diff --git a/web/adapters.go b/web/adapters.go
new file mode 100644
index 0000000000000000000000000000000000000000..484c08f7823146ae34777d870bc8fceb9f81d2e4
--- /dev/null
+++ b/web/adapters.go
@@ -0,0 +1,107 @@
+package web
+
+import (
+ "context"
+
+ "git.sr.ht/~sircmpwn/core-go/auth"
+
+ "go.bigb.es/sourcehut-dolt/authn"
+ "go.bigb.es/sourcehut-dolt/browse"
+ "go.bigb.es/sourcehut-dolt/core"
+ "go.bigb.es/sourcehut-dolt/db"
+)
+
+// This file holds the production adapters that satisfy the small interfaces in
+// deps.go over the real db, browse and core-go layers. Tests do not use these;
+// they inject their own fakes. Each adapter is a zero-value struct with a
+// compile-time interface assertion so a signature drift in a committed package
+// breaks the build here rather than at Phase-3 wiring time.
+
+// DBAdapter satisfies RepoStore over the request-scoped db.Store. It holds no
+// connection: every method builds a Store from the *sql.DB the core-go database
+// middleware installed in ctx (db.FromContext), so one value serves all
+// requests and leaks nothing.
+type DBAdapter struct{}
+
+var _ RepoStore = DBAdapter{}
+
+func (DBAdapter) CreateRepo(ctx context.Context, r *core.Repo) (*core.Repo, error) {
+ return db.FromContext(ctx).CreateRepo(ctx, r)
+}
+
+func (DBAdapter) GetRepoByOwnerAndName(ctx context.Context, owner, name string) (*core.Repo, error) {
+ return db.FromContext(ctx).GetRepoByOwnerAndName(ctx, owner, name)
+}
+
+func (DBAdapter) ListReposByOwner(ctx context.Context, owner string, viewer *core.Caller) ([]*core.Repo, error) {
+ return db.FromContext(ctx).ListReposByOwner(ctx, owner, viewer)
+}
+
+func (DBAdapter) ListReposForDashboard(ctx context.Context, userID int) ([]*core.Repo, error) {
+ return db.FromContext(ctx).ListReposForDashboard(ctx, userID)
+}
+
+func (DBAdapter) UpdateRepo(ctx context.Context, id int, description string, visibility core.Visibility) error {
+ return db.FromContext(ctx).UpdateRepo(ctx, id, description, visibility)
+}
+
+func (DBAdapter) DeleteRepo(ctx context.Context, id int) error {
+ return db.FromContext(ctx).DeleteRepo(ctx, id)
+}
+
+func (DBAdapter) EffectiveAccess(ctx context.Context, userID, repoID int) (*core.AccessMode, error) {
+ return db.FromContext(ctx).EffectiveAccess(ctx, userID, repoID)
+}
+
+func (DBAdapter) ListACL(ctx context.Context, repoID int) ([]*db.ACLEntry, error) {
+ return db.FromContext(ctx).ListACL(ctx, repoID)
+}
+
+func (DBAdapter) UpsertACL(ctx context.Context, repoID, userID int, mode core.AccessMode) error {
+ return db.FromContext(ctx).UpsertACL(ctx, repoID, userID, mode)
+}
+
+func (DBAdapter) DeleteACL(ctx context.Context, repoID, userID int) error {
+ return db.FromContext(ctx).DeleteACL(ctx, repoID, userID)
+}
+
+func (DBAdapter) InsertKey(ctx context.Context, userID int, kid string, pubkey []byte, comment string) (*db.DoltKey, error) {
+ return db.FromContext(ctx).InsertKey(ctx, userID, kid, pubkey, comment)
+}
+
+func (DBAdapter) ListKeysByUser(ctx context.Context, userID int) ([]*db.DoltKey, error) {
+ return db.FromContext(ctx).ListKeysByUser(ctx, userID)
+}
+
+func (DBAdapter) DeleteKey(ctx context.Context, id, userID int) error {
+ return db.FromContext(ctx).DeleteKey(ctx, id, userID)
+}
+
+// BrowseAdapter satisfies BrowseOpener over browse.Open. The returned *browse.DB
+// already implements every BrowseSession method plus Close.
+type BrowseAdapter struct{}
+
+var _ BrowseOpener = BrowseAdapter{}
+
+func (BrowseAdapter) Open(ctx context.Context, diskPath string) (BrowseSession, error) {
+ dbh, err := browse.Open(ctx, diskPath)
+ if err != nil {
+ return nil, err
+ }
+ return dbh, nil
+}
+
+// MetaUserResolver satisfies UserResolver via core-go's auth.LookupUser, which
+// mirrors the meta.sr.ht profile into the local user table and yields the
+// account's UserID. Used to resolve an ACL grantee by username.
+type MetaUserResolver struct{}
+
+var _ UserResolver = MetaUserResolver{}
+
+func (MetaUserResolver) LookupUser(ctx context.Context, username string) (*core.Caller, error) {
+ var ac auth.AuthContext
+ if err := auth.LookupUser(ctx, username, &ac); err != nil {
+ return nil, err
+ }
+ return authn.AsCoreCaller(&ac), nil
+}
diff --git a/web/chrome.go b/web/chrome.go
new file mode 100644
index 0000000000000000000000000000000000000000..67c07a2f341bb7db0ca8bef9c12616569fa75ccf
--- /dev/null
+++ b/web/chrome.go
@@ -0,0 +1,150 @@
+package web
+
+import (
+ "net/http"
+ "net/url"
+ "sort"
+ "strings"
+
+ "git.sr.ht/~sircmpwn/core-go/auth"
+ "git.sr.ht/~sircmpwn/core-go/config"
+ "github.com/vaughan0/go-ini"
+
+ "go.bigb.es/sourcehut-dolt/authn"
+)
+
+// serviceName is our own service key in the shared config and nav.
+const serviceName = "dolt.sr.ht"
+
+// networkOrder is upstream core.sr.ht's fixed nav ordering (flask.py
+// _network_order). Services present in the config but not listed here sort
+// after these, alphabetically. paste.sr.ht and pages.sr.ht are excluded from
+// the network entirely (they have no user-facing nav), mirroring _network.
+var networkOrder = []string{
+ "hub.sr.ht",
+ "git.sr.ht",
+ "hg.sr.ht",
+ "lists.sr.ht",
+ "todo.sr.ht",
+ "builds.sr.ht",
+ "man.sr.ht",
+ "meta.sr.ht",
+}
+
+var networkExcluded = map[string]bool{
+ "paste.sr.ht": true,
+ "pages.sr.ht": true,
+}
+
+// navEntry is one service link in the shared nav.
+type navEntry struct {
+ // Name is the leading segment of the service (e.g. "git" for git.sr.ht),
+ // rendered as the link text exactly as upstream nav.html does.
+ Name string
+ // Site is the full service key (e.g. "git.sr.ht").
+ Site string
+ // Origin is the external URL for the service.
+ Origin string
+ // Active is true for our own service, which highlights it in the nav.
+ Active bool
+}
+
+// basePage is the chrome model shared by every rendered page. Handler view
+// structs embed it so templates reference its fields directly (e.g. .SiteName).
+type basePage struct {
+ Title string
+ Site string
+ SiteLabel string
+ SiteName string
+ Environment string
+ ShowEnvBanner bool
+ Network []navEntry
+ MetaOrigin string
+ SelfOrigin string
+ LoginURL string
+ LogoutURL string
+ StyleHref string
+ // CurrentUser is the authenticated caller, or nil for an anonymous request.
+ CurrentUser *auth.AuthContext
+}
+
+// buildNetwork returns the ordered nav entries for conf: every section ending
+// ".sr.ht" that is not excluded, ordered by networkOrder then alphabetically
+// for unknown services. Origins are resolved externally via config.GetOrigin.
+func buildNetwork(conf ini.File) []navEntry {
+ var sites []string
+ for section := range conf {
+ if !strings.HasSuffix(section, ".sr.ht") || networkExcluded[section] {
+ continue
+ }
+ sites = append(sites, section)
+ }
+
+ orderIndex := func(s string) int {
+ for i, n := range networkOrder {
+ if n == s {
+ return i
+ }
+ }
+ return len(networkOrder) // unknown services sort after the fixed set
+ }
+ sort.Slice(sites, func(i, j int) bool {
+ oi, oj := orderIndex(sites[i]), orderIndex(sites[j])
+ if oi != oj {
+ return oi < oj
+ }
+ return sites[i] < sites[j] // stable, alphabetical among unknowns
+ })
+
+ entries := make([]navEntry, 0, len(sites))
+ for _, s := range sites {
+ entries = append(entries, navEntry{
+ Name: strings.SplitN(s, ".", 2)[0],
+ Site: s,
+ Origin: config.GetOrigin(conf, s, true),
+ Active: s == serviceName,
+ })
+ }
+ return entries
+}
+
+// newBasePage builds the chrome model for a request. Title is the per-page
+// ; the caller sets any page-specific fields on its own view struct.
+func (a *app) newBasePage(r *http.Request, title string) basePage {
+ conf := a.cfg.Conf
+ env := config.GetString(conf, "sr.ht", "environment", "development")
+ self := config.GetOrigin(conf, serviceName, true)
+ meta := config.GetOrigin(conf, "meta.sr.ht", true)
+
+ return basePage{
+ Title: title,
+ Site: serviceName,
+ SiteLabel: strings.SplitN(serviceName, ".", 2)[0],
+ SiteName: config.GetString(conf, "sr.ht", "site-name", "sr.ht"),
+ Environment: env,
+ ShowEnvBanner: env != "production",
+ Network: buildNetwork(conf),
+ MetaOrigin: meta,
+ SelfOrigin: self,
+ LoginURL: loginURL(self, meta, r),
+ LogoutURL: logoutURL(self, meta),
+ StyleHref: a.styleHref,
+ CurrentUser: authn.CallerFromContext(r.Context()),
+ }
+}
+
+// loginURL mirrors core.sr.ht flask.py: {meta}/login?return_to={self+full_path}.
+// full_path is the request path with its query string, so login round-trips the
+// user back to exactly where they were.
+func loginURL(self, meta string, r *http.Request) string {
+ returnTo := self + r.URL.EscapedPath()
+ if r.URL.RawQuery != "" {
+ returnTo += "?" + r.URL.RawQuery
+ }
+ return meta + "/login?return_to=" + url.QueryEscape(returnTo)
+}
+
+// logoutURL mirrors core.sr.ht flask.py: {meta}/logout?return_to={self origin}.
+func logoutURL(self, meta string) string {
+ return meta + "/logout?return_to=" + url.QueryEscape(self)
+}
diff --git a/web/csrf.go b/web/csrf.go
new file mode 100644
index 0000000000000000000000000000000000000000..07f674db46f2f8347695696e9b0736b43ade94f9
--- /dev/null
+++ b/web/csrf.go
@@ -0,0 +1,48 @@
+package web
+
+import (
+ "net/http"
+ "net/url"
+)
+
+// checkSameOrigin is dolt.sr.ht's CSRF defence for state-changing POSTs. core-go
+// ships no CSRF helper, so we keep it simple and explicit: a mutating request
+// must carry an Origin (or, failing that, a Referer) header whose scheme+host
+// matches our own configured origin. Cross-site form posts from a browser always
+// send an Origin that differs from ours, so this blocks them; same-origin form
+// submissions from our own pages always match.
+//
+// Rationale and limits (documented deliberately): we trust the Origin/Referer
+// header, which browsers set and script cannot forge cross-origin. A request
+// with NEITHER header is rejected — our own forms are same-origin and browsers
+// send Origin on form POSTs, so a missing header signals a non-browser or
+// stripped request, which we decline rather than wave through. This is a
+// header-check, not a token scheme; it is sufficient because dolt.sr.ht uses the
+// shared unified-login cookie (SameSite handling lives in meta) and has no
+// cross-origin embedding.
+func (a *app) checkSameOrigin(r *http.Request) bool {
+ selfOrigin := a.newBasePage(r, "").SelfOrigin
+ self, err := url.Parse(selfOrigin)
+ if err != nil || self.Host == "" {
+ return false
+ }
+
+ if origin := r.Header.Get("Origin"); origin != "" {
+ return originMatches(origin, self)
+ }
+ if referer := r.Header.Get("Referer"); referer != "" {
+ return originMatches(referer, self)
+ }
+ // No Origin and no Referer: refuse rather than assume same-origin.
+ return false
+}
+
+// originMatches reports whether raw (a full URL from an Origin or Referer
+// header) has the same scheme and host as self.
+func originMatches(raw string, self *url.URL) bool {
+ u, err := url.Parse(raw)
+ if err != nil {
+ return false
+ }
+ return u.Scheme == self.Scheme && u.Host == self.Host
+}
diff --git a/web/deps.go b/web/deps.go
new file mode 100644
index 0000000000000000000000000000000000000000..6d7f257a496fb7dcd095806e8869e7a6cf03022f
--- /dev/null
+++ b/web/deps.go
@@ -0,0 +1,140 @@
+// Package web is the HTTP layer of dolt.sr.ht: the chi router, request
+// handlers, SourceHut nav/chrome, and the html/template views for the database
+// dashboard, browse pages, settings and dolt-key management.
+//
+// # Dependency injection
+//
+// web is deliberately decoupled from the packages that touch Postgres, disk and
+// the remotesapi. It depends directly only on the pure/committed packages it
+// renders (core, browse) and authn (for the caller in the request context).
+// Everything with side effects — the metadata store, the on-disk store manager,
+// the browse opener, and username resolution against meta — is reached through
+// SMALL local interfaces declared here and satisfied by thin adapters (see
+// adapters.go for the production wiring, and the tests for fakes). This keeps
+// httptest coverage free of Postgres and dolt internals, and lets the Phase-3
+// main assemble the real Config without web importing storage/ or remoteapi/.
+package web
+
+import (
+ "context"
+
+ "github.com/vaughan0/go-ini"
+
+ "git.sr.ht/~sircmpwn/core-go/auth"
+
+ "go.bigb.es/sourcehut-dolt/authn"
+ "go.bigb.es/sourcehut-dolt/browse"
+ "go.bigb.es/sourcehut-dolt/core"
+ "go.bigb.es/sourcehut-dolt/db"
+)
+
+// Config carries everything the router and handlers need. The Phase-3 main
+// builds one and passes it to Register.
+type Config struct {
+ // Conf is the shared instance config (the same ini.File every *.sr.ht
+ // service reads). Used to render the nav/chrome and resolve origins.
+ Conf ini.File
+ // ReposRoot is the absolute directory holding the bare NBS stores, one per
+ // database at <ReposRoot>/~<owner>/<name>. Passed to StoreManager.DeleteStore
+ // as the containment root.
+ ReposRoot string
+ // StaticDir is the directory holding built static assets (the hashed
+ // main.min.<sha>.css and logo.svg). The CSS filename is discovered from it at
+ // Register time; "" falls back to the dev stylesheet /static/main.css.
+ StaticDir string
+
+ // Stores manages the on-disk NBS chunk stores. Satisfied in production by a
+ // storage-backed adapter (Phase 3); web never imports storage/.
+ Stores StoreManager
+ // Repos is the metadata store (repositories, ACLs, dolt keys). Satisfied in
+ // production by dbAdapter over db.Store; fakes are used in tests.
+ Repos RepoStore
+ // Browse opens read-only handles to bare stores for the browse pages.
+ // Satisfied in production by browseAdapter over browse.Open.
+ Browse BrowseOpener
+ // Users resolves a SourceHut username to its account (for ACL add-by-username),
+ // mirroring the meta profile on first sight. Satisfied in production by a
+ // core-go auth.LookupUser adapter.
+ Users UserResolver
+ // RepoDiskPath returns the absolute on-disk store dir for owner/name. In
+ // production this is storage.RepoDiskPath bound to ReposRoot.
+ RepoDiskPath func(owner, name string) string
+}
+
+// StoreManager is the on-disk store lifecycle the create/delete handlers drive.
+// It mirrors the storage package's InitStore/DeleteStore functions and the
+// Cache.Evict method; web declares it as an interface so it never imports
+// storage/.
+type StoreManager interface {
+ // InitStore creates a bare store at absPath and writes an empty repo authored
+ // by ownerName/ownerEmail. On any failure it must leave no partial store.
+ InitStore(ctx context.Context, absPath, ownerName, ownerEmail string) error
+ // DeleteStore removes the store at absPath, refusing anything outside root.
+ DeleteStore(ctx context.Context, root, absPath string) error
+ // Evict closes and drops any memoized served handle for diskPath, so a
+ // recreation at the same path never reuses a stale store.
+ Evict(diskPath string) error
+}
+
+// RepoStore is the subset of db.Store the handlers use. Declaring it as an
+// interface lets tests inject a fake without Postgres; the production dbAdapter
+// (adapters.go) is a compile-time-checked implementation over the real store.
+// Every method takes ctx first; the production adapter reads the request-scoped
+// *sql.DB from ctx (db.FromContext) so a single adapter value serves all
+// requests.
+type RepoStore interface {
+ CreateRepo(ctx context.Context, r *core.Repo) (*core.Repo, error)
+ GetRepoByOwnerAndName(ctx context.Context, ownerUsername, name string) (*core.Repo, error)
+ ListReposByOwner(ctx context.Context, ownerUsername string, viewer *core.Caller) ([]*core.Repo, error)
+ ListReposForDashboard(ctx context.Context, userID int) ([]*core.Repo, error)
+ UpdateRepo(ctx context.Context, id int, description string, visibility core.Visibility) error
+ DeleteRepo(ctx context.Context, id int) error
+
+ EffectiveAccess(ctx context.Context, userID, repoID int) (*core.AccessMode, error)
+ ListACL(ctx context.Context, repoID int) ([]*db.ACLEntry, error)
+ UpsertACL(ctx context.Context, repoID, userID int, mode core.AccessMode) error
+ DeleteACL(ctx context.Context, repoID, userID int) error
+
+ InsertKey(ctx context.Context, userID int, kid string, pubkey []byte, comment string) (*db.DoltKey, error)
+ ListKeysByUser(ctx context.Context, userID int) ([]*db.DoltKey, error)
+ DeleteKey(ctx context.Context, id, userID int) error
+}
+
+// BrowseSession is the read-only browse surface a single request uses. It is
+// exactly the method set of *browse.DB (plus Close), so the production adapter
+// returns a *browse.DB directly. Fakes implement it for httptest.
+type BrowseSession interface {
+ Branches(ctx context.Context) ([]browse.Branch, error)
+ Log(ctx context.Context, refStr, fromHash string, limit int) ([]browse.CommitInfo, string, error)
+ Tables(ctx context.Context, refStr string) ([]browse.TableInfo, error)
+ Rows(ctx context.Context, refStr, table string, offset, limit int) (*browse.RowPage, error)
+ CommitSummary(ctx context.Context, hashStr string) (*browse.CommitDiff, error)
+ Close() error
+}
+
+// BrowseOpener opens a BrowseSession over the bare store at diskPath. Open must
+// be paired with Session.Close by the caller (handlers defer it).
+type BrowseOpener interface {
+ Open(ctx context.Context, diskPath string) (BrowseSession, error)
+}
+
+// UserResolver resolves a username to a core account, mirroring the meta
+// profile into the local user table on first sight (so the resolved UserID can
+// be used as an ACL grantee). Returns an error the caller treats as "no such
+// user" for a permanent miss.
+type UserResolver interface {
+ LookupUser(ctx context.Context, username string) (*core.Caller, error)
+}
+
+// authContext aliases core-go's auth.AuthContext for brevity in handler
+// signatures; it is the authenticated caller (nil = anonymous).
+type authContext = auth.AuthContext
+
+// callerOf returns the resolved caller for a request context: the raw
+// *auth.AuthContext (nil = anonymous) for chrome rendering, and the pure
+// core.Caller for the access-control matrix. It is the single bridge from the
+// authn context value to the domain types used throughout the handlers.
+func callerOf(ctx context.Context) (*auth.AuthContext, *core.Caller) {
+ ac := authn.CallerFromContext(ctx)
+ return ac, authn.AsCoreCaller(ac)
+}
diff --git a/web/handlers_browse.go b/web/handlers_browse.go
new file mode 100644
index 0000000000000000000000000000000000000000..d87196d083260b388d6d3923ecb5ca777be6621f
--- /dev/null
+++ b/web/handlers_browse.go
@@ -0,0 +1,217 @@
+package web
+
+import (
+ "errors"
+ "net/http"
+ "strconv"
+
+ "github.com/go-chi/chi/v5"
+
+ "go.bigb.es/sourcehut-dolt/browse"
+ "go.bigb.es/sourcehut-dolt/core"
+)
+
+const (
+ // logPageSize is the number of commits per /log page.
+ logPageSize = 20
+ // rowsPageSize is the number of rows per /table page.
+ rowsPageSize = 50
+)
+
+// openBrowse opens a browse session for repo, writing a 500 and returning
+// ok=false on failure. The caller must Close the returned session.
+func (a *app) openBrowse(w http.ResponseWriter, r *http.Request, repo *core.Repo) (BrowseSession, bool) {
+ sess, err := a.cfg.Browse.Open(r.Context(), repo.Path)
+ if err != nil {
+ http.Error(w, "failed to open database", http.StatusInternalServerError)
+ return nil, false
+ }
+ return sess, true
+}
+
+// handleLog renders a paginated commit log for a branch (or ref). Pages after
+// the first are reached via ?from=<hash> (the nextHash from the prior page); the
+// active branch is chosen with ?branch=.
+func (a *app) handleLog(w http.ResponseWriter, r *http.Request) {
+ repo, _, _, ok := a.loadRepoForBrowse(w, r)
+ if !ok {
+ return
+ }
+ sess, ok := a.openBrowse(w, r, repo)
+ if !ok {
+ return
+ }
+ defer sess.Close()
+
+ branches, err := sess.Branches(r.Context())
+ if err != nil {
+ http.Error(w, "failed to list branches", http.StatusInternalServerError)
+ return
+ }
+
+ branch := r.URL.Query().Get("branch")
+ if branch == "" {
+ branch = browse.DefaultBranch(branches)
+ }
+ fromHash := r.URL.Query().Get("from")
+
+ commits, nextHash, err := sess.Log(r.Context(), branch, fromHash, logPageSize)
+ if err != nil {
+ if errors.Is(err, browse.ErrRefNotFound) {
+ a.notFound(w, r)
+ return
+ }
+ http.Error(w, "failed to read log", http.StatusInternalServerError)
+ return
+ }
+
+ view := struct {
+ basePage
+ Repo *core.Repo
+ Branches []browse.Branch
+ Branch string
+ Commits []browse.CommitInfo
+ NextHash string
+ }{
+ basePage: a.newBasePage(r, "Log — "+repo.OwnerName+"/"+repo.Name),
+ Repo: repo,
+ Branches: branches,
+ Branch: branch,
+ Commits: commits,
+ NextHash: nextHash,
+ }
+ a.render(w, http.StatusOK, "log.html", view)
+}
+
+// handleCommit renders a single commit's per-table diff summary.
+func (a *app) handleCommit(w http.ResponseWriter, r *http.Request) {
+ repo, _, _, ok := a.loadRepoForBrowse(w, r)
+ if !ok {
+ return
+ }
+ sess, ok := a.openBrowse(w, r, repo)
+ if !ok {
+ return
+ }
+ defer sess.Close()
+
+ hash := chi.URLParam(r, "hash")
+ summary, err := sess.CommitSummary(r.Context(), hash)
+ if err != nil {
+ if errors.Is(err, browse.ErrRefNotFound) {
+ a.notFound(w, r)
+ return
+ }
+ http.Error(w, "failed to read commit", http.StatusInternalServerError)
+ return
+ }
+
+ view := struct {
+ basePage
+ Repo *core.Repo
+ Summary *browse.CommitDiff
+ }{
+ basePage: a.newBasePage(r, "Commit "+shortHash(hash)+" — "+repo.OwnerName+"/"+repo.Name),
+ Repo: repo,
+ Summary: summary,
+ }
+ a.render(w, http.StatusOK, "commit.html", view)
+}
+
+// handleTree renders the tables (with schemas) present at a ref.
+func (a *app) handleTree(w http.ResponseWriter, r *http.Request) {
+ repo, _, _, ok := a.loadRepoForBrowse(w, r)
+ if !ok {
+ return
+ }
+ sess, ok := a.openBrowse(w, r, repo)
+ if !ok {
+ return
+ }
+ defer sess.Close()
+
+ ref := chi.URLParam(r, "ref")
+ tables, err := sess.Tables(r.Context(), ref)
+ if err != nil {
+ if errors.Is(err, browse.ErrRefNotFound) {
+ a.notFound(w, r)
+ return
+ }
+ http.Error(w, "failed to read tables", http.StatusInternalServerError)
+ return
+ }
+
+ view := struct {
+ basePage
+ Repo *core.Repo
+ Ref string
+ Tables []browse.TableInfo
+ }{
+ basePage: a.newBasePage(r, "Tree "+ref+" — "+repo.OwnerName+"/"+repo.Name),
+ Repo: repo,
+ Ref: ref,
+ Tables: tables,
+ }
+ a.render(w, http.StatusOK, "tree.html", view)
+}
+
+// handleTable renders a table's schema and a paginated page of its rows. Pages
+// are selected with ?page=N (1-based).
+func (a *app) handleTable(w http.ResponseWriter, r *http.Request) {
+ repo, _, _, ok := a.loadRepoForBrowse(w, r)
+ if !ok {
+ return
+ }
+ sess, ok := a.openBrowse(w, r, repo)
+ if !ok {
+ return
+ }
+ defer sess.Close()
+
+ ref := chi.URLParam(r, "ref")
+ table := chi.URLParam(r, "table")
+
+ page := 1
+ if p, err := strconv.Atoi(r.URL.Query().Get("page")); err == nil && p > 1 {
+ page = p
+ }
+ offset := (page - 1) * rowsPageSize
+
+ rows, err := sess.Rows(r.Context(), ref, table, offset, rowsPageSize)
+ if err != nil {
+ if errors.Is(err, browse.ErrRefNotFound) || errors.Is(err, browse.ErrTableNotFound) {
+ a.notFound(w, r)
+ return
+ }
+ http.Error(w, "failed to read rows", http.StatusInternalServerError)
+ return
+ }
+
+ totalPages := (rows.Total + rowsPageSize - 1) / rowsPageSize
+ if totalPages < 1 {
+ totalPages = 1
+ }
+
+ view := struct {
+ basePage
+ Repo *core.Repo
+ Ref string
+ Table string
+ Rows *browse.RowPage
+ Page int
+ TotalPages int
+ HasPrev bool
+ HasNext bool
+ }{
+ basePage: a.newBasePage(r, table+" — "+repo.OwnerName+"/"+repo.Name),
+ Repo: repo,
+ Ref: ref,
+ Table: table,
+ Rows: rows,
+ Page: page,
+ TotalPages: totalPages,
+ HasPrev: page > 1,
+ HasNext: page < totalPages,
+ }
+ a.render(w, http.StatusOK, "table.html", view)
+}
diff --git a/web/handlers_keys.go b/web/handlers_keys.go
new file mode 100644
index 0000000000000000000000000000000000000000..7b1e13d79b417ceb326a196fb7cdd4f43654fea8
--- /dev/null
+++ b/web/handlers_keys.go
@@ -0,0 +1,110 @@
+package web
+
+import (
+ "errors"
+ "net/http"
+ "strconv"
+ "strings"
+
+ "go.bigb.es/sourcehut-dolt/db"
+)
+
+// keysView is the dolt-key management page model.
+type keysView struct {
+ basePage
+ Keys []*db.DoltKey
+ Error string
+ Notice string
+}
+
+func (a *app) renderKeys(w http.ResponseWriter, r *http.Request, ac *authContext, status int, errMsg, notice string) {
+ keys, err := a.cfg.Repos.ListKeysByUser(r.Context(), ac.UserID)
+ if err != nil {
+ http.Error(w, "failed to list keys", http.StatusInternalServerError)
+ return
+ }
+ view := keysView{
+ basePage: a.newBasePage(r, "Dolt keys — "+serviceName),
+ Keys: keys,
+ Error: errMsg,
+ Notice: notice,
+ }
+ a.render(w, status, "keys.html", view)
+}
+
+// handleKeys renders the dolt-key page: the user's registered keys and the
+// add-key form. The page reads a `#<pubkey-base32>` URL fragment (which
+// `dolt login` appends) into the form via a few lines of inline JS, but works
+// without JS too — the user can paste the key the CLI printed. Login required.
+func (a *app) handleKeys(w http.ResponseWriter, r *http.Request) {
+ ac := a.requireLogin(w, r)
+ if ac == nil {
+ return
+ }
+ a.renderKeys(w, r, ac, http.StatusOK, "", "")
+}
+
+// handleKeysPost adds or deletes a dolt key. A form carrying `delete_id` removes
+// that key; otherwise `pubkey` (the base32 string dolt emits) is decoded,
+// validated and registered. Login and a same-origin POST are required.
+func (a *app) handleKeysPost(w http.ResponseWriter, r *http.Request) {
+ ac := a.requireLogin(w, r)
+ if ac == nil {
+ return
+ }
+ if !a.checkSameOrigin(r) {
+ a.forbidden(w, r, "Cross-origin request rejected.")
+ return
+ }
+ if err := r.ParseForm(); err != nil {
+ a.renderKeys(w, r, ac, http.StatusBadRequest, "Malformed form submission.", "")
+ return
+ }
+
+ if idStr := r.PostFormValue("delete_id"); idStr != "" {
+ a.keysDelete(w, r, ac, idStr)
+ return
+ }
+ a.keysAdd(w, r, ac)
+}
+
+// keysAdd decodes and registers a dolt public key for the caller.
+func (a *app) keysAdd(w http.ResponseWriter, r *http.Request, ac *authContext) {
+ pubStr := strings.TrimSpace(r.PostFormValue("pubkey"))
+ comment := strings.TrimSpace(r.PostFormValue("comment"))
+
+ pubkey, kid, err := decodeDoltPubKey(pubStr)
+ if err != nil {
+ a.renderKeys(w, r, ac, http.StatusBadRequest, "Invalid public key: "+err.Error(), "")
+ return
+ }
+
+ if _, err := a.cfg.Repos.InsertKey(r.Context(), ac.UserID, kid, pubkey, comment); err != nil {
+ if errors.Is(err, db.ErrKeyExists) {
+ a.renderKeys(w, r, ac, http.StatusConflict, "That key is already registered.", "")
+ return
+ }
+ http.Error(w, "failed to register key", http.StatusInternalServerError)
+ return
+ }
+ a.renderKeys(w, r, ac, http.StatusOK, "", "Key added. You can now use `dolt clone`/`push` without --user.")
+}
+
+// keysDelete removes one of the caller's keys, scoped by user id so a user can
+// only delete their own keys.
+func (a *app) keysDelete(w http.ResponseWriter, r *http.Request, ac *authContext, idStr string) {
+ id, err := strconv.Atoi(idStr)
+ if err != nil {
+ a.renderKeys(w, r, ac, http.StatusBadRequest, "Invalid key id.", "")
+ return
+ }
+ if err := a.cfg.Repos.DeleteKey(r.Context(), id, ac.UserID); err != nil {
+ if errors.Is(err, db.ErrNotFound) {
+ a.renderKeys(w, r, ac, http.StatusNotFound, "No such key.", "")
+ return
+ }
+ http.Error(w, "failed to delete key", http.StatusInternalServerError)
+ return
+ }
+ a.renderKeys(w, r, ac, http.StatusOK, "", "Key deleted.")
+}
diff --git a/web/handlers_repo.go b/web/handlers_repo.go
new file mode 100644
index 0000000000000000000000000000000000000000..d90f9bbf3b16b41b69062745ec65429ebe4e2b67
--- /dev/null
+++ b/web/handlers_repo.go
@@ -0,0 +1,249 @@
+package web
+
+import (
+ "errors"
+ "net/http"
+ "strings"
+
+ "git.sr.ht/~sircmpwn/core-go/config"
+ "github.com/go-chi/chi/v5"
+
+ "go.bigb.es/sourcehut-dolt/browse"
+ "go.bigb.es/sourcehut-dolt/core"
+ "go.bigb.es/sourcehut-dolt/db"
+)
+
+// overviewCommitLimit is how many recent commits the database overview shows.
+const overviewCommitLimit = 10
+
+// handleIndex renders the dashboard: the signed-in user's databases (owned +
+// ACL) with a create link, or an anonymous welcome blurb.
+func (a *app) handleIndex(w http.ResponseWriter, r *http.Request) {
+ ac, caller := callerOf(r.Context())
+
+ view := struct {
+ basePage
+ Repos []*core.Repo
+ }{basePage: a.newBasePage(r, serviceName)}
+
+ if ac != nil {
+ repos, err := a.cfg.Repos.ListReposForDashboard(r.Context(), caller.UserID)
+ if err != nil {
+ http.Error(w, "failed to list databases", http.StatusInternalServerError)
+ return
+ }
+ view.Repos = repos
+ }
+ a.render(w, http.StatusOK, "index.html", view)
+}
+
+// handleCreateForm renders the new-database form. Login is required.
+func (a *app) handleCreateForm(w http.ResponseWriter, r *http.Request) {
+ if ac := a.requireLogin(w, r); ac == nil {
+ return
+ }
+ a.renderCreate(w, r, http.StatusOK, createForm{Visibility: string(core.VisibilityPublic)}, "")
+}
+
+// createForm is the create page's sticky form state.
+type createForm struct {
+ Name string
+ Description string
+ Visibility string
+}
+
+func (a *app) renderCreate(w http.ResponseWriter, r *http.Request, status int, form createForm, errMsg string) {
+ view := struct {
+ basePage
+ Form createForm
+ Error string
+ }{
+ basePage: a.newBasePage(r, "Create database — "+serviceName),
+ Form: form,
+ Error: errMsg,
+ }
+ a.render(w, status, "create.html", view)
+}
+
+// handleCreate processes the new-database form. It validates the name, creates
+// the metadata row, then the on-disk store; on store-init failure it removes the
+// just-created row so no orphan metadata survives. Login and a same-origin POST
+// are required.
+func (a *app) handleCreate(w http.ResponseWriter, r *http.Request) {
+ ac := a.requireLogin(w, r)
+ if ac == nil {
+ return
+ }
+ if !a.checkSameOrigin(r) {
+ a.forbidden(w, r, "Cross-origin request rejected.")
+ return
+ }
+ if err := r.ParseForm(); err != nil {
+ a.renderCreate(w, r, http.StatusBadRequest, createForm{}, "Malformed form submission.")
+ return
+ }
+
+ form := createForm{
+ Name: strings.TrimSpace(r.PostFormValue("name")),
+ Description: strings.TrimSpace(r.PostFormValue("description")),
+ Visibility: r.PostFormValue("visibility"),
+ }
+
+ visibility, ok := parseVisibility(form.Visibility)
+ if !ok {
+ a.renderCreate(w, r, http.StatusBadRequest, form, "Invalid visibility.")
+ return
+ }
+ if err := core.ValidateName(form.Name); err != nil {
+ a.renderCreate(w, r, http.StatusBadRequest, form, err.Error())
+ return
+ }
+
+ owner := ac.Username
+ ownerName, ownerEmail := config.GetOwner(a.cfg.Conf)
+ if ownerEmail == "" {
+ ownerEmail = ac.Email
+ }
+ if ownerName == "" {
+ ownerName = owner
+ }
+
+ diskPath := a.cfg.RepoDiskPath(owner, form.Name)
+ repo := &core.Repo{
+ Name: form.Name,
+ Description: form.Description,
+ OwnerID: ac.UserID,
+ OwnerName: owner,
+ Path: diskPath,
+ Visibility: visibility,
+ }
+
+ // Insert the metadata row first: a name collision (ErrNameTaken) is caught
+ // before we ever touch disk. Then create the on-disk store; if that fails,
+ // remove the row we just inserted so metadata and disk never diverge.
+ created, err := a.cfg.Repos.CreateRepo(r.Context(), repo)
+ if err != nil {
+ if errors.Is(err, db.ErrNameTaken) {
+ a.renderCreate(w, r, http.StatusConflict, form,
+ "You already have a database with that name.")
+ return
+ }
+ http.Error(w, "failed to create database", http.StatusInternalServerError)
+ return
+ }
+
+ if err := a.cfg.Stores.InitStore(r.Context(), diskPath, ownerName, ownerEmail); err != nil {
+ // InitStore self-cleans its directory; undo the metadata row too.
+ _ = a.cfg.Repos.DeleteRepo(r.Context(), created.ID)
+ http.Error(w, "failed to initialize database store", http.StatusInternalServerError)
+ return
+ }
+
+ http.Redirect(w, r, "/~"+owner+"/"+form.Name, http.StatusSeeOther)
+}
+
+// handleUser renders a single user's visible databases (~user listing).
+func (a *app) handleUser(w http.ResponseWriter, r *http.Request) {
+ owner := chi.URLParam(r, "user")
+ _, caller := callerOf(r.Context())
+
+ repos, err := a.cfg.Repos.ListReposByOwner(r.Context(), owner, caller)
+ if err != nil {
+ http.Error(w, "failed to list databases", http.StatusInternalServerError)
+ return
+ }
+
+ view := struct {
+ basePage
+ Owner string
+ Repos []*core.Repo
+ }{
+ basePage: a.newBasePage(r, "~"+owner+" — "+serviceName),
+ Owner: owner,
+ Repos: repos,
+ }
+ a.render(w, http.StatusOK, "user.html", view)
+}
+
+// handleOverview renders the database overview: description, visibility badge,
+// branch list, latest commits, and a clone box showing both auth flows.
+func (a *app) handleOverview(w http.ResponseWriter, r *http.Request) {
+ repo, _, _, ok := a.loadRepoForBrowse(w, r)
+ if !ok {
+ return
+ }
+
+ var (
+ branches []browse.Branch
+ defBr string
+ commits []browse.CommitInfo
+ browseErr string
+ )
+ if sess, err := a.cfg.Browse.Open(r.Context(), repo.Path); err == nil {
+ defer sess.Close()
+ if bs, err := sess.Branches(r.Context()); err == nil {
+ branches = bs
+ defBr = browse.DefaultBranch(bs)
+ if defBr != "" {
+ if cs, _, err := sess.Log(r.Context(), defBr, "", overviewCommitLimit); err == nil {
+ commits = cs
+ } else {
+ browseErr = err.Error()
+ }
+ }
+ } else {
+ browseErr = err.Error()
+ }
+ } else {
+ browseErr = err.Error()
+ }
+
+ view := struct {
+ basePage
+ Repo *core.Repo
+ Branches []browse.Branch
+ DefaultBranch string
+ Commits []browse.CommitInfo
+ CloneURL string
+ BrowseError string
+ }{
+ basePage: a.newBasePage(r, repo.OwnerName+"/"+repo.Name+" — "+serviceName),
+ Repo: repo,
+ Branches: branches,
+ DefaultBranch: defBr,
+ Commits: commits,
+ CloneURL: a.cloneURL(r, repo),
+ BrowseError: browseErr,
+ }
+ a.render(w, http.StatusOK, "overview.html", view)
+}
+
+// cloneURL builds the HTTPS clone URL for repo: {self origin}/~owner/name.
+func (a *app) cloneURL(r *http.Request, repo *core.Repo) string {
+ return a.newBasePage(r, "").SelfOrigin + "/~" + repo.OwnerName + "/" + repo.Name
+}
+
+// requireLogin returns the authenticated caller, or nil after redirecting an
+// anonymous request to the login page.
+func (a *app) requireLogin(w http.ResponseWriter, r *http.Request) *authContext {
+ ac, _ := callerOf(r.Context())
+ if ac == nil {
+ a.redirectLogin(w, r)
+ return nil
+ }
+ return ac
+}
+
+// parseVisibility validates and maps a form visibility string.
+func parseVisibility(s string) (core.Visibility, bool) {
+ switch core.Visibility(s) {
+ case core.VisibilityPublic:
+ return core.VisibilityPublic, true
+ case core.VisibilityUnlisted:
+ return core.VisibilityUnlisted, true
+ case core.VisibilityPrivate:
+ return core.VisibilityPrivate, true
+ default:
+ return "", false
+ }
+}
diff --git a/web/handlers_settings.go b/web/handlers_settings.go
new file mode 100644
index 0000000000000000000000000000000000000000..bf814e1a8a8fb9fa4368913acf3d29eb3585aeb7
--- /dev/null
+++ b/web/handlers_settings.go
@@ -0,0 +1,217 @@
+package web
+
+import (
+ "errors"
+ "net/http"
+ "strconv"
+ "strings"
+
+ "github.com/go-chi/chi/v5"
+
+ "go.bigb.es/sourcehut-dolt/core"
+ "go.bigb.es/sourcehut-dolt/db"
+)
+
+// loadRepoForAdmin loads the {user}/{db} repo and enforces the owner-only admin
+// gate for settings. Login is required (anonymous → login redirect). A missing
+// repo, or a hidden PRIVATE repo the caller cannot even browse, is reported as
+// not found; a visible repo the caller does not own is a plain 403. On any of
+// these it writes the response and returns ok=false.
+func (a *app) loadRepoForAdmin(w http.ResponseWriter, r *http.Request) (repo *core.Repo, ac *authContext, ok bool) {
+ ac = a.requireLogin(w, r)
+ if ac == nil {
+ return nil, nil, false
+ }
+ _, caller := callerOf(r.Context())
+
+ owner := chi.URLParam(r, "user")
+ name := chi.URLParam(r, "db")
+ repo, err := a.cfg.Repos.GetRepoByOwnerAndName(r.Context(), owner, name)
+ if err != nil {
+ a.notFound(w, r)
+ return nil, nil, false
+ }
+
+ if caller.UserID != repo.OwnerID {
+ aclMode := a.effectiveACL(r, caller, repo)
+ if core.NotFoundForPrivate(caller, repo, aclMode) {
+ a.notFound(w, r)
+ } else {
+ a.forbidden(w, r, "Only the owner may change database settings.")
+ }
+ return nil, nil, false
+ }
+ return repo, ac, true
+}
+
+// settingsView is the settings page model.
+type settingsView struct {
+ basePage
+ Repo *core.Repo
+ ACL []*db.ACLEntry
+ Error string
+ Notice string
+}
+
+func (a *app) renderSettings(w http.ResponseWriter, r *http.Request, status int, repo *core.Repo, errMsg, notice string) {
+ acl, err := a.cfg.Repos.ListACL(r.Context(), repo.ID)
+ if err != nil {
+ http.Error(w, "failed to list access", http.StatusInternalServerError)
+ return
+ }
+ view := settingsView{
+ basePage: a.newBasePage(r, "Settings — "+repo.OwnerName+"/"+repo.Name),
+ Repo: repo,
+ ACL: acl,
+ Error: errMsg,
+ Notice: notice,
+ }
+ a.render(w, status, "settings.html", view)
+}
+
+// handleSettings renders the settings page (description/visibility, ACLs, danger
+// zone). Owner only.
+func (a *app) handleSettings(w http.ResponseWriter, r *http.Request) {
+ repo, _, ok := a.loadRepoForAdmin(w, r)
+ if !ok {
+ return
+ }
+ a.renderSettings(w, r, http.StatusOK, repo, "", "")
+}
+
+// handleSettingsPost dispatches the settings form on its "action" field:
+// update (description + visibility), acl_add, acl_remove, or delete. Owner only,
+// same-origin only.
+func (a *app) handleSettingsPost(w http.ResponseWriter, r *http.Request) {
+ repo, _, ok := a.loadRepoForAdmin(w, r)
+ if !ok {
+ return
+ }
+ if !a.checkSameOrigin(r) {
+ a.forbidden(w, r, "Cross-origin request rejected.")
+ return
+ }
+ if err := r.ParseForm(); err != nil {
+ a.renderSettings(w, r, http.StatusBadRequest, repo, "Malformed form submission.", "")
+ return
+ }
+
+ switch r.PostFormValue("action") {
+ case "update":
+ a.settingsUpdate(w, r, repo)
+ case "acl_add":
+ a.settingsACLAdd(w, r, repo)
+ case "acl_remove":
+ a.settingsACLRemove(w, r, repo)
+ case "delete":
+ a.settingsDelete(w, r, repo)
+ default:
+ a.renderSettings(w, r, http.StatusBadRequest, repo, "Unknown action.", "")
+ }
+}
+
+// settingsUpdate applies the description + visibility change.
+func (a *app) settingsUpdate(w http.ResponseWriter, r *http.Request, repo *core.Repo) {
+ description := strings.TrimSpace(r.PostFormValue("description"))
+ visibility, ok := parseVisibility(r.PostFormValue("visibility"))
+ if !ok {
+ a.renderSettings(w, r, http.StatusBadRequest, repo, "Invalid visibility.", "")
+ return
+ }
+ if err := a.cfg.Repos.UpdateRepo(r.Context(), repo.ID, description, visibility); err != nil {
+ http.Error(w, "failed to update database", http.StatusInternalServerError)
+ return
+ }
+ repo.Description = description
+ repo.Visibility = visibility
+ a.renderSettings(w, r, http.StatusOK, repo, "", "Settings saved.")
+}
+
+// settingsACLAdd grants (or updates) an ACL entry for a username. The grantee is
+// resolved via the user resolver, which mirrors the meta profile on first sight.
+func (a *app) settingsACLAdd(w http.ResponseWriter, r *http.Request, repo *core.Repo) {
+ username := strings.TrimPrefix(strings.TrimSpace(r.PostFormValue("username")), "~")
+ mode, ok := parseAccessMode(r.PostFormValue("mode"))
+ if !ok {
+ a.renderSettings(w, r, http.StatusBadRequest, repo, "Invalid access mode.", "")
+ return
+ }
+ if username == "" {
+ a.renderSettings(w, r, http.StatusBadRequest, repo, "A username is required.", "")
+ return
+ }
+
+ grantee, err := a.cfg.Users.LookupUser(r.Context(), username)
+ if err != nil || grantee == nil {
+ a.renderSettings(w, r, http.StatusBadRequest, repo,
+ "No such user: "+username, "")
+ return
+ }
+ if grantee.UserID == repo.OwnerID {
+ a.renderSettings(w, r, http.StatusBadRequest, repo,
+ "The owner already has full access.", "")
+ return
+ }
+ if err := a.cfg.Repos.UpsertACL(r.Context(), repo.ID, grantee.UserID, mode); err != nil {
+ http.Error(w, "failed to grant access", http.StatusInternalServerError)
+ return
+ }
+ a.renderSettings(w, r, http.StatusOK, repo, "", "Access granted to "+username+".")
+}
+
+// settingsACLRemove revokes an ACL entry by user id.
+func (a *app) settingsACLRemove(w http.ResponseWriter, r *http.Request, repo *core.Repo) {
+ userID, err := strconv.Atoi(r.PostFormValue("user_id"))
+ if err != nil {
+ a.renderSettings(w, r, http.StatusBadRequest, repo, "Invalid user.", "")
+ return
+ }
+ if err := a.cfg.Repos.DeleteACL(r.Context(), repo.ID, userID); err != nil {
+ if errors.Is(err, db.ErrNotFound) {
+ a.renderSettings(w, r, http.StatusNotFound, repo, "No such access entry.", "")
+ return
+ }
+ http.Error(w, "failed to revoke access", http.StatusInternalServerError)
+ return
+ }
+ a.renderSettings(w, r, http.StatusOK, repo, "", "Access revoked.")
+}
+
+// settingsDelete deletes the database after a name-confirmation check: the row,
+// then the on-disk store, then the served-cache handle. The confirmation guards
+// against accidental deletion.
+func (a *app) settingsDelete(w http.ResponseWriter, r *http.Request, repo *core.Repo) {
+ if r.PostFormValue("confirm_name") != repo.Name {
+ a.renderSettings(w, r, http.StatusBadRequest, repo,
+ "Type the database name exactly to confirm deletion.", "")
+ return
+ }
+
+ if err := a.cfg.Repos.DeleteRepo(r.Context(), repo.ID); err != nil {
+ http.Error(w, "failed to delete database", http.StatusInternalServerError)
+ return
+ }
+ if err := a.cfg.Stores.DeleteStore(r.Context(), a.cfg.ReposRoot, repo.Path); err != nil {
+ http.Error(w, "database record removed but store deletion failed: "+err.Error(),
+ http.StatusInternalServerError)
+ return
+ }
+ if err := a.cfg.Stores.Evict(repo.Path); err != nil {
+ http.Error(w, "store deleted but cache eviction failed: "+err.Error(),
+ http.StatusInternalServerError)
+ return
+ }
+ http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+// parseAccessMode validates and maps a form access-mode string.
+func parseAccessMode(s string) (core.AccessMode, bool) {
+ switch core.AccessMode(s) {
+ case core.AccessRO:
+ return core.AccessRO, true
+ case core.AccessRW:
+ return core.AccessRW, true
+ default:
+ return "", false
+ }
+}
diff --git a/web/pubkey.go b/web/pubkey.go
new file mode 100644
index 0000000000000000000000000000000000000000..a8b465864e8fd11d14b5305e48baad0c023fc5df
--- /dev/null
+++ b/web/pubkey.go
@@ -0,0 +1,36 @@
+package web
+
+import (
+ "fmt"
+
+ "github.com/dolthub/dolt/go/libraries/doltcore/creds"
+)
+
+// ed25519PubKeyLen is the raw length of an Ed25519 public key. dolt encodes it
+// as 52 base32 characters (creds.B32EncodedPubKeyLen) in its custom alphabet.
+const ed25519PubKeyLen = 32
+
+// decodeDoltPubKey decodes the base32 public-key string that the dolt CLI emits.
+// It is exactly the string `dolt login` appends to the login URL as a fragment
+// (creds.DoltCreds.PubKeyBase32Str: creds.B32CredsEncoding over the raw 32-byte
+// key, custom alphabet "0123456789abcdefghijklmnopqrstuv", no padding). It
+// returns the raw 32-byte key and its derived key id (kid =
+// base32(SHA-512/224(pubkey)) via creds.PubKeyToKIDStr), matching exactly what
+// the Bearer-JWT verifier in authn expects to look up.
+//
+// It validates the decoded length is exactly 32 bytes; a wrong length is a
+// malformed key and is rejected loudly rather than stored.
+func decodeDoltPubKey(s string) (pubkey []byte, kid string, err error) {
+ if s == "" {
+ return nil, "", fmt.Errorf("empty public key")
+ }
+ pubkey, err = creds.B32CredsEncoding.DecodeString(s)
+ if err != nil {
+ return nil, "", fmt.Errorf("invalid base32 public key: %w", err)
+ }
+ if len(pubkey) != ed25519PubKeyLen {
+ return nil, "", fmt.Errorf("public key must be %d bytes, got %d", ed25519PubKeyLen, len(pubkey))
+ }
+ kid = creds.PubKeyToKIDStr(pubkey)
+ return pubkey, kid, nil
+}
diff --git a/web/router.go b/web/router.go
new file mode 100644
index 0000000000000000000000000000000000000000..51b9bc53b4495d81704b7edf8fdac37a2ca92850
--- /dev/null
+++ b/web/router.go
@@ -0,0 +1,134 @@
+package web
+
+import (
+ "fmt"
+ "net/http"
+
+ "github.com/go-chi/chi/v5"
+
+ "go.bigb.es/sourcehut-dolt/core"
+)
+
+// app bundles the parsed templates, the discovered stylesheet href and the
+// injected config. Handlers are methods on *app so they share this state
+// without a global.
+type app struct {
+ cfg Config
+ templates templateSet
+ styleHref string
+}
+
+// Register mounts every dolt.sr.ht web route onto r. The caller (the Phase-3
+// main) installs the config/database/cookie middleware upstream on the router
+// group it passes here, then calls Register with the assembled Config.
+//
+// It parses templates and discovers the stylesheet once, at registration time,
+// so a broken template fails startup loudly rather than a request later. A
+// parse failure returns an error the caller must surface.
+func Register(r chi.Router, cfg Config) error {
+ if cfg.Repos == nil || cfg.Stores == nil || cfg.Browse == nil ||
+ cfg.Users == nil || cfg.RepoDiskPath == nil {
+ return fmt.Errorf("web: Register requires Repos, Stores, Browse, Users and RepoDiskPath")
+ }
+
+ templates, err := loadTemplates()
+ if err != nil {
+ return err
+ }
+
+ a := &app{
+ cfg: cfg,
+ templates: templates,
+ styleHref: discoverStyleHref(cfg.StaticDir),
+ }
+
+ r.Get("/", a.handleIndex)
+ r.Get("/create", a.handleCreateForm)
+ r.Post("/create", a.handleCreate)
+
+ r.Get("/settings/keys", a.handleKeys)
+ r.Post("/settings/keys", a.handleKeysPost)
+
+ r.Get("/~{user}", a.handleUser)
+ r.Get("/~{user}/{db}", a.handleOverview)
+ r.Get("/~{user}/{db}/log", a.handleLog)
+ r.Get("/~{user}/{db}/commit/{hash}", a.handleCommit)
+ r.Get("/~{user}/{db}/tree/{ref}", a.handleTree)
+ r.Get("/~{user}/{db}/table/{ref}/{table}", a.handleTable)
+ r.Get("/~{user}/{db}/settings", a.handleSettings)
+ r.Post("/~{user}/{db}/settings", a.handleSettingsPost)
+
+ r.Handle("/static/*", httpStaticHandler(a.cfg.StaticDir))
+
+ return nil
+}
+
+// --- shared response helpers -------------------------------------------------
+
+// notFound renders the 404 page. Used both for genuinely missing repos and to
+// hide the existence of PRIVATE repos the caller may not browse.
+func (a *app) notFound(w http.ResponseWriter, r *http.Request) {
+ view := struct {
+ basePage
+ }{basePage: a.newBasePage(r, "Not found — "+serviceName)}
+ a.render(w, http.StatusNotFound, "404.html", view)
+}
+
+// forbidden renders the 403 page for a denied but non-hidden request.
+func (a *app) forbidden(w http.ResponseWriter, r *http.Request, msg string) {
+ view := struct {
+ basePage
+ Message string
+ }{basePage: a.newBasePage(r, "Forbidden — "+serviceName), Message: msg}
+ a.render(w, http.StatusForbidden, "403.html", view)
+}
+
+// redirectLogin sends an unauthenticated caller to meta's login, returning them
+// to the current URL afterwards.
+func (a *app) redirectLogin(w http.ResponseWriter, r *http.Request) {
+ http.Redirect(w, r, a.newBasePage(r, "").LoginURL, http.StatusSeeOther)
+}
+
+// loadRepoForBrowse loads the repo named by the {user}/{db} URL params and
+// enforces read (OpBrowse) authorization. On any denial it writes the response
+// (404 for hidden PRIVATE repos, 403 otherwise) and returns ok=false. On
+// success it returns the repo, the (possibly nil) caller and the caller's ACL
+// grant for reuse by the handler.
+func (a *app) loadRepoForBrowse(w http.ResponseWriter, r *http.Request) (repo *core.Repo, caller *core.Caller, aclMode *core.AccessMode, ok bool) {
+ owner := chi.URLParam(r, "user")
+ name := chi.URLParam(r, "db")
+
+ _, caller = callerOf(r.Context())
+
+ repo, err := a.cfg.Repos.GetRepoByOwnerAndName(r.Context(), owner, name)
+ if err != nil {
+ // A missing repo is reported as not found regardless of the caller.
+ a.notFound(w, r)
+ return nil, nil, nil, false
+ }
+
+ aclMode = a.effectiveACL(r, caller, repo)
+ if !core.Allowed(caller, repo, aclMode, core.OpBrowse) {
+ if core.NotFoundForPrivate(caller, repo, aclMode) {
+ a.notFound(w, r)
+ } else {
+ a.forbidden(w, r, "You do not have access to this database.")
+ }
+ return nil, nil, nil, false
+ }
+ return repo, caller, aclMode, true
+}
+
+// effectiveACL resolves the caller's ACL grant on repo, or nil for an anonymous
+// caller or a caller with no grant. A lookup error degrades to nil (no grant):
+// access then falls back to visibility, which never over-grants.
+func (a *app) effectiveACL(r *http.Request, caller *core.Caller, repo *core.Repo) *core.AccessMode {
+ if caller == nil {
+ return nil
+ }
+ mode, err := a.cfg.Repos.EffectiveAccess(r.Context(), caller.UserID, repo.ID)
+ if err != nil {
+ return nil
+ }
+ return mode
+}
diff --git a/web/templates.go b/web/templates.go
new file mode 100644
index 0000000000000000000000000000000000000000..8c0780b246529bbf73fe1aabb5f9f31e140450b1
--- /dev/null
+++ b/web/templates.go
@@ -0,0 +1,228 @@
+package web
+
+import (
+ "embed"
+ "fmt"
+ "html/template"
+ "io/fs"
+ "net/http"
+ "net/url"
+ "os"
+ "sort"
+ "strings"
+ "time"
+)
+
+//go:embed templates/*.html templates/icons/*.svg
+var templateFS embed.FS
+
+// pageTemplates lists every content page. Each is parsed together with the
+// shared layout, nav and partials into its own *template.Template, so the
+// per-page {{define "content"}} blocks never collide.
+var pageTemplates = []string{
+ "index.html",
+ "create.html",
+ "user.html",
+ "overview.html",
+ "log.html",
+ "commit.html",
+ "tree.html",
+ "table.html",
+ "settings.html",
+ "keys.html",
+ "404.html",
+ "403.html",
+}
+
+// sharedTemplates are parsed into every page: the outer layout, the nav
+// fragment, and reusable partials (badges, pagination, etc.).
+var sharedTemplates = []string{
+ "templates/layout.html",
+ "templates/nav.html",
+ "templates/partials.html",
+}
+
+// templateSet maps a page name to its fully-parsed template (execute "layout").
+type templateSet map[string]*template.Template
+
+// loadTemplates parses every page template with the shared chrome and the
+// funcmap. It fails loudly (returns an error) on any parse problem so a broken
+// template surfaces at startup, never as a blank page at request time.
+func loadTemplates() (templateSet, error) {
+ icons, err := loadIcons()
+ if err != nil {
+ return nil, err
+ }
+ funcs := templateFuncs(icons)
+
+ set := make(templateSet, len(pageTemplates))
+ for _, page := range pageTemplates {
+ t := template.New("layout").Funcs(funcs)
+ files := append(append([]string{}, sharedTemplates...), "templates/"+page)
+ if _, err := t.ParseFS(templateFS, files...); err != nil {
+ return nil, fmt.Errorf("web: parse template %s: %w", page, err)
+ }
+ set[page] = t
+ }
+ return set, nil
+}
+
+// loadIcons reads every embedded icon SVG into a name→markup map for the icon
+// template func.
+func loadIcons() (map[string]template.HTML, error) {
+ entries, err := fs.ReadDir(templateFS, "templates/icons")
+ if err != nil {
+ return nil, fmt.Errorf("web: read icons dir: %w", err)
+ }
+ icons := make(map[string]template.HTML, len(entries))
+ for _, e := range entries {
+ if e.IsDir() || !strings.HasSuffix(e.Name(), ".svg") {
+ continue
+ }
+ data, err := templateFS.ReadFile("templates/icons/" + e.Name())
+ if err != nil {
+ return nil, fmt.Errorf("web: read icon %s: %w", e.Name(), err)
+ }
+ name := strings.TrimSuffix(e.Name(), ".svg")
+ icons[name] = template.HTML(fmt.Sprintf(
+ `<span class="icon icon-%s" aria-hidden="true">%s</span>`, name, data))
+ }
+ return icons, nil
+}
+
+// templateFuncs is the funcmap available in every template.
+func templateFuncs(icons map[string]template.HTML) template.FuncMap {
+ return template.FuncMap{
+ // icon renders a named inline SVG (from templates/icons). An unknown name
+ // yields empty output rather than a hard error, so a missing icon never
+ // crashes a page.
+ "icon": func(name string) template.HTML { return icons[name] },
+ // shorthash abbreviates a dolt/NBS hash to its first 8 characters, the
+ // convention used everywhere commits are listed.
+ "shorthash": shortHash,
+ // reltime renders a humanized relative time ("3 hours ago"), no deps.
+ "reltime": humanizeTime,
+ // abstime renders an absolute UTC timestamp for tooltips/detail.
+ "abstime": func(t time.Time) string { return t.UTC().Format("2006-01-02 15:04:05 UTC") },
+ // humansize renders a byte count as a human-readable size.
+ "humansize": humanizeSize,
+ "upper": strings.ToUpper,
+ // inc/dec support 1-based page arithmetic in pagination links.
+ "inc": func(n int) int { return n + 1 },
+ "dec": func(n int) int { return n - 1 },
+ // doltHost derives the host:port a `dolt login --auth-endpoint` expects
+ // from our origin URL (defaulting to :443 for https).
+ "doltHost": doltHost,
+ }
+}
+
+// doltHost renders the host:port for `dolt login --auth-endpoint` from an origin
+// URL. It appends the default TLS/plain port when the origin omits one.
+func doltHost(origin string) string {
+ u, err := url.Parse(origin)
+ if err != nil || u.Host == "" {
+ return origin
+ }
+ if u.Port() != "" {
+ return u.Host
+ }
+ if u.Scheme == "http" {
+ return u.Host + ":80"
+ }
+ return u.Host + ":443"
+}
+
+// shortHash returns the first 8 characters of h (or h itself if shorter).
+func shortHash(h string) string {
+ if len(h) <= 8 {
+ return h
+ }
+ return h[:8]
+}
+
+// humanizeTime renders t as a coarse relative time in the past. It is a small
+// self-contained helper (no new dependency) covering seconds→years.
+func humanizeTime(t time.Time) string {
+ d := time.Since(t)
+ if d < 0 {
+ return "just now"
+ }
+ switch {
+ case d < time.Minute:
+ return "just now"
+ case d < time.Hour:
+ return plural(int(d/time.Minute), "minute")
+ case d < 24*time.Hour:
+ return plural(int(d/time.Hour), "hour")
+ case d < 30*24*time.Hour:
+ return plural(int(d/(24*time.Hour)), "day")
+ case d < 365*24*time.Hour:
+ return plural(int(d/(30*24*time.Hour)), "month")
+ default:
+ return plural(int(d/(365*24*time.Hour)), "year")
+ }
+}
+
+func plural(n int, unit string) string {
+ if n == 1 {
+ return "1 " + unit + " ago"
+ }
+ return fmt.Sprintf("%d %ss ago", n, unit)
+}
+
+// humanizeSize renders a byte count with binary (1024) units.
+func humanizeSize(n uint64) string {
+ const unit = 1024
+ if n < unit {
+ return fmt.Sprintf("%d B", n)
+ }
+ div, exp := uint64(unit), 0
+ for m := n / unit; m >= unit; m /= unit {
+ div *= unit
+ exp++
+ }
+ return fmt.Sprintf("%.1f %ciB", float64(n)/float64(div), "KMGTPE"[exp])
+}
+
+// discoverStyleHref returns the stylesheet href for the layout: the hashed
+// production asset if one is present in staticDir (main.min.<sha>.css, served
+// under /static/), else the dev fallback /static/main.css. Globbing at startup
+// keeps the cache-busting filename out of the templates.
+func discoverStyleHref(staticDir string) string {
+ const fallback = "/static/main.css"
+ if staticDir == "" {
+ return fallback
+ }
+ matches, err := fs.Glob(os.DirFS(staticDir), "main.min.*.css")
+ if err != nil || len(matches) == 0 {
+ return fallback
+ }
+ sort.Strings(matches)
+ return "/static/" + matches[len(matches)-1]
+}
+
+// render executes the named page template with the layout, writing an HTML
+// response with the given status. A template execution error is a programming
+// error (bad template or view struct); it is logged and a 500 is written, but
+// never a partially-flushed page — we render into a buffer first.
+func (a *app) render(w http.ResponseWriter, status int, page string, data any) {
+ t, ok := a.templates[page]
+ if !ok {
+ http.Error(w, "template not found", http.StatusInternalServerError)
+ return
+ }
+ var buf strings.Builder
+ if err := t.ExecuteTemplate(&buf, "layout", data); err != nil {
+ http.Error(w, "template render error: "+err.Error(), http.StatusInternalServerError)
+ return
+ }
+ w.Header().Set("Content-Type", "text/html; charset=utf-8")
+ w.WriteHeader(status)
+ _, _ = w.Write([]byte(buf.String()))
+}
+
+// httpStaticHandler serves files from staticDir under the /static/ prefix. It
+// is mounted by the router; in dev (empty staticDir) it 404s every asset.
+func httpStaticHandler(staticDir string) http.Handler {
+ return http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir)))
+}
diff --git a/web/templates/403.html b/web/templates/403.html
new file mode 100644
index 0000000000000000000000000000000000000000..1c794a5c76a120d9fd2115d9074744de2f67733f
--- /dev/null
+++ b/web/templates/403.html
@@ -0,0 +1,6 @@
+{{define "content" -}}
+<div class="header-extension"></div>
+<h2>403 — Forbidden</h2>
+<p>{{if .Message}}{{.Message}}{{else}}You do not have access to this resource.{{end}}</p>
+<p><a href="/">Return to the dashboard</a></p>
+{{- end}}
diff --git a/web/templates/404.html b/web/templates/404.html
new file mode 100644
index 0000000000000000000000000000000000000000..8a6fb5495574de2088834712144c6f3ce9831716
--- /dev/null
+++ b/web/templates/404.html
@@ -0,0 +1,6 @@
+{{define "content" -}}
+<div class="header-extension"></div>
+<h2>404 — Not found</h2>
+<p>The page or database you requested does not exist.</p>
+<p><a href="/">Return to the dashboard</a></p>
+{{- end}}
diff --git a/web/templates/commit.html b/web/templates/commit.html
new file mode 100644
index 0000000000000000000000000000000000000000..4ecbfbe3c706734847d525fc784136468f8c5d31
--- /dev/null
+++ b/web/templates/commit.html
@@ -0,0 +1,33 @@
+{{define "content" -}}
+<h2><a href="/~{{.Repo.OwnerName}}/{{.Repo.Name}}">~{{.Repo.OwnerName}}/{{.Repo.Name}}</a> · commit</h2>
+<p><code>{{.Summary.Hash}}</code></p>
+
+<h4>Table changes</h4>
+{{if .Summary.Tables}}
+<table class="table">
+ <thead>
+ <tr><th>Table</th><th>Change</th><th>Rows +</th><th>Rows −</th><th>Rows ~</th></tr>
+ </thead>
+ <tbody>
+ {{range .Summary.Tables}}
+ <tr>
+ <td>
+ <a href="/~{{$.Repo.OwnerName}}/{{$.Repo.Name}}/table/{{$.Summary.Hash}}/{{.Name}}">{{.Name}}</a>
+ </td>
+ <td>
+ {{if .Added}}<span class="badge badge-success">added</span>{{end}}
+ {{if .Dropped}}<span class="badge badge-danger">dropped</span>{{end}}
+ {{if .SchemaChanged}}<span class="badge badge-warning">schema</span>{{end}}
+ {{if and (not .Added) (not .Dropped) (not .SchemaChanged)}}<span class="badge badge-info">data</span>{{end}}
+ </td>
+ <td>{{.RowsAdded}}</td>
+ <td>{{.RowsRemoved}}</td>
+ <td>{{.RowsModified}}</td>
+ </tr>
+ {{end}}
+ </tbody>
+</table>
+{{else}}
+<p class="text-muted">No table changes.</p>
+{{end}}
+{{- end}}
diff --git a/web/templates/create.html b/web/templates/create.html
new file mode 100644
index 0000000000000000000000000000000000000000..421e193872ed9c30acbb6ba8c7980836dbfe34fb
--- /dev/null
+++ b/web/templates/create.html
@@ -0,0 +1,33 @@
+{{define "content" -}}
+<h2>Create database</h2>
+{{if .Error}}
+<div class="alert alert-danger">{{.Error}}</div>
+{{end}}
+<form method="POST" action="/create">
+ <div class="form-group">
+ <label for="name">Name</label>
+ <input type="text" class="form-control" name="name" id="name"
+ value="{{.Form.Name}}" required
+ pattern="[a-zA-Z0-9](?:[a-zA-Z0-9_-]*[a-zA-Z0-9])?" maxlength="64"
+ autofocus>
+ <small class="form-text text-muted">
+ Letters, digits, hyphen and underscore; must start and end with a letter or
+ digit. This doubles as the SQL database name.
+ </small>
+ </div>
+ <div class="form-group">
+ <label for="description">Description</label>
+ <input type="text" class="form-control" name="description" id="description"
+ value="{{.Form.Description}}" maxlength="1024">
+ </div>
+ <div class="form-group">
+ <label for="visibility">Visibility</label>
+ <select class="form-control" name="visibility" id="visibility">
+ <option value="PUBLIC" {{if eq .Form.Visibility "PUBLIC"}}selected{{end}}>Public — anyone can browse and clone</option>
+ <option value="UNLISTED" {{if eq .Form.Visibility "UNLISTED"}}selected{{end}}>Unlisted — anyone with the link can browse and clone</option>
+ <option value="PRIVATE" {{if eq .Form.Visibility "PRIVATE"}}selected{{end}}>Private — only you and collaborators</option>
+ </select>
+ </div>
+ <button type="submit" class="btn btn-primary">Create</button>
+</form>
+{{- end}}
diff --git a/web/templates/icons/caret-right.svg b/web/templates/icons/caret-right.svg
new file mode 100644
index 0000000000000000000000000000000000000000..39a772deda798608215e24a917dde64c70c93c8d
--- /dev/null
+++ b/web/templates/icons/caret-right.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 192 512"><path d="M0 384.662V127.338c0-17.818 21.543-26.741 34.142-14.142l128.662 128.662c7.81 7.81 7.81 20.474 0 28.284L34.142 398.804C21.543 411.404 0 402.48 0 384.662z"/></svg>
diff --git a/web/templates/icons/circle.svg b/web/templates/icons/circle.svg
new file mode 100644
index 0000000000000000000000000000000000000000..92c0eacc5525ffdeb39b058aaed2bf01f043e3d7
--- /dev/null
+++ b/web/templates/icons/circle.svg
@@ -0,0 +1 @@
+<svg width="22" height="22" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M256 8C119 8 8 119 8 256s111 248 248 248 248-111 248-248S393 8 256 8zm0 448c-110.5 0-200-89.5-200-200S145.5 56 256 56s200 89.5 200 200-89.5 200-200 200z"/></svg>
diff --git a/web/templates/icons/clock.svg b/web/templates/icons/clock.svg
new file mode 100644
index 0000000000000000000000000000000000000000..e4970068ec7aa7c40968d96b06837f9c94768e5a
--- /dev/null
+++ b/web/templates/icons/clock.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M256 8C119 8 8 119 8 256s111 248 248 248 248-111 248-248S393 8 256 8zm0 448c-110.5 0-200-89.5-200-200S145.5 56 256 56s200 89.5 200 200-89.5 200-200 200zm61.8-104.4l-84.9-61.7c-3.1-2.3-4.9-5.9-4.9-9.7V116c0-6.6 5.4-12 12-12h32c6.6 0 12 5.4 12 12v141.7l66.8 48.6c5.4 3.9 6.5 11.4 2.6 16.8L334.6 349c-3.9 5.3-11.4 6.5-16.8 2.6z"/></svg>
diff --git a/web/templates/icons/code-branch.svg b/web/templates/icons/code-branch.svg
new file mode 100644
index 0000000000000000000000000000000000000000..466a1bf6c25dcf36187c59f2d74e8d2dd337eb32
--- /dev/null
+++ b/web/templates/icons/code-branch.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 384 512"><path d="M384 144c0-44.2-35.8-80-80-80s-80 35.8-80 80c0 36.4 24.3 67.1 57.5 76.8-.6 16.1-4.2 28.5-11 36.9-15.4 19.2-49.3 22.4-85.2 25.7-28.2 2.6-57.4 5.4-81.3 16.9v-144c32.5-10.2 56-40.5 56-76.3 0-44.2-35.8-80-80-80S0 35.8 0 80c0 35.8 23.5 66.1 56 76.3v199.3C23.5 365.9 0 396.2 0 432c0 44.2 35.8 80 80 80s80-35.8 80-80c0-34-21.2-63.1-51.2-74.6 3.1-5.2 7.8-9.8 14.9-13.4 16.2-8.2 40.4-10.4 66.1-12.8 42.2-3.9 90-8.4 118.2-43.4 14-17.4 21.1-39.8 21.6-67.9 31.6-10.8 54.4-40.7 54.4-75.9zM80 64c8.8 0 16 7.2 16 16s-7.2 16-16 16-16-7.2-16-16 7.2-16 16-16zm0 384c-8.8 0-16-7.2-16-16s7.2-16 16-16 16 7.2 16 16-7.2 16-16 16zm224-320c8.8 0 16 7.2 16 16s-7.2 16-16 16-16-7.2-16-16 7.2-16 16-16z"/></svg>
diff --git a/web/templates/icons/exclamation-triangle.svg b/web/templates/icons/exclamation-triangle.svg
new file mode 100644
index 0000000000000000000000000000000000000000..be6ddbf56efcd01960fc517b9c605b61ac29d45d
--- /dev/null
+++ b/web/templates/icons/exclamation-triangle.svg
@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 576 512"><path d="M569.517 440.013C587.975 472.007 564.806 512 527.94 512H48.054c-36.937 0-59.999-40.055-41.577-71.987L246.423 23.985c18.467-32.009 64.72-31.951 83.154 0l239.94 416.028zM288 354c-25.405 0-46 20.595-46 46s20.595 46 46 46 46-20.595 46-46-20.595-46-46-46zm-43.673-165.346l7.418 136c.347 6.364 5.609 11.346 11.982 11.346h48.546c6.373 0 11.635-4.982 11.982-11.346l7.418-136c.375-6.874-5.098-12.654-11.982-12.654h-63.383c-6.884 0-12.356 5.78-11.981 12.654z"/></svg>
+<!--
+Font Awesome Free 5.3.1 by @fontawesome - https://fontawesome.com
+License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)
+-->
\ No newline at end of file
diff --git a/web/templates/icons/folder.svg b/web/templates/icons/folder.svg
new file mode 100644
index 0000000000000000000000000000000000000000..5000d70293ed9cef05d5f6ab59c38b1228a19905
--- /dev/null
+++ b/web/templates/icons/folder.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path d="M464 128H272l-64-64H48C21.49 64 0 85.49 0 112v288c0 26.51 21.49 48 48 48h416c26.51 0 48-21.49 48-48V176c0-26.51-21.49-48-48-48z"/></svg>
diff --git a/web/templates/icons/plus-square.svg b/web/templates/icons/plus-square.svg
new file mode 100644
index 0000000000000000000000000000000000000000..5f31c9984409a4cbd6d91a453a7ea0bcdcff101a
--- /dev/null
+++ b/web/templates/icons/plus-square.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M352 240v32c0 6.6-5.4 12-12 12h-88v88c0 6.6-5.4 12-12 12h-32c-6.6 0-12-5.4-12-12v-88h-88c-6.6 0-12-5.4-12-12v-32c0-6.6 5.4-12 12-12h88v-88c0-6.6 5.4-12 12-12h32c6.6 0 12 5.4 12 12v88h88c6.6 0 12 5.4 12 12zm96-160v352c0 26.5-21.5 48-48 48H48c-26.5 0-48-21.5-48-48V80c0-26.5 21.5-48 48-48h352c26.5 0 48 21.5 48 48zm-48 346V86c0-3.3-2.7-6-6-6H54c-3.3 0-6 2.7-6 6v340c0 3.3 2.7 6 6 6h340c3.3 0 6-2.7 6-6z"/></svg>
diff --git a/web/templates/icons/user.svg b/web/templates/icons/user.svg
new file mode 100644
index 0000000000000000000000000000000000000000..e54b3a0a36b03de47e9b07b4d691b66248801418
--- /dev/null
+++ b/web/templates/icons/user.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 448 512"><path d="M224 256c70.7 0 128-57.3 128-128S294.7 0 224 0 96 57.3 96 128s57.3 128 128 128zm89.6 32h-16.7c-22.2 10.2-46.9 16-72.9 16s-50.6-5.8-72.9-16h-16.7C60.2 288 0 348.2 0 422.4V464c0 26.5 21.5 48 48 48h352c26.5 0 48-21.5 48-48v-41.6c0-74.2-60.2-134.4-134.4-134.4z"/></svg>
diff --git a/web/templates/index.html b/web/templates/index.html
new file mode 100644
index 0000000000000000000000000000000000000000..db1229ce42672ae38917617037d8b4c1cb797e6f
--- /dev/null
+++ b/web/templates/index.html
@@ -0,0 +1,26 @@
+{{define "content" -}}
+{{if .CurrentUser}}
+<div class="row">
+ <div class="col-md-8">
+ <h2>Your databases</h2>
+ </div>
+ <div class="col-md-4 text-right">
+ <a href="/create" class="btn btn-primary">{{icon "plus-square"}} Create database</a>
+ </div>
+</div>
+{{template "repoList" .Repos}}
+{{else}}
+<div class="header-extension"></div>
+<h2>{{.SiteName}} <span class="text-danger">{{.SiteLabel}}</span></h2>
+<p>
+ dolt.sr.ht hosts <a href="https://www.dolthub.com/">Dolt</a> databases the way
+ git.sr.ht hosts git repositories: <code>dolt clone</code>, <code>push</code> and
+ <code>pull</code> over HTTPS, with an integrated web UI for browsing branches,
+ commits and tables.
+</p>
+<p>
+ <a href="{{.LoginURL}}" rel="nofollow">Log in</a> to create and manage
+ databases.
+</p>
+{{end}}
+{{- end}}
diff --git a/web/templates/keys.html b/web/templates/keys.html
new file mode 100644
index 0000000000000000000000000000000000000000..a1c004d52d8fa90dff5ca7d38482c494f05f9da7
--- /dev/null
+++ b/web/templates/keys.html
@@ -0,0 +1,69 @@
+{{define "content" -}}
+<h2>Dolt keys</h2>
+{{if .Error}}<div class="alert alert-danger">{{.Error}}</div>{{end}}
+{{if .Notice}}<div class="alert alert-success">{{.Notice}}</div>{{end}}
+
+<p>
+ Associate a dolt Ed25519 credential to clone and push without a personal access
+ token, like a git SSH key. Run:
+</p>
+<pre>dolt creds new
+dolt login --auth-endpoint {{doltHost .SelfOrigin}} --login-url {{.SelfOrigin}}/settings/keys</pre>
+<p>
+ <code>dolt login</code> opens this page with your public key in the URL; the
+ field below is filled in automatically. Without JavaScript, paste the
+ <code>pub key</code> value the command printed.
+</p>
+
+<form method="POST" action="/settings/keys">
+ <div class="form-group">
+ <label for="pubkey">Public key</label>
+ <input type="text" class="form-control" name="pubkey" id="pubkey"
+ autocomplete="off" spellcheck="false">
+ </div>
+ <div class="form-group">
+ <label for="comment">Comment (optional)</label>
+ <input type="text" class="form-control" name="comment" id="comment" maxlength="256">
+ </div>
+ <button type="submit" class="btn btn-primary">Add key</button>
+</form>
+
+<div class="header-extension"></div>
+<h4>Your keys</h4>
+{{if .Keys}}
+<table class="table">
+ <thead><tr><th>Key ID</th><th>Comment</th><th>Added</th><th>Last used</th><th></th></tr></thead>
+ <tbody>
+ {{range .Keys}}
+ <tr>
+ <td><code>{{.KID}}</code></td>
+ <td>{{.Comment}}</td>
+ <td class="text-muted" title="{{.Created | abstime}}">{{.Created | reltime}}</td>
+ <td class="text-muted">{{if .LastUsed}}{{.LastUsed | reltime}}{{else}}never{{end}}</td>
+ <td>
+ <form method="POST" action="/settings/keys" style="display:inline">
+ <input type="hidden" name="delete_id" value="{{.ID}}">
+ <button type="submit" class="btn btn-sm btn-danger">Delete</button>
+ </form>
+ </td>
+ </tr>
+ {{end}}
+ </tbody>
+</table>
+{{else}}
+<p class="text-muted">No keys registered.</p>
+{{end}}
+
+<script>
+ // Prefill the public key from the URL fragment that `dolt login` appends
+ // (#<pubkey-base32>). Progressive enhancement only: the page works without JS.
+ (function () {
+ if (window.location.hash.length > 1) {
+ var field = document.getElementById("pubkey");
+ if (field && !field.value) {
+ field.value = decodeURIComponent(window.location.hash.substring(1));
+ }
+ }
+ })();
+</script>
+{{- end}}
diff --git a/web/templates/layout.html b/web/templates/layout.html
new file mode 100644
index 0000000000000000000000000000000000000000..087fec416521d08252016b1e6bbaae099daef24a
--- /dev/null
+++ b/web/templates/layout.html
@@ -0,0 +1,25 @@
+{{define "layout" -}}
+<!doctype html>
+<html lang="en">
+ <head>
+ <meta charset="utf-8">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <title>{{.Title}}
+
+
+
+
+ {{if .ShowEnvBanner}}
+
+ {{.Environment | upper}} ENVIRONMENT
+
+ {{end}}
+
+
+ {{template "content" .}}
+
+
+