the great refactor

src/api.v src/webapp/api.v

···
-module main
+module webapp
 
 import veb
 import auth
···
 		user.theme = app.config.instance.default_theme
 	}
 
-	sql app.db {
-		insert user into User
-	} or {
-		eprintln('failed to insert user ${user}')
-		return ctx.redirect('/')
-	}
-
-	println('reg: ${username}')
-
-	if x := app.get_user_by_name(username) {
+	if x := app.new_user(user) {
 		app.send_notification_to(
 			x.id,
 			app.config.welcome.summary.replace('%s', x.get_name()),
···
 		return ctx.redirect('/settings')
 	}
 
-	sql app.db {
-		update User set username = new_username where id == user.id
-	} or {
-		eprintln('failed to update username for ${user.id}')
+	if !app.set_username(user.id, new_username) {
 		ctx.error('failed to update username')
 	}
 
···
 
 	hashed_new_password := auth.hash_password_with_salt(new_password, user.password_salt)
 
-	sql app.db {
-		update User set password = hashed_new_password where id == user.id
-	} or {
-		eprintln('failed to update password for ${user.id}')
+	if !app.set_password(user.id, hashed_new_password) {
 		ctx.error('failed to update password')
 	}
 
···
 		return ctx.redirect('/me')
 	}
 
-	sql app.db {
-		update User set nickname = clean_nickname where id == user.id
-	} or {
-		ctx.error('failed to change nickname')
+	if !app.set_nickname(user.id, clean_nickname) {
 		eprintln('failed to update nickname for ${user} (${user.nickname} -> ${clean_nickname})')
 		return ctx.redirect('/me')
 	}
···
 }
 
 @['/api/user/set_muted'; post]
-fn (mut app App) api_user_set_muted(mut ctx Context, muted bool) veb.Result {
+fn (mut app App) api_user_set_muted(mut ctx Context, id int, muted bool) veb.Result {
 	user := app.whoami(mut ctx) or {
 		ctx.error('you are not logged in!')
 		return ctx.redirect('/login')
 	}
 
-	if user.admin || app.config.dev_mode {
-		sql app.db {
-			update User set muted = muted where id == user.id
-		} or {
+	to_mute := app.get_user_by_id(id) or {
+		ctx.error('no such user')
+		return ctx.redirect('/')
+	}
+
+	if user.admin {
+		if !app.set_muted(to_mute.id, muted) {
 			ctx.error('failed to change mute status')
-			eprintln('failed to update mute status for ${user} (${user.muted} -> ${muted})')
-			return ctx.redirect('/user/${user.username}')
+			return ctx.redirect('/user/${to_mute.username}')
 		}
-		return ctx.redirect('/user/${user.username}')
+		return ctx.redirect('/user/${to_mute.username}')
 	} else {
 		ctx.error('insufficient permissions!')
-		eprintln('insufficient perms to update mute status for ${user} (${user.muted} -> ${muted})')
-		return ctx.redirect('/user/${user.username}')
+		eprintln('insufficient perms to update mute status for ${to_mute} (${to_mute.muted} -> ${muted})')
+		return ctx.redirect('/user/${to_mute.username}')
 	}
 }
 
···
 		theme = url.trim_space()
 	}
 
-	sql app.db {
-		update User set theme = theme where id == user.id
-	} or {
+	if !app.set_theme(user.id, theme) {
 		ctx.error('failed to change theme')
-		eprintln('failed to update theme for ${user} (${user.theme} -> ${theme})')
 		return ctx.redirect('/me')
 	}
 
···
 		return ctx.redirect('/me')
 	}
 
-	sql app.db {
-		update User set pronouns = clean_pronouns where id == user.id
-	} or {
+	if !app.set_pronouns(user.id, clean_pronouns) {
 		ctx.error('failed to change pronouns')
-		eprintln('failed to update pronouns for ${user} (${user.pronouns} -> ${clean_pronouns})')
 		return ctx.redirect('/me')
 	}
 
···
 		return ctx.redirect('/me')
 	}
 
-	sql app.db {
-		update User set bio = clean_bio where id == user.id
-	} or {
-		ctx.error('failed to change bio')
+	if !app.set_bio(user.id, clean_bio) {
 		eprintln('failed to update bio for ${user} (${user.bio} -> ${clean_bio})')
 		return ctx.redirect('/me')
 	}

src/app.v

···
-module main
-
-import veb
-import db.pg
-import regex
-import time
-import auth
-import entity { LikeCache, Like, Post, Site, User, Notification }
-
-pub struct App {
-	veb.StaticHandler
-pub:
-	config Config
-pub mut:
-	db         pg.DB
-	auth       auth.Auth[pg.DB]
-	validators struct {
-	pub mut:
-		username   StringValidator
-		password   StringValidator
-		nickname   StringValidator
-		pronouns   StringValidator
-		user_bio   StringValidator
-		post_title StringValidator
-		post_body  StringValidator
-	}
-}
-
-pub fn (app &App) get_user_by_name(username string) ?User {
-	users := sql app.db {
-		select from User where username == username
-	} or { [] }
-	if users.len != 1 {
-		return none
-	}
-	return users[0]
-}
-
-pub fn (app &App) get_user_by_id(id int) ?User {
-	users := sql app.db {
-		select from User where id == id
-	} or { [] }
-	if users.len != 1 {
-		return none
-	}
-	return users[0]
-}
-
-pub fn (app &App) get_user_by_token(ctx &Context, token string) ?User {
-	user_token := app.auth.find_token(token, ctx.ip()) or {
-		eprintln('no such user corresponding to token')
-		return none
-	}
-	return app.get_user_by_id(user_token.user_id)
-}
-
-pub fn (app &App) get_recent_posts() []Post {
-	posts := sql app.db {
-		select from Post order by posted_at desc limit 10
-	} or { [] }
-	return posts
-}
-
-pub fn (app &App) get_popular_posts() []Post {
-	cached_likes := sql app.db {
-		select from LikeCache order by likes desc limit 10
-	} or { [] }
-	posts := cached_likes.map(fn [app] (it LikeCache) Post {
-		return app.get_post_by_id(it.post_id) or {
-			eprintln('cached like ${it} does not have a post related to it (from get_popular_posts)')
-			return Post{}
-		}
-	}).filter(it.id != 0)
-	return posts
-}
-
-pub fn (app &App) get_posts_from_user(user_id int) []Post {
-	posts := sql app.db {
-		select from Post where author_id == user_id order by posted_at desc
-	} or { [] }
-	return posts
-}
-
-pub fn (app &App) get_users() []User {
-	users := sql app.db {
-		select from User
-	} or { [] }
-	return users
-}
-
-pub fn (app &App) get_post_by_id(id int) ?Post {
-	posts := sql app.db {
-		select from Post where id == id limit 1
-	} or { [] }
-	if posts.len != 1 {
-		return none
-	}
-	return posts[0]
-}
-
-pub fn (app &App) get_post_by_author_and_timestamp(author_id int, timestamp time.Time) ?Post {
-	posts := sql app.db {
-		select from Post where author_id == author_id && posted_at == timestamp order by posted_at desc limit 1
-	} or { [] }
-	if posts.len == 0 {
-		return none
-	}
-	return posts[0]
-}
-
-pub fn (app &App) get_posts_with_tag(tag string, offset int) []Post {
-	posts := sql app.db {
-		select from Post where body like '%#(${tag})%' order by posted_at desc limit 10 offset offset
-	} or { [] }
-	return posts
-}
-
-pub fn (app &App) get_pinned_posts() []Post {
-	posts := sql app.db {
-		select from Post where pinned == true
-	} or { [] }
-	return posts
-}
-
-pub fn (app &App) whoami(mut ctx Context) ?User {
-	token := ctx.get_cookie('token') or { return none }.trim_space()
-	if token == '' {
-		return none
-	}
-	if user := app.get_user_by_token(ctx, token) {
-		if user.username == '' || user.id == 0 {
-			eprintln('a user had a token for the blank user')
-			// Clear token
-			ctx.set_cookie(
-				name:      'token'
-				value:     ''
-				same_site: .same_site_none_mode
-				secure:    true
-				path:      '/'
-			)
-			return none
-		}
-		return user
-	} else {
-		eprintln('a user had a token for a non-existent user (this token may have been expired and left in cookies)')
-		// Clear token
-		ctx.set_cookie(
-			name:      'token'
-			value:     ''
-			same_site: .same_site_none_mode
-			secure:    true
-			path:      '/'
-		)
-		return none
-	}
-}
-
-pub fn (app &App) get_unknown_user() User {
-	return User{
-		username: 'unknown'
-	}
-}
-
-pub fn (app &App) get_unknown_post() Post {
-	return Post{
-		title: 'unknown'
-	}
-}
-
-pub fn (app &App) logged_in_as(mut ctx Context, id int) bool {
-	if !ctx.is_logged_in() {
-		return false
-	}
-	return app.whoami(mut ctx) or { return false }.id == id
-}
-
-pub fn (app &App) does_user_like_post(user_id int, post_id int) bool {
-	likes := sql app.db {
-		select from Like where user_id == user_id && post_id == post_id
-	} or { [] }
-	if likes.len > 1 {
-		// something is very wrong lol
-		eprintln('a user somehow got two or more likes on the same post (user: ${user_id}, post: ${post_id})')
-	} else if likes.len == 0 {
-		return false
-	}
-	return likes.first().is_like
-}
-
-pub fn (app &App) does_user_dislike_post(user_id int, post_id int) bool {
-	likes := sql app.db {
-		select from Like where user_id == user_id && post_id == post_id
-	} or { [] }
-	if likes.len > 1 {
-		// something is very wrong lol
-		eprintln('a user somehow got two or more likes on the same post (user: ${user_id}, post: ${post_id})')
-	} else if likes.len == 0 {
-		return false
-	}
-	return !likes.first().is_like
-}
-
-pub fn (app &App) does_user_like_or_dislike_post(user_id int, post_id int) bool {
-	likes := sql app.db {
-		select from Like where user_id == user_id && post_id == post_id
-	} or { [] }
-	if likes.len > 1 {
-		// something is very wrong lol
-		eprintln('a user somehow got two or more likes on the same post (user: ${user_id}, post: ${post_id})')
-	}
-	return likes.len == 1
-}
-
-pub fn (app &App) get_net_likes_for_post(post_id int) int {
-	// check cache
-	cache := sql app.db {
-		select from LikeCache where post_id == post_id limit 1
-	} or { [] }
-
-	mut likes := 0
-
-	if cache.len != 1 {
-		println('calculating net likes for post: ${post_id}')
-		// calculate
-		db_likes := sql app.db {
-			select from Like where post_id == post_id
-		} or { [] }
-
-		for like in db_likes {
-			if like.is_like {
-				likes++
-			} else {
-				likes--
-			}
-		}
-
-		// cache
-		cached := LikeCache{
-			post_id: post_id
-			likes:   likes
-		}
-		sql app.db {
-			insert cached into LikeCache
-		} or {
-			eprintln('failed to cache like: ${cached}')
-			return likes
-		}
-	} else {
-		likes = cache.first().likes
-	}
-
-	return likes
-}
-
-pub fn (app &App) get_or_create_site_config() Site {
-	configs := sql app.db {
-		select from Site
-	} or { [] }
-	if configs.len == 0 {
-		// make the site config
-		site_config := Site{}
-		sql app.db {
-			insert site_config into Site
-		} or { panic('failed to create site config (${err})') }
-	} else if configs.len > 1 {
-		// this should never happen
-		panic('there are multiple site configs')
-	}
-	return configs[0]
-}
-
-@[inline]
-pub fn (app &App) get_motd() string {
-	site := app.get_or_create_site_config()
-	return site.motd
-}
-
-pub fn (app &App) get_notifications_for(user_id int) []Notification {
-	notifications := sql app.db {
-		select from Notification where user_id == user_id
-	} or { [] }
-	return notifications
-}
-
-pub fn (app &App) get_notification_count(user_id int, limit int) int {
-	notifications := sql app.db {
-		select from Notification where user_id == user_id limit limit
-	} or { [] }
-	return notifications.len
-}
-
-pub fn (app &App) get_notification_count_for_frontend(user_id int, limit int) string {
-	count := app.get_notification_count(user_id, limit)
-	if count == 0 {
-		return ''
-	} else if count > limit {
-		return ' (${count}+)'
-	} else {
-		return ' (${count})'
-	}
-}
-
-pub fn (app &App) send_notification_to(user_id int, summary string, body string) {
-	notification := Notification{
-		user_id: user_id
-		summary: summary
-		body: body
-	}
-	sql app.db {
-		insert notification into Notification
-	} or {
-		eprintln('failed to send notification ${notification}')
-	}
-}
-
-// sends notifications to each user mentioned in a post
-pub fn (app &App) process_post_mentions(post &Post) {
-	author := app.get_user_by_id(post.author_id) or {
-		eprintln('process_post_mentioned called on a post with a non-existent author: ${post}')
-		return
-	}
-	author_name := author.get_name()
-
-	// used so we do not send more than one notification per post
-	mut notified_users := []int{}
-
-	// notify who we replied to, if applicable
-	if post.replying_to != none {
-		if x := app.get_post_by_id(post.replying_to) {
-			app.send_notification_to(x.author_id, '${author_name} replied to your post!', '${author_name} replied to *(${x.id})')
-		}
-	}
-
-	// find mentions
-	mut re := regex.regex_opt('@\\(${app.config.user.username_pattern}\\)') or {
-		eprintln('failed to compile regex for process_post_mentions (err: ${err})')
-		return
-	}
-	matches := re.find_all_str(post.body)
-	for mat in matches {
-		println('found mentioned user: ${mat}')
-		username := mat#[2..-1]
-		user := app.get_user_by_name(username) or {
-			continue
-		}
-
-		if user.id in notified_users || user.id == author.id {
-			continue
-		}
-		notified_users << user.id
-
-		app.send_notification_to(
-			user.id,
-			'${author_name} mentioned you!',
-			'you have been mentioned in this post: *(${post.id})'
-		)
-	}
-}

src/config.v src/webapp/config.v

···
-module main
+module webapp
 
 import emmathemartian.maple
 

src/context.v src/webapp/context.v

···
-module main
+module webapp
 
 import veb
 

src/database/database.v

···
+module database
+
+import db.pg
+
+// all interactions with the database should be handled through this struct.
+pub struct DatabaseAccess {
+pub mut:
+	db pg.DB
+}

src/database/like.v

···
+module database
+
+import entity { Like, LikeCache }
+
+// returns the net likes of the given post
+pub fn (app &DatabaseAccess) get_net_likes_for_post(post_id int) int {
+	// check cache
+	cache := sql app.db {
+		select from LikeCache where post_id == post_id limit 1
+	} or { [] }
+
+	mut likes := 0
+
+	if cache.len != 1 {
+		println('calculating net likes for post: ${post_id}')
+		// calculate
+		db_likes := sql app.db {
+			select from Like where post_id == post_id
+		} or { [] }
+
+		for like in db_likes {
+			if like.is_like {
+				likes++
+			} else {
+				likes--
+			}
+		}
+
+		// cache
+		cached := LikeCache{
+			post_id: post_id
+			likes:   likes
+		}
+		sql app.db {
+			insert cached into LikeCache
+		} or {
+			eprintln('failed to cache like: ${cached}')
+			return likes
+		}
+	} else {
+		likes = cache.first().likes
+	}
+
+	return likes
+}

src/database/notification.v

···
+module database
+
+import entity { Notification }
+
+// get a list of notifications for the given user
+pub fn (app &DatabaseAccess) get_notifications_for(user_id int) []Notification {
+	notifications := sql app.db {
+		select from Notification where user_id == user_id
+	} or { [] }
+	return notifications
+}
+
+// get the amount of notifications a user has, with a given limit
+pub fn (app &DatabaseAccess) get_notification_count(user_id int, limit int) int {
+	notifications := sql app.db {
+		select from Notification where user_id == user_id limit limit
+	} or { [] }
+	return notifications.len
+}
+
+// send a notification to the given user
+pub fn (app &DatabaseAccess) send_notification_to(user_id int, summary string, body string) {
+	notification := Notification{
+		user_id: user_id
+		summary: summary
+		body: body
+	}
+	sql app.db {
+		insert notification into Notification
+	} or {
+		eprintln('failed to send notification ${notification}')
+	}
+}

src/database/post.v

···
+module database
+
+import time
+import entity { Post, Like, LikeCache }
+
+// get a post by its id, returns none if it does not exist
+pub fn (app &DatabaseAccess) get_post_by_id(id int) ?Post {
+	posts := sql app.db {
+		select from Post where id == id limit 1
+	} or { [] }
+	if posts.len != 1 {
+		return none
+	}
+	return posts[0]
+}
+
+// get a post by its author and timestamp, returns none if it does not exist
+pub fn (app &DatabaseAccess) get_post_by_author_and_timestamp(author_id int, timestamp time.Time) ?Post {
+	posts := sql app.db {
+		select from Post where author_id == author_id && posted_at == timestamp order by posted_at desc limit 1
+	} or { [] }
+	if posts.len == 0 {
+		return none
+	}
+	return posts[0]
+}
+
+// get a list of posts given a tag. this performs sql string operations and
+// probably is not very efficient, use sparingly.
+pub fn (app &DatabaseAccess) get_posts_with_tag(tag string, offset int) []Post {
+	posts := sql app.db {
+		select from Post where body like '%#(${tag})%' order by posted_at desc limit 10 offset offset
+	} or { [] }
+	return posts
+}
+
+// returns a list of all pinned posts
+pub fn (app &DatabaseAccess) get_pinned_posts() []Post {
+	posts := sql app.db {
+		select from Post where pinned == true
+	} or { [] }
+	return posts
+}
+
+// returns a list of the ten most recent posts.
+pub fn (app &DatabaseAccess) get_recent_posts() []Post {
+	posts := sql app.db {
+		select from Post order by posted_at desc limit 10
+	} or { [] }
+	return posts
+}
+
+// returns a list of the ten most liked posts.
+// TODO: make this time-gated (i.e, top ten liked posts of the day)
+pub fn (app &DatabaseAccess) get_popular_posts() []Post {
+	cached_likes := sql app.db {
+		select from LikeCache order by likes desc limit 10
+	} or { [] }
+	posts := cached_likes.map(fn [app] (it LikeCache) Post {
+		return app.get_post_by_id(it.post_id) or {
+			eprintln('cached like ${it} does not have a post related to it (from get_popular_posts)')
+			return Post{}
+		}
+	}).filter(it.id != 0)
+	return posts
+}
+
+// returns a list of all posts from a user in descending order of date
+pub fn (app &DatabaseAccess) get_posts_from_user(user_id int) []Post {
+	posts := sql app.db {
+		select from Post where author_id == user_id order by posted_at desc
+	} or { [] }
+	return posts
+}

src/database/site.v

···
+module database
+
+import entity { Site }
+
+pub fn (app &DatabaseAccess) get_or_create_site_config() Site {
+	configs := sql app.db {
+		select from Site
+	} or { [] }
+	if configs.len == 0 {
+		// make the site config
+		site_config := Site{}
+		sql app.db {
+			insert site_config into Site
+		} or { panic('failed to create site config (${err})') }
+	} else if configs.len > 1 {
+		// this should never happen
+		panic('there are multiple site configs')
+	}
+	return configs[0]
+}

src/database/user.v

···
+module database
+
+import entity { User, Notification, Like, Post }
+
+// creates a new user and returns their struct after creation.
+pub fn (app &DatabaseAccess) new_user(user User) ?User {
+	sql app.db {
+		insert user into User
+	} or {
+		eprintln('failed to insert user ${user}')
+		return none
+	}
+
+	println('reg: ${user.username}')
+
+	return app.get_user_by_name(user.username)
+}
+
+// updates the given user's username, returns true if this succeeded and false
+// otherwise.
+pub fn (app &DatabaseAccess) set_username(user_id int, new_username string) bool {
+	sql app.db {
+		update User set username = new_username where id == user_id
+	} or {
+		eprintln('failed to update username for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// updates the given user's password, returns true if this succeeded and false
+// otherwise.
+pub fn (app &DatabaseAccess) set_password(user_id int, hashed_new_password string) bool {
+	sql app.db {
+		update User set password = hashed_new_password where id == user_id
+	} or {
+		eprintln('failed to update password for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// updates the given user's nickname, returns true if this succeeded and false
+// otherwise.
+pub fn (app &DatabaseAccess) set_nickname(user_id int, new_nickname ?string) bool {
+	sql app.db {
+		update User set nickname = new_nickname where id == user_id
+	} or {
+		eprintln('failed to update nickname for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// updates the given user's muted status, returns true if this succeeded and
+// false otherwise.
+pub fn (app &DatabaseAccess) set_muted(user_id int, muted bool) bool {
+	sql app.db {
+		update User set muted = muted where id == user_id
+	} or {
+		eprintln('failed to update muted status for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// updates the given user's theme url, returns true if this succeeded and false
+// otherwise.
+pub fn (app &DatabaseAccess) set_theme(user_id int, theme ?string) bool {
+	sql app.db {
+		update User set theme = theme where id == user_id
+	} or {
+		eprintln('failed to update theme url for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// updates the given user's pronouns, returns true if this succeeded and false
+// otherwise.
+pub fn (app &DatabaseAccess) set_pronouns(user_id int, pronouns string) bool {
+	sql app.db {
+		update User set pronouns = pronouns where id == user_id
+	} or {
+		eprintln('failed to update pronouns for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// updates the given user's bio, returns true if this succeeded and false
+// otherwise.
+pub fn (app &DatabaseAccess) set_bio(user_id int, bio string) bool {
+	sql app.db {
+		update User set bio = bio where id == user_id
+	} or {
+		eprintln('failed to update bio for ${user_id}')
+		return false
+	}
+	return true
+}
+
+// get a user by their username, returns none if the user was not found.
+pub fn (app &DatabaseAccess) get_user_by_name(username string) ?User {
+	users := sql app.db {
+		select from User where username == username
+	} or { [] }
+	if users.len != 1 {
+		return none
+	}
+	return users[0]
+}
+
+// get a user by their id, returns none if the user was not found.
+pub fn (app &DatabaseAccess) get_user_by_id(id int) ?User {
+	users := sql app.db {
+		select from User where id == id
+	} or { [] }
+	if users.len != 1 {
+		return none
+	}
+	return users[0]
+}
+
+// returns all users
+pub fn (app &DatabaseAccess) get_users() []User {
+	users := sql app.db {
+		select from User
+	} or { [] }
+	return users
+}
+
+// returns true if a user likes the given post
+pub fn (app &DatabaseAccess) does_user_like_post(user_id int, post_id int) bool {
+	likes := sql app.db {
+		select from Like where user_id == user_id && post_id == post_id
+	} or { [] }
+	if likes.len > 1 {
+		// something is very wrong lol
+		eprintln('a user somehow got two or more likes on the same post (user: ${user_id}, post: ${post_id})')
+	} else if likes.len == 0 {
+		return false
+	}
+	return likes.first().is_like
+}
+
+// returns true if a user dislikes the given post
+pub fn (app &DatabaseAccess) does_user_dislike_post(user_id int, post_id int) bool {
+	likes := sql app.db {
+		select from Like where user_id == user_id && post_id == post_id
+	} or { [] }
+	if likes.len > 1 {
+		// something is very wrong lol
+		eprintln('a user somehow got two or more likes on the same post (user: ${user_id}, post: ${post_id})')
+	} else if likes.len == 0 {
+		return false
+	}
+	return !likes.first().is_like
+}
+
+// returns true if a user likes or dislikes the given post
+pub fn (app &DatabaseAccess) does_user_like_or_dislike_post(user_id int, post_id int) bool {
+	likes := sql app.db {
+		select from Like where user_id == user_id && post_id == post_id
+	} or { [] }
+	if likes.len > 1 {
+		// something is very wrong lol
+		eprintln('a user somehow got two or more likes on the same post (user: ${user_id}, post: ${post_id})')
+	}
+	return likes.len == 1
+}

src/main.v

···
 import auth
 import entity
 import os
+import webapp { App, Context, StringValidator }
 
 fn init_db(db pg.DB) ! {
 	sql db {
···
 }
 
 fn main() {
-	config := load_config_from(os.args[1])
+	config := webapp.load_config_from(os.args[1])
 
 	println('-> connecting to db...')
 	mut db := pg.connect(pg.Config{

src/pages.v src/webapp/pages.v

···
-module main
+module webapp
 
 import veb
 import entity { User }
···
 	recent_posts := app.get_recent_posts()
 	pinned_posts := app.get_pinned_posts()
 	motd := app.get_motd()
-	return $veb.html()
+	return $veb.html('../templates/index.html')
 }
 
 fn (mut app App) login(mut ctx Context) veb.Result {
 	ctx.title = 'login to ${app.config.instance.name}'
 	user := app.whoami(mut ctx) or { User{} }
-	return $veb.html()
+	return $veb.html('../templates/login.html')
 }
 
 fn (mut app App) register(mut ctx Context) veb.Result {
 	ctx.title = 'register for ${app.config.instance.name}'
 	user := app.whoami(mut ctx) or { User{} }
-	return $veb.html()
+	return $veb.html('../templates/register.html')
 }
 
 fn (mut app App) me(mut ctx Context) veb.Result {
···
 		return ctx.redirect('/login')
 	}
 	ctx.title = '${app.config.instance.name} - settings'
-	return $veb.html()
+	return $veb.html('../templates/settings.html')
 }
 
 fn (mut app App) admin(mut ctx Context) veb.Result {
 	ctx.title = '${app.config.instance.name} dashboard'
 	user := app.whoami(mut ctx) or { User{} }
-	return $veb.html()
+	return $veb.html('../templates/admin.html')
 }
 
 fn (mut app App) inbox(mut ctx Context) veb.Result {
···
 	}
 	ctx.title = '${app.config.instance.name} inbox'
 	notifications := app.get_notifications_for(user.id)
-	return $veb.html()
+	return $veb.html('../templates/inbox.html')
 }
 
 fn (mut app App) logout(mut ctx Context) veb.Result {
···
 		return ctx.redirect('/login')
 	}
 	ctx.title = '${app.config.instance.name} logout'
-	return $veb.html()
+	return $veb.html('../templates/logout.html')
 }
 
 @['/user/:username']
···
 		return ctx.redirect('/')
 	}
 	ctx.title = '${app.config.instance.name} - ${user.get_name()}'
-	return $veb.html()
+	return $veb.html('../templates/user.html')
 }
 
 @['/post/:post_id']
···
 		}
 	}
 
-	return $veb.html()
+	return $veb.html('../templates/post.html')
 }
 
 @['/post/:post_id/edit']
···
 		return ctx.redirect('/post/${post_id}')
 	}
 	ctx.title = '${app.config.instance.name} - editing ${post.title}'
-	return $veb.html()
+	return $veb.html('../templates/edit.html')
 }
 
 @['/post/:post_id/reply']
···
 		ctx.error('no such post')
 		return ctx.redirect('/')
 	}
-	return $veb.html('templates/new_post.html')
+	return $veb.html('../templates/new_post.html')
 }
 
 @['/post/new']
···
 	replying := false
 	replying_to := 0
 	replying_to_user := User{}
-	return $veb.html('templates/new_post.html')
+	return $veb.html('../templates/new_post.html')
 }
 
 @['/tag/:tag']
···
 	}
 	ctx.title = '${app.config.instance.name} - #${tag}'
 	offset := 0
-	return $veb.html()
+	return $veb.html('../templates/tag.html')
 }
 
 @['/tag/:tag/:offset']
···
 		return ctx.redirect('/login')
 	}
 	ctx.title = '${app.config.instance.name} - #${tag}'
-	return $veb.html('templates/tag.html')
+	return $veb.html('../templates/tag.html')
 }

src/templates/post.html

···
 		<input type="submit" value="delete">
 	</form>
 
+	@if user.admin
 	<form action="/api/post/pin" method="post">
 		<input
 			type="number"
···
 		>
 		<input type="submit" value="pin">
 	</form>
+	@end
 
 	</div>
 	@end

src/templates/user.html

···
 @if viewing.bio != ''
 <div>
 	<h2>bio:</h2>
-	<p>@viewing.bio</p>
+	<pre id="bio">@viewing.bio</pre>
 </div>
 @end
 
···
 		@end
 	</form>
 </div>
+@end
+
+@if viewing.bio != ''
+<script src="/static/js/render_body.js"></script>
+<script>
+	render_body('bio')
+</script>
 @end
 
 @include 'partial/footer.html'

src/validation.v src/webapp/validation.v

···
-module main
+module webapp
 
 import regex
 

src/webapp/app.v

···
+module webapp
+
+import veb
+import db.pg
+import regex
+import auth
+import entity { LikeCache, Like, Post, Site, User, Notification }
+import database { DatabaseAccess }
+
+pub struct App {
+	veb.StaticHandler
+	DatabaseAccess
+pub:
+	config Config
+pub mut:
+	auth       auth.Auth[pg.DB]
+	validators struct {
+	pub mut:
+		username   StringValidator
+		password   StringValidator
+		nickname   StringValidator
+		pronouns   StringValidator
+		user_bio   StringValidator
+		post_title StringValidator
+		post_body  StringValidator
+	}
+}
+
+// get a user by their token, returns none if the user was not found.
+pub fn (app &App) get_user_by_token(ctx &Context, token string) ?User {
+	user_token := app.auth.find_token(token, ctx.ip()) or {
+		eprintln('no such user corresponding to token')
+		return none
+	}
+	return app.get_user_by_id(user_token.user_id)
+}
+
+// returns the current logged in user, or none if the user is not logged in.
+pub fn (app &App) whoami(mut ctx Context) ?User {
+	token := ctx.get_cookie('token') or { return none }.trim_space()
+	if token == '' {
+		return none
+	}
+	if user := app.get_user_by_token(ctx, token) {
+		if user.username == '' || user.id == 0 {
+			eprintln('a user had a token for the blank user')
+			// Clear token
+			ctx.set_cookie(
+				name:      'token'
+				value:     ''
+				same_site: .same_site_none_mode
+				secure:    true
+				path:      '/'
+			)
+			return none
+		}
+		return user
+	} else {
+		eprintln('a user had a token for a non-existent user (this token may have been expired and left in cookies)')
+		// Clear token
+		ctx.set_cookie(
+			name:      'token'
+			value:     ''
+			same_site: .same_site_none_mode
+			secure:    true
+			path:      '/'
+		)
+		return none
+	}
+}
+
+// get a user representing an unknown user
+pub fn (app &App) get_unknown_user() User {
+	return User{
+		username: 'unknown'
+	}
+}
+
+// get a post representing an unknown post
+pub fn (app &App) get_unknown_post() Post {
+	return Post{
+		title: 'unknown'
+	}
+}
+
+// returns true if the user is logged in as the provided user id.
+pub fn (app &App) logged_in_as(mut ctx Context, id int) bool {
+	if !ctx.is_logged_in() {
+		return false
+	}
+	return app.whoami(mut ctx) or { return false }.id == id
+}
+
+// get the site's message of the day.
+@[inline]
+pub fn (app &App) get_motd() string {
+	site := app.get_or_create_site_config()
+	return site.motd
+}
+
+// get the notification count for a given user, formatted for usage on the
+// frontend.
+pub fn (app &App) get_notification_count_for_frontend(user_id int, limit int) string {
+	count := app.get_notification_count(user_id, limit)
+	if count == 0 {
+		return ''
+	} else if count > limit {
+		return ' (${count}+)'
+	} else {
+		return ' (${count})'
+	}
+}
+
+// processes a post's body to send notifications for mentions or replies.
+pub fn (app &App) process_post_mentions(post &Post) {
+	author := app.get_user_by_id(post.author_id) or {
+		eprintln('process_post_mentioned called on a post with a non-existent author: ${post}')
+		return
+	}
+	author_name := author.get_name()
+
+	// used so we do not send more than one notification per post
+	mut notified_users := []int{}
+
+	// notify who we replied to, if applicable
+	if post.replying_to != none {
+		if x := app.get_post_by_id(post.replying_to) {
+			app.send_notification_to(x.author_id, '${author_name} replied to your post!', '${author_name} replied to *(${x.id})')
+		}
+	}
+
+	// find mentions
+	mut re := regex.regex_opt('@\\(${app.config.user.username_pattern}\\)') or {
+		eprintln('failed to compile regex for process_post_mentions (err: ${err})')
+		return
+	}
+	matches := re.find_all_str(post.body)
+	for mat in matches {
+		println('found mentioned user: ${mat}')
+		username := mat#[2..-1]
+		user := app.get_user_by_name(username) or {
+			continue
+		}
+
+		if user.id in notified_users || user.id == author.id {
+			continue
+		}
+		notified_users << user.id
+
+		app.send_notification_to(
+			user.id,
+			'${author_name} mentioned you!',
+			'you have been mentioned in this post: *(${post.id})'
+		)
+	}
+}