this is *horrible*

16 files changed, 405 insertions, 140 deletions

diff --git a/server/Cargo.toml b/server/Cargo.toml
index 482baa8..a259d98 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -15,8 +15,10 @@ env_logger = "0.10.0"
 anyhow = "1.0.68"
 once_cell = "1.17.0"
 chashmap = "2.2.2"
+argon2 = "0.4.1"
 
-rocket = "0.5.0-rc.2"
+async-std = "1.12.0"
+rocket = { version = "0.5.0-rc.2", features = ["secrets"] }
 tokio = { version = "1.24.1", features = ["io-util"] }
 tokio-util = { version = "0.7.4", features = ["io", "io-util"] }
 markup = "0.13.1"
diff --git a/server/src/config.rs b/server/src/config.rs
index 10b5b5f..86f7068 100644
--- a/server/src/config.rs
+++ b/server/src/config.rs
@@ -7,6 +7,9 @@ pub struct GlobalConfig {
     pub brand: String,
     pub database_path: PathBuf,
     pub library_path: PathBuf,
+    pub admin_username: String,
+    pub admin_password: String,
+    pub cookie_key: String,
 }
 
 pub fn load_global_config() -> GlobalConfig {
diff --git a/server/src/database.rs b/server/src/database.rs
index 39b306c..3b2b4a9 100644
--- a/server/src/database.rs
+++ b/server/src/database.rs
@@ -8,6 +8,7 @@ use typed_sled::Tree;
 pub struct Database {
     pub db: sled::Db,
     pub users: Tree<String, User>,
+    pub invites: Tree<String, ()>,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -15,14 +16,17 @@ pub struct User {
     pub name: String,
     pub display_name: String,
     pub password: Vec<u8>,
+    pub admin: bool,
 }
 
 impl Database {
     pub fn open(path: &PathBuf) -> Result<Self, anyhow::Error> {
         info!("opening database… (takes O(n) time sadly)");
         let db = sled::open(path).context("opening database")?;
+        info!("ready");
         Ok(Self {
-            users: typed_sled::Tree::open(&db, "users"),
+            users: Tree::open(&db, "users"),
+            invites: Tree::open(&db, "invites"),
             db,
         })
     }
diff --git a/server/src/library.rs b/server/src/library.rs
index ebafa9d..578edfc 100644
--- a/server/src/library.rs
+++ b/server/src/library.rs
@@ -156,11 +156,13 @@ impl Node {
         }
     }
 }
+
 impl Item {
     pub fn path(&self) -> String {
         self.lib_path.to_str().unwrap().to_string()
     }
 }
+
 impl Directory {
     pub fn path(&self) -> String {
         self.lib_path.to_str().unwrap().to_string()
diff --git a/server/src/main.rs b/server/src/main.rs
index 29d51ca..5158b8d 100644
--- a/server/src/main.rs
+++ b/server/src/main.rs
@@ -1,12 +1,12 @@
 #![feature(box_syntax)]
 
 use config::{load_global_config, GlobalConfig};
-use database::Database;
+use database::{Database, User};
 use jellyremuxer::RemuxerContext;
 use library::Library;
 use once_cell::sync::Lazy;
 use rocket::launch;
-use routes::build_rocket;
+use routes::{build_rocket, ui::account::hash_password};
 use std::sync::Arc;
 
 pub mod config;
@@ -14,12 +14,6 @@ pub mod database;
 pub mod library;
 pub mod routes;
 
-pub struct AppState {
-    pub database: Database,
-    pub library: Library,
-    pub remuxer: Arc<RemuxerContext>,
-}
-
 pub static CONF: Lazy<GlobalConfig> = Lazy::new(|| load_global_config());
 
 #[launch]
@@ -28,10 +22,20 @@ fn rocket() -> _ {
         .filter_level(log::LevelFilter::Info)
         .parse_env("LOG")
         .init();
-    let state = AppState {
-        remuxer: RemuxerContext::new(),
-        library: Library::open(&CONF.library_path).unwrap(),
-        database: Database::open(&CONF.database_path).unwrap(),
-    };
-    build_rocket(state)
+    let remuxer = RemuxerContext::new();
+    let library = Library::open(&CONF.library_path).unwrap();
+    let database = Database::open(&CONF.database_path).unwrap();
+    database
+        .users
+        .insert(
+            &CONF.admin_username,
+            &User {
+                admin: true,
+                display_name: "Admin".to_string(),
+                name: CONF.admin_username.clone(),
+                password: hash_password(&CONF.admin_password),
+            },
+        )
+        .unwrap();
+    build_rocket(remuxer, library, database)
 }
diff --git a/server/src/routes/mod.rs b/server/src/routes/mod.rs
index 332b4c5..f707a60 100644
--- a/server/src/routes/mod.rs
+++ b/server/src/routes/mod.rs
@@ -1,20 +1,40 @@
-use crate::AppState;
-use rocket::{catchers, routes, Build, Rocket};
+use crate::{database::Database, library::Library, CONF};
+use jellyremuxer::RemuxerContext;
+use rocket::{catchers, config::SecretKey, routes, Build, Config, Rocket};
 use stream::r_stream;
-use ui::account::{r_account_login, r_account_register, r_account_register_post};
-use ui::error::r_not_found;
-use ui::home::r_home;
-use ui::node::{r_item_assets, r_library_node};
-use ui::player::r_player;
-use ui::style::{r_assets_font, r_assets_js, r_assets_style};
+use ui::{
+    account::{r_account_login, r_account_login_post, r_account_register, r_account_register_post},
+    error::r_catch,
+    home::r_home,
+    node::{r_item_assets, r_library_node},
+    player::r_player,
+    style::{r_assets_font, r_assets_js, r_assets_style},
+};
 
 pub mod stream;
 pub mod ui;
 
-pub fn build_rocket(state: AppState) -> Rocket<Build> {
+#[macro_export]
+macro_rules! uri {
+    ($kk:tt) => {
+        &rocket::uri!($kk).to_string()
+    };
+}
+
+pub fn build_rocket(
+    remuxer: RemuxerContext,
+    library: Library,
+    database: Database,
+) -> Rocket<Build> {
     rocket::build()
-        .manage(state)
-        .register("/", catchers![r_not_found])
+        .configure(Config {
+            secret_key: SecretKey::derive_from(CONF.cookie_key.as_bytes()),
+            ..Default::default()
+        })
+        .manage(remuxer)
+        .manage(library)
+        .manage(database)
+        .register("/", catchers![r_catch])
         .mount(
             "/",
             routes![
@@ -26,6 +46,7 @@ pub fn build_rocket(state: AppState) -> Rocket<Build> {
                 r_stream,
                 r_player,
                 r_account_login,
+                r_account_login_post,
                 r_account_register,
                 r_account_register_post,
                 r_item_assets,
diff --git a/server/src/routes/stream.rs b/server/src/routes/stream.rs
index c49f51d..0e1fccb 100644
--- a/server/src/routes/stream.rs
+++ b/server/src/routes/stream.rs
@@ -1,9 +1,12 @@
+use crate::library::Library;
+
 use super::ui::error::MyError;
-use crate::AppState;
 use anyhow::{anyhow, Context};
+use jellyremuxer::RemuxerContext;
 use log::debug;
 use log::warn;
 use rocket::{get, http::ContentType, response::stream::ReaderStream, State};
+use std::ops::Deref;
 use std::path::PathBuf;
 use tokio::io::{duplex, DuplexStream};
 use tokio_util::io::SyncIoBridge;
@@ -25,16 +28,16 @@ pub fn r_stream(
     path: PathBuf,
     webm: Option<bool>,
     tracks: String,
-    state: &State<AppState>,
+    remuxer: &State<RemuxerContext>,
+    library: &State<Library>,
 ) -> Result<(ContentType, ReaderStream![DuplexStream]), MyError> {
     let (a, b) = duplex(1024);
     let path = path.to_str().unwrap().to_string();
-    let item = state
-        .library
+    let item = library
         .nested(&path)
         .context("retrieving library node")?
         .get_item()?;
-    let remuxer = state.remuxer.clone();
+    let remuxer = remuxer.deref().clone();
     let tracks = tracks
         .split(",")
         .map(|e| e.parse().map_err(|_| anyhow!("invalid number")))
diff --git a/server/src/routes/ui/account/mod.rs b/server/src/routes/ui/account/mod.rs
index 7e329a1..74710d9 100644
--- a/server/src/routes/ui/account/mod.rs
+++ b/server/src/routes/ui/account/mod.rs
@@ -1,8 +1,20 @@
-use super::HtmlTemplate;
+pub mod session;
+
+use super::error::MyError;
+use super::layout::LayoutPage;
+use crate::database::Database;
 use crate::database::User;
-use crate::{AppState, CONF};
+use crate::routes::ui::error::MyResult;
+use crate::routes::ui::home::rocket_uri_macro_r_home;
+use crate::routes::ui::layout::DynLayoutPage;
+use crate::CONF;
+use anyhow::anyhow;
+use argon2::{Argon2, PasswordHasher};
+use rocket::form::Contextual;
 use rocket::form::Form;
-use rocket::{get, post, FromForm, State};
+use rocket::http::{Cookie, CookieJar};
+use rocket::response::Redirect;
+use rocket::{get, post, uri, FromForm, State};
 
 #[derive(FromForm)]
 pub struct RegisterForm {
@@ -15,10 +27,10 @@ pub struct RegisterForm {
 }
 
 #[get("/account/register")]
-pub fn r_account_register() -> HtmlTemplate<markup::DynRender<'static>> {
-    HtmlTemplate(
-        "Register".to_string(),
-        markup::new! {
+pub async fn r_account_register() -> DynLayoutPage<'static> {
+    LayoutPage {
+        title: "Register".to_string(),
+        content: markup::new! {
             h1 { "Register for " @CONF.brand  }
             form[method="POST", action=""] {
                 label[for="inp-invitation"] { "Invite Code: " }
@@ -32,41 +44,121 @@ pub fn r_account_register() -> HtmlTemplate<markup::DynRender<'static>> {
                 input[type="submit", value="Register now!"];
             }
         },
-    )
+    }
+}
+
+#[derive(FromForm)]
+pub struct LoginForm {
+    #[field(validate = len(4..32))]
+    pub username: String,
+    #[field(validate = len(..64))]
+    pub password: String,
 }
 
 #[get("/account/login")]
-pub fn r_account_login() -> HtmlTemplate<markup::DynRender<'static>> {
-    HtmlTemplate(
-        "Log in".to_string(),
-        markup::new! {
+pub fn r_account_login() -> DynLayoutPage<'static> {
+    LayoutPage {
+        title: "Log in".to_string(),
+        content: markup::new! {
             h1 { "Log in to your Account" }
+            form[method="POST", action=""] {
+                label[for="inp-username"] { "Username: " }
+                input[type="text", id="inp-username", name="username"]; br;
+                label[for="inp-password"] { "Password: " }
+                input[type="password", id="inp-password", name="password"]; br;
 
+                input[type="submit", value="Login"];
+            }
+            p { "While logged in, a cookie will be used to identify you." }
         },
-    )
+    }
 }
 
 #[post("/account/register", data = "<form>")]
-pub fn r_account_register_post(
-    state: &State<AppState>,
-    form: Form<RegisterForm>,
-) -> HtmlTemplate<markup::DynRender<'static>> {
-    state
-        .database
+pub fn r_account_register_post<'a>(
+    database: &'a State<Database>,
+    form: Form<Contextual<'a, RegisterForm>>,
+) -> MyResult<DynLayoutPage<'a>> {
+    let form = match &form.value {
+        Some(v) => v,
+        None => return Err(format_form_error(form)),
+    };
+
+    if database.invites.remove(&form.invitation).unwrap().is_none() {
+        return Err(MyError(anyhow!("invitation invalid")));
+    }
+    match database
         .users
-        .insert(
+        .compare_and_swap(
             &form.username,
-            &User {
+            None,
+            Some(&User {
                 display_name: form.username.clone(),
                 name: form.username.clone(),
                 password: form.password.clone().into(), // TODO hash it
+                admin: false,
+            }),
+        )
+        .unwrap()
+    {
+        Ok(_) => Ok(LayoutPage {
+            title: "Registration successful".to_string(),
+            content: markup::new! {
+                h1 { "Registration successful, you may log in now." }
             },
+        }),
+        Err(_) => Err(MyError(anyhow!("username is taken"))),
+    }
+}
+
+#[post("/account/login", data = "<form>")]
+pub fn r_account_login_post(
+    database: &State<Database>,
+    jar: &CookieJar,
+    form: Form<Contextual<LoginForm>>,
+) -> MyResult<Redirect> {
+    let form = match &form.value {
+        Some(v) => v,
+        None => return Err(format_form_error(form)),
+    };
+
+    // hashing the password regardless if the accounts exists to prevent timing attacks
+    let password = hash_password(&form.password);
+
+    let user = database
+        .users
+        .get(&form.username)?
+        .ok_or(anyhow!("invalid password"))?;
+
+    if user.password != password {
+        Err(anyhow!("invalid password"))?
+    }
+
+    jar.add_private(Cookie::build("user", user.name).permanent().finish());
+
+    Ok(Redirect::found(uri!(r_home())))
+}
+
+fn format_form_error<T>(form: Form<Contextual<T>>) -> MyError {
+    let mut k = String::from("form validation failed:");
+    for e in form.context.errors() {
+        k += &format!(
+            "\n\t{}: {e}",
+            e.name
+                .as_ref()
+                .map(|e| e.to_string())
+                .unwrap_or("<unknown>".to_string())
         )
-        .unwrap();
-    HtmlTemplate(
-        "Registration successful".to_string(),
-        markup::new! {
-            h1 { "Registration successful." }
-        },
-    )
+    }
+    MyError(anyhow!(k))
+}
+
+pub fn hash_password(s: &str) -> Vec<u8> {
+    Argon2::default()
+        .hash_password(s.as_bytes(), r"IYMa13osbNeLJKnQ1T8LlA")
+        .unwrap()
+        .hash
+        .unwrap()
+        .as_bytes()
+        .to_vec()
 }
diff --git a/server/src/routes/ui/account/session.rs b/server/src/routes/ui/account/session.rs
new file mode 100644
index 0000000..9c50099
--- /dev/null
+++ b/server/src/routes/ui/account/session.rs
@@ -0,0 +1,58 @@
+use crate::{
+    database::{Database, User},
+    routes::ui::error::MyError,
+};
+use anyhow::anyhow;
+use rocket::{
+    outcome::Outcome,
+    request::{self, FromRequest},
+    Request, State,
+};
+
+pub struct Session {
+    pub user: User,
+}
+
+impl Session {
+    pub async fn from_request_ut(req: &Request<'_>) -> Result<Self, MyError> {
+        let cookie = req
+            .cookies()
+            .get_private("user")
+            .ok_or(anyhow!("login required"))?;
+        let username = cookie.value();
+
+        let db = req.guard::<&State<Database>>().await.unwrap();
+        let user = db
+            .users
+            .get(&username.to_string())?
+            .ok_or(anyhow!("user not found"))?;
+
+        Ok(Session { user })
+    }
+}
+
+impl<'r> FromRequest<'r> for Session {
+    type Error = MyError;
+
+    fn from_request<'life0, 'async_trait>(
+        request: &'r Request<'life0>,
+    ) -> core::pin::Pin<
+        Box<
+            dyn core::future::Future<Output = request::Outcome<Self, Self::Error>>
+                + core::marker::Send
+                + 'async_trait,
+        >,
+    >
+    where
+        'r: 'async_trait,
+        'life0: 'async_trait,
+        Self: 'async_trait,
+    {
+        Box::pin(async move {
+            match Self::from_request_ut(request).await {
+                Ok(x) => Outcome::Success(x),
+                Err(_) => Outcome::Forward(()),
+            }
+        })
+    }
+}
diff --git a/server/src/routes/ui/error.rs b/server/src/routes/ui/error.rs
index 1a50796..011847e 100644
--- a/server/src/routes/ui/error.rs
+++ b/server/src/routes/ui/error.rs
@@ -1,6 +1,9 @@
+use super::layout::LayoutPage;
 use super::{layout::Layout, HtmlTemplate};
+use crate::routes::ui::account::rocket_uri_macro_r_account_login;
 use markup::Render;
 use rocket::http::Status;
+use rocket::uri;
 use rocket::{
     catch,
     http::ContentType,
@@ -10,37 +13,44 @@ use rocket::{
 use std::{fmt::Display, io::Cursor};
 
 #[catch(default)]
-pub fn r_not_found<'a>(status: Status, _request: &Request) -> HtmlTemplate<markup::DynRender<'a>> {
-    HtmlTemplate(
-        "Not found".to_string(),
-        markup::new! {
-            h2 { "Error" }
-            p { @format!("{status:?}") }
-        },
-    )
+pub fn r_catch<'a>(status: Status, _request: &Request) -> () {
+    // HtmlTemplate(box Layout {
+    //     title: "Not found".to_string(),
+    //     session: None,
+    //     main: markup::new! {
+    //         h2 { "Error" }
+    //         p { @format!("{status}") }
+    //         @if status == Status::NotFound {
+    //             p { "You might need to " a[href=&uri!(r_account_login()).to_string()] { "log in" } ", to see this page" }
+    //         }
+    //     },
+    // })
+    todo!()
 }
 
 pub type MyResult<T> = Result<T, MyError>;
 
 #[derive(Debug)]
-pub struct MyError(anyhow::Error);
+pub struct MyError(pub anyhow::Error);
 
 impl<'r> Responder<'r, 'static> for MyError {
     fn respond_to(self, _: &'r Request<'_>) -> response::Result<'static> {
-        let mut out = String::new();
-        Layout {
-            title: "Error".to_string(),
-            main: markup::new! {
-                h2 { "An error occured. Nobody is sorry"}
-                pre.error { @format!("{:?}", self.0) }
-            },
-        }
-        .render(&mut out)
-        .unwrap();
-        Response::build()
-            .header(ContentType::HTML)
-            .streamed_body(Cursor::new(out))
-            .ok()
+        // let mut out = String::new();
+        // LayoutPage {
+        //     title: "Error".to_string(),
+        //     content: markup::new! {
+        //         h2 { "An error occured. Nobody is sorry"}
+        //         pre.error { @format!("{:?}", self.0) }
+        //     },
+        // }
+        // .render(&mut out)
+        // .unwrap();
+        // Response::build()
+        //     .header(ContentType::HTML)
+        //     .status(Status::BadRequest)
+        //     .streamed_body(Cursor::new(out))
+        //     .ok()
+        todo!()
     }
 }
 
@@ -64,3 +74,8 @@ impl From<std::io::Error> for MyError {
         MyError(anyhow::anyhow!("{err}"))
     }
 }
+impl From<sled::Error> for MyError {
+    fn from(err: sled::Error) -> Self {
+        MyError(anyhow::anyhow!("{err}"))
+    }
+}
diff --git a/server/src/routes/ui/home.rs b/server/src/routes/ui/home.rs
index 04a4c7d..88c6cfb 100644
--- a/server/src/routes/ui/home.rs
+++ b/server/src/routes/ui/home.rs
@@ -1,15 +1,17 @@
-use crate::routes::ui::node::NodePage;
+use super::account::session::Session;
+use super::layout::LayoutPage;
+use crate::routes::ui::layout::DynLayoutPage;
 use crate::CONF;
-use crate::{routes::ui::HtmlTemplate, AppState};
+use crate::{library::Library, routes::ui::node::NodePage};
 use rocket::{get, State};
 
 #[get("/")]
-pub async fn r_home(state: &State<AppState>) -> HtmlTemplate<markup::DynRender> {
-    HtmlTemplate(
-        "Home".to_string(),
-        markup::new! {
+pub async fn r_home(_sess: Session, library: &State<Library>) -> LayoutPage<markup::DynRender> {
+    LayoutPage {
+        title: "Home".to_string(),
+        content: markup::new! {
             p { "Welcome to " @CONF.brand  }
-            @NodePage { node: state.library.root.clone() }
+            @NodePage { node: library.root.clone() }
         },
-    )
+    }
 }
diff --git a/server/src/routes/ui/layout.rs b/server/src/routes/ui/layout.rs
index cda8b0f..c25e644 100644
--- a/server/src/routes/ui/layout.rs
+++ b/server/src/routes/ui/layout.rs
@@ -1,9 +1,18 @@
+use super::{account::session::Session, Defer, HtmlTemplate};
+use crate::{uri, CONF};
+use async_std::task::block_on;
 use markup::Render;
-
-use crate::CONF;
+use rocket::{
+    http::ContentType,
+    request::{FromRequest, Outcome},
+    response::{self, Responder},
+    Request, Response,
+};
+use std::{convert::Infallible, io::Cursor};
+use tokio::runtime::Handle;
 
 markup::define! {
-    Layout<Main: Render>(title: String, main: Main) {
+    Layout<Main: Render>(title: String, main: Main, session: Option<Session>) {
         @markup::doctype()
         html {
             head {
@@ -15,9 +24,44 @@ markup::define! {
                 nav {
                     h1 { a[href="/"] { @CONF.brand } }
                     a[href="/library"] { "My Library" }
+
+                    div.account {
+                        @if let Some(session) = session {
+
+                        } else {
+                            // a[href=uri!(r_account_register())] { "Register" }
+                            // a[href=uri!(r_account_login())] { "Log in" }
+                        }
+                    }
                 }
                 #main { @main }
             }
         }
     }
 }
+
+pub type DynLayoutPage<'a> = LayoutPage<markup::DynRender<'a>>;
+
+pub struct LayoutPage<T> {
+    pub title: String,
+    pub content: T,
+}
+
+impl<'r, Main: Render> Responder<'r, 'static> for LayoutPage<Main> {
+    fn respond_to(self, req: &'r Request<'_>) -> response::Result<'static> {
+        let session = block_on(req.guard::<Option<Session>>()).unwrap();
+        let mut out = String::new();
+        Layout {
+            main: self.content,
+            title: self.title,
+            session,
+        }
+        .render(&mut out)
+        .unwrap();
+
+        Response::build()
+            .header(ContentType::HTML)
+            .streamed_body(Cursor::new(out))
+            .ok()
+    }
+}
diff --git a/server/src/routes/ui/mod.rs b/server/src/routes/ui/mod.rs
index 8a3bc4e..e062a68 100644
--- a/server/src/routes/ui/mod.rs
+++ b/server/src/routes/ui/mod.rs
@@ -1,34 +1,48 @@
-use self::layout::Layout;
 use markup::Render;
 use rocket::{
+    futures::FutureExt,
     http::ContentType,
     response::{self, Responder},
     Request, Response,
 };
-use std::io::Cursor;
+use std::{future::Future, io::Cursor, pin::Pin};
+use tokio::io::AsyncRead;
 
+pub mod account;
 pub mod error;
 pub mod home;
 pub mod layout;
 pub mod node;
-pub mod style;
 pub mod player;
-pub mod account;
+pub mod style;
 
-pub struct HtmlTemplate<T>(pub String, pub T);
+pub struct HtmlTemplate<'a>(pub markup::DynRender<'a>);
 
-impl<'r, T: Render> Responder<'r, 'static> for HtmlTemplate<T> {
-    fn respond_to(self, _: &'r Request<'_>) -> response::Result<'static> {
+impl<'r> Responder<'r, 'static> for HtmlTemplate<'_> {
+    fn respond_to(self, req: &'r Request<'_>) -> response::Result<'static> {
         let mut out = String::new();
-        Layout {
-            title: self.0,
-            main: self.1,
-        }
-        .render(&mut out)
-        .unwrap();
+        self.0.render(&mut out).unwrap();
         Response::build()
             .header(ContentType::HTML)
             .streamed_body(Cursor::new(out))
             .ok()
     }
 }
+
+pub struct Defer(Pin<Box<dyn Future<Output = String> + Send>>);
+
+impl AsyncRead for Defer {
+    fn poll_read(
+        mut self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &mut tokio::io::ReadBuf<'_>,
+    ) -> std::task::Poll<std::io::Result<()>> {
+        match self.0.poll_unpin(cx) {
+            std::task::Poll::Ready(r) => {
+                buf.put_slice(r.as_bytes());
+                std::task::Poll::Ready(Ok(()))
+            }
+            std::task::Poll::Pending => std::task::Poll::Pending,
+        }
+    }
+}
diff --git a/server/src/routes/ui/node.rs b/server/src/routes/ui/node.rs
index 0b7494e..ec9cde8 100644
--- a/server/src/routes/ui/node.rs
+++ b/server/src/routes/ui/node.rs
@@ -1,9 +1,11 @@
 use super::error::MyError;
 use super::player::player_uri;
 use crate::{
-    library::{Directory, Item, Node},
-    routes::ui::HtmlTemplate,
-    AppState,
+    library::{Directory, Item, Library, Node},
+    routes::ui::{
+        account::session::Session,
+        layout::{DynLayoutPage, LayoutPage},
+    },
 };
 use anyhow::{anyhow, Context};
 use log::info;
@@ -13,20 +15,20 @@ use tokio::fs::File;
 
 #[get("/library/<path..>")]
 pub async fn r_library_node(
+    _sess: Session,
     path: PathBuf,
-    state: &State<AppState>,
-) -> Result<HtmlTemplate<markup::DynRender>, MyError> {
-    let node = state
-        .library
+    library: &State<Library>,
+) -> Result<DynLayoutPage<'_>, MyError> {
+    let node = library
         .nested_path(&path)
         .context("retrieving library node")?
         .clone();
-    Ok(HtmlTemplate(
-        format!("{}", node.title()),
-        markup::new! {
+    Ok(LayoutPage {
+        title: format!("{}", node.title()),
+        content: markup::new! {
             @NodePage { node: node.clone() }
         },
-    ))
+    })
 }
 
 markup::define! {
@@ -88,11 +90,11 @@ markup::define! {
 
 #[get("/item_assets/<path..>")]
 pub async fn r_item_assets(
+    _sess: Session,
     path: PathBuf,
-    state: &State<AppState>,
+    library: &State<Library>,
 ) -> Result<(ContentType, File), MyError> {
-    let node = state
-        .library
+    let node = library
         .nested_path(&path)
         .context("retrieving library node")?
         .get_item()?
diff --git a/server/src/routes/ui/player.rs b/server/src/routes/ui/player.rs
index c93d2c1..764f583 100644
--- a/server/src/routes/ui/player.rs
+++ b/server/src/routes/ui/player.rs
@@ -1,16 +1,15 @@
-use super::HtmlTemplate;
+use super::{account::session::Session, layout::LayoutPage, HtmlTemplate};
 use crate::{
-    library::Item,
+    library::{Item, Library},
     routes::{
         stream::stream_uri,
-        ui::{error::MyResult, node::rocket_uri_macro_r_item_assets},
+        ui::{error::MyResult, layout::DynLayoutPage, node::rocket_uri_macro_r_item_assets},
     },
-    AppState,
 };
 use jellycommon::SourceTrackKind;
 use log::warn;
 use rocket::{get, uri, FromForm, State};
-use std::{path::PathBuf, sync::Arc};
+use std::{alloc::Layout, path::PathBuf, sync::Arc};
 
 pub fn player_uri(path: &PathBuf) -> String {
     format!("/player/{}", path.to_str().unwrap())
@@ -26,12 +25,12 @@ pub struct PlayerConfig {
 
 #[get("/player/<path..>?<conf..>", rank = 4)]
 pub fn r_player(
-    state: &State<AppState>,
+    _sess: Session,
+    library: &State<Library>,
     path: PathBuf,
     conf: PlayerConfig,
-) -> MyResult<HtmlTemplate<markup::DynRender<'_>>> {
-    warn!("{conf:?}");
-    let item = state.library.nested_path(&path)?.get_item()?;
+) -> MyResult<DynLayoutPage<'_>> {
+    let item = library.nested_path(&path)?.get_item()?;
     if conf.a.is_none() && conf.v.is_none() && conf.s.is_none() {
         return player_conf(item.clone());
     }
@@ -43,15 +42,15 @@ pub fn r_player(
         .chain(conf.s.into_iter())
         .collect::<Vec<_>>();
 
-    Ok(HtmlTemplate(
-        item.info.title.to_owned(),
-        markup::new! {
+    Ok(LayoutPage {
+        title: item.info.title.to_owned(),
+        content: markup::new! {
             video[src=stream_uri(&item.lib_path, &tracks), controls];
         },
-    ))
+    })
 }
 
-pub fn player_conf<'a>(item: Arc<Item>) -> MyResult<HtmlTemplate<markup::DynRender<'a>>> {
+pub fn player_conf<'a>(item: Arc<Item>) -> MyResult<DynLayoutPage<'a>> {
     let mut audio_tracks = vec![];
     let mut video_tracks = vec![];
     let mut sub_tracks = vec![];
@@ -63,9 +62,9 @@ pub fn player_conf<'a>(item: Arc<Item>) -> MyResult<HtmlTemplate<markup::DynRend
         }
     }
 
-    Ok(HtmlTemplate(
-        "Configure Player".to_string(),
-        markup::new! {
+    Ok(LayoutPage {
+        title: "Configure Player".to_string(),
+        content: markup::new! {
             // img.backdrop[src=uri!(r_item_assets(&item.lib_path)).to_string()];
             form.playerconf[method = "GET", action = ""] {
                 h2 { "Select tracks for " @item.info.title }
@@ -103,5 +102,5 @@ pub fn player_conf<'a>(item: Arc<Item>) -> MyResult<HtmlTemplate<markup::DynRend
                 input[type="submit", value="Start playback"];
             }
         },
-    ))
+    })
 }
diff --git a/server/src/routes/ui/style/transition.js b/server/src/routes/ui/style/transition.js
index dd2d319..8a71f14 100644
--- a/server/src/routes/ui/style/transition.js
+++ b/server/src/routes/ui/style/transition.js
@@ -5,7 +5,7 @@ globalThis.addEventListener("load", () => {
     patch_page()
 })
 
-globalThis.addEventListener("popstate", ev => {
+globalThis.addEventListener("popstate", () => {
     transition_to(window.location.href)
 })