add dashboard view, invites

src/auth.js

···
 const jwt = require("jsonwebtoken");
+const { db } = require("./db");
 const { JWT_KEY } = require("./");
 
 function authenticateToken(req, res, next) {
···
 	}
 }
 
-module.exports = { authenticateToken };
+function authenticateAdmin(req, res, next) {
+	if (!req.cookies || !req.cookies.auth_token) {
+		return res.redirect("/login");
+	}
+
+	const token = req.cookies.auth_token;
+
+	// If no token, deny access
+	if (!token) {
+		return res.redirect(
+			`/login?redirect=${encodeURIComponent(req.originalUrl)}`,
+		);
+	}
+
+	try {
+		const user = jwt.verify(token, JWT_KEY);
+		req.user = user;
+		const isAdmin = db
+			.query("SELECT isAdmin FROM users WHERE id = $id and isAdmin = 1")
+			.get({
+				id: req.user.id,
+			});
+		if (isAdmin) {
+			next();
+		} else {
+			res.status(400).send("only admins can invite");
+		}
+	} catch (error) {
+		res.send(`failed to authenticate as admin: ${error}`);
+	}
+}
+
+module.exports = { authenticateToken, authenticateAdmin };

src/db.js

···
 	strict: true,
 });
 
+function runMigration(name, migrationFn) {
+	const exists = db
+		.query("SELECT * FROM migrations WHERE name = $name")
+		.get({ name });
+
+	if (!exists) {
+		migrationFn();
+		db.query("INSERT INTO migrations (name) VALUES ($name)").run({ name });
+	}
+}
+
+// users table
 db.query(`
   CREATE TABLE IF NOT EXISTS users (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
···
   )
 `).run();
 
+// subs table
 db.query(`
   CREATE TABLE IF NOT EXISTS subscriptions (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
···
     UNIQUE(user_id, subreddit)
   )
 `).run();
+
+// migrations table
+db.query(`
+  CREATE TABLE IF NOT EXISTS migrations (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT UNIQUE
+  )
+`).run();
+
+runMigration("add-isAdmin-column", () => {
+	db.query(`
+    ALTER TABLE users
+    ADD COLUMN isAdmin INTEGER DEFAULT 0
+  `).run();
+
+	// first user is admin
+	db.query(`
+    UPDATE users
+    SET isAdmin = 1
+    WHERE id = (SELECT MIN(id) FROM users)
+  `).run();
+});
 
 module.exports = { db };

src/mixins/head.pug

···
   head
     meta(name="viewport" content="width=device-width, initial-scale=1.0")
     meta(charset='UTF-8')
-    title #{`readit ${title}`}
+    title #{`${title} · readit `}
     link(rel="stylesheet", href="/styles.css")
     link(rel="preconnect" href="https://rsms.me/")
     link(rel="stylesheet" href="https://rsms.me/inter/inter.css")

src/mixins/header.pug

···
       a(href=`/subs`) subscriptions
     if user
       div.header-item
-        | #{user.username}
+        a(href='/dashboard') #{user.username}
         | 
         a(href='/logout') (logout)
     else

src/mixins/sub.pug

···
-mixin subMgmt()
-  script.
-    function getSubs() {
-      var store = localStorage.getItem('subs');
-      if (store) {
-        return store.split(',').map((n)=>n.replace(/\/?r\//,''));
-      } else {
-        return [];
-      }
-    }
-
-    function subscribe(newsub) {
-      var subs = getSubs();
-      if (!subs.includes(newsub)) {
-        localStorage.setItem('subs',[...subs,newsub]);
-        updateButton(newsub);
-      }
-    }
-
-    function unsubscribe(sub) {
-      var subs = getSubs();
-      if (subs.includes(sub)) {
-        localStorage.setItem('subs',subs.filter((s)=>s!=sub));
-        updateButton(sub);
-      }
-    }
-
-    function issub(sub) {
-      return getSubs().includes(sub);
-    }
-
-

src/public/styles.css

···
   color: var(--text-color-muted);
 }
 
-.register-error-message {
+.register-error-message,
+.dashboard-error-message {
   margin-bottom: 1rem;
   flex-flow: row wrap;
   color: var(--error-text-color);
 }
+
+.invite-table {
+  width: 100%;
+  padding: 10px 0;
+}
+
+.invite-table th,
+.invite-table td
+{
+  padding: 5px 0;
+}
+
+.invite-table-header {
+  text-align: left;
+}
+
+.invite-link {
+  font-family: monospace;
+}

src/routes/index.js

···
 const geddit = require("../geddit.js");
 const { JWT_KEY } = require("../");
 const { db } = require("../db");
-const { authenticateToken } = require("../auth");
+const { authenticateToken, authenticateAdmin } = require("../auth");
 const { validateInviteToken } = require("../invite");
 
 const router = express.Router();
···
 		.query("SELECT * FROM subscriptions WHERE user_id = $id")
 		.all({ id: req.user.id });
 	res.render("subs", { subs, user: req.user });
+});
+
+// GET /dashboard
+router.get("/dashboard", authenticateToken, async (req, res) => {
+	let invites = null;
+	const isAdmin = db
+		.query("SELECT isAdmin FROM users WHERE id = $id and isAdmin = 1")
+		.get({
+			id: req.user.id,
+		});
+	if (isAdmin) {
+		invites = db
+			.query("SELECT * FROM invites")
+			.all()
+			.map((inv) => ({
+				...inv,
+				createdAt: Date.parse(inv.createdAt),
+				usedAt: Date.parse(inv.usedAt),
+			}));
+	}
+	res.render("dashboard", { invites, isAdmin, user: req.user });
+});
+
+router.get("/create-invite", authenticateAdmin, async (req, res) => {
+	function generateInviteToken() {
+		const hasher = new Bun.CryptoHasher("sha256", "super-secret-invite-key");
+		return hasher.update(Math.random().toString()).digest("hex").slice(0, 10);
+	}
+
+	function createInvite() {
+		const token = generateInviteToken();
+		db.run("INSERT INTO invites (token) VALUES ($token)", { token });
+	}
+
+	try {
+		db.run(`
+		  CREATE TABLE IF NOT EXISTS invites (
+		  	id INTEGER PRIMARY KEY AUTOINCREMENT,
+		  	token TEXT NOT NULL,
+		  	createdAt TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+		  	usedAt TIMESTAMP
+		  )
+	  `);
+
+		createInvite();
+		return res.redirect("/dashboard");
+	} catch (err) {
+		return res.send("failed to create invite");
+	}
+});
+
+router.get("/delete-invite/:id", authenticateToken, async (req, res) => {
+	try {
+		db.run("DELETE FROM invites WHERE id = $id", { id: req.params.id });
+		return res.redirect("/dashboard");
+	} catch (err) {
+		return res.send("failed to delete invite");
+	}
 });
 
 // GET /media

src/views/dashboard.pug

···
+include ../mixins/header
+include ../mixins/head
+include ../utils
+
+doctype html
+html
+  +head("dashboard")
+  body
+    main#content
+      +header(user)
+      div.hero
+        h1 dashboard
+
+        if message 
+          div.dashboard-error-message
+            | #{message}
+
+        if isAdmin
+          h2 invites
+
+          if invites
+            table.invite-table
+              tr
+                th.invite-table-header link
+                th.invite-table-header created
+                th.invite-table-header claimed
+                th.invite-table-header delete
+              each invite in invites
+                tr
+                  td.invite-link
+                    a(href=`/register?token=${invite.token}`) #{invite.token} 
+                  td #{timeDifference(Date.now(), invite.createdAt)} ago
+                  if invite.usedAt
+                    td #{timeDifference(Date.now(), invite.usedAt)} ago
+                  else
+                    td unclaimed
+                  td 
+                    a(href=`/delete-invite/${invite.id}`) delete
+
+          a(href="/create-invite") create invite
+
+        else
+          p you aren't an admin and therefore there is nothing to see here yet
+ 

src/views/index.pug

···
 include ../mixins/post
-include ../mixins/sub
 include ../mixins/header
 include ../mixins/head
 include ../utils
-- var subs = []
 doctype html
 html
   +head("home")
-  +subMgmt()
   script(defer).
     async function subscribe(sub) {
       await doThing(sub, 'subscribe');

src/views/subs.pug

···
-include ../mixins/sub
 include ../mixins/header
 include ../mixins/head
 
 doctype html
 html
   +head("subscriptions")
-  +subMgmt()
-  script.
-    function newSubItem(sub) {
-      const p = document.createElement("p");
-      const a = document.createElement("a");
-      a.href = `/r/${sub}`;
-      a.innerText = `r/${sub}`;
-      p.appendChild(a);
-      return p;
-    }
-
-    function buildSubList() {
-      var subList = document.getElementById('subList');
-      getSubs().forEach((sub)=>{
-        subList.appendChild(newSubItem(sub));
-      });
-    }
-
-    document.addEventListener('DOMContentLoaded', buildSubList);
   body
     main#content
       +header(user)