(width=60) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M12 14V16M8 9V6C8 3.79086 9.79086 2 12 2C14.2091 2 16 3.79086 16 6V9M7 21H17C18.1046 21 19 20.1046 19 19V11C19 9.89543 18.1046 9 17 9H7C5.89543 9 5 9.89543 5 11V19C5 20.1046 5.89543 21 7 21Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_warn(width=60) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M12 15H12.01M12 12V9M4.98207 19H19.0179C20.5615 19 21.5233 17.3256 20.7455 15.9923L13.7276 3.96153C12.9558 2.63852 11.0442 2.63852 10.2724 3.96153L3.25452 15.9923C2.47675 17.3256 3.43849 19 4.98207 19Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_image(width=24) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M4 17L7.58959 13.7694C8.38025 13.0578 9.58958 13.0896 10.3417 13.8417L11.5 15L15.0858 11.4142C15.8668 10.6332 17.1332 10.6332 17.9142 11.4142L20 13.5M11 9C11 9.55228 10.5523 10 10 10C9.44772 10 9 9.55228 9 9C9 8.44772 9.44772 8 10 8C10.5523 8 11 8.44772 11 9ZM6 20H18C19.1046 20 20 19.1046 20 18V6C20 4.89543 19.1046 4 18 4H6C4.89543 4 4 4.89543 4 6V18C4 19.1046 4.89543 20 6 20Z" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_spoiler(width=24) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M4 4L9.87868 9.87868M20 20L14.1213 14.1213M9.87868 9.87868C9.33579 10.4216 9 11.1716 9 12C9 13.6569 10.3431 15 12 15C12.8284 15 13.5784 14.6642 14.1213 14.1213M9.87868 9.87868L14.1213 14.1213M6.76821 6.76821C4.72843 8.09899 2.96378 10.026 2 11.9998C3.74646 15.5764 8.12201 19 11.9998 19C13.7376 19 15.5753 18.3124 17.2317 17.2317M9.76138 5.34717C10.5114 5.12316 11.2649 5 12.0005 5C15.8782 5 20.2531 8.42398 22 12.0002C21.448 13.1302 20.6336 14.2449 19.6554 15.2412" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_sticky(width=24) -%}
-<svg class="icon" width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M13 20H6C4.89543 20 4 19.1046 4 18V6C4 4.89543 4.89543 4 6 4H18C19.1046 4 20 4.89543 20 6V13M13 20L20 13M13 20V14C13 13.4477 13.4477 13 14 13H20" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}
-
-{% macro icn_megaphone(width=60) -%}
-<svg width="{{width}}px" height="{{width}}px" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
-<path d="M6 18V14M6 14H8L13 17V7L8 10H5C3.89543 10 3 10.8954 3 12V12C3 13.1046 3.89543 14 5 14H6ZM17 7L19 5M17 17L19 19M19 12H21" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
-</svg>
-{%- endmacro %}

app/templates/common/macros.html

@@ -1,308 +1,182 @@
-{% from 'common/icons.html' import icn_image, icn_spoiler, icn_info, icn_lock, icn_warn, icn_error, icn_bookmark, icn_megaphone %}
-{% macro pager(current_page, page_count) %}
-{% set left_start = [1, current_page - 5] | max %}
-{% set right_end = [page_count, current_page + 5] | min %}
-<div class="pager">
-  <span>Page:</span>
-  {% if current_page > 5 %}
-    <a href="?page=1" class="pagebutton">1</a>
-    {% if left_start > 2 %}
-      <span class="currentpage">&hellip;</span>
-    {% endif %}
-  {% endif %}
-  {% for i in range(left_start, current_page) %}
-    <a href="?page={{i}}" class="pagebutton">{{i}}</a>
-  {% endfor %}
-  {% if page_count > 0 %}
-    <span class="currentpage">{{current_page}}</span>
-  {% endif %}
-  {% for i in range(current_page + 1, right_end + 1) %}
-    <a href="?page={{i}}" class="pagebutton">{{i}}</a>
-  {% endfor %}
-  {% if right_end < page_count %}
-    {% if right_end < page_count - 1 %}
-      <span class="currentpage">&hellip;</span>
-    {% endif %}
-    <a href="?page={{page_count}}" class="pagebutton">{{page_count}}</a>
-  {% endif %}
-</div>
-{% endmacro %}
-
-{% macro bookmark_button(type, id, message = "Bookmark&hellip;", require_reload=false) %}
-{% set bid = type[0] + id | string %}
-<div class="bookmark-dropdown">
-<button type="button" class="contain-svg inline icon" data-bookmark-type="{{type}}" data-send="showBookmarkMenu" data-concept-id="{{id}}" data-bookmark-id="{{bid}}">{{ icn_bookmark(20) }}{{ message | safe }}</button>
-<div class="bookmark-dropdown-inner" data-receive="showBookmarkMenu" data-bookmark-id="{{bid}}" data-require-reload={{require_reload | int}}></div>
-</div>
-{% endmacro %}
-
-{% macro infobox(message, kind=InfoboxKind.INFO) %}
-<div class="{{ "infobox " + InfoboxHTMLClass[kind] }}">
-  <span>
-    <div class="infobox-icon-container">
-      {%- if kind == InfoboxKind.INFO -%}
-      {{- icn_info() -}}
-      {%- elif kind == InfoboxKind.LOCK -%}
-      {{- icn_lock() -}}
-      {%- elif kind == InfoboxKind.WARN -%}
-      {{- icn_warn() -}}
-      {%- elif kind == InfoboxKind.ERROR -%}
-      {{- icn_error() -}}
-      {%- endif -%}
-    </div>
-    <span>
-      {% set m = message.split(';', maxsplit=1) %}
-      <strong>{{ m[0] }}</strong>
-      {%- if m[1] %}
-      {{ m[1] -}}
-      {%- endif -%}
-    </span>
-  </span>
-</div>
-{% endmacro %}
-
-{% macro motd(motd_obj) %}
-<div class="motd">
-  <div class="motd-icon-container contain-svg">
-  {{ icn_megaphone(80) }}
-  <i><abbr title="Message of the Day">MOTD</abbr></i>
-  </div>
-  <div class="motd-content-container">
-    <div class="motd-title">{{ motd_obj.title }}</div>
-    <div class="motd-body">{{ motd_obj.body_rendered | safe}}</div>
-  </div>
-</div>
-{% endmacro %}
-
 {% macro timestamp(unix_ts) -%}
-<span class="timestamp" data-utc="{{ unix_ts }}" data-init="convertTimestamps">{{ unix_ts | ts_datetime('%Y-%m-%d %H:%M')}} <abbr title="Server Time">ST</abbr></span>
+<span class="timestamp" data-utc="{{ unix_ts }}">{{ unix_ts | ts_datetime('%Y-%m-%d %H:%M')}} <abbr title="Server Time">ST</abbr></span>
 {%- endmacro %}
 
-{% macro babycode_editor_component(ta_name, ta_placeholder="Post body", optional=False, prefill="", banned_tags=[]) %}
+{% macro subheader(title, desc='') -%}
-<div class="babycode-editor-container tab-bar" data-receive="toggleTab">
+<div id="subheader" class="plank secondary-bg">
-  <input type="hidden" id="babycode-banned-tags" value="{{banned_tags | unique | list | tojson | forceescape}}">
+  <h1 class="info">{{title}}</h1>
-  <div class="tab-buttons">
+  {%- if desc -%}<span>{{desc}}</span>{%- endif -%}
-    <button data-send="toggleTab" type=button class="tab-button active" data-target-id="tab-edit">Write</button>
+  <div class="actions-group">{% if caller %}{{- caller() -}}{% endif %}</div>
-    <button data-send="babycodePreview toggleTab" type=button class="tab-button" data-target-id="tab-preview">Preview</button>
-  </div>
-  <div class="tab-content active" id="tab-edit">
-    <span class="babycode-button-container">
-      <button data-send="insertBabycodeTag" data-tag="b" class="babycode-button" type=button id="post-editor-bold" title="Insert Bold" {{"disabled" if "b" in banned_tags else ""}}><strong>B</strong></button>
-      <button data-send="insertBabycodeTag" data-tag="i" class="babycode-button" type=button id="post-editor-italics" title="Insert Italics" {{"disabled" if "i" in banned_tags else ""}}><em>I</em></button>
-      <button data-send="insertBabycodeTag" data-tag="s" class="babycode-button" type=button id="post-editor-strike" title="Insert Strikethrough" {{"disabled" if "s" in banned_tags else ""}}><del>S</del></button>
-      <button data-send="insertBabycodeTag" data-tag="u" class="babycode-button" type=button id="post-editor-underline" title="Insert Underline" {{"disabled" if "u" in banned_tags else ""}}><u>U</u></button>
-      <button data-send="insertBabycodeTag" data-tag="url=" data-prefill="link label" class="babycode-button" type=button id="post-editor-url" title="Insert Link" {{"disabled" if "url" in banned_tags else ""}}><code>://</code></button>
-      <button data-send="insertBabycodeTag" data-tag="code=" data-break-line="1" class="babycode-button" type=button id="post-editor-code" title="Insert Code block" {{"disabled" if "code" in banned_tags else ""}}><code>&lt;/&gt;</code></button>
-      <button data-send="insertBabycodeTag" data-tag="img=" data-prefill="alt text" class="babycode-button contain-svg" type=button id="post-editor-img" title="Insert Image" {{"disabled" if "img" in banned_tags else ""}}>{{ icn_image() }}</button>
-      <button data-send="insertBabycodeTag" data-tag="ol" data-break-line="1" class="babycode-button" type=button id="post-editor-ol" title="Insert Ordered list" {{"disabled" if "ol" in banned_tags else ""}}>1.</button>
-      <button data-send="insertBabycodeTag" data-tag="ul" data-break-line="1" class="babycode-button" type=button id="post-editor-ul" title="Insert Unordered list" {{"disabled" if "u;" in banned_tags else ""}}>&bullet;</button>
-      <button data-send="insertBabycodeTag" data-tag="spoiler=" data-break-line="1" data-prefill="hidden content" class="babycode-button contain-svg" type=button id="post-editor-spoiler" title="Insert spoiler" {{"disabled" if "spoiler" in banned_tags else ""}}>{{ icn_spoiler() }}</button>
-    </span>
-    <textarea class="babycode-editor" name="{{ ta_name }}" id="babycode-content" placeholder="{{ ta_placeholder }}" {{ "required" if not optional else "" }} autocomplete="off" data-receive="insertBabycodeTag addQuote">{{ prefill }}</textarea>
-    <a href="{{ url_for("guides.guide_page", category='user', slug='babycode') }}" target="_blank">babycode guide</a>
-    {% if banned_tags %}
-    <div>Forbidden tags:</div>
-    <div>
-      <ul class="horizontal">
-        {% for tag in banned_tags | unique %}
-        <li><code class="inline-code">{{ tag }}</code></li>
-        {% endfor %}
-      </ul>
-    </div>
-    {% endif %}
-  </div>
-  <div class="tab-content" id="tab-preview" data-receive="babycodePreview">
-    <div id="babycode-preview-errors-container">Type something!</div>
-    <div id="babycode-preview-container"></div>
-  </div>
 </div>
-<script src="{{ "/static/js/babycode-editor.js" | cachebust }}"></script>
+{%- endmacro %}
-{% endmacro %}
 
-{% macro babycode_editor_form(ta_name, prefill = "", cancel_url="", endpoint="") %}
+{% macro pager(current_page, page_count, classes='', url='', args={}) -%}
-{% set save_button_text = "Post reply" if not cancel_url else "Save" %}
+{%- set args = dict(args.items() | rejectattr(0, 'equalto', 'page')) -%}
-<form class="post-edit-form" method="post" {%- if endpoint %}action={{ endpoint }}{% endif %}>
+{%- if args -%}
-  {{babycode_editor_component(ta_name, prefill = prefill)}}
+{#- remove the page query argument -#}
-  {% if not cancel_url %}
+{%- set url = url + (args | dict_to_query_string) + '&page=' -%}
-    <span>
+{%- else -%}
-      <input type="checkbox" id="subscribe" name="subscribe" {{ "checked" if session.get('subscribe_by_default', default=true) else "" }}>
+{%- set url = url + '?page=' -%}
-      <label for="subscribe">Subscribe to thread</label>
+{%- endif -%}
+<span class="button-row {{classes}}">
+{%- if current_page == 0 -%}
+  {%- if page_count <= 3 -%}
+    {%- for i in range(page_count) -%}
+      <a href="{{url}}{{i+1}}" class="linkbutton minimal">{{i+1}}</a>
+    {%- endfor -%}
+  {%- else -%}
+    <a href="{{url}}1" class="linkbutton minimal">1</a>
+    <a href="{{url}}2" class="linkbutton minimal">2</a>
+    <button class="minimal" disabled>&hellip;</button>
+    <a href="{{url}}{{page_count - 1}}" class="linkbutton minimal">{{page_count - 1}}</a>
+    <a href="{{url}}{{page_count}}" class="linkbutton minimal">{{page_count}}</a>
+  {%- endif -%}
+{%- else -%}
+  {%- set left_start = [2, current_page - 1] | max -%}
+  {%- set right_end = [page_count - 1, current_page + 1] | min -%}
+
+  {%- if current_page != 1 -%}
+  <a href="{{url}}1" class="linkbutton minimal">1</a>
+  {%- endif -%}
+
+  {%- if left_start > 2 -%}
+  <button class="minimal" disabled>&hellip;</button>
+  {%- endif -%}
+
+  {%- for i in range(left_start, current_page) -%}
+  <a href="{{url}}{{i}}" class="linkbutton minimal">{{i}}</a>
+  {%- endfor -%}
+
+  {%- if page_count > 0 -%}
+  <button class="minimal" disabled>{{current_page}}</button>
+  {%- endif -%}
+
+  {%- for i in range(current_page + 1, right_end + 1) -%}
+  <a href="{{url}}{{i}}" class="linkbutton minimal">{{i}}</a>
+  {%- endfor -%}
+
+  {%- if right_end < page_count - 1 -%}
+  <button class="minimal" disabled>&hellip;</button>
+  {%- endif -%}
+
+  {%- if page_count > 1 and current_page != page_count -%}
+  <a href="{{url}}{{page_count}}" class="linkbutton minimal">{{page_count}}</a>
+  {%- endif -%}
+{%- endif -%}
+</span>
+{%- endmacro %}
+
+{% macro tabs(prefix='', labels = []) -%}
+<div class="tab-container">
+  <div class="tab-bar" role="tablist">
+    {%- for tab_label in labels -%}
+    <button type="button" class="tab-button" role="tab" aria-selected="{{'true' if loop.index0==0 else 'false'}}" id="{{prefix+'-'+(tab_label | lower)+'-tab'}}" aria-controls="{{prefix+'-'+(tab_label | lower)+'-content'}}">{{tab_label}}</button>
+    {%- endfor -%}
+  </div>
+  {%- for tab_label in labels -%}
+  <div class="plank secondary-bg even no-shadow tab-content {{'hidden' if loop.index0!=0 else ''}}" role="tabpanel" aria-labelledby="{{prefix+'-'+(tab_label | lower)+'-tab'}}" id="{{prefix+'-'+(tab_label | lower)+'-content'}}">
+    {{- caller(loop.index0) -}}
+  </div>
+  {%- endfor -%}
+</div>
+{%- endmacro %}
+
+{% macro babycode_editor_component(
+  placeholder='Post content',
+  prefill='',
+  required=true,
+  id='babycode-content'
+) -%}
+{%- call(idx) tabs(prefix='babycode', labels=['Write', 'Preview']) -%}
+{%- if idx == 0 -%}
+<span class="babycode-editor-controls">
+  <span class="button-row">
+    <button type="button" class="minimal"><b>B</b></button>
+    <button type="button" class="minimal"><i>i</i></button>
+    <button type="button" class="minimal"><s>S</s></button>
+    <button type="button" class="minimal"><u>U</u></button>
+    <button type="button" class="minimal"><code>://</code></button>
+    <button type="button" class="minimal"><code>&lt;/&gt;</code></button>
+    <button type="button" class="minimal">1.</button>
+    <button type="button" class="minimal">&bullet;</button>
+    <button type="button" class="minimal"><img src="/static/emoji/angry.png" class="emoji"></button>
   </span>
-  {% endif %}
+  <a href="##">babycode help</a>
-  <span>
+</span>
-    <input type="submit" value="{{ save_button_text }}">
+<textarea name="babycode_content" id="{{id}}" class="babycode-editor" placeholder="{{placeholder}}" {{'required' if required else ''}}>{{ prefill }}</textarea>
-    {% if cancel_url %}
+{%- endif -%}
-      <a class="linkbutton warn" href="{{ cancel_url }}">Cancel</a>
+{%- endcall -%}
-    {% endif %}
+{%- endmacro %}
-  </span>
-</form>
-{% endmacro %}
 
 {% macro full_post(
-  post, render_sig = True, is_latest = False,
+  post, render_sig=true, is_latest=false,
-  editing = False, active_user = None, no_reply = false,
+  show_toolbar=true, is_editing=false, thread=none,
-  Reactions = none, show_thread_title = false,
+  show_reactions=true
-  show_bookmark = false, memo = None, bookmark_message = "Bookmark&hellip;",
+) -%}
-  reload_after_bookmark = false
+{%- if is_logged_in() -%}
-) %}
+{%- set can_delete = post.user_id == get_active_user().id or is_mod() -%}
-{% set postclass = "post" %}
+{%- else -%}
-{% if editing %}
+{%- set show_toolbar = false -%}
-  {% set postclass = postclass + " editing" %}
+{%- endif -%}
-{% endif %}
+{%- set owns = is_logged_in() and post.user_id == get_active_user().id -%}
-{% set post_permalink = url_for("threads.thread", slug = post['thread_slug'], after = post['id'], _anchor = ("post-" + (post['id'] | string))) %}
+{%- set can_reply = (is_logged_in()) and (not thread.locked or is_mod()) -%}
-<div class=" {{ postclass }}" id="post-{{ post['id'] }}" data-post-id="{{ post['id'] }}">
+<div class="usercard plank even contrast-bg minimal no-shadow">
-  <div class="usercard">
   <div class="usercard-inner">
-      <a href="{{ url_for("users.page", username=post['username']) }}" style="display: contents;">
+    <img src="{{post.avatar_path}}" class="avatar">
-      <img src="{{ post['avatar_path'] }}" class="avatar">
+    <div class="usercard-rest">
-      </a>
+      <a href="{{url_for('users.user_page', username=post.username)}}">{{post.display_name if post.display_name else post.username}}</a>
-      <a href="{{ url_for("users.page", username=post['username']) }}" class="username-link">{{ post['display_name'] or post['username'] }}</a>
+      <abbr title="mention">@{{post.username}}</abbr>
-      <em><abbr title="Mention">@{{ post.username }}</abbr></em>
+      <i>{{post.status}}</i>
-      {% if post['status'] %}
+      {%- set badges=post.badges_json | fromjson -%}
-        <em class="user-status">{{ post['status'] }}</em>
+      <div class="badges-container">
-      {% endif %}
+        {%- for badge in badges -%}
+        {%- if badge.link -%}<a href="{{badge.link}}">{%- endif -%}
+        <img src="{{badge.file_path}}" alt="{{badge.label}}" title="{{badge.label}}" class="badge-button">
+        {%- if badge.link -%}</a>{%- endif -%}
+        {%- endfor -%}
       </div>
     </div>
-
+  </div>
-  <div class="post-content-container" {{ "id=latest-post" if is_latest else "" }}>
+</div>
-    <div class="post-info">
+<div class="post-content">
-      <span>
+  <div class="plank even minimal secondary-bg no-shadow post-info">
-      {% if memo -%}
+    <a href="{{get_post_url(post.id, _anchor=true)}}"><i>Posted on {{timestamp(post.created_at)}}</i></a>
-        Memo: <i>{{ memo }}</i> &bullet;
+    {%- if show_toolbar -%}
-      {%- endif %}
-      {% if show_thread_title %}
-        <a href="{{ url_for('threads.thread', slug=post.thread_slug) }}">Thread: {{ post.thread_title }}</a>
-        &bullet;
-      {% endif %}
-      <a href="{{ post_permalink }}" title="Permalink"><i>
-        {% if (post['edited_at'] | int) > (post['created_at'] | int) %}
-          Edited on {{ timestamp(post['edited_at']) }}
-        {% else %}
-          Posted on {{ timestamp(post['edited_at']) }}
-        {% endif %}
-      </i></a>
-      </span>
     <span class="thread-actions">
-        {% set show_edit = false %}
+      {%- if owns -%}
-        {% if active_user %}
+      <a class="linkbutton" href="{{url_for('posts.edit', post_id=post.id)}}">Edit</a>
-          {% set show_edit = (active_user.id | string) == (post['user_id'] | string) and (not post['thread_is_locked'] or active_user.is_mod()) and not no_reply %}
+      {%- endif -%}
-        {% endif %}
+      {%- if can_reply -%}
-        {% if show_edit %}
+      <button disabled title="This feature requires JavaScript to be enabled.">Quote</button>
-          <a class="linkbutton" href="{{ url_for('posts.edit', post_id=post.id, _anchor='babycode-content') }}">Edit</a>
+      {%- endif -%}
-        {% endif %}
+      {%- if can_delete -%}
-
+      <a class="linkbutton critical" href="{{url_for('posts.delete', post_id=post.id)}}">Delete</a>
-        {% set show_reply = true %}
+      {%- endif -%}
-
+      <button disabled title="This feature requires JavaScript to be enabled.">Bookmark&hellip;</button>
-        {% if not active_user %}
-          {% set show_reply = false %}
-        {% elif post['thread_is_locked'] and not active_user.is_mod() %}
-          {% set show_reply = false %}
-        {% elif active_user.is_guest() %}
-          {% set show_reply = false %}
-        {% elif editing %}
-          {% set show_reply = false %}
-        {% elif no_reply %}
-          {% set show_reply = false %}
-        {% endif %}
-
-        {% if show_reply %}
-          {% set qtext = "@%s [url=%s]said:[/url]" | format(post['username'], post_permalink) %}
-          {% set reply_text = "%s\n[quote]\n%s\n[/quote]\n" | format(qtext, post['original_markup']) %}
-          <button data-send="addQuote" value="{{ reply_text }}" class="reply-button">Quote</button>
-        {% endif %}
-
-        {% set show_delete = false %}
-
-        {% if active_user %}
-          {% set show_delete = (((post['user_id'] | string) == (active_user.id | string) and not post['thread_is_locked']) or active_user.is_mod()) and not no_reply %}
-        {% endif %}
-
-        {% if show_delete %}
-          <button class="critical post-delete-button" value="{{ post['id'] }}">Delete</button>
-        {% endif %}
-
-        {% if show_bookmark %}
-          {{ bookmark_button(type="post", id=post.id, message=bookmark_message, require_reload=reload_after_bookmark)}}
-        {% endif %}
     </span>
+    {%- endif -%}
   </div>
-    <div class="post-content">
+  <div class="plank even no-shadow post-content-inner minimal">{{post.content | safe}}
-      {% if not editing %}
+    {%- if render_sig and post.signature_rendered -%}
-        <div class="post-inner" data-post-permalink="{{ post_permalink }}" data-author-username="{{ post.username }}">{{ post['content'] | safe }}</div>
+    <aside class="post-signature">{{post.signature_rendered | safe}}</aside>
-        {% if render_sig and post['signature_rendered'] %}
+    {%- endif -%}
-          <div class="signature-container">
-            {{ post['signature_rendered'] | safe }}
   </div>
-        {% endif %}
+  {%- if show_reactions -%}
-      {% else %}
+  <div class="plank even secondary-bg minimal no-shadow">
-        {{ babycode_editor_form(cancel_url = post_permalink, prefill = post['original_markup'], ta_name = "new_content") }}
+    <span class="button-row">
-      {% endif %}
+      {%- for reaction in Reactions.for_post(post.id) -%}
-    </div>
-    {% if Reactions -%}
-      {% set can_react = true -%}
-
-      {% if not active_user -%}
-        {% set can_react = false -%}
-      {% elif post['thread_is_locked'] and not active_user.is_mod() -%}
-        {% set can_react = false -%}
-      {% elif active_user.is_guest() -%}
-        {% set can_react = false -%}
-      {% elif editing -%}
-        {% set can_react = false -%}
-      {% endif -%}
-
-      {% set reactions = Reactions.for_post(post.id) -%}
-        <div class="post-reactions">
-        {% for reaction in reactions %}
       {% set reactors = Reactions.get_users(post.id, reaction.reaction_text) | map(attribute='username') | list %}
       {% set reactors_trimmed = reactors[:10] %}
       {% set reactors_str = reactors_trimmed | join (',\n') %}
       {% if reactors | count > 10 %}
         {% set reactors_str = reactors_str + '\n...and many others' %}
       {% endif %}
-          {% set has_reacted = active_user is not none and active_user.username in reactors %}
+      {% set has_reacted = get_active_user() is not none and get_active_user().username in reactors %}
-          <span class="reaction-container" data-emoji="{{ reaction.reaction_text }}" data-post-id="{{ post.id }}"><button type="button" class="reduced reaction-button {{"active" if has_reacted else ""}}" {{ "disabled" if not can_react else ""}} title="{{reactors_str}}"><img class=emoji src="/static/emoji/{{reaction.reaction_text}}.png"> x<span class="reaction-count" data-emoji="{{ reaction.reaction_text }}">{{reaction.c}}</span></button>
+      <button disabled title="{{reactors_str}}" class="minimal {{'alt' if has_reacted else ''}}"><img src="/static/emoji/{{reaction.reaction_text}}.png">{{reaction.c}}</button>
+      {%- endfor -%}
     </span>
-        {% endfor %}
+    {%- if is_logged_in() -%}<button disabled title="This feature requires JavaScript to be enabled.">Add reaction</button>{%- endif -%}
-        {% if can_react %}
-          <button type="button" class="reduced add-reaction-button" data-post-id="{{ post.id }}">Add reaction</button>
-        {% endif %}
-        </div>
-    {% endif %}
   </div>
+  {%- endif -%}
 </div>
-{% endmacro %}
+{%- endmacro %}
-
-{% macro accordion(hidden=false, disabled=false) %}
-{% if disabled %}
-{% set hidden = true %}
-{% endif %}
-<div class="accordion {{ "hidden" if hidden else ""}}" data-receive="toggleAccordion">
-  <div class="accordion-header">
-    <button type="button" class="accordion-toggle" {{"disabled" if disabled else ""}} data-send="toggleAccordion">{{ "+" if hidden else "-" }}</button>
-    {{ caller('header') }}
-  </div>
-  <div class="accordion-content {{ "hidden" if hidden else "" }}">
-    {{ caller('content') }}
-  </div>
-</div>
-{% endmacro %}
-
-{% macro guide_sections() %}
-  <div class="guide-container">
-  	<div class="guide-topics">
-      {% set sections %}{{ caller() }}{% endset %}
-      {{ sections | safe }}
-  	</div>
-  	<div class="guide-toc">
-    <h2>Table of contents</h2>
-    <a href="#top">(top)</a>
-      {% set toc = sections | extract_h2 %}
-      <ul>
-        {% for heading in toc %}
-          <li><a href='#{{ heading.id }}'>{{ heading.text }}</a></li>
-        {% endfor %}
-      </ul>
-    </div>
-  </div>
-{% endmacro %}

app/templates/common/topnav.html

@@ -1,31 +1,26 @@
-<nav id="topnav">
+<nav id="header" class="plank top">
-  <span>
+  <a class="site-title" href="/">Porom</a>
-    <a class="site-title" href="{{url_for('topics.all_topics')}}">{{config.SITE_NAME}}</a>
+  <span>anti-social media</span>
-  </span>
+  {%- if is_logged_in() -%}
-  <span>
+  {%- with user = get_active_user() -%}
-  {% if not is_logged_in() %}
+  <ul class="horizontal wrap">
-    {% if not config.DISABLE_SIGNUP %}
+    <li class="mobile-fill-flex">Welcome, <a href="{{url_for('users.user_page', username=user.username)}}">{{ user.get_readable_name() }}</a></li>
-    Welcome, guest. Please <a href="{{url_for('users.sign_up')}}">sign up</a> or <a href="{{url_for('users.log_in')}}">log in</a>
+    <li><a class="linkbutton" href="{{url_for('users.settings', username=user.username)}}">Settings</a></li>
-    {% else %}
+    <li><a class="linkbutton" href="{{url_for('users.inbox', username=user.username)}}">Inbox</a></li>
-    Welcome, guest. Please <a href="{{url_for('users.log_in')}}">log in</a>
+    <li><a class="linkbutton" href="{{url_for('users.bookmarks', username=user.username)}}">Bookmarks</a></li>
-    {% endif %}
+    {% if user.is_mod() -%}
-  {% else %}
+    <li><a class="linkbutton" href="{{url_for('mod.index')}}">Moderation</a></li>
-    {% with user = get_active_user() %}
+    {%- endif %}
-      Welcome, <a href="{{ url_for("users.page", username = user.username) }}">{{user.get_readable_name()}}</a>
-      <ul class="horizontal">
-        <li><a href="{{ url_for("users.settings", username = user.username) }}">Settings</a></li>
-        <li><a href="{{ url_for("users.inbox", username = user.username) }}">Inbox</a></li>
-        {% if config.DISABLE_SIGNUP and user.can_invite() %}
-          <li><a href="{{ url_for('users.invite_links', username=user.username )}}">Invite to {{ config.SITE_NAME }}</a></li>
-        {% endif %}
-        {% if not user.is_guest() %}
-        <li><a href="{{ url_for('users.bookmarks', username=user.username) }}">Bookmarks</a></li>
-        {% endif %}
-        {% if user.is_mod() %}
-          <li><a href="{{ url_for("mod.panel") }}">Moderation</a></li>
-        {% endif %}
   </ul>
-    {% endwith %}
+  {%- endwith -%}
-  {% endif %}
+  {%- elif request.path != url_for('users.sign_up') and request.path != url_for('users.log_in') -%}
-  </span>
+  <form class="horizontal wrap" method="POST" action="{{url_for('users.log_in_post')}}">
+    <input type="hidden" name="return_to" value="{{request.path}}">
+    <input type="text" placeholder="Username" name="username" autocomplete="username" required>
+    <input type="password" placeholder="Password" name="password" autocomplete="current-password" required>
+    <span><input type="checkbox" name="remember" id="remember"> <label for="remember">Remember me</label></span>
+    <input type="submit" value="Log in">
+    <a href="{{url_for('users.sign_up')}}" class="linkbutton alt">Sign up</a>
+  </form>
+  {%- endif -%}
 </nav>

app/templates/components/bookmarks_dropdown.html

@@ -1,28 +0,0 @@
-{% set bookmark_url = None %}
-{% if type == 'post' %}
-  {% set bookmark_url = url_for('api.bookmark_post', post_id=id) %}
-{% else %}
-  {% set bookmark_url = url_for('api.bookmark_thread', thread_id=id) %}
-{% endif %}
-<div class="bookmarks-dropdown" data-bookmark-type="{{type}}" data-receive="saveBookmarks" data-bookmark-endpoint="{{bookmark_url}}" data-originally-contained-in="{{ selected.id if selected else ""}}" data-require-reload={{require_reload | int}} popover=auto>
-  <div class="bookmarks-dropdown-header">
-    <span>Bookmark collections</span>
-    {% if not require_reload %}
-      <a href="{{ url_for('users.bookmarks', username=get_active_user().username) }}">View bookmarks</a>
-    {% endif %}
-  </div>
-  <div class="bookmark-dropdown-items-container">
-  {%- for collection in collections -%}
-  {%- set pc = collection.get_posts_count() -%}
-  {%- set tc = collection.get_threads_count() -%}
-    <div class="bookmark-dropdown-item {{ "selected" if selected and (selected.id | int) == (collection.id | int) else ""}}" data-send="selectBookmarkCollection" data-receive="selectBookmarkCollection" data-collection-id="{{collection.id}}">
-    <span class="bookmark-dropdown-item-name">{{collection.name}}</span>
-    <span class="bookmark-dropdown-item-stats"><abbr title="{{ pc }} {{('post' | pluralize(pc))}}">{{ pc }}p</abbr>, <abbr title="{{ tc }} {{('thread' | pluralize(tc))}}">{{ tc }}t</abbr></span>
-    </div>
-  {%- endfor -%}
-  </div>
-  <span>
-    <input type="text" placeholder="Memo" class="bookmark-memo-input" value="{{memo}}"></input>
-    <button type="button" data-send="saveBookmarks">Save</button>
-  </span>
-</div>

app/templates/guides/_layout.html

@@ -1,21 +0,0 @@
-{% extends 'base.html' %}
-{% from 'common/macros.html' import guide_sections with context %}
-{% block title %}guide - {{ guide.title }}{% endblock %}
-{% block content %}
-<div class="darkbg" id="top">
-  <h1 class="thread-title">Guide: {{ guide.title }}</h1>
-  <ul class="horizontal">
-    <li><a href="{{ url_for('guides.category_index', category=category) }}">&uarr; Back to category</a></li>
-    {% if prev_guide %}
-      <li><a href="{{ prev_guide.url }}">&larr; Previous: {{ prev_guide.title }}</a></li>
-    {% endif %}
-    {% if next_guide %}
-      <li><a href="{{ next_guide.url }}">&rarr; Next: {{ next_guide.title }}</a></li>
-    {% endif %}
-  </ul>
-</div>
-{% call() guide_sections() %}
-  {% block guide_content %}
-  {% endblock %}
-{% endcall %}
-{% endblock %}

app/templates/guides/category_index.html

@@ -1,15 +0,0 @@
-{% extends 'base.html' %}
-{% block title %}guides - {{ category | title }}{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1 class="thread-title">All guides in category "{{ category | replace('-', ' ') | title }}"</h1>
-  <ul>
-    {% for page in pages %}
-      <li><a href="{{ page.url }}">{{ page.title }}</a></li>
-    {% endfor %}
-  </ul>
-  <div>
-    <a href="{{ url_for('guides.guides_index') }}">&larr; All guide categories</a>
-  </div>
-</div>
-{% endblock %}

app/templates/guides/contact.html

@@ -1,13 +0,0 @@
-{% extends 'base.html' %}
-{% block title %}contact us{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Contact</h1>
-  {% if config.ADMIN_CONTACT_INFO %}
-    <p>The administrators of {{ config.SITE_NAME }} provide the following contact information:</p>
-    <div>{{ config.ADMIN_CONTACT_INFO | babycode_strict | safe }}</div>
-  {% else %}
-    <p>The administrators of {{ config.SITE_NAME }} did not provide any contact information.</p>
-  {% endif %}
-</div>
-{% endblock %}

app/templates/guides/guides_index.html

@@ -1,19 +0,0 @@
-{% extends 'base.html' %}
-{% block title %}guides{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1 class="thread-title">Guides index</h1>
-  <ul>
-  {% for category in categories %}
-    <li>
-      <h2><a href="{{ url_for('guides.category_index', category=category )}}">{{ category | replace('-', ' ') | title }}</a></h2>
-      <ul>
-        {% for page in categories[category] %}
-          <li><a href="{{ page.url }}">{{ page.title }}</a></li>
-        {% endfor %}
-      </ul>
-    </li>
-  {% endfor %}
-  </ul>
-</div>
-{% endblock %}

app/templates/guides/user-guides/01-introduction.html

@@ -1,76 +0,0 @@
-# Introduction
-{% extends 'guides/_layout.html' %}
-{% block guide_content %}
-<section class="guide-section">
-  <h2 id="pyrom">What is {{config.SITE_NAME}}?</h2>
-  {% if config.GUIDE_DESCRIPTION %}
-  <div>{{ config.GUIDE_DESCRIPTION | babycode_strict | safe }}</div>
-  {% endif %}
-  <p>{{ config.SITE_NAME }} is powered by <a href="https://git.poto.cafe/yagich/pyrom/" target="_blank">Pyrom</a>, a home-grown forum software for the indie web. This guide will help you get started, from creating an account to understanding how discussions are organized.</p>
-</section>
-<section class="guide-section">
-  <h2 id="signing-up">Signing up</h2>
-  <p>Most interactive features on {{ config.SITE_NAME }} such as creating threads or posting replies require a user account. While browsing is open to all, you must be signed in to participate.</p>
-  {% if config.DISABLE_SIGNUP %}
-  <p>{{ config.SITE_NAME }} uses an invite-only sign-up system. You cannot sign up directly. Instead, {% if config.USERS_CAN_INVITE %}an existing user{% elif config.MODS_CAN_INVITE %}a moderator{% endif %} can generate an invite link containing an invite key. Using that link will take you to the sign up page.</p>
-  {% else %}
-  <p>You can create an account on the <a href="{{url_for('users.sign_up')}}">sign-up page.</a> After you create your account, a moderator will need to manually approve your account before you can post. This may take some time.</p>
-  {% endif %}
-  <p>To create an account, you will need to provide:</p>
-  <ul>
-  	<li>A username:
-      <ul>
-        <li>Your username must be 3-20 characters long and only include lowercase letters (a-z), numbers (0-9), hyphens (-) and underscores (_).</li>
-        <li>If your username includes uppercase characters, the system will automatically convert them to lowercase. Your original capitalization will be preserved as part of your display name.</li>
-      </ul>
-  	</li>
-  	<li>A strong password:
-      <ul>
-      	<li>Your password must be at least 10 characters long and include at least one uppercase letter, at least one lowercase letter, at least one number, at least one special character, and no spaces.</li>
-      </ul>
-  	</li>
-  </ul>
-  <p>Once your account is {% if not config.DISABLE_SIGNUP %}confirmed and{% endif %} active, you will have full access to create threads, post replies, and use other features.</p>
-</section>
-<section class="guide-section">
-  <h2 id="topics">Topics</h2>
-  <p>The front page of {{ config.SITE_NAME }} is an overview of topics that you can create threads in. A topic is a broad category created by moderators to organize discussions.</p>
-  <p>Topics usually have a description that is shown under its name. Use it as guidance for where to post a thread. The order topics show up in is chosen by moderators.</p>
-  <p>A topic may be locked by a moderator. This will prevent threads from being created or moved into it by non-moderators. These topics are usually used for forum-wide information, but it is of course up to the moderators.</p>
-  <p>By default, threads in a topic are sorted by activity, but this can be changed in your user settings.</p>
-</section>
-<section class="guide-section">
-  <h2 id="threads">Threads</h2>
-  <p>Threads are where discussion happens. A thread is started by a user with a name and an initial post, and other users may add their own posts to it (known as replying to the thread).</p>
-  <p>When drafting a thread, you have to choose which topic to post it under. Be sure to follow the posting rules. If you created a thread under the wrong topic, you may move it when viewing replies. Moderators have the option to move any thread.</p>
-  <p>A thread may be locked by the original poster (OP) or a moderator. When a thread is locked, nobody except moderators can reply to it.</p>
-  <p>A thread may also be stickied by a moderator. Stickied threads show above all other threads in the topic it's under. If a thread is stickied, it is likely important.</p>
-  <p>You can subscribe to any thread. When subscribed, you will receive an overview of posts you missed for that thread in your inbox.</p>
-  <p>You can</p>
-</section>
-<section class="guide-section">
-  <h2 id="posts">Posts</h2>
-  <p>Posts are the individual messages that make up a thread. The first post starts the thread, and every subsequent message is a post in reply.</p>
-  <p>A post is split up into five sections:</p>
-  <ol>
-    <li>Usercard
-      <ul><li>The post author's information shows up to the left of the post. This includes their avatar, display name, mention, and status.</li></ul>
-    </li>
-    <li>Post actions
-      <ul><li>This shows the time and date when the post has been made (or edited), and buttons for actions you can perform on the post, such as quoting or editing.</li></ul>
-    </li>
-    <li>Post content
-      <ul><li>The actual message of the post.</li></ul>
-    </li>
-    <li>Signature (sig)
-      <ul><li>If the user has a signature set, it will show under each of their posts.</li></ul>
-    </li>
-    <li>Reactions
-      <ul><li>This shows the emoji reactions users have added to the post, and you can add your own.</li></ul>
-    </li>
-  </ol>
-  <p>You may edit or delete your posts after creating them. Edited posts will show when they were edited instead of when they were posted.</p>
-  <p>You can quote another user's post by pressing the <button>Quote</button> button on that post. This will copy the contents of it into the reply box and mention the user.</p>
-  <p>Posts are written in a markup language called Babycode. <a href="{{ url_for("guides.guide_page", category='user', slug='babycode') }}">More information on it can be found in a separate guide.</a></p>
-</section>
-{% endblock %}

app/templates/guides/user-guides/02-profiles.html

@@ -1,24 +0,0 @@
-# User profiles
-{% extends 'guides/_layout.html' %}
-{% block guide_content %}
-<section class="guide-section">
-  <h2 id="profile">User profiles</h2>
-  <p>Each user on {{ config.SITE_NAME }} has a profile.</p>
-  <p>A user's profile shows:</p>
-  <ul>
-    <li>Their avatar;</li>
-    <li>Their username and display name;</li>
-    <li>Their status;</li>
-    <li>Their signature;</li>
-    <li>Their stats:
-      <ul>
-        <li>Their permission level (regular user, moderator, etc);</li>
-        <li>The number of posts they've created;</li>
-        <li>The number of threads they've started;</li>
-        <li>A link to their latest started thread;</li>
-        <li>A few of their latest posts.</li>
-      </ul>
-    </li>
-  </ul>
-</section>
-{% endblock %}

app/templates/guides/user-guides/03-settings.html

@@ -1,64 +0,0 @@
-# User settings
-{% extends 'guides/_layout.html' %}
-{% block guide_content %}
-<section class="guide-section">
-  <h2 id="settings">Settings</h2>
-  <p>You can access your settings by following the "Settings" link in the top navigation bar or from the <button>Settings</button> button in your profile.</p>
-  <p>The settings page lets you set your avatar, change your personalization options, and change your password.</p>
-</section>
-<section class="guide-section">
-  <h2 id="avatar">Avatar</h2>
-  <p>When you upload an avatar, keep in mind that it will be cropped to a square and resized to fit 256 by 256 pixels. It's best to upload an image that is already square. Avatars must be no more than 1 MB in size. You can also clear your avatar, resetting it to the default one.</p>
-  <p>To change your avatar, first press the <button>Browse&hellip;</button> button and select a file from your device, then press the <button>Save avatar</button> button to upload it.</p>
-</section>
-<section class="guide-section">
-  <h2 id="personalization">Personalization</h2>
-  <p>The personalization section of the settings lets you change the following settings:</p>
-  <ul>
-    <li>Theme
-    <ul>
-      <li>Set the appearance of the forum. This feature is still in beta and themes may change unexpectedly.</li>
-    </ul>
-    </li>
-    <li>Thread sorting
-      <ul>
-        <li>Set the sorting of threads when viewing a single topic. "Latest activity" will put threads which had a response more recently closer to the top. "Thread creation date" will put threads which were created more recently closer to the top.</li>
-      </ul>
-    </li>
-    <li>Display name
-      <ul>
-        <li>If set, your display name will show up instead of your username in most places. In a post's usercard, the display name will show up above your username/mention. In posts that have mentioned you, your display name will be shown instead of your @username.</li>
-        <li>Display names have fewer restrictions than usernames, and most characters are allowed.</li>
-        <li>If you do not wish to use a display name, you can leave the field blank.</li>
-      </ul>
-    </li>
-    <li>Status
-      <ul>
-        <li>If set, your status will show up below your @mention in a post's usercard. 100 characters limit, no <a href="{{ url_for("guides.guide_page", category='user', slug='babycode') }}">Babycodes.</a></li>
-      </ul>
-    </li>
-    <li>Subscribe by default
-      <ul>
-        <li>If checked, you will automatically add the thread to your subscriptions when replying to it. You can override this setting by checking or unchecking "Subscribe to thread" before posting your reply in the reply box.</li>
-      </ul>
-    </li>
-    <li>Signature
-      <ul>
-        <li>If set, this signature will appear under all of your posts. <a href="{{ url_for("guides.guide_page", category='user', slug='babycode') }}">Babycode</a> is allowed (except @mentions).</li>
-      </ul>
-    </li>
-  </ul>
-</section>
-<section class="guide-section">
-  <h2 id="password">Changing your password</h2>
-  <p>You can change your password by typing it in the "New password" field and again in the "Confirm new password" field, then pressing the <button class="warn">Change password</button> button. The passwords in the two fields must match.</p>
-</section>
-<section class="guide-section">
-  <h2 id="deleting">Deleting your account</h2>
-  <p>If you no longer wish to participate in {{ config.SITE_NAME }}, you may delete your account. To do so, press the <button class="critical">Delete account</button> button in your settings, which will take you to a confirmation page.</p>
-  <p>Deleting your account is an irreversible action. Once you delete your account, <strong>you will not be able to log back in to it.</strong></p>
-  <p>Deleting your account <strong>does not delete your threads and posts.</strong> They will be kept intact to preserve history. They will be altered to show up as if a system user authored them.</p>
-  <p>If you want your posts and threads to be deleted as well, you may either delete them yourself or <a href="{{url_for("guides.contact")}}" target="_blank">contact the administrators</a> for help.</p>
-  <p>If you're sure you want to delete your account, you will need to type your password on the confirmation page before pressing the <button class="critical">Delete account</button> button.</p>
-</section>
-{% endblock %}

app/templates/guides/user-guides/04-inbox.html

@@ -1,29 +0,0 @@
-# Inbox/subscriptions
-{% extends 'guides/_layout.html' %}
-{% block guide_content %}
-<section class="guide-section">
-  <h2 id="overview">Subscriptions</h2>
-  <p>You can subscribe to any thread. When subscribed, you will receive an overview of posts you missed for that thread in your inbox.</p>
-  <p>Additionally, when browsing a topic, threads you've subscribed to will show the number of posts you haven't read in it next to the thread's name.</p>
-</section>
-<section class="guide-section">
-  <h2 id="inbox">Inbox</h2>
-  <p>You can access your Inbox by following the "Inbox" link in the top navigation bar.</p>
-  <p>The Inbox is split into two parts:</p>
-  <ol>
-    <li>Subscriptions
-      <ul>
-        <li>A table of all threads that you've subscribed to. You can unsubscribe from each thread by pressing the <button class="warn">Unsubscribe</button> button for that thread's row.</li>
-        <li>This section is collapsible, like a Babycode spoiler - press the "-" button to collapse it.</li>
-      </ul>
-    </li>
-    <li>Unread posts
-      <ul>
-        <li>These are the posts you missed in each thread, if any. They are sorted in reverse chronological order and are grouped by thread. Each thread is collapsible.</li>
-        <li>You can mark an entire thread as read by pressing the <button>Mark thread as Read</button> button, or unsubscribe from it by pressing the <button class="warn">Unsubscribe</button> button.</li>
-      </ul>
-    </li>
-  </ol>
-  <p>Your inbox is updated automatically when you browse a subscribed thread. Once you've seen the posts you missed, they will disappear from your Inbox.</p>
-</section>
-{% endblock %}

app/templates/guides/user-guides/05-bookmarks.html

@@ -1,39 +0,0 @@
-# Bookmarks
-{% from 'common/icons.html' import icn_bookmark %}
-{% extends 'guides/_layout.html' %}
-{% block guide_content %}
-<section class="guide-section">
-  <h2 id="bookmarks">Bookmarks</h2>
-  <p>You can bookmark whole threads or individual posts to save them for later reading. Bookmarks are split into collections.</p>
-  <p>Each post or thread you bookmark (collectively bookmarks) can only belong to one collection.</p>
-  <p>Each bookmark can have a short memo that you can add to it, for example to help you remember why you saved it.</p>
-</section>
-<section class="guide-section">
-  <h2 id="collections">Bookmark collections</h2>
-  <p>Bookmarks are organized into collections. There is always at least one collection you have access to, called "Bookmarks" by default.</p>
-  <p>You can add any number of collections by pressing the <button>Manage collections</button> button on the your bookmarks page.</p>
-  <p>On the "Manage bookmark collections" page, you can add, delete, rename, and reorder your collections.</p>
-  <p>To add a new collection, press the <button>Add new collection</button> button. A new item will be added.</p>
-  <p>You can name any collection by using the input box.</p>
-  <p>You can reorder collections by dragging and dropping it above or below others. The default collection is always at the top and can not be moved.</p>
-  <p>You can delete a collection by pressing the <button class="critical">Delete</button> button on that collection. Deleting a collection will remove all bookmarks from it. If you delete a collection by accident, simply refresh the page. Your changes are not saved until you press the <button>Save</button> button.</p>
-</section>
-<section class="guide-section">
-  <h2 id="bookmarking">Bookmarking posts and threads</h2>
-  <ul>
-    <li>To bookmark a thread, press the <button class="contain-svg inline icon">{{ icn_bookmark(20) }}Bookmark&hellip;</button> button at the top of the thread.</li>
-    <li>To bookmark a post, press the <button class="contain-svg inline icon">{{ icn_bookmark(20) }}Bookmark&hellip;</button> button on that post.</li>
-  </ul>
-  <p>Both will bring up a popup with your bookmark collections. You can select the collection to save the bookmark into by pressing its name and add an optional memo. To save the bookmark, press the <button>Save</button> button. Each bookmark can only belong to one collection.</p>
-  <p>If the post or thread is already bookmarked, the name of the collection will be highlighed and the box to its name will be filled. If you wish to remove the bookmark, press the name of the collection it's in and press the <button>Save</button> button.</p>
-</section>
-<section class="guide-section">
-  <h2 id="browsing-bookmarks">Browsing and managing bookmarks</h2>
-  <p>You can access your bookmarks by following the "Bookmarks" link in the top navigation bar.</p>
-  <p>On the Bookmarks page, each collection will show up as a collapsible section. If a collection is empty, it will be collapsed.</p>
-  <p>If a collection has any bookmarks, it will have two collapsibe sections nested inside it: one for threads and one for posts.</p>
-  <p>Bookmarked threads are shown as a table with their title, the memo, and a <button class="contain-svg inline icon">{{ icn_bookmark(20) }}Manage&hellip;</button> button. Pressing this button will show the same popup, letting you move or remove the bookmark.</p>
-  <p>Bookmarked posts are shown in the same way they're shown in a thread. The memo will be shown before the post's time stamp. To the right of the post is the same <button class="contain-svg inline icon">{{ icn_bookmark(20) }}Manage&hellip;</button> button.</p>
-  <p>If you made changes to bookmarked threads or posts on this page, you will have to refresh to save those changes.</p>
-</section>
-{% endblock %}

app/templates/guides/user-guides/99-babycode.html

@@ -1,184 +0,0 @@
-# Babycode
-{% extends 'guides/_layout.html' %}
-{% block guide_content %}
-  <section class="guide-section">
-    <h2 id="what-is-babycode">What is babycode?</h2>
-    <p>You may be familiar with BBCode, a loosely related family of markup languages popular on forums. Babycode is another, simplified, dialect of those languages. It is a way of formatting text by enclosing parts of it in special tags.</p>
-    <p>A <b>tag</b> is a short name enclosed in square brackets. Tags can be opening tags, like <code class="inline-code">[b]</code> or closing tags, like <code class="inline-code">[/b]</code>. Anything inserted between matching opening and closing tags is known as the tag's content.</p>
-    <p>Some tags can provide more specific instructions using an <b>attribute</b>. An attribute is added to the opening tag with an equals sign (<code class="inline-code">=</code>). This allows you to specify details like a particular color or a link's address.</p>
-    <p>Babycode is used in posts, user signatures, and MOTDs.</p>
-  </section>
-  <section class="guide-section">
-    <h2 id="text-formatting-tags">Text formatting tags</h2>
-    <ul class='guide-list'>
-      <li>To make some text <strong>bold</strong>, enclose it in <code class="inline-code">[b][/b]</code>:<br>
-      [b]Hello World[/b]<br>
-      Will become<br>
-      <strong>Hello World</strong>
-      </li>
-    </ul>
-    <ul class='guide-list'>
-      <li>To <em>italicize</em> text, enclose it in <code class="inline-code">[i][/i]</code>:<br>
-      [i]Hello World[/i]<br>
-      Will become<br>
-      <em>Hello World</em>
-      </li>
-    </ul>
-    <ul class='guide-list'>
-      <li>To make some text <del>strikethrough</del>, enclose it in <code class="inline-code">[s][/s]</code>:<br>
-      [s]Hello World[/s]<br>
-      Will become<br>
-      <del>Hello World</del>
-      </li>
-    </ul>
-    <ul class='guide-list'>
-      <li>To <u>underline</u> some text, enclose it in <code class="inline-code">[u][/u]</code>:<br>
-      [u]Hello World[/u]<br>
-      Will become<br>
-      <u>Hello World</u>
-      </li>
-    </ul>
-    <ul class='guide-list'>
-      <li>To make some text {{ "[big]big[/big]" | babycode | safe }}, enclose it in <code class="inline-code">[big][/big]</code>:<br>
-      [big]Hello World[/big]<br>
-      Will become<br>
-      {{ "[big]Hello World[/big]" | babycode | safe }}
-      <li>Similarly, you can make text {{ "[small]small[/small]" | babycode | safe }} with <code class="inline-code">[small][/small]</code>:<br>
-      [small]Hello World[/small]<br>
-      Will become<br>
-      {{ "[small]Hello World[/small]" | babycode | safe }}
-      </li>
-    </ul>
-    <ul class='guide-list'>
-      <li>You can change the text color by using <code class="inline-code">[color][/color]</code>:<br>
-      [color=red]Red text[/color]<br>
-      [color=white]White text[/color]<br>
-      [color=#3b08f0]Blueish text[/color]<br>
-      Will become<br>
-      {{ "[color=red]Red text[/color]" | babycode | safe }}<br>
-      {{ "[color=white]White text[/color]" | babycode | safe }}<br>
-      {{ "[color=#3b08f0]Blueish text[/color]" | babycode | safe }}<br>
-      </li>
-    </ul>
-    <ul class='guide-list'>
-      <li>You can center text by enclosing it in <code class="inline-code">[center][/center]</code>:<br>
-      [center]Hello World[/center]<br>
-      Will become<br>
-      {{ "[center]Hello World[/center]" | babycode | safe }}
-      </li>
-      <li>You can right-align text by enclosing it in <code class="inline-code">[right][/right]</code>:<br>
-      [right]Hello World[/right]<br>
-      Will become<br>
-      {{ "[right]Hello World[/right]" | babycode | safe }}
-      </li>
-      Note: the center and right tags will break the paragraph. See <a href="#paragraph-rules">Paragraph rules</a> for more details.
-    </ul>
-  </section>
-  <section class="guide-section">
-    <h2 id="emoji">Emoji</h2>
-    <p>There are a few emoji in the style of old forum emotes:</p>
-    <table class="emoji-table">
-      <tr>
-        <th>Short code</th>
-        <th>Emoji result</th>
-      </tr>
-      {% for emoji in __emoji %}
-        <tr>
-          <td>{{ ("[code]:%s:[/code]" % emoji) | babycode | safe }}</td>
-          <td>{{ __emoji[emoji] | safe }}</td>
-        </tr>
-      {% endfor %}
-    </table>
-    <p>Special thanks to the <a href="https://gh.vercte.net/forumoji/">Forumoji project</a> and its contributors for these graphics.</p>
-  </section>
-  <section class="guide-section">
-    <h2 id="paragraph-rules">Paragraph rules</h2>
-    <p>Line breaks in babycode work like Markdown: to start a new paragraph, use two line breaks:</p>
-    {{ '[code]paragraph 1\n\nparagraph 2[/code]' | babycode | safe }}
-    Will produce:<br>
-    {{ 'paragraph 1\n\nparagraph 2' | babycode | safe }}
-    <p>To break a line without starting a new paragraph, end a line with two spaces:</p>
-    {{ '[code]paragraph 1  \nstill paragraph 1[/code]' | babycode | safe }}
-    That will produce:<br>
-    {{ 'paragraph 1  \nstill paragraph 1' | babycode | safe }}
-    <p>Additionally, the following tags will break into a new paragraph:</p>
-    <ul>
-      <li><code class="inline-code">[code]</code> (code block, not inline);</li>
-      <li><code class="inline-code">[img]</code>;</li>
-      <li><code class="inline-code">[center]</code>;</li>
-      <li><code class="inline-code">[right]</code>;</li>
-      <li><code class="inline-code">[ul]</code> and <code class="inline-code">[ol]</code>;</li>
-      <li><code class="inline-code">[quote]</code>.</li>
-    </ul>
-  </section>
-  <section class="guide-section">
-    <h2 id="links">Links</h2>
-    <p>Loose links (starting with http:// or https://) will automatically get converted to clickable links. To add a label to a link, use<br><code class="inline-code">[url=https://example.com]Link label[/url]</code>:<br>
-    <a href="https://example.com">Link label</a></p>
-  </section>
-  <section class="guide-section">
-    <h2 id="attaching-an-image">Attaching an image</h2>
-    <p>To add an image to your post, use the <code class="inline-code">[img]</code> tag:<br>
-    <code class="inline-code">[img=https://forum.poto.cafe/avatars/default.webp]the Python logo with a cowboy hat[/img]</code>
-    {{ '[img=/static/avatars/default.webp]the Python logo with a cowboy hat[/img]' | babycode | safe }}
-    </p>
-    <p>The attribute is the image URL. The text inside the tag will become the image's alt text.</p>
-    <p>Images will always break up a paragraph and will get scaled down to a maximum of 400px. However, consecutive image tags will try to stay in one line, wrapping if necessary. Break the paragraph if you wish to keep images on their own paragraph.</p>
-    <p>Multiple images attached to a post can be clicked to open a dialog to view them.</p>
-  </section>
-  <section class="guide-section">
-    <h2 id="adding-code-blocks">Adding code blocks</h2>
-    {% set code = 'func _ready() -> void:\n\tprint("hello world!")' %}
-    <p>There are two kinds of code blocks recognized by babycode: inline and block. Inline code blocks do not break a paragraph. They can be added with <code class="inline-code">[code]your code here[/code]</code>. As long as there are no line breaks inside the code block, it is considered inline. If there are any, it will produce this:</p>
-    {{ ('[code]%s[/code]' % code) | babycode | safe }}
-    <p>Optionally, you can enable syntax highlighting by specifying the language in the attribute like this: <code class="inline-code">[code=gdscript]</code></p>
-    {{ ('[code=gdscript]%s[/code]' % code) | babycode | safe}}
-    <p>A full list of languages that can be highlighted is available <a href="https://pygments.org/languages/" target=_blank>here</a> (the short names column).</p>
-    <p>Inline code tags look like this: {{ '[code]Inline code[/code]' | babycode | safe }}</p>
-    <p>Babycodes are not parsed inside code blocks.</p>
-  </section>
-  <section class="guide-section">
-    <h2 id="quoting">Quoting</h2>
-    <p>Text enclosed within <code class="inline-code">[quote][/quote]</code> will look like a quote:</p>
-    <blockquote>A man provided with paper, pencil, and rubber, and subject to strict discipline, is in effect a universal machine.</blockquote>
-  </section>
-  <section class="guide-section">
-    <h2 id="lists">Lists</h2>
-    {% set list = '[ul]\nitem 1\n\nitem 2\n\nitem 3  \nstill item 3 (break line without inserting a new item by using two spaces at the end of a line)\n[/ul]' %}
-    <p>There are two kinds of lists, ordered (1, 2, 3, ...) and unordered (bullet points). Ordered lists are made with <code class="inline-code">[ol][/ol]</code> tags, and unordered with <code class="inline-code">[ul][/ul]</code>. Every new paragraph according to the <a href="#paragraph-rules">usual paragraph rules</a> will create a new list item. For example:</p>
-    {{ ('[code]%s[/code]' % list) | babycode | safe }}
-    Will produce the following list:
-    {{ list | babycode | safe }}
-  </section>
-  <section class="guide-section">
-    <h2 id="spoilers">Spoilers</h2>
-    {% set spoiler = "[spoiler=Major Metal Gear Spoilers]Snake dies[/spoiler]" %}
-    <p>You can make a section collapsible by using the <code class="inline-code">[spoiler]</code> tag:</p>
-    {{ ("[code]\n%s[/code]" % spoiler) | babycode | safe }}
-    Will produce:
-    {{ spoiler | babycode | safe }}
-    All other tags are supported inside spoilers.
-  </section>
-  <section class="guide-section">
-    <h2 id="mentions">Mentioning users</h2>
-    <p>You can mention users by their username (<em>not</em> their display name) by using <code class="inline-code">@username</code>. A user's username is always shown below their avatar and display name on their posts and their user page.</p>
-    <p>A mention will show up on your post as a clickable box with the user's display name if they have one set or their username with an <code class="inline-code">@</code> symbol if they don't:</p>
-    <a class="mention" href="#mentions" title="@user-without-display-name">@user-without-display-name</a>
-    <a class="mention display" href="#mentions" title="@user-with-display-name">User with display name</a>
-    <a class="mention display me" href="#mentions" title="@your-username">Your display name</a>
-    <p>Mentioning a user does not notify them. It is simply a way to link to their profile in your posts.</p>
-  </section>
-  <section class="guide-section">
-    <h2 id="void-tags">Void tags</h2>
-    <p>The special void tags <code class="inline-code">[lb]</code>, <code class="inline-code">[rb]</code>, and <code class="inline-code">[@]</code> will appear as the literal characters <code class="inline-code">[</code>, <code class="inline-code">]</code>, and <code class="inline-code">@</code> respectively. Unlike other tags, they are self-contained and have no closing equivalent.</p>
-    <ul class="guide-list">
-      {% set lbrb = "[color=red]This text will be red[/color]\n\n[lb]color=red[rb]This text won't be red[lb]/color[rb]" %}
-      <li><code class="inline-code">[lb]</code> and <code class="inline-code">[rb]</code> allow you to use square brackets without them being interpreted as Babycode:
-        {{ ("[code]" + lbrb + "[/code]") | babycode | safe }}
-        Will result in:<br>
-        {{ lbrb | babycode | safe }}
-      </li>
-      <li>The <code class="inline-code">[@]</code> tag allows you to use the @ symbol without it being turned into a mention.</li>
-    </ul>
-  </section>
-{% endblock %}

app/templates/mod/edit_topic.html

@@ -0,0 +1,13 @@
+{%- from 'common/macros.html' import subheader -%}
+{%- extends 'base.html' -%}
+{%- block title -%}editing topic {{topic.name}}{%- endblock -%}
+{%- block content -%}
+{{subheader('Editing topic %s' % topic.name, 'To preserve history, the URL of the topic can not be changed.')}}
+<form class="plank primary-bg full-width" method="POST">
+  <label for="name">Name</label>
+  <input type="text" id="name" name="name" required value="{{topic.name}}">
+  <label for="description">Description</label>
+  <textarea name="description" id="description" rows="5" required>{{topic.description}}</textarea>
+  <input type="submit" value="Save">
+</form>
+{%- endblock -%}

app/templates/mod/motd.html

@@ -1,17 +0,0 @@
-{% from 'common/macros.html' import babycode_editor_component %}
-{% extends 'base.html' %}
-{% block title %}editing MOTD{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Edit Message of the Day</h1>
-  <p>The Message of the Day will show up on the main page and in every topic.</p>
-  <form method="POST">
-    <label for="title">Title</label>
-    <input name="title" id="title" type="text" required autocomplete="off" placeholder="Required" value="{{ current.title }}"><br>
-    <label for="body">Body</label>
-    {{ babycode_editor_component('body', ta_placeholder='MOTD body (required)', banned_tags=MOTD_BANNED_TAGS, prefill=current.body_original_markup) }}
-    <input type="submit" value="Save">
-    <input class="critical" type="submit" formaction="{{ url_for('mod.motd_delete') }}" value="Delete MOTD" formnovalidate {{"disabled" if not current else ""}}>
-  </form>
-</div>
-{% endblock %}

app/templates/mod/new_topic.html

@@ -0,0 +1,13 @@
+{%- from 'common/macros.html' import subheader -%}
+{%- extends 'base.html' -%}
+{%- block title -%}creating a topic{%- endblock -%}
+{%- block content -%}
+{{subheader('Create topic', 'The new topic will appear at the bottom of the current topic list. You can sort it later.')}}
+<form class="plank primary-bg full-width" method="POST">
+  <label for="name">Name</label>
+  <input type="text" id="name" name="name" required>
+  <label for="description">Description</label>
+  <textarea name="description" id="description" rows="5" required></textarea>
+  <input type="submit" value="Create">
+</form>
+{%- endblock -%}

app/templates/mod/panel.html

@@ -1,12 +0,0 @@
-{% extends "base.html" %}
-{% block title %}moderation{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Moderation actions</h1>
-  <ul>
-    <li><a href="{{ url_for('mod.user_list') }}">User list</a></li>
-    <li><a href="{{ url_for('mod.sort_topics') }}">Sort topics</a></li>
-    <li><a href="{{ url_for('mod.motd_editor') }}">Message of the Day</a></li>
-  </ul>
-</div>
-{% endblock %}

app/templates/mod/sort-topics.html

@@ -1,18 +0,0 @@
-{% extends "base.html" %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Change topics order</h1>
-  <p>Drag topic titles to reoder them. Press submit when done. The topics will appear to users in the order set here.</p>
-  <form method="post" id=topics-container>
-      {% for topic in topics %}
-        <div draggable="true" class="draggable-topic" ondragover="dragOver(event)" ondragstart="dragStart(event)" ondragend="dragEnd()">
-          <div class="thread-title">{{ topic['name'] }}</div>
-          <div>{{ topic.description }}</div>
-          <input type="hidden" name="{{ topic['id'] }}" value="{{ topic['sort-order'] }}" class="topic-input">
-        </div>
-      {% endfor %}
-      <input type=submit value="Save order">
-    </form>
-</div>
-<script src="{{ "/static/js/sort-topics.js" | cachebust }}"></script>
-{% endblock %}

app/templates/mod/user-list.html

@@ -1,69 +0,0 @@
-{% from "common/macros.html" import timestamp, accordion %}
-{% extends "base.html" %}
-{% block content %}
-<div class="darkbg inbox-container">
-  {% set guests = (users | selectattr('permission', 'eq', PermissionLevel.GUEST.value) | list) %}
-  {% set not_guests = (users | selectattr('permission', 'gt', PermissionLevel.GUEST.value) | list) %}
-  {% call(section) accordion(disabled=(guests | count==0)) %}
-    {% if section == "header" %}
-      <span>Unconfirmed guests</span>
-    {% elif section == "content" %}
-      <table class="colorful-table">
-        <thead>
-          <th>Username</th>
-          <th class="small">Signed up on</th>
-        </thead>
-        {% for user in guests %}
-          <tr>
-            <td>
-              <a href="{{url_for("users.page", username=user['username'])}}">{{user['username']}}
-              </a>
-            </td>
-            <td>
-              {{ timestamp(user.created_at) }}
-            </td>
-          </tr>
-        {% endfor %}
-      </table>
-    {% endif %}
-  {% endcall %}
-
-  {% call(section) accordion() %}
-    {% if section == "header" %}
-      <span>Other users</span>
-    {% elif section == "content" %}
-      <table class="colorful-table">
-        <thead>
-          <th>Username</th>
-          <th class="small">Permission</th>
-          <th class="small">Signed up on</th>
-          {% if active_user.is_admin() %}
-            <th class="small">Create password reset link</th>
-          {% endif %}
-        </thead>
-        {% for user in not_guests %}
-          <tr>
-            <td>
-              <a href="{{url_for("users.page", username=user['username'])}}">{{user['username']}}
-              </a>
-            </td>
-            <td>
-              {{ user.permission | permission_string }}
-            </td>
-            <td>
-              {{ timestamp(user.created_at) }}
-            </td>
-            {% if active_user.is_admin() %}
-              <td>
-                <form method="post" action="{{url_for('mod.create_reset_pass', user_id=user.id)}}">
-                  <input type="submit" class="warn" value="Create password reset link">
-                </form>
-              </td>
-            {% endif %}
-          </tr>
-        {% endfor %}
-      </table>
-    {% endif %}
-  {% endcall %}
-</div>
-{% endblock %}

app/templates/posts/edit.html

@@ -1,18 +0,0 @@
-{% from 'common/macros.html' import full_post %}
-{% extends 'base.html' %}
-{% block title %}editing a post{% endblock %}
-{% block content %}
-{% for post in prev_context | reverse %}
-  {{ full_post(post=post, no_reply=true, active_user=active_user) }}
-{% endfor %}
-<span class="context-explain">
-  <span>&uarr;&uarr;&uarr;</span><i>Context</i><span>&uarr;&uarr;&uarr;</span>
-</span>
-{{ full_post(post=editing_post, editing=true, no_reply=true, active_user=active_user) }}
-<span class="context-explain">
-  <span>&darr;&darr;&darr;</span><i>Context</i><span>&darr;&darr;&darr;</span>
-</span>
-{% for post in next_context %}
-  {{ full_post(post=post, no_reply=true, active_user=active_user) }}
-{% endfor %}
-{% endblock %}

app/templates/threads/create.html

@@ -1,22 +0,0 @@
-{% from "common/macros.html" import babycode_editor_component %}
-{% extends "base.html" %}
-{% block title %}drafting a thread{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>New thread</h1>
-  <form method="post">
-    <label for="topic_id">Topic</label>
-    <select name="topic_id" id="topic_id" autocomplete="off">
-      {% for topic in all_topics %}
-        {% set disable_topic = active_user and not active_user.can_post_to_topic(topic) %}
-        <option value="{{ topic['id'] }}" {{"selected" if (request.args.get('topic_id')) == (topic['id'] | string) else ""}} {{'disabled' if disable_topic else ''}} >{{ topic['name'] }}{{ ' (locked)' if topic.is_locked }}</option>
-      {% endfor %}
-    </select><br>
-    <label for="title">Thread title</label>
-    <input type="text" id="title" name="title" placeholder="Required" required>
-    <label for="initial_post">Post body</label><br>
-    {{ babycode_editor_component("initial_post") }}
-    <input type="submit" value="Create thread">
-  </form>
-</div>
-{% endblock %}

app/templates/threads/new_thread.html

@@ -0,0 +1,19 @@
+{%- from 'common/macros.html' import subheader, babycode_editor_component -%}
+{%- extends 'base.html' -%}
+{%- block title -%}drafting a thread{%- endblock -%}
+{%- block content -%}
+{{subheader('New thread')}}
+<form class="plank primary-bg full-width" method="POST">
+  <label for="topic">Topic</label>
+  <select name="topic_id" id="topic" autocomplete="off">
+    {%- for topic in topics -%}
+    <option value="{{topic.id}}" {{'selected' if selected_topic == topic.id else ''}} {{'disabled' if not get_active_user().can_post_to_topic(topic) else ''}}>{{topic.name}}{{ ' (locked)' if topic.locked() else ''}}</option>
+    {%- endfor -%}
+  </select>
+  <label for="title">Title</label>
+  <input type="text" id="title" name="title" required>
+  <label for="babycode-content">Starting post</label>
+  {{ babycode_editor_component() }}
+  <input type="submit" value="Create">
+</form>
+{%- endblock -%}

app/templates/threads/thread.html

@@ -1,94 +1,77 @@
-{% from 'common/macros.html' import pager, babycode_editor_form, full_post, bookmark_button %}
+{%- from 'common/macros.html' import subheader, timestamp, pager, babycode_editor_component -%}
-{% from 'common/icons.html' import icn_bookmark %}
+{%- from 'common/macros.html' import full_post with context -%}
-{% extends "base.html" %}
+{%- extends 'base.html' -%}
-{% block title %}{{ thread.title }}{% endblock %}
+{%- block title -%}{{thread.title}}{%- endblock -%}
-{% block content %}
+{%- block content -%}
-{% set can_post = false %}
+{%- set td -%}
-{% set can_lock = false %}
+<ul class="horizontal">
-{% set can_subscribe = false %}
+<li>Started by <a href="{{url_for('users.user_page', username=started_by.username)}}">{{started_by.get_readable_name()}}</a> in topic <a href="{{url_for('topics.topic_by_id', topic_id=topic.id)}}">{{topic.name}}</a></li>
-{% set can_bookmark = false %}
+{%- if thread.locked() or thread.stickied() -%}
-{% if active_user %}
+  {%- if thread.locked() -%}
-  {% set can_subscribe = true %}
+  <li class="visible">Locked</li>
-  {% set can_bookmark = not active_user.is_guest() %}
+  {%- endif -%}
-  {% set can_post = (not thread.is_locked and not active_user.is_guest()) or active_user.is_mod() %}
+  {%- if thread.stickied() -%}
-  {% set can_lock = ((active_user.id | int) == (thread.user_id | int)) or active_user.is_mod() %}
+  <li class="visible">Stickied</li>
-{% endif %}
+  {%- endif -%}
-<main>
+{%- endif -%}
-  <nav class="darkbg">
+</ul>
-    <h1 class="thread-title">{{ thread.title }}{% if unread_count is not none %} ({{ unread_count }} unread){% endif %}</h1>
+{%- endset -%}
-    <span>Posted in <a href="{{ url_for("topics.topic", slug=topic.slug) }}">{{ topic.name }}</a>
+{%- call() subheader(thread.title, td) -%}
-    {% if thread.is_stickied %}
+<fieldset class="plank even no-shadow minimal thread-actions">
-      &bullet; <i>stickied, so it's probably important</i>
+  <legend>Actions</legend>
-    {% endif %}
+  {%- if is_logged_in() -%}
-    </span>
+  <button>Subscribe</button>
-    <div class="thread-actions">
+  <button disabled title="This feature requires JavaScript to be enabled.">Bookmark&hellip;</button>
-      {% if can_subscribe %}
+  {%- endif -%}
-        <form class="modform" action="{{ url_for('threads.subscribe', slug=thread.slug) }}" method="post">
+  <a href="{{url_for('threads.feed', thread_id=thread.id)}}" class="linkbutton rss">Subscribe via RSS</a>
-          <input type='hidden' name='last_visible_post' value='{{posts[-1].id}}'>
+</fieldset>
-          <input type='hidden' name='subscribe' value='{{ 'unsubscribe' if is_subscribed else 'subscribe' }}'>
+{%- if is_mod() -%}
-          <input type='submit' value='{{ 'Unsubscribe' if is_subscribed else 'Subscribe' }}'>
+<fieldset class="plank even no-shadow minimal thread-actions">
+  <legend>Moderation actions</legend>
+  <form method="POST">
+    <input type="hidden" name="lock" value="{{(not thread.locked()) | int}}">
+    <input type="hidden" name="sticky" value="{{(not thread.stickied()) | int}}">
+    <input type="submit" class="warn" value="{{'Unlock' if thread.locked() else 'Lock'}}" formaction="{{url_for('mod.lock_thread', thread_id=thread.id)}}">
+    <input type="submit" class="warn" value="{{'Unsticky' if thread.stickied() else 'Sticky'}}" formaction="{{url_for('mod.sticky_thread', thread_id=thread.id)}}">
   </form>
-      {% endif %}
+  <form class="horizontal wrap" method="POST" action="{{url_for('mod.move_thread', thread_id=thread.id)}}">
-      {% if can_bookmark %}
+    <select name="new_topic_id" id="new-topic-id" autocomplete="off" required>
-        {{ bookmark_button(type="thread", id=thread.id) }}
+      <option selected disabled value="">Move to topic:</option>
-      {% endif %}
+      {%- for t in topics -%}
-      {% if can_lock %}
+      <option value="{{t.id}}" {{'disabled' if t.id==topic.id else ''}}>{{t.name}}</option>
-        <form class="modform" action="{{ url_for("threads.lock", slug=thread.slug) }}" method="post">
+      {%- endfor -%}
-          <input type=hidden name='target_op' value="{{ (not thread.is_locked) | int }}">
-          <input class="warn" type="submit" value="{{"Unlock thread" if thread.is_locked else "Lock thread"}}">
-        </form>
-      {% endif %}
-      {% if active_user and active_user.is_mod() %}
-        <form class="modform" action="{{ url_for("threads.sticky", slug=thread.slug) }}" method="post">
-          <input type=hidden name='target_op' value="{{ (not thread.is_stickied) | int }}">
-          <input class="warn" type="submit" value="{{"Unsticky thread" if thread.is_stickied else "Sticky thread"}}">
-        </form>
-        <form class="modform" action="{{ url_for("threads.move", slug=thread.slug) }}" method="post">
-          <label for="new_topic_id">Move to topic:</label>
-          <select style="width:200px;" id="new_topic_id" name="new_topic_id" autocomplete="off">
-            {% for topic in topics %}
-              <option value="{{ topic['id'] }}" {{ "selected disabled" if (thread.topic_id | string) == (topic['id'] | string) else "" }}>{{ topic['name'] }}</option>
-            {% endfor %}
     </select>
-          <input class="warn" type="submit" value="Move thread">
+    <input type="submit" value="Move" class="warn">
   </form>
-      {% endif %}
+</fieldset>
-    </div>
+<fieldset class="plank even no-shadow minimal thread-actions">
-  </nav>
+  <legend>Page</legend>
-  {% for post in posts %}
+  {{- pager(page, page_count) -}}
-    {{ full_post(post = post, active_user = active_user, is_latest = loop.index == (posts | length), Reactions = Reactions, show_bookmark = can_bookmark) }}
+</fieldset>
-  {% endfor %}
+{%- endif -%}
+{%- endcall -%}
+<main>
+  {%- for post in posts -%}
+  <article id="post-{{post.id}}" class="post plank">
+    {{full_post(post)}}
+  </article>
+  {%- endfor -%}
 </main>
-
+<div class="plank secondary-bg">
-<nav id="bottomnav">
+  <fieldset class="plank even no-shadow minimal thread-actions">
-  {{ pager(current_page = current_page, page_count = page_count) }}
+    <legend>Page</legend>
-</nav>
+    {{- pager(page, page_count) -}}
-
+  </fieldset>
-{% if can_post %}
-  <h1>Respond to "{{ thread.title }}"</h1>
-  {{ babycode_editor_form(ta_name = "post_content")}}
-{% endif %}
-<dialog id="delete-dialog">
-  <div class=delete-dialog-inner>
-    Are you sure you want to delete the highlighted post?
-    <span>
-      <button id=post-delete-dialog-close>Cancel</button>
-      <button class="critical" form=post-delete-form>Delete</button>
-      <form id="post-delete-form" method="post"></form>
-    </span>
-  </div>
-</dialog>
-<input type='hidden' id='allowed-reaction-emoji' value='{{ REACTION_EMOJI | join(' ') }}'>
-<input type='hidden' id='thread-subscribe-endpoint' value='{{ url_for('api.thread_updates', thread_id=thread.id) }}'>
-<div id="new-post-notification" class="new-concept-notification hidden">
-  <div class="new-notification-content">
-    <p>New post in thread!</p>
-    <span class="notification-buttons">
-      <button id="dismiss-new-post-button">Dismiss</button>
-      <a class="linkbutton" id="go-to-new-post-button">View post</a>
-      <button id="unsub-new-post-button">Stop updates</button>
-    </span>
-  </div>
 </div>
-<script src="{{ "/static/js/thread.js" | cachebust }}"></script>
+{%- if is_logged_in() -%}
-{% endblock %}
+<form action="{{url_for('threads.reply', thread_id=thread.id)}}" method="POST" class="plank post-edit-form">
+  <h2 class="info">Reply to "{{thread.title}}"</h2>
+  {{- babycode_editor_component() -}}
+  <span>
+    <input type="checkbox" checked name="subscribe" id="subscribe">
+    <label for="subscribe">Subscribe to thread</label>
+  </span>
+  <span><input type="submit" value="Post reply"></span>
+</form>
+{%- endif -%}
+{%- endblock -%}

app/templates/topics/create.html

@@ -1,14 +0,0 @@
-{% extends "base.html" %}
-{% block title %}creating a topic{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Create topic</h1>
-  <form method="post">
-    <label for=name>Name</label>
-    <input type="text" name="name" id="name" required><br>
-    <label for="description">Description</label>
-    <textarea id="description" name="description" required rows=5></textarea><br>
-    <input type="submit" value="Create topic">
-  </form>
-</div>
-{% endblock %}

app/templates/topics/edit.html

@@ -1,16 +0,0 @@
-{% extends "base.html" %}
-{% block title %}creating a topic{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Editing topic {{ topic['name'] }}</h1>
-  <form method="post">
-    <label for=name>Name</label>
-    <input type="text" name="name" id="name" required value="{{ topic['name'] }}"><br>
-    <label for="description">Description</label>
-    <textarea id="description" name="description" required rows=5>{{ topic['description'] }}</textarea><br>
-    <input type="submit" value="Save changes">
-    <a class="linkbutton warn" href={{ url_for("topics.topic", slug=topic['slug'] )}}>Cancel</a><br>
-    <i> Note: to preserve history, you cannot change the topic URL.</i>
-  </form>
-</div>
-{% endblock %}

app/templates/topics/topic.html

@@ -1,96 +1,70 @@
-{% from 'common/macros.html' import pager, timestamp, motd %}
+{% from 'common/macros.html' import timestamp, subheader, pager %}
-{% from 'common/icons.html' import icn_lock, icn_sticky %}
+{%- extends 'base.html' -%}
-{% extends "base.html" %}
+{%- block title -%}browsing topic {{topic.name}}{%- endblock -%}
-{% block title %}browsing topic {{ topic['name'] }}{% endblock %}
+{%- block content -%}
-{% block content %}
+{%- set td -%}
-<nav class="darkbg">
+<ul class="horizontal">
-  <h1 class="thread-title">All threads in "{{topic['name']}}"</h1>
+  <li>{{topic.description}}</li>
-  <span>{{topic['description']}}</span>
+  {%- if topic.locked() -%}
-  <div>
+  <li class="visible">Locked</li>
-    {% if active_user %}
+  {%- endif -%}
-      {% if not (topic['is_locked']) | int or active_user.is_mod() %}
+</ul>
-        <a class="linkbutton" href="{{ url_for("threads.create", topic_id=topic['id']) }}">New thread</a>
+{%- endset -%}
-      {% endif %}
+{%- call() subheader(('Threads in "%s"' % topic.name), td) -%}
-      {% if active_user.is_mod() %}
+<fieldset class="plank even no-shadow minimal thread-actions">
-        <a class="linkbutton" href="{{url_for("topics.edit", slug=topic['slug'])}}">Edit topic</a>
+  <legend>Actions</legend>
-        <form class="modform" method="post" action="{{url_for("topics.edit", slug=topic['slug']) }}">
+  {%- if is_logged_in() and get_active_user().can_post_to_topic(topic) -%}
-          <input type="hidden" name="is_locked" value="{{ (not topic.is_locked) | int }}">
+  <a href="{{url_for('threads.new', topic_id=topic.id)}}" class="linkbutton">New thread</a>
-          <input class="warn" type="submit" id="lock" value="{{"Unlock topic" if topic['is_locked'] else "Lock topic"}}">
+  {%- endif -%}
-        </form>
+  <a href="{{url_for('topics.feed', topic_id=topic.id)}}" class="linkbutton rss">Subscribe via RSS</a>
-        <button type="button" class="critical" id="topic-delete-dialog-open">Delete</button>
+  <form method="GET">
-      {% endif %}
+    <select name="sort_by">
-    {% endif %}
+      <option value="activity"{% if sort_by == 'activity' %}selected{% endif %}>Sorted by activity</option>
-  </div>
+      <option value="thread" {% if sort_by == 'thread' %}selected{% endif %}>Sorted by newest</option>
-</nav>
+    </select>
-
+    <input type="submit" value="Sort">
-{% if topic['is_locked'] %}
+  </form>
-  {{ infobox("This topic is locked.;Only moderators can create new threads.", InfoboxKind.INFO) }}
+</fieldset>
-{% endif %}
+{%- if is_mod() -%}
-
+<fieldset class="plank even no-shadow minimal thread-actions">
-{%- with motds = get_motds() -%}
+  <legend>Moderation actions</legend>
-  {%- if motds -%}
+  <a href="{{url_for('mod.edit_topic', topic_id=topic.id)}}" class="linkbutton">Edit</a>
-    {%- for motd_obj in motds -%}
+  <form action="{{url_for('mod.lock_topic', topic_id=topic.id)}}" method="POST">
-      {{- motd(motd_obj) -}}
+    <input type="hidden" value="{{(not topic.locked()) | int}}" name="lock">
-    {%- endfor -%}
+    <input type="submit" class="warn" value="{{'Unlock' if topic.locked() else 'Lock'}}">
+  </form>
+</fieldset>
+{%- endif -%}
+{%- if threads | length > 0 -%}
+<fieldset class="plank even no-shadow minimal thread-actions">
+  <legend>Page</legend>
+  {{- pager(page, page_count, args=request.args) -}}
+</fieldset>
+{%- endif -%}
+{%- endcall -%}
+{%- if threads | length == 0 -%}
+<div class="plank"><p>There are no threads in this topic yet.{%- if is_logged_in() and get_active_user().can_post_to_topic(topic) %} Be the first to start a discussion!{%- endif -%}</p></div>
+{%- endif -%}
+{%- for thread in threads -%}
+<div class="topic-info plank">
+  <div class="title-container">
+    <span class="info thread-title-counter"><a href="{{url_for('threads.thread_by_id', thread_id=thread.id)}}">{{thread.title}}</a></span>
+    <ul class="horizontal"></ul>
+    {%- if thread.posts_count / 10 > 1 -%}
+    {{pager(0, (((thread.posts_count / 10) | round(0, 'ceil') )| int), 'flex-last', url=url_for('threads.thread_by_id', thread_id=thread.id))}}
     {%- endif -%}
-{%- endwith -%}
-
-{% if threads_list | length == 0 %}
-  <p>There are no threads in this topic.</p>
-{% else %}
-  {% for thread in threads_list %}
-    <div class="thread">
-      <div class="thread-sticky-container contain-svg">
-        {% if thread['is_stickied'] %}
-          {{ icn_sticky(48) }}
-          <i>Stickied</i>
-        {% endif %}
   </div>
-      <div class="thread-info-container">
+  <span>Started by <a href="{{url_for('users.user_page', username=thread.started_by)}}">{{thread.started_by_display_name if thread.started_by_display_name else thread.started_by}}</a> on {{timestamp(thread.created_at)}}</span>
-        <span class="thread-info-header">
+  <span>{{thread.posts_count}} {{'repl' | pluralize(thread.posts_count, 'y', 'ies')}}</span>
-          <span>
+  <span>Latest post by <a href="{{get_post_url(thread.latest_post_id, _anchor=true)}}">{{thread.latest_post_display_name if thread.latest_post_display_name else thread.latest_post_username}} on {{timestamp(thread.latest_post_created_at)}}</a>{{' (OP)' if thread.posts_count == 1 else ''}}</span>
-            <span class="thread-title"><a href="{{ url_for("threads.thread", slug=thread['slug']) }}">{{thread['title']}}</a>
+</div>
-            {% if thread['id'] in subscriptions %}
+{%- endfor -%}
-            ({{ subscriptions[thread['id']] }} unread)
+{%- if threads | length > 0 -%}
-            {% endif %}
+<div class="plank secondary-bg">
-            </span>
+  <fieldset class="plank even no-shadow minimal thread-actions">
-            &bullet;
+    <legend>Page</legend>
-            <span>
+    {{- pager(page, page_count, args=request.args) -}}
-            Started by <a href="{{ url_for("users.page", username=thread['started_by']) }}">{{ thread['started_by_display_name'] or thread['started_by'] }}</a> on {{ timestamp(thread['created_at']) }}
+  </fieldset>
-            </span>
+</div>
-          </span>
+{%- endif -%}
-        </span>
+{%- endblock -%}
-        <span>
-          Latest post by <a href="{{ url_for("users.page", username=thread['latest_post_username']) }}">{{ thread['latest_post_display_name'] or thread['latest_post_username'] }}</a>
-          on <a href="{{ url_for("threads.thread", slug=thread['slug'], after=thread['latest_post_id']) }}">on {{ timestamp(thread['latest_post_created_at']) }}</a>:
-        </span>
-        <span class="thread-info-post-preview">
-          {{ thread['latest_post_content'] | safe }}
-        </span>
-      </div>
-      <div class="thread-locked-container contain-svg">
-        {% if thread['is_locked'] %}
-          {{ icn_lock(48) }}
-          <i>Locked</i>
-        {% endif %}
-      </div>
-    </div>
-  {% endfor %}
-{% endif %}
-<nav id="bottomnav">
-  {{ pager(current_page = current_page, page_count = page_count) }}
-</nav>
-
-<dialog id="delete-dialog">
-  <div class="delete-dialog-inner">
-    Are you sure you want to delete this topic?
-    <span>
-      <button id=topic-delete-dialog-close>Cancel</button>
-      <button class="critical" form=topic-delete-form>Delete</button>
-      <form id="topic-delete-form" method="post" action="{{ url_for("topics.delete", slug = topic.slug) }}"></form>
-    </span>
-  </div>
-</dialog>
-
-<script src="{{ "/static/js/topic.js" | cachebust }}"></script>
-{% endblock %}

app/templates/topics/topics.html

@@ -1,51 +1,32 @@
-{% from 'common/icons.html' import icn_lock %}
+{% from 'common/macros.html' import timestamp, subheader %}
-{% from 'common/macros.html' import timestamp, motd %}
+{%- extends 'base.html' -%}
-{% extends "base.html" %}
+{%- block content -%}
-{% block content %}
+{%- call() subheader('All topics') -%}
-<nav class="darkbg">
+{%- if is_mod() -%}
-  <h1 class="thread-title">All topics</h1>
+<fieldset class="plank even no-shadow minimal thread-actions">
-  {% if active_user and active_user.is_mod() %}
+  <legend>Moderation actions</legend>
-    <a class="linkbutton" href={{ url_for("topics.create") }}>Create new topic</a>
+  <a href="{{url_for('mod.new_topic')}}" class="linkbutton">New topic</a>
-    <a class="linkbutton" href={{ url_for("mod.sort_topics") }}>Sort topics</a>
+  <a href="{{url_for('mod.sort_topics')}}" class="linkbutton">Sort topics</a>
-  {% endif %}
+</fieldset>
-</nav>
+{%- endif -%}
-{%- with motds = get_motds() -%}
+{%- endcall -%}
-  {%- if motds -%}
+{%- for topic in topics -%}
-    {%- for motd_obj in motds -%}
+<div class="topic-info plank">
-      {{- motd(motd_obj) -}}
+  <div class="title-container">
-    {%- endfor -%}
+    <a class="info" href="{{url_for('topics.topic_by_id', topic_id=topic.id)}}">{{topic.name}}</a>
+  </div>
+  <div>{{topic.description}}</div>
+  <ul class="horizontal">
+    <li>{{topic.threads_count}} {{"thread" | pluralize(topic.threads_count)}}</li>
+    <li>{{topic.posts_count}} {{"post" | pluralize(topic.posts_count)}}</li>
+  </ul>
+  <div>
+  {%- if topic.latest_post_timestamp -%}
+  Latest post at: {{timestamp(topic.latest_post_timestamp)}}
+  {%- else -%}
+  No posts yet
   {%- endif -%}
-{%- endwith -%}
-{% if topic_list | length == 0 %}
-  <p>There are no topics.</p>
-{% else %}
-  {% for topic in topic_list %}
-    <div class="topic">
-      <div class="topic-info-container">
-        <a class="thread-title" href="{{ url_for("topics.topic", slug=topic['slug']) }}">{{ topic['name'] }}</a>
-        {{ topic['description'] }}
-        {% if topic['latest_thread_username'] %}
-          <span>
-            Latest thread: <a href="{{ url_for("threads.thread", slug=topic['latest_thread_slug'])}}">{{topic['latest_thread_title']}}</a> by <a href="{{url_for("users.page", username=topic['latest_thread_username'])}}">{{topic['latest_thread_display_name'] or topic['latest_thread_username']}}</a> on {{ timestamp(topic['latest_thread_created_at']) }}
-          </span>
-          {% if topic['id'] in active_threads %}
-            {% with thread=active_threads[topic['id']] %}
-              <span>
-                Latest post in: <a href="{{ url_for("threads.thread", slug=thread['thread_slug'])}}">{{ thread['thread_title'] }}</a> by <a href="{{ url_for("users.page", username=thread['username'])}}">{{ thread['display_name'] or thread['username'] }}</a> at <a href="{{ get_post_url(thread.post_id, _anchor=true) }}">{{ timestamp(thread['post_created_at']) }}</a>
-              </span>
-            {% endwith %}
-          {% endif %}
-        {% else %}
-          <i>No threads yet.</i>
-        {% endif %}
   </div>
-        <div class="topic-locked-container contain-svg">
+</div>
-          {% if topic['is_locked'] %}
+{%- endfor -%}
-            {{ icn_lock(48) }}
+{%- endblock -%}
-            <i>Locked</i>
-          {% endif %}
-        </div>
-    </div>
-  {% endfor %}
-{% endif %}
-{% endblock %}

app/templates/users/bookmark_collections.html

@@ -1,35 +0,0 @@
-{% extends "base.html" %}
-{% block title %}managing bookmark collections{% endblock %}
-{% block content %}
-<div class="darkbg settings-container">
-  <h1>Manage bookmark collections</h1>
-  <p>Drag collections to reoder them. You cannot move or remove the default collection, but you can rename it.</p>
-  <div>
-    <button type="button" id="add-collection-button">Add new collection</button>
-    <div id="collections-container">
-      {% for collection in collections | sort(attribute='sort_order') %}
-        <div class="draggable-collection {{ "default" if collection.is_default else ""}}"
-            {% if not collection.is_default %}
-            draggable="true"
-            ondragover="dragOver(event)"
-            ondragstart="dragStart(event)"
-            ondragend="dragEnd()"
-            {% else %}
-            id="default-collection"
-            {% endif %}
-            data-collection-id="{{ collection.id }}">
-          <input type="text" class="collection-name" value="{{ collection.name }}" placeholder="Collection name" required autocomplete="off" maxlength="60"><br>
-          <div>{{ collection.get_threads_count() }} {{ "thread" | pluralize(num=collection.get_threads_count()) }}, {{ collection.get_posts_count() }} {{ "post" | pluralize(num=collection.get_posts_count()) }}</div>
-          {% if collection.is_default %}
-            <i>Default collection</i>
-          {% else %}
-            <button type="button" class="delete-button critical">Delete</button>
-          {% endif %}
-        </div>
-      {% endfor %}
-    </div>
-    <button type="button" id="save-button" data-submit-href="{{ url_for('api.manage_bookmark_collections', user_id=active_user.id) }}">Save</button>
-  </div>
-</div>
-<script src="{{ "/static/js/manage-bookmark-collections.js" | cachebust }}"></script>
-{% endblock %}

app/templates/users/bookmarks.html

@@ -1,52 +0,0 @@
-{% from "common/macros.html" import accordion, full_post, bookmark_button %}
-{% from "common/icons.html" import icn_bookmark %}
-{% extends "base.html" %}
-{% block title %}bookmarks{% endblock %}
-{% block content %}
-<div class="darkbg inbox-container">
-  <a class="linkbutton" href="{{ url_for('users.bookmark_collections', username=get_active_user().username) }}">Manage collections</a>
-  {% for collection in collections | sort(attribute='sort_order') %}
-    {% call(section) accordion(disabled=collection.is_empty()) %}
-      {% if section == 'header' %}
-        <h1 class="thread-title">{{ collection.name }}</h1>{{" (no bookmarks)" if collection.is_empty() else ""}}
-      {% else %}
-        {% call(inner_section) accordion(disabled=not collection.has_threads()) %}
-          {% if inner_section == 'header' %}
-          Threads{{" (no bookmarks)" if not collection.has_threads() else ""}}
-          {% else %}
-            <table class="colorful-table">
-              <thead>
-                <th>Title</th>
-                <th>Memo</th>
-                <th class="small">Manage</th>
-              </thead>
-              {% for thread in collection.get_threads() %}
-                <tr>
-                  <td>
-                    <a href="{{ url_for('threads.thread', slug=thread.get_thread().slug) }}">{{ thread.get_thread().title }}</a>
-                  </td>
-                  <td>
-                    <i>{{ thread.note }}</i>
-                  </td>
-                  <td>
-                    {{ bookmark_button(type='thread', id=thread.thread_id, message='Manage&hellip;', require_reload=true) }}
-                  </td>
-                </tr>
-              {% endfor %}
-            </table>
-          {% endif %}
-        {% endcall %}
-        {% call(inner_section) accordion(disabled=not collection.has_posts()) %}
-          {% if inner_section == 'header' %}
-          Posts{{" (no bookmarks)" if not collection.has_posts() else ""}}
-          {% else %}
-            {% for post in collection.get_posts() %}
-              {{ full_post(post.get_post().get_full_post_view(), no_reply=false, render_sig=false, show_thread_title=true, show_bookmark=true, memo=post.note, bookmark_message="Manage&hellip;", reload_after_bookmark=true) }}
-            {% endfor %}
-          {% endif %}
-        {% endcall %}
-      {% endif %}
-    {% endcall %}
-  {% endfor %}
-</div>
-{% endblock %}

app/templates/users/delete_page.html

@@ -1,15 +0,0 @@
-{% extends 'base.html' %}
-{% block title %}delete confirmation{% endblock %}
-{% block content %}
-<div class="darkbg login-container">
-  <h1>Confirm account deletion</h1>
-  <p>Are you sure you want to delete your account on {{ config.SITE_NAME }}? <strong>This action is irreversible.</strong> Your posts and threads will remain accessible to preserve history but will be de-personalized, showing up as authored by a system user. Posts that @mention you will also mention the system user instead.</p>
-  <p>If you wish for any and all content relating to you to be removed, you will have to <a href="{{url_for("guides.contact")}}" target="_blank">contact {{ config.SITE_NAME }}'s administrators separately.</a></p>
-  <p>If you are sure, please confirm your current password below.</p>
-  <form method="post">
-    <label for="password">Confirm password</label>
-    <input type="password" id="password" name="password" required autocomplete="current-password">
-    <input class="critical" type="submit" value="Delete account">
-  </form>
-</div>
-{% endblock %}

app/templates/users/inbox.html

@@ -1,65 +0,0 @@
-{% from "common/macros.html" import timestamp, full_post, accordion %}
-{% extends "base.html" %}
-{% block title %}inbox{% endblock %}
-{% block content %}
-<div class="darkbg inbox-container">
-  {% set has_subscriptions = all_subscriptions is not none %}
-  {% call(section) accordion(disabled=not has_subscriptions) %}
-    {% if section == "header" %}
-      {% if not has_subscriptions %}
-        (You have no subscriptions)
-      {% else %}
-        Your subscriptions
-      {% endif %}
-    {% elif section == "content" and has_subscriptions %}
-      <table class="colorful-table">
-        <thead>
-          <th>Thread</th>
-          <th class="small">Unsubscribe</th>
-        </thead>
-        {% for sub in all_subscriptions %}
-          <tr>
-            <td>
-              <a href=" {{ url_for("threads.thread", slug=sub.thread_slug) }} ">{{ sub.thread_title }}</a>
-            </td>
-            <td>
-              <form class="modform" method="post" action="{{ url_for("threads.subscribe", slug = sub.thread_slug) }}">
-                <input type="hidden" name="subscribe" value="unsubscribe">
-                <input class="warn" type="submit" value="Unsubscribe">
-              </form>
-            </td>
-          </tr>
-        {% endfor %}
-      </table>
-    {% endif %}
-  {% endcall %}
-  {% if has_subscriptions %}
-    {% if not new_posts %}
-      You have no unread posts.
-    {% else %}
-      You have {{ total_unreads_count }} total unread {{("post" | pluralize(num=total_unreads_count))}}:
-      {% for thread in new_posts %}
-        {% call(section) accordion() %}
-          {% if section == "header" %}
-            {% set latest_post_id = thread.posts[-1].id %}
-            {% set unread_posts_text = " (" + (thread.unread_count | string) + (" unread post" | pluralize(num=thread.unread_count)) %}
-            <a class="accordion-title" href="{{ url_for("threads.thread", slug=thread.thread_slug, after=latest_post_id, _anchor="post-" + (latest_post_id | string)) }}" title="Jump to latest post">{{thread.thread_title + unread_posts_text}}, latest at {{ timestamp(thread.newest_post_time) }})</a>
-            <form class="modform" method="post" action="{{ url_for("threads.subscribe", slug = thread.thread_slug) }}">
-              <input type="hidden" name="subscribe" value="read">
-              <input type="submit" value="Mark thread as Read">
-            </form>
-            <form class="modform" method="post" action="{{ url_for("threads.subscribe", slug = thread.thread_slug) }}">
-              <input type="hidden" name="subscribe" value="unsubscribe">
-              <input class="warn" type="submit" value="Unsubscribe">
-            </form>
-          {% elif section == "content" %}
-            {% for post in thread.posts %}
-              {{ full_post(post, no_reply = true) }}
-            {% endfor %}
-          {% endif %}
-        {% endcall %}
-      {% endfor %}
-    {% endif %}
-  {% endif %}
-</div>
-{% endblock %}

app/templates/users/invite_links.html

@@ -1,36 +0,0 @@
-{% from 'common/macros.html' import accordion %}
-{% extends 'base.html' %}
-{% block title %}invites{% endblock %}
-{% block content %}
-<div class="darkbg inbox-container">
-  <p>To manage growth, {{ config.SITE_NAME }} disallows direct sign ups. Instead, users already with an account may invite people they know. You can create invite links here. Once an invite link is used to sign up, it can no longer be used.</p>
-  {% call(section) accordion(disabled=invites | length == 0) %}
-    {% if section == 'header' %}
-    Your invites
-    {% else %}
-      {% if invites %}
-        <table class="colorful-table">
-          <thead>
-            <th class='small'>Link</th>
-            <th class='small'>Revoke</th>
-          </thead>
-        {% for invite in invites %}
-          <tr>
-            <td><a href="{{url_for('users.sign_up', key=invite.key)}}">Link</a></td>
-            <td>
-              <form method="post" action="{{ url_for('users.revoke_invite_link', username=active_user.username) }}">
-                <input type=hidden value="{{ invite.key }}" name="key">
-                <input type=submit class=warn value="Revoke">
-              </form>
-            </td>
-          </tr>
-        {% endfor %}
-        </table>
-      {% endif %}
-    {% endif %}
-  {% endcall %}
-  <form method="post" action="{{ url_for('users.create_invite_link', username=active_user.username) }}">
-    <input type=submit value="Create new invite">
-  </form>
-</div>
-{% endblock %}

app/templates/users/log_in.html

@@ -1,14 +1,22 @@
-{% extends 'base.html' %}
+{% from 'common/macros.html' import subheader %}
-{% block title %}Log in{% endblock %}
+{%- extends 'base.html' -%}
-{% block content %}
+{%- block title -%}log in{%- endblock -%}
-<div class="darkbg login-container">
+{%- block content -%}
-  <h1>Log in</h1>
+{%- set welcome -%}
-  <form method="post">
+Welcome back! No account yet? <a href="{{url_for('users.sign_up')}}">Sign up</a>
-    <label for="username">Username</label><br>
+{%- endset -%}
-    <input type="text" id="username" name="username" required autocomplete="username"><br>
+{{ subheader('Log in', welcome)}}
-    <label for="password">Password</label><br>
+{%- if request.args.get('error') -%}
-    <input type="password" id="password" name="password" required autocomplete="current-password"><br>
+<div class="infobox plank critical">
-    <input type="submit" value="Log in">
+  {{request.args.get('error')}}
-  </form>
 </div>
-{% endblock %}
+{%- endif -%}
+<form class="plank primary-bg full-width" method="POST">
+  <label for="username">Username</label>
+  <input type="text" id="username" name="username" autocomplete="username" required>
+  <label for="password">Password</label>
+  <input type="password" id="password" name="password" autocomplete="current-password" required>
+  <span><input type="checkbox" name="remember" id="remember"> <label for="remember">Remember me</label></span>
+  <input type="submit" value="Log in">
+</form>
+{%- endblock -%}

app/templates/users/reset_link_login.html

@@ -1,15 +0,0 @@
-{% extends 'base.html' %}
-{% block title %}Reset password{% endblock %}
-{% block content %}
-<div class="darkbg login-container">
-  <h1>Reset password for {{username}}</h1>
-  <p>Send this link to {{username}} to allow them to reset their password.</p>
-  <form method="post">
-    <label for="password">New password</label><br>
-    <input type="password" id="password" name="password" autocomplete="new-password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required><br>
-    <label for="password2">Confirm password</label><br>
-    <input type="password" id="password2" name="password2" autocomplete="new-password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required><br>
-    <input type="submit" value="Reset password">
-  </form>
-</div>
-{% endblock %}

app/templates/users/settings.html

@@ -1,61 +0,0 @@
-{% from 'common/macros.html' import babycode_editor_component %}
-{% extends 'base.html' %}
-{% block title %}settings{% endblock %}
-{% block content %}
-{% set disable_avatar = not is_logged_in() %}
-<div class='darkbg settings-container'>
-  <h1>User settings</h1>
-  <div class="settings-grid">
-    <fieldset class="hfc">
-      <legend>Set avatar</legend>
-      <form class='avatar-form' method='post' action='{{ url_for('users.set_avatar', username=active_user.username) }}' enctype='multipart/form-data'>
-        <img src='{{ active_user.get_avatar_url() }}'>
-        <input id='file' type='file' name='avatar' accept='image/*' required>
-        <div>
-          <input type='submit' value='Save avatar' {{ 'disabled' if disable_avatar else '' }}>
-          <input type='submit' value='Clear avatar' formaction='{{ url_for('users.clear_avatar', username=active_user.username) }}' formnovalidate {{ 'disabled' if active_user.is_default_avatar() else '' }}>
-        </div>
-        <span>1MB maximum size. Avatar will be scaled down to fit a square.</span>
-      </form>
-    </fieldset>
-    <fieldset class="hfc">
-      <legend>Personalization</legend>
-      <form method='post'>
-        <label for='theme'>Theme (beta)</label>
-        <select autocomplete='off' id='theme' name='theme'>
-          {% for theme in config.allowed_themes %}
-            <option value="{{ theme }}" {{ 'selected' if get_prefers_theme() == theme }}>{{ theme | theme_name }}</option>
-          {% endfor %}
-        </select>
-        <label for='topic_sort_by'>Sort threads by:</label>
-        <select id='topic_sort_by' name='topic_sort_by'>
-          <option value='activity' {{ 'selected' if session['sort_by'] == 'activity' else '' }}>Latest activity</option>
-          <option value='thread' {{ 'selected' if session['sort_by'] == 'thread' else '' }}>Thread creation date</option>
-        </select>
-        <label for='display_name'>Display name</label>
-        <input type='text' id='display_name' name='display_name' value='{{ active_user.display_name }}' pattern="(?:[\w!#$%^*\(\)\-_=+\[\]\{\}\|;:,.?\s]{3,50})?" title='3-50 characters, no @, no <>, no &' placeholder='Optional. Will be shown in place of username.' autocomplete='off'></input>
-        <label for='status'>Status</label>
-        <input type='text' id='status' name='status' value='{{ active_user.status }}' maxlength=100 placeholder='Will be shown under your name. Max 100 characters.'>
-        <input autocomplete='off' type='checkbox' id='subscribe_by_default' name='subscribe_by_default' {{ 'checked' if session.get('subscribe_by_default', default=true) else '' }}>
-        <label for='subscribe_by_default'>Subscribe to thread by default when responding</label><br>
-        <label for='babycode-content'>Signature</label>
-        {{ babycode_editor_component(ta_name='signature', prefill=active_user.signature_original_markup, ta_placeholder='Will be shown under each of your posts', optional=true, banned_tags=SIG_BANNED_TAGS) }}
-        <input type='submit' value='Save settings'>
-      </form>
-    </fieldset>
-    <fieldset class="hfc">
-      <legend>Change password</legend>
-      <form method='post' action='{{ url_for('users.change_password', username=active_user.username) }}'>
-        <label for="new_password">New password</label><br>
-        <input type="password" id="new_password" name="new_password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
-        <label for="new_password2">Confirm new password</label><br>
-        <input type="password" id="new_password2" name="new_password2" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
-        <input class="warn" type="submit" value="Change password">
-      </form>
-    </fieldset>
-  </div>
-  <div>
-    <a class="linkbutton critical" href="{{ url_for('users.delete_page', username=active_user.username) }}">Delete account</a>
-  </div>
-</div>
-{% endblock %}

app/templates/users/sign_up.html

@@ -1,25 +1,24 @@
-{% extends 'base.html' %}
+{% from 'common/macros.html' import subheader %}
-{% block title %}Sign up{% endblock %}
+{%- extends 'base.html' -%}
-{% block content %}
+{%- block title -%}sign up{%- endblock -%}
-<div class="darkbg login-container">
+{%- block content -%}
-  <h1>Sign up</h1>
+{%- set welcome -%}
-  {% if inviter %}
+Please read the rules etc. stub
-  <p>You have been invited by <a href="{{ url_for('users.page', username=inviter.username) }}">{{ inviter.get_readable_name() }}</a> to join {{ config.SITE_NAME }}. Create an identity below.</p>
+{%- endset -%}
-  {% endif %}
+{{ subheader('Sign up', welcome)}}
-  <form method="post">
+{%- if request.args.get('error') -%}
-    {% if key %}
+<div class="infobox plank critical">
-      <input type="hidden" value={{key}} name="key">
+  {{request.args.get('error')}}
-    {% endif %}
-    <label for="username">Username</label><br>
-    <input type="text" id="username" name="username" pattern="[a-zA-Z0-9_-]{3,20}" title="3-20 characters. Only upper and lowercase letters, digits, hyphens, and underscores" required autocomplete="username"><br>
-    <label for="password">Password</label>
-    <input type="password" id="password" name="password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,255}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
-    <label for="password-confirm">Confirm Password</label>
-    <input type="password" id="password-confirm" name="password-confirm" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,255}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" required autocomplete="new-password"><br>
-    <input type="submit" value="Sign up">
-  </form>
-  {% if not inviter %}
-  <span>After you sign up, a moderator will need to confirm your account before you will be allowed to post.</span>
-  {% endif %}
 </div>
-{% endblock %}
+{%- endif -%}
+<form class="plank primary-bg full-width" method="POST">
+  <label for="username">Username</label>
+  <input type="text" id="username" name="username" pattern="[a-zA-Z0-9_\-]{3,24}" title="3-24 characters. Only upper and lowercase letters, digits, hyphens, and underscores" autocomplete="username" required>
+  <label for="password">Create password</label>
+  <input type="password" id="password" name="password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,255}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" autocomplete="new-password" required>
+  <label for="password2">Confirm password</label>
+  <input type="password" id="password2" name="password" pattern="(?=.*[a-z])(?=.*[A-Z])(?=.*\d)(?=.*[\W_])(?!.*\s).{10,255}" title="10+ chars with: 1 uppercase, 1 lowercase, 1 number, 1 special char, and no spaces" autocomplete="new-password" required>
+  <span><input type="checkbox" name="remember" id="remember"> <label for="remember">Remember me</label></span>
+  <input type="submit" value="Sign up">
+</form>
+{%- endblock -%}

app/templates/users/user.html

@@ -1,96 +0,0 @@
-{% from 'common/macros.html' import timestamp %}
-{% extends 'base.html' %}
-{% block title %}{{ target_user.get_readable_name() }}'s profile{% endblock %}
-{% block content %}
-<div class="darkbg">
-  <h1 class="thread-title"><i>{{ target_user.get_readable_name() }}</i>'s profile</h1>
-  {% if active_user.id == target_user.id %}
-    <div class="user-actions">
-      <a class="linkbutton" href="{{ url_for("users.settings", username = active_user.username) }}">Settings</a>
-      <form method="post" action="{{ url_for("users.log_out") }}">
-        <input class="warn" type="submit" value="Log out">
-      </form>
-    </div>
-    {% if active_user.is_guest() %}
-      <h2>You are a guest. A Moderator needs to approve your account before you will be able to post.</h2>
-    {% endif %}
-  {% endif %}
-  {% if active_user and active_user.is_mod() and not target_user.is_system() %}
-    <h1 class="thread-title">Moderation controls</h1>
-    {% if target_user.is_guest() %}
-      <p>This user is a guest. They signed up on {{ timestamp(target_user['created_at']) }}</p>
-      <form class="modform" method="post" action="{{ url_for("users.confirm_user", user_id=target_user.id) }}">
-        <input type="submit" value="Confirm user">
-      </form>
-    {% else %}
-      <p>This user signed up on {{ timestamp(target_user['created_at']) }} and was confirmed on {{ timestamp(target_user['confirmed_on']) }}</p>
-      {% if (target_user.permission | int) < (active_user.permission | int) %}
-        <form class="modform" method="post" action="{{ url_for("users.guest_user", user_id=target_user.id) }}">
-          <input class="warn" type="submit" value="Demote user to guest (soft ban)">
-        </form>
-      {% endif %}
-      {% if active_user.is_admin() and not target_user.is_mod() %}
-        <form class="modform" method="post" action="{{ url_for("users.mod_user", user_id=target_user.id) }}">
-          <input class="warn" type="submit" value="Promote user to moderator">
-        </form>
-      {% elif target_user.is_mod() and (target_user.permission | int) < (active_user.permission | int) %}
-        <form class="modform" method="post" action="{{ url_for("users.demod_user", user_id=target_user.id) }}">
-          <input class="critical" type="submit" value="Demote user to regular user">
-        </form>
-      {% endif %}
-    {% endif %}
-  {% endif %}
-</div>
-<div class="user-info">
-  <div class="user-page-usercard">
-    <div class="usercard-inner">
-      <img class="avatar" src="{{ target_user.get_avatar_url() }}">
-      <strong class="big">{{ target_user.get_readable_name() }}</strong>
-      <em><abbr title="Mention">@{{ target_user.username }}</abbr></em>
-      {% if target_user.status %}
-        <em class="user-status">{{ target_user.status }}</em>
-      {% endif %}
-      {% if target_user.signature_rendered %}
-        Signature:
-        <div>{{ target_user.signature_rendered | safe }}</div>
-      {% endif %}
-    </div>
-  </div>
-  <div class="user-page-stats">
-    {% with stats = target_user.get_post_stats() %}
-      <ul class="user-stats-list">
-        <li>Permission: {{ target_user.permission | permission_string }}</li>
-        <li>Posts created: {{ stats.post_count }}</li>
-        <li>Threads started: {{ stats.thread_count }}</li>
-        {% if stats.latest_thread_title %}
-          <li>Latest started thread: <a href="{{ url_for("threads.thread", slug = stats.latest_thread_slug) }}">{{ stats.latest_thread_title }}</a>
-        {% endif %}
-        {% if stats.inviter_username %}
-          <li>Invited by <a href="{{ url_for('users.page', username=stats.inviter_username) }}">{{ stats.inviter_display_name or stats.inviter_username }}</a></li>
-        {% endif %}
-      </ul>
-    {% endwith %}
-    Latest posts:
-    {% with posts = target_user.get_latest_posts() %}
-      <div class="user-page-posts">
-        {% for post in posts %}
-          <div class="post-content-container">
-            <div class="post-info">
-              <a href="{{ url_for("threads.thread", slug=post.thread_slug, after=post.id) }}" title="permalink"><i>
-              {% if (post.edited_at | int) > (post.created_at | int) %}
-                Edited on {{ timestamp(post.edited_at) }}
-              {% else %}
-                Posted on {{ timestamp(post.edited_at) }}
-              {% endif %}
-              </i></a>
-            </div>
-            <div class="post-content user-page-post-preview">
-              <div class="post-inner wider">{{ post.content | safe }}</div>
-            </div>
-          </div>
-        {% endfor %}
-      </div>
-    {% endwith %}
-  </div>
-</div>
-{% endblock %}

app/templates/users/user_page.html

@@ -0,0 +1,98 @@
+{%- from 'common/macros.html' import subheader, timestamp, pager -%}
+{%- extends 'base.html' -%}
+{%- block title -%}{{ target_user.get_readable_name() }}'s profile{%- endblock -%}
+{%- set stats = target_user.get_post_stats() -%}
+{%- block content -%}
+{%- call() subheader("%s's profile" % target_user.get_readable_name()) -%}
+{%- if is_logged_in() -%}
+
+{%- if target_user.id == get_active_user().id -%}
+<fieldset class="plank even no-shadow minimal thread-actions">
+  <legend>Actions</legend>
+  <form action="{{url_for('users.log_out')}}" method="POST">
+    <input type="submit" class="warn" value="Log out">
+  </form>
+</fieldset>
+{%- endif -%}
+
+{%- if get_active_user().is_mod() and target_user.id != get_active_user().id -%}
+<fieldset class="plank even no-shadow minimal thread-actions">
+  <legend>Moderation actions</legend>
+  <form method="POST">
+    {{csrf_input() | safe}}
+    {%- if target_user.is_guest() -%}
+    <input class="warn" type="submit" value="Approve user" formaction="{{url_for('mod.make_user_regular', user_id=target_user.id)}}">
+    {%- else -%}
+    <input class="warn" type="submit" value="Demote to guest (soft ban)" formaction="{{url_for('mod.make_user_guest', user_id=target_user.id)}}">
+      {%- if get_active_user().is_admin() -%}
+        {%- if not target_user.is_mod_only() -%}
+        <input class="warn" type="submit" value="Promote to moderator" formaction="{{url_for('mod.make_user_mod', user_id=target_user.id)}}">
+        {%- else -%}
+        <input class="warn" type="submit" value="Demote from moderator" formaction="{{url_for('mod.make_user_regular', user_id=target_user.id)}}">
+        {%- endif -%}
+      {%- endif -%}
+    {%- endif -%}
+  </form>
+</fieldset>
+{%- endif -%}
+
+{%- endif -%}
+{%- endcall -%}
+<div class="userpage-usercard">
+  <div class="usercard plank even contrast-bg minimal no-shadow">
+    <div class="usercard-inner">
+      <img src="{{target_user.get_avatar_url()}}" class="avatar">
+    </div>
+  </div>
+  <div class="plank even minimal no-shadow user-stats">
+    <h3 class="info">{{target_user.get_readable_name()}}</h3>
+    <span>Display name: {{target_user.get_readable_name()}}</span>
+    <span>Mention: @{{target_user.username}}</span>
+    <span>Status: <em>{{target_user.status}}</em></span>
+    <span>Rank: {{target_user.permission | permission_string}}</span>
+    {%- set time = target_user.created_at -%}
+    {%- if target_user.approved_at -%}
+    {%- set time = target_user.approved_at -%}
+    {%- endif -%}
+    <span>Joined: {{timestamp(target_user.created_at)}}</span>
+    {%- if not target_user.is_guest() -%}
+    <span>Posts: <a href="{{url_for('users.posts', username=target_user.username)}}">{{stats.post_count}}</a></span>
+    <span>Threads started: <a href="{{url_for('users.threads', username=target_user.username)}}">{{stats.thread_count}}</a></span>
+    {%- set badges = target_user.get_badges() -%}
+
+    {%- if badges -%}
+    <div class="badges-container nocenter">
+      Badges:
+      {%- for badge in badges -%}
+      {%- if badge.link -%}<a href="{{badge.link}}">{%- endif -%}
+      <img src="{{badge.get_image_url()}}" alt="{{badge.label}}" title="{{badge.label}}" class="badge-button">
+      {%- if badge.link -%}</a>{%- endif -%}
+      {%- endfor -%}
+    </div>
+    {%- endif -%}
+    <fieldset class="plank secondary-bg minimal even no-shadow">
+      <legend>About me</legend>
+      <p>stub</p>
+    </fieldset>
+    {%- if target_user.signature_rendered -%}
+    <fieldset class="plank secondary-bg minimal even no-shadow">
+      <legend>Signature</legend>
+      {{target_user.signature_rendered | safe}}
+    </fieldset>
+    {%- endif -%}
+    {#
+    <fieldset class="plank secondary-bg minimal even no-shadow">
+      <legend>Profile comments</legend>
+      <fieldset class="plank minimal even no-shadow">
+        <legend>Page</legend>
+        {{pager(0, 3, url=url_for('users.log_in'))}}
+      </fieldset>
+      <div class="post plank">
+        <p>stub</p>
+      </div>
+    </fieldset>
+    #}
+    {%- endif -%}
+  </div>
+</div>
+{%- endblock -%}

app/util.py

@@ -0,0 +1,26 @@
+from flask import url_for, session
+from .models import Posts, Threads
+from .auth import is_logged_in
+
+def get_post_url(post_id, _anchor=False, external=False):
+    post = Posts.find({'id': post_id})
+    if not post:
+        return ''
+
+    thread = Threads.find({'id': post.thread_id})
+
+    anchor = None if not _anchor else f'post-{post_id}'
+
+    return url_for('threads.thread_by_id', thread_id=thread.id, after=post_id, _external=external, _anchor=anchor)
+
+def dict_to_query_string(d) -> str:
+    return '?' + '&'.join([f'{key}={str(value)}' for key, value in d.items()])
+
+def get_csrf_token():
+    if not is_logged_in():
+        return ''
+
+    return session.get('csrf', '')
+
+def csrf_input():
+    return f'<input type="hidden" name="csrf" value="{get_csrf_token()}">'

build-themes.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-set -e
-
-sass_dir="sass"
-css_dir="data/static/css"
-
-if [[ "$1" == "--watch" && -n "$2" ]]; then
-  file="$2"
-  [[ $(basename "$file") = _* ]] && exit 1
-  sass --no-source-map --watch "$file" "$css_dir/theme-$(basename "$file" .scss).css"
-else
-  set -u
-  rm -r "$css_dir/"
-  #build default first
-  sass --no-source-map "$sass_dir/_default.scss" "$css_dir/style.css"
-  for file in "$sass_dir"/*.scss; do
-    [[ $(basename "$file") = _* ]] && continue
-    sass --no-source-map "$file" "$css_dir/theme-$(basename "$file" .scss).css"
-  done
-fi

config/pyrom_config.toml

@@ -1,18 +0,0 @@
-SITE_NAME = "Porom"
-DISABLE_SIGNUP = false # if true, no one can sign up.
-
-# if neither of the following two options is true,
-# no one can sign up. this may be useful later when/if LDAP is implemented.
-
-MODS_CAN_INVITE = true # if true, allows moderators to create invite links. useless unless DISABLE_SIGNUP to be true.
-USERS_CAN_INVITE = false # if true, allows users to create invite links. useless unless DISABLE_SIGNUP to be true.
-
-# contact information, will be shown in /guides/contact
-# some babycodes allowed
-# forbidden tags: [spoiler], [img], @mention, [big], [small], [center], [right], [color]
-ADMIN_CONTACT_INFO = ""
-
-# forum information. shown in the introduction guide at /guides/user/introduction
-# some babycodes allowed
-# forbidden tags: [spoiler], [img], @mention, [big], [small], [center], [right], [color]
-GUIDE_DESCRIPTION = ""

config/pyrom_config.toml.example

@@ -0,0 +1,38 @@
+### REQUIRED CONFIGURATION
+## the following settings are required.
+## the app will not work if they are missing.
+
+# the domain name you will be serving Pyrom from, without the scheme, including the subdomain(s).
+# this is overridden by the app in development.
+# used for generating URLs.
+# the app will not start if this field is missing.
+SERVER_NAME = "forum.your.domain"
+
+### OPTIONAL CONFIGURATION
+## the following settings are set to their default values.
+## you can override any of them.
+
+# your forum's name, shown on the header.
+SITE_NAME = "Pyrom"
+
+# if true, users can not sign up manually. see the following two settings.
+DISABLE_SIGNUP = false
+
+# if neither of the following two options is true,
+# no one can sign up. this may be useful later when/if LDAP is implemented.
+
+# if true, allows moderators to create invite links. useless unless DISABLE_SIGNUP is true.
+MODS_CAN_INVITE = true
+
+# if true, allows users to create invite links. useless unless DISABLE_SIGNUP is true.
+USERS_CAN_INVITE = false
+
+# contact information, will be shown in /guides/contact
+# some babycodes allowed
+# forbidden tags: [spoiler], [img], @mention, [big], [small], [center], [right], [color]
+ADMIN_CONTACT_INFO = ""
+
+# forum information. shown in the introduction guide at /guides/user/introduction
+# some babycodes allowed
+# forbidden tags: [spoiler], [img], @mention, [big], [small], [center], [right], [color]
+GUIDE_DESCRIPTION = ""

data/static/css/normalize.css

@@ -0,0 +1,223 @@
+/*! modern-normalize v3.0.1 | MIT License | https://github.com/sindresorhus/modern-normalize */
+
+/*
+ * Document
+ * ========
+ */
+
+/**
+ * Use a better box model (opinionated).
+ */
+
+*,
+::before,
+::after {
+  box-sizing: border-box;
+}
+
+/**
+ * 1. Improve consistency of default fonts in all browsers. (https://github.com/sindresorhus/modern-normalize/issues/3)
+ * 2. Correct the line height in all browsers.
+ * 3. Prevent adjustments of font size after orientation changes in iOS.
+ * 4. Use a more readable tab size (opinionated).
+ */
+
+html {
+  font-family:
+  system-ui,
+  'Segoe UI',
+  Roboto,
+  Helvetica,
+  Arial,
+  sans-serif,
+  'Apple Color Emoji',
+  'Segoe UI Emoji'; /* 1 */
+  line-height: 1.15; /* 2 */
+  -webkit-text-size-adjust: 100%; /* 3 */
+  tab-size: 4; /* 4 */
+}
+
+/*
+ * Sections
+ * ========
+ */
+
+/**
+ * Remove the margin in all browsers.
+ */
+
+body {
+  margin: 0;
+}
+
+/*
+ * Text-level semantics
+ * ====================
+ */
+
+/**
+ * Add the correct font weight in Chrome and Safari.
+ */
+
+b,
+strong {
+  font-weight: bolder;
+}
+
+/**
+ * 1. Improve consistency of default fonts in all browsers. (https://github.com/sindresorhus/modern-normalize/issues/3)
+ * 2. Correct the odd 'em' font sizing in all browsers.
+ */
+
+code,
+kbd,
+samp,
+pre {
+  font-family:
+  ui-monospace,
+  SFMono-Regular,
+  Consolas,
+  'Liberation Mono',
+  Menlo,
+  monospace; /* 1 */
+  font-size: 1em; /* 2 */
+}
+
+/**
+ * Add the correct font size in all browsers.
+ */
+
+small {
+  font-size: 80%;
+}
+
+/**
+ * Prevent 'sub' and 'sup' elements from affecting the line height in all browsers.
+ */
+
+sub,
+sup {
+  font-size: 75%;
+  line-height: 0;
+  position: relative;
+  vertical-align: baseline;
+}
+
+sub {
+  bottom: -0.25em;
+}
+
+sup {
+  top: -0.5em;
+}
+
+/*
+ * Tabular data
+ * ============
+ */
+
+/**
+ * Correct table border color inheritance in Chrome and Safari. (https://issues.chromium.org/issues/40615503, https://bugs.webkit.org/show_bug.cgi?id=195016)
+ */
+
+table {
+  border-color: currentcolor;
+}
+
+/*
+ * Forms
+ * =====
+ */
+
+/**
+ * 1. Change the font styles in all browsers.
+ * 2. Remove the margin in Firefox and Safari.
+ */
+
+button,
+input,
+optgroup,
+select,
+textarea {
+  font-family: inherit; /* 1 */
+  font-size: 100%; /* 1 */
+  line-height: normal; /* 1 */
+  margin: 0; /* 2 */
+}
+
+/**
+ * Correct the inability to style clickable types in iOS and Safari.
+ */
+
+button,
+[type='button'],
+[type='reset'],
+[type='submit'] {
+  -webkit-appearance: button;
+}
+
+/**
+ * Remove the padding so developers are not caught out when they zero out 'fieldset' elements in all browsers.
+ */
+
+legend {
+  padding: 0;
+}
+
+/**
+ * Add the correct vertical alignment in Chrome and Firefox.
+ */
+
+progress {
+  vertical-align: baseline;
+}
+
+/**
+ * Correct the cursor style of increment and decrement buttons in Safari.
+ */
+
+::-webkit-inner-spin-button,
+::-webkit-outer-spin-button {
+  height: auto;
+}
+
+/**
+ * 1. Correct the odd appearance in Chrome and Safari.
+ * 2. Correct the outline style in Safari.
+ */
+
+[type='search'] {
+  -webkit-appearance: textfield; /* 1 */
+  outline-offset: -2px; /* 2 */
+}
+
+/**
+ * Remove the inner padding in Chrome and Safari on macOS.
+ */
+
+::-webkit-search-decoration {
+  -webkit-appearance: none;
+}
+
+/**
+ * 1. Correct the inability to style clickable types in iOS and Safari.
+ * 2. Change font properties to 'inherit' in Safari.
+ */
+
+::-webkit-file-upload-button {
+  -webkit-appearance: button; /* 1 */
+  font: inherit; /* 2 */
+}
+
+/*
+ * Interactive
+ * ===========
+ */
+
+/*
+ * Add the correct display in Chrome and Safari.
+ */
+
+summary {
+  display: list-item;
+}

data/static/js/babycode-editor.js

@@ -1,40 +0,0 @@
-{
-  let ta = document.getElementById("babycode-content");
-  
-  ta.addEventListener("keydown", (e) => {
-    if(e.key === "Enter" && e.ctrlKey) {
-      if (inThread()) {
-        localStorage.removeItem(window.location.pathname);
-      }
-      e.target.form?.submit();
-    }
-  })
-  
-  const inThread = () => {
-    const scheme = window.location.pathname.split("/");
-    return scheme[1] === "threads" && scheme[2] !== "create";
-  }
-  
-  ta.addEventListener("input", () => {
-    if (!inThread()) return;
-    
-    localStorage.setItem(window.location.pathname, ta.value);
-  })
-
-  if (inThread()) {
-    const form = ta.closest('.post-edit-form');
-    console.log(ta.closest('.post-edit-form'));
-    if (form){
-      form.addEventListener("submit", () => {
-        localStorage.removeItem(window.location.pathname);
-      })
-    }
-  }
-
-  document.addEventListener("DOMContentLoaded", () => {
-    if (!inThread()) return;
-    const prevContent = localStorage.getItem(window.location.pathname);
-    if (!prevContent) return;
-    ta.value = prevContent;
-  })
-}

data/static/js/bitties/pyrom-bitty.js

@@ -1,279 +0,0 @@
-const bookmarkMenuHrefTemplate = '/hyperapi/bookmarks-dropdown';
-const previewEndpoint = '/api/babycode-preview';
-const userEndpoint = '/api/current-user';
-
-const delay = ms => {return new Promise(resolve => setTimeout(resolve, ms))}
-
-export default class {
-  async showBookmarkMenu(ev, el) {
-    if ((el.sender.dataset.bookmarkId === el.ds('bookmarkId')) && el.childElementCount === 0) {
-      const searchParams = new URLSearchParams({
-        'id': el.sender.dataset.conceptId,
-        'require_reload': el.dataset.requireReload,
-      });
-      const bookmarkMenuHref = `${bookmarkMenuHrefTemplate}/${el.sender.dataset.bookmarkType}?${searchParams}`;
-      const res = await this.api.getHTML(bookmarkMenuHref);
-      if (res.error) {
-        return;
-      }
-      const frag = res.value;
-      el.appendChild(frag);
-      const menu = el.childNodes[0];
-      menu.showPopover();
-
-      const bRect = el.getBoundingClientRect();
-      const menuRect = menu.getBoundingClientRect();
-      const preferredLeft = bRect.right - menuRect.width;
-      const preferredRight = bRect.right;
-      const enoughSpace = preferredLeft >= 0;
-      const scrollY = window.scrollY || window.pageYOffset;
-      if (enoughSpace) {
-        menu.style.left = `${preferredLeft}px`;
-      } else {
-        menu.style.left = `${bRect.left}px`;
-      }
-      menu.style.top = `${bRect.bottom + scrollY}px`;
-
-      menu.addEventListener('beforetoggle', (e) => {
-        if (e.newState === 'closed') {
-          // if it's still in the tree, remove it
-          // the delay is required to make sure its removed instantly when
-          // clicking the button when the menu is open
-          setTimeout(() => {menu.remove()}, 100);
-        };
-      }, { once: true });
-
-    } else if (el.childElementCount > 0) {
-      el.removeChild(el.childNodes[0]);
-    }
-  }
-
-  selectBookmarkCollection(ev, el) {
-    const clicked = el.sender;
-
-    if (el.sender === el) {
-      if (clicked.classList.contains('selected')) {
-        clicked.classList.remove('selected');
-      } else {
-        clicked.classList.add('selected');
-      }
-    } else {
-      el.classList.remove('selected');
-    }
-  }
-
-  async saveBookmarks(ev, el) {
-    const bookmarkHref = el.ds('bookmarkEndpoint');
-    const collection = el.querySelector('.bookmark-dropdown-item.selected');
-    let data = {};
-    if (collection) {
-      data['operation'] = 'move';
-      data['collection_id'] = collection.dataset.collectionId;
-      data['memo'] = el.querySelector('.bookmark-memo-input').value;
-    } else {
-      data['operation'] = 'remove';
-      data['collection_id'] = el.ds('originallyContainedIn');
-    }
-
-    const options = {
-      method: 'POST',
-      body: JSON.stringify(data),
-      headers: {
-        'Content-Type': 'application/json',
-      },
-    }
-    const requireReload = el.dsInt('requireReload') !== 0;
-    el.remove();
-    await fetch(bookmarkHref, options);
-    if (requireReload) {
-      window.location.reload();
-    }
-  }
-
-  async copyCode(ev, el) {
-    if (!el.isSender) {
-      return;
-    }
-    await navigator.clipboard.writeText(el.value);
-    el.textContent = 'Copied!'
-    await delay(1000);
-    el.textContent = 'Copy';
-  }
-
-  toggleAccordion(ev, el) {
-    const accordion = el;
-    const header = accordion.querySelector('.accordion-header');
-    if (!header.contains(el.sender)){
-      return;
-    }
-    const btn = el.sender;
-    const content = el.querySelector('.accordion-content');
-    // these are all meant to be in sync
-    accordion.classList.toggle('hidden');
-    content.classList.toggle('hidden');
-    btn.textContent = accordion.classList.contains('hidden') ? '+' : '-';
-  }
-
-  toggleTab(ev, el) {
-    const tabButtonsContainer = el.querySelector('.tab-buttons');
-    if (!el.contains(el.sender)) {
-      return;
-    }
-
-    if (el.sender.classList.contains('active')) {
-      return;
-    }
-
-    const targetId = el.senderDs('targetId');
-    const contents = el.querySelectorAll('.tab-content');
-    for (let content of contents) {
-      if (content.id === targetId) {
-        content.classList.add('active');
-      } else {
-        content.classList.remove('active');
-      }
-    }
-    for (let button of tabButtonsContainer.children) {
-      if (button.dataset.targetId === targetId) {
-        button.classList.add('active');
-      } else {
-        button.classList.remove('active');
-      }
-    }
-  }
-
-  #previousMarkup = null;
-  async babycodePreview(ev, el) {
-    if (el.sender.classList.contains('active')) {
-      return;
-    }
-
-    const previewErrorsContainer = el.querySelector('#babycode-preview-errors-container');
-    const previewContainer = el.querySelector('#babycode-preview-container');
-    const ta = document.getElementById('babycode-content');
-    const markup = ta.value.trim();
-    if (markup === '') {
-      previewErrorsContainer.textContent = 'Type something!';
-      previewContainer.textContent = '';
-      this.#previousMarkup = '';
-      return;
-    }
-
-    if (markup === this.#previousMarkup) {
-      return;
-    }
-
-    const bannedTags = JSON.parse(document.getElementById('babycode-banned-tags').value);
-    this.#previousMarkup = markup;
-
-    const res = await this.api.getJSON(previewEndpoint, [], {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({
-        markup: markup,
-        banned_tags: bannedTags,
-      }),
-    });
-    if (res.error) {
-      switch (res.error.status) {
-        case 429:
-          previewErrorsContainer.textContent = '(Old preview, try again in a few seconds.)'
-          this.#previousMarkup = '';
-          break;
-        case 400:
-          previewErrorsContainer.textContent = '(Request got malformed.)'
-          break;
-        case 401:
-          previewErrorsContainer.textContent = '(You are not logged in.)'
-          break;
-        default:
-          previewErrorsContainer.textContent = '(Error. Check console.)'
-          break;
-      }
-    } else {
-      previewErrorsContainer.textContent = '';
-      previewContainer.innerHTML = res.value.html;
-    }
-  }
-
-  insertBabycodeTag(ev, el) {
-    const tagStart = el.senderDs('tag');
-    const breakLine = 'breakLine' in el.sender.dataset;
-    const prefill = 'prefill' in el.sender.dataset ? el.sender.dataset.prefill : '';
-
-    const hasAttr = tagStart[tagStart.length - 1] === '=';
-    let tagEnd = tagStart;
-    let tagInsertStart = `[${tagStart}]${breakLine ? '\n' : ''}`;
-    if (hasAttr) {
-      tagEnd = tagEnd.slice(0, -1);
-    }
-    const tagInsertEnd = `${breakLine ? '\n' : ''}[/${tagEnd}]`;
-    const hasSelection = el.selectionStart !== el.selectionEnd;
-    const text = el.value;
-
-    if (hasSelection) {
-      const realStart = Math.min(el.selectionStart, el.selectionEnd);
-      const realEnd = Math.max(el.selectionStart, el.selectionEnd);
-      const selectionLength = realEnd - realStart;
-
-      const strStart = text.slice(0, realStart);
-      const strEnd = text.substring(realEnd);
-      const frag = `${tagInsertStart}${text.slice(realStart, realEnd)}${tagInsertEnd}`;
-      const reconst = `${strStart}${frag}${strEnd}`;
-      el.value = reconst;
-      if (!hasAttr) {
-        el.setSelectionRange(realStart + tagInsertStart.length, realStart + tagInsertEnd.length + selectionLength - 1);
-      } else {
-        const attrCursor = realStart + tagInsertEnd.length - (1 + (breakLine ? 1 : 0))
-        el.setSelectionRange(attrCursor, attrCursor); // cursor on attr
-      }
-    } else {
-      if (hasAttr) {
-        tagInsertStart += prefill;
-      }
-      const cursor = el.selectionStart;
-      const strStart = text.slice(0, cursor);
-      const strEnd = text.substr(cursor);
-
-      let newCursor = strStart.length + tagInsertStart.length;
-      if (hasAttr) {
-        newCursor = cursor + tagInsertStart.length - prefill.length - (1 + (breakLine ? 1 : 0)) //cursor on attr
-      }
-      const reconst = `${strStart}${tagInsertStart}${tagInsertEnd}${strEnd}`;
-      el.value = reconst;
-      el.setSelectionRange(newCursor, newCursor);
-    }
-    el.focus();
-  }
-
-  addQuote(ev, el) {
-    el.value += el.sender.value;
-    el.scrollIntoView();
-    el.focus();
-  }
-
-  convertTimestamps(ev, el) {
-    const timestamp = el.dsInt('utc');
-    if (!isNaN(timestamp)) {
-      const date = new Date(timestamp * 1000);
-      el.textContent = date.toLocaleString();
-    }
-  }
-
-  #currentUsername = undefined;
-  async highlightMentions(ev, el) {
-    if (this.#currentUsername === undefined) {
-      const userInfo = await this.api.getJSON(userEndpoint);
-      if (!userInfo.value) {
-        return;
-      }
-      this.#currentUsername = userInfo.value.user.username;
-    }
-
-    if (el.ds('username') === this.#currentUsername) {
-      el.classList.add('me');
-    }
-  }
-}

data/static/js/manage-bookmark-collections.js

@@ -1,128 +0,0 @@
-let removedCollections = [];
-
-document.getElementById("add-collection-button").addEventListener("click", () => {
-  const container = document.getElementById("collections-container");
-  const currentCount = container.querySelectorAll(".draggable-collection").length;
-
-  const newId = `new-${Date.now()}`
-  const collectionHtml = `
-    <div class="draggable-collection"
-         data-collection-id="${newId}"
-         draggable="true"
-         ondragover="dragOver(event)"
-         ondragstart="dragStart(event)"
-         ondragend="dragEnd()">
-      <input type="text" class="collection-name" value="" required placeholder="Enter collection name" autocomplete="off" maxlength="60"><br>
-      <div>0 threads, 0 posts</div>
-      <button type="button" class="delete-button critical">Delete</button>
-    </div>
-  `;
-  container.insertAdjacentHTML('beforeend', collectionHtml);
-})
-
-document.addEventListener("click", e => {
-  if (!e.target.classList.contains("delete-button")) {
-    return;
-  }
-  const collectionDiv = e.target.closest(".draggable-collection");
-  const collectionId = collectionDiv.dataset.collectionId;
-
-  if (!collectionId.startsWith("new-")) {
-    removedCollections.push(collectionId);
-  }
-
-  collectionDiv.remove();
-})
-
-document.getElementById("save-button").addEventListener("click", async () => {
-  const collections = [];
-  const collectionDivs = document.querySelectorAll(".draggable-collection");
-  let isValid = true;
-  collectionDivs.forEach((collection, index) => {
-    const collectionId = collection.dataset.collectionId;
-    const nameInput = collection.querySelector(".collection-name");
-
-    if (!nameInput.reportValidity()) {
-      isValid = false;
-      return;
-    }
-
-    collections.push({
-      id: collectionId,
-      name: nameInput.value,
-      is_new: collectionId.startsWith("new-"),
-    });
-  })
-
-  if (!isValid) {
-    return;
-  }
-
-  const data = {
-    collections: collections,
-    removed_collections: removedCollections,
-  };
-
-  try {
-    const saveHref = document.getElementById('save-button').dataset.submitHref;
-    const response = await fetch(saveHref, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-      },
-      body: JSON.stringify(data),
-    });
-
-    if (response.ok) {
-      window.location.reload();
-    } else {
-      console.error("Error saving collections");
-    }
-
-  } catch (error) {
-    console.error("Error saving collections: ", error);
-  }
-})
-
-// drag logic
-// https://codepen.io/crouchingtigerhiddenadam/pen/qKXgap
-
-let selected = null;
-const container = document.getElementById("collections-container");
-function isBefore(el1, el2) {
-  let cur;
-  if (el2.parentNode === el1.parentNode) {
-    for (cur = el1.previousSibling; cur; cur = cur.previousSibling) {
-      if (cur === el2) return true;
-    }
-  }
-  return false;
-}
-
-function dragOver(e) {
-  let target = e.target.closest(".draggable-collection")
-
-  if (!target || target === selected) {
-    return;
-  }
-
-  if (isBefore(selected, target)) {
-    container.insertBefore(selected, target)
-  } else {
-    container.insertBefore(selected, target.nextSibling)
-  }
-}
-
-function dragEnd() {
-  if (!selected) return;
-
-  selected.classList.remove("dragged")
-  selected = null;
-}
-
-function dragStart(e) {
-  e.dataTransfer.effectAllowed = 'move'
-  e.dataTransfer.setData('text/plain', "")
-  selected = e.target
-  selected.classList.add("dragged")
-}

data/static/js/sort-topics.js

@@ -1,45 +0,0 @@
-// https://codepen.io/crouchingtigerhiddenadam/pen/qKXgap
-let selected = null;
-let container = document.getElementById("topics-container")
-
-function isBefore(el1, el2) {
-  let cur
-  if (el2.parentNode === el1.parentNode) {
-    for (cur = el1.previousSibling; cur; cur = cur.previousSibling) {
-      if (cur === el2) return true
-    }
-  }
-  return false;
-}
-
-function dragOver(e) {
-  let target = e.target.closest(".draggable-topic")
-  
-  if (!target || target === selected) {
-    return;
-  }
-  
-  if (isBefore(selected, target)) {
-    container.insertBefore(selected, target)
-  } else {
-    container.insertBefore(selected, target.nextSibling)
-  }
-}
-
-function dragEnd() {
-  if (!selected) return;
-  
-  selected.classList.remove("dragged")
-  selected = null;
-  for (let i = 0; i < container.childElementCount - 1; i++) {
-    let input = container.children[i].querySelector(".topic-input");
-    input.value = i + 1;
-  }
-}
-
-function dragStart(e) {
-  e.dataTransfer.effectAllowed = 'move'
-  e.dataTransfer.setData('text/plain', null)
-  selected = e.target
-  selected.classList.add("dragged")
-}

data/static/js/thread.js

@@ -1,360 +0,0 @@
-{
-  const ta = document.getElementById("babycode-content");
-
-  function supportsPopover() {
-    return Object.hasOwn(HTMLElement.prototype, "popover");
-  }
-
-  if (supportsPopover()){
-    let quotedPostContainer = null;
-    function isQuoteSelectionValid() {
-      const selection = document.getSelection();
-
-      if (!selection || selection.rangeCount === 0 || selection.isCollapsed) {
-        return false;
-      }
-
-      const range = selection.getRangeAt(0);
-      const commonAncestor = range.commonAncestorContainer;
-
-      const ancestorElement = commonAncestor.nodeType === Node.TEXT_NODE
-      ? commonAncestor.parentNode
-      : commonAncestor;
-
-      const container = ancestorElement.closest(".post-inner");
-      if (!container) {
-        return false;
-      }
-      const success = container.contains(ancestorElement);
-      if (success) {
-        quotedPostContainer = container;
-      }
-      return success;
-    }
-
-    let quotePopover = null;
-    let isSelecting = false;
-
-    document.addEventListener("mousedown", () => {
-      isSelecting = true;
-    })
-
-    document.addEventListener("mouseup", () => {
-      isSelecting = false;
-      handlePossibleSelection();
-    })
-
-    document.addEventListener("keyup", (e) => {
-      if (e.shiftKey && (e.key.startsWith('Arrow') || e.key === 'Home' || e.key === 'End')) {
-        handlePossibleSelection();
-      }
-    })
-
-    function handlePossibleSelection() {
-      setTimeout(() => {
-        const valid = isQuoteSelectionValid();
-        if (isSelecting || !valid) {
-          removeQuotePopover();
-          return;
-        }
-
-        const selection = document.getSelection();
-        const selectionStr = selection.toString().trim();
-        if (selection.isCollapsed || selectionStr === "") {
-          removeQuotePopover();
-          return;
-        }
-
-        showQuotePopover();
-      }, 50)
-    }
-
-    function removeQuotePopover() {
-      quotePopover?.hidePopover();
-    }
-
-    function createQuotePopover() {
-      quotePopover = document.createElement("div");
-      quotePopover.popover = "auto";
-      quotePopover.className = "quote-popover";
-
-      const quoteButton = document.createElement("button");
-      quoteButton.textContent = "Quote fragment"
-      quoteButton.className = "reduced"
-      quotePopover.appendChild(quoteButton);
-      document.body.appendChild(quotePopover);
-      return quoteButton;
-    }
-
-    function showQuotePopover() {
-      if (!quotePopover) {
-        const quoteButton = createQuotePopover();
-        quoteButton.addEventListener("click", () => {
-          console.log("Quoting:", document.getSelection().toString());
-          const postPermalink = quotedPostContainer.dataset.postPermalink;
-          const authorUsername = quotedPostContainer.dataset.authorUsername;
-          console.log(postPermalink, authorUsername);
-          if (ta.value.trim() !== "") {
-            ta.value += "\n"
-          }
-          ta.value += `@${authorUsername} [url=${postPermalink}]said:[/url]\n[quote]< :scissors: > ${document.getSelection().toString()} < :scissors: >[/quote]\n`;
-          ta.scrollIntoView()
-          ta.focus();
-
-          document.getSelection().empty();
-          removeQuotePopover();
-        })
-      }
-
-      const range = document.getSelection().getRangeAt(0);
-      const rect = range.getBoundingClientRect();
-      const scrollY = window.scrollY || window.pageYOffset;
-
-      quotePopover.style.setProperty("top", `${rect.top + scrollY - 55}px`)
-      quotePopover.style.setProperty("left", `${rect.left + rect.width/2}px`)
-
-      if (!quotePopover.matches(':popover-open')) {
-        quotePopover.showPopover();
-      }
-    }
-  }
-  
-  const deleteDialog = document.getElementById("delete-dialog");
-  const deleteDialogCloseButton = document.getElementById("post-delete-dialog-close");
-  let deletionTargetPostContainer;
-  
-  function closeDeleteDialog() {
-    deletionTargetPostContainer.style.removeProperty("background-color");
-    deleteDialog.close();
-  }
-  
-  deleteDialogCloseButton.addEventListener("click", (e) => {
-    closeDeleteDialog();
-  })
-  deleteDialog.addEventListener("click", (e) => {
-    if (e.target === deleteDialog) {
-      closeDeleteDialog();
-    }
-  })
-  for (let button of document.querySelectorAll(".post-delete-button")) {
-    button.addEventListener("click", (e) => {
-      deleteDialog.showModal();
-      const postId = button.value;
-      deletionTargetPostContainer = document.getElementById("post-" + postId).querySelector(".post-content-container");
-      deletionTargetPostContainer.style.setProperty("background-color", "#fff");
-      const form = document.getElementById("post-delete-form");
-      form.action = `/post/${postId}/delete`
-    })
-  }
-  
-  const threadEndpoint = document.getElementById("thread-subscribe-endpoint").value;
-  let now = Math.floor(new Date() / 1000);
-  function hideNotification() {
-    const notification = document.getElementById('new-post-notification');
-    notification.classList.add('hidden');
-  }
-  
-  function showNewPostNotification(url) {
-    const notification = document.getElementById("new-post-notification");
-    
-    notification.classList.remove("hidden");
-    
-    document.getElementById("dismiss-new-post-button").onclick = () => {
-      now = Math.floor(new Date() / 1000);
-      hideNotification();
-      tryFetchUpdate();
-    }
-    
-    document.getElementById("go-to-new-post-button").href = url;
-    
-    document.getElementById("unsub-new-post-button").onclick = () => {
-      hideNotification();
-    }
-  }
-
-  function tryFetchUpdate() {
-    if (!threadEndpoint) return;
-    const body = JSON.stringify({'since': now});
-    fetch(threadEndpoint, {method: "POST", headers: {"Content-Type": "application/json"}, body: body})
-      .then(res => res.json())
-      .then(json => {
-        if (json.status === "none") {
-          setTimeout(tryFetchUpdate, 5000);
-        } else if (json.status === "new_post") {
-          showNewPostNotification(json.url);
-        }
-      })
-      .catch(error => console.log(error))
-  }
-  tryFetchUpdate();
-
-  if (supportsPopover()){
-    const reactionEmoji = document.getElementById("allowed-reaction-emoji").value.split(" ");
-    let reactionPopover = null;
-    let reactionTargetPostId = null;
-
-    function tryAddReaction(emoji, postId = reactionTargetPostId) {
-      const body = JSON.stringify({
-        "emoji": emoji,
-      });
-      fetch(`/api/add-reaction/${postId}`, {method: "POST", headers: {"Content-Type": "application/json"}, body: body})
-        .then(res => res.json())
-        .then(json => {
-          if (json.status === "added") {
-            const post = document.getElementById(`post-${postId}`);
-            const spans = Array.from(post.querySelectorAll(".reaction-count")).filter((span) => {
-              return span.dataset.emoji === emoji
-            });
-            if (spans.length > 0) {
-              const currentValue = spans[0].textContent;
-              spans[0].textContent = `${parseInt(currentValue) + 1}`;
-              const button = spans[0].closest(".reaction-button");
-              button.classList.add("active");
-            } else {
-              const span = document.createElement("span");
-              span.classList = "reaction-container";
-              span.dataset.emoji = emoji;
-
-              const button = document.createElement("button");
-              button.type = "button";
-              button.className = "reduced reaction-button active";
-
-              button.addEventListener("click", () => {
-                tryAddReaction(emoji, postId);
-              })
-
-              const img = document.createElement("img");
-              img.src = `/static/emoji/${emoji}.png`;
-
-              button.textContent = " x";
-
-              const reactionCountSpan = document.createElement("span")
-              reactionCountSpan.className = "reaction-count"
-              reactionCountSpan.textContent = "1"
-
-              button.insertAdjacentElement("afterbegin", img);
-              button.appendChild(reactionCountSpan);
-
-              span.appendChild(button);
-
-              const post = document.getElementById(`post-${postId}`);
-              post.querySelector(".post-reactions").insertBefore(span, post.querySelector(".add-reaction-button"));
-            }
-          } else if (json.error_code === 409) {
-            console.log("reaction exists, gonna try and remove");
-            tryRemoveReaction(emoji, postId);
-          } else {
-            console.warn(json)
-          }
-        })
-      .catch(error => console.error(error));
-    }
-
-    function tryRemoveReaction(emoji, postId = reactionTargetPostId) {
-      const body = JSON.stringify({
-        "emoji": emoji,
-      });
-
-      fetch(`/api/remove-reaction/${postId}`, {method: "POST", headers: {"Content-Type": "application/json"}, body: body})
-      .then(res => res.json())
-      .then(json => {
-        if (json.status === "removed") {
-          const post = document.getElementById(`post-${postId}`);
-          const spans = Array.from(post.querySelectorAll(".reaction-container")).filter((span) => {
-            return span.dataset.emoji === emoji
-          });
-          if (spans.length > 0) {
-            const reactionCountSpan = spans[0].querySelector(".reaction-count");
-            const currentValue = parseInt(reactionCountSpan.textContent);
-            if (currentValue - 1 === 0) {
-              spans[0].remove();
-            } else {
-              reactionCountSpan.textContent = `${parseInt(currentValue) - 1}`;
-              const button = reactionCountSpan.closest(".reaction-button");
-              button.classList.remove("active");
-            }
-          }
-        } else {
-          console.warn(json)
-        }
-      })
-      .catch(error => console.error(error));
-    }
-
-    function createReactionPopover() {
-      reactionPopover = document.createElement("div");
-      reactionPopover.className = "reaction-popover";
-      reactionPopover.popover = "auto";
-
-      const inner = document.createElement("div");
-      inner.className = "reaction-popover-inner";
-
-      reactionPopover.appendChild(inner);
-
-      for (let emoji of reactionEmoji) {
-        const img = document.createElement("img");
-        img.src = `/static/emoji/${emoji}.png`;
-
-        const button = document.createElement("button");
-        button.type = "button";
-        button.className = "reduced";
-        button.appendChild(img);
-        button.addEventListener("click", () => {
-          tryAddReaction(emoji);
-        })
-
-        button.dataset.emojiName = emoji;
-
-        inner.appendChild(button);
-      }
-
-      reactionPopover.addEventListener("beforetoggle", (e) => {
-        if (e.newState === "closed") {
-          reactionTargetPostId = null;
-        }
-      })
-
-      document.body.appendChild(reactionPopover);
-    }
-
-    function showReactionPopover() {
-      if (!reactionPopover) {
-        createReactionPopover();
-      }
-
-      if (!reactionPopover.matches(':popover-open')) {
-        reactionPopover.showPopover();
-      }
-    }
-
-    for (let button of document.querySelectorAll(".add-reaction-button")) {
-      button.addEventListener("click", (e) => {
-        showReactionPopover();
-        reactionTargetPostId = e.target.dataset.postId;
-
-        const rect = e.target.getBoundingClientRect();
-        const popoverRect = reactionPopover.getBoundingClientRect();
-        const scrollY = window.scrollY || window.pageYOffset;
-
-        reactionPopover.style.setProperty("top", `${rect.top + scrollY + rect.height}px`)
-        reactionPopover.style.setProperty("left", `${rect.left + rect.width/2 - popoverRect.width/2}px`)
-      })
-    }
-
-    for (let button of document.querySelectorAll(".reaction-button")) {
-      button.addEventListener("click", () => {
-        const reactionContainer = button.closest(".reaction-container")
-        const emoji = reactionContainer.dataset.emoji;
-        const postId = reactionContainer.dataset.postId;
-        console.log(reactionContainer);
-        tryAddReaction(emoji, postId);
-      })
-    }
-
-  } else {
-    for (let button of document.querySelectorAll(".add-reaction-button")) {
-      button.disabled = true;
-      button.title = "Enable JS to add reactions."
-    }
-  }
-}

data/static/js/topic.js

@@ -1,16 +0,0 @@
-{
-  const deleteDialog = document.getElementById("delete-dialog");
-  const deleteDialogOpenButton = document.getElementById("topic-delete-dialog-open");
-  deleteDialogOpenButton.addEventListener("click", (e) => {
-    deleteDialog.showModal();
-  });
-  const deleteDialogCloseButton = document.getElementById("topic-delete-dialog-close");
-  deleteDialogCloseButton.addEventListener("click", (e) => {
-    deleteDialog.close();
-  })
-  deleteDialog.addEventListener("click", (e) => {
-    if (e.target === deleteDialog) {
-      deleteDialog.close();
-    }
-  })
-}