name = "cellar"

version = "0.1.0"

dependencies = [

 "andromeda-auth",

 "askama 0.15.6",

 "askama_web",

 "axum",

 "base64",

 "dotenvy",

 "nanoid",

 "rand 0.8.5",

 "reqwest 0.12.28",

 "rusqlite",

 "rust-embed",

 "serde",

 "serde_json",

 "subtle",

 "tokio",

 "tracing",

 "tracing-subscriber",

]

[[package]]

    "apps/cellar",

CELLAR_PASSWORD=changeme

CELLAR_DB_PATH=cellar.sqlite

ANTHROPIC_API_KEY=

COOKIE_SECURE=false

HOST=127.0.0.1

PORT=3000

[package]

name = "cellar"

version = "0.1.0"

edition = "2024"

description = "Personal wine tasting log"

license = "MIT"

repository = "https://github.com/stevedylandev/andromeda"

homepage = "https://github.com/stevedylandev/andromeda"

[dependencies]

axum = { workspace = true, features = ["multipart"] }

tokio = { workspace = true }

serde = { workspace = true }

serde_json = { workspace = true }

rusqlite = { workspace = true }

nanoid = { workspace = true }

rust-embed = { workspace = true }

dotenvy = { workspace = true }

subtle = { workspace = true }

rand = { workspace = true }

tracing = { workspace = true }

tracing-subscriber = { workspace = true }

andromeda-auth = { workspace = true }

askama = "0.15"

askama_web = { version = "0.15", features = ["axum-0.8"] }

reqwest = { version = "0.12", features = ["json", "rustls-tls"], default-features = false }

base64 = "0.22"

FROM rust:1-slim-bookworm AS builder

RUN apt-get update && apt-get install -y pkg-config libssl-dev && rm -rf /var/lib/apt/lists/*

WORKDIR /app

# Copy workspace manifests

COPY Cargo.toml Cargo.lock .

COPY crates/auth/Cargo.toml crates/auth/

COPY apps/sipp/Cargo.toml apps/sipp/

COPY apps/feeds/Cargo.toml apps/feeds/

COPY apps/parcels/Cargo.toml apps/parcels/

COPY apps/jotts/Cargo.toml apps/jotts/

COPY apps/og/Cargo.toml apps/og/

COPY apps/shrink/Cargo.toml apps/shrink/

COPY apps/cellar/Cargo.toml apps/cellar/

# Create stubs for dependency caching

RUN mkdir -p crates/auth/src && echo '' > crates/auth/src/lib.rs \

    && for app in sipp feeds parcels jotts og shrink cellar; do \

         mkdir -p apps/$app/src && echo 'fn main() {}' > apps/$app/src/main.rs; \

       done

RUN cargo build --release -p cellar

# Copy real source

COPY crates/auth/src crates/auth/src

COPY apps/cellar/src apps/cellar/src

COPY apps/cellar/static apps/cellar/static

COPY apps/cellar/templates apps/cellar/templates

RUN touch apps/cellar/src/*.rs crates/auth/src/*.rs && cargo build --release -p cellar

FROM debian:bookworm-slim

RUN apt-get update && apt-get install -y ca-certificates && rm -rf /var/lib/apt/lists/*

COPY --from=builder /app/target/release/cellar /usr/local/bin/cellar

WORKDIR /data

EXPOSE 3000

ENV HOST=0.0.0.0

ENV PORT=3000

CMD ["cellar"]

# Cellar

![cover](https://files.stevedylan.dev/cellar-demo.png)

A minimal wine collection tracker

## Quickstart

```bash

git clone https://github.com/stevedylandev/cellar.git

cd cellar

cp .env.example .env

# Edit .env with your password and Anthropic API key

cargo build --release

./target/release/cellar

```

### Environment Variables

| Variable | Description | Default |

|---|---|---|

| `CELLAR_PASSWORD` | Password for login authentication | `changeme` |

| `CELLAR_DB_PATH` | SQLite database file path | `cellar.sqlite` |

| `ANTHROPIC_API_KEY` | Anthropic API key for AI features | |

| `HOST` | Server bind address | `127.0.0.1` |

| `PORT` | Server port | `3000` |

| `COOKIE_SECURE` | Enable HTTPS-only cookies | `false` |

## Overview

A simple, self-hosted wine collection app built with Rust. Here's a few highlights:

- Single Rust binary with embedded assets

- Password authentication with session cookies

- Add, edit, and delete wines from your collection

- AI-powered tasting notes via Claude

- Pentagon visualizations for wine profiles

- Dark themed UI with Commit Mono font

- SQLite for persistent storage

## Structure

```

cellar/

├── src/

│   ├── main.rs        # App entrypoint, env vars, starts server

│   ├── server.rs      # Axum router, HTTP handlers, and templates

│   ├── auth.rs        # Password verification and session management

│   ├── claude.rs      # Anthropic API integration for tasting notes

│   └── db.rs          # SQLite database layer (wines, sessions)

├── templates/         # Askama HTML templates

│   ├── base.html      # Base layout with header and nav

│   ├── login.html     # Login page

│   ├── index.html     # Wine collection list

│   ├── wine.html      # Single wine display

│   ├── wine_form.html # Add/edit wine form

│   └── admin.html     # Admin page

├── static/            # Favicons, og:image, styles, and webmanifest

├── Dockerfile         # Multi-stage build (Rust + Debian slim)

└── docker-compose.yml

```

## Deployment

### Docker (recommended)

```bash

git clone https://github.com/stevedylandev/cellar.git

cd cellar

cp .env.example .env

# Edit .env with your password and Anthropic API key

docker compose up -d

```

This will start Cellar on port `3000` with a persistent volume for the SQLite database.

### Binary

```bash

cargo build --release

```

The resulting binary at `./target/release/cellar` is self-contained with all assets embedded. Copy it to your server with a configured `.env` file and run it directly.

## License

[MIT](LICENSE)

services:

  app:

    build:

      context: ../..

      dockerfile: apps/cellar/Dockerfile

    ports:

      - "${PORT:-3000}:${PORT:-3000}"

    environment:

      - CELLAR_PASSWORD=${CELLAR_PASSWORD:-changeme}

      - CELLAR_DB_PATH=/data/cellar.sqlite

      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY:-}

      - COOKIE_SECURE=false

      - HOST=0.0.0.0

      - PORT=${PORT:-3000}

    volumes:

      - cellar-data:/data

    restart: unless-stopped

volumes:

  cellar-data:

use axum::{

    extract::FromRequestParts,

    http::request::Parts,

    response::{IntoResponse, Redirect, Response},

};

use std::sync::Arc;

use crate::db;

use crate::server::AppState;

pub use andromeda_auth::{

    build_session_cookie, clear_session_cookie, generate_session_token, verify_password,

};

pub struct AuthSession;

impl FromRequestParts<Arc<AppState>> for AuthSession {

    type Rejection = Response;

    async fn from_request_parts(

        parts: &mut Parts,

        state: &Arc<AppState>,

    ) -> Result<Self, Self::Rejection> {

        let token = andromeda_auth::extract_session_cookie(&parts.headers);

        if let Some(token) = token {

            if is_valid_session(state, &token) {

                return Ok(AuthSession);

            }

        }

        Err(Redirect::to("/admin/login").into_response())

    }

}

fn is_valid_session(state: &AppState, token: &str) -> bool {

    match db::get_session_expiry(&state.db, token) {

        Ok(Some(expires_at)) => {

            let now = chrono_now();

            expires_at > now

        }

        _ => false,

    }

}

pub fn chrono_now() -> String {

    use std::time::{SystemTime, UNIX_EPOCH};

    let secs = SystemTime::now()

        .duration_since(UNIX_EPOCH)

        .unwrap()

        .as_secs();

    let days_since_epoch = secs / 86400;

    let time_of_day = secs % 86400;

    let hours = time_of_day / 3600;

    let minutes = (time_of_day % 3600) / 60;

    let seconds = time_of_day % 60;

    let (year, month, day) = days_to_ymd(days_since_epoch as i64);

    format!(

        "{:04}-{:02}-{:02} {:02}:{:02}:{:02}",

        year, month, day, hours, minutes, seconds

    )

}

fn days_to_ymd(mut days: i64) -> (i64, i64, i64) {

    days += 719468;

    let era = if days >= 0 { days } else { days - 146096 } / 146097;

    let doe = (days - era * 146097) as u32;

    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;

    let y = yoe as i64 + era * 400;

    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);

    let mp = (5 * doy + 2) / 153;

    let d = doy - (153 * mp + 2) / 5 + 1;

    let m = if mp < 10 { mp + 3 } else { mp - 9 };

    let y = if m <= 2 { y + 1 } else { y };

    (y, m as i64, d as i64)

}

use base64::Engine;

use base64::engine::general_purpose::STANDARD;

use serde::{Deserialize, Serialize};

#[derive(Serialize)]

struct ClaudeRequest {

    model: String,

    max_tokens: u32,

    messages: Vec<ClaudeMessage>,

}

#[derive(Serialize)]

struct ClaudeMessage {

    role: String,

    content: Vec<ClaudeContent>,

}

#[derive(Serialize)]

#[serde(tag = "type")]

enum ClaudeContent {

    #[serde(rename = "image")]

    Image { source: ImageSource },

    #[serde(rename = "text")]

    Text { text: String },

}

#[derive(Serialize)]

struct ImageSource {

    #[serde(rename = "type")]

    source_type: String,

    media_type: String,

    data: String,

}

#[derive(Deserialize, Serialize)]

pub struct AnalyzeResult {

    pub name: String,

    pub origin: String,

    pub grape: String,

    pub background: String,

}

#[derive(Deserialize)]

struct ClaudeResponse {

    content: Vec<ContentBlock>,

}

#[derive(Deserialize)]

struct ContentBlock {

    text: Option<String>,

}

pub async fn analyze_wine_image(

    api_key: &str,

    image_bytes: &[u8],

    media_type: &str,

) -> Result<AnalyzeResult, String> {

    let encoded = STANDARD.encode(image_bytes);

    let request = ClaudeRequest {

        model: "claude-sonnet-4-20250514".to_string(),

        max_tokens: 1024,

        messages: vec![ClaudeMessage {

            role: "user".to_string(),

            content: vec![

                ClaudeContent::Image {

                    source: ImageSource {

                        source_type: "base64".to_string(),

                        media_type: media_type.to_string(),

                        data: encoded,

                    },

                },

                ClaudeContent::Text {

                    text: "Look at this wine bottle label. Return a JSON object with exactly these fields: {\"name\": \"the full wine name\", \"origin\": \"region and/or country\", \"grape\": \"grape variety or blend\", \"background\": \"brief background about the wine and the winery, including any notable history or interesting facts\"}. If you cannot determine a field, use an empty string. Respond with ONLY the JSON, no other text.".to_string(),

                },

            ],

        }],

    };

    let client = reqwest::Client::new();

    let response = client

        .post("https://api.anthropic.com/v1/messages")

        .header("x-api-key", api_key)

        .header("anthropic-version", "2023-06-01")

        .header("content-type", "application/json")

        .json(&request)

        .send()

        .await

        .map_err(|e| format!("Request failed: {}", e))?;

    if !response.status().is_success() {

        let status = response.status();

        let body = response.text().await.unwrap_or_default();

        return Err(format!("API error {}: {}", status, body));

    }

    let claude_response: ClaudeResponse = response

        .json()

        .await

        .map_err(|e| format!("Failed to parse response: {}", e))?;

    let text = claude_response

        .content

        .iter()

        .find_map(|block| block.text.as_ref())

        .ok_or_else(|| "No text in response".to_string())?;

    let text = text.trim();

    let json_str = if let Some(start) = text.find('{') {

        if let Some(end) = text.rfind('}') {

            &text[start..=end]

        } else {

            text

        }

    } else {

        text

    };

    serde_json::from_str(json_str).map_err(|e| format!("Failed to parse JSON: {} (raw: {})", e, text))

}

use nanoid::nanoid;

use rusqlite::{Connection, params};

use serde::{Deserialize, Serialize};

use std::fmt;

use std::sync::{Arc, Mutex};

pub type Db = Arc<Mutex<Connection>>;

#[derive(Debug)]

pub enum DbError {

    Sqlite(rusqlite::Error),

    LockPoisoned,

}

impl fmt::Display for DbError {

    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {

        match self {

            DbError::Sqlite(e) => write!(f, "Database error: {}", e),

            DbError::LockPoisoned => write!(f, "Database lock poisoned"),

        }

    }

}

impl std::error::Error for DbError {}

impl From<rusqlite::Error> for DbError {

    fn from(e: rusqlite::Error) -> Self {

        DbError::Sqlite(e)

    }

}

#[derive(Debug, Serialize, Deserialize, Clone)]

pub struct Wine {

    pub id: i64,

    pub short_id: String,

    pub name: String,

    pub origin: String,

    pub grape: String,

    pub notes: String,

    pub has_image: bool,

    pub image_mime: Option<String>,

    pub sweetness: i32,

    pub acidity: i32,

    pub tannin: i32,

    pub alcohol: i32,

    pub body: i32,

    pub background: String,

    pub created_at: String,

}

pub fn init_db() -> Db {

    let path = std::env::var("CELLAR_DB_PATH").unwrap_or_else(|_| "cellar.sqlite".to_string());

    let conn = Connection::open(&path).expect("Failed to open database");

    conn.execute_batch(

        "CREATE TABLE IF NOT EXISTS wines (

            id         INTEGER PRIMARY KEY AUTOINCREMENT,

            short_id   TEXT NOT NULL UNIQUE,

            name       TEXT NOT NULL,

            origin     TEXT NOT NULL,

            grape      TEXT NOT NULL,

            notes      TEXT NOT NULL,

            image      BLOB,

            image_mime TEXT,

            sweetness  INTEGER NOT NULL CHECK(sweetness BETWEEN 1 AND 5),

            acidity    INTEGER NOT NULL CHECK(acidity BETWEEN 1 AND 5),

            tannin     INTEGER NOT NULL CHECK(tannin BETWEEN 1 AND 5),

            alcohol    INTEGER NOT NULL CHECK(alcohol BETWEEN 1 AND 5),

            body       INTEGER NOT NULL CHECK(body BETWEEN 1 AND 5),

            created_at TEXT NOT NULL DEFAULT (datetime('now'))

        );

        CREATE TABLE IF NOT EXISTS sessions (

            id         INTEGER PRIMARY KEY AUTOINCREMENT,

            token      TEXT NOT NULL UNIQUE,

            expires_at TEXT NOT NULL

        );"

    )

    .expect("Failed to create tables");

    // Migration: add background column if it doesn't exist

    let _ = conn.execute("ALTER TABLE wines ADD COLUMN background TEXT NOT NULL DEFAULT ''", []);

    Arc::new(Mutex::new(conn))

}

fn wine_from_row(row: &rusqlite::Row) -> rusqlite::Result<Wine> {

    Ok(Wine {

        id: row.get(0)?,

        short_id: row.get(1)?,

        name: row.get(2)?,

        origin: row.get(3)?,

        grape: row.get(4)?,

        notes: row.get(5)?,

        has_image: row.get(6)?,

        image_mime: row.get(7)?,

        sweetness: row.get(8)?,

        acidity: row.get(9)?,

        tannin: row.get(10)?,

        alcohol: row.get(11)?,

        body: row.get(12)?,

        background: row.get(13)?,

        created_at: row.get(14)?,

    })

}

const WINE_COLUMNS: &str =

    "id, short_id, name, origin, grape, notes, (image IS NOT NULL) AS has_image, image_mime, sweetness, acidity, tannin, alcohol, body, background, created_at";

pub fn create_wine(

    db: &Db,

    name: &str,

    origin: &str,

    grape: &str,

    notes: &str,

    image: Option<&[u8]>,

    image_mime: Option<&str>,

    sweetness: i32,

    acidity: i32,

    tannin: i32,

    alcohol: i32,

    body: i32,

    background: &str,

) -> Result<Wine, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let short_id = nanoid!(10);

    conn.execute(

        "INSERT INTO wines (short_id, name, origin, grape, notes, image, image_mime, sweetness, acidity, tannin, alcohol, body, background)

         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, ?13)",

        params![short_id, name, origin, grape, notes, image, image_mime, sweetness, acidity, tannin, alcohol, body, background],

    )?;

    let id = conn.last_insert_rowid();

    let wine = conn.query_row(

        &format!("SELECT {} FROM wines WHERE id = ?1", WINE_COLUMNS),

        params![id],

        wine_from_row,

    )?;

    Ok(wine)

}

pub fn get_all_wines(db: &Db) -> Result<Vec<Wine>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let mut stmt = conn.prepare(&format!(

        "SELECT {} FROM wines ORDER BY id DESC",

        WINE_COLUMNS

    ))?;

    let wines = stmt

        .query_map([], wine_from_row)?

        .collect::<Result<Vec<_>, _>>()?;

    Ok(wines)

}

pub fn get_wine_by_short_id(db: &Db, short_id: &str) -> Result<Option<Wine>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        &format!(

            "SELECT {} FROM wines WHERE short_id = ?1",

            WINE_COLUMNS

        ),

        params![short_id],

        wine_from_row,

    ) {

        Ok(wine) => Ok(Some(wine)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn get_wine_image(db: &Db, short_id: &str) -> Result<Option<(Vec<u8>, String)>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        "SELECT image, image_mime FROM wines WHERE short_id = ?1 AND image IS NOT NULL",

        params![short_id],

        |row| {

            let image: Vec<u8> = row.get(0)?;

            let mime: String = row.get(1)?;

            Ok((image, mime))

        },

    ) {

        Ok(result) => Ok(Some(result)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn update_wine(

    db: &Db,

    short_id: &str,

    name: &str,

    origin: &str,

    grape: &str,

    notes: &str,

    sweetness: i32,

    acidity: i32,

    tannin: i32,

    alcohol: i32,

    body: i32,

    background: &str,

) -> Result<Option<Wine>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute(

        "UPDATE wines SET name = ?1, origin = ?2, grape = ?3, notes = ?4, sweetness = ?5, acidity = ?6, tannin = ?7, alcohol = ?8, body = ?9, background = ?10 WHERE short_id = ?11",

        params![name, origin, grape, notes, sweetness, acidity, tannin, alcohol, body, background, short_id],

    )?;

    if rows == 0 {

        return Ok(None);

    }

    match conn.query_row(

        &format!(

            "SELECT {} FROM wines WHERE short_id = ?1",

            WINE_COLUMNS

        ),

        params![short_id],

        wine_from_row,

    ) {

        Ok(wine) => Ok(Some(wine)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn update_wine_image(

    db: &Db,

    short_id: &str,

    image: &[u8],

    mime: &str,

) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute(

        "UPDATE wines SET image = ?1, image_mime = ?2 WHERE short_id = ?3",

        params![image, mime, short_id],

    )?;

    Ok(rows > 0)

}

pub fn delete_wine(db: &Db, short_id: &str) -> Result<bool, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    let rows = conn.execute(

        "DELETE FROM wines WHERE short_id = ?1",

        params![short_id],

    )?;

    Ok(rows > 0)

}

// Session functions

pub fn insert_session(db: &Db, token: &str, expires_at: &str) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "INSERT INTO sessions (token, expires_at) VALUES (?1, ?2)",

        params![token, expires_at],

    )?;

    Ok(())

}

pub fn get_session_expiry(db: &Db, token: &str) -> Result<Option<String>, DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    match conn.query_row(

        "SELECT expires_at FROM sessions WHERE token = ?1",

        params![token],

        |row| row.get(0),

    ) {

        Ok(val) => Ok(Some(val)),

        Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),

        Err(e) => Err(DbError::Sqlite(e)),

    }

}

pub fn delete_session(db: &Db, token: &str) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute("DELETE FROM sessions WHERE token = ?1", params![token])?;

    Ok(())

}

pub fn prune_expired_sessions(db: &Db) -> Result<(), DbError> {

    let conn = db.lock().map_err(|_| DbError::LockPoisoned)?;

    conn.execute(

        "DELETE FROM sessions WHERE expires_at < datetime('now')",

        [],

    )?;

    Ok(())

}

mod auth;

mod claude;

mod db;

mod server;

#[tokio::main]

async fn main() {

    tracing_subscriber::fmt::init();

    let host = std::env::var("HOST").unwrap_or_else(|_| "127.0.0.1".to_string());

    let port: u16 = std::env::var("PORT")

        .ok()

        .and_then(|v| v.parse().ok())

        .unwrap_or(3000);

    server::run(host, port).await;

}

use askama::Template;

use askama_web::WebTemplate;

use axum::{

    extract::{DefaultBodyLimit, Multipart, Path, Query, State},

    http::{HeaderValue, StatusCode},

    response::{Html, IntoResponse, Json, Redirect, Response},

    routing::{get, post},

    Router,

};

use rust_embed::Embed;

use std::sync::Arc;

use crate::auth;

use crate::claude;

use crate::db::{self, Db, Wine};

#[derive(Clone)]

pub struct AppState {

    pub db: Db,

    pub app_password: String,

    pub cookie_secure: bool,

    pub anthropic_api_key: Option<String>,

}

#[derive(Embed)]

#[folder = "static/"]

struct Static;

// --- Templates ---

#[derive(Template)]

#[template(path = "base.html")]

struct BaseTemplate;

#[derive(Template)]

#[template(path = "login.html")]

struct LoginTemplate {

    error: Option<String>,

}

struct WineWithSvg {

    wine: Wine,

    pentagon_svg: String,

}

#[derive(Template)]

#[template(path = "index.html")]

struct IndexTemplate {

    wines: Vec<WineWithSvg>,

}

#[derive(Template)]

#[template(path = "wine.html")]

struct WineDetailTemplate {

    wine: Wine,

    pentagon_svg: String,

}

#[derive(Template)]

#[template(path = "admin.html")]

struct AdminTemplate {

    wines: Vec<Wine>,

}

#[derive(Template)]

#[template(path = "wine_form.html")]

struct WineFormTemplate {

    wine: Option<Wine>,

    error: Option<String>,

    has_anthropic_key: bool,

}

// --- Query/Form structs ---

#[derive(serde::Deserialize, Default)]

pub struct FlashQuery {

    pub error: Option<String>,

}

#[derive(serde::Deserialize)]

struct LoginForm {

    password: String,

}

// --- Static file handlers ---

fn mime_from_path(path: &str) -> &'static str {

    match path.rsplit('.').next().unwrap_or("") {

        "css" => "text/css",

        "js" => "application/javascript",

        "html" => "text/html",

        "png" => "image/png",

        "jpg" | "jpeg" => "image/jpeg",

        "ico" => "image/x-icon",

        "svg" => "image/svg+xml",

        "woff" | "woff2" => "font/woff2",

        "ttf" => "font/ttf",

        "otf" => "font/otf",

        "json" | "webmanifest" => "application/json",

        _ => "application/octet-stream",

    }

}

async fn serve_static(Path(path): Path<String>) -> Response {

    match Static::get(&path) {

        Some(file) => {

            let mime = mime_from_path(&path);

            (

                StatusCode::OK,

                [(axum::http::header::CONTENT_TYPE, HeaderValue::from_static(mime))],

                file.data.to_vec(),

            )

                .into_response()

        }

        None => StatusCode::NOT_FOUND.into_response(),

    }

}

// --- Pentagon SVG ---

fn build_pentagon_svg(

    sweetness: i32,

    acidity: i32,

    tannin: i32,

    alcohol: i32,

    body: i32,

    size: f64,

    show_labels: bool,

) -> String {

    let cx = size / 2.0;

    let cy = size / 2.0;

    let margin = if show_labels { 30.0 } else { 5.0 };

    let r = size / 2.0 - margin;

    let scores = [sweetness, acidity, tannin, alcohol, body];

    let labels = ["Sweetness", "Acidity", "Tannin", "Alcohol", "Body"];

    let angles: Vec<f64> = (0..5)

        .map(|i| (-90.0_f64 + 72.0 * i as f64).to_radians())

        .collect();

    let mut svg = format!(

        r#"<svg viewBox="0 0 {s} {s}" width="{s}" height="{s}" xmlns="http://www.w3.org/2000/svg">"#,

        s = size

    );

    // Grid pentagons at 20%, 40%, 60%, 80%

    for pct in &[0.2, 0.4, 0.6, 0.8] {

        let points: String = angles

            .iter()

            .map(|a| format!("{:.1},{:.1}", cx + r * pct * a.cos(), cy + r * pct * a.sin()))

            .collect::<Vec<_>>()

            .join(" ");

        svg.push_str(&format!(

            r#"<polygon points="{}" fill="none" stroke="white" stroke-opacity="0.12" stroke-width="0.75"/>"#,

            points

        ));

    }

    // Outer pentagon (100%)

    let outline: String = angles

        .iter()

        .map(|a| format!("{:.1},{:.1}", cx + r * a.cos(), cy + r * a.sin()))

        .collect::<Vec<_>>()

        .join(" ");

    svg.push_str(&format!(

        r#"<polygon points="{}" fill="none" stroke="white" stroke-opacity="0.25" stroke-width="1"/>"#,

        outline

    ));

    // Axis lines from center to each vertex

    for a in &angles {

        svg.push_str(&format!(

            r#"<line x1="{:.1}" y1="{:.1}" x2="{:.1}" y2="{:.1}" stroke="white" stroke-opacity="0.12" stroke-width="0.75"/>"#,

            cx, cy, cx + r * a.cos(), cy + r * a.sin()

        ));

    }

    // Data polygon

    let data_points: Vec<(f64, f64)> = scores

        .iter()

        .zip(&angles)

        .map(|(s, a)| {

            let d = (*s as f64 / 5.0) * r;

            (cx + d * a.cos(), cy + d * a.sin())

        })

        .collect();

    let data_str: String = data_points

        .iter()

        .map(|(x, y)| format!("{:.1},{:.1}", x, y))

        .collect::<Vec<_>>()

        .join(" ");

    svg.push_str(&format!(

        r#"<polygon points="{}" fill="white" fill-opacity="0.08" stroke="white" stroke-width="1.5"/>"#,

        data_str

    ));

    // Data dots

    for (x, y) in &data_points {

        svg.push_str(&format!(

            r#"<circle cx="{:.1}" cy="{:.1}" r="2.5" fill="white"/>"#,

            x, y

        ));

    }

    // Labels

    if show_labels {

        for (i, label) in labels.iter().enumerate() {

            let a = angles[i];

            let label_dist = r + 18.0;

            let lx = cx + label_dist * a.cos();

            let ly = cy + label_dist * a.sin() + 3.5;

            svg.push_str(&format!(

                r#"<text x="{:.1}" y="{:.1}" fill="white" fill-opacity="0.5" font-size="9" font-family="Commit Mono, monospace" text-anchor="middle">{}</text>"#,

                lx, ly, label

            ));

        }

    }

    svg.push_str("</svg>");

    svg

}

// --- Auth handlers ---

async fn get_login(Query(q): Query<FlashQuery>) -> Response {

    WebTemplate(LoginTemplate { error: q.error }).into_response()

}

async fn post_login(

    State(state): State<Arc<AppState>>,

    axum::extract::Form(form): axum::extract::Form<LoginForm>,

) -> Response {

    if !auth::verify_password(&form.password, &state.app_password) {

        return Redirect::to("/admin/login?error=Invalid+password").into_response();

    }

    let token = auth::generate_session_token();

    let expires_at = {

        use std::time::{SystemTime, UNIX_EPOCH};

        let secs = SystemTime::now()

            .duration_since(UNIX_EPOCH)

            .unwrap()

            .as_secs()

            + 7 * 24 * 3600;

        let days = secs / 86400;

        let tod = secs % 86400;

        let (y, m, d) = days_to_ymd(days as i64);

        format!(

            "{:04}-{:02}-{:02} {:02}:{:02}:{:02}",

            y,

            m,

            d,

            tod / 3600,

            (tod % 3600) / 60,

            tod % 60

        )

    };

    if let Err(e) = db::insert_session(&state.db, &token, &expires_at) {

        tracing::error!("Failed to create session: {}", e);

        return Redirect::to("/admin/login?error=Server+error").into_response();

    }

    let _ = db::prune_expired_sessions(&state.db);

    let cookie = auth::build_session_cookie(&token, state.cookie_secure);

    let mut resp = Redirect::to("/admin").into_response();

    resp.headers_mut().insert(

        axum::http::header::SET_COOKIE,

        HeaderValue::from_str(&cookie).unwrap(),

    );

    resp

}

async fn get_logout(State(state): State<Arc<AppState>>, headers: axum::http::HeaderMap) -> Response {

    if let Some(cookie_header) = headers.get("cookie").and_then(|v| v.to_str().ok()) {

        for part in cookie_header.split(';') {

            let part = part.trim();

            if let Some(val) = part.strip_prefix("session=") {

                let val = val.trim();

                if !val.is_empty() {

                    let _ = db::delete_session(&state.db, val);

                }

            }

        }

    }

    let cookie = auth::clear_session_cookie();

    let mut resp = Redirect::to("/admin/login").into_response();

    resp.headers_mut().insert(

        axum::http::header::SET_COOKIE,

        HeaderValue::from_str(&cookie).unwrap(),

    );

    resp

}

// --- Public handlers ---

async fn get_index(State(state): State<Arc<AppState>>) -> Response {

    match db::get_all_wines(&state.db) {

        Ok(wines) => {

            let wines: Vec<WineWithSvg> = wines

                .into_iter()

                .map(|wine| {

                    let pentagon_svg = build_pentagon_svg(

                        wine.sweetness,

                        wine.acidity,

                        wine.tannin,

                        wine.alcohol,

                        wine.body,

                        80.0,

                        false,

                    );

                    WineWithSvg { wine, pentagon_svg }

                })

                .collect();

            WebTemplate(IndexTemplate { wines }).into_response()

        }

        Err(e) => {

            tracing::error!("Failed to list wines: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn get_wine_detail(

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

) -> Response {

    match db::get_wine_by_short_id(&state.db, &short_id) {

        Ok(Some(wine)) => {

            let pentagon_svg = build_pentagon_svg(

                wine.sweetness,

                wine.acidity,

                wine.tannin,

                wine.alcohol,

                wine.body,

                250.0,

                true,

            );

            WebTemplate(WineDetailTemplate { wine, pentagon_svg }).into_response()

        }

        Ok(None) => (StatusCode::NOT_FOUND, Html("Wine not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to get wine: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn get_wine_image(

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

) -> Response {

    match db::get_wine_image(&state.db, &short_id) {

        Ok(Some((bytes, mime))) => {

            let content_type = HeaderValue::from_str(&mime).unwrap_or_else(|_| {

                HeaderValue::from_static("application/octet-stream")

            });

            (

                StatusCode::OK,

                [(axum::http::header::CONTENT_TYPE, content_type)],

                bytes,

            )

                .into_response()

        }

        Ok(None) => StatusCode::NOT_FOUND.into_response(),

        Err(e) => {

            tracing::error!("Failed to get wine image: {}", e);

            StatusCode::INTERNAL_SERVER_ERROR.into_response()

        }

    }

}

// --- Admin handlers ---

async fn get_admin(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

) -> Response {

    match db::get_all_wines(&state.db) {

        Ok(wines) => WebTemplate(AdminTemplate { wines }).into_response(),

        Err(e) => {

            tracing::error!("Failed to list wines: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

async fn get_new_wine(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Query(q): Query<FlashQuery>,

) -> Response {

    WebTemplate(WineFormTemplate {

        wine: None,

        error: q.error,

        has_anthropic_key: state.anthropic_api_key.is_some(),

    })

    .into_response()

}

async fn get_edit_wine(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

    Query(q): Query<FlashQuery>,

) -> Response {

    match db::get_wine_by_short_id(&state.db, &short_id) {

        Ok(Some(wine)) => WebTemplate(WineFormTemplate {

            wine: Some(wine),

            error: q.error,

            has_anthropic_key: state.anthropic_api_key.is_some(),

        })

        .into_response(),

        Ok(None) => (StatusCode::NOT_FOUND, Html("Wine not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to get wine: {}", e);

            (StatusCode::INTERNAL_SERVER_ERROR, Html("Server error".to_string())).into_response()

        }

    }

}

// --- Multipart parsing ---

struct WineFormData {

    name: String,

    origin: String,

    grape: String,

    notes: String,

    background: String,

    image: Option<Vec<u8>>,

    image_mime: Option<String>,

    sweetness: i32,

    acidity: i32,

    tannin: i32,

    alcohol: i32,

    body: i32,

}

async fn parse_wine_multipart(mut multipart: Multipart) -> Result<WineFormData, String> {

    let mut name = String::new();

    let mut origin = String::new();

    let mut grape = String::new();

    let mut notes = String::new();

    let mut background = String::new();

    let mut image: Option<Vec<u8>> = None;

    let mut image_mime: Option<String> = None;

    let mut sweetness = 3;

    let mut acidity = 3;

    let mut tannin = 3;

    let mut alcohol = 3;

    let mut body = 3;

    while let Ok(Some(field)) = multipart.next_field().await {

        let field_name = field.name().unwrap_or("").to_string();

        match field_name.as_str() {

            "image" => {

                let content_type = field.content_type().unwrap_or("application/octet-stream").to_string();

                let bytes = field.bytes().await.map_err(|e| format!("Failed to read image: {}", e))?;

                if !bytes.is_empty() {

                    image = Some(bytes.to_vec());

                    image_mime = Some(content_type);

                }

            }

            "name" => name = field.text().await.unwrap_or_default(),

            "origin" => origin = field.text().await.unwrap_or_default(),

            "grape" => grape = field.text().await.unwrap_or_default(),

            "notes" => notes = field.text().await.unwrap_or_default(),

            "background" => background = field.text().await.unwrap_or_default(),

            "sweetness" => sweetness = field.text().await.unwrap_or_default().parse().unwrap_or(3),

            "acidity" => acidity = field.text().await.unwrap_or_default().parse().unwrap_or(3),

            "tannin" => tannin = field.text().await.unwrap_or_default().parse().unwrap_or(3),

            "alcohol" => alcohol = field.text().await.unwrap_or_default().parse().unwrap_or(3),

            "body" => body = field.text().await.unwrap_or_default().parse().unwrap_or(3),

            _ => {}

        }

    }

    if name.trim().is_empty() {

        return Err("Name is required".to_string());

    }

    // Clamp scores to 1-5

    let clamp = |v: i32| v.max(1).min(5);

    Ok(WineFormData {

        name: name.trim().to_string(),

        origin: origin.trim().to_string(),

        grape: grape.trim().to_string(),

        notes: notes.trim().to_string(),

        background: background.trim().to_string(),

        image,

        image_mime,

        sweetness: clamp(sweetness),

        acidity: clamp(acidity),

        tannin: clamp(tannin),

        alcohol: clamp(alcohol),

        body: clamp(body),

    })

}

async fn post_new_wine(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    multipart: Multipart,

) -> Response {

    let data = match parse_wine_multipart(multipart).await {

        Ok(data) => data,

        Err(e) => {

            return Redirect::to(&format!("/admin/new?error={}", urlencoded(&e))).into_response();

        }

    };

    match db::create_wine(

        &state.db,

        &data.name,

        &data.origin,

        &data.grape,

        &data.notes,

        data.image.as_deref(),

        data.image_mime.as_deref(),

        data.sweetness,

        data.acidity,

        data.tannin,

        data.alcohol,

        data.body,

        &data.background,

    ) {

        Ok(wine) => Redirect::to(&format!("/wines/{}", wine.short_id)).into_response(),

        Err(e) => {

            tracing::error!("Failed to create wine: {}", e);

            Redirect::to("/admin/new?error=Failed+to+create+wine").into_response()

        }

    }

}

async fn post_edit_wine(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

    multipart: Multipart,

) -> Response {

    let data = match parse_wine_multipart(multipart).await {

        Ok(data) => data,

        Err(e) => {

            return Redirect::to(&format!("/admin/edit/{}?error={}", short_id, urlencoded(&e)))

                .into_response();

        }

    };

    match db::update_wine(

        &state.db,

        &short_id,

        &data.name,

        &data.origin,

        &data.grape,

        &data.notes,

        data.sweetness,

        data.acidity,

        data.tannin,

        data.alcohol,

        data.body,

        &data.background,

    ) {

        Ok(Some(_)) => {

            if let Some(image) = &data.image {

                if let Some(mime) = &data.image_mime {

                    if let Err(e) = db::update_wine_image(&state.db, &short_id, image, mime) {

                        tracing::error!("Failed to update wine image: {}", e);

                    }

                }

            }

            Redirect::to(&format!("/wines/{}", short_id)).into_response()

        }

        Ok(None) => (StatusCode::NOT_FOUND, Html("Wine not found".to_string())).into_response(),

        Err(e) => {

            tracing::error!("Failed to update wine: {}", e);

            Redirect::to(&format!(

                "/admin/edit/{}?error=Failed+to+update+wine",

                short_id

            ))

            .into_response()

        }

    }

}

async fn post_delete_wine(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    Path(short_id): Path<String>,

) -> Response {

    match db::delete_wine(&state.db, &short_id) {

        Ok(_) => Redirect::to("/admin").into_response(),

        Err(e) => {

            tracing::error!("Failed to delete wine: {}", e);

            Redirect::to("/admin").into_response()

        }

    }

}

// --- Claude vision handler ---

async fn post_analyze_image(

    _session: auth::AuthSession,

    State(state): State<Arc<AppState>>,

    mut multipart: Multipart,