version = "0.1.3"

[[package]]

name = "posts"

version = "0.1.0"

dependencies = [

 "andromeda-auth",

 "askama 0.15.6",

 "askama_web",

 "axum",

 "dotenvy",

 "nanoid",

 "pulldown-cmark",

 "rand 0.8.5",

 "rusqlite",

 "rust-embed",

 "serde",

 "serde_json",

 "subtle",

 "tokio",

 "tracing",

 "tracing-subscriber",

]

    "apps/posts",

POSTS_PASSWORD=changeme

POSTS_DB_PATH=posts.sqlite

COOKIE_SECURE=false

HOST=127.0.0.1

PORT=3000

[package]

name = "posts"

version = "0.1.0"

edition = "2024"

description = "CMS blog with admin interface"

license = "MIT"

repository = "https://github.com/stevedylandev/andromeda"

homepage = "https://github.com/stevedylandev/andromeda"

[dependencies]

axum = { workspace = true }

tokio = { workspace = true }

serde = { workspace = true }

serde_json = { workspace = true }

rusqlite = { workspace = true }

nanoid = { workspace = true }

rust-embed = { workspace = true }

dotenvy = { workspace = true }

subtle = { workspace = true }

rand = { workspace = true }

tracing = { workspace = true }

tracing-subscriber = { workspace = true }

andromeda-auth = { workspace = true }

askama = "0.15"

askama_web = { version = "0.15", features = ["axum-0.8"] }

pulldown-cmark = "0.12"

# Build from repo root: docker build -t posts -f apps/posts/Dockerfile .

FROM rust:1-slim-bookworm AS builder

RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy workspace manifests

COPY Cargo.toml Cargo.lock .

COPY crates/auth/Cargo.toml crates/auth/

COPY apps/sipp/Cargo.toml apps/sipp/

COPY apps/feeds/Cargo.toml apps/feeds/

COPY apps/parcels/Cargo.toml apps/parcels/

COPY apps/jotts/Cargo.toml apps/jotts/

COPY apps/og/Cargo.toml apps/og/

COPY apps/shrink/Cargo.toml apps/shrink/

COPY apps/cellar/Cargo.toml apps/cellar/

COPY apps/posts/Cargo.toml apps/posts/

# Create stubs for dependency caching

RUN mkdir -p crates/auth/src && echo '' > crates/auth/src/lib.rs \

    && for app in sipp feeds parcels jotts og shrink cellar posts; do \

         mkdir -p apps/$app/src && echo 'fn main() {}' > apps/$app/src/main.rs; \

       done

RUN cargo build --release -p posts

# Copy real source

COPY crates/auth/src crates/auth/src

COPY apps/posts/src apps/posts/src

COPY apps/posts/static apps/posts/static

COPY apps/posts/templates apps/posts/templates

RUN touch apps/posts/src/*.rs crates/auth/src/*.rs && cargo build --release -p posts

FROM debian:bookworm-slim

COPY --from=builder /app/target/release/posts /usr/local/bin/posts

WORKDIR /data

EXPOSE 3000

ENV HOST=0.0.0.0

ENV PORT=3000

CMD ["posts"]

services:

  app:

    build:

      context: ../..

      dockerfile: apps/posts/Dockerfile

    ports:

      - "${PORT:-3000}:${PORT:-3000}"

    environment:

      - POSTS_PASSWORD=${POSTS_PASSWORD:-changeme}

      - POSTS_DB_PATH=/data/posts.sqlite

      - COOKIE_SECURE=false

      - HOST=0.0.0.0

      - PORT=${PORT:-3000}

    volumes:

      - posts-data:/data

    restart: unless-stopped

volumes:

  posts-data:

use axum::{

    extract::FromRequestParts,

    http::request::Parts,

    response::{IntoResponse, Redirect, Response},

};

use std::sync::Arc;

use crate::db;

use crate::server::AppState;

pub use andromeda_auth::{

    build_session_cookie, clear_session_cookie, generate_session_token, verify_password,

};

pub struct AuthSession;

impl FromRequestParts<Arc<AppState>> for AuthSession {

    type Rejection = Response;

    async fn from_request_parts(

        parts: &mut Parts,

        state: &Arc<AppState>,

    ) -> Result<Self, Self::Rejection> {

        let token = andromeda_auth::extract_session_cookie(&parts.headers);

        if let Some(token) = token {

            if is_valid_session(state, &token) {

                return Ok(AuthSession);

            }

        }

        Err(Redirect::to("/admin/login").into_response())

    }

}

fn is_valid_session(state: &AppState, token: &str) -> bool {

    match db::get_session_expiry(&state.db, token) {

        Ok(Some(expires_at)) => {

            let now = chrono_now();

            expires_at > now

        }

        _ => false,

    }

}

fn chrono_now() -> String {

    use std::time::{SystemTime, UNIX_EPOCH};

    let secs = SystemTime::now()

        .duration_since(UNIX_EPOCH)

        .unwrap()

        .as_secs();

    let days_since_epoch = secs / 86400;

    let time_of_day = secs % 86400;

    let hours = time_of_day / 3600;

    let minutes = (time_of_day % 3600) / 60;

    let seconds = time_of_day % 60;

    let (year, month, day) = days_to_ymd(days_since_epoch as i64);

    format!(

        "{:04}-{:02}-{:02} {:02}:{:02}:{:02}",

        year, month, day, hours, minutes, seconds

    )

}

fn days_to_ymd(mut days: i64) -> (i64, i64, i64) {

    days += 719468;

    let era = if days >= 0 { days } else { days - 146096 } / 146097;

    let doe = (days - era * 146097) as u32;

    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;

    let y = yoe as i64 + era * 400;

    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);

    let mp = (5 * doy + 2) / 153;

    let d = doy - (153 * mp + 2) / 5 + 1;

    let m = if mp < 10 { mp + 3 } else { mp - 9 };

    let y = if m <= 2 { y + 1 } else { y };

    (y, m as i64, d as i64)

}

use nanoid::nanoid;

use rusqlite::{Connection, params};

use serde::{Deserialize, Serialize};

use std::fmt;

use std::sync::{Arc, Mutex};

pub type Db = Arc<Mutex<Connection>>;

#[derive(Debug)]

pub enum DbError {

    Sqlite(rusqlite::Error),

    LockPoisoned,

}

impl fmt::Display for DbError {

    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {

        match self {

            DbError::Sqlite(e) => write!(f, "Database error: {}", e),

            DbError::LockPoisoned => write!(f, "Database lock poisoned"),

        }

    }

}

impl std::error::Error for DbError {}

impl From<rusqlite::Error> for DbError {

    fn from(e: rusqlite::Error) -> Self {

        DbError::Sqlite(e)

    }

}

#[derive(Debug, Serialize, Deserialize, Clone)]

pub struct Post {

    pub id: i64,

    pub short_id: String,

    pub title: String,

    pub slug: String,

    pub alias: Option<String>,

    pub canonical_url: Option<String>,

    pub published_date: Option<String>,

    pub meta_description: Option<String>,

    pub meta_image: Option<String>,

    pub lang: String,

    pub tags: Option<String>,

    pub content: String,

    pub status: String,

    pub created_at: String,

    pub updated_at: String,

}

#[derive(Debug, Serialize, Deserialize, Clone)]

pub struct Page {

    pub id: i64,

    pub short_id: String,

    pub title: String,

    pub slug: String,

    pub content: String,

    pub is_published: bool,

    pub nav_order: i64,

    pub created_at: String,

    pub updated_at: String,

}

pub fn init_db() -> Db {

    let path = std::env::var("POSTS_DB_PATH").unwrap_or_else(|_| "posts.sqlite".to_string());

    let conn = Connection::open(&path).expect("Failed to open database");

    conn.execute_batch(

        "CREATE TABLE IF NOT EXISTS posts (

            id              INTEGER PRIMARY KEY AUTOINCREMENT,

            short_id        TEXT NOT NULL UNIQUE,

            title           TEXT NOT NULL,

            slug            TEXT NOT NULL UNIQUE,

            alias           TEXT,

            canonical_url   TEXT,

            published_date  TEXT,

            meta_description TEXT,

            meta_image      TEXT,

            lang            TEXT NOT NULL DEFAULT 'en',

            tags            TEXT,

            content         TEXT NOT NULL,

            status          TEXT NOT NULL DEFAULT 'draft',

            created_at      TEXT NOT NULL DEFAULT (datetime('now')),

            updated_at      TEXT NOT NULL DEFAULT (datetime('now'))

        );

        CREATE TABLE IF NOT EXISTS pages (

            id              INTEGER PRIMARY KEY AUTOINCREMENT,

            short_id        TEXT NOT NULL UNIQUE,

            title           TEXT NOT NULL,

            slug            TEXT NOT NULL UNIQUE,

            content         TEXT NOT NULL,

            is_published    INTEGER NOT NULL DEFAULT 0,

            nav_order       INTEGER NOT NULL DEFAULT 0,

            created_at      TEXT NOT NULL DEFAULT (datetime('now')),

            updated_at      TEXT NOT NULL DEFAULT (datetime('now'))

        );

        CREATE TABLE IF NOT EXISTS sessions (

            id              INTEGER PRIMARY KEY AUTOINCREMENT,

            token           TEXT NOT NULL UNIQUE,

            expires_at      TEXT NOT NULL

        );

        CREATE TABLE IF NOT EXISTS settings (

            key   TEXT PRIMARY KEY,

            value TEXT NOT NULL

        );"

    )

    .expect("Failed to create tables");

    // Seed default settings

    conn.execute(

        "INSERT OR IGNORE INTO settings (key, value) VALUES ('blog_title', 'My Blog')",

        [],

    )

    .ok();

    conn.execute(

        "INSERT OR IGNORE INTO settings (key, value) VALUES ('blog_description', 'A simple blog')",

        [],

    )

    .ok();

    conn.execute(

        "INSERT OR IGNORE INTO settings (key, value) VALUES ('intro_content', '')",

        [],

    )

    .ok();

    Arc::new(Mutex::new(conn))

}

// --- Post CRUD ---

fn row_to_post(row: &rusqlite::Row) -> rusqlite::Result<Post> {

    Ok(Post {

        id: row.get(0)?,

        short_id: row.get(1)?,

        title: row.get(2)?,

        slug: row.get(3)?,

        alias: row.get(4)?,

        canonical_url: row.get(5)?,

        published_date: row.get(6)?,

        meta_description: row.get(7)?,

        meta_image: row.get(8)?,

        lang: row.get(9)?,

        tags: row.get(10)?,

        content: row.get(11)?,

        status: row.get(12)?,

        created_at: row.get(13)?,

        updated_at: row.get(14)?,

    })

}

const POST_COLS: &str = "id, short_id, title, slug, alias, canonical_url, published_date, meta_description, meta_image, lang, tags, content, status, created_at, updated_at";

pub fn create_post(

    db: &Db,

    title: &str,

    slug: &str,

    content: &str,

    status: &str,

    alias: Option<&str>,

    canonical_url: Option<&str>,

    published_date: Option<&str>,

    meta_description: Option<&str>,

    meta_image: Option<&str>,

    lang: &str,

    tags: Option<&str>,

) -> Result<Post, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let short_id = nanoid!(10);

    conn.execute(

        "INSERT INTO posts (short_id, title, slug, content, status, alias, canonical_url, published_date, meta_description, meta_image, lang, tags)

         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12)",

        params![short_id, title, slug, content, status, alias, canonical_url, published_date, meta_description, meta_image, lang, tags],

    )?;

    let id = conn.last_insert_rowid();

    let post = conn.query_row(

        &format!("SELECT {} FROM posts WHERE id = ?1", POST_COLS),

        params![id],

        row_to_post,

    )?;

    Ok(post)

}

pub fn get_post_by_short_id(db: &Db, short_id: &str) -> Result<Option<Post>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        &format!("SELECT {} FROM posts WHERE short_id = ?1", POST_COLS),

        params![short_id],

        row_to_post,

    ) {

        Ok(post) => Ok(Some(post)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn get_post_by_slug(db: &Db, slug: &str) -> Result<Option<Post>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        &format!("SELECT {} FROM posts WHERE slug = ?1", POST_COLS),

        params![slug],

        row_to_post,

    ) {

        Ok(post) => Ok(Some(post)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn get_all_posts(db: &Db) -> Result<Vec<Post>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare(

        &format!("SELECT {} FROM posts ORDER BY id DESC", POST_COLS),

    )?;

    let posts = stmt

        .query_map([], row_to_post)?

        .collect::<Result<Vec<_>, _>>()?;

    Ok(posts)

}

pub fn get_published_posts(db: &Db) -> Result<Vec<Post>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare(

        &format!("SELECT {} FROM posts WHERE status = 'published' ORDER BY published_date DESC, id DESC", POST_COLS),

    )?;

    let posts = stmt

        .query_map([], row_to_post)?

        .collect::<Result<Vec<_>, _>>()?;

    Ok(posts)

}

pub fn update_post(

    db: &Db,

    short_id: &str,

    title: &str,

    slug: &str,

    content: &str,

    alias: Option<&str>,

    canonical_url: Option<&str>,

    published_date: Option<&str>,

    meta_description: Option<&str>,

    meta_image: Option<&str>,

    lang: &str,

    tags: Option<&str>,

) -> Result<Option<Post>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute(

        "UPDATE posts SET title = ?1, slug = ?2, content = ?3, alias = ?4, canonical_url = ?5,

         published_date = ?6, meta_description = ?7, meta_image = ?8, lang = ?9, tags = ?10,

         updated_at = datetime('now') WHERE short_id = ?11",

        params![title, slug, content, alias, canonical_url, published_date, meta_description, meta_image, lang, tags, short_id],

    )?;

    if rows == 0 {

        return Ok(None);

    }

    match conn.query_row(

        &format!("SELECT {} FROM posts WHERE short_id = ?1", POST_COLS),

        params![short_id],

        row_to_post,

    ) {

        Ok(post) => Ok(Some(post)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn delete_post(db: &Db, short_id: &str) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute("DELETE FROM posts WHERE short_id = ?1", params![short_id])?;

    Ok(rows > 0)

}

pub fn toggle_post_status(db: &Db, short_id: &str) -> Result<Option<String>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let current: String = match conn.query_row(

        "SELECT status FROM posts WHERE short_id = ?1",

        params![short_id],

        |row| row.get(0),

    ) {

        Ok(s) => s,

        Err(rusqlite::Error::QueryReturnedNoRows) => return Ok(None),

        Err(e) => return Err(DbError::Sqlite(e)),

    };

    let new_status = if current == "published" { "draft" } else { "published" };

    if new_status == "published" {

        conn.execute(

            "UPDATE posts SET status = ?1, published_date = COALESCE(published_date, datetime('now')), updated_at = datetime('now') WHERE short_id = ?2",

            params![new_status, short_id],

        )?;

    } else {

        conn.execute(

            "UPDATE posts SET status = ?1, updated_at = datetime('now') WHERE short_id = ?2",

            params![new_status, short_id],

        )?;

    }

    Ok(Some(new_status.to_string()))

}

pub fn find_alias_redirect(db: &Db, alias: &str) -> Result<Option<String>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        "SELECT slug FROM posts WHERE alias = ?1 AND status = 'published'",

        params![alias],

        |row| row.get::<_, String>(0),

    ) {

        Ok(slug) => Ok(Some(format!("/posts/{}", slug))),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

// --- Page CRUD ---

fn row_to_page(row: &rusqlite::Row) -> rusqlite::Result<Page> {

    Ok(Page {

        id: row.get(0)?,

        short_id: row.get(1)?,

        title: row.get(2)?,

        slug: row.get(3)?,

        content: row.get(4)?,

        is_published: row.get::<_, i64>(5)? != 0,

        nav_order: row.get(6)?,

        created_at: row.get(7)?,

        updated_at: row.get(8)?,

    })

}

const PAGE_COLS: &str = "id, short_id, title, slug, content, is_published, nav_order, created_at, updated_at";

pub fn create_page(

    db: &Db,

    title: &str,

    slug: &str,

    content: &str,

    is_published: bool,

    nav_order: i64,

) -> Result<Page, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let short_id = nanoid!(10);

    conn.execute(

        "INSERT INTO pages (short_id, title, slug, content, is_published, nav_order) VALUES (?1, ?2, ?3, ?4, ?5, ?6)",

        params![short_id, title, slug, content, is_published as i64, nav_order],

    )?;

    let id = conn.last_insert_rowid();

    let page = conn.query_row(

        &format!("SELECT {} FROM pages WHERE id = ?1", PAGE_COLS),

        params![id],

        row_to_page,

    )?;

    Ok(page)

}

pub fn get_page_by_short_id(db: &Db, short_id: &str) -> Result<Option<Page>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        &format!("SELECT {} FROM pages WHERE short_id = ?1", PAGE_COLS),

        params![short_id],

        row_to_page,

    ) {

        Ok(page) => Ok(Some(page)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn get_page_by_slug(db: &Db, slug: &str) -> Result<Option<Page>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        &format!("SELECT {} FROM pages WHERE slug = ?1", PAGE_COLS),

        params![slug],

        row_to_page,

    ) {

        Ok(page) => Ok(Some(page)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn get_all_pages(db: &Db) -> Result<Vec<Page>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare(

        &format!("SELECT {} FROM pages ORDER BY nav_order ASC, id ASC", PAGE_COLS),

    )?;

    let pages = stmt

        .query_map([], row_to_page)?

        .collect::<Result<Vec<_>, _>>()?;

    Ok(pages)

}

pub fn get_published_pages(db: &Db) -> Result<Vec<Page>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare(

        &format!("SELECT {} FROM pages WHERE is_published = 1 ORDER BY nav_order ASC, id ASC", PAGE_COLS),

    )?;

    let pages = stmt

        .query_map([], row_to_page)?

        .collect::<Result<Vec<_>, _>>()?;

    Ok(pages)

}

pub fn update_page(

    db: &Db,

    short_id: &str,

    title: &str,

    slug: &str,

    content: &str,

    is_published: bool,

    nav_order: i64,

) -> Result<Option<Page>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute(

        "UPDATE pages SET title = ?1, slug = ?2, content = ?3, is_published = ?4, nav_order = ?5, updated_at = datetime('now') WHERE short_id = ?6",

        params![title, slug, content, is_published as i64, nav_order, short_id],

    )?;

    if rows == 0 {

        return Ok(None);

    }

    match conn.query_row(

        &format!("SELECT {} FROM pages WHERE short_id = ?1", PAGE_COLS),

        params![short_id],

        row_to_page,

    ) {

        Ok(page) => Ok(Some(page)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn delete_page(db: &Db, short_id: &str) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute("DELETE FROM pages WHERE short_id = ?1", params![short_id])?;

    Ok(rows > 0)

}

// --- Settings ---

pub fn get_setting(db: &Db, key: &str) -> Result<Option<String>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        "SELECT value FROM settings WHERE key = ?1",

        params![key],

        |row| row.get(0),

    ) {

        Ok(val) => Ok(Some(val)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn set_setting(db: &Db, key: &str, value: &str) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "INSERT INTO settings (key, value) VALUES (?1, ?2) ON CONFLICT(key) DO UPDATE SET value = ?2",

        params![key, value],

    )?;

    Ok(())

}

pub fn get_all_settings(db: &Db) -> Result<Vec<(String, String)>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare("SELECT key, value FROM settings ORDER BY key")?;

    let settings = stmt

        .query_map([], |row| Ok((row.get(0)?, row.get(1)?)))?

        .collect::<Result<Vec<_>, _>>()?;

    Ok(settings)

}

// --- Session functions ---

pub fn insert_session(db: &Db, token: &str, expires_at: &str) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "INSERT INTO sessions (token, expires_at) VALUES (?1, ?2)",

        params![token, expires_at],

    )?;

    Ok(())

}

pub fn get_session_expiry(db: &Db, token: &str) -> Result<Option<String>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        "SELECT expires_at FROM sessions WHERE token = ?1",

        params![token],

        |row| row.get(0),

    ) {

        Ok(val) => Ok(Some(val)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn delete_session(db: &Db, token: &str) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute("DELETE FROM sessions WHERE token = ?1", params![token])?;

    Ok(())

}

pub fn prune_expired_sessions(db: &Db) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "DELETE FROM sessions WHERE expires_at < datetime('now')",

        [],

    )?;

    Ok(())

}

mod auth;

mod db;

mod server;

#[tokio::main]

async fn main() {

    tracing_subscriber::fmt::init();

    let host = std::env::var("HOST").unwrap_or_else(|_| "127.0.0.1".to_string());

    let port: u16 = std::env::var("PORT")

        .ok()

        .and_then(|v| v.parse().ok())

        .unwrap_or(3000);

    server::run(host, port).await;

}

use askama::Template;

use askama_web::WebTemplate;

use axum::{

    extract::{Form, Path, Query, State},

    http::{HeaderValue, StatusCode, Uri},

    response::{Html, IntoResponse, Redirect, Response},

    routing::{get, post},

    Router,

};

use pulldown_cmark::{Options, Parser, html};

use rust_embed::Embed;

use std::sync::Arc;

use crate::auth;

use crate::db::{self, Db, Page, Post};

#[derive(Clone)]

pub struct AppState {

    pub db: Db,

    pub app_password: String,

    pub cookie_secure: bool,

}

#[derive(Embed)]

#[folder = "static/"]

struct Static;

// --- Templates ---

#[derive(Template)]

#[template(path = "base.html")]

struct BaseTemplate {

    blog_title: String,

    nav_pages: Vec<Page>,

}

#[derive(Template)]

#[template(path = "admin_base.html")]

struct AdminBaseTemplate;

#[derive(Template)]

#[template(path = "login.html")]

struct LoginTemplate {

    error: Option<String>,

}

#[derive(Template)]

#[template(path = "index.html")]

struct IndexTemplate {

    blog_title: String,

    blog_description: String,

    intro_html: String,

    posts: Vec<Post>,

    nav_pages: Vec<Page>,

}

#[derive(Template)]

#[template(path = "post.html")]

struct PostTemplate {

    blog_title: String,

    nav_pages: Vec<Page>,

    post: Post,

    rendered_content: String,

}

#[derive(Template)]

#[template(path = "page.html")]

struct PageTemplate {

    blog_title: String,

    nav_pages: Vec<Page>,

    page: Page,

    rendered_content: String,

}

#[derive(Template)]

#[template(path = "admin_index.html")]

struct AdminIndexTemplate {

    posts: Vec<Post>,

}

#[derive(Template)]

#[template(path = "admin_post_form.html")]

struct AdminPostFormTemplate {

    post: Option<Post>,

    error: Option<String>,

}

#[derive(Template)]

#[template(path = "admin_pages.html")]

struct AdminPagesTemplate {

    pages: Vec<Page>,

}

#[derive(Template)]

#[template(path = "admin_page_form.html")]

struct AdminPageFormTemplate {

    page: Option<Page>,

    error: Option<String>,

}

#[derive(Template)]

#[template(path = "admin_settings.html")]

struct AdminSettingsTemplate {

    blog_title: String,

    blog_description: String,

    intro_content: String,

    success: bool,

}

// --- Query/Form structs ---

#[derive(serde::Deserialize, Default)]

pub struct FlashQuery {

    pub error: Option<String>,

    #[serde(default)]

    pub success: bool,

}

#[derive(serde::Deserialize)]

struct LoginForm {

    password: String,

}

#[derive(serde::Deserialize)]

struct PostForm {

    attributes: String,

    content: String,

    #[serde(default)]

    action: String,

}

struct ParsedAttributes {

    title: String,

    slug: String,

    alias: String,

    published_date: String,

    meta_description: String,

    meta_image: String,

    lang: String,

    tags: String,

}

fn parse_attributes(text: &str) -> ParsedAttributes {

    let mut attrs = ParsedAttributes {

        title: String::new(),

        slug: String::new(),

        alias: String::new(),

        published_date: String::new(),

        meta_description: String::new(),

        meta_image: String::new(),

        lang: String::new(),

        tags: String::new(),

    };

    for line in text.lines() {

        if let Some((key, value)) = line.split_once(':') {

            let key = key.trim().to_lowercase();

            let value = value.trim().to_string();

            match key.as_str() {

                "title" => attrs.title = value,

                "slug" => attrs.slug = value,

                "alias" => attrs.alias = value,

                "published_date" => attrs.published_date = value,

                "meta_description" => attrs.meta_description = value,

                "meta_image" => attrs.meta_image = value,

                "lang" => attrs.lang = value,

                "tags" => attrs.tags = value,

                _ => {} // ignore unknown keys (including canonical_url)

            }

        }

    }

    attrs

}

#[derive(serde::Deserialize)]

struct PageForm {

    title: String,

    slug: String,

    content: String,

    #[serde(default)]

    is_published: Option<String>,

    #[serde(default)]

    nav_order: i64,

}

#[derive(serde::Deserialize)]

struct SettingsForm {

    blog_title: String,

    blog_description: String,

    intro_content: String,

}

// --- Helpers ---

fn mime_from_path(path: &str) -> &'static str {

    match path.rsplit('.').next().unwrap_or("") {

        "css" => "text/css",

        "js" => "application/javascript",

        "html" => "text/html",

        "png" => "image/png",

        "ico" => "image/x-icon",

        "svg" => "image/svg+xml",

        "woff" | "woff2" => "font/woff2",

        "ttf" => "font/ttf",

        "otf" => "font/otf",

        "json" | "webmanifest" => "application/json",

        _ => "application/octet-stream",

    }

}

fn render_markdown(content: &str) -> String {

    let mut options = Options::empty();

    options.insert(Options::ENABLE_STRIKETHROUGH);

    options.insert(Options::ENABLE_TABLES);

    options.insert(Options::ENABLE_TASKLISTS);

    let parser = Parser::new_ext(content, options);

    let mut html_output = String::new();

    html::push_html(&mut html_output, parser);

    html_output

}

fn now_datetime() -> String {

    use std::time::{SystemTime, UNIX_EPOCH};

    let secs = SystemTime::now()

        .duration_since(UNIX_EPOCH)

        .unwrap()

        .as_secs();

    let days = secs / 86400;

    let tod = secs % 86400;

    let (y, m, d) = days_to_ymd(days as i64);

    format!(

        "{:04}-{:02}-{:02} {:02}:{:02}:{:02}",

        y, m, d, tod / 3600, (tod % 3600) / 60, tod % 60

    )

}

fn slugify(s: &str) -> String {

    s.to_lowercase()

        .chars()

        .map(|c| if c.is_ascii_alphanumeric() { c } else { '-' })

        .collect::<String>()

        .split('-')

        .filter(|s| !s.is_empty())

        .collect::<Vec<_>>()

        .join("-")

}

fn opt_str(s: &str) -> Option<&str> {

    let trimmed = s.trim();

    if trimmed.is_empty() { None } else { Some(trimmed) }

}

fn get_blog_title(db: &Db) -> String {

    db::get_setting(db, "blog_title")

        .ok()

        .flatten()

        .unwrap_or_else(|| "My Blog".to_string())

}

fn get_nav_pages(db: &Db) -> Vec<Page> {

    db::get_published_pages(db).unwrap_or_default()

}

// --- Static file handler ---

async fn serve_static(Path(path): Path<String>) -> Response {

    match Static::get(&path) {

        Some(file) => {

            let mime = mime_from_path(&path);

            (

                StatusCode::OK,

                [(axum::http::header::CONTENT_TYPE, HeaderValue::from_static(mime))],

                file.data.to_vec(),

            )

                .into_response()

        }

        None => StatusCode::NOT_FOUND.into_response(),

    }

}

// --- Auth handlers ---

async fn get_login(Query(q): Query<FlashQuery>) -> Response {

    WebTemplate(LoginTemplate { error: q.error }).into_response()

}

async fn post_login(

    State(state): State<Arc<AppState>>,

    Form(form): Form<LoginForm>,

) -> Response {

    if !auth::verify_password(&form.password, &state.app_password) {

        return Redirect::to("/admin/login?error=Invalid+password").into_response();

    }

    let token = auth::generate_session_token();

    let expires_at = {

        use std::time::{SystemTime, UNIX_EPOCH};

        let secs = SystemTime::now()

            .duration_since(UNIX_EPOCH)

            .unwrap()

            .as_secs()

            + 7 * 24 * 3600;

        let days = secs / 86400;

        let tod = secs % 86400;

        let (y, m, d) = days_to_ymd(days as i64);

        format!(

            "{:04}-{:02}-{:02} {:02}:{:02}:{:02}",

            y, m, d, tod / 3600, (tod % 3600) / 60, tod % 60

        )

    };

    if let Err(e) = db::insert_session(&state.db, &token, &expires_at) {

        tracing::error!("Failed to create session: {}", e);

        return Redirect::to("/admin/login?error=Server+error").into_response();

    }

    let cookie = auth::build_session_cookie(&token, state.cookie_secure);

    let mut resp = Redirect::to("/admin").into_response();

    resp.headers_mut().insert(

        axum::http::header::SET_COOKIE,

        HeaderValue::from_str(&cookie).unwrap(),

    );

    resp

}

async fn get_logout(State(state): State<Arc<AppState>>, headers: axum::http::HeaderMap) -> Response {

    if let Some(cookie_header) = headers.get("cookie").and_then(|v| v.to_str().ok()) {

        for part in cookie_header.split(';') {

            let part = part.trim();

            if let Some(val) = part.strip_prefix("session=") {

                let val = val.trim();

                if !val.is_empty() {

                    let _ = db::delete_session(&state.db, val);

                }

            }

        }

    }

    let cookie = auth::clear_session_cookie();

    let mut resp = Redirect::to("/admin/login").into_response();

    resp.headers_mut().insert(

        axum::http::header::SET_COOKIE,

        HeaderValue::from_str(&cookie).unwrap(),

    );

    resp

}

// --- Public handlers ---

async fn public_index(State(state): State<Arc<AppState>>) -> Response {

    let blog_title = get_blog_title(&state.db);

    let blog_description = db::get_setting(&state.db, "blog_description")

        .ok()

        .flatten()

        .unwrap_or_default();

    let intro_content = db::get_setting(&state.db, "intro_content")

        .ok()

        .flatten()

        .unwrap_or_default();

    let intro_html = render_markdown(&intro_content);

    let nav_pages = get_nav_pages(&state.db);

    match db::get_published_posts(&state.db) {

        Ok(posts) => WebTemplate(IndexTemplate {

            blog_title,

            blog_description,

            intro_html,

            posts,

            nav_pages,

        })

        .into_response(),

        Err(e) => {

            tracing::error!("Failed to list posts: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn public_post(

    State(state): State<Arc<AppState>>,

    Path(slug): Path<String>,

) -> Response {

    match db::get_post_by_slug(&state.db, &slug) {

        Ok(Some(post)) if post.status == "published" => {

            let rendered_content = render_markdown(&post.content);

            let blog_title = get_blog_title(&state.db);

            let nav_pages = get_nav_pages(&state.db);

            WebTemplate(PostTemplate {

                blog_title,

                nav_pages,

                post,

                rendered_content,

            })

            .into_response()

        }

        Ok(_) => (StatusCode::NOT_FOUND, Html("Not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to get post: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn public_page(

    State(state): State<Arc<AppState>>,

    Path(slug): Path<String>,

) -> Response {

    match db::get_page_by_slug(&state.db, &slug) {

        Ok(Some(page)) if page.is_published => {

            let rendered_content = render_markdown(&page.content);

            let blog_title = get_blog_title(&state.db);

            let nav_pages = get_nav_pages(&state.db);

            WebTemplate(PageTemplate {

                blog_title,

                nav_pages,

                page,

                rendered_content,

            })

            .into_response()

        }

        Ok(_) => (StatusCode::NOT_FOUND, Html("Not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to get page: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn fallback_handler(

    State(state): State<Arc<AppState>>,

    uri: Uri,

) -> Response {

    let path = uri.path().trim_start_matches('/');

    if let Ok(Some(redirect_to)) = db::find_alias_redirect(&state.db, path) {

        return Redirect::permanent(&redirect_to).into_response();

    }

    (StatusCode::NOT_FOUND, Html("Not found".to_string())).into_response()

}

// --- Admin post handlers ---

async fn admin_index(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

) -> Response {

    match db::get_all_posts(&state.db) {

        Ok(posts) => WebTemplate(AdminIndexTemplate { posts }).into_response(),

        Err(e) => {

            tracing::error!("Failed to list posts: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn admin_new_post(

    _session: auth::AuthSession,

    Query(q): Query<FlashQuery>,

) -> Response {

    WebTemplate(AdminPostFormTemplate {

        post: None,

        error: q.error,

    })

    .into_response()

}

async fn admin_create_post(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Form(form): Form<PostForm>,

) -> Response {

    let attrs = parse_attributes(&form.attributes);

    let title = attrs.title.trim();

    if title.is_empty() {

        return Redirect::to("/admin/posts/new?error=Title+is+required").into_response();

    }

    let slug = if attrs.slug.trim().is_empty() {

        slugify(title)

    } else {

        attrs.slug.trim().to_string()

    };

    let status = if form.action == "publish" { "published" } else { "draft" };

    let lang = if attrs.lang.trim().is_empty() { "en" } else { attrs.lang.trim() };

    let published_date = if attrs.published_date.trim().is_empty() {

        now_datetime()

    } else {

        attrs.published_date.trim().to_string()

    };

    match db::create_post(

        &state.db,

        title,

        &slug,

        &form.content,

        status,

        opt_str(&attrs.alias),

        None,

        Some(&published_date),

        opt_str(&attrs.meta_description),

        opt_str(&attrs.meta_image),

        lang,

        opt_str(&attrs.tags),

    ) {

        Ok(_) => Redirect::to("/admin").into_response(),

        Err(e) => {

            tracing::error!("Failed to create post: {}", e);

            Redirect::to("/admin/posts/new?error=Failed+to+create+post").into_response()

        }

    }

}

async fn admin_edit_post(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

    Query(q): Query<FlashQuery>,

) -> Response {

    match db::get_post_by_short_id(&state.db, &short_id) {

        Ok(Some(post)) => WebTemplate(AdminPostFormTemplate {

            post: Some(post),

            error: q.error,

        })

        .into_response(),

        Ok(None) => (StatusCode::NOT_FOUND, Html("Post not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to get post: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn admin_update_post(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

    Form(form): Form<PostForm>,

) -> Response {

    let attrs = parse_attributes(&form.attributes);

    let title = attrs.title.trim();

    if title.is_empty() {

        return Redirect::to(&format!("/admin/posts/{}/edit?error=Title+is+required", short_id))

            .into_response();

    }

    let slug = if attrs.slug.trim().is_empty() {

        slugify(title)

    } else {

        attrs.slug.trim().to_string()

    };

    let lang = if attrs.lang.trim().is_empty() { "en" } else { attrs.lang.trim() };

    let published_date = if attrs.published_date.trim().is_empty() {

        now_datetime()

    } else {

        attrs.published_date.trim().to_string()

    };

    match db::update_post(

        &state.db,

        &short_id,

        title,

        &slug,

        &form.content,

        opt_str(&attrs.alias),

        None,

        Some(&published_date),

        opt_str(&attrs.meta_description),

        opt_str(&attrs.meta_image),

        lang,

        opt_str(&attrs.tags),

    ) {

        Ok(Some(_)) => Redirect::to("/admin").into_response(),

        Ok(None) => (StatusCode::NOT_FOUND, Html("Post not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to update post: {}", e);

            Redirect::to(&format!("/admin/posts/{}/edit?error=Failed+to+update", short_id))

                .into_response()

        }

    }

}

async fn admin_delete_post(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

) -> Response {

    match db::delete_post(&state.db, &short_id) {

        Ok(_) => Redirect::to("/admin").into_response(),

        Err(e) => {