No OneTemporary
Actions

Size

120 KB

Subscribers

None

View Options

	diff --git a/activitypub.go b/activitypub.go
	index 0308b6c..0ac4d0c 100644
	--- a/activitypub.go
	+++ b/activitypub.go
	@@ -1,699 +1,704 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"bytes"
	"crypto/sha256"
	"database/sql"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"io/ioutil"
	"net/http"
	"net/http/httputil"
	"net/url"
	"strconv"
	"time"

	"github.com/gorilla/mux"
	"github.com/writeas/activity/streams"
	"github.com/writeas/httpsig"
	"github.com/writeas/impart"
	"github.com/writeas/nerds/store"
	"github.com/writeas/web-core/activitypub"
	"github.com/writeas/web-core/activitystreams"
	"github.com/writeas/web-core/log"
	)

	const (
	// TODO: delete. don't use this!
	apCustomHandleDefault = "blog"
	)

	type RemoteUser struct {
	ID int64
	ActorID string
	Inbox string
	SharedInbox string
	}

	func (ru RemoteUser) AsPerson() activitystreams.Person {
	return &activitystreams.Person{
	BaseObject: activitystreams.BaseObject{
	Type: "Person",
	Context: []interface{}{
	activitystreams.Namespace,
	},
	ID: ru.ActorID,
	},
	Inbox: ru.Inbox,
	Endpoints: activitystreams.Endpoints{
	SharedInbox: ru.SharedInbox,
	},
	}
	}

	func handleFetchCollectionActivities(app App, w http.ResponseWriter, r http.Request) error {
	w.Header().Set("Server", serverSoftware)

	vars := mux.Vars(r)
	alias := vars["alias"]

	// TODO: enforce visibility
	// Get base Collection data
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	p := c.PersonObject()

	return impart.RenderActivityJSON(w, p, http.StatusOK)
	}

	func handleFetchCollectionOutbox(app App, w http.ResponseWriter, r http.Request) error {
	w.Header().Set("Server", serverSoftware)

	vars := mux.Vars(r)
	alias := vars["alias"]

	// TODO: enforce visibility
	// Get base Collection data
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	if app.cfg.App.SingleUser {
	if alias != c.Alias {
	return ErrCollectionNotFound
	}
	}

	res := &CollectionObj{Collection: *c}
	app.db.GetPostsCount(res, false)
	accountRoot := c.FederatedAccount()

	page := r.FormValue("page")
	p, err := strconv.Atoi(page)
	if err != nil \|\| p < 1 {
	// Return outbox
	oc := activitystreams.NewOrderedCollection(accountRoot, "outbox", res.TotalPosts)
	return impart.RenderActivityJSON(w, oc, http.StatusOK)
	}

	// Return outbox page
	ocp := activitystreams.NewOrderedCollectionPage(accountRoot, "outbox", res.TotalPosts, p)
	ocp.OrderedItems = []interface{}{}

	posts, err := app.db.GetPosts(c, p, false, true, false)
	for _, pp := range *posts {
	pp.Collection = res
	o := pp.ActivityObject()
	a := activitystreams.NewCreateActivity(o)
	ocp.OrderedItems = append(ocp.OrderedItems, *a)
	}

	return impart.RenderActivityJSON(w, ocp, http.StatusOK)
	}

	func handleFetchCollectionFollowers(app App, w http.ResponseWriter, r http.Request) error {
	w.Header().Set("Server", serverSoftware)

	vars := mux.Vars(r)
	alias := vars["alias"]

	// TODO: enforce visibility
	// Get base Collection data
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	accountRoot := c.FederatedAccount()

	folls, err := app.db.GetAPFollowers(c)
	if err != nil {
	return err
	}

	page := r.FormValue("page")
	p, err := strconv.Atoi(page)
	if err != nil \|\| p < 1 {
	// Return outbox
	oc := activitystreams.NewOrderedCollection(accountRoot, "followers", len(*folls))
	return impart.RenderActivityJSON(w, oc, http.StatusOK)
	}

	// Return outbox page
	ocp := activitystreams.NewOrderedCollectionPage(accountRoot, "followers", len(*folls), p)
	ocp.OrderedItems = []interface{}{}
	/*
	for _, f := range *folls {
	ocp.OrderedItems = append(ocp.OrderedItems, f.ActorID)
	}
	*/
	return impart.RenderActivityJSON(w, ocp, http.StatusOK)
	}

	func handleFetchCollectionFollowing(app App, w http.ResponseWriter, r http.Request) error {
	w.Header().Set("Server", serverSoftware)

	vars := mux.Vars(r)
	alias := vars["alias"]

	// TODO: enforce visibility
	// Get base Collection data
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	accountRoot := c.FederatedAccount()

	page := r.FormValue("page")
	p, err := strconv.Atoi(page)
	if err != nil \|\| p < 1 {
	// Return outbox
	oc := activitystreams.NewOrderedCollection(accountRoot, "following", 0)
	return impart.RenderActivityJSON(w, oc, http.StatusOK)
	}

	// Return outbox page
	ocp := activitystreams.NewOrderedCollectionPage(accountRoot, "following", 0, p)
	ocp.OrderedItems = []interface{}{}
	return impart.RenderActivityJSON(w, ocp, http.StatusOK)
	}

	func handleFetchCollectionInbox(app App, w http.ResponseWriter, r http.Request) error {
	w.Header().Set("Server", serverSoftware)

	vars := mux.Vars(r)
	alias := vars["alias"]
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	// TODO: return Reject?
	return err
	}
	+ c.hostName = app.cfg.App.Host

	if debugging {
	dump, err := httputil.DumpRequest(r, true)
	if err != nil {
	log.Error("Can't dump: %v", err)
	} else {
	log.Info("Rec'd! %q", dump)
	}
	}

	var m map[string]interface{}
	if err := json.NewDecoder(r.Body).Decode(&m); err != nil {
	return err
	}

	a := streams.NewAccept()
	p := c.PersonObject()
	var to *url.URL
	var isFollow, isUnfollow bool
	fullActor := &activitystreams.Person{}
	var remoteUser *RemoteUser

	res := &streams.Resolver{
	FollowCallback: func(f *streams.Follow) error {
	isFollow = true

	// 1) Use the Follow concrete type here
	// 2) Errors are propagated to res.Deserialize call below
	m["@context"] = []string{activitystreams.Namespace}
	b, _ := json.Marshal(m)
	if debugging {
	log.Info("Follow: %s", b)
	}

	_, followID := f.GetId()
	if followID == nil {
	log.Error("Didn't resolve follow ID")
	} else {
	aID := c.FederatedAccount() + "#accept-" + store.GenerateFriendlyRandomString(20)
	acceptID, err := url.Parse(aID)
	if err != nil {
	log.Error("Couldn't parse generated Accept URL '%s': %v", aID, err)
	}
	a.SetId(acceptID)
	}
	a.AppendObject(f.Raw())
	_, to = f.GetActor(0)
	obj := f.Raw().GetObjectIRI(0)
	a.AppendActor(obj)

	// First get actor information
	if to == nil {
	return fmt.Errorf("No valid `to` string")
	}
	fullActor, remoteUser, err = getActor(app, to.String())
	if err != nil {
	return err
	}
	return impart.RenderActivityJSON(w, m, http.StatusOK)
	},
	UndoCallback: func(u *streams.Undo) error {
	isUnfollow = true

	m["@context"] = []string{activitystreams.Namespace}
	b, _ := json.Marshal(m)
	if debugging {
	log.Info("Undo: %s", b)
	}

	a.AppendObject(u.Raw())
	_, to = u.GetActor(0)
	// TODO: get actor from object.object, not object
	obj := u.Raw().GetObjectIRI(0)
	a.AppendActor(obj)
	if to != nil {
	// Populate fullActor from DB?
	remoteUser, err = getRemoteUser(app, to.String())
	if err != nil {
	if iErr, ok := err.(*impart.HTTPError); ok {
	if iErr.Status == http.StatusNotFound {
	log.Error("No remoteuser info for Undo event!")
	}
	}
	return err
	} else {
	fullActor = remoteUser.AsPerson()
	}
	} else {
	log.Error("No to on Undo!")
	}
	return impart.RenderActivityJSON(w, m, http.StatusOK)
	},
	}
	if err := res.Deserialize(m); err != nil {
	// 3) Any errors from #2 can be handled, or the payload is an unknown type.
	log.Error("Unable to resolve Follow: %v", err)
	if debugging {
	log.Error("Map: %s", m)
	}
	return err
	}

	go func() {
	time.Sleep(2 * time.Second)
	am, err := a.Serialize()
	if err != nil {
	log.Error("Unable to serialize Accept: %v", err)
	return
	}
	am["@context"] = []string{activitystreams.Namespace}

	if to == nil {
	log.Error("No to! %v", err)
	return
	}
	- err = makeActivityPost(p, fullActor.Inbox, am)
	+ err = makeActivityPost(app.cfg.App.Host, p, fullActor.Inbox, am)
	if err != nil {
	log.Error("Unable to make activity POST: %v", err)
	return
	}

	if isFollow {
	t, err := app.db.Begin()
	if err != nil {
	log.Error("Unable to start transaction: %v", err)
	return
	}

	var followerID int64

	if remoteUser != nil {
	followerID = remoteUser.ID
	} else {
	// Add follower locally, since it wasn't found before
	res, err := t.Exec("INSERT INTO remoteusers (actor_id, inbox, shared_inbox) VALUES (?, ?, ?)", fullActor.ID, fullActor.Inbox, fullActor.Endpoints.SharedInbox)
	if err != nil {
	if !app.db.isDuplicateKeyErr(err) {
	t.Rollback()
	log.Error("Couldn't add new remoteuser in DB: %v\n", err)
	return
	}
	}

	followerID, err = res.LastInsertId()
	if err != nil {
	t.Rollback()
	log.Error("no lastinsertid for followers, rolling back: %v", err)
	return
	}

	// Add in key
	_, err = t.Exec("INSERT INTO remoteuserkeys (id, remote_user_id, public_key) VALUES (?, ?, ?)", fullActor.PublicKey.ID, followerID, fullActor.PublicKey.PublicKeyPEM)
	if err != nil {
	if !app.db.isDuplicateKeyErr(err) {
	t.Rollback()
	log.Error("Couldn't add follower keys in DB: %v\n", err)
	return
	}
	}
	}

	// Add follow
	_, err = t.Exec("INSERT INTO remotefollows (collection_id, remote_user_id, created) VALUES (?, ?, "+app.db.now()+")", c.ID, followerID)
	if err != nil {
	if !app.db.isDuplicateKeyErr(err) {
	t.Rollback()
	log.Error("Couldn't add follower in DB: %v\n", err)
	return
	}
	}

	err = t.Commit()
	if err != nil {
	t.Rollback()
	log.Error("Rolling back after Commit(): %v\n", err)
	return
	}
	} else if isUnfollow {
	// Remove follower locally
	_, err = app.db.Exec("DELETE FROM remotefollows WHERE collection_id = ? AND remote_user_id = (SELECT id FROM remoteusers WHERE actor_id = ?)", c.ID, to.String())
	if err != nil {
	log.Error("Couldn't remove follower from DB: %v\n", err)
	}
	}
	}()

	return nil
	}

	-func makeActivityPost(p *activitystreams.Person, url string, m interface{}) error {
	+func makeActivityPost(hostName string, p *activitystreams.Person, url string, m interface{}) error {
	log.Info("POST %s", url)
	b, err := json.Marshal(m)
	if err != nil {
	return err
	}

	r, _ := http.NewRequest("POST", url, bytes.NewBuffer(b))
	r.Header.Add("Content-Type", "application/activity+json")
	r.Header.Set("User-Agent", "Go ("+serverSoftware+"/"+softwareVer+"; +"+hostName+")")
	h := sha256.New()
	h.Write(b)
	r.Header.Add("Digest", "SHA-256="+base64.StdEncoding.EncodeToString(h.Sum(nil)))

	// Sign using the 'Signature' header
	privKey, err := activitypub.DecodePrivateKey(p.GetPrivKey())
	if err != nil {
	return err
	}
	signer := httpsig.NewSigner(p.PublicKey.ID, privKey, httpsig.RSASHA256, []string{"(request-target)", "date", "host", "digest"})
	err = signer.SignSigHeader(r)
	if err != nil {
	log.Error("Can't sign: %v", err)
	}

	if debugging {
	dump, err := httputil.DumpRequestOut(r, true)
	if err != nil {
	log.Error("Can't dump: %v", err)
	} else {
	log.Info("%s", dump)
	}
	}

	resp, err := http.DefaultClient.Do(r)
	if err != nil {
	return err
	}
	if resp != nil && resp.Body != nil {
	defer resp.Body.Close()
	}

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
	return err
	}
	if debugging {
	log.Info("Status : %s", resp.Status)
	log.Info("Response: %s", body)
	}

	return nil
	}

	-func resolveIRI(url string) ([]byte, error) {
	+func resolveIRI(hostName, url string) ([]byte, error) {
	log.Info("GET %s", url)

	r, _ := http.NewRequest("GET", url, nil)
	r.Header.Add("Accept", "application/activity+json")
	r.Header.Set("User-Agent", "Go ("+serverSoftware+"/"+softwareVer+"; +"+hostName+")")

	if debugging {
	dump, err := httputil.DumpRequestOut(r, true)
	if err != nil {
	log.Error("Can't dump: %v", err)
	} else {
	log.Info("%s", dump)
	}
	}

	resp, err := http.DefaultClient.Do(r)
	if err != nil {
	return nil, err
	}
	if resp != nil && resp.Body != nil {
	defer resp.Body.Close()
	}

	body, err := ioutil.ReadAll(resp.Body)
	if err != nil {
	return nil, err
	}
	if debugging {
	log.Info("Status : %s", resp.Status)
	log.Info("Response: %s", body)
	}

	return body, nil
	}

	func deleteFederatedPost(app App, p PublicPost, collID int64) error {
	if debugging {
	log.Info("Deleting federated post!")
	}
	actor := p.Collection.PersonObject(collID)
	na := p.ActivityObject()

	// Add followers
	p.Collection.ID = collID
	followers, err := app.db.GetAPFollowers(&p.Collection.Collection)
	if err != nil {
	log.Error("Couldn't delete post (get followers)! %v", err)
	return err
	}

	inboxes := map[string][]string{}
	for _, f := range *followers {
	inbox := f.SharedInbox
	if inbox == "" {
	inbox = f.Inbox
	}
	if _, ok := inboxes[inbox]; ok {
	inboxes[inbox] = append(inboxes[inbox], f.ActorID)
	} else {
	inboxes[inbox] = []string{f.ActorID}
	}
	}

	for si, instFolls := range inboxes {
	na.CC = []string{}
	for _, f := range instFolls {
	na.CC = append(na.CC, f)
	}

	- err = makeActivityPost(actor, si, activitystreams.NewDeleteActivity(na))
	+ err = makeActivityPost(app.cfg.App.Host, actor, si, activitystreams.NewDeleteActivity(na))
	if err != nil {
	log.Error("Couldn't delete post! %v", err)
	}
	}
	return nil
	}

	func federatePost(app App, p PublicPost, collID int64, isUpdate bool) error {
	if debugging {
	if isUpdate {
	log.Info("Federating updated post!")
	} else {
	log.Info("Federating new post!")
	}
	}
	actor := p.Collection.PersonObject(collID)
	na := p.ActivityObject()

	// Add followers
	p.Collection.ID = collID
	followers, err := app.db.GetAPFollowers(&p.Collection.Collection)
	if err != nil {
	log.Error("Couldn't post! %v", err)
	return err
	}
	log.Info("Followers for %d: %+v", collID, followers)

	inboxes := map[string][]string{}
	for _, f := range *followers {
	inbox := f.SharedInbox
	if inbox == "" {
	inbox = f.Inbox
	}
	if _, ok := inboxes[inbox]; ok {
	inboxes[inbox] = append(inboxes[inbox], f.ActorID)
	} else {
	inboxes[inbox] = []string{f.ActorID}
	}
	}

	for si, instFolls := range inboxes {
	na.CC = []string{}
	for _, f := range instFolls {
	na.CC = append(na.CC, f)
	}
	var activity *activitystreams.Activity
	if isUpdate {
	activity = activitystreams.NewUpdateActivity(na)
	} else {
	activity = activitystreams.NewCreateActivity(na)
	activity.To = na.To
	activity.CC = na.CC
	}
	- err = makeActivityPost(actor, si, activity)
	+ err = makeActivityPost(app.cfg.App.Host, actor, si, activity)
	if err != nil {
	log.Error("Couldn't post! %v", err)
	}
	}
	return nil
	}

	func getRemoteUser(app App, actorID string) (RemoteUser, error) {
	u := RemoteUser{ActorID: actorID}
	err := app.db.QueryRow("SELECT id, inbox, shared_inbox FROM remoteusers WHERE actor_id = ?", actorID).Scan(&u.ID, &u.Inbox, &u.SharedInbox)
	switch {
	case err == sql.ErrNoRows:
	return nil, impart.HTTPError{http.StatusNotFound, "No remote user with that ID."}
	case err != nil:
	log.Error("Couldn't get remote user %s: %v", actorID, err)
	return nil, err
	}

	return &u, nil
	}

	func getActor(app App, actorIRI string) (activitystreams.Person, *RemoteUser, error) {
	log.Info("Fetching actor %s locally", actorIRI)
	actor := &activitystreams.Person{}
	remoteUser, err := getRemoteUser(app, actorIRI)
	if err != nil {
	if iErr, ok := err.(impart.HTTPError); ok {
	if iErr.Status == http.StatusNotFound {
	// Fetch remote actor
	log.Info("Not found; fetching actor %s remotely", actorIRI)
	- actorResp, err := resolveIRI(actorIRI)
	+ actorResp, err := resolveIRI(app.cfg.App.Host, actorIRI)
	if err != nil {
	log.Error("Unable to get actor! %v", err)
	return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't fetch actor."}
	}
	if err := unmarshalActor(actorResp, actor); err != nil {
	log.Error("Unable to unmarshal actor! %v", err)
	return nil, nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't parse actor."}
	}
	} else {
	return nil, nil, err
	}
	} else {
	return nil, nil, err
	}
	} else {
	actor = remoteUser.AsPerson()
	}
	return actor, remoteUser, nil
	}

	// unmarshal actor normalizes the actor response to conform to
	// the type Person from github.com/writeas/web-core/activitysteams
	//
	// some implementations return different context field types
	// this converts any non-slice contexts into a slice
	func unmarshalActor(actorResp []byte, actor *activitystreams.Person) error {
	// FIXME: Hubzilla has an object for the Actor's url: cannot unmarshal object into Go struct field Person.url of type string

	// flexActor overrides the Context field to allow
	// all valid representations during unmarshal
	flexActor := struct {
	activitystreams.Person
	Context json.RawMessage `json:"@context,omitempty"`
	}{}
	if err := json.Unmarshal(actorResp, &flexActor); err != nil {
	return err
	}

	actor.Endpoints = flexActor.Endpoints
	actor.Followers = flexActor.Followers
	actor.Following = flexActor.Following
	actor.ID = flexActor.ID
	actor.Icon = flexActor.Icon
	actor.Inbox = flexActor.Inbox
	actor.Name = flexActor.Name
	actor.Outbox = flexActor.Outbox
	actor.PreferredUsername = flexActor.PreferredUsername
	actor.PublicKey = flexActor.PublicKey
	actor.Summary = flexActor.Summary
	actor.Type = flexActor.Type
	actor.URL = flexActor.URL

	func(val interface{}) {
	switch val.(type) {
	case []interface{}:
	// already a slice, do nothing
	actor.Context = val.([]interface{})
	default:
	actor.Context = []interface{}{val}
	}
	}(flexActor.Context)

	return nil
	}
	diff --git a/app.go b/app.go
	index e970a77..a0864c4 100644
	--- a/app.go
	+++ b/app.go
	@@ -1,726 +1,722 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"fmt"
	"html/template"
	"io/ioutil"
	"net/http"
	"net/url"
	"os"
	"os/signal"
	"path/filepath"
	"regexp"
	"strings"
	"syscall"
	"time"

	"github.com/gorilla/mux"
	"github.com/gorilla/schema"
	"github.com/gorilla/sessions"
	"github.com/manifoldco/promptui"
	"github.com/writeas/go-strip-markdown"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/converter"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/author"
	"github.com/writeas/writefreely/config"
	"github.com/writeas/writefreely/key"
	"github.com/writeas/writefreely/migrations"
	"github.com/writeas/writefreely/page"
	)

	const (
	staticDir = "static"
	assumedTitleLen = 80
	postsPerPage = 10

	serverSoftware = "WriteFreely"
	softwareURL = "https://writefreely.org"
	)

	var (
	debugging bool

	// Software version can be set from git env using -ldflags
	softwareVer = "0.9.0"

	// DEPRECATED VARS
	- // TODO: pass app.cfg into GetCollection* calls so we can get these values
	- // from Collection methods and we no longer need these.
	- hostName string
	isSingleUser bool
	)

	// App holds data and configuration for an individual WriteFreely instance.
	type App struct {
	router *mux.Router
	shttp *http.ServeMux
	db *datastore
	cfg *config.Config
	cfgFile string
	keys *key.Keychain
	sessionStore *sessions.CookieStore
	formDecoder *schema.Decoder

	timeline *localTimeline
	}

	// DB returns the App's datastore
	func (app App) DB() datastore {
	return app.db
	}

	// Router returns the App's router
	func (app App) Router() mux.Router {
	return app.router
	}

	// Config returns the App's current configuration.
	func (app App) Config() config.Config {
	return app.cfg
	}

	// SetConfig updates the App's Config to the given value.
	func (app App) SetConfig(cfg config.Config) {
	app.cfg = cfg
	}

	// SetKeys updates the App's Keychain to the given value.
	func (app App) SetKeys(k key.Keychain) {
	app.keys = k
	}

	// Apper is the interface for getting data into and out of a WriteFreely
	// instance (or "App").
	//
	// App returns the App for the current instance.
	//
	// LoadConfig reads an app configuration into the App, returning any error
	// encountered.
	//
	// SaveConfig persists the current App configuration.
	//
	// LoadKeys reads the App's encryption keys and loads them into its
	// key.Keychain.
	type Apper interface {
	App() *App

	LoadConfig() error
	SaveConfig(*config.Config) error

	LoadKeys() error
	}

	// App returns the App
	func (app App) App() App {
	return app
	}

	// LoadConfig loads and parses a config file.
	func (app *App) LoadConfig() error {
	log.Info("Loading %s configuration...", app.cfgFile)
	cfg, err := config.Load(app.cfgFile)
	if err != nil {
	log.Error("Unable to load configuration: %v", err)
	os.Exit(1)
	return err
	}
	app.cfg = cfg
	return nil
	}

	// SaveConfig saves the given Config to disk -- namely, to the App's cfgFile.
	func (app App) SaveConfig(c config.Config) error {
	return config.Save(c, app.cfgFile)
	}

	// LoadKeys reads all needed keys from disk into the App. In order to use the
	// configured `Server.KeysParentDir`, you must call initKeyPaths(App) before
	// this.
	func (app *App) LoadKeys() error {
	var err error
	app.keys = &key.Keychain{}

	if debugging {
	log.Info(" %s", emailKeyPath)
	}
	app.keys.EmailKey, err = ioutil.ReadFile(emailKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieAuthKeyPath)
	}
	app.keys.CookieAuthKey, err = ioutil.ReadFile(cookieAuthKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieKeyPath)
	}
	app.keys.CookieKey, err = ioutil.ReadFile(cookieKeyPath)
	if err != nil {
	return err
	}

	return nil
	}

	// handleViewHome shows page at root path. Will be the Pad if logged in and the
	// catch-all landing page otherwise.
	func handleViewHome(app App, w http.ResponseWriter, r http.Request) error {
	if app.cfg.App.SingleUser {
	// Render blog index
	return handleViewCollection(app, w, r)
	}

	// Multi-user instance
	u := getUserSession(app, r)
	if u != nil {
	// User is logged in, so show the Pad
	return handleViewPad(app, w, r)
	}

	if land := app.cfg.App.LandingPath(); land != "/" {
	return impart.HTTPError{http.StatusFound, land}
	}

	p := struct {
	page.StaticPage
	Flashes []template.HTML
	}{
	StaticPage: pageForReq(app, r),
	}

	// Get error messages
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session in handleViewHome; ignoring: %v", err)
	}
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}

	// Show landing page
	return renderPage(w, "landing.tmpl", p)
	}

	func handleTemplatedPage(app App, w http.ResponseWriter, r http.Request, t *template.Template) error {
	p := struct {
	page.StaticPage
	ContentTitle string
	Content template.HTML
	PlainContent string
	Updated string

	AboutStats *InstanceStats
	}{
	StaticPage: pageForReq(app, r),
	}
	if r.URL.Path == "/about" \|\| r.URL.Path == "/privacy" {
	var c *instanceContent
	var err error

	if r.URL.Path == "/about" {
	c, err = getAboutPage(app)

	// Fetch stats
	p.AboutStats = &InstanceStats{}
	p.AboutStats.NumPosts, _ = app.db.GetTotalPosts()
	p.AboutStats.NumBlogs, _ = app.db.GetTotalCollections()
	} else {
	c, err = getPrivacyPage(app)
	}

	if err != nil {
	return err
	}
	p.ContentTitle = c.Title.String
	p.Content = template.HTML(applyMarkdown([]byte(c.Content), ""))
	p.PlainContent = shortPostDescription(stripmd.Strip(c.Content))
	if !c.Updated.IsZero() {
	p.Updated = c.Updated.Format("January 2, 2006")
	}
	}

	// Serve templated page
	err := t.ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render page: %v", err)
	}
	return nil
	}

	func pageForReq(app App, r http.Request) page.StaticPage {
	p := page.StaticPage{
	AppCfg: app.cfg.App,
	Path: r.URL.Path,
	Version: "v" + softwareVer,
	}

	// Add user information, if given
	var u *User
	accessToken := r.FormValue("t")
	if accessToken != "" {
	userID := app.db.GetUserID(accessToken)
	if userID != -1 {
	var err error
	u, err = app.db.GetUserByID(userID)
	if err == nil {
	p.Username = u.Username
	}
	}
	} else {
	u = getUserSession(app, r)
	if u != nil {
	p.Username = u.Username
	}
	}

	return p
	}

	var fileRegex = regexp.MustCompile("/([^/]\\.[^/])$")

	// Initialize loads the app configuration and initializes templates, keys,
	// session, route handlers, and the database connection.
	func Initialize(apper Apper, debug bool) (*App, error) {
	debugging = debug

	apper.LoadConfig()

	// Load templates
	err := InitTemplates(apper.App().Config())
	if err != nil {
	return nil, fmt.Errorf("load templates: %s", err)
	}

	// Load keys and set up session
	initKeyPaths(apper.App()) // TODO: find a better way to do this, since it's unneeded in all Apper implementations
	err = InitKeys(apper)
	if err != nil {
	return nil, fmt.Errorf("init keys: %s", err)
	}
	apper.App().InitSession()

	apper.App().InitDecoder()

	err = ConnectToDatabase(apper.App())
	if err != nil {
	return nil, fmt.Errorf("connect to DB: %s", err)
	}

	// Handle local timeline, if enabled
	if apper.App().cfg.App.LocalTimeline {
	log.Info("Initializing local timeline...")
	initLocalTimeline(apper.App())
	}

	return apper.App(), nil
	}

	func Serve(app App, r mux.Router) {
	log.Info("Going to serve...")

	- hostName = app.cfg.App.Host
	isSingleUser = app.cfg.App.SingleUser
	app.cfg.Server.Dev = debugging

	// Handle shutdown
	c := make(chan os.Signal, 2)
	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
	go func() {
	<-c
	log.Info("Shutting down...")
	shutdown(app)
	log.Info("Done.")
	os.Exit(0)
	}()

	// Start web application server
	var bindAddress = app.cfg.Server.Bind
	if bindAddress == "" {
	bindAddress = "localhost"
	}
	var err error
	if app.cfg.IsSecureStandalone() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	go func() {
	err = http.ListenAndServe(
	fmt.Sprintf("%s:80", bindAddress), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	http.Redirect(w, r, app.cfg.App.Host, http.StatusMovedPermanently)
	}))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("---")
	err = http.ListenAndServeTLS(
	fmt.Sprintf("%s:443", bindAddress), app.cfg.Server.TLSCertPath, app.cfg.Server.TLSKeyPath, r)
	} else {
	log.Info("Serving on http://%s:%d\n", bindAddress, app.cfg.Server.Port)
	log.Info("---")
	err = http.ListenAndServe(fmt.Sprintf("%s:%d", bindAddress, app.cfg.Server.Port), r)
	}
	if err != nil {
	log.Error("Unable to start: %v", err)
	os.Exit(1)
	}
	}

	func (app *App) InitDecoder() {
	// TODO: do this at the package level, instead of the App level
	// Initialize modules
	app.formDecoder = schema.NewDecoder()
	app.formDecoder.RegisterConverter(converter.NullJSONString{}, converter.ConvertJSONNullString)
	app.formDecoder.RegisterConverter(converter.NullJSONBool{}, converter.ConvertJSONNullBool)
	app.formDecoder.RegisterConverter(sql.NullString{}, converter.ConvertSQLNullString)
	app.formDecoder.RegisterConverter(sql.NullBool{}, converter.ConvertSQLNullBool)
	app.formDecoder.RegisterConverter(sql.NullInt64{}, converter.ConvertSQLNullInt64)
	app.formDecoder.RegisterConverter(sql.NullFloat64{}, converter.ConvertSQLNullFloat64)
	}

	// ConnectToDatabase validates and connects to the configured database, then
	// tests the connection.
	func ConnectToDatabase(app *App) error {
	// Check database configuration
	if app.cfg.Database.Type == driverMySQL && (app.cfg.Database.User == "" \|\| app.cfg.Database.Password == "") {
	return fmt.Errorf("Database user or password not set.")
	}
	if app.cfg.Database.Host == "" {
	app.cfg.Database.Host = "localhost"
	}
	if app.cfg.Database.Database == "" {
	app.cfg.Database.Database = "writefreely"
	}

	// TODO: check err
	connectToDatabase(app)

	// Test database connection
	err := app.db.Ping()
	if err != nil {
	return fmt.Errorf("Database ping failed: %s", err)
	}

	return nil
	}

	// OutputVersion prints out the version of the application.
	func OutputVersion() {
	fmt.Println(serverSoftware + " " + softwareVer)
	}

	// NewApp creates a new app instance.
	func NewApp(cfgFile string) *App {
	return &App{
	cfgFile: cfgFile,
	}
	}

	// CreateConfig creates a default configuration and saves it to the app's cfgFile.
	func CreateConfig(app *App) error {
	log.Info("Creating configuration...")
	c := config.New()
	log.Info("Saving configuration %s...", app.cfgFile)
	err := config.Save(c, app.cfgFile)
	if err != nil {
	return fmt.Errorf("Unable to save configuration: %v", err)
	}
	return nil
	}

	// DoConfig runs the interactive configuration process.
	func DoConfig(app *App) {
	d, err := config.Configure(app.cfgFile)
	if err != nil {
	log.Error("Unable to configure: %v", err)
	os.Exit(1)
	}
	if d.User != nil {
	app.cfg = d.Config
	connectToDatabase(app)
	defer shutdown(app)

	if !app.db.DatabaseInitialized() {
	err = adminInitDatabase(app)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	}

	u := &User{
	Username: d.User.Username,
	HashedPass: d.User.HashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	// Create blog
	log.Info("Creating user %s...\n", u.Username)
	err = app.db.CreateUser(u, app.cfg.App.SiteName)
	if err != nil {
	log.Error("Unable to create user: %s", err)
	os.Exit(1)
	}
	log.Info("Done!")
	}
	os.Exit(0)
	}

	// GenerateKeyFiles creates app encryption keys and saves them into the configured KeysParentDir.
	func GenerateKeyFiles(app *App) error {
	// Read keys path from config
	app.LoadConfig()

	// Create keys dir if it doesn't exist yet
	fullKeysDir := filepath.Join(app.cfg.Server.KeysParentDir, keysDir)
	if _, err := os.Stat(fullKeysDir); os.IsNotExist(err) {
	err = os.Mkdir(fullKeysDir, 0700)
	if err != nil {
	return err
	}
	}

	// Generate keys
	initKeyPaths(app)
	var keyErrs error
	err := generateKey(emailKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieAuthKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieKeyPath)
	if err != nil {
	keyErrs = err
	}

	return keyErrs
	}

	// CreateSchema creates all database tables needed for the application.
	func CreateSchema(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())
	err := adminInitDatabase(apper.App())
	if err != nil {
	return err
	}
	return nil
	}

	// Migrate runs all necessary database migrations.
	func Migrate(app *App) error {
	app.LoadConfig()
	connectToDatabase(app)
	defer shutdown(app)

	err := migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}
	return nil
	}

	// ResetPassword runs the interactive password reset process.
	func ResetPassword(app *App, username string) error {
	// Connect to the database
	app.LoadConfig()
	connectToDatabase(app)
	defer shutdown(app)

	// Fetch user
	u, err := app.db.GetUserForAuth(username)
	if err != nil {
	log.Error("Get user: %s", err)
	os.Exit(1)
	}

	// Prompt for new password
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: "New password",
	Mask: '*',
	}
	newPass, err := prompt.Run()
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}

	// Do the update
	log.Info("Updating...")
	err = adminResetPassword(app, u, newPass)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	func connectToDatabase(app *App) {
	log.Info("Connecting to %s database...", app.cfg.Database.Type)

	var db *sql.DB
	var err error
	if app.cfg.Database.Type == driverMySQL {
	db, err = sql.Open(app.cfg.Database.Type, fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=true&loc=%s", app.cfg.Database.User, app.cfg.Database.Password, app.cfg.Database.Host, app.cfg.Database.Port, app.cfg.Database.Database, url.QueryEscape(time.Local.String())))
	db.SetMaxOpenConns(50)
	} else if app.cfg.Database.Type == driverSQLite {
	if !SQLiteEnabled {
	log.Error("Invalid database type '%s'. Binary wasn't compiled with SQLite3 support.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if app.cfg.Database.FileName == "" {
	log.Error("SQLite database filename value in config.ini is empty.")
	os.Exit(1)
	}
	db, err = sql.Open("sqlite3_with_regex", app.cfg.Database.FileName+"?parseTime=true&cached=shared")
	db.SetMaxOpenConns(1)
	} else {
	log.Error("Invalid database type '%s'. Only 'mysql' and 'sqlite3' are supported right now.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	app.db = &datastore{db, app.cfg.Database.Type}
	}

	func shutdown(app *App) {
	log.Info("Closing database connection...")
	app.db.Close()
	}

	// CreateUser creates a new admin or normal user from the given credentials.
	func CreateUser(apper Apper, username, password string, isAdmin bool) error {
	// Create an admin user with --create-admin
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Ensure an admin / first user doesn't already exist
	firstUser, _ := apper.App().db.GetUserByID(1)
	if isAdmin {
	// Abort if trying to create admin user, but one already exists
	if firstUser != nil {
	return fmt.Errorf("Admin user already exists (%s). Create a regular user with: writefreely --create-user", firstUser.Username)
	}
	} else {
	// Abort if trying to create regular user, but no admin exists yet
	if firstUser == nil {
	return fmt.Errorf("No admin user exists yet. Create an admin first with: writefreely --create-admin")
	}
	}

	// Create the user
	// Normalize and validate username
	desiredUsername := username
	username = getSlug(username, "")

	usernameDesc := username
	if username != desiredUsername {
	usernameDesc += " (originally: " + desiredUsername + ")"
	}

	if !author.IsValidUsername(apper.App().cfg, username) {
	return fmt.Errorf("Username %s is invalid, reserved, or shorter than configured minimum length (%d characters).", usernameDesc, apper.App().cfg.App.MinUsernameLen)
	}

	// Hash the password
	hashedPass, err := auth.HashPass([]byte(password))
	if err != nil {
	return fmt.Errorf("Unable to hash password: %v", err)
	}

	u := &User{
	Username: username,
	HashedPass: hashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	userType := "user"
	if isAdmin {
	userType = "admin"
	}
	log.Info("Creating %s %s...", userType, usernameDesc)
	err = apper.App().db.CreateUser(u, desiredUsername)
	if err != nil {
	return fmt.Errorf("Unable to create user: %s", err)
	}
	log.Info("Done!")
	return nil
	}

	func adminInitDatabase(app *App) error {
	schemaFileName := "schema.sql"
	if app.cfg.Database.Type == driverSQLite {
	schemaFileName = "sqlite.sql"
	}

	schema, err := Asset(schemaFileName)
	if err != nil {
	return fmt.Errorf("Unable to load schema file: %v", err)
	}

	tblReg := regexp.MustCompile("CREATE TABLE (IF NOT EXISTS )?`([a-z_]+)`")

	queries := strings.Split(string(schema), ";\n")
	for _, q := range queries {
	if strings.TrimSpace(q) == "" {
	continue
	}
	parts := tblReg.FindStringSubmatch(q)
	if len(parts) >= 3 {
	log.Info("Creating table %s...", parts[2])
	} else {
	log.Info("Creating table ??? (Weird query) No match in: %v", parts)
	}
	_, err = app.db.Exec(q)
	if err != nil {
	log.Error("%s", err)
	} else {
	log.Info("Created.")
	}
	}

	// Set up migrations table
	log.Info("Initializing appmigrations table...")
	err = migrations.SetInitialMigrations(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("Unable to set initial migrations: %v", err)
	}

	log.Info("Running migrations...")
	err = migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}

	log.Info("Done.")
	return nil
	}
	diff --git a/collections.go b/collections.go
	index eb9fcab..1a8ceca 100644
	--- a/collections.go
	+++ b/collections.go
	@@ -1,1057 +1,1062 @@
	/*
	* Copyright © 2018 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"encoding/json"
	"fmt"
	"html/template"
	"math"
	"net/http"
	"net/url"
	"regexp"
	"strconv"
	"strings"
	"unicode"

	"github.com/gorilla/mux"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/activitystreams"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/bots"
	"github.com/writeas/web-core/log"
	waposts "github.com/writeas/web-core/posts"
	"github.com/writeas/writefreely/author"
	"github.com/writeas/writefreely/page"
	)

	type (
	// TODO: add Direction to db
	// TODO: add Language to db
	Collection struct {
	ID int64 `datastore:"id" json:"-"`
	Alias string `datastore:"alias" schema:"alias" json:"alias"`
	Title string `datastore:"title" schema:"title" json:"title"`
	Description string `datastore:"description" schema:"description" json:"description"`
	Direction string `schema:"dir" json:"dir,omitempty"`
	Language string `schema:"lang" json:"lang,omitempty"`
	StyleSheet string `datastore:"style_sheet" schema:"style_sheet" json:"style_sheet"`
	Script string `datastore:"script" schema:"script" json:"script,omitempty"`
	Public bool `datastore:"public" json:"public"`
	Visibility collVisibility `datastore:"private" json:"-"`
	Format string `datastore:"format" json:"format,omitempty"`
	Views int64 `json:"views"`
	OwnerID int64 `datastore:"owner_id" json:"-"`
	PublicOwner bool `datastore:"public_owner" json:"-"`
	URL string `json:"url,omitempty"`

	- db *datastore
	+ db *datastore
	+ hostName string
	}
	CollectionObj struct {
	Collection
	TotalPosts int `json:"total_posts"`
	Owner *User `json:"owner,omitempty"`
	Posts *[]PublicPost `json:"posts,omitempty"`
	}
	DisplayCollection struct {
	*CollectionObj
	Prefix string
	IsTopLevel bool
	CurrentPage int
	TotalPages int
	Format *CollectionFormat
	}
	SubmittedCollection struct {
	// Data used for updating a given collection
	ID int64
	OwnerID uint64

	// Form helpers
	PreferURL string `schema:"prefer_url" json:"prefer_url"`
	Privacy int `schema:"privacy" json:"privacy"`
	Pass string `schema:"password" json:"password"`
	MathJax bool `schema:"mathjax" json:"mathjax"`
	Handle string `schema:"handle" json:"handle"`

	// Actual collection values updated in the DB
	Alias *string `schema:"alias" json:"alias"`
	Title *string `schema:"title" json:"title"`
	Description *string `schema:"description" json:"description"`
	StyleSheet *sql.NullString `schema:"style_sheet" json:"style_sheet"`
	Script *sql.NullString `schema:"script" json:"script"`
	Visibility *int `schema:"visibility" json:"public"`
	Format *sql.NullString `schema:"format" json:"format"`
	}
	CollectionFormat struct {
	Format string
	}

	collectionReq struct {
	// Information about the collection request itself
	prefix, alias, domain string
	isCustomDomain bool

	// User-related fields
	isCollOwner bool
	}
	)

	func (sc *SubmittedCollection) FediverseHandle() string {
	if sc.Handle == "" {
	return apCustomHandleDefault
	}
	return getSlug(sc.Handle, "")
	}

	// collVisibility represents the visibility level for the collection.
	type collVisibility int

	// Visibility levels. Values are bitmasks, stored in the database as
	// decimal numbers. If adding types, append them to this list. If removing,
	// replace the desired visibility with a new value.
	const CollUnlisted collVisibility = 0
	const (
	CollPublic collVisibility = 1 << iota
	CollPrivate
	CollProtected
	)

	func (cf *CollectionFormat) Ascending() bool {
	return cf.Format == "novel"
	}
	func (cf *CollectionFormat) ShowDates() bool {
	return cf.Format == "blog"
	}
	func (cf *CollectionFormat) PostsPerPage() int {
	if cf.Format == "novel" {
	return postsPerPage
	}
	return postsPerPage
	}

	// Valid returns whether or not a format value is valid.
	func (cf *CollectionFormat) Valid() bool {
	return cf.Format == "blog" \|\|
	cf.Format == "novel" \|\|
	cf.Format == "notebook"
	}

	// NewFormat creates a new CollectionFormat object from the Collection.
	func (c Collection) NewFormat() CollectionFormat {
	cf := &CollectionFormat{Format: c.Format}

	// Fill in default format
	if cf.Format == "" {
	cf.Format = "blog"
	}

	return cf
	}

	func (c *Collection) IsUnlisted() bool {
	return c.Visibility == 0
	}

	func (c *Collection) IsPrivate() bool {
	return c.Visibility&CollPrivate != 0
	}

	func (c *Collection) IsProtected() bool {
	return c.Visibility&CollProtected != 0
	}

	func (c *Collection) IsPublic() bool {
	return c.Visibility&CollPublic != 0
	}

	func (c *Collection) FriendlyVisibility() string {
	if c.IsPrivate() {
	return "Private"
	}
	if c.IsPublic() {
	return "Public"
	}
	if c.IsProtected() {
	return "Password-protected"
	}
	return "Unlisted"
	}

	func (c *Collection) ShowFooterBranding() bool {
	// TODO: implement this setting
	return true
	}

	// CanonicalURL returns a fully-qualified URL to the collection.
	func (c *Collection) CanonicalURL() string {
	return c.RedirectingCanonicalURL(false)
	}

	func (c *Collection) DisplayCanonicalURL() string {
	us := c.CanonicalURL()
	u, err := url.Parse(us)
	if err != nil {
	return us
	}
	p := u.Path
	if p == "/" {
	p = ""
	}
	return u.Hostname() + p
	}

	func (c *Collection) RedirectingCanonicalURL(isRedir bool) string {
	if isSingleUser {
	- return hostName + "/"
	+ return c.hostName + "/"
	}

	- return fmt.Sprintf("%s/%s/", hostName, c.Alias)
	+ return fmt.Sprintf("%s/%s/", c.hostName, c.Alias)
	}

	// PrevPageURL provides a full URL for the previous page of collection posts,
	// returning a /page/N result for pages >1
	func (c *Collection) PrevPageURL(prefix string, n int, tl bool) string {
	u := ""
	if n == 2 {
	// Previous page is 1; no need for /page/ prefix
	if prefix == "" {
	u = "/"
	}
	// Else leave off trailing slash
	} else {
	u = fmt.Sprintf("/page/%d", n-1)
	}

	if tl {
	return u
	}
	return "/" + prefix + c.Alias + u
	}

	// NextPageURL provides a full URL for the next page of collection posts
	func (c *Collection) NextPageURL(prefix string, n int, tl bool) string {
	if tl {
	return fmt.Sprintf("/page/%d", n+1)
	}
	return fmt.Sprintf("/%s%s/page/%d", prefix, c.Alias, n+1)
	}

	func (c *Collection) DisplayTitle() string {
	if c.Title != "" {
	return c.Title
	}
	return c.Alias
	}

	func (c *Collection) StyleSheetDisplay() template.CSS {
	return template.CSS(c.StyleSheet)
	}

	// ForPublic modifies the Collection for public consumption, such as via
	// the API.
	func (c *Collection) ForPublic() {
	c.URL = c.CanonicalURL()
	}

	var isAvatarChar = regexp.MustCompile("[a-z0-9]").MatchString

	func (c Collection) PersonObject(ids ...int64) activitystreams.Person {
	accountRoot := c.FederatedAccount()
	p := activitystreams.NewPerson(accountRoot)
	p.URL = c.CanonicalURL()
	uname := c.Alias
	p.PreferredUsername = uname
	p.Name = c.DisplayTitle()
	p.Summary = c.Description
	if p.Name != "" {
	if av := c.AvatarURL(); av != "" {
	p.Icon = activitystreams.Image{
	Type: "Image",
	MediaType: "image/png",
	URL: av,
	}
	}
	}

	collID := c.ID
	if len(ids) > 0 {
	collID = ids[0]
	}
	pub, priv := c.db.GetAPActorKeys(collID)
	if pub != nil {
	p.AddPubKey(pub)
	p.SetPrivKey(priv)
	}

	return p
	}

	func (c *Collection) AvatarURL() string {
	fl := string(unicode.ToLower([]rune(c.DisplayTitle())[0]))
	if !isAvatarChar(fl) {
	return ""
	}
	- return hostName + "/img/avatars/" + fl + ".png"
	+ return c.hostName + "/img/avatars/" + fl + ".png"
	}

	func (c *Collection) FederatedAPIBase() string {
	- return hostName + "/"
	+ return c.hostName + "/"
	}

	func (c *Collection) FederatedAccount() string {
	accountUser := c.Alias
	return c.FederatedAPIBase() + "api/collections/" + accountUser
	}

	func (c *Collection) RenderMathJax() bool {
	return c.db.CollectionHasAttribute(c.ID, "render_mathjax")
	}

	func newCollection(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	alias := r.FormValue("alias")
	title := r.FormValue("title")

	var missingParams, accessToken string
	var u *User
	c := struct {
	Alias string `json:"alias" schema:"alias"`
	Title string `json:"title" schema:"title"`
	Web bool `json:"web" schema:"web"`
	}{}
	if reqJSON {
	// Decode JSON request
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&c)
	if err != nil {
	log.Error("Couldn't parse post update JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	// TODO: move form parsing to formDecoder
	c.Alias = alias
	c.Title = title
	}

	if c.Alias == "" {
	if c.Title != "" {
	// If only a title was given, just use it to generate the alias.
	c.Alias = getSlug(c.Title, "")
	} else {
	missingParams += "`alias` "
	}
	}
	if c.Title == "" {
	missingParams += "`title` "
	}
	if missingParams != "" {
	return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Parameter(s) %srequired.", missingParams)}
	}

	if reqJSON && !c.Web {
	accessToken = r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}
	} else {
	u = getUserSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}
	}

	if !author.IsValidUsername(app.cfg, c.Alias) {
	return impart.HTTPError{http.StatusPreconditionFailed, "Collection alias isn't valid."}
	}

	var coll *Collection
	var err error
	if accessToken != "" {
	coll, err = app.db.CreateCollectionFromToken(c.Alias, c.Title, accessToken)
	if err != nil {
	// TODO: handle this
	return err
	}
	} else {
	coll, err = app.db.CreateCollection(c.Alias, c.Title, u.ID)
	if err != nil {
	// TODO: handle this
	return err
	}
	}

	res := &CollectionObj{Collection: *coll}

	if reqJSON {
	return impart.WriteSuccess(w, res, http.StatusCreated)
	}
	redirectTo := "/me/c/"
	// TODO: redirect to pad when necessary
	return impart.HTTPError{http.StatusFound, redirectTo}
	}

	func apiCheckCollectionPermissions(app App, r http.Request, c *Collection) (int64, error) {
	accessToken := r.Header.Get("Authorization")
	var userID int64 = -1
	if accessToken != "" {
	userID = app.db.GetUserID(accessToken)
	}
	isCollOwner := userID == c.OwnerID
	if c.IsPrivate() && !isCollOwner {
	// Collection is private, but user isn't authenticated
	return -1, ErrCollectionNotFound
	}
	if c.IsProtected() {
	// TODO: check access token
	return -1, ErrCollectionUnauthorizedRead
	}

	return userID, nil
	}

	// fetchCollection handles the API endpoint for retrieving collection data.
	func fetchCollection(app App, w http.ResponseWriter, r http.Request) error {
	accept := r.Header.Get("Accept")
	if strings.Contains(accept, "application/activity+json") {
	return handleFetchCollectionActivities(app, w, r)
	}

	vars := mux.Vars(r)
	alias := vars["alias"]

	// TODO: move this logic into a common getCollection function
	// Get base Collection data
	c, err := app.db.GetCollection(alias)
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host
	+
	// Redirect users who aren't requesting JSON
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	if !reqJSON {
	return impart.HTTPError{http.StatusFound, c.CanonicalURL()}
	}

	// Check permissions
	userID, err := apiCheckCollectionPermissions(app, r, c)
	if err != nil {
	return err
	}
	isCollOwner := userID == c.OwnerID

	// Fetch extra data about the Collection
	res := &CollectionObj{Collection: *c}
	if c.PublicOwner {
	u, err := app.db.GetUserByID(res.OwnerID)
	if err != nil {
	// Log the error and just continue
	log.Error("Error getting user for collection: %v", err)
	} else {
	res.Owner = u
	}
	}
	app.db.GetPostsCount(res, isCollOwner)
	// Strip non-public information
	res.Collection.ForPublic()

	return impart.WriteSuccess(w, res, http.StatusOK)
	}

	// fetchCollectionPosts handles an API endpoint for retrieving a collection's
	// posts.
	func fetchCollectionPosts(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	alias := vars["alias"]

	c, err := app.db.GetCollection(alias)
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	// Check permissions
	userID, err := apiCheckCollectionPermissions(app, r, c)
	if err != nil {
	return err
	}
	isCollOwner := userID == c.OwnerID

	// Get page
	page := 1
	if p := r.FormValue("page"); p != "" {
	pInt, _ := strconv.Atoi(p)
	if pInt > 0 {
	page = pInt
	}
	}

	posts, err := app.db.GetPosts(c, page, isCollOwner, false, false)
	if err != nil {
	return err
	}
	coll := &CollectionObj{Collection: *c, Posts: posts}
	app.db.GetPostsCount(coll, isCollOwner)
	// Strip non-public information
	coll.Collection.ForPublic()

	// Transform post bodies if needed
	if r.FormValue("body") == "html" {
	for _, p := range *coll.Posts {
	p.Content = waposts.ApplyMarkdown([]byte(p.Content))
	}
	}

	return impart.WriteSuccess(w, coll, http.StatusOK)
	}

	type CollectionPage struct {
	page.StaticPage
	*DisplayCollection
	IsCustomDomain bool
	IsWelcome bool
	IsOwner bool
	CanPin bool
	Username string
	Collections *[]Collection
	PinnedPosts *[]PublicPost
	}

	func (c *CollectionObj) ScriptDisplay() template.JS {
	return template.JS(c.Script)
	}

	var jsSourceCommentReg = regexp.MustCompile("(?m)^// src:(.+)$")

	func (c *CollectionObj) ExternalScripts() []template.URL {
	scripts := []template.URL{}
	if c.Script == "" {
	return scripts
	}

	matches := jsSourceCommentReg.FindAllStringSubmatch(c.Script, -1)
	for _, m := range matches {
	scripts = append(scripts, template.URL(strings.TrimSpace(m[1])))
	}
	return scripts
	}

	func (c *CollectionObj) CanShowScript() bool {
	return false
	}

	func processCollectionRequest(cr collectionReq, vars map[string]string, w http.ResponseWriter, r http.Request) error {
	cr.prefix = vars["prefix"]
	cr.alias = vars["collection"]
	// Normalize the URL, redirecting user to consistent post URL
	if cr.alias != strings.ToLower(cr.alias) {
	return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", strings.ToLower(cr.alias))}
	}

	return nil
	}

	// processCollectionPermissions checks the permissions for the given
	// collectionReq, returning a Collection if access is granted; otherwise this
	// renders any necessary collection pages, for example, if requesting a custom
	// domain that doesn't yet have a collection associated, or if a collection
	// requires a password. In either case, this will return nil, nil -- thus both
	// values should ALWAYS be checked to determine whether or not to continue.
	func processCollectionPermissions(app App, cr collectionReq, u User, w http.ResponseWriter, r http.Request) (*Collection, error) {
	// Display collection if this is a collection
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(cr.alias)
	}
	// TODO: verify we don't reveal the existence of a private collection with redirection
	if err != nil {
	if err, ok := err.(impart.HTTPError); ok {
	if err.Status == http.StatusNotFound {
	if cr.isCustomDomain {
	// User is on the site from a custom domain
	//tErr := pages["404-domain.tmpl"].ExecuteTemplate(w, "base", pageForHost(page.StaticPage{}, r))
	//if tErr != nil {
	//log.Error("Unable to render 404-domain page: %v", err)
	//}
	return nil, nil
	}
	if len(cr.alias) >= minIDLen && len(cr.alias) <= maxIDLen {
	// Alias is within post ID range, so just be sure this isn't a post
	if app.db.PostIDExists(cr.alias) {
	// TODO: use StatusFound for vanity post URLs when we implement them
	return nil, impart.HTTPError{http.StatusMovedPermanently, "/" + cr.alias}
	}
	}
	// Redirect if necessary
	newAlias := app.db.GetCollectionRedirect(cr.alias)
	if newAlias != "" {
	return nil, impart.HTTPError{http.StatusFound, "/" + newAlias + "/"}
	}
	}
	}
	return nil, err
	}
	+ c.hostName = app.cfg.App.Host

	// Update CollectionRequest to reflect owner status
	cr.isCollOwner = u != nil && u.ID == c.OwnerID

	// Check permissions
	if !cr.isCollOwner {
	if c.IsPrivate() {
	return nil, ErrCollectionNotFound
	} else if c.IsProtected() {
	uname := ""
	if u != nil {
	uname = u.Username
	}

	// See if we've authorized this collection
	authd := isAuthorizedForCollection(app, c.Alias, r)

	if !authd {
	p := struct {
	page.StaticPage
	*CollectionObj
	Username string
	Next string
	Flashes []template.HTML
	}{
	StaticPage: pageForReq(app, r),
	CollectionObj: &CollectionObj{Collection: *c},
	Username: uname,
	Next: r.FormValue("g"),
	Flashes: []template.HTML{},
	}
	// Get owner information
	p.CollectionObj.Owner, err = app.db.GetUserByID(c.OwnerID)
	if err != nil {
	// Log the error and just continue
	log.Error("Error getting user for collection: %v", err)
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}
	err = templates["password-collection"].ExecuteTemplate(w, "password-collection", p)
	if err != nil {
	log.Error("Unable to render password-collection: %v", err)
	return nil, err
	}
	return nil, nil
	}
	}
	}
	return c, nil
	}

	func checkUserForCollection(app App, cr collectionReq, r http.Request, isPostReq bool) (User, error) {
	u := getUserSession(app, r)
	return u, nil
	}

	func newDisplayCollection(c Collection, cr collectionReq, page int) *DisplayCollection {
	coll := &DisplayCollection{
	CollectionObj: &CollectionObj{Collection: *c},
	CurrentPage: page,
	Prefix: cr.prefix,
	IsTopLevel: isSingleUser,
	Format: c.NewFormat(),
	}
	c.db.GetPostsCount(coll.CollectionObj, cr.isCollOwner)
	return coll
	}

	func getCollectionPage(vars map[string]string) int {
	page := 1
	var p int
	p, _ = strconv.Atoi(vars["page"])
	if p > 0 {
	page = p
	}
	return page
	}

	// handleViewCollection displays the requested Collection
	func handleViewCollection(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	cr := &collectionReq{}

	err := processCollectionRequest(cr, vars, w, r)
	if err != nil {
	return err
	}

	u, err := checkUserForCollection(app, cr, r, false)
	if err != nil {
	return err
	}

	page := getCollectionPage(vars)

	c, err := processCollectionPermissions(app, cr, u, w, r)
	if c == nil \|\| err != nil {
	return err
	}

	// Serve ActivityStreams data now, if requested
	if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
	ac := c.PersonObject()
	ac.Context = []interface{}{activitystreams.Namespace}
	return impart.RenderActivityJSON(w, ac, http.StatusOK)
	}

	// Fetch extra data about the Collection
	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
	coll := newDisplayCollection(c, cr, page)

	coll.TotalPages = int(math.Ceil(float64(coll.TotalPosts) / float64(coll.Format.PostsPerPage())))
	if coll.TotalPages > 0 && page > coll.TotalPages {
	redirURL := fmt.Sprintf("/page/%d", coll.TotalPages)
	if !app.cfg.App.SingleUser {
	redirURL = fmt.Sprintf("/%s%s%s", cr.prefix, coll.Alias, redirURL)
	}
	return impart.HTTPError{http.StatusFound, redirURL}
	}

	coll.Posts, _ = app.db.GetPosts(c, page, cr.isCollOwner, false, false)

	// Serve collection
	displayPage := CollectionPage{
	DisplayCollection: coll,
	StaticPage: pageForReq(app, r),
	IsCustomDomain: cr.isCustomDomain,
	IsWelcome: r.FormValue("greeting") != "",
	}
	var owner *User
	if u != nil {
	displayPage.Username = u.Username
	displayPage.IsOwner = u.ID == coll.OwnerID
	if displayPage.IsOwner {
	// Add in needed information for users viewing their own collection
	owner = u
	displayPage.CanPin = true

	pubColls, err := app.db.GetPublishableCollections(owner)
	if err != nil {
	log.Error("unable to fetch collections: %v", err)
	}
	displayPage.Collections = pubColls
	}
	}
	if owner == nil {
	// Current user doesn't own collection; retrieve owner information
	owner, err = app.db.GetUserByID(coll.OwnerID)
	if err != nil {
	// Log the error and just continue
	log.Error("Error getting user for collection: %v", err)
	}
	}
	displayPage.Owner = owner
	coll.Owner = displayPage.Owner

	// Add more data
	// TODO: fix this mess of collections inside collections
	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj)

	err = templates["collection"].ExecuteTemplate(w, "collection", displayPage)
	if err != nil {
	log.Error("Unable to render collection index: %v", err)
	}

	// Update collection view count
	go func() {
	// Don't update if owner is viewing the collection.
	if u != nil && u.ID == coll.OwnerID {
	return
	}
	// Only update for human views
	if r.Method == "HEAD" \|\| bots.IsBot(r.UserAgent()) {
	return
	}

	_, err := app.db.Exec("UPDATE collections SET view_count = view_count + 1 WHERE id = ?", coll.ID)
	if err != nil {
	log.Error("Unable to update collections count: %v", err)
	}
	}()

	return err
	}

	func handleViewCollectionTag(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	tag := vars["tag"]

	cr := &collectionReq{}
	err := processCollectionRequest(cr, vars, w, r)
	if err != nil {
	return err
	}

	u, err := checkUserForCollection(app, cr, r, false)
	if err != nil {
	return err
	}

	page := getCollectionPage(vars)

	c, err := processCollectionPermissions(app, cr, u, w, r)
	if c == nil \|\| err != nil {
	return err
	}

	coll := newDisplayCollection(c, cr, page)

	coll.Posts, _ = app.db.GetPostsTagged(c, tag, page, cr.isCollOwner)
	if coll.Posts != nil && len(*coll.Posts) == 0 {
	return ErrCollectionPageNotFound
	}

	// Serve collection
	displayPage := struct {
	CollectionPage
	Tag string
	}{
	CollectionPage: CollectionPage{
	DisplayCollection: coll,
	StaticPage: pageForReq(app, r),
	IsCustomDomain: cr.isCustomDomain,
	},
	Tag: tag,
	}
	var owner *User
	if u != nil {
	displayPage.Username = u.Username
	displayPage.IsOwner = u.ID == coll.OwnerID
	if displayPage.IsOwner {
	// Add in needed information for users viewing their own collection
	owner = u
	displayPage.CanPin = true

	pubColls, err := app.db.GetPublishableCollections(owner)
	if err != nil {
	log.Error("unable to fetch collections: %v", err)
	}
	displayPage.Collections = pubColls
	}
	}
	if owner == nil {
	// Current user doesn't own collection; retrieve owner information
	owner, err = app.db.GetUserByID(coll.OwnerID)
	if err != nil {
	// Log the error and just continue
	log.Error("Error getting user for collection: %v", err)
	}
	}
	displayPage.Owner = owner
	coll.Owner = displayPage.Owner
	// Add more data
	// TODO: fix this mess of collections inside collections
	displayPage.PinnedPosts, _ = app.db.GetPinnedPosts(coll.CollectionObj)

	err = templates["collection-tags"].ExecuteTemplate(w, "collection-tags", displayPage)
	if err != nil {
	log.Error("Unable to render collection tag page: %v", err)
	}

	return nil
	}

	func handleCollectionPostRedirect(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	slug := vars["slug"]

	cr := &collectionReq{}
	err := processCollectionRequest(cr, vars, w, r)
	if err != nil {
	return err
	}

	// Normalize the URL, redirecting user to consistent post URL
	loc := fmt.Sprintf("/%s", slug)
	if !app.cfg.App.SingleUser {
	loc = fmt.Sprintf("/%s/%s", cr.alias, slug)
	}
	return impart.HTTPError{http.StatusFound, loc}
	}

	func existingCollection(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	vars := mux.Vars(r)
	collAlias := vars["alias"]
	isWeb := r.FormValue("web") == "1"

	var u *User
	if reqJSON && !isWeb {
	// Ensure an access token was given
	accessToken := r.Header.Get("Authorization")
	u = &User{}
	u.ID = app.db.GetUserID(accessToken)
	if u.ID == -1 {
	return ErrBadAccessToken
	}
	} else {
	u = getUserSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}
	}

	if r.Method == "DELETE" {
	err := app.db.DeleteCollection(collAlias, u.ID)
	if err != nil {
	// TODO: if not HTTPError, report error to admin
	log.Error("Unable to delete collection: %s", err)
	return err
	}
	addSessionFlash(app, w, r, "Deleted your blog, "+collAlias+".", nil)
	return impart.HTTPError{Status: http.StatusNoContent}
	}

	c := SubmittedCollection{OwnerID: uint64(u.ID)}
	var err error

	if reqJSON {
	// Decode JSON request
	decoder := json.NewDecoder(r.Body)
	err = decoder.Decode(&c)
	if err != nil {
	log.Error("Couldn't parse collection update JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err = r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse collection update form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&c, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode collection update form request: %v\n", err)
	return ErrBadFormData
	}
	}

	err = app.db.UpdateCollection(&c, collAlias)
	if err != nil {
	if err, ok := err.(impart.HTTPError); ok {
	if reqJSON {
	return err
	}
	addSessionFlash(app, w, r, err.Message, nil)
	return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
	} else {
	log.Error("Couldn't update collection: %v\n", err)
	return err
	}
	}

	if reqJSON {
	return impart.WriteSuccess(w, struct {
	}{}, http.StatusOK)
	}

	addSessionFlash(app, w, r, "Blog updated!", nil)
	return impart.HTTPError{http.StatusFound, "/me/c/" + collAlias}
	}

	// collectionAliasFromReq takes a request and returns the collection alias
	// if it can be ascertained, as well as whether or not the collection uses a
	// custom domain.
	func collectionAliasFromReq(r *http.Request) string {
	vars := mux.Vars(r)
	alias := vars["subdomain"]
	isSubdomain := alias != ""
	if !isSubdomain {
	// Fall back to write.as/{collection} since this isn't a custom domain
	alias = vars["collection"]
	}
	return alias
	}

	func handleWebCollectionUnlock(app App, w http.ResponseWriter, r http.Request) error {
	var readReq struct {
	Alias string `schema:"alias" json:"alias"`
	Pass string `schema:"password" json:"password"`
	Next string `schema:"to" json:"to"`
	}

	// Get params
	if impart.ReqJSON(r) {
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&readReq)
	if err != nil {
	log.Error("Couldn't parse readReq JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse readReq form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&readReq, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode readReq form request: %v\n", err)
	return ErrBadFormData
	}
	}

	if readReq.Alias == "" {
	return impart.HTTPError{http.StatusBadRequest, "Need a collection `alias` to read."}
	}
	if readReq.Pass == "" {
	return impart.HTTPError{http.StatusBadRequest, "Please supply a password."}
	}

	var collHashedPass []byte
	err := app.db.QueryRow("SELECT password FROM collectionpasswords INNER JOIN collections ON id = collection_id WHERE alias = ?", readReq.Alias).Scan(&collHashedPass)
	if err != nil {
	if err == sql.ErrNoRows {
	log.Error("No collectionpassword found when trying to read collection %s", readReq.Alias)
	return impart.HTTPError{http.StatusInternalServerError, "Something went very wrong. The humans have been alerted."}
	}
	return err
	}

	if !auth.Authenticated(collHashedPass, []byte(readReq.Pass)) {
	return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
	}

	// Success; set cookie
	session, err := app.sessionStore.Get(r, blogPassCookieName)
	if err == nil {
	session.Values[readReq.Alias] = true
	err = session.Save(r, w)
	if err != nil {
	log.Error("Didn't save unlocked blog '%s': %v", readReq.Alias, err)
	}
	}

	next := "/" + readReq.Next
	if !app.cfg.App.SingleUser {
	next = "/" + readReq.Alias + next
	}
	return impart.HTTPError{http.StatusFound, next}
	}

	func isAuthorizedForCollection(app App, alias string, r http.Request) bool {
	authd := false
	session, err := app.sessionStore.Get(r, blogPassCookieName)
	if err == nil {
	_, authd = session.Values[alias]
	}
	return authd
	}
	diff --git a/feed.go b/feed.go
	index bf3444b..dd82c33 100644
	--- a/feed.go
	+++ b/feed.go
	@@ -1,110 +1,111 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"fmt"
	. "github.com/gorilla/feeds"
	"github.com/gorilla/mux"
	stripmd "github.com/writeas/go-strip-markdown"
	"github.com/writeas/web-core/log"
	"net/http"
	"time"
	)

	func ViewFeed(app App, w http.ResponseWriter, req http.Request) error {
	alias := collectionAliasFromReq(req)

	// Display collection if this is a collection
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	return nil
	}
	+ c.hostName = app.cfg.App.Host

	if c.IsPrivate() \|\| c.IsProtected() {
	return ErrCollectionNotFound
	}

	// Fetch extra data about the Collection
	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
	coll := &DisplayCollection{CollectionObj: &CollectionObj{Collection: *c}}
	if c.PublicOwner {
	u, err := app.db.GetUserByID(coll.OwnerID)
	if err != nil {
	// Log the error and just continue
	log.Error("Error getting user for collection: %v", err)
	} else {
	coll.Owner = u
	}
	}

	tag := mux.Vars(req)["tag"]
	if tag != "" {
	coll.Posts, _ = app.db.GetPostsTagged(c, tag, 1, false)
	} else {
	coll.Posts, _ = app.db.GetPosts(c, 1, false, true, false)
	}

	author := ""
	if coll.Owner != nil {
	author = coll.Owner.Username
	}

	collectionTitle := coll.DisplayTitle()
	if tag != "" {
	collectionTitle = tag + " — " + collectionTitle
	}

	baseUrl := coll.CanonicalURL()
	basePermalinkUrl := baseUrl
	siteURL := baseUrl
	if tag != "" {
	siteURL += "tag:" + tag
	}

	feed := &Feed{
	Title: collectionTitle,
	Link: &Link{Href: siteURL},
	Description: coll.Description,
	Author: &Author{author, ""},
	Created: time.Now(),
	}

	var title, permalink string
	for _, p := range *coll.Posts {
	title = p.PlainDisplayTitle()
	permalink = fmt.Sprintf("%s%s", baseUrl, p.Slug.String)
	feed.Items = append(feed.Items, &Item{
	Id: fmt.Sprintf("%s%s", basePermalinkUrl, p.Slug.String),
	Title: title,
	Link: &Link{Href: permalink},
	Description: "<![CDATA[" + stripmd.Strip(p.Content) + "]]>",
	Content: applyMarkdown([]byte(p.Content), ""),
	Author: &Author{author, ""},
	Created: p.Created,
	Updated: p.Updated,
	})
	}

	rss, err := feed.ToRss()
	if err != nil {
	return err
	}

	fmt.Fprint(w, rss)
	return nil
	}
	diff --git a/posts.go b/posts.go
	index 35cb6b9..0efa5ec 100644
	--- a/posts.go
	+++ b/posts.go
	@@ -1,1396 +1,1398 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"encoding/json"
	"fmt"
	"html/template"
	"net/http"
	"regexp"
	"strings"
	"time"

	"github.com/gorilla/mux"
	"github.com/guregu/null"
	"github.com/guregu/null/zero"
	"github.com/kylemcc/twitter-text-go/extract"
	"github.com/microcosm-cc/bluemonday"
	stripmd "github.com/writeas/go-strip-markdown"
	"github.com/writeas/impart"
	"github.com/writeas/monday"
	"github.com/writeas/slug"
	"github.com/writeas/web-core/activitystreams"
	"github.com/writeas/web-core/bots"
	"github.com/writeas/web-core/converter"
	"github.com/writeas/web-core/i18n"
	"github.com/writeas/web-core/log"
	"github.com/writeas/web-core/tags"
	"github.com/writeas/writefreely/page"
	"github.com/writeas/writefreely/parse"
	)

	const (
	// Post ID length bounds
	minIDLen = 10
	maxIDLen = 10
	userPostIDLen = 10
	postIDLen = 10

	postMetaDateFormat = "2006-01-02 15:04:05"
	)

	type (
	AnonymousPost struct {
	ID string
	Content string
	HTMLContent template.HTML
	Font string
	Language string
	Direction string
	Title string
	GenTitle string
	Description string
	Author string
	Views int64
	IsPlainText bool
	IsCode bool
	IsLinkable bool
	}

	AuthenticatedPost struct {
	ID string `json:"id" schema:"id"`
	Web bool `json:"web" schema:"web"`
	*SubmittedPost
	}

	// SubmittedPost represents a post supplied by a client for publishing or
	// updating. Since Title and Content can be updated to "", they are
	// pointers that can be easily tested to detect changes.
	SubmittedPost struct {
	Slug *string `json:"slug" schema:"slug"`
	Title *string `json:"title" schema:"title"`
	Content *string `json:"body" schema:"body"`
	Font string `json:"font" schema:"font"`
	IsRTL converter.NullJSONBool `json:"rtl" schema:"rtl"`
	Language converter.NullJSONString `json:"lang" schema:"lang"`
	Created *string `json:"created" schema:"created"`
	}

	// Post represents a post as found in the database.
	Post struct {
	ID string `db:"id" json:"id"`
	Slug null.String `db:"slug" json:"slug,omitempty"`
	Font string `db:"text_appearance" json:"appearance"`
	Language zero.String `db:"language" json:"language"`
	RTL zero.Bool `db:"rtl" json:"rtl"`
	Privacy int64 `db:"privacy" json:"-"`
	OwnerID null.Int `db:"owner_id" json:"-"`
	CollectionID null.Int `db:"collection_id" json:"-"`
	PinnedPosition null.Int `db:"pinned_position" json:"-"`
	Created time.Time `db:"created" json:"created"`
	Updated time.Time `db:"updated" json:"updated"`
	ViewCount int64 `db:"view_count" json:"-"`
	Title zero.String `db:"title" json:"title"`
	HTMLTitle template.HTML `db:"title" json:"-"`
	Content string `db:"content" json:"body"`
	HTMLContent template.HTML `db:"content" json:"-"`
	HTMLExcerpt template.HTML `db:"content" json:"-"`
	Tags []string `json:"tags"`
	Images []string `json:"images,omitempty"`

	OwnerName string `json:"owner,omitempty"`
	}

	// PublicPost holds properties for a publicly returned post, i.e. a post in
	// a context where the viewer may not be the owner. As such, sensitive
	// metadata for the post is hidden and properties supporting the display of
	// the post are added.
	PublicPost struct {
	*Post
	IsSubdomain bool `json:"-"`
	IsTopLevel bool `json:"-"`
	DisplayDate string `json:"-"`
	Views int64 `json:"views"`
	Owner *PublicUser `json:"-"`
	IsOwner bool `json:"-"`
	Collection *CollectionObj `json:"collection,omitempty"`
	}

	RawPost struct {
	Id, Slug string
	Title string
	Content string
	Views int64
	Font string
	Created time.Time
	IsRTL sql.NullBool
	Language sql.NullString
	OwnerID int64
	CollectionID sql.NullInt64

	Found bool
	Gone bool
	}

	AnonymousAuthPost struct {
	ID string `json:"id"`
	Token string `json:"token"`
	}
	ClaimPostRequest struct {
	*AnonymousAuthPost
	CollectionAlias string `json:"collection"`
	CreateCollection bool `json:"create_collection"`

	// Generated properties
	Slug string `json:"-"`
	}
	ClaimPostResult struct {
	ID string `json:"id,omitempty"`
	Code int `json:"code,omitempty"`
	ErrorMessage string `json:"error_msg,omitempty"`
	Post *PublicPost `json:"post,omitempty"`
	}
	)

	func (p *Post) Direction() string {
	if p.RTL.Valid {
	if p.RTL.Bool {
	return "rtl"
	}
	return "ltr"
	}
	return "auto"
	}

	// DisplayTitle dynamically generates a title from the Post's contents if it
	// doesn't already have an explicit title.
	func (p *Post) DisplayTitle() string {
	if p.Title.String != "" {
	return p.Title.String
	}
	t := friendlyPostTitle(p.Content, p.ID)
	return t
	}

	// PlainDisplayTitle dynamically generates a title from the Post's contents if it
	// doesn't already have an explicit title.
	func (p *Post) PlainDisplayTitle() string {
	if t := stripmd.Strip(p.DisplayTitle()); t != "" {
	return t
	}
	return p.ID
	}

	// FormattedDisplayTitle dynamically generates a title from the Post's contents if it
	// doesn't already have an explicit title.
	func (p *Post) FormattedDisplayTitle() template.HTML {
	if p.HTMLTitle != "" {
	return p.HTMLTitle
	}
	return template.HTML(p.DisplayTitle())
	}

	// Summary gives a shortened summary of the post based on the post's title,
	// especially for display in a longer list of posts. It extracts a summary for
	// posts in the Title\n\nBody format, returning nothing if the entire was short
	// enough that the extracted title == extracted summary.
	func (p Post) Summary() string {
	if p.Content == "" {
	return ""
	}
	// Strip out HTML
	p.Content = bluemonday.StrictPolicy().Sanitize(p.Content)
	// and Markdown
	p.Content = stripmd.Strip(p.Content)

	title := p.Title.String
	var desc string
	if title == "" {
	// No title, so generate one
	title = friendlyPostTitle(p.Content, p.ID)
	desc = postDescription(p.Content, title, p.ID)
	if desc == title {
	return ""
	}
	return desc
	}

	return shortPostDescription(p.Content)
	}

	// Excerpt shows any text that comes before a (more) tag.
	// TODO: use HTMLExcerpt in templates instead of this method
	func (p *Post) Excerpt() template.HTML {
	return p.HTMLExcerpt
	}

	func (p *Post) CreatedDate() string {
	return p.Created.Format("2006-01-02")
	}

	func (p *Post) Created8601() string {
	return p.Created.Format("2006-01-02T15:04:05Z")
	}

	func (p *Post) IsScheduled() bool {
	return p.Created.After(time.Now())
	}

	func (p *Post) HasTag(tag string) bool {
	// Regexp looks for tag and has a non-capturing group at the end looking
	// for the end of the word.
	// Assisted by: https://stackoverflow.com/a/35192941/1549194
	hasTag, _ := regexp.MatchString("#"+tag+`(?:[[:punct:]]\|\s\|\z)`, p.Content)
	return hasTag
	}

	func (p *Post) HasTitleLink() bool {
	if p.Title.String == "" {
	return false
	}
	hasLink, _ := regexp.MatchString(`([^!]+\|^)\[.+\]$.+$`, p.Title.String)
	return hasLink
	}

	func handleViewPost(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	friendlyID := vars["post"]

	isJSON := strings.HasSuffix(friendlyID, ".json")
	isXML := strings.HasSuffix(friendlyID, ".xml")
	isCSS := strings.HasSuffix(friendlyID, ".css")
	isMarkdown := strings.HasSuffix(friendlyID, ".md")
	isRaw := strings.HasSuffix(friendlyID, ".txt") \|\| isJSON \|\| isXML \|\| isCSS \|\| isMarkdown

	// Display reserved page if that is requested resource
	if t, ok := pages[r.URL.Path[1:]+".tmpl"]; ok {
	return handleTemplatedPage(app, w, r, t)
	} else if (strings.Contains(r.URL.Path, ".") && !isRaw && !isMarkdown) \|\| r.URL.Path == "/robots.txt" \|\| r.URL.Path == "/manifest.json" {
	// Serve static file
	app.shttp.ServeHTTP(w, r)
	return nil
	}

	// Display collection if this is a collection
	c, _ := app.db.GetCollection(friendlyID)
	if c != nil {
	return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s/", friendlyID)}
	}

	// Normalize the URL, redirecting user to consistent post URL
	if friendlyID != strings.ToLower(friendlyID) {
	return impart.HTTPError{http.StatusMovedPermanently, fmt.Sprintf("/%s", strings.ToLower(friendlyID))}
	}

	ext := ""
	if isRaw {
	parts := strings.Split(friendlyID, ".")
	friendlyID = parts[0]
	if len(parts) > 1 {
	ext = "." + parts[1]
	}
	}

	var ownerID sql.NullInt64
	var title string
	var content string
	var font string
	var language []byte
	var rtl []byte
	var views int64
	var post *AnonymousPost
	var found bool
	var gone bool

	fixedID := slug.Make(friendlyID)
	if fixedID != friendlyID {
	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/%s%s", fixedID, ext)}
	}

	err := app.db.QueryRow(fmt.Sprintf("SELECT owner_id, title, content, text_appearance, view_count, language, rtl FROM posts WHERE id = ?"), friendlyID).Scan(&ownerID, &title, &content, &font, &views, &language, &rtl)
	switch {
	case err == sql.ErrNoRows:
	found = false

	// Output the error in the correct format
	if isJSON {
	content = "{\"error\": \"Post not found.\"}"
	} else if isRaw {
	content = "Post not found."
	} else {
	return ErrPostNotFound
	}
	case err != nil:
	found = false

	log.Error("Post loading err: %s\n", err)
	return ErrInternalGeneral
	default:
	found = true

	var d string
	if len(rtl) == 0 {
	d = "auto"
	} else if rtl[0] == 49 {
	// TODO: find a cleaner way to get this (possibly NULL) value
	d = "rtl"
	} else {
	d = "ltr"
	}
	generatedTitle := friendlyPostTitle(content, friendlyID)
	sanitizedContent := content
	if font != "code" {
	sanitizedContent = template.HTMLEscapeString(content)
	}
	var desc string
	if title == "" {
	desc = postDescription(content, title, friendlyID)
	} else {
	desc = shortPostDescription(content)
	}
	post = &AnonymousPost{
	ID: friendlyID,
	Content: sanitizedContent,
	Title: title,
	GenTitle: generatedTitle,
	Description: desc,
	Author: "",
	Font: font,
	IsPlainText: isRaw,
	IsCode: font == "code",
	IsLinkable: font != "code",
	Views: views,
	Language: string(language),
	Direction: d,
	}
	if !isRaw {
	post.HTMLContent = template.HTML(applyMarkdown([]byte(content), ""))
	}
	}

	// Check if post has been unpublished
	if content == "" {
	gone = true

	if isJSON {
	content = "{\"error\": \"Post was unpublished.\"}"
	} else if isCSS {
	content = ""
	} else if isRaw {
	content = "Post was unpublished."
	} else {
	return ErrPostUnpublished
	}
	}

	var u = &User{}
	if isRaw {
	contentType := "text/plain"
	if isJSON {
	contentType = "application/json"
	} else if isCSS {
	contentType = "text/css"
	} else if isXML {
	contentType = "application/xml"
	} else if isMarkdown {
	contentType = "text/markdown"
	}
	w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
	if isMarkdown && post.Title != "" {
	fmt.Fprintf(w, "%s\n", post.Title)
	for i := 1; i <= len(post.Title); i++ {
	fmt.Fprintf(w, "=")
	}
	fmt.Fprintf(w, "\n\n")
	}
	fmt.Fprint(w, content)

	if !found {
	return ErrPostNotFound
	} else if gone {
	return ErrPostUnpublished
	}
	} else {
	var err error
	page := struct {
	*AnonymousPost
	page.StaticPage
	Username string
	IsOwner bool
	SiteURL string
	}{
	AnonymousPost: post,
	StaticPage: pageForReq(app, r),
	SiteURL: app.cfg.App.Host,
	}
	if u = getUserSession(app, r); u != nil {
	page.Username = u.Username
	page.IsOwner = ownerID.Valid && ownerID.Int64 == u.ID
	}

	err = templates["post"].ExecuteTemplate(w, "post", page)
	if err != nil {
	log.Error("Post template execute error: %v", err)
	}
	}

	go func() {
	if u != nil && ownerID.Valid && ownerID.Int64 == u.ID {
	// Post is owned by someone; skip view increment since that person is viewing this post.
	return
	}
	// Update stats for non-raw post views
	if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
	_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE id = ?", friendlyID)
	if err != nil {
	log.Error("Unable to update posts count: %v", err)
	}
	}
	}()

	return nil
	}

	// API v2 funcs
	// newPost creates a new post with or without an owning Collection.
	//
	// Endpoints:
	// /posts
	// /posts?collection={alias}
	// ? /collections/{alias}/posts
	func newPost(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	vars := mux.Vars(r)
	collAlias := vars["alias"]
	if collAlias == "" {
	collAlias = r.FormValue("collection")
	}
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	// TODO: remove this
	accessToken = r.FormValue("access_token")
	}

	// FIXME: determine web submission with Content-Type header
	var u *User
	var userID int64 = -1
	var username string
	if accessToken == "" {
	u = getUserSession(app, r)
	if u != nil {
	userID = u.ID
	username = u.Username
	}
	} else {
	userID = app.db.GetUserID(accessToken)
	}
	if userID == -1 {
	return ErrNotLoggedIn
	}

	if accessToken == "" && u == nil && collAlias != "" {
	return impart.HTTPError{http.StatusBadRequest, "Parameter `access_token` required."}
	}

	// Get post data
	var p *SubmittedPost
	if reqJSON {
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&p)
	if err != nil {
	log.Error("Couldn't parse new post JSON request: %v\n", err)
	return ErrBadJSON
	}
	if p.Title == nil {
	t := ""
	p.Title = &t
	}
	if strings.TrimSpace(*(p.Content)) == "" {
	return ErrNoPublishableContent
	}
	} else {
	post := r.FormValue("body")
	appearance := r.FormValue("font")
	title := r.FormValue("title")
	rtlValue := r.FormValue("rtl")
	langValue := r.FormValue("lang")
	if strings.TrimSpace(post) == "" {
	return ErrNoPublishableContent
	}

	var isRTL, rtlValid bool
	if rtlValue == "auto" && langValue != "" {
	isRTL = i18n.LangIsRTL(langValue)
	rtlValid = true
	} else {
	isRTL = rtlValue == "true"
	rtlValid = rtlValue != "" && langValue != ""
	}

	// Create a new post
	p = &SubmittedPost{
	Title: &title,
	Content: &post,
	Font: appearance,
	IsRTL: converter.NullJSONBool{sql.NullBool{Bool: isRTL, Valid: rtlValid}},
	Language: converter.NullJSONString{sql.NullString{String: langValue, Valid: langValue != ""}},
	}
	}
	if !p.isFontValid() {
	p.Font = "norm"
	}

	var newPost *PublicPost = &PublicPost{}
	var coll *Collection
	var err error
	if accessToken != "" {
	newPost, err = app.db.CreateOwnedPost(p, accessToken, collAlias)
	} else {
	//return ErrNotLoggedIn
	// TODO: verify user is logged in
	var collID int64
	if collAlias != "" {
	coll, err = app.db.GetCollection(collAlias)
	if err != nil {
	return err
	}
	if coll.OwnerID != u.ID {
	return ErrForbiddenCollection
	}
	collID = coll.ID
	}
	// TODO: return PublicPost from createPost
	newPost.Post, err = app.db.CreatePost(userID, collID, p)
	}
	if err != nil {
	return err
	}
	if coll != nil {
	coll.ForPublic()
	newPost.Collection = &CollectionObj{Collection: *coll}
	}

	newPost.extractData()
	newPost.OwnerName = username

	// Write success now
	response := impart.WriteSuccess(w, newPost, http.StatusCreated)

	if newPost.Collection != nil && app.cfg.App.Federation && !newPost.Created.After(time.Now()) {
	go federatePost(app, newPost, newPost.Collection.ID, false)
	}

	return response
	}

	func existingPost(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	vars := mux.Vars(r)
	postID := vars["post"]

	p := AuthenticatedPost{ID: postID}
	var err error

	if reqJSON {
	// Decode JSON request
	decoder := json.NewDecoder(r.Body)
	err = decoder.Decode(&p)
	if err != nil {
	log.Error("Couldn't parse post update JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err = r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse post update form request: %v\n", err)
	return ErrBadFormData
	}

	// Can't decode to a nil SubmittedPost property, so create instance now
	p.SubmittedPost = &SubmittedPost{}
	err = app.formDecoder.Decode(&p, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode post update form request: %v\n", err)
	return ErrBadFormData
	}
	}

	if p.Web {
	p.IsRTL.Valid = true
	}

	if p.SubmittedPost == nil {
	return ErrPostNoUpdatableVals
	}

	// Ensure an access token was given
	accessToken := r.Header.Get("Authorization")
	// Get user's cookie session if there's no token
	var u *User
	//var username string
	if accessToken == "" {
	u = getUserSession(app, r)
	if u != nil {
	//username = u.Username
	}
	}
	if u == nil && accessToken == "" {
	return ErrNoAccessToken
	}

	// Get user ID from current session or given access token, if one was given.
	var userID int64
	if u != nil {
	userID = u.ID
	} else if accessToken != "" {
	userID, err = AuthenticateUser(app.db, accessToken)
	if err != nil {
	return err
	}
	}

	// Modify post struct
	p.ID = postID

	err = app.db.UpdateOwnedPost(&p, userID)
	if err != nil {
	if reqJSON {
	return err
	}

	if err, ok := err.(impart.HTTPError); ok {
	addSessionFlash(app, w, r, err.Message, nil)
	} else {
	addSessionFlash(app, w, r, err.Error(), nil)
	}
	}

	var pRes *PublicPost
	pRes, err = app.db.GetPost(p.ID, 0)
	if reqJSON {
	if err != nil {
	return err
	}
	pRes.extractData()
	}

	if pRes.CollectionID.Valid {
	coll, err := app.db.GetCollectionBy("id = ?", pRes.CollectionID.Int64)
	if err == nil && app.cfg.App.Federation {
	pRes.Collection = &CollectionObj{Collection: *coll}
	go federatePost(app, pRes, pRes.Collection.ID, true)
	}
	}

	// Write success now
	if reqJSON {
	return impart.WriteSuccess(w, pRes, http.StatusOK)
	}

	addSessionFlash(app, w, r, "Changes saved.", nil)
	collectionAlias := vars["alias"]
	redirect := "/" + postID + "/meta"
	if collectionAlias != "" {
	collPre := "/" + collectionAlias
	if app.cfg.App.SingleUser {
	collPre = ""
	}
	redirect = collPre + "/" + pRes.Slug.String + "/edit/meta"
	} else {
	if app.cfg.App.SingleUser {
	redirect = "/d" + redirect
	}
	}
	w.Header().Set("Location", redirect)
	w.WriteHeader(http.StatusFound)

	return nil
	}

	func deletePost(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	friendlyID := vars["post"]
	editToken := r.FormValue("token")

	var ownerID int64
	var u *User
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" && editToken == "" {
	u = getUserSession(app, r)
	if u == nil {
	return ErrNoAccessToken
	}
	}

	var res sql.Result
	var t *sql.Tx
	var err error
	var collID sql.NullInt64
	var coll *Collection
	var pp *PublicPost
	if editToken != "" {
	// TODO: SELECT owner_id, as well, and return appropriate error if NULL instead of running two queries
	var dummy int64
	err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ?", friendlyID).Scan(&dummy)
	switch {
	case err == sql.ErrNoRows:
	return impart.HTTPError{http.StatusNotFound, "Post not found."}
	}
	err = app.db.QueryRow("SELECT 1 FROM posts WHERE id = ? AND owner_id IS NULL", friendlyID).Scan(&dummy)
	switch {
	case err == sql.ErrNoRows:
	// Post already has an owner. This could provide a bad experience
	// for the user, but it's more important to ensure data isn't lost
	// unexpectedly. So prevent deletion via token.
	return impart.HTTPError{http.StatusConflict, "This post belongs to some user (hopefully yours). Please log in and delete it from that user's account."}
	}
	res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND modify_token = ? AND owner_id IS NULL", friendlyID, editToken)
	} else if accessToken != "" \|\| u != nil {
	// Caller provided some way to authenticate; assume caller expects the
	// post to be deleted based on a specific post owner, thus we should
	// return corresponding errors.
	if accessToken != "" {
	ownerID = app.db.GetUserID(accessToken)
	if ownerID == -1 {
	return ErrBadAccessToken
	}
	} else {
	ownerID = u.ID
	}

	// TODO: don't make two queries
	var realOwnerID sql.NullInt64
	err = app.db.QueryRow("SELECT collection_id, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&collID, &realOwnerID)
	if err != nil {
	return err
	}
	if !collID.Valid {
	// There's no collection; simply delete the post
	res, err = app.db.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
	} else {
	// Post belongs to a collection; do any additional clean up
	coll, err = app.db.GetCollectionBy("id = ?", collID.Int64)
	if err != nil {
	log.Error("Unable to get collection: %v", err)
	return err
	}
	if app.cfg.App.Federation {
	// First fetch full post for federation
	pp, err = app.db.GetOwnedPost(friendlyID, ownerID)
	if err != nil {
	log.Error("Unable to get owned post: %v", err)
	return err
	}
	collObj := &CollectionObj{Collection: *coll}
	pp.Collection = collObj
	}

	t, err = app.db.Begin()
	if err != nil {
	log.Error("No begin: %v", err)
	return err
	}
	res, err = t.Exec("DELETE FROM posts WHERE id = ? AND owner_id = ?", friendlyID, ownerID)
	}
	} else {
	return impart.HTTPError{http.StatusBadRequest, "No authenticated user or post token given."}
	}
	if err != nil {
	return err
	}

	affected, err := res.RowsAffected()
	if err != nil {
	if t != nil {
	t.Rollback()
	log.Error("Rows affected err! Rolling back")
	}
	return err
	} else if affected == 0 {
	if t != nil {
	t.Rollback()
	log.Error("No rows affected! Rolling back")
	}
	return impart.HTTPError{http.StatusForbidden, "Post not found, or you're not the owner."}
	}
	if t != nil {
	t.Commit()
	}
	if coll != nil && app.cfg.App.Federation {
	go deleteFederatedPost(app, pp, collID.Int64)
	}

	return impart.HTTPError{Status: http.StatusNoContent}
	}

	// addPost associates a post with the authenticated user.
	func addPost(app App, w http.ResponseWriter, r http.Request) error {
	var ownerID int64

	// Authenticate user
	at := r.Header.Get("Authorization")
	if at != "" {
	ownerID = app.db.GetUserID(at)
	if ownerID == -1 {
	return ErrBadAccessToken
	}
	} else {
	u := getUserSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}
	ownerID = u.ID
	}

	// Parse claimed posts in format:
	// [{"id": "...", "token": "..."}]
	var claims *[]ClaimPostRequest
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&claims)
	if err != nil {
	return ErrBadJSONArray
	}

	vars := mux.Vars(r)
	collAlias := vars["alias"]

	// Update all given posts
	res, err := app.db.ClaimPosts(ownerID, collAlias, claims)
	if err != nil {
	return err
	}

	if app.cfg.App.Federation {
	for _, pRes := range *res {
	if pRes.Code != http.StatusOK {
	continue
	}
	if !pRes.Post.Created.After(time.Now()) {
	go federatePost(app, pRes.Post, pRes.Post.Collection.ID, false)
	}
	}
	}
	return impart.WriteSuccess(w, res, http.StatusOK)
	}

	func dispersePost(app App, w http.ResponseWriter, r http.Request) error {
	var ownerID int64

	// Authenticate user
	at := r.Header.Get("Authorization")
	if at != "" {
	ownerID = app.db.GetUserID(at)
	if ownerID == -1 {
	return ErrBadAccessToken
	}
	} else {
	u := getUserSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}
	ownerID = u.ID
	}

	// Parse posts in format:
	// ["..."]
	var postIDs []string
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&postIDs)
	if err != nil {
	return ErrBadJSONArray
	}

	// Update all given posts
	res, err := app.db.DispersePosts(ownerID, postIDs)
	if err != nil {
	return err
	}
	return impart.WriteSuccess(w, res, http.StatusOK)
	}

	type (
	PinPostResult struct {
	ID string `json:"id,omitempty"`
	Code int `json:"code,omitempty"`
	ErrorMessage string `json:"error_msg,omitempty"`
	}
	)

	// pinPost pins a post to a blog
	func pinPost(app App, w http.ResponseWriter, r http.Request) error {
	var userID int64

	// Authenticate user
	at := r.Header.Get("Authorization")
	if at != "" {
	userID = app.db.GetUserID(at)
	if userID == -1 {
	return ErrBadAccessToken
	}
	} else {
	u := getUserSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}
	userID = u.ID
	}

	// Parse request
	var posts []struct {
	ID string `json:"id"`
	Position int64 `json:"position"`
	}
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&posts)
	if err != nil {
	return ErrBadJSONArray
	}

	// Validate data
	vars := mux.Vars(r)
	collAlias := vars["alias"]

	coll, err := app.db.GetCollection(collAlias)
	if err != nil {
	return err
	}
	if coll.OwnerID != userID {
	return ErrForbiddenCollection
	}

	// Do (un)pinning
	isPinning := r.URL.Path[strings.LastIndex(r.URL.Path, "/"):] == "/pin"
	res := []PinPostResult{}
	for _, p := range posts {
	err = app.db.UpdatePostPinState(isPinning, p.ID, coll.ID, userID, p.Position)
	ppr := PinPostResult{ID: p.ID}
	if err != nil {
	ppr.Code = http.StatusInternalServerError
	// TODO: set error messsage
	} else {
	ppr.Code = http.StatusOK
	}
	res = append(res, ppr)
	}
	return impart.WriteSuccess(w, res, http.StatusOK)
	}

	func fetchPost(app App, w http.ResponseWriter, r http.Request) error {
	var collID int64
	var coll *Collection
	var err error
	vars := mux.Vars(r)
	if collAlias := vars["alias"]; collAlias != "" {
	// Fetch collection information, since an alias is provided
	coll, err = app.db.GetCollection(collAlias)
	if err != nil {
	return err
	}
	+ coll.hostName = app.cfg.App.Host
	_, err = apiCheckCollectionPermissions(app, r, coll)
	if err != nil {
	return err
	}
	collID = coll.ID
	}

	p, err := app.db.GetPost(vars["post"], collID)
	if err != nil {
	return err
	}

	p.extractData()

	accept := r.Header.Get("Accept")
	if strings.Contains(accept, "application/activity+json") {
	// Fetch information about the collection this belongs to
	if coll == nil && p.CollectionID.Valid {
	coll, err = app.db.GetCollectionByID(p.CollectionID.Int64)
	if err != nil {
	return err
	}
	}
	if coll == nil {
	// This is a draft post; 404 for now
	// TODO: return ActivityObject
	return impart.HTTPError{http.StatusNotFound, ""}
	}

	p.Collection = &CollectionObj{Collection: *coll}
	po := p.ActivityObject()
	po.Context = []interface{}{activitystreams.Namespace}
	return impart.RenderActivityJSON(w, po, http.StatusOK)
	}

	return impart.WriteSuccess(w, p, http.StatusOK)
	}

	func fetchPostProperty(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	p, err := app.db.GetPostProperty(vars["post"], 0, vars["property"])
	if err != nil {
	return err
	}

	return impart.WriteSuccess(w, p, http.StatusOK)
	}

	func (p *Post) processPost() PublicPost {
	res := &PublicPost{Post: p, Views: 0}
	res.Views = p.ViewCount
	// TODO: move to own function
	loc := monday.FuzzyLocale(p.Language.String)
	res.DisplayDate = monday.Format(p.Created, monday.LongFormatsByLocale[loc], loc)

	return *res
	}

	func (p *PublicPost) CanonicalURL() string {
	if p.Collection == nil \|\| p.Collection.Alias == "" {
	- return hostName + "/" + p.ID
	+ return p.Collection.hostName + "/" + p.ID
	}
	return p.Collection.CanonicalURL() + p.Slug.String
	}

	func (p PublicPost) ActivityObject() activitystreams.Object {
	o := activitystreams.NewArticleObject()
	o.ID = p.Collection.FederatedAPIBase() + "api/posts/" + p.ID
	o.Published = p.Created
	o.URL = p.CanonicalURL()
	o.AttributedTo = p.Collection.FederatedAccount()
	o.CC = []string{
	p.Collection.FederatedAccount() + "/followers",
	}
	o.Name = p.DisplayTitle()
	if p.HTMLContent == template.HTML("") {
	p.formatContent(false)
	}
	o.Content = string(p.HTMLContent)
	if p.Language.Valid {
	o.ContentMap = map[string]string{
	p.Language.String: string(p.HTMLContent),
	}
	}
	if len(p.Tags) == 0 {
	o.Tag = []activitystreams.Tag{}
	} else {
	var tagBaseURL string
	if isSingleUser {
	tagBaseURL = p.Collection.CanonicalURL() + "tag:"
	} else {
	- tagBaseURL = fmt.Sprintf("%s/%s/tag:", hostName, p.Collection.Alias)
	+ tagBaseURL = fmt.Sprintf("%s/%s/tag:", p.Collection.hostName, p.Collection.Alias)
	}
	for _, t := range p.Tags {
	o.Tag = append(o.Tag, activitystreams.Tag{
	Type: activitystreams.TagHashtag,
	HRef: tagBaseURL + t,
	Name: "#" + t,
	})
	}
	}
	return o
	}

	// TODO: merge this into getSlugFromPost or phase it out
	func getSlug(title, lang string) string {
	return getSlugFromPost("", title, lang)
	}

	func getSlugFromPost(title, body, lang string) string {
	if title == "" {
	title = postTitle(body, body)
	}
	title = parse.PostLede(title, false)
	// Truncate lede if needed
	title, _ = parse.TruncToWord(title, 80)
	if lang != "" && len(lang) == 2 {
	return slug.MakeLang(title, lang)
	}
	return slug.Make(title)
	}

	// isFontValid returns whether or not the submitted post's appearance is valid.
	func (p *SubmittedPost) isFontValid() bool {
	validFonts := map[string]bool{
	"norm": true,
	"sans": true,
	"mono": true,
	"wrap": true,
	"code": true,
	}

	_, valid := validFonts[p.Font]
	return valid
	}

	func getRawPost(app App, friendlyID string) RawPost {
	var content, font, title string
	var isRTL sql.NullBool
	var lang sql.NullString
	var ownerID sql.NullInt64
	var created time.Time

	err := app.db.QueryRow("SELECT title, content, text_appearance, language, rtl, created, owner_id FROM posts WHERE id = ?", friendlyID).Scan(&title, &content, &font, &lang, &isRTL, &created, &ownerID)
	switch {
	case err == sql.ErrNoRows:
	return &RawPost{Content: "", Found: false, Gone: false}
	case err != nil:
	return &RawPost{Content: "", Found: true, Gone: false}
	}

	return &RawPost{Title: title, Content: content, Font: font, Created: created, IsRTL: isRTL, Language: lang, OwnerID: ownerID.Int64, Found: true, Gone: content == ""}

	}

	// TODO; return a Post!
	func getRawCollectionPost(app App, slug, collAlias string) RawPost {
	var id, title, content, font string
	var isRTL sql.NullBool
	var lang sql.NullString
	var created time.Time
	var ownerID null.Int
	var views int64
	var err error

	if app.cfg.App.SingleUser {
	err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, owner_id FROM posts WHERE slug = ? AND collection_id = 1", slug).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &ownerID)
	} else {
	err = app.db.QueryRow("SELECT id, title, content, text_appearance, language, rtl, view_count, created, owner_id FROM posts WHERE slug = ? AND collection_id = (SELECT id FROM collections WHERE alias = ?)", slug, collAlias).Scan(&id, &title, &content, &font, &lang, &isRTL, &views, &created, &ownerID)
	}
	switch {
	case err == sql.ErrNoRows:
	return &RawPost{Content: "", Found: false, Gone: false}
	case err != nil:
	return &RawPost{Content: "", Found: true, Gone: false}
	}

	return &RawPost{
	Id: id,
	Slug: slug,
	Title: title,
	Content: content,
	Font: font,
	Created: created,
	IsRTL: isRTL,
	Language: lang,
	OwnerID: ownerID.Int64,
	Found: true,
	Gone: content == "",
	Views: views,
	}
	}

	func viewCollectionPost(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	slug := vars["slug"]

	isJSON := strings.HasSuffix(slug, ".json")
	isXML := strings.HasSuffix(slug, ".xml")
	isMarkdown := strings.HasSuffix(slug, ".md")
	isRaw := strings.HasSuffix(slug, ".txt") \|\| isJSON \|\| isXML \|\| isMarkdown

	if strings.Contains(r.URL.Path, ".") && !isRaw {
	// Serve static file
	app.shttp.ServeHTTP(w, r)
	return nil
	}

	cr := &collectionReq{}
	err := processCollectionRequest(cr, vars, w, r)
	if err != nil {
	return err
	}

	// Check for hellbanned users
	u, err := checkUserForCollection(app, cr, r, true)
	if err != nil {
	return err
	}

	// Normalize the URL, redirecting user to consistent post URL
	if slug != strings.ToLower(slug) {
	loc := fmt.Sprintf("/%s", strings.ToLower(slug))
	if !app.cfg.App.SingleUser {
	loc = "/" + cr.alias + loc
	}
	return impart.HTTPError{http.StatusMovedPermanently, loc}
	}

	// Display collection if this is a collection
	var c *Collection
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(cr.alias)
	}
	if err != nil {
	if err, ok := err.(impart.HTTPError); ok {
	if err.Status == http.StatusNotFound {
	// Redirect if necessary
	newAlias := app.db.GetCollectionRedirect(cr.alias)
	if newAlias != "" {
	return impart.HTTPError{http.StatusFound, "/" + newAlias + "/" + slug}
	}
	}
	}
	return err
	}
	+ c.hostName = app.cfg.App.Host

	// Check collection permissions
	if c.IsPrivate() && (u == nil \|\| u.ID != c.OwnerID) {
	return ErrPostNotFound
	}
	if c.IsProtected() && ((u == nil \|\| u.ID != c.OwnerID) && !isAuthorizedForCollection(app, c.Alias, r)) {
	return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/?g=" + slug}
	}

	cr.isCollOwner = u != nil && c.OwnerID == u.ID

	if isRaw {
	slug = strings.Split(slug, ".")[0]
	}

	// Fetch extra data about the Collection
	// TODO: refactor out this logic, shared in collection.go:fetchCollection()
	coll := &CollectionObj{Collection: *c}
	owner, err := app.db.GetUserByID(coll.OwnerID)
	if err != nil {
	// Log the error and just continue
	log.Error("Error getting user for collection: %v", err)
	} else {
	coll.Owner = owner
	}

	p, err := app.db.GetPost(slug, coll.ID)
	if err != nil {
	if err == ErrCollectionPageNotFound && slug == "feed" {
	// User tried to access blog feed without a trailing slash, and
	// there's no post with a slug "feed"
	return impart.HTTPError{http.StatusFound, c.CanonicalURL() + "/feed/"}
	}
	return err
	}
	p.IsOwner = owner != nil && p.OwnerID.Valid && owner.ID == p.OwnerID.Int64
	p.Collection = coll
	p.IsTopLevel = app.cfg.App.SingleUser

	// Check if post has been unpublished
	if p.Content == "" {
	return impart.HTTPError{http.StatusGone, "Post was unpublished."}
	}

	// Serve collection post
	if isRaw {
	contentType := "text/plain"
	if isJSON {
	contentType = "application/json"
	} else if isXML {
	contentType = "application/xml"
	} else if isMarkdown {
	contentType = "text/markdown"
	}
	w.Header().Set("Content-Type", fmt.Sprintf("%s; charset=utf-8", contentType))
	if isMarkdown && p.Title.String != "" {
	fmt.Fprintf(w, "# %s\n\n", p.Title.String)
	}
	fmt.Fprint(w, p.Content)
	} else if strings.Contains(r.Header.Get("Accept"), "application/activity+json") {
	p.extractData()
	ap := p.ActivityObject()
	ap.Context = []interface{}{activitystreams.Namespace}
	return impart.RenderActivityJSON(w, ap, http.StatusOK)
	} else {
	p.extractData()
	p.Content = strings.Replace(p.Content, "<!--more-->", "", 1)
	// TODO: move this to function
	p.formatContent(cr.isCollOwner)
	tp := struct {
	*PublicPost
	page.StaticPage
	IsOwner bool
	IsPinned bool
	IsCustomDomain bool
	PinnedPosts *[]PublicPost
	}{
	PublicPost: p,
	StaticPage: pageForReq(app, r),
	IsOwner: cr.isCollOwner,
	IsCustomDomain: cr.isCustomDomain,
	}
	tp.PinnedPosts, _ = app.db.GetPinnedPosts(coll)
	tp.IsPinned = len(*tp.PinnedPosts) > 0 && PostsContains(tp.PinnedPosts, p)
	if err := templates["collection-post"].ExecuteTemplate(w, "post", tp); err != nil {
	log.Error("Error in collection-post template: %v", err)
	}
	}

	go func() {
	if p.OwnerID.Valid {
	// Post is owned by someone. Don't update stats if owner is viewing the post.
	if u != nil && p.OwnerID.Int64 == u.ID {
	return
	}
	}
	// Update stats for non-raw post views
	if !isRaw && r.Method != "HEAD" && !bots.IsBot(r.UserAgent()) {
	_, err := app.db.Exec("UPDATE posts SET view_count = view_count + 1 WHERE slug = ? AND collection_id = ?", slug, coll.ID)
	if err != nil {
	log.Error("Unable to update posts count: %v", err)
	}
	}
	}()

	return nil
	}

	// TODO: move this to utils after making it more generic
	func PostsContains(sl []PublicPost, s PublicPost) bool {
	for _, e := range *sl {
	if e.ID == s.ID {
	return true
	}
	}
	return false
	}

	func (p *Post) extractData() {
	p.Tags = tags.Extract(p.Content)
	p.extractImages()
	}

	func (rp *RawPost) UserFacingCreated() string {
	return rp.Created.Format(postMetaDateFormat)
	}

	func (rp *RawPost) Created8601() string {
	return rp.Created.Format("2006-01-02T15:04:05Z")
	}

	var imageURLRegex = regexp.MustCompile(`(?i)^https?:\/\/[^ ]*\.(gif\|png\|jpg\|jpeg\|image)$`)

	func (p *Post) extractImages() {
	matches := extract.ExtractUrls(p.Content)
	urls := map[string]bool{}
	for i := range matches {
	u := matches[i].Text
	if !imageURLRegex.MatchString(u) {
	continue
	}
	urls[u] = true
	}

	resURLs := make([]string, 0)
	for k := range urls {
	resURLs = append(resURLs, k)
	}
	p.Images = resURLs
	}
	diff --git a/read.go b/read.go
	index 13add9e..3bc91c7 100644
	--- a/read.go
	+++ b/read.go
	@@ -1,302 +1,305 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"fmt"
	. "github.com/gorilla/feeds"
	"github.com/gorilla/mux"
	stripmd "github.com/writeas/go-strip-markdown"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/log"
	"github.com/writeas/web-core/memo"
	"github.com/writeas/writefreely/page"
	"html/template"
	"math"
	"net/http"
	"strconv"
	"time"
	)

	const (
	tlFeedLimit = 100
	tlAPIPageLimit = 10
	tlMaxAuthorPosts = 5
	tlPostsPerPage = 16
	)

	type localTimeline struct {
	m *memo.Memo
	posts *[]PublicPost

	// Configuration values
	postsPerPage int
	}

	type readPublication struct {
	page.StaticPage
	Posts *[]PublicPost
	CurrentPage int
	TotalPages int
	}

	func initLocalTimeline(app *App) {
	app.timeline = &localTimeline{
	postsPerPage: tlPostsPerPage,
	- m: memo.New(app.db.FetchPublicPosts, 10*time.Minute),
	+ m: memo.New(app.FetchPublicPosts, 10*time.Minute),
	}
	}

	// satisfies memo.Func
	-func (db *datastore) FetchPublicPosts() (interface{}, error) {
	+func (app *App) FetchPublicPosts() (interface{}, error) {
	// Finds all public posts and posts in a public collection published during the owner's active subscription period and within the last 3 months
	- rows, err := db.Query(`SELECT p.id, alias, c.title, p.slug, p.title, p.content, p.text_appearance, p.language, p.rtl, p.created, p.updated
	+ rows, err := app.db.Query(`SELECT p.id, alias, c.title, p.slug, p.title, p.content, p.text_appearance, p.language, p.rtl, p.created, p.updated
	FROM collections c
	LEFT JOIN posts p ON p.collection_id = c.id
	- WHERE c.privacy = 1 AND (p.created >= ` + db.dateSub(3, "month") + ` AND p.created <= ` + db.now() + ` AND pinned_position IS NULL)
	+ WHERE c.privacy = 1 AND (p.created >= ` + app.db.dateSub(3, "month") + ` AND p.created <= ` + app.db.now() + ` AND pinned_position IS NULL)
	ORDER BY p.created DESC`)
	if err != nil {
	log.Error("Failed selecting from posts: %v", err)
	return nil, impart.HTTPError{http.StatusInternalServerError, "Couldn't retrieve collection posts." + err.Error()}
	}
	defer rows.Close()

	ap := map[string]uint{}

	posts := []PublicPost{}
	for rows.Next() {
	p := &Post{}
	c := &Collection{}
	var alias, title sql.NullString
	err = rows.Scan(&p.ID, &alias, &title, &p.Slug, &p.Title, &p.Content, &p.Font, &p.Language, &p.RTL, &p.Created, &p.Updated)
	if err != nil {
	log.Error("[READ] Unable to scan row, skipping: %v", err)
	continue
	}
	+ c.hostName = app.cfg.App.Host
	+
	isCollectionPost := alias.Valid
	if isCollectionPost {
	c.Alias = alias.String
	if c.Alias != "" && ap[c.Alias] == tlMaxAuthorPosts {
	// Don't add post if we've hit the post-per-author limit
	continue
	}

	c.Public = true
	c.Title = title.String
	}

	p.extractData()
	p.HTMLContent = template.HTML(applyMarkdown([]byte(p.Content), ""))
	fp := p.processPost()
	if isCollectionPost {
	fp.Collection = &CollectionObj{Collection: *c}
	}

	posts = append(posts, fp)
	ap[c.Alias]++
	}

	return posts, nil
	}

	func viewLocalTimelineAPI(app App, w http.ResponseWriter, r http.Request) error {
	updateTimelineCache(app.timeline)

	skip, _ := strconv.Atoi(r.FormValue("skip"))

	posts := []PublicPost{}
	for i := skip; i < skip+tlAPIPageLimit && i < len(*app.timeline.posts); i++ {
	posts = append(posts, (*app.timeline.posts)[i])
	}

	return impart.WriteSuccess(w, posts, http.StatusOK)
	}

	func viewLocalTimeline(app App, w http.ResponseWriter, r http.Request) error {
	if !app.cfg.App.LocalTimeline {
	return impart.HTTPError{http.StatusNotFound, "Page doesn't exist."}
	}

	vars := mux.Vars(r)
	var p int
	page := 1
	p, _ = strconv.Atoi(vars["page"])
	if p > 0 {
	page = p
	}

	return showLocalTimeline(app, w, r, page, vars["author"], vars["tag"])
	}

	func updateTimelineCache(tl *localTimeline) {
	// Fetch posts if enough time has passed since last cache
	if tl.posts == nil \|\| tl.m.Invalidate() {
	log.Info("[READ] Updating post cache")
	var err error
	var postsInterfaces interface{}
	postsInterfaces, err = tl.m.Get()
	if err != nil {
	log.Error("[READ] Unable to cache posts: %v", err)
	} else {
	castPosts := postsInterfaces.([]PublicPost)
	tl.posts = &castPosts
	}
	}
	}

	func showLocalTimeline(app App, w http.ResponseWriter, r http.Request, page int, author, tag string) error {
	updateTimelineCache(app.timeline)

	pl := len(*(app.timeline.posts))
	ttlPages := int(math.Ceil(float64(pl) / float64(app.timeline.postsPerPage)))

	start := 0
	if page > 1 {
	start = app.timeline.postsPerPage * (page - 1)
	if start > pl {
	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/read/p/%d", ttlPages)}
	}
	}
	end := app.timeline.postsPerPage * page
	if end > pl {
	end = pl
	}
	var posts []PublicPost
	if author != "" {
	posts = []PublicPost{}
	for _, p := range *app.timeline.posts {
	if author == "anonymous" {
	if p.Collection == nil {
	posts = append(posts, p)
	}
	} else if p.Collection != nil && p.Collection.Alias == author {
	posts = append(posts, p)
	}
	}
	} else if tag != "" {
	posts = []PublicPost{}
	for _, p := range *app.timeline.posts {
	if p.HasTag(tag) {
	posts = append(posts, p)
	}
	}
	} else {
	posts = *app.timeline.posts
	posts = posts[start:end]
	}

	d := &readPublication{
	pageForReq(app, r),
	&posts,
	page,
	ttlPages,
	}

	err := templates["read"].ExecuteTemplate(w, "base", d)
	if err != nil {
	log.Error("Unable to render reader: %v", err)
	fmt.Fprintf(w, ":(")
	}
	return nil
	}

	// NextPageURL provides a full URL for the next page of collection posts
	func (c *readPublication) NextPageURL(n int) string {
	return fmt.Sprintf("/read/p/%d", n+1)
	}

	// PrevPageURL provides a full URL for the previous page of collection posts,
	// returning a /page/N result for pages >1
	func (c *readPublication) PrevPageURL(n int) string {
	if n == 2 {
	// Previous page is 1; no need for /p/ prefix
	return "/read"
	}
	return fmt.Sprintf("/read/p/%d", n-1)
	}

	// handlePostIDRedirect handles a route where a post ID is given and redirects
	// the user to the canonical post URL.
	func handlePostIDRedirect(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)
	postID := vars["post"]
	p, err := app.db.GetPost(postID, 0)
	if err != nil {
	return err
	}

	if !p.CollectionID.Valid {
	// No collection; send to normal URL
	// NOTE: not handling single user blogs here since this handler is only used for the Reader
	return impart.HTTPError{http.StatusFound, app.cfg.App.Host + "/" + postID + ".md"}
	}

	c, err := app.db.GetCollectionBy("id = ?", fmt.Sprintf("%d", p.CollectionID.Int64))
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	// Retrieve collection information and send user to canonical URL
	return impart.HTTPError{http.StatusFound, c.CanonicalURL() + p.Slug.String}
	}

	func viewLocalTimelineFeed(app App, w http.ResponseWriter, req http.Request) error {
	if !app.cfg.App.LocalTimeline {
	return impart.HTTPError{http.StatusNotFound, "Page doesn't exist."}
	}

	updateTimelineCache(app.timeline)

	feed := &Feed{
	Title: app.cfg.App.SiteName + " Reader",
	Link: &Link{Href: app.cfg.App.Host},
	Description: "Read the latest posts from " + app.cfg.App.SiteName + ".",
	Created: time.Now(),
	}

	c := 0
	var title, permalink, author string
	for _, p := range *app.timeline.posts {
	if c == tlFeedLimit {
	break
	}

	title = p.PlainDisplayTitle()
	permalink = p.CanonicalURL()
	if p.Collection != nil {
	author = p.Collection.Title
	} else {
	author = "Anonymous"
	permalink += ".md"
	}
	i := &Item{
	Id: app.cfg.App.Host + "/read/a/" + p.ID,
	Title: title,
	Link: &Link{Href: permalink},
	Description: "<![CDATA[" + stripmd.Strip(p.Content) + "]]>",
	Content: applyMarkdown([]byte(p.Content), ""),
	Author: &Author{author, ""},
	Created: p.Created,
	Updated: p.Updated,
	}
	feed.Items = append(feed.Items, i)
	c++
	}

	rss, err := feed.ToRss()
	if err != nil {
	return err
	}

	fmt.Fprint(w, rss)
	return nil
	}
	diff --git a/sitemap.go b/sitemap.go
	index efc772b..5c37366 100644
	--- a/sitemap.go
	+++ b/sitemap.go
	@@ -1,104 +1,105 @@
	/*
	* Copyright © 2018-2019 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"fmt"
	"github.com/gorilla/mux"
	"github.com/ikeikeikeike/go-sitemap-generator/stm"
	"github.com/writeas/web-core/log"
	"net/http"
	"time"
	)

	func buildSitemap(host, alias string) *stm.Sitemap {
	sm := stm.NewSitemap()
	sm.SetDefaultHost(host)
	if alias != "/" {
	sm.SetSitemapsPath(alias)
	}

	sm.Create()

	// Note: Do not call `sm.Finalize()` because it flushes
	// the underlying datastructure from memory to disk.

	return sm
	}

	func handleViewSitemap(app App, w http.ResponseWriter, r http.Request) error {
	vars := mux.Vars(r)

	// Determine canonical blog URL
	alias := vars["collection"]
	subdomain := vars["subdomain"]
	isSubdomain := subdomain != ""
	if isSubdomain {
	alias = subdomain
	}

	host := fmt.Sprintf("%s/%s/", app.cfg.App.Host, alias)
	var c *Collection
	var err error
	pre := "/"
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	return err
	}
	+ c.hostName = app.cfg.App.Host

	if !isSubdomain {
	pre += alias + "/"
	}
	host = c.CanonicalURL()

	sm := buildSitemap(host, pre)
	posts, err := app.db.GetPosts(c, 0, false, false, false)
	if err != nil {
	log.Error("Error getting posts: %v", err)
	return err
	}
	lastSiteMod := time.Now()
	for i, p := range *posts {
	if i == 0 {
	lastSiteMod = p.Updated
	}
	u := stm.URL{
	"loc": p.Slug.String,
	"changefreq": "weekly",
	"mobile": true,
	"lastmod": p.Updated,
	}
	if len(p.Images) > 0 {
	imgs := []stm.URL{}
	for _, i := range p.Images {
	imgs = append(imgs, stm.URL{"loc": i, "title": ""})
	}
	u["image"] = imgs
	}
	sm.Add(u)
	}

	// Add top URL
	sm.Add(stm.URL{
	"loc": pre,
	"changefreq": "daily",
	"priority": "1.0",
	"lastmod": lastSiteMod,
	})

	w.Write(sm.XMLContent())

	return nil
	}
	diff --git a/webfinger.go b/webfinger.go
	index f8a0d7b..c95d88e 100644
	--- a/webfinger.go
	+++ b/webfinger.go
	@@ -1,81 +1,82 @@
	/*
	* Copyright © 2018 A Bunch Tell LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"github.com/writeas/go-webfinger"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/config"
	"net/http"
	)

	type wfResolver struct {
	db *datastore
	cfg *config.Config
	}

	var wfUserNotFoundErr = impart.HTTPError{http.StatusNotFound, "User not found."}

	func (wfr wfResolver) FindUser(username string, host, requestHost string, r []webfinger.Rel) (*webfinger.Resource, error) {
	var c *Collection
	var err error
	if wfr.cfg.App.SingleUser {
	c, err = wfr.db.GetCollectionByID(1)
	} else {
	c, err = wfr.db.GetCollection(username)
	}
	if err != nil {
	log.Error("Unable to get blog: %v", err)
	return nil, err
	}
	+ c.hostName = wfr.cfg.App.Host
	if wfr.cfg.App.SingleUser {
	// Ensure handle matches user-chosen one on single-user blogs
	if username != c.Alias {
	log.Info("Username '%s' is not handle '%s'", username, c.Alias)
	return nil, wfUserNotFoundErr
	}
	}
	// Only return information if site has federation enabled.
	// TODO: enable two levels of federation? Unlisted or Public on timelines?
	if !wfr.cfg.App.Federation {
	return nil, wfUserNotFoundErr
	}

	res := webfinger.Resource{
	Subject: "acct:" + username + "@" + host,
	Aliases: []string{
	c.CanonicalURL(),
	c.FederatedAccount(),
	},
	Links: []webfinger.Link{
	{
	HRef: c.CanonicalURL(),
	Type: "text/html",
	Rel: "https://webfinger.net/rel/profile-page",
	},
	{
	HRef: c.FederatedAccount(),
	Type: "application/activity+json",
	Rel: "self",
	},
	},
	}
	return &res, nil
	}

	func (wfr wfResolver) DummyUser(username string, hostname string, r []webfinger.Rel) (*webfinger.Resource, error) {
	return nil, wfUserNotFoundErr
	}

	func (wfr wfResolver) IsNotFoundError(err error) bool {
	return err == wfUserNotFoundErr
	}

File Metadata

Mime Type: text/x-diff
Expires: Fri, Jan 31, 5:56 PM (1 d, 2 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3145964

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions