Merge pull request #2 from EmmaTheMartian/feature/search

feature/search

doc/resources.md

···
 ## database design
 
 - https://stackoverflow.com/questions/59505855/liked-posts-design-specifics
+
+## sql
+
+- https://stackoverflow.com/questions/11144394/order-sql-by-strongest-like

doc/todo.md

···
 
 ## in-progress
 
-- [ ] post:embedded links (links added to a post will be embedded into the post
-as images, music links, etc)
-	- should have special handling for spotify, apple music, youtube,
-	discord, and other common links. we want those ones to look fancy!
+- [x] post:search for posts
+	- [ ] filters:
+		```
+		created-at:<date>
+		created-after:<date>
+		created-before:<date>
+		is:pinned
+		has-tag:<tag>
+		posted-by:<user>
+		!excluded-query
+		```
+- [x] user:search for users
+	- [ ] filters:
+		```
+		created-at:<date>
+		created-after:<date>
+		created-before:<date>
+		is:admin
+		```
 
 ## planing
 
···
 > however, i will not be fixing it, because it is funny.
 
 - [ ] post:saving (add the post to a list of saved posts that a user can view later)
-- [ ] post:search for posts
-- [ ] user:search for users
+- [ ] post:add more embedded link handling! (discord, github, gitlab, codeberg, etc)
 - [ ] user:follow other users (send notifications on new posts)
 
 ## ideas
···
 - [x] post:editing
 - [x] post:replies
 - [x] post:tags ('hashtags')
+- [x] post:embedded links (links added to a post will be embedded into the post
+as images, music links, etc)
+	- should have special handling for spotify, apple music, youtube,
+	discord, and other common links. we want those ones to look fancy!
 - [x] site:message of the day (admins can add a welcome message displayed on index.html)
 
 ## graveyard

src/database/database.v

···
 module database
 
 import db.pg
+import entity { User, Post }
 
 // DatabaseAccess handles all interactions with the database.
 pub struct DatabaseAccess {
 pub mut:
 	db pg.DB
 }
+
+// get_unknown_user returns a user representing an unknown user
+pub fn (app &DatabaseAccess) get_unknown_user() User {
+	return User{
+		username: 'unknown'
+	}
+}
+
+// get_unknown_post returns a post representing an unknown post
+pub fn (app &DatabaseAccess) get_unknown_post() Post {
+	return Post{
+		title: 'unknown'
+	}
+}

src/database/like.v

···
 
 import entity { Like, LikeCache }
 
+// add_like adds a like to the database, returns true if this succeeds and false
+// otherwise.
+pub fn (app &DatabaseAccess) add_like(like &Like) bool {
+	sql app.db {
+		insert like into Like
+		// yeet the old cached like value
+		delete from LikeCache where post_id == like.post_id
+	} or {
+		return false
+	}
+	return true
+}
+
 // get_net_likes_for_post returns the net likes of the given post.
 pub fn (app &DatabaseAccess) get_net_likes_for_post(post_id int) int {
 	// check cache
···
 
 	return likes
 }
+
+// unlike_post removes a (dis)like from the given post, returns true if this
+// succeeds and false otherwise.
+pub fn (app &DatabaseAccess) unlike_post(post_id int, user_id int) bool {
+	sql app.db {
+		delete from Like where user_id == user_id && post_id == post_id
+		// yeet the old cached like value
+		delete from LikeCache where post_id == post_id
+	} or {
+		return false
+	}
+	return true
+}

src/database/notification.v

···
 
 import entity { Notification }
 
+// get_notification_by_id gets a notification by its given id, returns none if
+// the notification does not exist.
+pub fn (app &DatabaseAccess) get_notification_by_id(id int) ?Notification {
+	notifications := sql app.db {
+		select from Notification where id == id
+	} or { [] }
+	if notifications.len != 1 {
+		return none
+	}
+	return notifications[0]
+}
+
+// delete_notification deletes the given notification, returns true if this
+// succeeded and false otherwise.
+pub fn (app &DatabaseAccess) delete_notification(id int) bool {
+	sql app.db {
+		delete from Notification where id == id
+	} or {
+		return false
+	}
+	return true
+}
+
+// delete_notifications_for_user deletes all notifications for the given user,
+// returns true if this succeeded and false otherwise.
+pub fn (app &DatabaseAccess) delete_notifications_for_user(user_id int) bool {
+	sql app.db {
+		delete from Notification where user_id == user_id
+	} or {
+		return false
+	}
+	return true
+}
+
 // get_notifications_for gets a list of notifications for the given user.
 pub fn (app &DatabaseAccess) get_notifications_for(user_id int) []Notification {
 	notifications := sql app.db {

src/database/post.v

···
 module database
 
 import time
-import entity { Post, Like, LikeCache }
+import entity { Post, User, Like, LikeCache }
+
+// add_post adds a new post to the database, returns true if this succeeded and
+// false otherwise.
+pub fn (app &DatabaseAccess) add_post(post &Post) bool {
+	sql app.db {
+		insert post into Post
+	} or {
+		return false
+	}
+	return true
+}
 
 // get_post_by_id gets a post by its id, returns none if it does not exist.
 pub fn (app &DatabaseAccess) get_post_by_id(id int) ?Post {
···
 	} or { [] }
 	return posts
 }
+
+// pin_post pins the given post, returns true if this succeeds and false
+// otherwise.
+pub fn (app &DatabaseAccess) pin_post(post_id int) bool {
+	sql app.db {
+		update Post set pinned = true where id == post_id
+	} or {
+		return false
+	}
+	return true
+}
+
+// update_post updates the given post's title and body with the given title and
+// body, returns true if this succeeds and false otherwise.
+pub fn (app &DatabaseAccess) update_post(post_id int, new_title string, new_body string) bool {
+	sql app.db {
+		update Post set body = new_body, title = new_title where id == post_id
+	} or {
+		return false
+	}
+	return true
+}
+
+// delete_post deletes the given post and all likes associated with it, returns
+// true if this succeeds and false otherwise.
+pub fn (app &DatabaseAccess) delete_post(id int) bool {
+	sql app.db {
+		delete from Post where id == id
+		delete from Like where post_id == id
+		delete from LikeCache where post_id == id
+	} or {
+		return false
+	}
+	return true
+}
+
+////// searching //////
+
+// PostSearchResult represents a search result for a post.
+pub struct PostSearchResult {
+pub mut:
+	post   Post
+	author User
+}
+
+@[inline]
+pub fn PostSearchResult.from_post(app &DatabaseAccess, post &Post) PostSearchResult {
+	return PostSearchResult{
+		post: post
+		author: app.get_user_by_id(post.author_id) or { app.get_unknown_user() }
+	}
+}
+
+@[inline]
+pub fn PostSearchResult.from_post_list(app &DatabaseAccess, posts []Post) []PostSearchResult {
+	mut results := []PostSearchResult{
+		cap: posts.len,
+		len: posts.len
+	}
+	for index, post in posts {
+		results[index] = PostSearchResult.from_post(app, post)
+	}
+	return results
+}
+
+// search_for_posts searches for posts matching the given query.
+// todo: query options/filters, such as user:beep, !excluded-text, etc
+pub fn (app &DatabaseAccess) search_for_posts(query string, limit int, offset int) []PostSearchResult {
+	sql_query := "\
+	SELECT *, CASE
+		WHEN title LIKE '%${query}%' THEN 1
+		WHEN body LIKE '%${query}%' THEN 2
+		END AS priority
+	FROM \"Post\"
+	WHERE title LIKE '%${query}%' OR body LIKE '%${query}%'
+	ORDER BY priority ASC LIMIT ${limit} OFFSET ${offset}"
+
+	queried_posts := app.db.q_strings(sql_query) or {
+		eprintln('search_for_posts error in app.db.q_strings: ${err}')
+		[]
+	}
+
+	posts := queried_posts.map(|it| Post.from_row(it))
+	return PostSearchResult.from_post_list(app, posts)
+}

src/database/site.v

···
 	}
 	return configs[0]
 }
+
+// set_motd sets the site's current message of the day, returns true if this
+// succeeds and false otherwise.
+pub fn (app &DatabaseAccess) set_motd(motd string) bool {
+	sql app.db {
+		update Site set motd = motd where id == 1
+	} or {
+		return false
+	}
+	return true
+}

src/database/user.v

···
 module database
 
-import entity { User, Notification, Like, Post }
+import entity { User, Notification, Like, LikeCache, Post }
 
 // new_user creates a new user and returns their struct after creation.
 pub fn (app &DatabaseAccess) new_user(user User) ?User {
···
 	}
 	return likes.len == 1
 }
+
+// delete_user deletes the given user and their data, returns true if this
+// succeeded and false otherwise.
+pub fn (app &DatabaseAccess) delete_user(user_id int) bool {
+	sql app.db {
+		delete from User where id == user_id
+		delete from Like where user_id == user_id
+		delete from Notification where user_id == user_id
+	} or {
+		return false
+	}
+
+	// delete posts and their likes
+	posts_from_this_user := sql app.db {
+		select from Post where author_id == user_id
+	} or { [] }
+
+	for post in posts_from_this_user {
+		sql app.db {
+			delete from Like where post_id == post.id
+			delete from LikeCache where post_id == post.id
+		} or {
+			eprintln('failed to delete like cache for post during user deletion: ${post.id}')
+		}
+	}
+
+	sql app.db {
+		delete from Post where author_id == user_id
+	} or {
+		eprintln('failed to delete posts by deleting user: ${user_id}')
+	}
+
+	return true
+}
+
+// search_for_users searches for posts matching the given query.
+// todo: query options/filters, such as created-after:<date>, created-before:<date>, etc
+pub fn (app &DatabaseAccess) search_for_users(query string, limit int, offset int) []User {
+	sql_query := "\
+	SELECT *, CASE
+		WHEN username LIKE '%${query}%' THEN 1
+		WHEN nickname LIKE '%${query}%' THEN 2
+		END AS priority
+	FROM \"User\"
+	WHERE username LIKE '%${query}%' OR nickname LIKE '%${query}%'
+	ORDER BY priority ASC LIMIT ${limit} OFFSET ${offset}"
+
+	queried_users := app.db.q_strings(sql_query) or {
+		eprintln('search_for_users error in app.db.q_strings: ${err}')
+		[]
+	}
+
+	users := queried_users.map(|it| User.from_row(it))
+	return users
+}

src/entity/post.v

···
 module entity
 
+import db.pg
 import time
+import util
 
 pub struct Post {
 pub mut:
···
 
 	posted_at time.Time = time.now()
 }
+
+// Post.from_row creates a post object from the given database row.
+// see src/database/post.v#search_for_posts for usage.
+@[inline]
+pub fn Post.from_row(row pg.Row) Post {
+	// this throws a cgen error when put in Post{}
+	//todo: report this
+	posted_at := time.parse(util.or_throw[string](row.vals[6])) or { panic(err) }
+
+	return Post{
+		id: util.or_throw[string](row.vals[0]).int()
+		author_id: util.or_throw[string](row.vals[1]).int()
+		replying_to: if row.vals[2] == none { ?int(none) } else {
+			util.map_or_throw[string, int](row.vals[2], |it| it.int())
+		}
+		title: util.or_throw[string](row.vals[3])
+		body: util.or_throw[string](row.vals[4])
+		pinned: util.map_or_throw[string, bool](row.vals[5], |it| it.bool())
+		posted_at: posted_at
+	}
+}

src/entity/user.v

···
 module entity
 
+import db.pg
 import time
+import util
 
 pub struct User {
 pub mut:
···
 		.replace(user.password, '*'.repeat(16))
 		.replace(user.password_salt, '*'.repeat(16))
 }
+
+// User.from_row creates a user object from the given database row.
+// see src/database/user.v#search_for_users for usage.
+@[inline]
+pub fn User.from_row(row pg.Row) User {
+	// this throws a cgen error when put in User{}
+	//todo: report this
+	created_at := time.parse(util.or_throw[string](row.vals[10])) or { panic(err) }
+
+	return User{
+		id: util.or_throw[string](row.vals[0]).int()
+		username: util.or_throw[string](row.vals[1])
+		nickname: if row.vals[2] == none { ?string(none) } else {
+			util.or_throw[string](row.vals[2])
+		}
+		password: 'haha lol, nope'
+		password_salt: 'haha lol, nope'
+		muted: util.map_or_throw[string, bool](row.vals[5], |it| it.bool())
+		admin: util.map_or_throw[string, bool](row.vals[6], |it| it.bool())
+		theme: util.or_throw[string](row.vals[7])
+		bio: util.or_throw[string](row.vals[8])
+		pronouns: util.or_throw[string](row.vals[9])
+		created_at: created_at
+	}
+}

src/static/js/search.js

···
+const search_posts = async (query, limit, offset) => {
+	const data = await fetch(`/api/post/search?query=${query}&limit=${limit}&offset=${offset}`, {
+		method: 'GET'
+	})
+	const json = await data.json()
+	return json
+}
+
+const search_users = async (query, limit, offset) => {
+	const data = await fetch(`/api/user/search?query=${query}&limit=${limit}&offset=${offset}`, {
+		method: 'GET'
+	})
+	const json = await data.json()
+	return json
+}

src/static/js/user_utils.js

···
+const get_display_name = user => user.nickname == undefined ? user.username : user.nickname

src/templates/components/user_card_mini.html

···
+<div class="user-card user-card-mini">
+	<p>
+		<a href="/user/@{user.username}">@{user.get_name()}</a>
+	</p>
+</div>

src/templates/partial/header.html

···
 <body>
 
 	<header>
+		@if ctx.is_logged_in()
+		<a href="/me">@@@user.get_name()</a>
+		-
+		@end
+
 		@if app.config.dev_mode
 		<span><strong>dev mode</strong></span>
 		-
···
 		-
 
 		@if ctx.is_logged_in()
-		<a href="/me">profile</a>
-		-
 		<a href="/inbox">inbox@{app.get_notification_count_for_frontend(user.id, 99)}</a>
 		@else
 		<a href="/login">log in</a>

src/templates/search.html

···
+@include 'partial/header.html'
+
+<script src="/static/js/user_utils.js"></script>
+<script src="/static/js/search.js"></script>
+
+<h1>search</h1>
+
+<div>
+	<input type="text" name="query" id="query">
+	<div>
+		<p>search for:</p>
+		<input type="radio" name="search-for" id="search-for-posts" value="posts" checked aria-checked>
+		<label for="search-for-posts">posts</label>
+		<input type="radio" name="search-for" id="search-for-users" value="users">
+		<label for="search-for-users">users</label>
+	</div>
+	<br>
+	<button id="search">search</button>
+</div>
+
+<br>
+
+<div id="pages">
+</div>
+
+<div id="results">
+</div>
+
+<script>
+	const params = new URLSearchParams(window.location.search)
+
+	const pages = document.getElementById('pages')
+	const results = document.getElementById('results')
+
+	const query = document.getElementById('query')
+	if (query.value == '' && params.get('q')) {
+		query.value = params.get('q')
+	}
+
+	let limit = params.get('limit')
+	if (!limit) {
+		limit = 10
+	}
+
+	let offset = params.get('offset')
+	if (!limit) {
+		offset = 0
+	}
+
+	const add_post_result = result => {
+		// same as components/post_mini.html except js
+		const element = document.createElement('div')
+		element.classList.add('post', 'post-mini')
+		const p = document.createElement('p')
+
+		const user_link = document.createElement('a')
+		user_link.href = '/user/' + result.author.username
+		const user_text = document.createElement('strong')
+		user_text.innerText = get_display_name(result.author)
+		user_link.appendChild(user_text)
+		p.appendChild(user_link)
+
+		p.innerHTML += ': '
+
+		const post_link = document.createElement('a')
+		post_link.href = '/post/' + result.post.id
+		post_link.innerText = result.post.title
+		p.appendChild(post_link)
+
+		element.appendChild(p)
+		results.appendChild(element)
+	}
+
+	const add_user_result = user => {
+		const element = document.createElement('div')
+		const p = document.createElement('p')
+		const user_link = document.createElement('a')
+		user_link.href = '/user/' + user.username
+		user_link.innerText = get_display_name(user)
+		p.appendChild(user_link)
+		element.appendChild(p)
+		results.appendChild(element)
+	}
+
+	const add_pages = () => {
+		// creates a separator
+		const sep = () => {
+			const span = document.createElement('span')
+			span.innerText = ' - '
+			pages.appendChild(span)
+		}
+
+		const first_link = document.createElement('a')
+		// we escape the $ here because otherwise V will try to perform replacements at compile-time.
+		//todo: report this, this behaviour should be changed or at least looked into further.
+		first_link.href = '/search?q=' + query.value + '&limit=' + limit + '&offset=0'
+		first_link.innerText = '0'
+		pages.appendChild(first_link)
+
+		sep()
+
+		const back_link = document.createElement('a')
+		back_link.href = '/search?q=' + query.value + '&limit=' + limit + '&offset=' + Math.min(0, offset - 10)
+		back_link.innerText = '<'
+		pages.appendChild(back_link)
+
+		sep()
+
+		const next_link = document.createElement('a')
+		next_link.href = '/search?q=' + query.value + '&limit=' + limit + '&offset=' + (offset + 10)
+		next_link.innerText = '>'
+		pages.appendChild(next_link)
+	}
+
+	document.getElementById('search').addEventListener('click', async () => {
+		results.innerHTML = '' // yeet the children!
+		pages.innerHTML = '' // yeet more children!
+
+		var search_for
+		for (const radio of document.getElementsByName('search-for')) {
+			if (radio.checked) {
+				search_for = radio.value
+				break
+			}
+		}
+		if (search_for == undefined) {
+			alert('please select either "users" or "posts" to search for.')
+			return
+		}
+
+		console.log('search: ', query.value, limit, offset)
+
+		var search_results
+		if (search_for == 'users') {
+			search_results = await search_users(query.value, limit, offset)
+		} else if (search_for == 'posts') {
+			search_results = await search_posts(query.value, limit, offset)
+		} else {
+			// this should never happen
+			alert('something wrong occured while searching, please report this (01)')
+			return
+		}
+
+		console.log(search_results)
+
+		if (search_results.length >= 0) {
+			// i iterate inside the if statements so that i do not have to perform a redundant
+			// string comparison for every single result.
+			if (search_for == 'users') {
+				for (result of search_results) {
+					add_user_result(result)
+				}
+			} else if (search_for == 'posts') {
+				for (result of search_results) {
+					add_post_result(result)
+				}
+			} else {
+				// this should never happen
+				alert('something wrong occured while searching, please report this (02)')
+				return
+			}
+
+			// set up pagination, but only if we actually have pages to display
+			if (offset > 0) {
+				add_pages()
+			}
+		} else {
+			results.innerText = 'no results!'
+		}
+	})
+</script>
+
+@include 'partial/footer.html'

src/util/none.v

···
+module util
+
+@[inline]
+pub fn map_or[T, R](val ?T, mapper fn (T) R, or_else R) R {
+	return if val == none { or_else } else { mapper(val) }
+}
+
+@[inline]
+pub fn map_or_throw[T, R](val ?T, mapper fn (T) R) R {
+	return if val == none { panic('value was none: ${val}') } else { mapper(val) }
+}
+
+@[inline]
+pub fn map_or_opt[T, R](val ?T, mapper fn (T) ?R, or_else ?R) ?R {
+	return if val == none { or_else } else { mapper(val) }
+}
+
+@[inline]
+pub fn or_throw[T](val ?T) T {
+	return if val == none { panic('value was none: ${val}') } else { val }
+}

src/webapp/api.v

···
 import veb
 import auth
 import entity { Like, LikeCache, Post, Site, User, Notification }
+import database { PostSearchResult }
+
+// search_hard_limit is the maximum limit for a search query, used to prevent
+// people from requesting searches with huge limits and straining the SQL server
+pub const search_hard_limit := 50
 
 ////// user //////
 
···
 
 @['/api/user/notification/clear']
 fn (mut app App) api_user_notification_clear(mut ctx Context, id int) veb.Result {
-	if !ctx.is_logged_in() {
+	user := app.whoami(mut ctx) or {
 		ctx.error('you are not logged in!')
 		return ctx.redirect('/login')
 	}
-	sql app.db {
-		delete from Notification where id == id
-	} or {
-		ctx.error('failed to delete notification')
-		return ctx.redirect('/inbox')
+
+	if notification := app.get_notification_by_id(id) {
+		if notification.user_id != user.id {
+			ctx.error('no such notification for user')
+			return ctx.redirect('/inbox')
+		} else {
+			if !app.delete_notification(id) {
+				ctx.error('failed to delete notification')
+				return ctx.redirect('/inbox')
+			}
+		}
+	} else {
+		ctx.error('no such notification for user')
 	}
+
 	return ctx.redirect('/inbox')
 }
 
···
 		ctx.error('you are not logged in!')
 		return ctx.redirect('/login')
 	}
-	sql app.db {
-		delete from Notification where user_id == user.id
-	} or {
+	if !app.delete_notifications_for_user(user.id) {
 		ctx.error('failed to delete notifications')
 		return ctx.redirect('/inbox')
 	}
···
 
 	if user.admin || user.id == id {
 		// yeet
-		sql app.db {
-			delete from User where id == id
-			delete from Like where user_id == id
-			delete from Notification where user_id == id
-		} or {
+		if !app.delete_user(user.id) {
 			ctx.error('failed to delete user: ${id}')
 			return ctx.redirect('/')
 		}
 
-		// delete posts and their likes
-		posts_from_this_user := sql app.db {
-			select from Post where author_id == id
-		} or { [] }
-
-		for post in posts_from_this_user {
-			sql app.db {
-				delete from Like where post_id == post.id
-				delete from LikeCache where post_id == post.id
-			} or {
-				eprintln('failed to delete like cache for post during user deletion: ${post.id}')
-			}
-		}
-
-		sql app.db {
-			delete from Post where author_id == id
-		} or {
-			eprintln('failed to delete posts by deleting user: ${user.id}')
-		}
-
 		app.auth.delete_tokens_for_user(id) or {
 			eprintln('failed to delete tokens for user during deletion: ${id}')
 		}
···
 	return ctx.redirect('/')
 }
 
+@['/api/user/search'; get]
+fn (mut app App) api_user_search(mut ctx Context, query string, limit int, offset int) veb.Result {
+	if limit >= search_hard_limit {
+		return ctx.text('limit exceeds hard limit (${search_hard_limit})')
+	}
+	users := app.search_for_users(query, limit, offset)
+	return ctx.json[[]User](users)
+}
+
 ////// post //////
 
 @['/api/post/new_post'; post]
···
 		post.replying_to = replying_to
 	}
 
-	sql app.db {
-		insert post into Post
-	} or {
+	if !app.add_post(post) {
 		ctx.error('failed to post!')
 		println('failed to post: ${post} from user ${user.id}')
 		return ctx.redirect('/post/new')
···
 	}
 
 	if user.admin || user.id == post.author_id {
-		sql app.db {
-			delete from Post where id == id
-			delete from Like where post_id == id
-		} or {
+		if !app.delete_post(post.id) {
 			ctx.error('failed to delete post')
 			eprintln('failed to delete post: ${id}')
 			return ctx.redirect('/')
···
 	post := app.get_post_by_id(id) or { return ctx.server_error('post does not exist') }
 
 	if app.does_user_like_post(user.id, post.id) {
-		sql app.db {
-			delete from Like where user_id == user.id && post_id == post.id
-			// yeet the old cached like value
-			delete from LikeCache where post_id == post.id
-		} or {
+		if !app.unlike_post(post.id, user.id) {
 			eprintln('user ${user.id} failed to unlike post ${id}')
 			return ctx.server_error('failed to unlike post')
 		}
···
 	} else {
 		// remove the old dislike, if it exists
 		if app.does_user_dislike_post(user.id, post.id) {
-			sql app.db {
-				delete from Like where user_id == user.id && post_id == post.id
-			} or {
+			if !app.unlike_post(post.id, user.id) {
 				eprintln('user ${user.id} failed to remove dislike on post ${id} when liking it')
 			}
 		}
···
 			post_id: post.id
 			is_like: true
 		}
-		sql app.db {
-			insert like into Like
-			// yeet the old cached like value
-			delete from LikeCache where post_id == post.id
-		} or {
+		if !app.add_like(like) {
 			eprintln('user ${user.id} failed to like post ${id}')
 			return ctx.server_error('failed to like post')
 		}
···
 	post := app.get_post_by_id(id) or { return ctx.server_error('post does not exist') }
 
 	if app.does_user_dislike_post(user.id, post.id) {
-		sql app.db {
-			delete from Like where user_id == user.id && post_id == post.id
-			// yeet the old cached like value
-			delete from LikeCache where post_id == post.id
-		} or {
-			eprintln('user ${user.id} failed to unlike post ${id}')
-			return ctx.server_error('failed to unlike post')
+		if !app.unlike_post(post.id, user.id) {
+			eprintln('user ${user.id} failed to undislike post ${id}')
+			return ctx.server_error('failed to undislike post')
 		}
 		return ctx.ok('undisliked post')
 	} else {
 		// remove the old like, if it exists
 		if app.does_user_like_post(user.id, post.id) {
-			sql app.db {
-				delete from Like where user_id == user.id && post_id == post.id
-			} or {
+			if !app.unlike_post(post.id, user.id) {
 				eprintln('user ${user.id} failed to remove like on post ${id} when disliking it')
 			}
 		}
···
 			post_id: post.id
 			is_like: false
 		}
-		sql app.db {
-			insert like into Like
-			// yeet the old cached like value
-			delete from LikeCache where post_id == post.id
-		} or {
+		if !app.add_like(like) {
 			eprintln('user ${user.id} failed to dislike post ${id}')
 			return ctx.server_error('failed to dislike post')
 		}
···
 		return ctx.redirect('/')
 	}
 
-	sql app.db {
-		update Post set body = body, title = title where id == id
-	} or {
+	if !app.update_post(id, title, body) {
 		eprintln('failed to update post')
 		ctx.error('failed to update post')
 		return ctx.redirect('/')
···
 	}
 
 	if user.admin {
-		sql app.db {
-			update Post set pinned = true where id == id
-		} or {
+		if !app.pin_post(id) {
 			eprintln('failed to pin post: ${id}')
 			ctx.error('failed to pin post')
 			return ctx.redirect('/post/${id}')
···
 	}
 }
 
+@['/api/post/get/<id>'; get]
+fn (mut app App) api_post_get_post(mut ctx Context, id int) veb.Result {
+	post := app.get_post_by_id(id) or {
+		return ctx.text('no such post')
+	}
+	return ctx.json[Post](post)
+}
+
+@['/api/post/search'; get]
+fn (mut app App) api_post_search(mut ctx Context, query string, limit int, offset int) veb.Result {
+	if limit >= search_hard_limit {
+		return ctx.text('limit exceeds hard limit (${search_hard_limit})')
+	}
+	posts := app.search_for_posts(query, limit, offset)
+	return ctx.json[[]PostSearchResult](posts)
+}
+
 ////// site //////
 
 @['/api/site/set_motd'; post]
···
 	}
 
 	if user.admin {
-		sql app.db {
-			update Site set motd = motd where id == 1
-		} or {
+		if !app.set_motd(motd) {
 			ctx.error('failed to set motd')
 			eprintln('failed to set motd: ${motd}')
 			return ctx.redirect('/')

src/webapp/app.v

···
 	}
 }
 
-// get_unknown_user returns a user representing an unknown user
-pub fn (app &App) get_unknown_user() User {
-	return User{
-		username: 'unknown'
-	}
-}
-
-// get_unknown_post returns a post representing an unknown post
-pub fn (app &App) get_unknown_post() Post {
-	return Post{
-		title: 'unknown'
-	}
-}
-
 // logged_in_as returns true if the user is logged in as the provided user id.
 pub fn (app &App) logged_in_as(mut ctx Context, id int) bool {
 	if !ctx.is_logged_in() {

src/webapp/pages.v

···
 	ctx.title = '${app.config.instance.name} - #${tag}'
 	return $veb.html('../templates/tag.html')
 }
+
+@['/search']
+fn (mut app App) search(mut ctx Context, q string, offset int) veb.Result {
+	user := app.whoami(mut ctx) or {
+		ctx.error('not logged in')
+		return ctx.redirect('/login')
+	}
+	ctx.title = '${app.config.instance.name} - search'
+	return $veb.html('../templates/search.html')
+}