No OneTemporary
Actions

Size

68 KB

Subscribers

None

View Options

	diff --git a/account.go b/account.go
	index 1edba1a..5612389 100644
	--- a/account.go
	+++ b/account.go
	@@ -1,1039 +1,1041 @@
	package writefreely

	import (
	"encoding/json"
	"fmt"
	"github.com/gorilla/mux"
	"github.com/gorilla/sessions"
	"github.com/guregu/null/zero"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/data"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/author"
	"github.com/writeas/writefreely/page"
	"html/template"
	"net/http"
	"regexp"
	"strings"
	"sync"
	"time"
	)

	type (
	userSettings struct {
	Username string `schema:"username" json:"username"`
	Email string `schema:"email" json:"email"`
	NewPass string `schema:"new-pass" json:"new_pass"`
	OldPass string `schema:"current-pass" json:"current_pass"`
	IsLogOut bool `schema:"logout" json:"logout"`
	}

	UserPage struct {
	page.StaticPage

	PageTitle string
	Separator template.HTML
	+ IsAdmin bool
	}
	)

	-func NewUserPage(app app, r http.Request, username, title string, flashes []string) *UserPage {
	+func NewUserPage(app app, r http.Request, u User, title string, flashes []string) UserPage {
	up := &UserPage{
	StaticPage: pageForReq(app, r),
	PageTitle: title,
	}
	- up.Username = username
	+ up.Username = u.Username
	up.Flashes = flashes
	up.Path = r.URL.Path
	+ up.IsAdmin = u.IsAdmin()
	return up
	}

	func (up UserPage) SetMessaging(u User) {
	//up.NeedsAuth = app.db.DoesUserNeedAuth(u.ID)
	}

	const (
	loginAttemptExpiration = 3 * time.Second
	)

	var actuallyUsernameReg = regexp.MustCompile("username is actually ([a-z0-9\\-]+)\\. Please try that, instead")

	func apiSignup(app app, w http.ResponseWriter, r http.Request) error {
	_, err := signup(app, w, r)
	return err
	}

	func signup(app app, w http.ResponseWriter, r http.Request) (*AuthUser, error) {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))

	// Get params
	var ur userRegistration
	if reqJSON {
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&ur)
	if err != nil {
	log.Error("Couldn't parse signup JSON request: %v\n", err)
	return nil, ErrBadJSON
	}
	} else {
	// Check if user is already logged in
	u := getUserSession(app, r)
	if u != nil {
	return &AuthUser{User: u}, nil
	}

	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse signup form request: %v\n", err)
	return nil, ErrBadFormData
	}

	err = app.formDecoder.Decode(&ur, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode signup form request: %v\n", err)
	return nil, ErrBadFormData
	}
	}

	return signupWithRegistration(app, ur, w, r)
	}

	func signupWithRegistration(app app, signup userRegistration, w http.ResponseWriter, r http.Request) (*AuthUser, error) {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))

	// Validate required params (alias)
	if signup.Alias == "" {
	return nil, impart.HTTPError{http.StatusBadRequest, "A username is required."}
	}
	if signup.Pass == "" {
	return nil, impart.HTTPError{http.StatusBadRequest, "A password is required."}
	}
	var desiredUsername string
	if signup.Normalize {
	// With this option we simply conform the username to what we expect
	// without complaining. Since they might've done something funny, like
	// enter: write.as/Way Out There, we'll use their raw input for the new
	// collection name and sanitize for the slug / username.
	desiredUsername = signup.Alias
	signup.Alias = getSlug(signup.Alias, "")
	}
	if !author.IsValidUsername(app.cfg, signup.Alias) {
	// Ensure the username is syntactically correct.
	return nil, impart.HTTPError{http.StatusPreconditionFailed, "Username is reserved or isn't valid. It must be at least 3 characters long, and can only include letters, numbers, and hyphens."}
	}

	// Handle empty optional params
	// TODO: remove this var
	createdWithPass := true
	hashedPass, err := auth.HashPass([]byte(signup.Pass))
	if err != nil {
	return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
	}

	// Create struct to insert
	u := &User{
	Username: signup.Alias,
	HashedPass: hashedPass,
	HasPass: createdWithPass,
	Email: zero.NewString("", signup.Email != ""),
	Created: time.Now().Truncate(time.Second).UTC(),
	}
	if signup.Email != "" {
	encEmail, err := data.Encrypt(app.keys.emailKey, signup.Email)
	if err != nil {
	log.Error("Unable to encrypt email: %s\n", err)
	} else {
	u.Email.String = string(encEmail)
	}
	}

	// Create actual user
	if err := app.db.CreateUser(u, desiredUsername); err != nil {
	return nil, err
	}

	// Add back unencrypted data for response
	if signup.Email != "" {
	u.Email.String = signup.Email
	}

	resUser := &AuthUser{
	User: u,
	}
	if !createdWithPass {
	resUser.Password = signup.Pass
	}
	title := signup.Alias
	if signup.Normalize {
	title = desiredUsername
	}
	resUser.Collections = &[]Collection{
	{
	Alias: signup.Alias,
	Title: title,
	},
	}

	var token string
	if reqJSON && !signup.Web {
	token, err = app.db.GetAccessToken(u.ID)
	if err != nil {
	return nil, impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
	}
	resUser.AccessToken = token
	} else {
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
	log.Error("Session: %v; ignoring", err)
	}
	session.Values[cookieUserVal] = resUser.User.Cookie()
	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't save session: %v", err)
	return nil, err
	}
	}
	if reqJSON {
	return resUser, impart.WriteSuccess(w, resUser, http.StatusCreated)
	}

	return resUser, nil
	}

	func viewLogout(app app, w http.ResponseWriter, r http.Request) error {
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	return ErrInternalCookieSession
	}

	// Ensure user has an email or password set before they go, so they don't
	// lose access to their account.
	val := session.Values[cookieUserVal]
	var u = &User{}
	var ok bool
	if u, ok = val.(*User); !ok {
	log.Error("Error casting user object on logout. Vals: %+v Resetting cookie.", session.Values)

	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't save session on logout: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
	}

	return impart.HTTPError{http.StatusFound, "/"}
	}

	u, err = app.db.GetUserByID(u.ID)
	if err != nil && err != ErrUserNotFound {
	return impart.HTTPError{http.StatusInternalServerError, "Unable to fetch user information."}
	}

	session.Options.MaxAge = -1

	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't save session on logout: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to save cookie session."}
	}

	return impart.HTTPError{http.StatusFound, "/"}
	}

	func handleAPILogout(app app, w http.ResponseWriter, r http.Request) error {
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}
	t := auth.GetToken(accessToken)
	if len(t) == 0 {
	return ErrNoAccessToken
	}
	err := app.db.DeleteToken(t)
	if err != nil {
	return err
	}
	return impart.HTTPError{Status: http.StatusNoContent}
	}

	func viewLogin(app app, w http.ResponseWriter, r http.Request) error {
	var earlyError string
	oneTimeToken := r.FormValue("with")
	if oneTimeToken != "" {
	log.Info("Calling login with one-time token.")
	err := login(app, w, r)
	if err != nil {
	log.Info("Received error: %v", err)
	earlyError = fmt.Sprintf("%s", err)
	}
	}

	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session; ignoring: %v", err)
	}

	p := &struct {
	page.StaticPage
	To string
	Message template.HTML
	Flashes []template.HTML
	Username string
	}{
	pageForReq(app, r),
	r.FormValue("to"),
	template.HTML(""),
	[]template.HTML{},
	getTempInfo(app, "login-user", r, w),
	}

	if earlyError != "" {
	p.Flashes = append(p.Flashes, template.HTML(earlyError))
	}

	// Display any error messages
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}
	err = pages["login.tmpl"].ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render login: %v", err)
	return err
	}
	return nil
	}

	func webLogin(app app, w http.ResponseWriter, r http.Request) error {
	err := login(app, w, r)
	if err != nil {
	username := r.FormValue("alias")
	// Login request was unsuccessful; save the error in the session and redirect them
	if err, ok := err.(impart.HTTPError); ok {
	session, _ := app.sessionStore.Get(r, cookieName)
	if session != nil {
	session.AddFlash(err.Message)
	session.Save(r, w)
	}

	if m := actuallyUsernameReg.FindStringSubmatch(err.Message); len(m) > 0 {
	// Retain fixed username recommendation for the login form
	username = m[1]
	}
	}

	// Pass along certain information
	saveTempInfo(app, "login-user", username, r, w)

	// Retain post-login URL if one was given
	redirectTo := "/login"
	postLoginRedirect := r.FormValue("to")
	if postLoginRedirect != "" {
	redirectTo += "?to=" + postLoginRedirect
	}

	log.Error("Unable to login: %v", err)
	return impart.HTTPError{http.StatusTemporaryRedirect, redirectTo}
	}

	return nil
	}

	var loginAttemptUsers = sync.Map{}

	func login(app app, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	oneTimeToken := r.FormValue("with")
	verbose := r.FormValue("all") == "true" \|\| r.FormValue("verbose") == "1" \|\| r.FormValue("verbose") == "true" \|\| (reqJSON && oneTimeToken != "")

	redirectTo := r.FormValue("to")
	if redirectTo == "" {
	if app.cfg.App.SingleUser {
	redirectTo = "/me/new"
	} else {
	redirectTo = "/"
	}
	}

	var u *User
	var err error
	var signin userCredentials

	// Log in with one-time token if one is given
	if oneTimeToken != "" {
	log.Info("Login: Logging user in via token.")
	userID := app.db.GetUserID(oneTimeToken)
	if userID == -1 {
	log.Error("Login: Got user -1 from token")
	err := ErrBadAccessToken
	err.Message = "Expired or invalid login code."
	return err
	}
	log.Info("Login: Found user %d.", userID)

	u, err = app.db.GetUserByID(userID)
	if err != nil {
	log.Error("Unable to fetch user on one-time token login: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "There was an error retrieving the user you want."}
	}
	log.Info("Login: Got user via token")
	} else {
	// Get params
	if reqJSON {
	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&signin)
	if err != nil {
	log.Error("Couldn't parse signin JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse signin form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&signin, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode signin form request: %v\n", err)
	return ErrBadFormData
	}
	}

	log.Info("Login: Attempting login for '%s'", signin.Alias)

	// Validate required params (all)
	if signin.Alias == "" {
	msg := "Parameter `alias` required."
	if signin.Web {
	msg = "A username is required."
	}
	return impart.HTTPError{http.StatusBadRequest, msg}
	}
	if !signin.EmailLogin && signin.Pass == "" {
	msg := "Parameter `pass` required."
	if signin.Web {
	msg = "A password is required."
	}
	return impart.HTTPError{http.StatusBadRequest, msg}
	}

	// Prevent excessive login attempts on the same account
	// Skip this check in dev environment
	if !app.cfg.Server.Dev {
	now := time.Now()
	attemptExp, att := loginAttemptUsers.LoadOrStore(signin.Alias, now.Add(loginAttemptExpiration))
	if att {
	if attemptExpTime, ok := attemptExp.(time.Time); ok {
	if attemptExpTime.After(now) {
	// This user attempted previously, and the period hasn't expired yet
	return impart.HTTPError{http.StatusTooManyRequests, "You're doing that too much."}
	} else {
	// This user attempted previously, but the time expired; free up space
	loginAttemptUsers.Delete(signin.Alias)
	}
	} else {
	log.Error("Unable to cast expiration to time")
	}
	}
	}

	// Retrieve password
	u, err = app.db.GetUserForAuth(signin.Alias)
	if err != nil {
	log.Info("Unable to getUserForAuth on %s: %v", signin.Alias, err)
	if strings.IndexAny(signin.Alias, "@") > 0 {
	log.Info("Suggesting: %s", ErrUserNotFoundEmail.Message)
	return ErrUserNotFoundEmail
	}
	return err
	}
	// Authenticate
	if u.Email.String == "" {
	// User has no email set, so check if they haven't added a password, either,
	// so we can return a more helpful error message.
	if hasPass, _ := app.db.IsUserPassSet(u.ID); !hasPass {
	log.Info("Tried logging in to %s, but no password or email.", signin.Alias)
	return impart.HTTPError{http.StatusPreconditionFailed, "This user never added a password or email address. Please contact us for help."}
	}
	}
	if !auth.Authenticated(u.HashedPass, []byte(signin.Pass)) {
	return impart.HTTPError{http.StatusUnauthorized, "Incorrect password."}
	}
	}

	if reqJSON && !signin.Web {
	var token string
	if r.Header.Get("User-Agent") == "" {
	// Get last created token when User-Agent is empty
	token = app.db.FetchLastAccessToken(u.ID)
	if token == "" {
	token, err = app.db.GetAccessToken(u.ID)
	}
	} else {
	token, err = app.db.GetAccessToken(u.ID)
	}
	if err != nil {
	log.Error("Login: Unable to create access token: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, "Could not create access token. Try re-authenticating."}
	}
	resUser := getVerboseAuthUser(app, token, u, verbose)
	return impart.WriteSuccess(w, resUser, http.StatusOK)
	}

	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	log.Error("Login: Session: %v; ignoring", err)
	}

	// Remove unwanted data
	session.Values[cookieUserVal] = u.Cookie()
	err = session.Save(r, w)
	if err != nil {
	log.Error("Login: Couldn't save session: %v", err)
	// TODO: return error
	}

	// Send success
	if reqJSON {
	return impart.WriteSuccess(w, &AuthUser{User: u}, http.StatusOK)
	}
	log.Info("Login: Redirecting to %s", redirectTo)
	w.Header().Set("Location", redirectTo)
	w.WriteHeader(http.StatusFound)
	return nil
	}

	func getVerboseAuthUser(app app, token string, u User, verbose bool) *AuthUser {
	resUser := &AuthUser{
	AccessToken: token,
	User: u,
	}

	// Fetch verbose user data if requested
	if verbose {
	posts, err := app.db.GetUserPosts(u)
	if err != nil {
	log.Error("Login: Unable to get user posts: %v", err)
	}
	colls, err := app.db.GetCollections(u)
	if err != nil {
	log.Error("Login: Unable to get user collections: %v", err)
	}
	passIsSet, err := app.db.IsUserPassSet(u.ID)
	if err != nil {
	// TODO: correct error meesage
	log.Error("Login: Unable to get user collections: %v", err)
	}

	resUser.Posts = posts
	resUser.Collections = colls
	resUser.User.HasPass = passIsSet
	}
	return resUser
	}

	func viewExportOptions(app app, u User, w http.ResponseWriter, r *http.Request) error {
	// Fetch extra user data
	- p := NewUserPage(app, r, u.Username, "Export", nil)
	+ p := NewUserPage(app, r, u, "Export", nil)

	showUserPage(w, "export", p)
	return nil
	}

	func viewExportPosts(app app, w http.ResponseWriter, r http.Request) ([]byte, string, error) {
	var filename string
	var u = &User{}
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	if reqJSON {
	// Use given Authorization header
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return nil, filename, ErrNoAccessToken
	}

	userID := app.db.GetUserID(accessToken)
	if userID == -1 {
	return nil, filename, ErrBadAccessToken
	}

	var err error
	u, err = app.db.GetUserByID(userID)
	if err != nil {
	return nil, filename, impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve requested user."}
	}
	} else {
	// Use user cookie
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	log.Error("Session: %v; ignoring", err)
	}

	val := session.Values[cookieUserVal]
	var ok bool
	if u, ok = val.(*User); !ok {
	return nil, filename, ErrNotLoggedIn
	}
	}

	filename = u.Username + "-posts-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")

	// Fetch data we're exporting
	var err error
	var data []byte
	posts, err := app.db.GetUserPosts(u)
	if err != nil {
	return data, filename, err
	}

	// Export as CSV
	if strings.HasSuffix(r.URL.Path, ".csv") {
	data = exportPostsCSV(u, posts)
	return data, filename, err
	}
	if strings.HasSuffix(r.URL.Path, ".zip") {
	data = exportPostsZip(u, posts)
	return data, filename, err
	}

	if r.FormValue("pretty") == "1" {
	data, err = json.MarshalIndent(posts, "", "\t")
	} else {
	data, err = json.Marshal(posts)
	}
	return data, filename, err
	}

	func viewExportFull(app app, w http.ResponseWriter, r http.Request) ([]byte, string, error) {
	var err error
	filename := ""
	u := getUserSession(app, r)
	if u == nil {
	return nil, filename, ErrNotLoggedIn
	}
	filename = u.Username + "-" + time.Now().Truncate(time.Second).UTC().Format("200601021504")

	exportUser := compileFullExport(app, u)

	var data []byte
	if r.FormValue("pretty") == "1" {
	data, err = json.MarshalIndent(exportUser, "", "\t")
	} else {
	data, err = json.Marshal(exportUser)
	}
	return data, filename, err
	}

	func viewMeAPI(app app, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	uObj := struct {
	ID int64 `json:"id,omitempty"`
	Username string `json:"username,omitempty"`
	}{}
	var err error

	if reqJSON {
	_, uObj.Username, err = app.db.GetUserDataFromToken(r.Header.Get("Authorization"))
	if err != nil {
	return err
	}
	} else {
	u := getUserSession(app, r)
	if u == nil {
	return impart.WriteSuccess(w, uObj, http.StatusOK)
	}
	uObj.Username = u.Username
	}

	return impart.WriteSuccess(w, uObj, http.StatusOK)
	}

	func viewMyPostsAPI(app app, u User, w http.ResponseWriter, r *http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	if !reqJSON {
	return ErrBadRequestedType
	}

	var err error
	p := GetPostsCache(u.ID)
	if p == nil {
	userPostsCache.Lock()
	if userPostsCache.users[u.ID].ready == nil {
	userPostsCache.users[u.ID] = postsCacheItem{ready: make(chan struct{})}
	userPostsCache.Unlock()

	p, err = app.db.GetUserPosts(u)
	if err != nil {
	return err
	}

	CachePosts(u.ID, p)
	} else {
	userPostsCache.Unlock()

	<-userPostsCache.users[u.ID].ready
	p = GetPostsCache(u.ID)
	}
	}

	return impart.WriteSuccess(w, p, http.StatusOK)
	}

	func viewMyCollectionsAPI(app app, u User, w http.ResponseWriter, r *http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))
	if !reqJSON {
	return ErrBadRequestedType
	}

	p, err := app.db.GetCollections(u)
	if err != nil {
	return err
	}

	return impart.WriteSuccess(w, p, http.StatusOK)
	}

	func viewArticles(app app, u User, w http.ResponseWriter, r *http.Request) error {
	p, err := app.db.GetAnonymousPosts(u)
	if err != nil {
	log.Error("unable to fetch anon posts: %v", err)
	}
	// nil-out AnonymousPosts slice for easy detection in the template
	if p != nil && len(*p) == 0 {
	p = nil
	}

	f, err := getSessionFlashes(app, w, r, nil)
	if err != nil {
	log.Error("unable to fetch flashes: %v", err)
	}

	c, err := app.db.GetPublishableCollections(u)
	if err != nil {
	log.Error("unable to fetch collections: %v", err)
	}

	d := struct {
	*UserPage
	AnonymousPosts *[]PublicPost
	Collections *[]Collection
	}{
	- UserPage: NewUserPage(app, r, u.Username, u.Username+"'s Posts", f),
	+ UserPage: NewUserPage(app, r, u, u.Username+"'s Posts", f),
	AnonymousPosts: p,
	Collections: c,
	}
	d.UserPage.SetMessaging(u)
	w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
	w.Header().Set("Expires", "Thu, 04 Oct 1990 20:00:00 GMT")
	showUserPage(w, "articles", d)

	return nil
	}

	func viewCollections(app app, u User, w http.ResponseWriter, r *http.Request) error {
	c, err := app.db.GetCollections(u)
	if err != nil {
	log.Error("unable to fetch collections: %v", err)
	return fmt.Errorf("No collections")
	}

	f, _ := getSessionFlashes(app, w, r, nil)

	uc, _ := app.db.GetUserCollectionCount(u.ID)
	// TODO: handle any errors

	d := struct {
	*UserPage
	Collections *[]Collection

	UsedCollections, TotalCollections int

	NewBlogsDisabled bool
	}{
	- UserPage: NewUserPage(app, r, u.Username, u.Username+"'s Blogs", f),
	+ UserPage: NewUserPage(app, r, u, u.Username+"'s Blogs", f),
	Collections: c,
	UsedCollections: int(uc),
	NewBlogsDisabled: !app.cfg.App.CanCreateBlogs(uc),
	}
	d.UserPage.SetMessaging(u)
	showUserPage(w, "collections", d)

	return nil
	}

	func viewEditCollection(app app, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	c, err := app.db.GetCollection(vars["collection"])
	if err != nil {
	return err
	}
	if c.OwnerID != u.ID {
	return ErrCollectionNotFound
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)
	obj := struct {
	*UserPage
	*Collection
	}{
	- UserPage: NewUserPage(app, r, u.Username, "Edit "+c.DisplayTitle(), flashes),
	+ UserPage: NewUserPage(app, r, u, "Edit "+c.DisplayTitle(), flashes),
	Collection: c,
	}

	if err := userPages["user/collection.tmpl"].ExecuteTemplate(w, "collection", obj); err != nil {
	log.Error("Error parsing user collection: %v", err)
	}
	return nil
	}

	func updateSettings(app app, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r.Header.Get("Content-Type"))

	var s userSettings
	var u *User
	var sess *sessions.Session
	var err error
	if reqJSON {
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}

	u, err = app.db.GetAPIUser(accessToken)
	if err != nil {
	return ErrBadAccessToken
	}

	decoder := json.NewDecoder(r.Body)
	err := decoder.Decode(&s)
	if err != nil {
	log.Error("Couldn't parse settings JSON request: %v\n", err)
	return ErrBadJSON
	}

	// Prevent all username updates
	// TODO: support changing username via JSON API request
	s.Username = ""
	} else {
	u, sess = getUserAndSession(app, r)
	if u == nil {
	return ErrNotLoggedIn
	}

	err := r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse settings form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&s, r.PostForm)
	if err != nil {
	log.Error("Couldn't decode settings form request: %v\n", err)
	return ErrBadFormData
	}
	}

	// Do update
	postUpdateReturn := r.FormValue("return")
	redirectTo := "/me/settings"
	if s.IsLogOut {
	redirectTo += "?logout=1"
	} else if postUpdateReturn != "" {
	redirectTo = postUpdateReturn
	}

	// Only do updates on values we need
	if s.Username != "" && s.Username == u.Username {
	// Username hasn't actually changed; blank it out
	s.Username = ""
	}
	err = app.db.ChangeSettings(app, u, &s)
	if err != nil {
	if reqJSON {
	return err
	}

	if err, ok := err.(impart.HTTPError); ok {
	addSessionFlash(app, w, r, err.Message, nil)
	}
	} else {
	// Successful update.
	if reqJSON {
	return impart.WriteSuccess(w, u, http.StatusOK)
	}

	if s.IsLogOut {
	redirectTo = "/me/logout"
	} else {
	sess.Values[cookieUserVal] = u.Cookie()
	addSessionFlash(app, w, r, "Account updated.", nil)
	}
	}

	w.Header().Set("Location", redirectTo)
	w.WriteHeader(http.StatusFound)
	return nil
	}

	func updatePassphrase(app app, w http.ResponseWriter, r http.Request) error {
	accessToken := r.Header.Get("Authorization")
	if accessToken == "" {
	return ErrNoAccessToken
	}

	curPass := r.FormValue("current")
	newPass := r.FormValue("new")
	// Ensure a new password is given (always required)
	if newPass == "" {
	return impart.HTTPError{http.StatusBadRequest, "Provide a new password."}
	}

	userID, sudo := app.db.GetUserIDPrivilege(accessToken)
	if userID == -1 {
	return ErrBadAccessToken
	}

	// Ensure a current password is given if the access token doesn't have sudo
	// privileges.
	if !sudo && curPass == "" {
	return impart.HTTPError{http.StatusBadRequest, "Provide current password."}
	}

	// Hash the new password
	hashedPass, err := auth.HashPass([]byte(newPass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, "Could not create password hash."}
	}

	// Do update
	err = app.db.ChangePassphrase(userID, sudo, curPass, hashedPass)
	if err != nil {
	return err
	}

	return impart.WriteSuccess(w, struct{}{}, http.StatusOK)
	}

	func viewStats(app app, u User, w http.ResponseWriter, r *http.Request) error {
	var c *Collection
	var err error
	vars := mux.Vars(r)
	alias := vars["collection"]
	if alias != "" {
	c, err = app.db.GetCollection(alias)
	if err != nil {
	return err
	}
	if c.OwnerID != u.ID {
	return ErrCollectionNotFound
	}
	}

	topPosts, err := app.db.GetTopPosts(u, alias)
	if err != nil {
	log.Error("Unable to get top posts: %v", err)
	return err
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)
	titleStats := ""
	if c != nil {
	titleStats = c.DisplayTitle() + " "
	}

	obj := struct {
	*UserPage
	VisitsBlog string
	Collection *Collection
	TopPosts *[]PublicPost
	APFollowers int
	}{
	- UserPage: NewUserPage(app, r, u.Username, titleStats+"Stats", flashes),
	+ UserPage: NewUserPage(app, r, u, titleStats+"Stats", flashes),
	VisitsBlog: alias,
	Collection: c,
	TopPosts: topPosts,
	}
	if app.cfg.App.Federation {
	folls, err := app.db.GetAPFollowers(c)
	if err != nil {
	return err
	}
	obj.APFollowers = len(*folls)
	}

	showUserPage(w, "stats", obj)
	return nil
	}

	func viewSettings(app app, u User, w http.ResponseWriter, r *http.Request) error {
	fullUser, err := app.db.GetUserByID(u.ID)
	if err != nil {
	log.Error("Unable to get user for settings: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
	}

	passIsSet, err := app.db.IsUserPassSet(u.ID)
	if err != nil {
	log.Error("Unable to get isUserPassSet for settings: %s", err)
	return impart.HTTPError{http.StatusInternalServerError, "Unable to retrieve user data. The humans have been alerted."}
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)

	obj := struct {
	*UserPage
	Email string
	HasPass bool
	IsLogOut bool
	}{
	- UserPage: NewUserPage(app, r, u.Username, "Account Settings", flashes),
	+ UserPage: NewUserPage(app, r, u, "Account Settings", flashes),
	Email: fullUser.EmailClear(app.keys),
	HasPass: passIsSet,
	IsLogOut: r.FormValue("logout") == "1",
	}

	showUserPage(w, "settings", obj)
	return nil
	}

	func saveTempInfo(app app, key, val string, r http.Request, w http.ResponseWriter) error {
	session, err := app.sessionStore.Get(r, "t")
	if err != nil {
	return ErrInternalCookieSession
	}

	session.Values[key] = val
	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't saveTempInfo for key-val (%s:%s): %v", key, val, err)
	}
	return err
	}

	func getTempInfo(app app, key string, r http.Request, w http.ResponseWriter) string {
	session, err := app.sessionStore.Get(r, "t")
	if err != nil {
	return ""
	}

	// Get the information
	var s = ""
	var ok bool
	if s, ok = session.Values[key].(string); !ok {
	return ""
	}

	// Delete cookie
	session.Options.MaxAge = -1
	err = session.Save(r, w)
	if err != nil {
	log.Error("Couldn't erase temp data for key %s: %v", key, err)
	}

	// Return value
	return s
	}
	diff --git a/admin.go b/admin.go
	index 29cff31..6d3cffd 100644
	--- a/admin.go
	+++ b/admin.go
	@@ -1,21 +1,124 @@
	package writefreely

	import (
	"fmt"
	+ "github.com/gogits/gogs/pkg/tool"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"net/http"
	+ "runtime"
	+ "time"
	)

	+var (
	+ appStartTime = time.Now()
	+ sysStatus systemStatus
	+)
	+
	+type systemStatus struct {
	+ Uptime string
	+ NumGoroutine int
	+
	+ // General statistics.
	+ MemAllocated string // bytes allocated and still in use
	+ MemTotal string // bytes allocated (even if freed)
	+ MemSys string // bytes obtained from system (sum of XxxSys below)
	+ Lookups uint64 // number of pointer lookups
	+ MemMallocs uint64 // number of mallocs
	+ MemFrees uint64 // number of frees
	+
	+ // Main allocation heap statistics.
	+ HeapAlloc string // bytes allocated and still in use
	+ HeapSys string // bytes obtained from system
	+ HeapIdle string // bytes in idle spans
	+ HeapInuse string // bytes in non-idle span
	+ HeapReleased string // bytes released to the OS
	+ HeapObjects uint64 // total number of allocated objects
	+
	+ // Low-level fixed-size structure allocator statistics.
	+ // Inuse is bytes used now.
	+ // Sys is bytes obtained from system.
	+ StackInuse string // bootstrap stacks
	+ StackSys string
	+ MSpanInuse string // mspan structures
	+ MSpanSys string
	+ MCacheInuse string // mcache structures
	+ MCacheSys string
	+ BuckHashSys string // profiling bucket hash table
	+ GCSys string // GC metadata
	+ OtherSys string // other system allocations
	+
	+ // Garbage collector statistics.
	+ NextGC string // next run in HeapAlloc time (bytes)
	+ LastGC string // last run in absolute time (ns)
	+ PauseTotalNs string
	+ PauseNs string // circular buffer of recent GC pause times, most recent at [(NumGC+255)%256]
	+ NumGC uint32
	+}
	+
	+func handleViewAdminDash(app app, u User, w http.ResponseWriter, r *http.Request) error {
	+ updateAppStats()
	+ p := struct {
	+ *UserPage
	+ Message string
	+ SysStatus systemStatus
	+ }{
	+ NewUserPage(app, r, u, "Admin", nil),
	+ r.FormValue("m"),
	+ sysStatus,
	+ }
	+
	+ showUserPage(w, "admin", p)
	+ return nil
	+}
	+
	+func updateAppStats() {
	+ sysStatus.Uptime = tool.TimeSincePro(appStartTime)
	+
	+ m := new(runtime.MemStats)
	+ runtime.ReadMemStats(m)
	+ sysStatus.NumGoroutine = runtime.NumGoroutine()
	+
	+ sysStatus.MemAllocated = tool.FileSize(int64(m.Alloc))
	+ sysStatus.MemTotal = tool.FileSize(int64(m.TotalAlloc))
	+ sysStatus.MemSys = tool.FileSize(int64(m.Sys))
	+ sysStatus.Lookups = m.Lookups
	+ sysStatus.MemMallocs = m.Mallocs
	+ sysStatus.MemFrees = m.Frees
	+
	+ sysStatus.HeapAlloc = tool.FileSize(int64(m.HeapAlloc))
	+ sysStatus.HeapSys = tool.FileSize(int64(m.HeapSys))
	+ sysStatus.HeapIdle = tool.FileSize(int64(m.HeapIdle))
	+ sysStatus.HeapInuse = tool.FileSize(int64(m.HeapInuse))
	+ sysStatus.HeapReleased = tool.FileSize(int64(m.HeapReleased))
	+ sysStatus.HeapObjects = m.HeapObjects
	+
	+ sysStatus.StackInuse = tool.FileSize(int64(m.StackInuse))
	+ sysStatus.StackSys = tool.FileSize(int64(m.StackSys))
	+ sysStatus.MSpanInuse = tool.FileSize(int64(m.MSpanInuse))
	+ sysStatus.MSpanSys = tool.FileSize(int64(m.MSpanSys))
	+ sysStatus.MCacheInuse = tool.FileSize(int64(m.MCacheInuse))
	+ sysStatus.MCacheSys = tool.FileSize(int64(m.MCacheSys))
	+ sysStatus.BuckHashSys = tool.FileSize(int64(m.BuckHashSys))
	+ sysStatus.GCSys = tool.FileSize(int64(m.GCSys))
	+ sysStatus.OtherSys = tool.FileSize(int64(m.OtherSys))
	+
	+ sysStatus.NextGC = tool.FileSize(int64(m.NextGC))
	+ sysStatus.LastGC = fmt.Sprintf("%.1fs", float64(time.Now().UnixNano()-int64(m.LastGC))/1000/1000/1000)
	+ sysStatus.PauseTotalNs = fmt.Sprintf("%.1fs", float64(m.PauseTotalNs)/1000/1000/1000)
	+ sysStatus.PauseNs = fmt.Sprintf("%.3fs", float64(m.PauseNs[(m.NumGC+255)%256])/1000/1000/1000)
	+ sysStatus.NumGC = m.NumGC
	+}
	+
	func adminResetPassword(app app, u User, newPass string) error {
	hashedPass, err := auth.HashPass([]byte(newPass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
	}

	err = app.db.ChangePassphrase(u.ID, true, "", hashedPass)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
	}
	return nil
	}
	diff --git a/handle.go b/handle.go
	index 6fde474..62ff436 100644
	--- a/handle.go
	+++ b/handle.go
	@@ -1,584 +1,622 @@
	package writefreely

	import (
	"fmt"
	"html/template"
	"net/http"
	"net/url"
	"runtime/debug"
	"strconv"
	"strings"
	"time"

	"github.com/gorilla/sessions"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/page"
	)

	type UserLevel int

	const (
	UserLevelNone UserLevel = iota // user or not -- ignored
	UserLevelOptional // user or not -- object fetched if user
	UserLevelNoneRequired // non-user (required)
	UserLevelUser // user (required)
	)

	type (
	handlerFunc func(app app, w http.ResponseWriter, r http.Request) error
	userHandlerFunc func(app app, u User, w http.ResponseWriter, r *http.Request) error
	dataHandlerFunc func(app app, w http.ResponseWriter, r http.Request) ([]byte, string, error)
	authFunc func(app app, r http.Request) (*User, error)
	)

	type Handler struct {
	errors *ErrorPages
	sessionStore *sessions.CookieStore
	app *app
	}

	// ErrorPages hold template HTML error pages for displaying errors to the user.
	// In each, there should be a defined template named "base".
	type ErrorPages struct {
	NotFound *template.Template
	Gone *template.Template
	InternalServerError *template.Template
	Blank *template.Template
	}

	// NewHandler returns a new Handler instance, using the given StaticPage data,
	// and saving alias to the application's CookieStore.
	func NewHandler(app app) Handler {
	h := &Handler{
	errors: &ErrorPages{
	NotFound: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>404</title></head><body><p>Not found.</p></body></html>{{end}}")),
	Gone: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>410</title></head><body><p>Gone.</p></body></html>{{end}}")),
	InternalServerError: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>500</title></head><body><p>Internal server error.</p></body></html>{{end}}")),
	Blank: template.Must(template.New("").Parse("{{define \"base\"}}<html><head><title>{{.Title}}</title></head><body><p>{{.Content}}</p></body></html>{{end}}")),
	},
	sessionStore: app.sessionStore,
	app: app,
	}

	return h
	}

	// SetErrorPages sets the given set of ErrorPages as templates for any errors
	// that come up.
	func (h Handler) SetErrorPages(e ErrorPages) {
	h.errors = e
	}

	// User handles requests made in the web application by the authenticated user.
	// This provides user-friendly HTML pages and actions that work in the browser.
	func (h *Handler) User(f userHandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	h.handleHTTPError(w, r, func() error {
	var status int
	start := time.Now()

	defer func() {
	if e := recover(); e != nil {
	log.Error("%s: %s", e, debug.Stack())
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = http.StatusInternalServerError
	}

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	u := getUserSession(h.app, r)
	if u == nil {
	err := ErrNotLoggedIn
	status = err.Status
	return err
	}

	err := f(h.app, u, w, r)
	if err == nil {
	status = http.StatusOK
	} else if err, ok := err.(impart.HTTPError); ok {
	status = err.Status
	} else {
	status = http.StatusInternalServerError
	}

	return err
	}())
	}
	}

	+// Admin handles requests on /admin routes
	+func (h *Handler) Admin(f userHandlerFunc) http.HandlerFunc {
	+ return func(w http.ResponseWriter, r *http.Request) {
	+ h.handleHTTPError(w, r, func() error {
	+ var status int
	+ start := time.Now()
	+
	+ defer func() {
	+ if e := recover(); e != nil {
	+ log.Error("%s: %s", e, debug.Stack())
	+ h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	+ status = http.StatusInternalServerError
	+ }
	+
	+ log.Info(fmt.Sprintf("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent()))
	+ }()
	+
	+ u := getUserSession(h.app, r)
	+ if u == nil \|\| !u.IsAdmin() {
	+ err := impart.HTTPError{http.StatusNotFound, ""}
	+ status = err.Status
	+ return err
	+ }
	+
	+ err := f(h.app, u, w, r)
	+ if err == nil {
	+ status = http.StatusOK
	+ } else if err, ok := err.(impart.HTTPError); ok {
	+ status = err.Status
	+ } else {
	+ status = http.StatusInternalServerError
	+ }
	+
	+ return err
	+ }())
	+ }
	+}
	+
	// UserAPI handles requests made in the API by the authenticated user.
	// This provides user-friendly HTML pages and actions that work in the browser.
	func (h *Handler) UserAPI(f userHandlerFunc) http.HandlerFunc {
	return h.UserAll(false, f, func(app app, r http.Request) (*User, error) {
	// Authorize user from Authorization header
	t := r.Header.Get("Authorization")
	if t == "" {
	return nil, ErrNoAccessToken
	}
	u := &User{ID: app.db.GetUserID(t)}
	if u.ID == -1 {
	return nil, ErrBadAccessToken
	}

	return u, nil
	})
	}

	func (h *Handler) UserAll(web bool, f userHandlerFunc, a authFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	handleFunc := func() error {
	var status int
	start := time.Now()

	defer func() {
	if e := recover(); e != nil {
	log.Error("%s: %s", e, debug.Stack())
	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
	status = 500
	}

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	u, err := a(h.app, r)
	if err != nil {
	if err, ok := err.(impart.HTTPError); ok {
	status = err.Status
	} else {
	status = 500
	}
	return err
	}

	err = f(h.app, u, w, r)
	if err == nil {
	status = 200
	} else if err, ok := err.(impart.HTTPError); ok {
	status = err.Status
	} else {
	status = 500
	}

	return err
	}

	if web {
	h.handleHTTPError(w, r, handleFunc())
	} else {
	h.handleError(w, r, handleFunc())
	}
	}
	}

	func (h *Handler) RedirectOnErr(f handlerFunc, loc string) handlerFunc {
	return func(app app, w http.ResponseWriter, r http.Request) error {
	err := f(app, w, r)
	if err != nil {
	if ie, ok := err.(impart.HTTPError); ok {
	// Override default redirect with returned error's, if it's a
	// redirect error.
	if ie.Status == http.StatusFound {
	return ie
	}
	}
	return impart.HTTPError{http.StatusFound, loc}
	}
	return nil
	}
	}

	func (h *Handler) Page(n string) http.HandlerFunc {
	return h.Web(func(app app, w http.ResponseWriter, r http.Request) error {
	t, ok := pages[n]
	if !ok {
	return impart.HTTPError{http.StatusNotFound, "Page not found."}
	}

	sp := pageForReq(app, r)

	err := t.ExecuteTemplate(w, "base", sp)
	if err != nil {
	log.Error("Unable to render page: %v", err)
	}
	return err
	}, UserLevelOptional)
	}

	func (h *Handler) WebErrors(f handlerFunc, ul UserLevel) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	// TODO: factor out this logic shared with Web()
	h.handleHTTPError(w, r, func() error {
	var status int
	start := time.Now()

	defer func() {
	if e := recover(); e != nil {
	u := getUserSession(h.app, r)
	username := "None"
	if u != nil {
	username = u.Username
	}
	log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = 500
	}

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	var session *sessions.Session
	var err error
	if ul != UserLevelNone {
	session, err = h.sessionStore.Get(r, cookieName)
	if err != nil && (ul == UserLevelNoneRequired \|\| ul == UserLevelUser) {
	// Cookie is required, but we can ignore this error
	log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul, err)
	}

	_, gotUser := session.Values[cookieUserVal].(*User)
	if ul == UserLevelNoneRequired && gotUser {
	to := correctPageFromLoginAttempt(r)
	log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
	err := impart.HTTPError{http.StatusFound, to}
	status = err.Status
	return err
	} else if ul == UserLevelUser && !gotUser {
	log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
	err := ErrNotLoggedIn
	status = err.Status
	return err
	}
	}

	// TODO: pass User object to function
	err = f(h.app, w, r)
	if err == nil {
	status = 200
	} else if httpErr, ok := err.(impart.HTTPError); ok {
	status = httpErr.Status
	if status < 300 \|\| status > 399 {
	addSessionFlash(h.app, w, r, httpErr.Message, session)
	return impart.HTTPError{http.StatusFound, r.Referer()}
	}
	} else {
	e := fmt.Sprintf("[Web handler] 500: %v", err)
	if !strings.HasSuffix(e, "write: broken pipe") {
	log.Error(e)
	} else {
	log.Error(e)
	}
	log.Info("Web handler internal error render")
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = 500
	}

	return err
	}())
	}
	}

	// Web handles requests made in the web application. This provides user-
	// friendly HTML pages and actions that work in the browser.
	func (h *Handler) Web(f handlerFunc, ul UserLevel) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	h.handleHTTPError(w, r, func() error {
	var status int
	start := time.Now()

	defer func() {
	if e := recover(); e != nil {
	u := getUserSession(h.app, r)
	username := "None"
	if u != nil {
	username = u.Username
	}
	log.Error("User: %s\n\n%s: %s", username, e, debug.Stack())
	log.Info("Web deferred internal error render")
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = 500
	}

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	if ul != UserLevelNone {
	session, err := h.sessionStore.Get(r, cookieName)
	if err != nil && (ul == UserLevelNoneRequired \|\| ul == UserLevelUser) {
	// Cookie is required, but we can ignore this error
	log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul, err)
	}

	_, gotUser := session.Values[cookieUserVal].(*User)
	if ul == UserLevelNoneRequired && gotUser {
	to := correctPageFromLoginAttempt(r)
	log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
	err := impart.HTTPError{http.StatusFound, to}
	status = err.Status
	return err
	} else if ul == UserLevelUser && !gotUser {
	log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
	err := ErrNotLoggedIn
	status = err.Status
	return err
	}
	}

	// TODO: pass User object to function
	err := f(h.app, w, r)
	if err == nil {
	status = 200
	} else if httpErr, ok := err.(impart.HTTPError); ok {
	status = httpErr.Status
	} else {
	e := fmt.Sprintf("[Web handler] 500: %v", err)
	log.Error(e)
	log.Info("Web internal error render")
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = 500
	}

	return err
	}())
	}
	}

	func (h *Handler) All(f handlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	h.handleError(w, r, func() error {
	// TODO: return correct "success" status
	status := 200
	start := time.Now()

	defer func() {
	if e := recover(); e != nil {
	log.Error("%s:\n%s", e, debug.Stack())
	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Something didn't work quite right."})
	status = 500
	}

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	// TODO: do any needed authentication

	err := f(h.app, w, r)
	if err != nil {
	if err, ok := err.(impart.HTTPError); ok {
	status = err.Status
	} else {
	status = 500
	}
	}

	return err
	}())
	}
	}

	func (h *Handler) Download(f dataHandlerFunc, ul UserLevel) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	h.handleHTTPError(w, r, func() error {
	var status int
	start := time.Now()
	defer func() {
	if e := recover(); e != nil {
	log.Error("%s: %s", e, debug.Stack())
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = 500
	}

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	data, filename, err := f(h.app, w, r)
	if err != nil {
	if err, ok := err.(impart.HTTPError); ok {
	status = err.Status
	} else {
	status = 500
	}
	return err
	}

	ext := ".json"
	ct := "application/json"
	if strings.HasSuffix(r.URL.Path, ".csv") {
	ext = ".csv"
	ct = "text/csv"
	} else if strings.HasSuffix(r.URL.Path, ".zip") {
	ext = ".zip"
	ct = "application/zip"
	}
	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%s%s", filename, ext))
	w.Header().Set("Content-Type", ct)
	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
	fmt.Fprint(w, string(data))

	status = 200
	return nil
	}())
	}
	}

	func (h *Handler) Redirect(url string, ul UserLevel) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	h.handleHTTPError(w, r, func() error {
	start := time.Now()

	var status int
	if ul != UserLevelNone {
	session, err := h.sessionStore.Get(r, cookieName)
	if err != nil && (ul == UserLevelNoneRequired \|\| ul == UserLevelUser) {
	// Cookie is required, but we can ignore this error
	log.Error("Handler: Unable to get session (for user permission %d); ignoring: %v", ul, err)
	}

	_, gotUser := session.Values[cookieUserVal].(*User)
	if ul == UserLevelNoneRequired && gotUser {
	to := correctPageFromLoginAttempt(r)
	log.Info("Handler: Required NO user, but got one. Redirecting to %s", to)
	err := impart.HTTPError{http.StatusFound, to}
	status = err.Status
	return err
	} else if ul == UserLevelUser && !gotUser {
	log.Info("Handler: Required a user, but DIDN'T get one. Sending not logged in.")
	err := ErrNotLoggedIn
	status = err.Status
	return err
	}
	}

	status = sendRedirect(w, http.StatusFound, url)

	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())

	return nil
	}())
	}
	}

	func (h Handler) handleHTTPError(w http.ResponseWriter, r http.Request, err error) {
	if err == nil {
	return
	}

	if err, ok := err.(impart.HTTPError); ok {
	if err.Status >= 300 && err.Status < 400 {
	sendRedirect(w, err.Status, err.Message)
	return
	} else if err.Status == http.StatusUnauthorized {
	q := ""
	if r.URL.RawQuery != "" {
	q = url.QueryEscape("?" + r.URL.RawQuery)
	}
	sendRedirect(w, http.StatusFound, "/login?to="+r.URL.Path+q)
	return
	} else if err.Status == http.StatusGone {
	p := &struct {
	page.StaticPage
	Content *template.HTML
	}{
	StaticPage: pageForReq(h.app, r),
	}
	if err.Message != "" {
	co := template.HTML(err.Message)
	p.Content = &co
	}
	h.errors.Gone.ExecuteTemplate(w, "base", p)
	return
	} else if err.Status == http.StatusNotFound {
	h.errors.NotFound.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	return
	} else if err.Status == http.StatusInternalServerError {
	log.Info("handleHTTPErorr internal error render")
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	return
	} else if err.Status == http.StatusAccepted {
	impart.WriteSuccess(w, "", err.Status)
	return
	} else {
	p := &struct {
	page.StaticPage
	Title string
	Content template.HTML
	}{
	pageForReq(h.app, r),
	fmt.Sprintf("Uh oh (%d)", err.Status),
	template.HTML(fmt.Sprintf("<p style=\"text-align: center\" class=\"introduction\">%s</p>", err.Message)),
	}
	h.errors.Blank.ExecuteTemplate(w, "base", p)
	return
	}
	impart.WriteError(w, err)
	return
	}

	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
	}

	func (h Handler) handleError(w http.ResponseWriter, r http.Request, err error) {
	if err == nil {
	return
	}

	if err, ok := err.(impart.HTTPError); ok {
	if err.Status >= 300 && err.Status < 400 {
	sendRedirect(w, err.Status, err.Message)
	return
	}

	// if strings.Contains(r.Header.Get("Accept"), "text/html") {
	impart.WriteError(w, err)
	// }
	return
	}

	if IsJSON(r.Header.Get("Content-Type")) {
	impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "This is an unhelpful error message for a miscellaneous internal error."})
	return
	}
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	}

	func correctPageFromLoginAttempt(r *http.Request) string {
	to := r.FormValue("to")
	if to == "" {
	to = "/"
	} else if !strings.HasPrefix(to, "/") {
	to = "/" + to
	}
	return to
	}

	func (h *Handler) LogHandlerFunc(f http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
	h.handleHTTPError(w, r, func() error {
	status := 200
	start := time.Now()

	defer func() {
	if e := recover(); e != nil {
	log.Error("Handler.LogHandlerFunc\n\n%s: %s", e, debug.Stack())
	h.errors.InternalServerError.ExecuteTemplate(w, "base", pageForReq(h.app, r))
	status = 500
	}

	// TODO: log actual status code returned
	log.Info("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, time.Since(start), r.UserAgent())
	}()

	f(w, r)

	return nil
	}())
	}
	}

	func sendRedirect(w http.ResponseWriter, code int, location string) int {
	w.Header().Set("Location", location)
	w.WriteHeader(code)
	return code
	}
	diff --git a/routes.go b/routes.go
	index 21cbda4..28a1d3f 100644
	--- a/routes.go
	+++ b/routes.go
	@@ -1,156 +1,158 @@
	package writefreely

	import (
	"github.com/gorilla/mux"
	"github.com/writeas/go-nodeinfo"
	"github.com/writeas/go-webfinger"
	"github.com/writeas/web-core/log"
	"github.com/writeas/writefreely/config"
	"net/http"
	"strings"
	)

	func initRoutes(handler Handler, r mux.Router, cfg config.Config, db datastore) {
	hostSubroute := cfg.App.Host[strings.Index(cfg.App.Host, "://")+3:]
	if cfg.App.SingleUser {
	hostSubroute = "{domain}"
	} else {
	if strings.HasPrefix(hostSubroute, "localhost") {
	hostSubroute = "localhost"
	}
	}

	if cfg.App.SingleUser {
	log.Info("Adding %s routes (single user)...", hostSubroute)
	} else {
	log.Info("Adding %s routes (multi-user)...", hostSubroute)
	}

	// Primary app routes
	write := r.PathPrefix("/").Subrouter()

	// Federation endpoint configurations
	wf := webfinger.Default(wfResolver{db, cfg})
	wf.NoTLSHandler = nil

	// Federation endpoints
	// host-meta
	write.HandleFunc("/.well-known/host-meta", handler.Web(handleViewHostMeta, UserLevelOptional))
	// webfinger
	write.HandleFunc(webfinger.WebFingerPath, handler.LogHandlerFunc(http.HandlerFunc(wf.Webfinger)))
	// nodeinfo
	niCfg := nodeInfoConfig(db, cfg)
	ni := nodeinfo.NewService(*niCfg, nodeInfoResolver{cfg, db})
	write.HandleFunc(nodeinfo.NodeInfoPath, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfoDiscover)))
	write.HandleFunc(niCfg.InfoURL, handler.LogHandlerFunc(http.HandlerFunc(ni.NodeInfo)))

	// Set up dyamic page handlers
	// Handle auth
	auth := write.PathPrefix("/api/auth/").Subrouter()
	if cfg.App.OpenRegistration {
	auth.HandleFunc("/signup", handler.All(apiSignup)).Methods("POST")
	}
	auth.HandleFunc("/login", handler.All(login)).Methods("POST")
	auth.HandleFunc("/read", handler.WebErrors(handleWebCollectionUnlock, UserLevelNone)).Methods("POST")
	auth.HandleFunc("/me", handler.All(handleAPILogout)).Methods("DELETE")

	// Handle logged in user sections
	me := write.PathPrefix("/me").Subrouter()
	me.HandleFunc("/", handler.Redirect("/me", UserLevelUser))
	me.HandleFunc("/c", handler.Redirect("/me/c/", UserLevelUser)).Methods("GET")
	me.HandleFunc("/c/", handler.User(viewCollections)).Methods("GET")
	me.HandleFunc("/c/{collection}", handler.User(viewEditCollection)).Methods("GET")
	me.HandleFunc("/c/{collection}/stats", handler.User(viewStats)).Methods("GET")
	me.HandleFunc("/posts", handler.Redirect("/me/posts/", UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/", handler.User(viewArticles)).Methods("GET")
	me.HandleFunc("/posts/export.csv", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/export.zip", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/posts/export.json", handler.Download(viewExportPosts, UserLevelUser)).Methods("GET")
	me.HandleFunc("/export", handler.User(viewExportOptions)).Methods("GET")
	me.HandleFunc("/export.json", handler.Download(viewExportFull, UserLevelUser)).Methods("GET")
	me.HandleFunc("/settings", handler.User(viewSettings)).Methods("GET")
	me.HandleFunc("/logout", handler.Web(viewLogout, UserLevelNone)).Methods("GET")

	write.HandleFunc("/api/me", handler.All(viewMeAPI)).Methods("GET")
	apiMe := write.PathPrefix("/api/me/").Subrouter()
	apiMe.HandleFunc("/", handler.All(viewMeAPI)).Methods("GET")
	apiMe.HandleFunc("/posts", handler.UserAPI(viewMyPostsAPI)).Methods("GET")
	apiMe.HandleFunc("/collections", handler.UserAPI(viewMyCollectionsAPI)).Methods("GET")
	apiMe.HandleFunc("/password", handler.All(updatePassphrase)).Methods("POST")
	apiMe.HandleFunc("/self", handler.All(updateSettings)).Methods("POST")

	// Sign up validation
	write.HandleFunc("/api/alias", handler.All(handleUsernameCheck)).Methods("POST")

	// Handle collections
	write.HandleFunc("/api/collections", handler.All(newCollection)).Methods("POST")
	apiColls := write.PathPrefix("/api/collections/").Subrouter()
	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.All(fetchCollection)).Methods("GET")
	apiColls.HandleFunc("/{alias:[0-9a-zA-Z\\-]+}", handler.All(existingCollection)).Methods("POST", "DELETE")
	apiColls.HandleFunc("/{alias}/posts", handler.All(fetchCollectionPosts)).Methods("GET")
	apiColls.HandleFunc("/{alias}/posts", handler.All(newPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/posts/{post}", handler.All(fetchPost)).Methods("GET")
	apiColls.HandleFunc("/{alias}/posts/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/posts/{post}/{property}", handler.All(fetchPostProperty)).Methods("GET")
	apiColls.HandleFunc("/{alias}/collect", handler.All(addPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/pin", handler.All(pinPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/unpin", handler.All(pinPost)).Methods("POST")
	apiColls.HandleFunc("/{alias}/inbox", handler.All(handleFetchCollectionInbox)).Methods("POST")
	apiColls.HandleFunc("/{alias}/outbox", handler.All(handleFetchCollectionOutbox)).Methods("GET")
	apiColls.HandleFunc("/{alias}/following", handler.All(handleFetchCollectionFollowing)).Methods("GET")
	apiColls.HandleFunc("/{alias}/followers", handler.All(handleFetchCollectionFollowers)).Methods("GET")

	// Handle posts
	write.HandleFunc("/api/posts", handler.All(newPost)).Methods("POST")
	posts := write.PathPrefix("/api/posts/").Subrouter()
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(fetchPost)).Methods("GET")
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(existingPost)).Methods("POST", "PUT")
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}", handler.All(deletePost)).Methods("DELETE")
	posts.HandleFunc("/{post:[a-zA-Z0-9]{10}}/{property}", handler.All(fetchPostProperty)).Methods("GET")
	posts.HandleFunc("/claim", handler.All(addPost)).Methods("POST")
	posts.HandleFunc("/disperse", handler.All(dispersePost)).Methods("POST")

	if cfg.App.OpenRegistration {
	write.HandleFunc("/auth/signup", handler.Web(handleWebSignup, UserLevelNoneRequired)).Methods("POST")
	}
	write.HandleFunc("/auth/login", handler.Web(webLogin, UserLevelNoneRequired)).Methods("POST")

	+ write.HandleFunc("/admin", handler.Admin(handleViewAdminDash)).Methods("GET")
	+
	// Handle special pages first
	write.HandleFunc("/login", handler.Web(viewLogin, UserLevelNoneRequired))

	draftEditPrefix := ""
	if cfg.App.SingleUser {
	draftEditPrefix = "/d"
	write.HandleFunc("/me/new", handler.Web(handleViewPad, UserLevelOptional)).Methods("GET")
	} else {
	write.HandleFunc("/new", handler.Web(handleViewPad, UserLevelOptional)).Methods("GET")
	}

	// All the existing stuff
	write.HandleFunc(draftEditPrefix+"/{action}/edit", handler.Web(handleViewPad, UserLevelOptional)).Methods("GET")
	write.HandleFunc(draftEditPrefix+"/{action}/meta", handler.Web(handleViewMeta, UserLevelOptional)).Methods("GET")
	// Collections
	if cfg.App.SingleUser {
	RouteCollections(handler, write.PathPrefix("/").Subrouter())
	} else {
	write.HandleFunc("/{prefix:[@~$!\\-+]}{collection}", handler.Web(handleViewCollection, UserLevelOptional))
	write.HandleFunc("/{collection}/", handler.Web(handleViewCollection, UserLevelOptional))
	RouteCollections(handler, write.PathPrefix("/{prefix:[@~$!\\-+]?}{collection}").Subrouter())
	// Posts
	}
	write.HandleFunc(draftEditPrefix+"/{post}", handler.Web(handleViewPost, UserLevelOptional))
	write.HandleFunc("/", handler.Web(handleViewHome, UserLevelOptional))
	}

	func RouteCollections(handler Handler, r mux.Router) {
	r.HandleFunc("/page/{page:[0-9]+}", handler.Web(handleViewCollection, UserLevelOptional))
	r.HandleFunc("/tag:{tag}", handler.Web(handleViewCollectionTag, UserLevelOptional))
	r.HandleFunc("/tag:{tag}/feed/", handler.Web(ViewFeed, UserLevelOptional))
	r.HandleFunc("/tags/{tag}", handler.Web(handleViewCollectionTag, UserLevelOptional))
	r.HandleFunc("/sitemap.xml", handler.All(handleViewSitemap))
	r.HandleFunc("/feed/", handler.All(ViewFeed))
	r.HandleFunc("/{slug}", handler.Web(viewCollectionPost, UserLevelOptional))
	r.HandleFunc("/{slug}/edit", handler.Web(handleViewPad, UserLevelUser))
	r.HandleFunc("/{slug}/edit/meta", handler.Web(handleViewMeta, UserLevelUser))
	r.HandleFunc("/{slug}/", handler.Web(handleCollectionPostRedirect, UserLevelOptional)).Methods("GET")
	}
	diff --git a/templates/user/admin.tmpl b/templates/user/admin.tmpl
	new file mode 100644
	index 0000000..cf6ac8f
	--- /dev/null
	+++ b/templates/user/admin.tmpl
	@@ -0,0 +1,108 @@
	+{{define "admin"}}
	+{{template "header" .}}
	+
	+<style type="text/css">
	+h2 {font-weight: normal;}
	+ul.pagenav {list-style: none;}
	+form {margin: 2em 0;}
	+.ui.divider:not(.vertical):not(.horizontal) {
	+ border-top: 1px solid rgba(34,36,38,.15);
	+ border-bottom: 1px solid rgba(255,255,255,.1);
	+}
	+.ui.divider {
	+ margin: 1rem 0;
	+ line-height: 1;
	+ height: 0;
	+ font-weight: 700;
	+ text-transform: uppercase;
	+ letter-spacing: .05em;
	+ color: rgba(0,0,0,.85);
	+ -webkit-user-select: none;
	+ -moz-user-select: none;
	+ -ms-user-select: none;
	+ user-select: none;
	+ -webkit-tap-highlight-color: transparent;
	+ font-size: 1rem;
	+}
	+</style>
	+
	+<div class="content-container tight">
	+ <h2>Admin Dashboard</h2>
	+
	+ {{if .Message}}<p>{{.Message}}</p>{{end}}
	+
	+ <ul class="pagenav">
	+ <li><a href="#monitor">Application monitor</a></li>
	+ </ul>
	+
	+ <hr />
	+
	+ <h3><a name="monitor"></a>application monitor</h3>
	+ <div class="ui attached table segment">
	+ <dl class="dl-horizontal admin-dl-horizontal">
	+ <dt>Server Uptime</dt>
	+ <dd>{{.SysStatus.Uptime}}</dd>
	+ <dt>Current Goroutines</dt>
	+ <dd>{{.SysStatus.NumGoroutine}}</dd>
	+ <div class="ui divider"></div>
	+ <dt>Current memory usage</dt>
	+ <dd>{{.SysStatus.MemAllocated}}</dd>
	+ <dt>Total mem allocated</dt>
	+ <dd>{{.SysStatus.MemTotal}}</dd>
	+ <dt>Memory obtained</dt>
	+ <dd>{{.SysStatus.MemSys}}</dd>
	+ <dt>Pointer lookup times</dt>
	+ <dd>{{.SysStatus.Lookups}}</dd>
	+ <dt>Memory allocate times</dt>
	+ <dd>{{.SysStatus.MemMallocs}}</dd>
	+ <dt>Memory free times</dt>
	+ <dd>{{.SysStatus.MemFrees}}</dd>
	+ <div class="ui divider"></div>
	+ <dt>Current heap usage</dt>
	+ <dd>{{.SysStatus.HeapAlloc}}</dd>
	+ <dt>Heap memory obtained</dt>
	+ <dd>{{.SysStatus.HeapSys}}</dd>
	+ <dt>Heap memory idle</dt>
	+ <dd>{{.SysStatus.HeapIdle}}</dd>
	+ <dt>Heap memory in use</dt>
	+ <dd>{{.SysStatus.HeapInuse}}</dd>
	+ <dt>Heap memory released</dt>
	+ <dd>{{.SysStatus.HeapReleased}}</dd>
	+ <dt>Heap objects</dt>
	+ <dd>{{.SysStatus.HeapObjects}}</dd>
	+ <div class="ui divider"></div>
	+ <dt>Bootstrap stack usage</dt>
	+ <dd>{{.SysStatus.StackInuse}}</dd>
	+ <dt>Stack memory obtained</dt>
	+ <dd>{{.SysStatus.StackSys}}</dd>
	+ <dt>MSpan structures in use</dt>
	+ <dd>{{.SysStatus.MSpanInuse}}</dd>
	+ <dt>MSpan structures obtained</dt>
	+ <dd>{{.SysStatus.HeapSys}}</dd>
	+ <dt>MCache structures in use</dt>
	+ <dd>{{.SysStatus.MCacheInuse}}</dd>
	+ <dt>MCache structures obtained</dt>
	+ <dd>{{.SysStatus.MCacheSys}}</dd>
	+ <dt>Profiling bucket hash table obtained</dt>
	+ <dd>{{.SysStatus.BuckHashSys}}</dd>
	+ <dt>GC metadata obtained</dt>
	+ <dd>{{.SysStatus.GCSys}}</dd>
	+ <dt>Other system allocation obtained</dt>
	+ <dd>{{.SysStatus.OtherSys}}</dd>
	+ <div class="ui divider"></div>
	+ <dt>Next GC recycle</dt>
	+ <dd>{{.SysStatus.NextGC}}</dd>
	+ <dt>Since last GC</dt>
	+ <dd>{{.SysStatus.LastGC}}</dd>
	+ <dt>Total GC pause</dt>
	+ <dd>{{.SysStatus.PauseTotalNs}}</dd>
	+ <dt>Last GC pause</dt>
	+ <dd>{{.SysStatus.PauseNs}}</dd>
	+ <dt>GC times</dt>
	+ <dd>{{.SysStatus.NumGC}}</dd>
	+ </dl>
	+ </div>
	+</div>
	+{{template "footer" .}}
	+{{template "body-end" .}}
	+{{end}}
	diff --git a/templates/user/settings.tmpl b/templates/user/settings.tmpl
	index 204aae3..fd204a5 100644
	--- a/templates/user/settings.tmpl
	+++ b/templates/user/settings.tmpl
	@@ -1,83 +1,83 @@
	{{define "settings"}}
	{{template "header" .}}

	<style type="text/css">
	.option { margin: 2em 0em; }
	h3 { font-weight: normal; }
	.section > *:not(input) { font-size: 0.86em; }
	</style>
	<div class="content-container snug regular">
	- <h2>{{if .IsLogOut}}Before you go...{{else}}Account Settings{{end}}</h2>
	+ <h2>{{if .IsLogOut}}Before you go...{{else}}Account Settings {{if .IsAdmin}}<a href="/admin">admin settings</a>{{end}}{{end}}</h2>
	{{if .Flashes}}<ul class="errors">
	{{range .Flashes}}<li class="urgent">{{.}}</li>{{end}}
	</ul>{{end}}

	{{ if .IsLogOut }}
	<div class="alert info">
	<p class="introduction">Please add an <strong>email address</strong> and/or <strong>passphrase</strong> so you can log in again later.</p>
	</div>
	{{ else }}
	<div class="option">
	<p>Change your account settings here.</p>
	</div>

	<form method="post" action="/api/me/self" autocomplete="false">
	<div class="option">
	<h3>Username</h3>
	<div class="section">
	<input type="text" name="username" value="{{.Username}}" tabindex="1" />
	<input type="submit" value="Update" style="margin-left: 1em;" />
	</div>
	</div>
	</form>
	{{ end }}

	<form method="post" action="/api/me/self" autocomplete="false">
	<input type="hidden" name="logout" value="{{.IsLogOut}}" />
	<div class="option">
	<h3>Passphrase</h3>
	<div class="section">
	{{if and (not .HasPass) (not .IsLogOut)}}<div class="alert info"><p>Add a passphrase to easily log in to your account.</p></div>{{end}}
	{{if .HasPass}}<p>Current passphrase</p>
	<input type="password" name="current-pass" placeholder="Current passphrase" tabindex="1" /> <input class="show" type="checkbox" id="show-cur-pass" /><label for="show-cur-pass"> Show</label>
	<p>New passphrase</p>
	{{end}}
	{{if .IsLogOut}}<input type="text" value="{{.Username}}" style="display:none" />{{end}}
	<input type="password" name="new-pass" autocomplete="new-password" placeholder="New passphrase" tabindex="{{if .IsLogOut}}1{{else}}2{{end}}" /> <input class="show" type="checkbox" id="show-new-pass" /><label for="show-new-pass"> Show</label>
	</div>
	</div>

	<div class="option">
	<h3>Email</h3>
	<div class="section">
	{{if and (not .Email) (not .IsLogOut)}}<div class="alert info"><p>Add your email to get:</p>
	<ul>
	<li>No-passphrase login</li>
	<li>Account recovery if you forget your passphrase</li>
	</ul></div>{{end}}
	<input type="email" name="email" style="letter-spacing: 1px" placeholder="Email address" value="{{.Email}}" size="40" tabindex="{{if .IsLogOut}}2{{else}}3{{end}}" />
	</div>
	</div>

	<div class="option" style="text-align: center; margin-top: 4em;">
	<input type="submit" value="Save changes" tabindex="4" />
	</div>
	</form>
	</div>

	<script>
	var showChecks = document.querySelectorAll('input.show');
	for (var i=0; i<showChecks.length; i++) {
	showChecks[i].addEventListener('click', function() {
	var prevEl = this.previousElementSibling;
	if (prevEl.type == "password") {
	prevEl.type = "text";
	} else {
	prevEl.type = "password";
	}
	});
	}
	</script>

	{{template "footer" .}}
	{{end}}
	diff --git a/users.go b/users.go
	index ec7af21..b645c6a 100644
	--- a/users.go
	+++ b/users.go
	@@ -1,94 +1,99 @@
	package writefreely

	import (
	"time"

	"github.com/guregu/null/zero"
	"github.com/writeas/web-core/data"
	"github.com/writeas/web-core/log"
	)

	type (
	userCredentials struct {
	Alias string `json:"alias" schema:"alias"`
	Pass string `json:"pass" schema:"pass"`
	Email string `json:"email" schema:"email"`
	Web bool `json:"web" schema:"-"`
	To string `json:"-" schema:"to"`

	EmailLogin bool `json:"via_email" schema:"via_email"`
	}

	userRegistration struct {
	userCredentials
	Honeypot string `json:"fullname" schema:"fullname"`
	Normalize bool `json:"normalize" schema:"normalize"`
	Signup bool `json:"signup" schema:"signup"`
	}

	// AuthUser contains information for a newly authenticated user (either
	// from signing up or logging in).
	AuthUser struct {
	AccessToken string `json:"access_token,omitempty"`
	Password string `json:"password,omitempty"`
	User *User `json:"user"`

	// Verbose user data
	Posts *[]PublicPost `json:"posts,omitempty"`
	Collections *[]Collection `json:"collections,omitempty"`
	}

	// User is a consistent user object in the database and all contexts (auth
	// and non-auth) in the API.
	User struct {
	ID int64 `json:"-"`
	Username string `json:"username"`
	HashedPass []byte `json:"-"`
	HasPass bool `json:"has_pass"`
	Email zero.String `json:"email"`
	Created time.Time `json:"created"`

	clearEmail string `json:"email"`
	}

	userMeStats struct {
	TotalCollections, TotalArticles, CollectionPosts uint64
	}

	ExportUser struct {
	*User
	Collections *[]CollectionObj `json:"collections"`
	AnonymousPosts []PublicPost `json:"posts"`
	}

	PublicUser struct {
	Username string `json:"username"`
	}
	)

	// EmailClear decrypts and returns the user's email, caching it in the user
	// object.
	func (u User) EmailClear(keys keychain) string {
	if u.clearEmail != "" {
	return u.clearEmail
	}

	if u.Email.Valid && u.Email.String != "" {
	email, err := data.Decrypt(keys.emailKey, []byte(u.Email.String))
	if err != nil {
	log.Error("Error decrypting user email: %v", err)
	} else {
	u.clearEmail = string(email)
	return u.clearEmail
	}
	}
	return ""
	}

	// Cookie strips down an AuthUser to contain only information necessary for
	// cookies.
	func (u User) Cookie() *User {
	u.HashedPass = []byte{}

	return &u
	}
	+
	+func (u *User) IsAdmin() bool {
	+ // TODO: get this from database
	+ return u.ID == 1
	+}

File Metadata

Mime Type: text/x-diff
Expires: Thu, May 15, 4:36 AM (6 h, 4 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3239462

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions