name = "library"

version = "0.1.0"

dependencies = [

 "andromeda-auth",

 "andromeda-darkmatter-css",

 "andromeda-db",

 "askama 0.13.1",

 "axum",

 "chrono",

 "dotenvy",

 "mime_guess",

 "rand 0.8.5",

 "reqwest 0.12.28",

 "rusqlite",

 "rust-embed",

 "serde",

 "serde_json",

 "subtle",

 "tokio",

 "tracing",

 "tracing-subscriber",

 "urlencoding",

]

[[package]]

    "apps/library",

ADMIN_PASSWORD=changeme

COOKIE_SECURE=false

BASE_URL=http://localhost:3000

HOST=127.0.0.1

PORT=3000

LIBRARY_DB_PATH=/data/library.sqlite

API_KEY=

GOOGLE_BOOKS_API_KEY=

[package]

name = "library"

version = "0.1.0"

edition = "2024"

description = "Personal book tracking"

license = "MIT"

repository = "https://github.com/stevedylandev/andromeda"

homepage = "https://github.com/stevedylandev/andromeda"

[dependencies]

axum = { workspace = true }

tokio = { workspace = true }

serde = { workspace = true }

serde_json = { workspace = true }

dotenvy = { workspace = true }

rust-embed = { workspace = true }

subtle = { workspace = true }

rand = { workspace = true }

rusqlite = { workspace = true }

tracing = { workspace = true }

tracing-subscriber = { workspace = true, features = ["env-filter"] }

andromeda-auth = { workspace = true }

andromeda-db = { workspace = true, features = ["axum", "session"] }

andromeda-darkmatter-css = { workspace = true }

askama = "0.13"

reqwest = { version = "0.12", features = ["json"] }

chrono = "0.4"

mime_guess = "2"

urlencoding = "2"

# Build from repo root: docker build -t library -f apps/library/Dockerfile .

FROM lukemathwalker/cargo-chef:latest-rust-1-slim-bookworm AS chef

WORKDIR /app

FROM chef AS planner

COPY . .

RUN cargo chef prepare --recipe-path recipe.json

FROM chef AS builder

RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*

COPY --from=planner /app/recipe.json recipe.json

RUN cargo chef cook --release --recipe-path recipe.json -p library

COPY . .

RUN cargo build --release -p library

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*

COPY --from=builder /app/target/release/library /usr/local/bin/library

WORKDIR /data

EXPOSE 3000

ENV HOST=0.0.0.0

ENV PORT=3000

CMD ["library"]

[general]

dirs = ["src/templates"]

use axum::{

    extract::{FromRef, FromRequestParts},

    http::{request::Parts, StatusCode},

    response::{IntoResponse, Redirect, Response},

};

use chrono::{Duration, Utc};

use std::sync::Arc;

use crate::AppState;

use andromeda_db::session;

pub use andromeda_auth::{

    build_session_cookie, clear_session_cookie, extract_session_cookie, generate_session_token,

    verify_api_key, verify_password,

};

const SESSION_DAYS: i64 = 7;

pub fn create_session(db: &andromeda_db::Db, token: &str) -> Result<(), andromeda_db::DbError> {

    let expires = (Utc::now() + Duration::days(SESSION_DAYS))

        .format("%Y-%m-%d %H:%M:%S")

        .to_string();

    session::insert_session(db, token, &expires)

}

pub fn is_valid_session(db: &andromeda_db::Db, token: &str) -> bool {

    match session::get_session_expiry(db, token) {

        Ok(Some(expires_at)) => {

            chrono::NaiveDateTime::parse_from_str(&expires_at, "%Y-%m-%d %H:%M:%S")

                .map(|exp| exp > Utc::now().naive_utc())

                .unwrap_or(false)

        }

        _ => false,

    }

}

pub fn delete_session(db: &andromeda_db::Db, token: &str) {

    let _ = session::delete_session(db, token);

}

pub struct AuthSession;

impl<S> FromRequestParts<S> for AuthSession

where

    S: Send + Sync,

    Arc<AppState>: FromRef<S>,

{

    type Rejection = Response;

    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {

        let state = Arc::<AppState>::from_ref(state);

        if let Some(token) = extract_session_cookie(&parts.headers) {

            if is_valid_session(&state.db, &token) {

                return Ok(AuthSession);

            }

        }

        Err(Redirect::to("/admin/login").into_response())

    }

}

pub struct ApiAuth;

impl<S> FromRequestParts<S> for ApiAuth

where

    S: Send + Sync,

    Arc<AppState>: FromRef<S>,

{

    type Rejection = Response;

    async fn from_request_parts(parts: &mut Parts, state: &S) -> Result<Self, Self::Rejection> {

        let state = Arc::<AppState>::from_ref(state);

        if let Some(expected_key) = state.api_key.as_deref() {

            if let Some(header) = parts.headers.get(axum::http::header::AUTHORIZATION) {

                if let Ok(s) = header.to_str() {

                    if let Some(token) = s.strip_prefix("Bearer ").or_else(|| s.strip_prefix("bearer ")) {

                        if verify_api_key(token.trim(), expected_key) {

                            return Ok(ApiAuth);

                        }

                    }

                }

            }

        }

        if let Some(token) = extract_session_cookie(&parts.headers) {

            if is_valid_session(&state.db, &token) {

                return Ok(ApiAuth);

            }

        }

        Err((

            StatusCode::UNAUTHORIZED,

            axum::Json(serde_json::json!({ "error": "unauthorized" })),

        )

            .into_response())

    }

}

use andromeda_db::{Db, DbError};

use rusqlite::{params, OptionalExtension};

use serde::{Deserialize, Serialize};

pub const BOOKS_SCHEMA: &str = r#"

CREATE TABLE IF NOT EXISTS books (

    id            INTEGER PRIMARY KEY AUTOINCREMENT,

    google_id     TEXT UNIQUE,

    title         TEXT NOT NULL,

    authors       TEXT NOT NULL,

    isbn          TEXT,

    cover_url     TEXT,

    notes         TEXT,

    status        TEXT NOT NULL CHECK (status IN ('read','reading','want')),

    added_at      INTEGER NOT NULL,

    updated_at    INTEGER NOT NULL

);

CREATE INDEX IF NOT EXISTS idx_books_status_added ON books(status, added_at DESC);

"#;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]

#[serde(rename_all = "lowercase")]

pub enum BookStatus {

    Read,

    Reading,

    Want,

}

impl BookStatus {

    pub fn as_str(&self) -> &'static str {

        match self {

            BookStatus::Read => "read",

            BookStatus::Reading => "reading",

            BookStatus::Want => "want",

        }

    }

    pub fn parse(s: &str) -> Option<Self> {

        match s {

            "read" => Some(BookStatus::Read),

            "reading" => Some(BookStatus::Reading),

            "want" => Some(BookStatus::Want),

            _ => None,

        }

    }

}

#[derive(Debug, Clone, Serialize)]

pub struct Book {

    pub id: i64,

    pub google_id: Option<String>,

    pub title: String,

    pub authors: String,

    pub isbn: Option<String>,

    pub cover_url: Option<String>,

    pub notes: Option<String>,

    pub status: String,

    pub added_at: i64,

    pub updated_at: i64,

}

#[derive(Debug, Clone)]

pub struct NewBook {

    pub google_id: Option<String>,

    pub title: String,

    pub authors: String,

    pub isbn: Option<String>,

    pub cover_url: Option<String>,

    pub notes: Option<String>,

    pub status: BookStatus,

}

fn map_book(row: &rusqlite::Row) -> rusqlite::Result<Book> {

    Ok(Book {

        id: row.get(0)?,

        google_id: row.get(1)?,

        title: row.get(2)?,

        authors: row.get(3)?,

        isbn: row.get(4)?,

        cover_url: row.get(5)?,

        notes: row.get(6)?,

        status: row.get(7)?,

        added_at: row.get(8)?,

        updated_at: row.get(9)?,

    })

}

const SELECT_COLS: &str =

    "id, google_id, title, authors, isbn, cover_url, notes, status, added_at, updated_at";

pub fn list_books(db: &Db, status: Option<BookStatus>) -> Result<Vec<Book>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let books = match status {

        Some(s) => {

            let sql = format!(

                "SELECT {SELECT_COLS} FROM books WHERE status = ?1 ORDER BY added_at DESC"

            );

            let mut stmt = conn.prepare(&sql)?;

            let rows = stmt.query_map([s.as_str()], map_book)?;

            rows.collect::<Result<Vec<_>, _>>()?

        }

        None => {

            let sql = format!("SELECT {SELECT_COLS} FROM books ORDER BY added_at DESC");

            let mut stmt = conn.prepare(&sql)?;

            let rows = stmt.query_map([], map_book)?;

            rows.collect::<Result<Vec<_>, _>>()?

        }

    };

    Ok(books)

}

pub fn get_book(db: &Db, id: i64) -> Result<Option<Book>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let sql = format!("SELECT {SELECT_COLS} FROM books WHERE id = ?1");

    let book = conn

        .query_row(&sql, [id], map_book)

        .optional()?;

    Ok(book)

}

pub fn insert_book(db: &Db, b: &NewBook) -> Result<i64, DbError> {

    let now = chrono::Utc::now().timestamp();

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "INSERT INTO books (google_id, title, authors, isbn, cover_url, notes, status, added_at, updated_at)

         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?8)

         ON CONFLICT(google_id) DO UPDATE SET status = excluded.status, updated_at = excluded.updated_at",

        params![

            b.google_id,

            b.title,

            b.authors,

            b.isbn,

            b.cover_url,

            b.notes,

            b.status.as_str(),

            now,

        ],

    )?;

    Ok(conn.last_insert_rowid())

}

pub fn update_book_status(db: &Db, id: i64, status: BookStatus) -> Result<bool, DbError> {

    let now = chrono::Utc::now().timestamp();

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let n = conn.execute(

        "UPDATE books SET status = ?1, updated_at = ?2 WHERE id = ?3",

        params![status.as_str(), now, id],

    )?;

    Ok(n > 0)

}

pub fn update_book_notes(db: &Db, id: i64, notes: Option<&str>) -> Result<bool, DbError> {

    let now = chrono::Utc::now().timestamp();

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let n = conn.execute(

        "UPDATE books SET notes = ?1, updated_at = ?2 WHERE id = ?3",

        params![notes, now, id],

    )?;

    Ok(n > 0)

}

pub fn delete_book(db: &Db, id: i64) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let n = conn.execute("DELETE FROM books WHERE id = ?1", [id])?;

    Ok(n > 0)

}

#[derive(Debug, Default, Clone, Copy, Serialize)]

pub struct StatusCounts {

    pub read: i64,

    pub reading: i64,

    pub want: i64,

}

pub fn count_by_status(db: &Db) -> Result<StatusCounts, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare("SELECT status, COUNT(*) FROM books GROUP BY status")?;

    let mut counts = StatusCounts::default();

    let rows = stmt.query_map([], |row| {

        let s: String = row.get(0)?;

        let n: i64 = row.get(1)?;

        Ok((s, n))

    })?;

    for r in rows {

        let (s, n) = r?;

        match s.as_str() {

            "read" => counts.read = n,

            "reading" => counts.reading = n,

            "want" => counts.want = n,

            _ => {}

        }

    }

    Ok(counts)

}

use serde::{Deserialize, Serialize};

use std::time::Duration;

#[derive(Debug, Clone, Serialize)]

pub struct SearchHit {

    pub google_id: String,

    pub title: String,

    pub authors: String,

    pub isbn: Option<String>,

    pub cover_url: Option<String>,

}

#[derive(Deserialize)]

struct VolumesResponse {

    #[serde(default)]

    items: Vec<Volume>,

}

#[derive(Deserialize)]

struct Volume {

    id: String,

    #[serde(rename = "volumeInfo")]

    volume_info: VolumeInfo,

}

#[derive(Deserialize)]

struct VolumeInfo {

    title: Option<String>,

    #[serde(default)]

    authors: Vec<String>,

    #[serde(default, rename = "industryIdentifiers")]

    identifiers: Vec<Identifier>,

    #[serde(rename = "imageLinks")]

    image_links: Option<ImageLinks>,

}

#[derive(Deserialize)]

struct Identifier {

    #[serde(rename = "type")]

    kind: String,

    identifier: String,

}

#[derive(Deserialize)]

struct ImageLinks {

    thumbnail: Option<String>,

    #[serde(rename = "smallThumbnail")]

    small_thumbnail: Option<String>,

}

pub async fn search(query: &str, api_key: Option<&str>) -> Result<Vec<SearchHit>, String> {

    let q = urlencoding::encode(query.trim());

    if q.is_empty() {

        return Ok(Vec::new());

    }

    let mut url = format!(

        "https://www.googleapis.com/books/v1/volumes?q={q}&maxResults=10&printType=books"

    );

    if let Some(key) = api_key {

        url.push_str(&format!("&key={}", urlencoding::encode(key)));

    }

    let client = reqwest::Client::builder()

        .timeout(Duration::from_secs(8))

        .user_agent("andromeda-library/0.1")

        .build()

        .map_err(|e| format!("client build: {e}"))?;

    let resp = client

        .get(&url)

        .send()

        .await

        .map_err(|e| format!("request: {e}"))?;

    if !resp.status().is_success() {

        return Err(format!("google books status {}", resp.status()));

    }

    let data: VolumesResponse = resp

        .json()

        .await

        .map_err(|e| format!("parse: {e}"))?;

    Ok(data

        .items

        .into_iter()

        .map(|v| {

            let info = v.volume_info;

            let isbn = pick_isbn(&info.identifiers);

            let cover_url = info

                .image_links

                .as_ref()

                .and_then(|l| l.thumbnail.clone().or_else(|| l.small_thumbnail.clone()))

                .map(|u| u.replacen("http://", "https://", 1));

            SearchHit {

                google_id: v.id,

                title: info.title.unwrap_or_else(|| "Untitled".to_string()),

                authors: info.authors.join(", "),

                isbn,

                cover_url,

            }

        })

        .collect())

}

fn pick_isbn(ids: &[Identifier]) -> Option<String> {

    ids.iter()

        .find(|i| i.kind == "ISBN_13")

        .or_else(|| ids.iter().find(|i| i.kind == "ISBN_10"))

        .map(|i| i.identifier.clone())

}

mod auth;

mod db;

mod google_books;

use std::sync::{Arc, Mutex};

use andromeda_db::{

    session::{prune_expired_sessions, SESSION_SCHEMA},

    Db,

};

use askama::Template;

use axum::{

    extract::{Path, Query, State},

    http::{header, HeaderMap, StatusCode},

    response::{Html, IntoResponse, Json, Redirect, Response},

    routing::{get, post},

    Form, Router,

};

use rusqlite::Connection;

use rust_embed::Embed;

use serde::Deserialize;

use crate::db::{Book, BookStatus, NewBook, StatusCounts};

#[derive(Embed)]

#[folder = "static/"]

struct Static;

pub struct AppState {

    pub db: Db,

    pub admin_password: Option<String>,

    pub api_key: Option<String>,

    pub google_books_api_key: Option<String>,

    pub cookie_secure: bool,

    pub base_url: String,

}

// ── Templates ────────────────────────────────────────────────────────────

struct BookView {

    title: String,

    authors: String,

    cover_url: Option<String>,

    notes: Option<String>,

}

#[derive(Template)]

#[template(path = "index.html")]

struct IndexTemplate {

    base_url: String,

    tab: &'static str,

    tab_label: &'static str,

    books: Vec<BookView>,

    counts: StatusCounts,

}

#[derive(Template)]

#[template(path = "login.html")]

struct LoginTemplate {

    error: Option<String>,

}

struct AdminBookRow {

    id: i64,

    title: String,

    authors: String,

    isbn: Option<String>,

    cover_url: Option<String>,

    notes: Option<String>,

    status: String,

}

#[derive(Template)]

#[template(path = "admin.html")]

struct AdminTemplate {

    success: Option<String>,

    error: Option<String>,

    books: Vec<AdminBookRow>,

    api_key_configured: bool,

    google_key_configured: bool,

}

fn render_index(

    state: &AppState,

    status: BookStatus,

    tab: &'static str,

    label: &'static str,

) -> Response {

    let books = db::list_books(&state.db, Some(status))

        .unwrap_or_default()

        .into_iter()

        .map(|b: Book| BookView {

            title: b.title,

            authors: b.authors,

            cover_url: b.cover_url,

            notes: b.notes,

        })

        .collect();

    let counts = db::count_by_status(&state.db).unwrap_or_default();

    Html(

        IndexTemplate {

            base_url: state.base_url.clone(),

            tab,

            tab_label: label,

            books,

            counts,

        }

        .render()

        .unwrap(),

    )

    .into_response()

}

async fn root_redirect() -> Response {

    Redirect::to("/read").into_response()

}

async fn read_handler(State(state): State<Arc<AppState>>) -> Response {

    render_index(&state, BookStatus::Read, "read", "Read")

}

async fn reading_handler(State(state): State<Arc<AppState>>) -> Response {

    render_index(&state, BookStatus::Reading, "reading", "Reading")

}

async fn want_handler(State(state): State<Arc<AppState>>) -> Response {

    render_index(&state, BookStatus::Want, "want", "Want to Read")

}

async fn static_handler(Path(path): Path<String>) -> Response {

    match Static::get(&path) {

        Some(file) => {

            let mime = mime_guess::from_path(&path).first_or_octet_stream();

            ([(header::CONTENT_TYPE, mime.as_ref())], file.data.to_vec()).into_response()

        }

        None => StatusCode::NOT_FOUND.into_response(),

    }

}

// ── Admin ────────────────────────────────────────────────────────────────

#[derive(Deserialize, Default)]

struct FlashQuery {

    error: Option<String>,

    success: Option<String>,

}

#[derive(Deserialize)]

struct LoginForm {

    password: String,

}

async fn login_get_handler(Query(q): Query<FlashQuery>) -> Response {

    Html(LoginTemplate { error: q.error }.render().unwrap()).into_response()

}

async fn login_post_handler(

    State(state): State<Arc<AppState>>,

    Form(form): Form<LoginForm>,

) -> Response {

    let admin_password = match &state.admin_password {

        Some(p) => p,

        None => {

            return Redirect::to("/admin/login?error=No+admin+password+configured").into_response();

        }

    };

    if !auth::verify_password(&form.password, admin_password) {

        return Redirect::to("/admin/login?error=Invalid+password").into_response();

    }

    let token = auth::generate_session_token();

    if let Err(e) = auth::create_session(&state.db, &token) {

        tracing::error!("failed to create session: {e}");

        return Redirect::to("/admin/login?error=Session+error").into_response();

    }

    let _ = prune_expired_sessions(&state.db);

    let cookie = auth::build_session_cookie(&token, state.cookie_secure);

    let mut resp = Redirect::to("/admin").into_response();

    resp.headers_mut()

        .insert(header::SET_COOKIE, cookie.parse().unwrap());

    resp

}

async fn logout_handler(State(state): State<Arc<AppState>>, headers: HeaderMap) -> Response {

    if let Some(token) = auth::extract_session_cookie(&headers) {

        auth::delete_session(&state.db, &token);

    }

    let mut resp = Redirect::to("/admin/login").into_response();

    resp.headers_mut().insert(

        header::SET_COOKIE,

        auth::clear_session_cookie().parse().unwrap(),

    );

    resp

}

async fn admin_handler(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Query(q): Query<FlashQuery>,

) -> Response {

    let books = db::list_books(&state.db, None)

        .unwrap_or_default()

        .into_iter()

        .map(|b| AdminBookRow {

            id: b.id,

            title: b.title,

            authors: b.authors,

            isbn: b.isbn,

            cover_url: b.cover_url,

            notes: b.notes,

            status: b.status,

        })

        .collect();

    Html(

        AdminTemplate {

            success: q.success,

            error: q.error,

            books,

            api_key_configured: state.api_key.is_some(),

            google_key_configured: state.google_books_api_key.is_some(),

        }

        .render()

        .unwrap(),

    )

    .into_response()

}

#[derive(Deserialize)]

struct SearchQuery {

    q: String,

}

async fn admin_search_handler(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Query(q): Query<SearchQuery>,

) -> Response {

    match google_books::search(&q.q, state.google_books_api_key.as_deref()).await {

        Ok(hits) => Json(hits).into_response(),

        Err(e) => {

            tracing::warn!("google books search failed: {e}");

            (StatusCode::BAD_GATEWAY, Json(serde_json::json!({ "error": e })))

                .into_response()

        }

    }

}

#[derive(Deserialize)]

struct AddBookForm {

    google_id: Option<String>,

    title: String,

    authors: String,

    isbn: Option<String>,

    cover_url: Option<String>,

    status: String,

}

async fn admin_add_book(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Form(form): Form<AddBookForm>,

) -> Response {

    let Some(status) = BookStatus::parse(&form.status) else {

        return Redirect::to("/admin?error=Invalid+status").into_response();

    };

    let new_book = NewBook {

        google_id: form.google_id.filter(|s| !s.is_empty()),

        title: form.title,

        authors: form.authors,

        isbn: form.isbn.filter(|s| !s.is_empty()),

        cover_url: form.cover_url.filter(|s| !s.is_empty()),

        notes: None,

        status,

    };

    match db::insert_book(&state.db, &new_book) {

        Ok(_) => Redirect::to("/admin?success=Book+added").into_response(),

        Err(e) => {

            tracing::error!("insert book: {e}");

            Redirect::to("/admin?error=Failed+to+add+book").into_response()

        }

    }

}

#[derive(Deserialize)]

struct UpdateStatusForm {

    status: String,

}

async fn admin_update_status(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(id): Path<i64>,

    Form(form): Form<UpdateStatusForm>,

) -> Response {

    let Some(status) = BookStatus::parse(&form.status) else {

        return Redirect::to("/admin?error=Invalid+status").into_response();

    };

    let _ = db::update_book_status(&state.db, id, status);

    Redirect::to("/admin?success=Status+updated").into_response()

}

#[derive(Deserialize)]

struct UpdateNotesForm {

    notes: String,

}

async fn admin_update_notes(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(id): Path<i64>,

    Form(form): Form<UpdateNotesForm>,

) -> Response {

    let trimmed = form.notes.trim();

    let notes = if trimmed.is_empty() { None } else { Some(trimmed) };

    let _ = db::update_book_notes(&state.db, id, notes);

    Redirect::to("/admin?success=Notes+saved").into_response()

}

async fn admin_delete_book(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(id): Path<i64>,

) -> Response {

    let _ = db::delete_book(&state.db, id);

    Redirect::to("/admin?success=Book+removed").into_response()

}

// ── JSON API ─────────────────────────────────────────────────────────────

#[derive(Deserialize)]

struct ListBooksQuery {

    status: Option<String>,

}

async fn api_list_books(

    State(state): State<Arc<AppState>>,

    Query(q): Query<ListBooksQuery>,

) -> Response {

    let status = match q.status.as_deref() {

        None | Some("") | Some("all") => None,

        Some(s) => match BookStatus::parse(s) {

            Some(st) => Some(st),

            None => {

                return (

                    StatusCode::BAD_REQUEST,

                    Json(serde_json::json!({ "error": "invalid status" })),

                )

                    .into_response();

            }

        },

    };

    match db::list_books(&state.db, status) {

        Ok(books) => Json(books).into_response(),

        Err(e) => {

            tracing::error!("list books: {e}");

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

async fn api_get_book(

    State(state): State<Arc<AppState>>,

    Path(id): Path<i64>,

) -> Response {

    match db::get_book(&state.db, id) {

        Ok(Some(book)) => Json(book).into_response(),

        Ok(None) => (StatusCode::NOT_FOUND, Json(serde_json::json!({ "error": "not found" })))

            .into_response(),

        Err(e) => {

            tracing::error!("get book: {e}");

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

#[derive(Deserialize)]

struct CreateBookBody {

    google_id: Option<String>,

    title: String,

    authors: String,

    isbn: Option<String>,

    cover_url: Option<String>,

    notes: Option<String>,

    status: String,

}

async fn api_create_book(

    _auth: auth::ApiAuth,

    State(state): State<Arc<AppState>>,

    Json(body): Json<CreateBookBody>,

) -> Response {

    let Some(status) = BookStatus::parse(&body.status) else {

        return (

            StatusCode::BAD_REQUEST,

            Json(serde_json::json!({ "error": "invalid status" })),

        )

            .into_response();

    };

    let new_book = NewBook {

        google_id: body.google_id,

        title: body.title,

        authors: body.authors,

        isbn: body.isbn,

        cover_url: body.cover_url,

        notes: body.notes,

        status,

    };

    match db::insert_book(&state.db, &new_book) {

        Ok(id) => match db::get_book(&state.db, id) {

            Ok(Some(book)) => (StatusCode::CREATED, Json(book)).into_response(),

            _ => StatusCode::INTERNAL_SERVER_ERROR.into_response(),

        },

        Err(e) => {

            tracing::error!("create book: {e}");

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

#[derive(Deserialize)]

struct PatchBookBody {

    status: Option<String>,

    notes: Option<String>,

}

async fn api_patch_book(

    _auth: auth::ApiAuth,

    State(state): State<Arc<AppState>>,

    Path(id): Path<i64>,

    Json(body): Json<PatchBookBody>,

) -> Response {

    if let Some(s) = body.status.as_deref() {

        let Some(status) = BookStatus::parse(s) else {

            return (

                StatusCode::BAD_REQUEST,

                Json(serde_json::json!({ "error": "invalid status" })),

            )

                .into_response();

        };

        if let Err(e) = db::update_book_status(&state.db, id, status) {

            tracing::error!("update status: {e}");

            return StatusCode::INTERNAL_SERVER_ERROR.into_response();

        }

    }

    if let Some(notes) = body.notes.as_deref() {

        let trimmed = notes.trim();

        let n = if trimmed.is_empty() { None } else { Some(trimmed) };

        if let Err(e) = db::update_book_notes(&state.db, id, n) {

            tracing::error!("update notes: {e}");

            return StatusCode::INTERNAL_SERVER_ERROR.into_response();

        }

    }

    match db::get_book(&state.db, id) {

        Ok(Some(book)) => Json(book).into_response(),

        Ok(None) => (StatusCode::NOT_FOUND, Json(serde_json::json!({ "error": "not found" })))

            .into_response(),

        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),

    }

}

async fn api_delete_book(

    _auth: auth::ApiAuth,

    State(state): State<Arc<AppState>>,

    Path(id): Path<i64>,

) -> Response {

    match db::delete_book(&state.db, id) {

        Ok(true) => StatusCode::NO_CONTENT.into_response(),

        Ok(false) => (StatusCode::NOT_FOUND, Json(serde_json::json!({ "error": "not found" })))

            .into_response(),

        Err(e) => {

            tracing::error!("delete book: {e}");

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

async fn api_counts(State(state): State<Arc<AppState>>) -> Response {

    match db::count_by_status(&state.db) {

        Ok(counts) => Json(counts).into_response(),

        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),

    }

}

// ── main ─────────────────────────────────────────────────────────────────

#[tokio::main]

async fn main() {

    dotenvy::dotenv().ok();

    tracing_subscriber::fmt()

        .with_env_filter(

            tracing_subscriber::EnvFilter::try_from_default_env()

                .unwrap_or_else(|_| tracing_subscriber::EnvFilter::new("info,library=info")),

        )

        .init();

    let db_path =

        std::env::var("LIBRARY_DB_PATH").unwrap_or_else(|_| "library.sqlite".to_string());

    let conn = Connection::open(&db_path).expect("open sqlite");

    conn.execute_batch(SESSION_SCHEMA).expect("session schema");

    conn.execute_batch(db::BOOKS_SCHEMA).expect("books schema");

    let db: Db = Arc::new(Mutex::new(conn));

    let cookie_secure = std::env::var("COOKIE_SECURE")

        .map(|v| v.eq_ignore_ascii_case("true"))

        .unwrap_or(false);

    let base_url =

        std::env::var("BASE_URL").unwrap_or_else(|_| "http://localhost:3000".to_string());

    let api_key = std::env::var("API_KEY").ok().filter(|s| !s.is_empty());

    if api_key.is_none() {

        tracing::warn!("API_KEY not set; write API accessible via session cookie only");

    }

    let google_books_api_key = std::env::var("GOOGLE_BOOKS_API_KEY")

        .ok()

        .filter(|s| !s.is_empty());

    let state = Arc::new(AppState {

        db,

        admin_password: std::env::var("ADMIN_PASSWORD").ok(),

        api_key,

        google_books_api_key,

        cookie_secure,

        base_url,

    });

    let admin_router = Router::new()

        .route("/admin", get(admin_handler))

        .route(

            "/admin/login",

            get(login_get_handler).post(login_post_handler),

        )

        .route("/admin/logout", get(logout_handler))

        .route("/admin/search", get(admin_search_handler))

        .route("/admin/add", post(admin_add_book))

        .route("/admin/books/{id}/status", post(admin_update_status))

        .route("/admin/books/{id}/notes", post(admin_update_notes))

        .route("/admin/books/{id}/delete", post(admin_delete_book));

    let api_router = Router::new()

        .route("/api/books", get(api_list_books).post(api_create_book))

        .route(

            "/api/books/{id}",

            get(api_get_book).patch(api_patch_book).delete(api_delete_book),

        )

        .route("/api/counts", get(api_counts));

    let app = Router::new()

        .route("/", get(root_redirect))

        .route("/read", get(read_handler))

        .route("/reading", get(reading_handler))

        .route("/want", get(want_handler))

        .route("/static/{*path}", get(static_handler))

        .merge(admin_router)

        .merge(api_router)

        .merge(andromeda_darkmatter_css::router::<Arc<AppState>>())

        .with_state(state);

    let host = std::env::var("HOST").unwrap_or_else(|_| "0.0.0.0".to_string());

    let port: u16 = std::env::var("PORT")

        .ok()

        .and_then(|v| v.parse().ok())

        .unwrap_or(3000);

    let addr = format!("{host}:{port}");

    let listener = tokio::net::TcpListener::bind(&addr)

        .await

        .unwrap_or_else(|_| panic!("Failed to bind to {addr}"));

    tracing::info!("Library server running on http://{host}:{port}");

    axum::serve(listener, app).await.unwrap();

}

<!doctype html>

<html lang="en">

  <head>

    <meta charset="UTF-8" />

    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <meta name="theme-color" content="#121113" />

    <link rel="stylesheet" href="/assets/darkmatter.css" />

    <link rel="stylesheet" href="/static/styles.css" />

    <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png" />

    <link rel="icon" type="image/png" sizes="32x32" href="/static/favicon-32x32.png" />

    <link rel="icon" type="image/png" sizes="16x16" href="/static/favicon-16x16.png" />

    <link rel="manifest" href="/static/site.webmanifest" />

    <title>Library | Admin</title>

  </head>

  <body>

    <div class="header">

      <a href="/" class="logo"><h1>LIBRARY</h1></a>

      <nav class="links">

        <a href="/admin/logout">logout</a>

      </nav>

    </div>

    {% if let Some(msg) = success %}

    <p class="success">{{ msg }}</p>

    {% endif %}

    {% if let Some(err) = error %}

    <p class="error">{{ err }}</p>

    {% endif %}

    <section class="admin-form">

      <h3>Search Books</h3>

      <div class="search-row">

        <input type="text" id="book-query" placeholder="title, author, isbn" />

        <button type="button" id="search-btn" onclick="searchBooks()">Search</button>

      </div>

      <div id="search-status" class="search-status" style="display:none;"></div>

      <div id="search-results" class="search-results"></div>

      <p class="hint">Google Books API key: {% if google_key_configured %}configured{% else %}not set (default rate limits apply){% endif %}</p>

    </section>

    <section class="admin-subs">

      <h3>Library ({{ books.len() }})</h3>

      {% if books.is_empty() %}

      <p class="hint">No books yet. Search above to add one.</p>

      {% else %}

      <div class="books-list">

        {% for b in books %}

        <div class="book-card admin">

          {% if let Some(url) = b.cover_url %}

          <img class="book-cover" src="{{ url }}" alt="" loading="lazy" />

          {% else %}

          <div class="book-cover placeholder"></div>

          {% endif %}

          <div class="book-info">

            <h3 class="book-title">{{ b.title }}</h3>

            <p class="book-authors">{{ b.authors }}</p>

            {% if let Some(isbn) = b.isbn %}

            <p class="book-meta">ISBN: {{ isbn }}</p>

            {% endif %}

            <form method="POST" action="/admin/books/{{ b.id }}/status" class="inline">

              <select name="status" onchange="this.form.submit()">

                <option value="read"{% if b.status == "read" %} selected{% endif %}>Read</option>

                <option value="reading"{% if b.status == "reading" %} selected{% endif %}>Reading</option>

                <option value="want"{% if b.status == "want" %} selected{% endif %}>Want to Read</option>

              </select>

              <noscript><button type="submit">Save</button></noscript>

            </form>

            <form method="POST" action="/admin/books/{{ b.id }}/notes" class="inline notes-form">

              <textarea name="notes" rows="2" placeholder="notes">{% if let Some(n) = b.notes %}{{ n }}{% endif %}</textarea>

              <button type="submit">Save notes</button>

            </form>

            <form method="POST" action="/admin/books/{{ b.id }}/delete" class="inline">

              <button type="submit" class="danger">Delete</button>

            </form>

          </div>

        </div>

        {% endfor %}

      </div>

      {% endif %}

    </section>

    <p class="hint">API key: {% if api_key_configured %}configured{% else %}not set (write API requires session cookie){% endif %}</p>

    <script>

      async function searchBooks() {

        const q = document.getElementById('book-query').value.trim();

        if (!q) return;

        const btn = document.getElementById('search-btn');

        const status = document.getElementById('search-status');

        const results = document.getElementById('search-results');

        btn.disabled = true;

        btn.textContent = 'Searching...';

        status.style.display = 'none';

        results.innerHTML = '';

        try {

          const resp = await fetch('/admin/search?q=' + encodeURIComponent(q));

          const data = await resp.json();

          if (!resp.ok) {

            status.textContent = data.error || 'Search failed';

            status.className = 'search-status error';

            status.style.display = 'block';

            return;

          }

          if (!data.length) {

            status.textContent = 'No results';

            status.className = 'search-status';

            status.style.display = 'block';

            return;

          }

          data.forEach(function(hit) {

            results.appendChild(renderHit(hit));

          });

        } catch (e) {

          status.textContent = 'Request failed';

          status.className = 'search-status error';

          status.style.display = 'block';

        } finally {

          btn.disabled = false;

          btn.textContent = 'Search';

        }

      }

      function renderHit(hit) {

        const card = document.createElement('form');

        card.method = 'POST';

        card.action = '/admin/add';

        card.className = 'book-card hit';

        const cover = document.createElement('div');

        if (hit.cover_url) {

          const img = document.createElement('img');

          img.src = hit.cover_url;

          img.className = 'book-cover';

          img.loading = 'lazy';

          card.appendChild(img);

        } else {

          cover.className = 'book-cover placeholder';

          card.appendChild(cover);

        }

        const info = document.createElement('div');

        info.className = 'book-info';

        info.innerHTML =

          '<h3 class="book-title"></h3>' +

          '<p class="book-authors"></p>' +

          (hit.isbn ? '<p class="book-meta">ISBN: ' + escapeHtml(hit.isbn) + '</p>' : '');

        info.querySelector('.book-title').textContent = hit.title;

        info.querySelector('.book-authors').textContent = hit.authors;

        const hidden = function(name, value) {

          const el = document.createElement('input');

          el.type = 'hidden';

          el.name = name;

          el.value = value || '';

          return el;

        };

        info.appendChild(hidden('google_id', hit.google_id));

        info.appendChild(hidden('title', hit.title));

        info.appendChild(hidden('authors', hit.authors));

        info.appendChild(hidden('isbn', hit.isbn));

        info.appendChild(hidden('cover_url', hit.cover_url));

        const select = document.createElement('select');

        select.name = 'status';

        ['want', 'reading', 'read'].forEach(function(s) {

          const o = document.createElement('option');

          o.value = s;

          o.textContent = s === 'want' ? 'Want to Read' : s.charAt(0).toUpperCase() + s.slice(1);

          select.appendChild(o);

        });

        info.appendChild(select);

        const btn = document.createElement('button');

        btn.type = 'submit';

        btn.textContent = 'Add';

        info.appendChild(btn);

        card.appendChild(info);

        return card;

      }

      function escapeHtml(s) {

        return String(s || '').replace(/[&<>"']/g, function(c) {

          return ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":"&#39;"})[c];

        });

      }

    </script>

  </body>

</html>

<!doctype html>

<html lang="en">

  <head>

    <meta charset="UTF-8" />

    <meta name="viewport" content="width=device-width, initial-scale=1.0" />

    <meta name="theme-color" content="#121113" />

    <link rel="stylesheet" href="/assets/darkmatter.css" />

    <link rel="stylesheet" href="/static/styles.css" />

    <link rel="apple-touch-icon" sizes="180x180" href="/static/apple-touch-icon.png" />

    <link rel="icon" type="image/png" sizes="32x32" href="/static/favicon-32x32.png" />

    <link rel="icon" type="image/png" sizes="16x16" href="/static/favicon-16x16.png" />

    <link rel="manifest" href="/static/site.webmanifest" />

    <title>Library | {{ tab_label }}</title>

    <meta name="description" content="Personal book tracker" />

    <meta property="og:url" content="{{ base_url }}" />

    <meta property="og:type" content="website" />

    <meta property="og:title" content="Library" />

    <meta property="og:description" content="Personal book tracker" />

    <meta property="og:image" content="{{ base_url }}/static/og.png" />

    <meta name="twitter:card" content="summary_large_image" />

    <meta property="twitter:url" content="{{ base_url }}" />

    <meta name="twitter:title" content="Library" />

    <meta name="twitter:description" content="Personal book tracker" />

    <meta name="twitter:image" content="{{ base_url }}/static/og.png" />

  </head>

  <body>

    <div class="header">

      <a href="/" class="logo"><h1>LIBRARY</h1></a>

      <nav class="links">

        <a href="/admin">add</a>

      </nav>

    </div>

    <nav class="tabs">

      <a href="/read" class="tab{% if tab == "read" %} active{% endif %}">Read <span class="count">{{ counts.read }}</span></a>

      <a href="/reading" class="tab{% if tab == "reading" %} active{% endif %}">Reading <span class="count">{{ counts.reading }}</span></a>

      <a href="/want" class="tab{% if tab == "want" %} active{% endif %}">Want to Read <span class="count">{{ counts.want }}</span></a>

    </nav>

    {% if books.is_empty() %}

    <p class="no-books">No books in {{ tab_label }}.</p>

    {% else %}

    <div class="books-list">

      {% for book in books %}

      <article class="book-card">

        {% if let Some(url) = book.cover_url %}

        <img class="book-cover" src="{{ url }}" alt="" loading="lazy" />

        {% else %}

        <div class="book-cover placeholder"></div>

        {% endif %}

        <div class="book-info">