feat: Add Guilds and Channels (#12)

- Bumps rust version from old nightly to stable.
- Add guilds to instance
- Add voice channels that can be used with the bot
- Support starting instance from scratch with no DB

Reviewed-on: #12
Co-authored-by: Patrick Cleavelin <patrick@spacegirl.nl>
Co-committed-by: Patrick Cleavelin <patrick@spacegirl.nl>

.gitignore

@@ -1,4 +1,7 @@
 /target
-**/result
-result/
-result
+/config
+/sounds
+/.idea
+.DS_Store
+
+.env

.woodpecker.yml

@@ -0,0 +1,27 @@
+steps:
+  build-docker-image:
+    when:
+      event: [push, tag]
+    image: alpine:edge
+    commands:
+      - apk update && apk upgrade
+      - apk add --no-cache git nix --repository=https://dl-cdn.alpinelinux.org/alpine/edge/testing
+      - echo "system-features = nixos-test benchmark big-parallel uid-range kvm" > /etc/nix/nix.conf
+      - nix build --extra-experimental-features nix-command --extra-experimental-features flakes --max-jobs 16 .#docker
+      - cp $(nix build --extra-experimental-features nix-command --extra-experimental-features flakes --print-out-paths .#docker) ./memejoin-rs.tar.gz
+    volumes:
+      - ${AGENT_NIX_STORE_PATH}:/nix
+
+  publish-image:
+    when:
+      event: tag
+    image: docker
+    secrets: [ forgejo_token ]
+    commands:
+      - 'docker login -u ${CI_REPO_OWNER} --password $${FORGEJO_TOKEN} git.spacegirl.nl'
+      - 'docker image load --input memejoin-rs.tar.gz'
+      - 'docker image tag memejoin-rs:${CI_COMMIT_TAG} git.spacegirl.nl/${CI_REPO}:${CI_COMMIT_TAG}'
+      - 'docker image push git.spacegirl.nl/${CI_REPO}:${CI_COMMIT_TAG}'
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - ${AGENT_NIX_STORE_PATH}:/nix

Cargo.toml

@@ -1,15 +1,43 @@
 [package]
 name = "memejoin-rs"
-version = "0.1.0-alpha"
+version = "0.2.2-alpha"
 edition = "2021"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
+async-trait = "0.1.72"
+axum = { version = "0.6.9", features = ["headers", "multipart"] }
+axum-extra = { version = "0.7.5", features = ["cookie-private", "cookie"] }
+chrono = { version = "0.4.23", features = ["serde"] }
+dotenv = "0.15.0"
+enum-iterator = "1.4.1"
+futures = "0.3.26"
+iter_tools = "0.1.4"
+reqwest = "0.11.14"
 serde = "1.0.152"
 serde_json = "1.0.93"
-serenity = { version = "0.11.5", default-features = false, features = ["client", "gateway", "rustls_backend", "model", "cache", "voice"] }
-songbird = "0.3.0"
+thiserror = "1.0.38"
 tokio = { version = "1.25.0", features = ["rt-multi-thread", "macros", "signal"] }
+tower-http = { version = "0.4.0", features = ["cors"] }
 tracing = "0.1.37"
 tracing-subscriber = "0.3.16"
+uuid = { version = "1.3.0", features = ["v4"] }
+
+[dependencies.serenity]
+version = "0.11.5"
+default-features = false
+features = ["client", "gateway", "rustls_backend", "model", "cache", "voice"]
+
+[dependencies.songbird]
+version = "0.3.2"
+features = [ "builtin-queue", "yt-dlp" ]
+
+[target.'cfg(unix)'.dependencies]
+rusqlite = { version = "0.29.0", features = ["chrono"] }
+
+[target.'cfg(windows)'.dependencies]
+rusqlite = { version = "0.29.0", features = ["bundled", "chrono"] }
+
+[lints.clippy]
+map_flatten = "allow"

flake.lock

@@ -1,12 +1,15 @@
 {
   "nodes": {
     "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1667395993,
-        "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -16,12 +19,15 @@
       }
     },
     "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
       "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
         "type": "github"
       },
       "original": {
@@ -32,11 +38,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1675942811,
-        "narHash": "sha256-/v4Z9mJmADTpXrdIlAjFa1e+gkpIIROR670UVDQFwIw=",
+        "lastModified": 1717786204,
+        "narHash": "sha256-4q0s6m0GUcN7q+Y2DqD27iLvbcd1G50T2lv08kKxkSI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "724bfc0892363087709bd3a5a1666296759154b1",
+        "rev": "051f920625ab5aabe37c920346e3e69d7d34400e",
         "type": "github"
       },
       "original": {
@@ -48,11 +54,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1665296151,
-        "narHash": "sha256-uOB0oxqxN9K7XGF1hcnY+PQnlQJ+3bP2vCn/+Ru/bbc=",
+        "lastModified": 1706487304,
+        "narHash": "sha256-LE8lVX28MV2jWJsidW13D2qrHU/RUUONendL2Q/WlJg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "14ccaaedd95a488dd7ae142757884d8e125b3363",
+        "rev": "90f456026d284c22b3e3497be980b2e47d0b28ac",
         "type": "github"
       },
       "original": {
@@ -75,11 +81,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1676169013,
-        "narHash": "sha256-mhUWa6TUg6Qjba1OdxPuW1ctCuU4O4lSObVc6UUUE0E=",
+        "lastModified": 1717985971,
+        "narHash": "sha256-24h/qKp0aeI+Ew13WdRF521kY24PYa5HOvw0mlrABjk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "ef4cd733dc6b595cab5092f5004a489c5fd80b07",
+        "rev": "abfe5b3126b1b7e9e4daafc1c6478d17f0b584e7",
         "type": "github"
       },
       "original": {
@@ -87,6 +93,36 @@
         "repo": "rust-overlay",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -8,10 +8,21 @@
   outputs = { self, nixpkgs, rust-overlay, flake-utils, ... }:
     flake-utils.lib.eachDefaultSystem (system:
       let
+        tag = "v0.2.2-alpha";
         overlays = [ (import rust-overlay) ];
         pkgs = import nixpkgs {
           inherit system overlays;
         };
+        yt-dlp = pkgs.yt-dlp.overrideAttrs (oldAttr: rec {
+          inherit (oldAttr) name;
+          version = "2024.05.27";
+          src = pkgs.fetchFromGitHub {
+            owner = "yt-dlp";
+            repo = "yt-dlp";
+            rev = "${version}";
+            sha256 = "55zDAMwCJPn5zKrAFw4ogTxxmvjrv4PvhYO7PsHbRo4=";
+          };
+        });
         local-rust = (pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain).override {
           extensions = [ "rust-analysis" ];
         };
@@ -24,21 +35,50 @@
             pkg-config
             gcc
             openssl
+            sqlite
+            pkg-config
             python3
             ffmpeg
             cmake
             libopus
-            youtube-dl
-          ];
+            yt-dlp
+          ] ++ (if pkgs.system == "aarch64-darwin" || pkgs.system == "x86_64-darwin" then [ darwin.apple_sdk.frameworks.Security darwin.apple_sdk.frameworks.SystemConfiguration ] else []);
         };
 
         packages = with pkgs; flake-utils.lib.flattenTree rec {
           default = rustPlatform.buildRustPackage rec {
+            inherit tag;
             name = "memejoin-rs";
-            version = "0.1.0-alpha";
             src = self;
-            cargoSha256 = "dGc6db0A7Tp+ZnsPAPCUbmmbNq/N/1DhKOb2gRPisN0=";
-            nativeBuildInputs = [ local-rust cmake gcc libopus ];
+            buildInputs = [ openssl.dev ];
+            nativeBuildInputs = [ local-rust pkg-config openssl openssl.dev cmake gcc libopus sqlite ];
+
+            cargoLock = {
+              lockFile = ./Cargo.lock;
+            };
+
+            # lol, why does `buildRustPackage` not work without this?
+            postPatch = ''
+              ln -sf ${./Cargo.lock} Cargo.lock
+            '';
+          };
+
+          docker = dockerTools.buildImage {
+            inherit tag;
+            name = "memejoin-rs";
+            copyToRoot = buildEnv {
+              name = "image-root";
+              paths = [ default cacert openssl openssl.dev ffmpeg libopus youtube-dl yt-dlp sqlite ];
+            };
+            runAsRoot = ''
+              #!${runtimeShell}
+              mkdir -p /data
+            '';
+            config = {
+              WorkingDir = "/data";
+              Volumes = { "/data/config" = { }; "/data/sounds" = { }; };
+              Entrypoint = [ "/bin/memejoin-rs" ];
+            };
           };
         };
       }

justfile

@@ -0,0 +1,10 @@
+alias b := build
+alias r := run
+
+set dotenv-load
+
+build:
+    cargo build
+
+run:
+    cargo run

rust-toolchain

@@ -1 +1 @@
-nightly
+stable

src/auth.rs

@@ -0,0 +1,145 @@
+use std::str::FromStr;
+
+use enum_iterator::Sequence;
+use serde::{Deserialize, Serialize};
+
+use crate::routes::Error;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct Discord {
+    pub(crate) access_token: String,
+    pub(crate) token_type: String,
+    pub(crate) expires_in: usize,
+    pub(crate) refresh_token: String,
+    pub(crate) scope: String,
+}
+
+#[derive(Clone)]
+pub(crate) struct DiscordSecret {
+    pub(crate) client_id: String,
+    pub(crate) client_secret: String,
+    pub(crate) bot_token: String,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct User {
+    pub(crate) auth: Discord,
+    pub(crate) name: String,
+}
+
+#[derive(Default, Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct AppPermissions(pub(crate) u8);
+
+impl AppPermissions {
+    pub(crate) fn can(&self, perm: AppPermission) -> bool {
+        (self.0 & (perm as u8) > 0) || (self.0 & (AppPermission::Admin as u8) > 0)
+    }
+
+    // FIXME: eventually use this
+    #[allow(dead_code)]
+    pub(crate) fn add(&mut self, perm: Permission) {
+        self.0 |= perm as u8;
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize, Sequence)]
+#[repr(u8)]
+pub(crate) enum AppPermission {
+    None = 0,
+    AddGuild = 1,
+    Admin = 128,
+}
+
+impl AppPermission {
+    pub(crate) fn all() -> u8 {
+        0xFF
+    }
+}
+
+impl std::fmt::Display for AppPermission {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                AppPermission::None => todo!(),
+                AppPermission::AddGuild => "Add Guild".to_string(),
+                AppPermission::Admin => "Admin".to_string(),
+            }
+        )
+    }
+}
+
+impl FromStr for AppPermission {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "Add Guild" => Ok(Self::AddGuild),
+            "Admin" => Ok(Self::Admin),
+            _ => Err(Self::Err::InvalidRequest),
+        }
+    }
+}
+
+#[derive(Default, Debug, Clone, Copy, Serialize, Deserialize)]
+pub(crate) struct Permissions(pub(crate) u8);
+
+impl Permissions {
+    pub(crate) fn can(&self, perm: Permission) -> bool {
+        (self.0 & (perm as u8) > 0) || (self.0 & (Permission::Moderator as u8) > 0)
+    }
+
+    pub(crate) fn add(&mut self, perm: Permission) {
+        self.0 |= perm as u8;
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize, Sequence)]
+#[repr(u8)]
+pub(crate) enum Permission {
+    None = 0,
+    UploadSounds = 1,
+    DeleteSounds = 2,
+    Soundboard = 4,
+    AddChannel = 8,
+    Moderator = 128,
+}
+
+impl Permission {
+    pub(crate) fn all() -> u8 {
+        0xFF
+    }
+}
+
+impl std::fmt::Display for Permission {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{}",
+            match self {
+                Permission::None => todo!(),
+                Permission::UploadSounds => "Upload Sounds".to_string(),
+                Permission::DeleteSounds => "Delete Sounds".to_string(),
+                Permission::Soundboard => "Soundboard".to_string(),
+                Permission::AddChannel => "Add Channel".to_string(),
+                Permission::Moderator => "Moderator".to_string(),
+            },
+        )
+    }
+}
+
+impl FromStr for Permission {
+    type Err = Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "Upload Sounds" => Ok(Self::UploadSounds),
+            "Delete Sounds" => Ok(Self::DeleteSounds),
+            "Soundboard" => Ok(Self::Soundboard),
+            "Add Channel" => Ok(Self::AddChannel),
+            "Moderator" => Ok(Self::Moderator),
+            _ => Err(Self::Err::InvalidRequest),
+        }
+    }
+}

src/db/mod.rs

@@ -0,0 +1,578 @@
+use std::path::Path;
+
+use chrono::NaiveDateTime;
+use rusqlite::{Connection, OptionalExtension, Result};
+use serde::{Deserialize, Serialize};
+use tracing::warn;
+
+use crate::auth;
+
+pub struct Database {
+    conn: Connection,
+}
+
+impl Database {
+    pub fn new(path: impl AsRef<Path>) -> Result<Self> {
+        Ok(Self {
+            conn: Connection::open(path)?,
+        })
+    }
+
+    pub(crate) fn init(&self) -> Result<()> {
+        self.conn.execute_batch(include_str!("schema.sql"))?;
+
+        Ok(())
+    }
+
+    pub(crate) fn get_guild_users(&self, guild_id: u64) -> Result<Vec<String>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                username
+            FROM UserGuild
+            WHERE guild_id = :guild_id
+            ",
+        )?;
+
+        // NOTE(pcleavelin): for some reason this needs to be a let-binding or else
+        // the compiler complains about it being dropped too early (maybe I should update the compiler version)
+        let users = query
+            .query_map(&[(":guild_id", &guild_id.to_string())], |row| row.get(0))?
+            .collect::<Result<Vec<String>>>()?;
+
+        Ok(users)
+    }
+
+    pub fn get_guild(&self, guild_id: u64) -> Result<String> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                Guild.name
+            FROM Guild
+            WHERE Guild.id = :guild_id
+            ",
+        )?;
+
+        let guild_name =
+            query.query_row(&[(":guild_id", &guild_id.to_string())], |row| row.get(0))?;
+
+        Ok(guild_name)
+    }
+
+    pub(crate) fn get_guilds(&self) -> Result<Vec<Guild>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                id, name, sound_delay
+            FROM Guild
+            ",
+        )?;
+
+        // NOTE(pcleavelin): for some reason this needs to be a let-binding or else
+        // the compiler complains about it being dropped too early (maybe I should update the compiler version)
+        #[allow(clippy::useless_conversion)]
+        let guilds = query
+            .query_map([], |row| {
+                Ok(Guild {
+                    id: row.get(0)?,
+                    name: row.get(1)?,
+                    sound_delay: row.get(2)?,
+                })
+            })?
+            .into_iter()
+            .collect::<Result<Vec<Guild>>>();
+
+        guilds
+    }
+
+    pub(crate) fn get_user_count(&self) -> Result<i64> {
+        self.conn.query_row(
+            "
+            SELECT
+                COUNT(username)
+            FROM User
+            ",
+            [],
+            |row| row.get(0),
+        )
+    }
+
+    pub(crate) fn get_user_from_api_key(&self, api_key: &str) -> Result<User> {
+        self.conn.query_row(
+            "
+            SELECT
+                username AS name, api_key, api_key_expires_at, discord_token, discord_token_expires_at
+            FROM User
+            WHERE api_key = ?1
+            ",
+            [api_key],
+            |row| {
+                Ok(User {
+                    name: row.get(0)?,
+                    api_key: row.get(1)?,
+                    api_key_expires_at: row.get(2)?,
+                    discord_token: row.get(3)?,
+                    discord_token_expires_at: row.get(4)?,
+                })
+            },
+        )
+    }
+
+    pub(crate) fn get_user(&self, username: &str) -> Result<Option<User>> {
+        self.conn
+            .query_row(
+                "
+            SELECT
+                username AS name, api_key, api_key_expires_at, discord_token, discord_token_expires_at
+            FROM User
+            WHERE name = ?1
+            ",
+                [username],
+                |row| {
+                    Ok(User {
+                        name: row.get(0)?,
+                        api_key: row.get(1)?,
+                        api_key_expires_at: row.get(2)?,
+                        discord_token: row.get(3)?,
+                        discord_token_expires_at: row.get(4)?,
+                    })
+                },
+            )
+            .optional()
+    }
+
+    pub fn get_user_guilds(&self, username: &str) -> Result<Vec<Guild>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                id, name, sound_delay
+            FROM Guild
+            LEFT JOIN UserGuild ON UserGuild.guild_id = Guild.id
+            WHERE UserGuild.username = :username
+            ",
+        )?;
+
+        // NOTE(pcleavelin): for some reason this needs to be a let-binding or else
+        // the compiler complains about it being dropped too early (maybe I should update the compiler version)
+        #[allow(clippy::useless_conversion)]
+        let guilds = query
+            .query_map(&[(":username", username)], |row| {
+                Ok(Guild {
+                    id: row.get(0)?,
+                    name: row.get(1)?,
+                    sound_delay: row.get(2)?,
+                })
+            })?
+            .into_iter()
+            .collect::<Result<Vec<Guild>>>();
+
+        guilds
+    }
+
+    pub fn get_guild_intros(&self, guild_id: u64) -> Result<Vec<Intro>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                Intro.id,
+                Intro.name,
+                Intro.filename
+            FROM Intro
+            WHERE
+                Intro.guild_id = :guild_id
+            ",
+        )?;
+
+        // NOTE(pcleavelin): for some reason this needs to be a let-binding or else
+        // the compiler complains about it being dropped too early (maybe I should update the compiler version)
+        #[allow(clippy::useless_conversion)]
+        let intros = query
+            .query_map(
+                &[
+                    // :vomit:
+                    (":guild_id", &guild_id.to_string()),
+                ],
+                |row| {
+                    Ok(Intro {
+                        id: row.get(0)?,
+                        name: row.get(1)?,
+                        filename: row.get(2)?,
+                    })
+                },
+            )?
+            .into_iter()
+            .collect::<Result<Vec<Intro>>>();
+
+        intros
+    }
+
+    pub fn get_all_user_intros(&self, guild_id: u64) -> Result<Vec<UserIntro>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                Intro.id,
+                Intro.name,
+                Intro.filename,
+                UI.channel_name,
+                UI.username
+            FROM Intro
+            LEFT JOIN UserIntro UI ON UI.intro_id = Intro.id
+            WHERE
+                UI.guild_id = :guild_id
+            ORDER BY UI.username DESC, UI.channel_name DESC, UI.intro_id;
+            ",
+        )?;
+
+        // NOTE(pcleavelin): for some reason this needs to be a let-binding or else
+        // the compiler complains about it being dropped too early (maybe I should update the compiler version)
+        #[allow(clippy::useless_conversion)]
+        let intros = query
+            .query_map(
+                &[
+                    // :vomit:
+                    (":guild_id", &guild_id.to_string()),
+                ],
+                |row| {
+                    Ok(UserIntro {
+                        intro: Intro {
+                            id: row.get(0)?,
+                            name: row.get(1)?,
+                            filename: row.get(2)?,
+                        },
+                        channel_name: row.get(3)?,
+                        username: row.get(4)?,
+                    })
+                },
+            )?
+            .into_iter()
+            .collect::<Result<Vec<UserIntro>>>();
+
+        intros
+    }
+
+    pub(crate) fn get_all_user_permissions(
+        &self,
+        guild_id: u64,
+    ) -> Result<Vec<(String, auth::Permissions)>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                username,
+                permissions
+            FROM UserPermission
+            WHERE
+                guild_id = :guild_id
+            ",
+        )?;
+
+        let permissions = query
+            .query_map(
+                &[
+                    // :vomit:
+                    (":guild_id", &guild_id.to_string()),
+                ],
+                |row| Ok((row.get(0)?, auth::Permissions(row.get(1)?))),
+            )?
+            .collect::<Result<Vec<(String, auth::Permissions)>>>()?;
+
+        Ok(permissions)
+    }
+
+    pub(crate) fn get_user_permissions(
+        &self,
+        username: &str,
+        guild_id: u64,
+    ) -> Result<auth::Permissions> {
+        self.conn.query_row(
+            "
+            SELECT
+                permissions
+            FROM UserPermission
+            WHERE
+                username = ?1
+            AND guild_id = ?2
+            ",
+            [username, &guild_id.to_string()],
+            |row| Ok(auth::Permissions(row.get(0)?)),
+        )
+    }
+
+    pub(crate) fn get_user_app_permissions(&self, username: &str) -> Result<auth::AppPermissions> {
+        self.conn.query_row(
+            "
+            SELECT
+                permissions
+            FROM UserAppPermission
+            WHERE
+                username = ?1
+            ",
+            [username],
+            |row| Ok(auth::AppPermissions(row.get(0)?)),
+        )
+    }
+
+    pub(crate) fn get_guild_channels(&self, guild_id: u64) -> Result<Vec<String>> {
+        let mut query = self.conn.prepare(
+            "
+            SELECT
+                Channel.name
+            FROM Channel
+            WHERE
+                Channel.guild_id = :guild_id
+            ORDER BY Channel.name DESC
+            ",
+        )?;
+
+        // NOTE(pcleavelin): for some reason this needs to be a let-binding or else
+        // the compiler complains about it being dropped too early (maybe I should update the compiler version)
+        #[allow(clippy::useless_conversion)]
+        let intros = query
+            .query_map(
+                &[
+                    // :vomit:
+                    (":guild_id", &guild_id.to_string()),
+                ],
+                |row| row.get(0),
+            )?
+            .into_iter()
+            .collect::<Result<Vec<String>>>();
+
+        intros
+    }
+
+    pub(crate) fn get_user_channel_intros(
+        &self,
+        username: &str,
+        guild_id: u64,
+        channel_name: &str,
+    ) -> Result<Vec<Intro>> {
+        let all_user_intros = self.get_all_user_intros(guild_id)?.into_iter();
+
+        let intros = all_user_intros
+            .filter(|intro| intro.username == username && intro.channel_name == channel_name)
+            .map(|intro| intro.intro)
+            .collect();
+
+        Ok(intros)
+    }
+
+    pub fn insert_guild(&self, guild_id: &u64, name: &str, sound_delay: u32) -> Result<()> {
+        let affected = self.conn.execute(
+            "INSERT INTO
+                Guild (id, name, sound_delay)
+            VALUES (?1, ?2, ?3)",
+            [
+                guild_id.to_string(),
+                name.to_string(),
+                sound_delay.to_string(),
+            ],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert guild");
+        }
+
+        Ok(())
+    }
+
+    pub fn insert_guild_channel(&self, guild_id: &u64, name: &str) -> Result<()> {
+        let affected = self.conn.execute(
+            "INSERT INTO
+                Channel (name, guild_id)
+            VALUES (?1, ?2)",
+            [name.to_string(), guild_id.to_string()],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert channel");
+        }
+
+        Ok(())
+    }
+
+    pub fn insert_user(
+        &self,
+        username: &str,
+        api_key: &str,
+        api_key_expires_at: NaiveDateTime,
+        discord_token: &str,
+        discord_token_expires_at: NaiveDateTime,
+    ) -> Result<()> {
+        let affected = self.conn.execute(
+            "INSERT INTO
+                User (username, api_key, api_key_expires_at, discord_token, discord_token_expires_at)
+            VALUES (?1, ?2, ?3, ?4, ?5)
+            ON CONFLICT(username) DO UPDATE SET api_key = ?2, api_key_expires_at = ?3, discord_token = ?4, discord_token_expires_at = ?5",
+            [
+                username,
+                api_key,
+                &api_key_expires_at.to_string(),
+                discord_token,
+                &discord_token_expires_at.to_string(),
+            ],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert new user");
+        }
+
+        Ok(())
+    }
+
+    pub fn insert_intro(
+        &self,
+        name: &str,
+        volume: i32,
+        guild_id: u64,
+        filename: &str,
+    ) -> Result<()> {
+        let affected = self.conn.execute(
+            "INSERT INTO
+                Intro (name, volume, guild_id, filename)
+            VALUES (?1, ?2, ?3, ?4)",
+            [name, &volume.to_string(), &guild_id.to_string(), filename],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert intro");
+        }
+
+        Ok(())
+    }
+
+    pub fn insert_user_guild(&self, username: &str, guild_id: u64) -> Result<()> {
+        let affected = self.conn.execute(
+            "INSERT OR IGNORE INTO UserGuild (username, guild_id) VALUES (?1, ?2)",
+            [username, &guild_id.to_string()],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert user guild");
+        }
+
+        Ok(())
+    }
+
+    pub fn insert_user_intro(
+        &self,
+        username: &str,
+        guild_id: u64,
+        channel_name: &str,
+        intro_id: i32,
+    ) -> Result<()> {
+        let affected = self.conn.execute(
+            "INSERT INTO UserIntro (username, guild_id, channel_name, intro_id) VALUES (?1, ?2, ?3, ?4)",
+            [
+                username,
+                &guild_id.to_string(),
+                channel_name,
+                &intro_id.to_string(),
+            ],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert user intro");
+        }
+
+        Ok(())
+    }
+
+    pub(crate) fn insert_user_permission(
+        &self,
+        username: &str,
+        guild_id: u64,
+        permissions: auth::Permissions,
+    ) -> Result<()> {
+        let affected = self.conn.execute(
+            "
+            INSERT INTO
+                UserPermission (username, guild_id, permissions)
+            VALUES (?1, ?2, ?3)
+            ON CONFLICT(username, guild_id) DO UPDATE SET permissions = ?3",
+            [username, &guild_id.to_string(), &permissions.0.to_string()],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert user permissions");
+        }
+
+        Ok(())
+    }
+
+    pub(crate) fn insert_user_app_permission(
+        &self,
+        username: &str,
+        permissions: auth::AppPermissions,
+    ) -> Result<()> {
+        let affected = self.conn.execute(
+            "
+            INSERT INTO
+                UserAppPermission (username, permissions)
+            VALUES (?1, ?2)
+            ON CONFLICT(username) DO UPDATE SET permissions = ?2",
+            [username, &permissions.0.to_string()],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to insert user app permissions");
+        }
+
+        Ok(())
+    }
+
+    pub fn delete_user_intro(
+        &self,
+        username: &str,
+        guild_id: u64,
+        channel_name: &str,
+        intro_id: i32,
+    ) -> Result<()> {
+        let affected = self.conn.execute(
+            "DELETE FROM
+                UserIntro
+            WHERE
+                username = ?1
+            AND guild_id = ?2
+            AND channel_name = ?3
+            AND intro_id = ?4",
+            [
+                username,
+                &guild_id.to_string(),
+                channel_name,
+                &intro_id.to_string(),
+            ],
+        )?;
+
+        if affected < 1 {
+            warn!("no rows affected when attempting to delete user intro");
+        }
+
+        Ok(())
+    }
+}
+
+pub struct Guild {
+    pub id: u64,
+    pub name: String,
+    pub sound_delay: u32,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct User {
+    pub name: String,
+    pub api_key: String,
+    pub api_key_expires_at: NaiveDateTime,
+    pub discord_token: String,
+    pub discord_token_expires_at: NaiveDateTime,
+}
+
+pub struct Intro {
+    pub id: i32,
+    pub name: String,
+    pub filename: String,
+}
+
+pub struct UserIntro {
+    pub intro: Intro,
+    pub channel_name: String,
+    pub username: String,
+}

src/db/schema.sql

@@ -0,0 +1,93 @@
+BEGIN;
+
+create table if not exists User
+(
+    username TEXT not null
+        constraint User_pk
+            primary key,
+    api_key TEXT not null,
+    api_key_expires_at DATETIME not null,
+    discord_token TEXT not null,
+    discord_token_expires_at DATETIME not null
+);
+
+create table if not exists Intro
+(
+    id     integer not null
+        constraint Intro_pk
+            primary key autoincrement,
+    name   TEXT    not null,
+    volume integer not null,
+    guild_id integer not null
+        constraint Intro_Guild_guild_id_fk
+            references Guild ("id"),
+    filename   TEXT    not null
+);
+
+create table if not exists Guild
+(
+    id          integer    not null
+        primary key,
+    name        TEXT    not null,
+    sound_delay integer not null
+);
+
+create table if not exists Channel
+(
+    name     TEXT
+        primary key,
+    guild_id integer
+        constraint Channel_Guild_id_fk
+            references Guild (id)
+);
+
+create table if not exists UserGuild
+(
+    username TEXT not null
+        constraint UserGuild_User_username_fk
+            references User,
+    guild_id integer not null
+        constraint UserGuild_Guild_id_fk
+            references Guild (id),
+    primary key ("username", "guild_id")
+);
+
+create table if not exists UserIntro
+(
+    username     text    not null
+        constraint UserIntro_User_username_fk
+            references User,
+    intro_id     integer not null
+        constraint UserIntro_Intro_id_fk
+            references Intro,
+    guild_id     integer    not null
+        constraint UserIntro_Guild_guild_id_fk
+            references Guild ("id"),
+    channel_name text    not null
+        constraint UserIntro_Channel_channel_name_fk
+            references Channel ("name"),
+    primary key ("username", "intro_id", "guild_id", "channel_name")
+);
+
+create table if not exists UserPermission
+(
+    username    TEXT    not null
+        constraint UserPermission_User_username_fk
+            references User,
+    guild_id integer not null
+        constraint User_Guild_guild_id_fk
+            references Guild ("id"),
+    permissions integer not null,
+    primary key ("username", "guild_id")
+);
+
+create table if not exists UserAppPermission
+(
+    username    TEXT    not null
+        constraint UserPermission_User_username_fk
+            references User,
+    permissions integer not null,
+    primary key ("username")
+);
+
+COMMIT;

src/htmx.rs

@@ -0,0 +1,401 @@
+#![allow(dead_code)]
+
+use std::collections::HashMap;
+
+pub trait Build {
+    fn build(self) -> String;
+}
+
+#[derive(PartialEq)]
+pub enum Tag {
+    Empty,
+
+    Html,
+    Head,
+    Link,
+    Script,
+    Title,
+    Body,
+    Main,
+    Break,
+
+    Details,
+    Summary,
+
+    Dialog,
+    Article,
+    Header,
+    Footer,
+
+    Div,
+
+    Table,
+    TableHead,
+    TableHeader,
+    TableBody,
+    TableRow,
+    TableData,
+
+    Progress,
+
+    Form,
+    Label,
+    FieldSet,
+    Input,
+    Select,
+    Option,
+
+    Nav,
+
+    OrderedList,
+    UnorderedList,
+    ListItem,
+
+    Anchor,
+    Button,
+
+    HeaderGroup,
+    Header1,
+    Header2,
+    Header3,
+    Header4,
+    Header5,
+    Header6,
+    Strong,
+    Paragraph,
+    JustText,
+}
+
+impl Tag {
+    fn as_str(&self) -> &'static str {
+        match self {
+            Self::Empty => "",
+            Self::JustText => "",
+
+            Self::Html => "html",
+            Self::Head => "head",
+            Self::Link => "link",
+            Self::Script => "script",
+            Self::Title => "title",
+            Self::Body => "body",
+            Self::Main => "main",
+            Self::Break => "break",
+
+            Self::Progress => "progress",
+
+            Self::Details => "details",
+            Self::Summary => "summary",
+
+            Self::Dialog => "dialog",
+            Self::Article => "article",
+            Self::Header => "header",
+            Self::Footer => "footer",
+
+            Self::Div => "div",
+
+            Self::Table => "table",
+            Self::TableHead => "thead",
+            Self::TableHeader => "th",
+            Self::TableBody => "tbody",
+            Self::TableRow => "tr",
+            Self::TableData => "td",
+
+            Self::Form => "form",
+            Self::Label => "label",
+            Self::FieldSet => "fieldset",
+            Self::Input => "input",
+            Self::Select => "select",
+            Self::Option => "option",
+
+            Self::Nav => "nav",
+
+            Self::OrderedList => "ol",
+            Self::UnorderedList => "ul",
+            Self::ListItem => "li",
+
+            Self::Anchor => "a",
+            Self::Button => "button",
+
+            Self::HeaderGroup => "hgroup",
+            Self::Header1 => "h1",
+            Self::Header2 => "h2",
+            Self::Header3 => "h3",
+            Self::Header4 => "h4",
+            Self::Header5 => "h5",
+            Self::Header6 => "h6",
+            Self::Strong => "strong",
+            Self::Paragraph => "paragraph",
+        }
+    }
+
+    fn start(&self) -> String {
+        if *self != Self::JustText && *self != Self::Empty {
+            format!("<{}>", self.as_str())
+        } else {
+            String::new()
+        }
+    }
+
+    fn end(&self) -> String {
+        if *self != Self::JustText
+            && *self != Self::Empty
+            && *self != Self::Link
+            && *self != Self::Input
+        {
+            format!("</{}>", self.as_str())
+        } else {
+            String::new()
+        }
+    }
+}
+
+pub enum SwapMethod {
+    InnerHtml,
+    OuterHtml,
+    BeforeEnd,
+    Refresh,
+}
+
+impl SwapMethod {
+    fn as_str(&self) -> &'static str {
+        match self {
+            SwapMethod::InnerHtml => "innerHTML",
+            SwapMethod::OuterHtml => "outerHTML",
+            SwapMethod::BeforeEnd => "beforeend",
+            SwapMethod::Refresh => "refresh",
+        }
+    }
+}
+
+pub struct HtmxBuilder {
+    tag: Tag,
+    attributes: HashMap<String, String>,
+    children: Vec<HtmxBuilder>,
+    text: Option<String>,
+}
+
+impl Build for HtmxBuilder {
+    #[must_use]
+    fn build(self) -> String {
+        let mut string = String::new();
+
+        // TODO: do this better
+        {
+            if self.tag != Tag::JustText && self.tag != Tag::Empty {
+                string.push_str(&format!("<{}", self.tag.as_str()));
+            }
+
+            for (attr, value) in self.attributes {
+                if value.is_empty() {
+                    string.push_str(&format!(" {attr} "));
+                } else {
+                    string.push_str(&format!(" {attr}='{value}' "));
+                }
+            }
+            if self.tag != Tag::JustText && self.tag != Tag::Empty {
+                string.push('>');
+            }
+        }
+
+        if let Some(text) = self.text {
+            string.push_str(&text);
+        }
+
+        for child in self.children {
+            string.push_str(&child.build());
+        }
+
+        string.push_str(&self.tag.end());
+
+        string
+    }
+}
+
+impl HtmxBuilder {
+    pub fn new(tag: Tag) -> Self {
+        Self {
+            tag,
+            attributes: HashMap::new(),
+            children: Vec::new(),
+            text: None,
+        }
+    }
+
+    pub fn push_builder(mut self, builder: HtmxBuilder) -> Self {
+        self.children.push(builder);
+        self
+    }
+
+    pub fn attribute(mut self, attr: &str, val: &str) -> Self {
+        self.attributes.insert(attr.to_string(), val.to_string());
+        self
+    }
+
+    pub fn hx_get(self, uri: &str) -> Self {
+        self.attribute("hx-get", uri)
+    }
+
+    pub fn hx_post(self, uri: &str) -> Self {
+        self.attribute("hx-post", uri)
+    }
+
+    pub fn hx_swap(self, swap_method: SwapMethod) -> Self {
+        self.attribute("hx-swap", swap_method.as_str())
+    }
+
+    pub fn hx_trigger(self, trigger: &str) -> Self {
+        self.attribute("hx-trigger", trigger)
+    }
+
+    pub fn hx_target(self, target: &str) -> Self {
+        self.attribute("hx-target", target)
+    }
+
+    pub fn html<F>(mut self, builder_fn: F) -> Self
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Html)));
+        self
+    }
+
+    pub fn head<F>(mut self, builder_fn: F) -> Self
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Head)));
+        self
+    }
+
+    pub fn title(mut self, text: &str) -> HtmxBuilder {
+        self.children.push(HtmxBuilder::new(Tag::Title).text(text));
+        self
+    }
+
+    pub fn body<F>(mut self, builder_fn: F) -> Self
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Body)));
+        self
+    }
+
+    pub fn script(mut self, src: &str, integrity: Option<&str>) -> Self {
+        let mut b = HtmxBuilder::new(Tag::Script).attribute("src", src);
+
+        if let Some(integrity) = integrity {
+            b = b
+                .attribute("integrity", integrity)
+                .attribute("crossorigin", "anonymous");
+        }
+
+        self.children.push(b);
+        self
+    }
+
+    pub fn style_link(mut self, link: &str) -> Self {
+        self.children.push(
+            HtmxBuilder::new(Tag::Link)
+                .attribute("rel", "stylesheet")
+                .attribute("href", link),
+        );
+        self
+    }
+
+    pub fn flag(mut self, flag: &str) -> Self {
+        self.attributes.insert(flag.to_string(), "".to_string());
+        self
+    }
+
+    pub fn builder<F>(mut self, tag: Tag, builder_fn: F) -> Self
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(tag)));
+        self
+    }
+
+    pub fn builder_text(mut self, tag: Tag, text: &str) -> Self {
+        self.children.push(HtmxBuilder::new(tag).text(text));
+        self
+    }
+
+    pub fn nav<F>(mut self, builder_fn: F) -> Self
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Nav)));
+        self
+    }
+
+    pub fn form<F>(mut self, builder_fn: F) -> HtmxBuilder
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Form)));
+        self
+    }
+
+    pub fn label<F>(mut self, builder_fn: F) -> HtmxBuilder
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Label)));
+        self
+    }
+
+    pub fn input<F>(mut self, builder_fn: F) -> HtmxBuilder
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children.push(builder_fn(HtmxBuilder::new(Tag::Input)));
+        self
+    }
+
+    pub fn button<F>(mut self, builder_fn: F) -> HtmxBuilder
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children
+            .push(builder_fn(HtmxBuilder::new(Tag::Button)));
+        self
+    }
+
+    pub fn ul<F>(mut self, builder_fn: F) -> HtmxBuilder
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children
+            .push(builder_fn(HtmxBuilder::new(Tag::UnorderedList)));
+        self
+    }
+
+    pub fn li<F>(mut self, builder_fn: F) -> HtmxBuilder
+    where
+        F: FnOnce(HtmxBuilder) -> HtmxBuilder,
+    {
+        self.children
+            .push(builder_fn(HtmxBuilder::new(Tag::ListItem)));
+        self
+    }
+
+    pub fn link(mut self, text: &str, href: &str) -> HtmxBuilder {
+        // TODO: add href attribute
+        self.children.push(
+            HtmxBuilder::new(Tag::Anchor)
+                .text(text)
+                .attribute("href", href),
+        );
+        self
+    }
+
+    pub fn text(mut self, text: &str) -> HtmxBuilder {
+        self.text = Some(text.to_string());
+        self
+    }
+
+    pub fn strong(mut self, text: &str) -> HtmxBuilder {
+        self.children.push(HtmxBuilder::new(Tag::Strong).text(text));
+        self
+    }
+}

src/main.rs

@@ -1,24 +1,47 @@
-#![feature(stmt_expr_attributes)]
-#![feature(proc_macro_hygiene)]
-#![feature(async_closure)]
+// #![feature(stmt_expr_attributes)]
+// #![feature(proc_macro_hygiene)]
+// #![feature(async_closure)]
 
-use std::collections::HashMap;
+mod auth;
+mod db;
+mod htmx;
+mod media;
+mod page;
+mod routes;
+pub mod settings;
+
+use axum::http::Method;
+use axum::routing::{get, post};
+use axum::Router;
+use settings::ApiState;
 use std::env;
+use std::net::SocketAddr;
 use std::sync::Arc;
+use tokio::sync::mpsc;
+use tower_http::cors::{Any, CorsLayer};
 
-use serde::Deserialize;
 use serenity::async_trait;
-use serenity::model::prelude::{Channel, GuildId, Ready};
+use serenity::model::prelude::{Channel, ChannelId, GuildId, Member, Ready};
 use serenity::model::voice::VoiceState;
 use serenity::prelude::GatewayIntents;
 use serenity::prelude::*;
 use songbird::SerenityInit;
 use tracing::*;
 
-struct Handler;
+use crate::settings::Settings;
+
+enum HandlerMessage {
+    Ready(Context),
+    PlaySound(Context, Member, ChannelId),
+    TrackEnded(GuildId),
+}
+
+struct Handler {
+    tx: std::sync::Mutex<mpsc::Sender<HandlerMessage>>,
+}
 
 struct TrackEventHandler {
-    ctx: Context,
+    tx: mpsc::Sender<HandlerMessage>,
     guild_id: GuildId,
 }
 
@@ -28,67 +51,43 @@ impl songbird::EventHandler for TrackEventHandler {
         &'a self,
         ctx: &'b songbird::EventContext<'c>,
     ) -> Option<songbird::Event> {
-        if let songbird::EventContext::Track(track) = ctx {
-            if let Some(context) = track.get(0) {
-                if context.0.playing == songbird::tracks::PlayMode::End
-                    || context.0.playing == songbird::tracks::PlayMode::Stop
-                {
-                    let manager = songbird::get(&self.ctx).await.expect("should get manager");
-                    if let Err(err) = manager.leave(self.guild_id).await {
-                        error!("Failed to leave voice channel: {err:?}");
-                    }
-                }
+        if let songbird::EventContext::Track(_) = ctx {
+            if let Err(err) = self
+                .tx
+                .send(HandlerMessage::TrackEnded(self.guild_id))
+                .await
+            {
+                error!("Failed to send track end message to handler: {err}");
             }
         }
+
         None
     }
 }
 
-#[derive(Debug, Clone, Deserialize)]
-struct Settings {
-    #[serde(alias = "userEnteredSoundDelay")]
-    _sound_delay: u64,
-    channels: HashMap<String, ChannelSettings>,
-}
-
-impl TypeMapKey for Settings {
-    type Value = Arc<Settings>;
-}
-
-#[derive(Debug, Clone, Deserialize)]
-struct ChannelSettings {
-    #[serde(alias = "enterUsers")]
-    users: HashMap<String, UserSettings>,
-}
-
-#[derive(Debug, Clone, Deserialize)]
-struct UserSettings {
-    #[serde(rename = "type")]
-    ty: SoundType,
-
-    #[serde(alias = "enterSound")]
-    sound: String,
-    #[serde(alias = "youtubeVolume")]
-    _volume: i32,
-}
-
-#[derive(Debug, Clone, Deserialize)]
-enum SoundType {
-    #[serde(alias = "file")]
-    File,
-    #[serde(alias = "youtube")]
-    Youtube,
-}
-
 #[async_trait]
 impl EventHandler for Handler {
-    async fn ready(&self, _ctx: Context, ready: Ready) {
+    async fn ready(&self, ctx: Context, ready: Ready) {
+        let tx = self
+            .tx
+            .lock()
+            .expect("failed to get message sender lock")
+            .clone();
+
+        tx.send(HandlerMessage::Ready(ctx))
+            .await
+            .unwrap_or_else(|err| panic!("failed to send ready message to handler: {err}"));
+
         info!("{} is ready", ready.user.name);
     }
 
     async fn voice_state_update(&self, ctx: Context, old: Option<VoiceState>, new: VoiceState) {
         if old.is_none() {
             if let (Some(member), Some(channel_id)) = (new.member, new.channel_id) {
+                if member.user.name == "MemeJoin" {
+                    return;
+                }
+
                 info!(
                     "{}#{} joined voice channel {:?} in {:?}",
                     member.user.name,
@@ -100,108 +99,102 @@ impl EventHandler for Handler {
                         .unwrap_or("no_guild_name".to_string())
                 );
 
-                if member.user.name == "MemeJoin" {
-                    return;
-                }
+                let tx = self
+                    .tx
+                    .lock()
+                    .expect("couldn't get lock for Handler messenger")
+                    .clone();
 
-                let settings = {
-                    let data_read = ctx.data.read().await;
-
-                    data_read
-                        .get::<Settings>()
-                        .expect("settings should exist")
-                        .clone()
-                };
-
-                let Some(Channel::Guild(channel)) = channel_id.to_channel_cached(&ctx.cache) else {
-                    error!("Failed to get cached channel from member!");
-                    return;
-                };
-
-                let Some(user) = settings.channels.get(channel.name()).and_then(|c| c.users.get(&member.user.name)) else {
-                    info!("No sound associated for {} in channel {}", member.user.name, channel.name());
-                    return;
-                };
-
-                let Some(manager) = songbird::get(&ctx).await else {
-                    error!("Failed to get songbird manager from context");
-                    return;
-                };
-
-                match manager.join(member.guild_id, channel_id).await {
-                    (handler_lock, Ok(())) => {
-                        let mut handler = handler_lock.lock().await;
-
-                        let source = match user.ty {
-                            SoundType::Youtube => match songbird::ytdl(&user.sound).await {
-                                Ok(source) => source,
-                                Err(err) => {
-                                    error!("Error starting youtube source: {err:?}");
-                                    return;
-                                }
-                            },
-                            SoundType::File => {
-                                match songbird::ffmpeg(format!("sounds/{}", &user.sound)).await {
-                                    Ok(source) => source,
-                                    Err(err) => {
-                                        error!("Error starting file source: {err:?}");
-                                        return;
-                                    }
-                                }
-                            }
-                        };
-
-                        let track_handle = handler.play_source(source);
-                        if let Err(err) = track_handle.add_event(
-                            songbird::Event::Track(songbird::TrackEvent::End),
-                            TrackEventHandler {
-                                ctx,
-                                guild_id: member.guild_id,
-                            },
-                        ) {
-                            error!("Failed to add event handler to track handle: {err:?}");
-                        };
-                    }
-
-                    (_, Err(err)) => {
-                        error!("Failed to join voice channel {}: {err:?}", channel.name());
-                    }
+                if let Err(err) = tx
+                    .send(HandlerMessage::PlaySound(ctx, member, channel_id))
+                    .await
+                {
+                    error!("Failed to send play sound message to handler: {err}");
                 }
             }
         }
     }
 }
 
-#[tokio::main]
-#[instrument]
-async fn main() {
-    tracing_subscriber::fmt::init();
+fn spawn_api(db: Arc<tokio::sync::Mutex<db::Database>>) {
+    let secrets = auth::DiscordSecret {
+        client_id: env::var("DISCORD_CLIENT_ID").expect("expected DISCORD_CLIENT_ID env var"),
+        client_secret: env::var("DISCORD_CLIENT_SECRET")
+            .expect("expected DISCORD_CLIENT_SECRET env var"),
+        bot_token: env::var("DISCORD_TOKEN").expect("expected DISCORD_TOKEN env var"),
+    };
+    let origin = env::var("APP_ORIGIN").expect("expected APP_ORIGIN");
 
+    let state = ApiState {
+        db,
+        secrets,
+        origin: origin.clone(),
+    };
+
+    tokio::spawn(async move {
+        let api = Router::new()
+            .route("/", get(page::home))
+            .route("/index.html", get(page::home))
+            .route("/login", get(page::login))
+            .route("/guild/:guild_id", get(page::guild_dashboard))
+            .route("/guild/:guild_id/setup", get(routes::guild_setup))
+            .route(
+                "/guild/:guild_id/add_channel",
+                post(routes::guild_add_channel),
+            )
+            .route(
+                "/guild/:guild_id/permissions/update",
+                post(routes::update_guild_permissions),
+            )
+            .route("/v2/auth", get(routes::v2_auth))
+            .route(
+                "/v2/intros/add/:guild_id/:channel",
+                post(routes::v2_add_intro_to_user),
+            )
+            .route(
+                "/v2/intros/remove/:guild_id/:channel",
+                post(routes::v2_remove_intro_from_user),
+            )
+            .route("/v2/intros/:guild/add", get(routes::v2_add_guild_intro))
+            .route(
+                "/v2/intros/:guild/upload",
+                post(routes::v2_upload_guild_intro),
+            )
+            .route("/health", get(routes::health))
+            .layer(
+                CorsLayer::new()
+                    .allow_origin([origin.parse().unwrap()])
+                    .allow_headers(Any)
+                    .allow_methods([Method::GET, Method::POST, Method::DELETE]),
+            )
+            .with_state(state);
+        let addr = SocketAddr::from(([0, 0, 0, 0], 8100));
+        info!("socket listening on {addr}");
+        axum::Server::bind(&addr)
+            .serve(api.into_make_service())
+            .await
+            .unwrap();
+    });
+}
+
+async fn spawn_bot(db: Arc<tokio::sync::Mutex<db::Database>>) {
     let token = env::var("DISCORD_TOKEN").expect("expected DISCORD_TOKEN env var");
+    let songbird = songbird::Songbird::serenity();
 
-    let settings = serde_json::from_str::<Settings>(
-        &std::fs::read_to_string("config/settings.json").expect("no config/settings.json"),
-    )
-    .expect("error parsing settings file");
-
-    info!("{settings:?}");
+    let (tx, mut rx) = mpsc::channel(10);
 
     let intents = GatewayIntents::GUILDS
         | GatewayIntents::GUILD_MESSAGES
         | GatewayIntents::MESSAGE_CONTENT
         | GatewayIntents::GUILD_VOICE_STATES;
     let mut client = Client::builder(&token, intents)
-        .event_handler(Handler)
-        .register_songbird()
+        .event_handler(Handler {
+            tx: std::sync::Mutex::new(tx.clone()),
+        })
+        .register_songbird_with(songbird.clone())
         .await
         .expect("Error creating client");
 
-    {
-        let mut data = client.data.write().await;
-
-        data.insert::<Settings>(Arc::new(settings));
-    }
-
     info!("Starting bot with token '{token}'");
     tokio::spawn(async move {
         if let Err(err) = client.start().await {
@@ -209,6 +202,147 @@ async fn main() {
         }
     });
 
+    tokio::spawn(async move {
+        while let Some(msg) = rx.recv().await {
+            match msg {
+                HandlerMessage::Ready(ctx) => {
+                    info!("Got Ready message");
+
+                    let songbird = songbird::get(&ctx).await.expect("no songbird instance");
+
+                    let guilds = match db.lock().await.get_guilds() {
+                        Ok(guilds) => guilds,
+                        Err(err) => {
+                            error!(?err, "failed to get guild on bot ready");
+                            continue;
+                        }
+                    };
+
+                    for guild in guilds {
+                        let handler_lock = songbird.get_or_insert(GuildId(guild.id));
+
+                        let mut handler = handler_lock.lock().await;
+
+                        handler.add_global_event(
+                            songbird::Event::Track(songbird::TrackEvent::End),
+                            TrackEventHandler {
+                                tx: tx.clone(),
+                                guild_id: GuildId(guild.id),
+                            },
+                        );
+                    }
+                }
+                HandlerMessage::TrackEnded(guild_id) => {
+                    info!("Got TrackEnded message");
+
+                    if let Some(manager) = songbird.get(guild_id) {
+                        let mut handler = manager.lock().await;
+                        let queue = handler.queue();
+
+                        if queue.is_empty() {
+                            info!("Track Queue is empty, leaving voice channel");
+                            if let Err(err) = handler.leave().await {
+                                error!("Failed to leave channel: {err:?}");
+                            }
+                        }
+                    }
+                }
+
+                HandlerMessage::PlaySound(ctx, member, channel_id) => {
+                    info!("Got PlaySound message");
+
+                    let Some(Channel::Guild(channel)) = channel_id.to_channel_cached(&ctx.cache)
+                    else {
+                        error!("Failed to get cached channel from member!");
+                        continue;
+                    };
+
+                    let intros = match db.lock().await.get_user_channel_intros(
+                        &member.user.name,
+                        channel.guild_id.0,
+                        channel.name(),
+                    ) {
+                        Ok(intros) => intros,
+                        Err(err) => {
+                            error!(
+                                ?err,
+                                "failed to get user channel intros when playing sound through bot"
+                            );
+                            continue;
+                        }
+                    };
+
+                    // TODO: randomly choose a intro to play
+                    let Some(intro) = intros.first() else {
+                        error!("couldn't get user intro, none exist");
+                        continue;
+                    };
+
+                    let source = match songbird::ffmpeg(format!("sounds/{}", &intro.filename)).await
+                    {
+                        Ok(source) => source,
+                        Err(err) => {
+                            error!(
+                                "Error starting file source from {}: {err:?}",
+                                intro.filename
+                            );
+                            continue;
+                        }
+                    };
+
+                    match songbird.join(member.guild_id, channel_id).await {
+                        (handler_lock, Ok(())) => {
+                            let mut handler = handler_lock.lock().await;
+
+                            let _track_handler = handler.enqueue_source(source);
+                            // TODO: set volume
+                        }
+
+                        (_, Err(err)) => {
+                            error!("Failed to join voice channel {}: {err:?}", channel.name());
+                        }
+                    }
+                }
+            }
+        }
+    });
+}
+
+#[tokio::main]
+#[instrument]
+async fn main() -> std::io::Result<()> {
+    dotenv::dotenv().ok();
+
+    tracing_subscriber::fmt::init();
+
+    let settings = serde_json::from_str::<Settings>(
+        &std::fs::read_to_string("config/settings.json").expect("no config/settings.json"),
+    )
+    .expect("error parsing settings file");
+    info!("{settings:?}");
+
+    let (run_api, run_bot) = (settings.run_api, settings.run_bot);
+    let db = Arc::new(tokio::sync::Mutex::new(
+        db::Database::new("./config/db.sqlite").expect("couldn't open sqlite db"),
+    ));
+
+    {
+        // attempt to initialize the database with the schema
+        let db = db.lock().await;
+        db.init().expect("couldn't init db");
+    }
+
+    if run_api {
+        spawn_api(db.clone());
+    }
+    if run_bot {
+        spawn_bot(db).await;
+    }
+
+    info!("spawned background tasks");
+
     let _ = tokio::signal::ctrl_c().await;
     info!("Received Ctrl-C, shuttdown down.");
+
+    Ok(())
 }

src/media.rs

@@ -0,0 +1,20 @@
+use crate::routes::Error;
+
+pub(crate) async fn normalize(src: &str, dest: &str) -> Result<(), Error> {
+    let child = tokio::process::Command::new("ffmpeg")
+        .args(["-i", src])
+        .arg("-vn")
+        .args(["-map", "0:a"])
+        .arg(dest)
+        .spawn()
+        .map_err(|err| Error::Ffmpeg(err.to_string()))?
+        .wait()
+        .await
+        .map_err(|err| Error::Ffmpeg(err.to_string()))?;
+
+    if !child.success() {
+        return Err(Error::FfmpegTerminated);
+    }
+
+    Ok(())
+}

src/page.rs

@@ -0,0 +1,574 @@
+use crate::{
+    auth,
+    db::{self, User},
+    htmx::{Build, HtmxBuilder, Tag},
+    settings::ApiState,
+};
+use axum::{
+    extract::{Path, State},
+    response::{Html, Redirect},
+};
+use iter_tools::Itertools;
+use tracing::error;
+
+fn page_header(title: &str) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Html).head(|b| {
+        b.title(title)
+            .script(
+                "https://unpkg.com/htmx.org@1.9.3",
+                Some("sha384-lVb3Rd/Ca0AxaoZg5sACe8FJKF0tnUgR2Kd7ehUOG5GCcROv5uBIZsOqovBAcWua"),
+            )
+            // Not currently using
+            // .script("https://unpkg.com/hyperscript.org@0.9.9", None)
+            .style_link("https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css")
+    })
+}
+
+pub(crate) async fn home(
+    State(state): State<ApiState>,
+    user: Option<User>,
+) -> Result<Html<String>, Redirect> {
+    if let Some(user) = user {
+        let db = state.db.lock().await;
+
+        let needs_setup = db
+            .get_guilds()
+            .map_err(|err| {
+                error!(?err, "failed to get user guilds");
+                // TODO: change this to returning a error to the client
+                Redirect::to(&format!("{}/error", state.origin))
+            })?
+            .is_empty();
+        let user_guilds = db.get_user_guilds(&user.name).map_err(|err| {
+            error!(?err, "failed to get user guilds");
+            // TODO: change this to returning a error to the client
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+        let user_app_permissions = db.get_user_app_permissions(&user.name).unwrap_or_default();
+        let can_add_guild = user_app_permissions.can(auth::AppPermission::AddGuild);
+
+        let client = reqwest::Client::new();
+        let discord_guilds: Vec<crate::routes::DiscordUserGuild> = if can_add_guild {
+            client
+                .get("https://discord.com/api/v10/users/@me/guilds")
+                .bearer_auth(&user.discord_token)
+                .send()
+                .await
+                .map_err(|err| {
+                    error!(?err, "failed to get guilds");
+                    // TODO: change this to returning a error to the client
+                    Redirect::to(&format!("{}/error", state.origin))
+                })?
+                .json()
+                .await
+                .map_err(|err| {
+                    error!(?err, "failed to parse json");
+                    // TODO: change this to returning a error to the client
+                    Redirect::to(&format!("{}/error", state.origin))
+                })?
+        } else {
+            vec![]
+        }
+        .into_iter()
+        // lol, why does this need to have an explicit type annotation
+        .filter(|discord_guild: &crate::routes::DiscordUserGuild| {
+            !user_guilds
+                .iter()
+                .any(|user_guild| discord_guild.id == user_guild.id)
+        })
+        .collect();
+
+        let guild_list = if needs_setup {
+            HtmxBuilder::new(Tag::Empty).builder(Tag::Div, |b| {
+                b.attribute("class", "container")
+                    .builder_text(Tag::Header2, "Select a Guild to setup")
+                    .push_builder(setup_guild_list(&state.origin, &discord_guilds))
+            })
+        } else {
+            HtmxBuilder::new(Tag::Empty).builder(Tag::Div, |b| {
+                b.attribute("class", "container")
+                    .builder_text(Tag::Header2, "Choose a Guild")
+                    .push_builder(guild_list(&state.origin, user_guilds.iter()))
+            })
+        };
+
+        Ok(Html(
+            page_header("MemeJoin - Home")
+                .builder(Tag::Div, |b| {
+                    let mut b = b.push_builder(guild_list);
+
+                    if !needs_setup && can_add_guild && !discord_guilds.is_empty() {
+                        b = b
+                            .attribute("class", "container")
+                            .builder_text(Tag::Header2, "Add a Guild")
+                            .push_builder(setup_guild_list(&state.origin, &discord_guilds));
+                    }
+
+                    b
+                })
+                .build(),
+        ))
+    } else {
+        Err(Redirect::to(&format!("{}/login", state.origin)))
+    }
+}
+
+fn setup_guild_list(origin: &str, user_guilds: &[crate::routes::DiscordUserGuild]) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Empty).ul(|b| {
+        let mut b = b;
+        for guild in user_guilds {
+            b = b.li(|b| {
+                b.link(
+                    &guild.name,
+                    // TODO: url encode the name
+                    &format!("{}/guild/{}/setup?name={}", origin, guild.id, guild.name),
+                )
+            });
+        }
+
+        b
+    })
+}
+
+fn guild_list<'a>(origin: &str, guilds: impl Iterator<Item = &'a db::Guild>) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Empty).ul(|b| {
+        let mut b = b;
+        for guild in guilds {
+            b = b.li(|b| b.link(&guild.name, &format!("{}/guild/{}", origin, guild.id)));
+        }
+
+        b
+    })
+}
+
+fn intro_list<'a>(
+    intros: impl Iterator<Item = &'a db::Intro>,
+    label: &str,
+    post: &str,
+) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Empty).form(|b| {
+        b.attribute("class", "container")
+            .hx_post(post)
+            .hx_target("closest #channel-intro-selector")
+            .attribute("hx-encoding", "multipart/form-data")
+            .builder(Tag::FieldSet, |b| {
+                let mut b = b
+                    .attribute("class", "container")
+                    .attribute("style", "height: 256px; overflow: auto");
+                for intro in intros {
+                    b = b.builder(Tag::Label, |b| {
+                        b.builder(Tag::Input, |b| {
+                            b.attribute("type", "checkbox")
+                                .attribute("name", &intro.id.to_string())
+                        })
+                        .builder_text(Tag::Paragraph, &intro.name)
+                    });
+                }
+
+                b
+            })
+            .button(|b| b.attribute("type", "submit").text(label))
+    })
+}
+
+pub(crate) async fn guild_dashboard(
+    State(state): State<ApiState>,
+    user: User,
+    Path(guild_id): Path<u64>,
+) -> Result<Html<String>, Redirect> {
+    let (guild_name, guild_intros, guild_channels, all_user_intros, user_permissions) = {
+        let db = state.db.lock().await;
+
+        let guild_name = db.get_guild(guild_id).map_err(|err| {
+            error!(?err, %guild_id, "couldn't get guild");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+
+        let guild_intros = db.get_guild_intros(guild_id).map_err(|err| {
+            error!(?err, %guild_id, "couldn't get guild intros");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+        let guild_channels = db.get_guild_channels(guild_id).map_err(|err| {
+            error!(?err, %guild_id, "couldn't get guild channels");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+        let all_user_intros = db.get_all_user_intros(guild_id).map_err(|err| {
+            error!(?err, %guild_id, "couldn't get user intros");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+        let user_permissions = db
+            .get_user_permissions(&user.name, guild_id)
+            .unwrap_or_default();
+
+        (
+            guild_name,
+            guild_intros,
+            guild_channels,
+            all_user_intros,
+            user_permissions,
+        )
+    };
+
+    let can_upload = user_permissions.can(auth::Permission::UploadSounds);
+    let can_add_channel = user_permissions.can(auth::Permission::AddChannel);
+    let is_moderator = user_permissions.can(auth::Permission::Moderator);
+    let mod_dashboard =
+        moderator_dashboard(&state, &state.secrets.bot_token, guild_id, user_permissions).await;
+
+    let user_intros = all_user_intros
+        .iter()
+        .filter(|intro| intro.username == user.name)
+        .group_by(|intro| &intro.channel_name);
+
+    Ok(Html(
+        HtmxBuilder::new(Tag::Html)
+            .push_builder(page_header("MemeJoin - Dashboard"))
+            .builder(Tag::Nav, |b| {
+                b.builder(Tag::HeaderGroup, |b| {
+                    b.attribute("class", "container")
+                        .builder(Tag::Header1, |b| b.text("MemeJoin - A bot for user intros"))
+                        .builder_text(Tag::Header6, &format!("{} - {}", user.name, guild_name))
+                })
+            })
+            .builder(Tag::Empty, |b| {
+                let mut b = if is_moderator || can_add_channel {
+                    b.builder(Tag::Div, |b| {
+                        b.attribute("class", "container")
+                            .builder(Tag::Article, |b| {
+                                b.builder_text(Tag::Header, "Server Settings")
+                                    .push_builder(mod_dashboard)
+                            })
+                    })
+                } else {
+                    b
+                };
+                b = if can_upload {
+                    b.builder(Tag::Div, |b| {
+                        b.attribute("class", "container")
+                            .builder(Tag::Article, |b| {
+                                b.builder_text(Tag::Header, "Upload New Intro")
+                                    .push_builder(upload_form(&state.origin, guild_id))
+                            })
+                    })
+                    .builder(Tag::Div, |b| {
+                        b.attribute("class", "container")
+                            .builder(Tag::Article, |b| {
+                                b.builder_text(Tag::Header, "Upload New Intro from Url")
+                                    .push_builder(ytdl_form(&state.origin, guild_id))
+                            })
+                    })
+                } else {
+                    b
+                };
+
+                b.builder(Tag::Div, |b| {
+                    b.attribute("class", "container")
+                        .builder(Tag::Article, |b| {
+                            let mut b = b.builder_text(Tag::Header, "Guild Intros");
+
+                            let mut user_intros = user_intros.into_iter().peekable();
+
+                            for guild_channel_name in &guild_channels {
+                                // Get user intros for this channel
+                                let intros = user_intros
+                                    .peeking_take_while(|(channel_name, _)| {
+                                        channel_name == &guild_channel_name
+                                    })
+                                    .map(|(_, intros)| intros.map(|intro| &intro.intro))
+                                    .flatten();
+
+                                b = b.builder(Tag::Details, |b| {
+                                    let mut b = b;
+                                    if guild_channels.len() < 2 {
+                                        b = b.attribute("open", "");
+                                    }
+                                    b.builder_text(Tag::Summary, guild_channel_name).builder(
+                                        Tag::Div,
+                                        |b| {
+                                            b.attribute("id", "channel-intro-selector")
+                                                .attribute("style", "display: flex; align-items: flex-end; max-height: 50%; overflow: hidden;")
+                                                .push_builder(channel_intro_selector(
+                                                    &state.origin,
+                                                    guild_id,
+                                                    guild_channel_name,
+                                                    intros,
+                                                    guild_intros.iter(),
+                                                ))
+                                        },
+                                    )
+                                });
+                            }
+
+                            b
+                        })
+                })
+            })
+            .build(),
+    ))
+}
+
+pub fn channel_intro_selector<'a>(
+    origin: &str,
+    guild_id: u64,
+    channel_name: &String,
+    intros: impl Iterator<Item = &'a db::Intro>,
+    guild_intros: impl Iterator<Item = &'a db::Intro>,
+) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Empty)
+        .builder(Tag::Div, |b| {
+            b.attribute("style", "display: flex; flex-direction: column; justify-content: space-between; align-items: center; width: 100%; height: 100%; padding: 16px;")
+                .builder_text(Tag::Strong, "Your Current Intros")
+                .push_builder(intro_list(
+                    intros,
+                    "Remove Intro",
+                    &format!("{}/v2/intros/remove/{}/{}", origin, guild_id, &channel_name),
+                ))
+        })
+        .builder(Tag::Div, |b| {
+            b.attribute("style", "display: flex; flex-direction: column; justify-content: space-between; align-items: center; width: 100%; height: 100%; padding: 16px;")
+            .builder_text(Tag::Strong, "Select Intros")
+                .push_builder(intro_list(
+                    guild_intros,
+                    "Add Intro",
+                    &format!("{}/v2/intros/add/{}/{}", origin, guild_id, channel_name),
+                ))
+        })
+}
+
+fn upload_form(origin: &str, guild_id: u64) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Empty).form(|b| {
+        b.attribute("class", "container")
+            .hx_post(&format!("{}/v2/intros/{}/upload", origin, guild_id))
+            .attribute("hx-encoding", "multipart/form-data")
+            .builder(Tag::FieldSet, |b| {
+                b.attribute("class", "container")
+                    .attribute("role", "group")
+                    .input(|b| b.attribute("type", "file").attribute("name", "file"))
+                    .input(|b| {
+                        b.attribute("name", "name")
+                            .attribute("placeholder", "enter intro title")
+                    })
+                    .button(|b| b.attribute("type", "submit").text("Upload"))
+            })
+    })
+}
+
+fn ytdl_form(origin: &str, guild_id: u64) -> HtmxBuilder {
+    HtmxBuilder::new(Tag::Empty).form(|b| {
+        b.attribute("class", "container")
+            .hx_get(&format!("{}/v2/intros/{}/add", origin, guild_id))
+            .builder(Tag::FieldSet, |b| {
+                b.attribute("class", "container")
+                    .attribute("role", "group")
+                    .input(|b| {
+                        b.attribute("placeholder", "enter video url")
+                            .attribute("name", "url")
+                    })
+                    .input(|b| {
+                        b.attribute("placeholder", "enter intro title")
+                            .attribute("name", "name")
+                    })
+                    .button(|b| b.attribute("type", "submit").text("Upload"))
+            })
+    })
+}
+
+async fn moderator_dashboard(
+    state: &ApiState,
+    bot_token: &str,
+    guild_id: u64,
+    user_permissions: auth::Permissions,
+) -> HtmxBuilder {
+    let permissions_editor = permissions_editor(state, guild_id).await;
+    let channel_editor = channel_editor(state, bot_token, guild_id).await;
+
+    let mut b = HtmxBuilder::new(Tag::Empty);
+
+    if user_permissions.can(auth::Permission::Moderator) {
+        b = b.push_builder(permissions_editor);
+    }
+    if user_permissions.can(auth::Permission::AddChannel) {
+        b = b.push_builder(channel_editor);
+    }
+
+    b
+}
+
+async fn channel_editor(state: &ApiState, bot_token: &str, guild_id: u64) -> HtmxBuilder {
+    let db = state.db.lock().await;
+    let added_guild_channels = db.get_guild_channels(guild_id).unwrap_or_default();
+
+    let mut got_channels = true;
+    let client = reqwest::Client::new();
+    let channels: Vec<String> = {
+        match client
+            .get(format!(
+                "https://discord.com/api/v10/guilds/{}/channels",
+                guild_id
+            ))
+            .header("Authorization", format!("Bot {}", bot_token))
+            .send()
+            .await
+        {
+            Ok(resp) => match resp.json::<Vec<crate::routes::DiscordChannel>>().await {
+                Ok(channels) => channels
+                    .into_iter()
+                    .filter(|channel| channel.ty == crate::routes::ChannelType::GuildVoice as u32)
+                    .filter_map(|channel| channel.name)
+                    .filter(|name| !added_guild_channels.contains(name))
+                    .collect(),
+                Err(err) => {
+                    error!(?err, "failed to parse json");
+                    got_channels = false;
+
+                    vec![]
+                }
+            },
+            Err(err) => {
+                error!(?err, "failed to get channels");
+                got_channels = false;
+
+                vec![]
+            }
+        }
+    };
+
+    if got_channels && !channels.is_empty() {
+        HtmxBuilder::new(Tag::Details)
+            .builder_text(Tag::Summary, "Add Channels")
+            .form(|b| {
+                b.attribute("class", "container")
+                    .hx_post(&format!("{}/guild/{}/add_channel", state.origin, guild_id))
+                    .attribute("hx-encoding", "multipart/form-data")
+                    .builder(Tag::FieldSet, |b| {
+                        let mut b = b
+                            .attribute("class", "container")
+                            .attribute("style", "max-height: 50%; overflow-y: scroll");
+                        for channel_name in channels {
+                            b = b.builder(Tag::Label, |b| {
+                                b.builder(Tag::Input, |b| {
+                                    b.attribute("type", "checkbox")
+                                        .attribute("name", &channel_name.to_string())
+                                })
+                                .builder_text(Tag::Paragraph, &channel_name)
+                            });
+                        }
+
+                        b
+                    })
+                    .button(|b| b.attribute("type", "submit").text("Add Channel"))
+            })
+    } else if channels.is_empty() {
+        HtmxBuilder::new(Tag::Empty)
+    } else {
+        HtmxBuilder::new(Tag::Empty).text("Failed to get channels")
+    }
+}
+
+async fn permissions_editor(state: &ApiState, guild_id: u64) -> HtmxBuilder {
+    let db = state.db.lock().await;
+    let user_permissions = db.get_all_user_permissions(guild_id).unwrap_or_default();
+
+    HtmxBuilder::new(Tag::Details)
+        .builder_text(Tag::Summary, "Permissions")
+        .form(|b| {
+            b.hx_post(&format!(
+                "{}/guild/{}/permissions/update",
+                state.origin, guild_id
+            ))
+            .attribute("hx-encoding", "multipart/form-data")
+            .builder(Tag::Table, |b| {
+                let mut b = b.attribute("role", "grid").builder(Tag::TableHead, |b| {
+                    let mut b = b.builder_text(Tag::TableHeader, "User");
+
+                    for perm in enum_iterator::all::<auth::Permission>() {
+                        if perm == auth::Permission::Moderator || perm == auth::Permission::None {
+                            continue;
+                        }
+
+                        b = b.builder_text(Tag::TableHeader, &perm.to_string());
+                    }
+
+                    b
+                });
+
+                for permission in user_permissions {
+                    b = b.builder(Tag::TableRow, |b| {
+                        let mut b = b.builder_text(Tag::TableData, permission.0.as_str());
+
+                        for perm in enum_iterator::all::<auth::Permission>() {
+                            if perm == auth::Permission::Moderator || perm == auth::Permission::None
+                            {
+                                continue;
+                            }
+
+                            b = b.builder(Tag::TableData, |b| {
+                                b.builder(Tag::Input, |b| {
+                                    let mut b = b
+                                        .attribute("type", "checkbox")
+                                        .attribute("name", &format!("{}#{}", permission.0, perm));
+
+                                    if permission.1.can(auth::Permission::Moderator) {
+                                        b = b.flag("disabled");
+                                    }
+
+                                    if permission.1.can(perm) {
+                                        return b.flag("checked");
+                                    }
+
+                                    b
+                                })
+                            });
+                        }
+
+                        b
+                    });
+                }
+
+                b
+            })
+            .button(|b| b.attribute("type", "submit").text("Update Permissions"))
+        })
+}
+
+pub(crate) async fn login(
+    State(state): State<ApiState>,
+    user: Option<User>,
+) -> Result<Html<String>, Redirect> {
+    if user.is_some() {
+        Err(Redirect::to(&format!("{}/", state.origin)))
+    } else {
+        let authorize_uri = format!("https://discord.com/api/oauth2/authorize?client_id={}&redirect_uri={}/v2/auth&response_type=code&scope=guilds.members.read+guilds+identify", state.secrets.client_id, state.origin);
+
+        Ok(Html(
+            HtmxBuilder::new(Tag::Html)
+                .push_builder(page_header("MemeJoin - Dashboard"))
+                .builder(Tag::Nav, |b| {
+                    b.builder(Tag::HeaderGroup, |b| {
+                        b.attribute("class", "container")
+                            .builder(Tag::Header1, |b| b.text("MemeJoin - A bot for user intros"))
+                            .builder_text(Tag::Header6, "salad")
+                    })
+                })
+                .builder(Tag::Main, |b| {
+                    b.attribute("class", "container").builder(Tag::Anchor, |b| {
+                        b.attribute("role", "button")
+                            .text("Login with Discord")
+                            .attribute("href", &authorize_uri)
+                    })
+                })
+                .build(),
+        ))
+    }
+
+    //Html(
+    //    HtmxBuilder::new(Tag::Html)
+    //        .push_builder(page_header("MemeJoin - Login"))
+    //        .link("Login", &authorize_uri)
+    //        .build(),
+    //)
+}

src/routes.rs

@@ -0,0 +1,609 @@
+use std::collections::HashMap;
+
+use axum::{
+    extract::{Multipart, Path, Query, State},
+    http::{HeaderMap, HeaderValue},
+    response::{Html, IntoResponse, Redirect},
+};
+
+use axum_extra::extract::{cookie::Cookie, CookieJar};
+use chrono::{Duration, Utc};
+use reqwest::{StatusCode, Url};
+use serde::{Deserialize, Deserializer};
+use std::str::FromStr;
+use tracing::{error, info};
+use uuid::Uuid;
+
+use crate::{
+    auth::{self},
+    db,
+    htmx::Build,
+    page,
+};
+use crate::{media, settings::ApiState};
+
+pub(crate) async fn health() -> &'static str {
+    "Hello!"
+}
+
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum Error {
+    #[error("{0}")]
+    Auth(String),
+    #[error("{0}")]
+    GetUser(#[from] reqwest::Error),
+
+    #[error("Guild doesn't exist")]
+    NoGuildFound,
+    #[error("invalid request")]
+    InvalidRequest,
+
+    #[error("Invalid permissions for request")]
+    InvalidPermission,
+    #[error("{0}")]
+    Ytdl(#[from] std::io::Error),
+    #[error("{0}")]
+    Ffmpeg(String),
+
+    #[error("ytdl terminated unsuccessfully")]
+    YtdlTerminated,
+    #[error("ffmpeg terminated unsuccessfully")]
+    FfmpegTerminated,
+
+    #[error("database error: {0}")]
+    Database(#[from] rusqlite::Error),
+}
+
+impl IntoResponse for Error {
+    fn into_response(self) -> axum::response::Response {
+        error!("{self}");
+
+        match self {
+            Self::Auth(msg) => (StatusCode::INTERNAL_SERVER_ERROR, msg).into_response(),
+            Self::GetUser(error) => (StatusCode::UNAUTHORIZED, error.to_string()).into_response(),
+
+            Self::NoGuildFound => (StatusCode::NOT_FOUND, self.to_string()).into_response(),
+            Self::InvalidRequest => (StatusCode::BAD_REQUEST, self.to_string()).into_response(),
+
+            Self::InvalidPermission => (StatusCode::UNAUTHORIZED, self.to_string()).into_response(),
+            Self::Ytdl(error) => {
+                (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()).into_response()
+            }
+            Self::Ffmpeg(error) => (StatusCode::INTERNAL_SERVER_ERROR, error).into_response(),
+            Self::YtdlTerminated | Self::FfmpegTerminated => {
+                (StatusCode::INTERNAL_SERVER_ERROR, self.to_string()).into_response()
+            }
+
+            Self::Database(error) => {
+                (StatusCode::INTERNAL_SERVER_ERROR, error.to_string()).into_response()
+            }
+        }
+    }
+}
+
+#[derive(Deserialize)]
+struct DiscordUser {
+    pub username: String,
+}
+
+#[derive(Deserialize)]
+pub(crate) struct DiscordUserGuild {
+    #[serde(deserialize_with = "serde_string_as_u64")]
+    pub id: u64,
+    pub name: String,
+    pub owner: bool,
+}
+
+#[derive(Deserialize)]
+pub(crate) struct DiscordChannel {
+    pub name: Option<String>,
+    #[serde(rename = "type")]
+    pub ty: u32,
+}
+
+#[derive(Deserialize, PartialEq, Eq)]
+#[repr(u32)]
+pub(crate) enum ChannelType {
+    GuildText = 0,
+    GuildVoice = 2,
+}
+
+fn serde_string_as_u64<'de, D>(deserializer: D) -> Result<u64, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let value = <&str as Deserialize>::deserialize(deserializer)?;
+
+    value
+        .parse::<u64>()
+        .map_err(|_| serde::de::Error::invalid_value(serde::de::Unexpected::Str(value), &"u64"))
+}
+
+pub(crate) async fn v2_auth(
+    State(state): State<ApiState>,
+    Query(params): Query<HashMap<String, String>>,
+    jar: CookieJar,
+) -> Result<(CookieJar, Redirect), Error> {
+    let Some(code) = params.get("code") else {
+        return Err(Error::Auth("no code".to_string()));
+    };
+
+    info!("attempting to get access token with code {}", code);
+
+    let mut data = HashMap::new();
+
+    let redirect_uri = format!("{}/v2/auth", state.origin);
+    data.insert("client_id", state.secrets.client_id.as_str());
+    data.insert("client_secret", state.secrets.client_secret.as_str());
+    data.insert("grant_type", "authorization_code");
+    data.insert("code", code);
+    data.insert("redirect_uri", &redirect_uri);
+
+    let client = reqwest::Client::new();
+
+    let auth: auth::Discord = client
+        .post("https://discord.com/api/oauth2/token")
+        .form(&data)
+        .send()
+        .await
+        .map_err(|err| Error::Auth(err.to_string()))?
+        .json()
+        .await
+        .map_err(|err| {
+            error!(?err, "auth error");
+            Error::Auth(err.to_string())
+        })?;
+
+    // Get authorized username
+    let user: DiscordUser = client
+        .get("https://discord.com/api/v10/users/@me")
+        .bearer_auth(&auth.access_token)
+        .send()
+        .await?
+        .json()
+        .await?;
+
+    // TODO: get bot's guilds so we only save users who are able to use the bot
+    let discord_guilds: Vec<DiscordUserGuild> = client
+        .get("https://discord.com/api/v10/users/@me/guilds")
+        .bearer_auth(&auth.access_token)
+        .send()
+        .await?
+        .json()
+        .await
+        .map_err(|err| Error::Auth(err.to_string()))?;
+
+    let db = state.db.lock().await;
+    let needs_setup = db.get_user_count().map_err(Error::Database)? == 0;
+    let token = if let Some(user) = db
+        .get_user(&user.username)
+        .map_err(Error::Database)?
+        .filter(|user| user.api_key_expires_at >= Utc::now().naive_utc())
+    {
+        user.api_key
+    } else {
+        Uuid::new_v4().to_string()
+    };
+
+    if needs_setup {
+        let now = Utc::now().naive_utc();
+        db.insert_user(
+            &user.username,
+            &token,
+            now + Duration::weeks(4),
+            &auth.access_token,
+            now + Duration::seconds(auth.expires_in as i64),
+        )
+        .map_err(Error::Database)?;
+
+        db.insert_user_app_permission(
+            &user.username,
+            auth::AppPermissions(auth::AppPermission::all()),
+        )
+        .map_err(Error::Database)?;
+    }
+
+    let guilds = db.get_guilds().map_err(Error::Database)?;
+    let mut in_a_guild = false;
+    for guild in guilds {
+        let Some(discord_guild) = discord_guilds
+            .iter()
+            .find(|discord_guild| discord_guild.id == guild.id)
+            else {
+                continue;
+            };
+
+        in_a_guild = true;
+
+        if !needs_setup {
+            let now = Utc::now().naive_utc();
+            db.insert_user(
+                &user.username,
+                &token,
+                now + Duration::weeks(4),
+                &auth.access_token,
+                now + Duration::seconds(auth.expires_in as i64),
+            )
+            .map_err(Error::Database)?;
+        }
+
+        db.insert_user_guild(&user.username, guild.id)
+            .map_err(Error::Database)?;
+
+        if db.get_user_permissions(&user.username, guild.id).is_err() {
+            db.insert_user_permission(
+                &user.username,
+                guild.id,
+                if discord_guild.owner {
+                    auth::Permissions(auth::Permission::all())
+                } else {
+                    Default::default()
+                },
+            )
+            .map_err(Error::Database)?;
+        }
+    }
+    if !in_a_guild {
+        return Err(Error::NoGuildFound);
+    }
+
+    // TODO: add permissions based on roles
+
+    let uri = Url::parse(&state.origin).expect("should be a valid url");
+
+    let mut cookie = Cookie::new("access_token", token);
+    cookie.set_path(uri.path().to_string());
+    cookie.set_secure(true);
+
+    Ok((jar.add(cookie), Redirect::to(&format!("{}/", state.origin))))
+}
+
+pub(crate) async fn v2_add_intro_to_user(
+    State(state): State<ApiState>,
+    Path((guild_id, channel)): Path<(u64, String)>,
+    user: db::User,
+    mut form_data: Multipart,
+) -> Result<Html<String>, Redirect> {
+    let db = state.db.lock().await;
+
+    while let Ok(Some(field)) = form_data.next_field().await {
+        let Some(intro_id) = field.name() else {
+            continue;
+        };
+
+        let intro_id = intro_id.parse::<i32>().map_err(|err| {
+            error!(?err, "invalid intro id");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+
+        db.insert_user_intro(&user.name, guild_id, &channel, intro_id)
+            .map_err(|err| {
+                error!(?err, "failed to add user intro");
+                // TODO: change to actual error
+                Redirect::to(&format!("{}/login", state.origin))
+            })?;
+    }
+
+    let guild_intros = db.get_guild_intros(guild_id).map_err(|err| {
+        error!(?err, %guild_id, "couldn't get guild intros");
+        // TODO: change to actual error
+        Redirect::to(&format!("{}/login", state.origin))
+    })?;
+
+    let intros = db
+        .get_user_channel_intros(&user.name, guild_id, &channel)
+        .map_err(|err| {
+            error!(?err, user = %user.name, %guild_id, "couldn't get user intros");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+
+    Ok(Html(
+        page::channel_intro_selector(
+            &state.origin,
+            guild_id,
+            &channel,
+            intros.iter(),
+            guild_intros.iter(),
+        )
+        .build(),
+    ))
+}
+
+pub(crate) async fn v2_remove_intro_from_user(
+    State(state): State<ApiState>,
+    Path((guild_id, channel)): Path<(u64, String)>,
+    user: db::User,
+    mut form_data: Multipart,
+) -> Result<Html<String>, Redirect> {
+    let db = state.db.lock().await;
+
+    while let Ok(Some(field)) = form_data.next_field().await {
+        let Some(intro_id) = field.name() else {
+            continue;
+        };
+
+        let intro_id = intro_id.parse::<i32>().map_err(|err| {
+            error!(?err, "invalid intro id");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+
+        db.delete_user_intro(&user.name, guild_id, &channel, intro_id)
+            .map_err(|err| {
+                error!(?err, "failed to remove user intro");
+                // TODO: change to actual error
+                Redirect::to(&format!("{}/login", state.origin))
+            })?;
+    }
+
+    let guild_intros = db.get_guild_intros(guild_id).map_err(|err| {
+        error!(?err, %guild_id, "couldn't get guild intros");
+        // TODO: change to actual error
+        Redirect::to(&format!("{}/login", state.origin))
+    })?;
+
+    let intros = db
+        .get_user_channel_intros(&user.name, guild_id, &channel)
+        .map_err(|err| {
+            error!(?err, user = %user.name, %guild_id, "couldn't get user intros");
+            // TODO: change to actual error
+            Redirect::to(&format!("{}/login", state.origin))
+        })?;
+
+    Ok(Html(
+        page::channel_intro_selector(
+            &state.origin,
+            guild_id,
+            &channel,
+            intros.iter(),
+            guild_intros.iter(),
+        )
+        .build(),
+    ))
+}
+
+pub(crate) async fn v2_upload_guild_intro(
+    State(state): State<ApiState>,
+    Path(guild_id): Path<u64>,
+    user: db::User,
+    mut form_data: Multipart,
+) -> Result<HeaderMap, Error> {
+    let db = state.db.lock().await;
+    let mut name = None;
+    let mut file = None;
+
+    if !db
+        .get_guilds()
+        .map_err(Error::Database)?
+        .into_iter()
+        .any(|guild| guild.id == guild_id)
+    {
+        return Err(Error::NoGuildFound);
+    }
+
+    let user_permissions = db
+        .get_user_permissions(&user.name, guild_id)
+        .map_err(Error::Database)?;
+
+    if !user_permissions.can(auth::Permission::UploadSounds) {
+        return Err(Error::InvalidPermission);
+    }
+
+    while let Ok(Some(field)) = form_data.next_field().await {
+        let Some(field_name) = field.name() else {
+            continue;
+        };
+
+        if field_name.eq_ignore_ascii_case("name") {
+            name = Some(field.text().await.map_err(|_| Error::InvalidRequest)?);
+            continue;
+        }
+
+        if field_name.eq_ignore_ascii_case("file") {
+            file = Some(field.bytes().await.map_err(|_| Error::InvalidRequest)?);
+            continue;
+        }
+    }
+
+    let Some(name) = name else {
+        return Err(Error::InvalidRequest);
+    };
+    let Some(file) = file else {
+        return Err(Error::InvalidRequest);
+    };
+
+    let uuid = Uuid::new_v4().to_string();
+    let temp_path = format!("./sounds/temp/{uuid}");
+    let dest_path = format!("./sounds/{uuid}.mp3");
+
+    // Write original file so its ready for codec conversion
+    std::fs::write(&temp_path, file)?;
+    media::normalize(&temp_path, &dest_path).await?;
+    std::fs::remove_file(&temp_path)?;
+
+    db.insert_intro(&name, 0, guild_id, &format!("{uuid}.mp3"))
+        .map_err(Error::Database)?;
+
+    let mut headers = HeaderMap::new();
+    headers.insert("HX-Refresh", HeaderValue::from_static("true"));
+
+    Ok(headers)
+}
+
+pub(crate) async fn v2_add_guild_intro(
+    State(state): State<ApiState>,
+    Path(guild_id): Path<u64>,
+    Query(mut params): Query<HashMap<String, String>>,
+    user: db::User,
+) -> Result<HeaderMap, Error> {
+    let db = state.db.lock().await;
+    let Some(url) = params.remove("url") else {
+        return Err(Error::InvalidRequest);
+    };
+    let Some(name) = params.remove("name") else {
+        return Err(Error::InvalidRequest);
+    };
+
+    if !db
+        .get_guilds()
+        .map_err(Error::Database)?
+        .into_iter()
+        .any(|guild| guild.id == guild_id)
+    {
+        return Err(Error::NoGuildFound);
+    }
+
+    let user_permissions = db
+        .get_user_permissions(&user.name, guild_id)
+        .map_err(Error::Database)?;
+
+    if !user_permissions.can(auth::Permission::UploadSounds) {
+        return Err(Error::InvalidPermission);
+    }
+
+    let uuid = Uuid::new_v4().to_string();
+    let child = tokio::process::Command::new("yt-dlp")
+        .arg(&url)
+        .args(["-o", &format!("sounds/{uuid}")])
+        .args(["-x", "--audio-format", "mp3"])
+        .spawn()
+        .map_err(Error::Ytdl)?
+        .wait()
+        .await
+        .map_err(Error::Ytdl)?;
+
+    if !child.success() {
+        return Err(Error::YtdlTerminated);
+    }
+
+    db.insert_intro(&name, 0, guild_id, &format!("{uuid}.mp3"))
+        .map_err(Error::Database)?;
+
+    let mut headers = HeaderMap::new();
+    headers.insert("HX-Refresh", HeaderValue::from_static("true"));
+
+    Ok(headers)
+}
+
+#[derive(Debug, Deserialize)]
+pub(crate) struct GuildSetupParams {
+    name: String,
+}
+
+pub(crate) async fn guild_setup(
+    State(state): State<ApiState>,
+    user: db::User,
+    Path(guild_id): Path<u64>,
+    Query(GuildSetupParams { name }): Query<GuildSetupParams>,
+) -> Result<Redirect, Error> {
+    let db = state.db.lock().await;
+
+    let user_permissions = db.get_user_app_permissions(&user.name).unwrap_or_default();
+    if !user_permissions.can(auth::AppPermission::AddGuild) {
+        return Err(Error::InvalidPermission);
+    }
+
+    db.insert_guild(&guild_id, &name, 0)?;
+    db.insert_user_guild(&user.name, guild_id)?;
+    db.insert_user_permission(
+        &user.name,
+        guild_id,
+        auth::Permissions(auth::Permission::all()),
+    )?;
+
+    Ok(Redirect::to(&format!(
+        "{}/guild/{}",
+        state.origin, guild_id
+    )))
+}
+
+pub(crate) async fn guild_add_channel(
+    State(state): State<ApiState>,
+    user: db::User,
+    Path(guild_id): Path<u64>,
+    mut form_data: Multipart,
+) -> Result<HeaderMap, Error> {
+    let db = state.db.lock().await;
+
+    let user_permissions = db
+        .get_user_permissions(&user.name, guild_id)
+        .unwrap_or_default();
+    if !user_permissions.can(auth::Permission::AddChannel) {
+        return Err(Error::InvalidPermission);
+    }
+
+    while let Ok(Some(field)) = form_data.next_field().await {
+        let Some(channel_name) = field.name() else {
+            continue;
+        };
+
+        db.insert_guild_channel(&guild_id, channel_name)?;
+    }
+
+    let mut headers = HeaderMap::new();
+    headers.insert("HX-Refresh", HeaderValue::from_static("true"));
+
+    Ok(headers)
+}
+
+pub(crate) async fn update_guild_permissions(
+    State(state): State<ApiState>,
+    Path(guild_id): Path<u64>,
+    user: db::User,
+    mut form_data: Multipart,
+) -> Result<HeaderMap, Error> {
+    let db = state.db.lock().await;
+
+    let this_user_permissions = db
+        .get_user_permissions(&user.name, guild_id)
+        .unwrap_or_default();
+
+    if !this_user_permissions.can(auth::Permission::Moderator) {
+        return Err(Error::InvalidPermission);
+    }
+
+    let mut users_to_update: HashMap<String, auth::Permissions> = db
+        .get_guild_users(guild_id)?
+        .into_iter()
+        .map(|user| (user, Default::default()))
+        .collect();
+
+    while let Ok(Some(field)) = form_data.next_field().await {
+        let Some(field_name) = field.name() else {
+            continue;
+        };
+
+        if let Some((username, permission)) = field_name.split_once('#') {
+            let permission = auth::Permission::from_str(permission)?;
+
+            let username = username.to_string();
+            if field.text().await.map_err(|_| Error::InvalidRequest)? == "on" {
+                users_to_update
+                    .entry(username)
+                    .and_modify(|value| {
+                        value.add(permission);
+                    })
+                    .or_insert_with(|| {
+                        let mut perm = auth::Permissions::default();
+                        perm.add(permission);
+                        perm
+                    });
+            }
+        }
+    }
+
+    for (user, permissions) in users_to_update {
+        let user_permissions = db.get_user_permissions(&user, guild_id).unwrap_or_default();
+
+        if !user_permissions.can(auth::Permission::Moderator) {
+            db.insert_user_permission(&user, guild_id, permissions)?;
+        }
+    }
+
+    let mut headers = HeaderMap::new();
+    headers.insert("HX-Refresh", HeaderValue::from_static("true"));
+
+    Ok(headers)
+}

src/settings.rs

@@ -0,0 +1,64 @@
+use std::sync::Arc;
+
+use crate::{
+    auth,
+    db::{self, Database},
+};
+use axum::{async_trait, extract::FromRequestParts, http::request::Parts, response::Redirect};
+use axum_extra::extract::CookieJar;
+use chrono::Utc;
+use serde::{Deserialize, Serialize};
+use serenity::prelude::TypeMapKey;
+use tracing::error;
+
+// TODO: make this is wrapped type so cloning isn't happening
+#[derive(Clone)]
+pub(crate) struct ApiState {
+    pub db: Arc<tokio::sync::Mutex<Database>>,
+    pub secrets: auth::DiscordSecret,
+    pub origin: String,
+}
+
+#[async_trait]
+impl FromRequestParts<ApiState> for db::User {
+    type Rejection = Redirect;
+
+    async fn from_request_parts(
+        Parts { headers, .. }: &mut Parts,
+        state: &ApiState,
+    ) -> Result<Self, Self::Rejection> {
+        let jar = CookieJar::from_headers(headers);
+
+        if let Some(token) = jar.get("access_token") {
+            match state.db.lock().await.get_user_from_api_key(token.value()) {
+                Ok(user) => {
+                    let now = Utc::now().naive_utc();
+                    if user.api_key_expires_at < now || user.discord_token_expires_at < now {
+                        Err(Redirect::to(&format!("{}/login", state.origin)))
+                    } else {
+                        Ok(user)
+                    }
+                }
+                Err(err) => {
+                    error!(?err, "failed to authenticate user");
+
+                    Err(Redirect::to(&format!("{}/login", state.origin)))
+                }
+            }
+        } else {
+            Err(Redirect::to(&format!("{}/login", state.origin)))
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub(crate) struct Settings {
+    #[serde(default)]
+    pub(crate) run_api: bool,
+    #[serde(default)]
+    pub(crate) run_bot: bool,
+}
+impl TypeMapKey for Settings {
+    type Value = Arc<Settings>;
+}