RefactorHEADmaster

11 files changed, 1097 insertions, 0 deletions

diff --git a/forged/internal/incoming/web/handlers/group.go b/forged/internal/incoming/web/handlers/group.go
new file mode 100644
index 0000000..4823cb7
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/group.go
@@ -0,0 +1,156 @@
+package handlers
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"path/filepath"
+	"strconv"
+
+	"github.com/jackc/pgx/v5"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	"go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/templates"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+type GroupHTTP struct {
+	r templates.Renderer
+}
+
+func NewGroupHTTP(r templates.Renderer) *GroupHTTP {
+	return &GroupHTTP{
+		r: r,
+	}
+}
+
+func (h *GroupHTTP) Index(w http.ResponseWriter, r *http.Request, _ wtypes.Vars) {
+	base := wtypes.Base(r)
+	userID, err := strconv.ParseInt(base.UserID, 10, 64)
+	if err != nil {
+		userID = 0
+	}
+
+	queryParams := queries.GetGroupByPathParams{
+		Column1: base.URLSegments,
+		UserID:  userID,
+	}
+	p, err := base.Global.Queries.GetGroupByPath(r.Context(), queryParams)
+	if err != nil {
+		slog.Error("failed to get group ID by path", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	subgroups, err := base.Global.Queries.GetSubgroups(r.Context(), &p.ID)
+	if err != nil {
+		slog.Error("failed to get subgroups", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		// TODO: gracefully fail this part of the page
+	}
+	repos, err := base.Global.Queries.GetReposInGroup(r.Context(), p.ID)
+	if err != nil {
+		slog.Error("failed to get repos in group", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		// TODO: gracefully fail this part of the page
+	}
+	err = h.r.Render(w, "group", struct {
+		BaseData     *wtypes.BaseData
+		Subgroups    []queries.GetSubgroupsRow
+		Repos        []queries.GetReposInGroupRow
+		Description  string
+		DirectAccess bool
+	}{
+		BaseData:     base,
+		Subgroups:    subgroups,
+		Repos:        repos,
+		Description:  p.Description,
+		DirectAccess: p.HasRole,
+	})
+	if err != nil {
+		slog.Error("failed to render index page", "error", err)
+	}
+}
+
+func (h *GroupHTTP) Post(w http.ResponseWriter, r *http.Request, _ wtypes.Vars) {
+	base := wtypes.Base(r)
+	userID, err := strconv.ParseInt(base.UserID, 10, 64)
+	if err != nil {
+		userID = 0
+	}
+
+	queryParams := queries.GetGroupByPathParams{
+		Column1: base.URLSegments,
+		UserID:  userID,
+	}
+	p, err := base.Global.Queries.GetGroupByPath(r.Context(), queryParams)
+	if err != nil {
+		slog.Error("failed to get group ID by path", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	if !p.HasRole {
+		http.Error(w, "You do not have the necessary permissions to create repositories in this group.", http.StatusForbidden)
+		return
+	}
+
+	name := r.PostFormValue("repo_name")
+	desc := r.PostFormValue("repo_desc")
+	contrib := r.PostFormValue("repo_contrib")
+	if name == "" {
+		http.Error(w, "Repo name is required", http.StatusBadRequest)
+		return
+	}
+
+	if contrib == "" || contrib == "public" {
+		contrib = "open"
+	}
+
+	tx, err := base.Global.DB.BeginTx(r.Context(), pgx.TxOptions{})
+	if err != nil {
+		slog.Error("begin tx failed", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = tx.Rollback(r.Context()) }()
+
+	txq := base.Global.Queries.WithTx(tx)
+	var descPtr *string
+	if desc != "" {
+		descPtr = &desc
+	}
+	repoID, err := txq.InsertRepo(r.Context(), queries.InsertRepoParams{
+		GroupID:             p.ID,
+		Name:                name,
+		Description:         descPtr,
+		ContribRequirements: contrib,
+	})
+	if err != nil {
+		slog.Error("insert repo failed", "error", err)
+		http.Error(w, "Failed to create repository", http.StatusInternalServerError)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoID))
+
+	gitc, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err != nil {
+		slog.Error("git2d connect failed", "error", err)
+		http.Error(w, "Failed to initialize repository (backend)", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = gitc.Close() }()
+	if err = gitc.InitRepo(repoPath, base.Global.Config.Hooks.Execs); err != nil {
+		slog.Error("git2d init failed", "error", err)
+		http.Error(w, "Failed to initialize repository", http.StatusInternalServerError)
+		return
+	}
+
+	if err = tx.Commit(r.Context()); err != nil {
+		slog.Error("commit tx failed", "error", err)
+		http.Error(w, "Failed to finalize repository creation", http.StatusInternalServerError)
+		return
+	}
+
+	http.Redirect(w, r, r.URL.Path, http.StatusSeeOther)
+}
diff --git a/forged/internal/incoming/web/handlers/index.go b/forged/internal/incoming/web/handlers/index.go
new file mode 100644
index 0000000..a758b07
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/index.go
@@ -0,0 +1,39 @@
+package handlers
+
+import (
+	"log"
+	"net/http"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	"go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/templates"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+)
+
+type IndexHTTP struct {
+	r templates.Renderer
+}
+
+func NewIndexHTTP(r templates.Renderer) *IndexHTTP {
+	return &IndexHTTP{
+		r: r,
+	}
+}
+
+func (h *IndexHTTP) Index(w http.ResponseWriter, r *http.Request, _ wtypes.Vars) {
+	groups, err := wtypes.Base(r).Global.Queries.GetRootGroups(r.Context())
+	if err != nil {
+		http.Error(w, "failed to get root groups", http.StatusInternalServerError)
+		log.Println("failed to get root groups", "error", err)
+		return
+	}
+	err = h.r.Render(w, "index", struct {
+		BaseData *wtypes.BaseData
+		Groups   []queries.GetRootGroupsRow
+	}{
+		BaseData: wtypes.Base(r),
+		Groups:   groups,
+	})
+	if err != nil {
+		log.Println("failed to render index page", "error", err)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/not_implemented.go b/forged/internal/incoming/web/handlers/not_implemented.go
new file mode 100644
index 0000000..6813c88
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/not_implemented.go
@@ -0,0 +1,22 @@
+package handlers
+
+import (
+	"net/http"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/templates"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+)
+
+type NotImplementedHTTP struct {
+	r templates.Renderer
+}
+
+func NewNotImplementedHTTP(r templates.Renderer) *NotImplementedHTTP {
+	return &NotImplementedHTTP{
+		r: r,
+	}
+}
+
+func (h *NotImplementedHTTP) Handle(w http.ResponseWriter, _ *http.Request, _ wtypes.Vars) {
+	http.Error(w, "not implemented", http.StatusNotImplemented)
+}
diff --git a/forged/internal/incoming/web/handlers/repo/branches.go b/forged/internal/incoming/web/handlers/repo/branches.go
new file mode 100644
index 0000000..26f3b04
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/branches.go
@@ -0,0 +1,68 @@
+package repo
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path/filepath"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+func (h *HTTP) Branches(w http.ResponseWriter, r *http.Request, v wtypes.Vars) {
+	base := wtypes.Base(r)
+	repoName := v["repo"]
+
+	var userID int64
+	if base.UserID != "" {
+		_, _ = fmt.Sscan(base.UserID, &userID)
+	}
+	grp, err := base.Global.Queries.GetGroupByPath(r.Context(), queries.GetGroupByPathParams{Column1: base.GroupPath, UserID: userID})
+	if err != nil {
+		slog.Error("get group by path", "error", err)
+		http.Error(w, "Group not found", http.StatusNotFound)
+		return
+	}
+	repoRow, err := base.Global.Queries.GetRepoByGroupAndName(r.Context(), queries.GetRepoByGroupAndNameParams{GroupID: grp.ID, Name: repoName})
+	if err != nil {
+		slog.Error("get repo by name", "error", err)
+		http.Error(w, "Repository not found", http.StatusNotFound)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoRow.ID))
+	client, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err != nil {
+		slog.Error("git2d connect failed", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = client.Close() }()
+
+	branches, err := client.ListBranches(repoPath)
+	if err != nil {
+		slog.Error("list branches failed", "error", err)
+		branches = nil
+	}
+
+	repoURLRoot := "/" + misc.SegmentsToURL(base.GroupPath) + "/-/repos/" + url.PathEscape(repoRow.Name) + "/"
+	data := map[string]any{
+		"BaseData":         base,
+		"group_path":       base.GroupPath,
+		"repo_name":        repoRow.Name,
+		"repo_description": repoRow.Description,
+		"repo_url_root":    repoURLRoot,
+		"branches":         branches,
+		"global": map[string]any{
+			"forge_title": base.Global.ForgeTitle,
+		},
+	}
+	if err := h.r.Render(w, "repo_branches", data); err != nil {
+		slog.Error("render repo branches", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/repo/commit.go b/forged/internal/incoming/web/handlers/repo/commit.go
new file mode 100644
index 0000000..0a27f3b
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/commit.go
@@ -0,0 +1,239 @@
+package repo
+
+import (
+	"crypto/sha1"
+	"encoding/hex"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+type commitPerson struct {
+	Name  string
+	Email string
+	When  time.Time
+}
+
+type commitObject struct {
+	Hash      string
+	Message   string
+	Author    commitPerson
+	Committer commitPerson
+}
+
+type usableChunk struct {
+	Operation int
+	Content   string
+}
+
+type diffFileMeta struct {
+	Hash string
+	Mode string
+	Path string
+}
+
+type usableFilePatch struct {
+	From   diffFileMeta
+	To     diffFileMeta
+	Chunks []usableChunk
+}
+
+func shortHash(s string) string {
+	if s == "" {
+		return ""
+	}
+	b := sha1.Sum([]byte(s))
+	return hex.EncodeToString(b[:8])
+}
+
+func parseUnifiedPatch(p string) []usableFilePatch {
+	lines := strings.Split(p, "\n")
+	patches := []usableFilePatch{}
+	var cur *usableFilePatch
+	flush := func() {
+		if cur != nil {
+			patches = append(patches, *cur)
+			cur = nil
+		}
+	}
+	appendChunk := func(op int, buf *[]string) {
+		if len(*buf) == 0 || cur == nil {
+			return
+		}
+		content := strings.Join(*buf, "\n")
+		*buf = (*buf)[:0]
+		cur.Chunks = append(cur.Chunks, usableChunk{Operation: op, Content: content})
+	}
+	var bufSame, bufAdd, bufDel []string
+
+	for _, ln := range lines {
+		if strings.HasPrefix(ln, "diff --git ") {
+			appendChunk(0, &bufSame)
+			appendChunk(1, &bufAdd)
+			appendChunk(2, &bufDel)
+			flush()
+			parts := strings.SplitN(strings.TrimPrefix(ln, "diff --git "), " ", 2)
+			from := strings.TrimPrefix(strings.TrimSpace(parts[0]), "a/")
+			to := from
+			if len(parts) > 1 {
+				to = strings.TrimPrefix(strings.TrimSpace(strings.TrimPrefix(parts[1], "b/")), "b/")
+			}
+			cur = &usableFilePatch{
+				From: diffFileMeta{Path: from, Hash: shortHash(from)},
+				To:   diffFileMeta{Path: to, Hash: shortHash(to)},
+			}
+			continue
+		}
+		if cur == nil {
+			continue
+		}
+		switch {
+		case strings.HasPrefix(ln, "+"):
+			appendChunk(0, &bufSame)
+			appendChunk(2, &bufDel)
+			bufAdd = append(bufAdd, ln)
+		case strings.HasPrefix(ln, "-"):
+			appendChunk(0, &bufSame)
+			appendChunk(1, &bufAdd)
+			bufDel = append(bufDel, ln)
+		default:
+			appendChunk(1, &bufAdd)
+			appendChunk(2, &bufDel)
+			bufSame = append(bufSame, ln)
+		}
+	}
+	if cur != nil {
+		appendChunk(0, &bufSame)
+		appendChunk(1, &bufAdd)
+		appendChunk(2, &bufDel)
+		flush()
+	}
+	return patches
+}
+
+func (h *HTTP) Commit(w http.ResponseWriter, r *http.Request, v wtypes.Vars) {
+	base := wtypes.Base(r)
+	repoName := v["repo"]
+	commitSpec := v["commit"]
+	wantPatch := strings.HasSuffix(commitSpec, ".patch")
+	commitSpec = strings.TrimSuffix(commitSpec, ".patch")
+
+	var userID int64
+	if base.UserID != "" {
+		_, _ = fmt.Sscan(base.UserID, &userID)
+	}
+	grp, err := base.Global.Queries.GetGroupByPath(r.Context(), queries.GetGroupByPathParams{Column1: base.GroupPath, UserID: userID})
+	if err != nil {
+		slog.Error("get group by path", "error", err)
+		http.Error(w, "Group not found", http.StatusNotFound)
+		return
+	}
+	repoRow, err := base.Global.Queries.GetRepoByGroupAndName(r.Context(), queries.GetRepoByGroupAndNameParams{GroupID: grp.ID, Name: repoName})
+	if err != nil {
+		slog.Error("get repo by name", "error", err)
+		http.Error(w, "Repository not found", http.StatusNotFound)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoRow.ID))
+	client, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err != nil {
+		slog.Error("git2d connect failed", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = client.Close() }()
+
+	resolved := commitSpec
+	if len(commitSpec) < 40 {
+		if list, lerr := client.Log(repoPath, commitSpec, 1); lerr == nil && len(list) > 0 {
+			resolved = list[0].Hash
+		}
+	}
+	if !wantPatch && resolved != "" && resolved != commitSpec {
+		u := *r.URL
+		basePath := strings.TrimSuffix(u.EscapedPath(), commitSpec)
+		u.Path = basePath + resolved
+		http.Redirect(w, r, u.String(), http.StatusSeeOther)
+		return
+	}
+
+	if wantPatch {
+		patchStr, perr := client.FormatPatch(repoPath, resolved)
+		if perr != nil {
+			slog.Error("format patch failed", "error", perr)
+			http.Error(w, "Failed to format patch", http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		_, _ = w.Write([]byte(patchStr))
+		return
+	}
+
+	info, derr := client.CommitInfo(repoPath, resolved)
+	if derr != nil {
+		slog.Error("commit info failed", "error", derr)
+		http.Error(w, "Failed to get commit info", http.StatusInternalServerError)
+		return
+	}
+
+	toTime := func(sec, minoff int64) time.Time {
+		loc := time.FixedZone("", int(minoff*60))
+		return time.Unix(sec, 0).In(loc)
+	}
+	co := commitObject{
+		Hash:      info.Hash,
+		Message:   info.Message,
+		Author:    commitPerson{Name: info.AuthorName, Email: info.AuthorEmail, When: toTime(info.AuthorWhen, info.AuthorTZMin)},
+		Committer: commitPerson{Name: info.CommitterName, Email: info.CommitterEmail, When: toTime(info.CommitterWhen, info.CommitterTZMin)},
+	}
+
+	toUsable := func(files []git2c.FileDiff) []usableFilePatch {
+		out := make([]usableFilePatch, 0, len(files))
+		for _, f := range files {
+			u := usableFilePatch{
+				From: diffFileMeta{Path: f.FromPath, Mode: fmt.Sprintf("%06o", f.FromMode), Hash: shortHash(f.FromPath)},
+				To:   diffFileMeta{Path: f.ToPath, Mode: fmt.Sprintf("%06o", f.ToMode), Hash: shortHash(f.ToPath)},
+			}
+			for _, ch := range f.Chunks {
+				u.Chunks = append(u.Chunks, usableChunk{Operation: int(ch.Op), Content: ch.Content})
+			}
+			out = append(out, u)
+		}
+		return out
+	}
+	filePatches := toUsable(info.Files)
+	parentHex := ""
+	if len(info.Parents) > 0 {
+		parentHex = info.Parents[0]
+	}
+
+	repoURLRoot := "/" + misc.SegmentsToURL(base.GroupPath) + "/-/repos/" + url.PathEscape(repoRow.Name) + "/"
+	data := map[string]any{
+		"BaseData":           base,
+		"group_path":         base.GroupPath,
+		"repo_name":          repoRow.Name,
+		"repo_description":   repoRow.Description,
+		"repo_url_root":      repoURLRoot,
+		"commit_object":      co,
+		"commit_id":          co.Hash,
+		"parent_commit_hash": parentHex,
+		"file_patches":       filePatches,
+		"global": map[string]any{
+			"forge_title": base.Global.ForgeTitle,
+		},
+	}
+	if err := h.r.Render(w, "repo_commit", data); err != nil {
+		slog.Error("render repo commit", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/repo/handler.go b/forged/internal/incoming/web/handlers/repo/handler.go
new file mode 100644
index 0000000..2881d7d
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/handler.go
@@ -0,0 +1,15 @@
+package repo
+
+import (
+	"go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/templates"
+)
+
+type HTTP struct {
+	r templates.Renderer
+}
+
+func NewHTTP(r templates.Renderer) *HTTP {
+	return &HTTP{
+		r: r,
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/repo/index.go b/forged/internal/incoming/web/handlers/repo/index.go
new file mode 100644
index 0000000..c2cb24a
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/index.go
@@ -0,0 +1,132 @@
+package repo
+
+import (
+	"bytes"
+	"fmt"
+	"html/template"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+
+	"github.com/yuin/goldmark"
+	"github.com/yuin/goldmark/extension"
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+func (h *HTTP) Index(w http.ResponseWriter, r *http.Request, v wtypes.Vars) {
+	base := wtypes.Base(r)
+	repoName := v["repo"]
+	slog.Info("repo index", "group_path", base.GroupPath, "repo", repoName)
+
+	var userID int64
+	if base.UserID != "" {
+		_, _ = fmt.Sscan(base.UserID, &userID)
+	}
+	grp, err := base.Global.Queries.GetGroupByPath(r.Context(), queries.GetGroupByPathParams{
+		Column1: base.GroupPath,
+		UserID:  userID,
+	})
+	if err != nil {
+		slog.Error("get group by path", "error", err)
+		http.Error(w, "Group not found", http.StatusNotFound)
+		return
+	}
+
+	repoRow, err := base.Global.Queries.GetRepoByGroupAndName(r.Context(), queries.GetRepoByGroupAndNameParams{
+		GroupID: grp.ID,
+		Name:    repoName,
+	})
+	if err != nil {
+		slog.Error("get repo by name", "error", err)
+		http.Error(w, "Repository not found", http.StatusNotFound)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoRow.ID))
+
+	var commits []git2c.Commit
+	var readme template.HTML
+	var commitsErr error
+	var readmeFile *git2c.FilenameContents
+	var cerr error
+	client, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err == nil {
+		defer func() { _ = client.Close() }()
+		commits, readmeFile, cerr = client.CmdIndex(repoPath)
+		if cerr != nil {
+			commitsErr = cerr
+			slog.Error("git2d CmdIndex failed", "error", cerr, "path", repoPath)
+		} else if readmeFile != nil {
+			nameLower := strings.ToLower(readmeFile.Filename)
+			if strings.HasSuffix(nameLower, ".md") || strings.HasSuffix(nameLower, ".markdown") || nameLower == "readme" {
+				md := goldmark.New(
+					goldmark.WithExtensions(extension.GFM),
+				)
+				var buf bytes.Buffer
+				if err := md.Convert(readmeFile.Content, &buf); err == nil {
+					readme = template.HTML(buf.String())
+				} else {
+					readme = template.HTML(template.HTMLEscapeString(string(readmeFile.Content)))
+				}
+			} else {
+				readme = template.HTML(template.HTMLEscapeString(string(readmeFile.Content)))
+			}
+		}
+	} else {
+		commitsErr = err
+		slog.Error("git2d connect failed", "error", err)
+	}
+
+	sshRoot := strings.TrimSuffix(base.Global.Config.SSH.Root, "/")
+	httpRoot := strings.TrimSuffix(base.Global.Config.Web.Root, "/")
+	pathPart := misc.SegmentsToURL(base.GroupPath) + "/-/repos/" + url.PathEscape(repoRow.Name)
+	sshURL := ""
+	httpURL := ""
+	if sshRoot != "" {
+		sshURL = sshRoot + "/" + pathPart
+	}
+	if httpRoot != "" {
+		httpURL = httpRoot + "/" + pathPart
+	}
+
+	var notes []string
+	if len(commits) == 0 && commitsErr == nil {
+		notes = append(notes, "This repository has no commits yet.")
+	}
+	if readme == template.HTML("") {
+		notes = append(notes, "No README found in the default branch.")
+	}
+	if sshURL == "" && httpURL == "" {
+		notes = append(notes, "Clone URLs not configured (missing SSH root and HTTP root).")
+	}
+
+	cloneURL := sshURL
+	if cloneURL == "" {
+		cloneURL = httpURL
+	}
+
+	data := map[string]any{
+		"BaseData":         base,
+		"group_path":       base.GroupPath,
+		"repo_name":        repoRow.Name,
+		"repo_description": repoRow.Description,
+		"ssh_clone_url":    cloneURL,
+		"ref_name":         base.RefName,
+		"commits":          commits,
+		"commits_err":      &commitsErr,
+		"readme":           readme,
+		"notes":            notes,
+		"global": map[string]any{
+			"forge_title": base.Global.ForgeTitle,
+		},
+	}
+	if err := h.r.Render(w, "repo_index", data); err != nil {
+		slog.Error("render repo index", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/repo/log.go b/forged/internal/incoming/web/handlers/repo/log.go
new file mode 100644
index 0000000..9a1a6b8
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/log.go
@@ -0,0 +1,107 @@
+package repo
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"time"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+type logAuthor struct {
+	Name  string
+	Email string
+	When  time.Time
+}
+
+type logCommit struct {
+	Hash    string
+	Message string
+	Author  logAuthor
+}
+
+func (h *HTTP) Log(w http.ResponseWriter, r *http.Request, v wtypes.Vars) {
+	base := wtypes.Base(r)
+	repoName := v["repo"]
+
+	var userID int64
+	if base.UserID != "" {
+		_, _ = fmt.Sscan(base.UserID, &userID)
+	}
+	grp, err := base.Global.Queries.GetGroupByPath(r.Context(), queries.GetGroupByPathParams{Column1: base.GroupPath, UserID: userID})
+	if err != nil {
+		slog.Error("get group by path", "error", err)
+		http.Error(w, "Group not found", http.StatusNotFound)
+		return
+	}
+	repoRow, err := base.Global.Queries.GetRepoByGroupAndName(r.Context(), queries.GetRepoByGroupAndNameParams{GroupID: grp.ID, Name: repoName})
+	if err != nil {
+		slog.Error("get repo by name", "error", err)
+		http.Error(w, "Repository not found", http.StatusNotFound)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoRow.ID))
+	client, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err != nil {
+		slog.Error("git2d connect failed", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = client.Close() }()
+
+	var refspec string
+	if base.RefType == "" {
+		refspec = ""
+	} else {
+		hex, rerr := client.ResolveRef(repoPath, base.RefType, base.RefName)
+		if rerr != nil {
+			slog.Error("resolve ref failed", "error", rerr)
+			refspec = ""
+		} else {
+			refspec = hex
+		}
+	}
+
+	var rawCommits []git2c.Commit
+	rawCommits, err = client.Log(repoPath, refspec, 0)
+	var commitsErr error
+	if err != nil {
+		commitsErr = err
+		slog.Error("git2d log failed", "error", err)
+	}
+	commits := make([]logCommit, 0, len(rawCommits))
+	for _, c := range rawCommits {
+		when, _ := time.Parse("2006-01-02 15:04:05", c.Date)
+		commits = append(commits, logCommit{
+			Hash:    c.Hash,
+			Message: c.Message,
+			Author:  logAuthor{Name: c.Author, Email: c.Email, When: when},
+		})
+	}
+
+	repoURLRoot := "/" + misc.SegmentsToURL(base.GroupPath) + "/-/repos/" + url.PathEscape(repoRow.Name) + "/"
+	data := map[string]any{
+		"BaseData":         base,
+		"group_path":       base.GroupPath,
+		"repo_name":        repoRow.Name,
+		"repo_description": repoRow.Description,
+		"repo_url_root":    repoURLRoot,
+		"ref_name":         base.RefName,
+		"commits":          commits,
+		"commits_err":      &commitsErr,
+		"global": map[string]any{
+			"forge_title": base.Global.ForgeTitle,
+		},
+	}
+	if err := h.r.Render(w, "repo_log", data); err != nil {
+		slog.Error("render repo log", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/repo/raw.go b/forged/internal/incoming/web/handlers/repo/raw.go
new file mode 100644
index 0000000..6d5db1e
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/raw.go
@@ -0,0 +1,90 @@
+package repo
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+func (h *HTTP) Raw(w http.ResponseWriter, r *http.Request, v wtypes.Vars) {
+	base := wtypes.Base(r)
+	repoName := v["repo"]
+	rawPathSpec := v["rest"]
+	pathSpec := strings.TrimSuffix(rawPathSpec, "/")
+
+	var userID int64
+	if base.UserID != "" {
+		_, _ = fmt.Sscan(base.UserID, &userID)
+	}
+	grp, err := base.Global.Queries.GetGroupByPath(r.Context(), queries.GetGroupByPathParams{Column1: base.GroupPath, UserID: userID})
+	if err != nil {
+		slog.Error("get group by path", "error", err)
+		http.Error(w, "Group not found", http.StatusNotFound)
+		return
+	}
+	repoRow, err := base.Global.Queries.GetRepoByGroupAndName(r.Context(), queries.GetRepoByGroupAndNameParams{GroupID: grp.ID, Name: repoName})
+	if err != nil {
+		slog.Error("get repo by name", "error", err)
+		http.Error(w, "Repository not found", http.StatusNotFound)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoRow.ID))
+
+	client, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err != nil {
+		slog.Error("git2d connect failed", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = client.Close() }()
+
+	files, content, err := client.CmdTreeRaw(repoPath, pathSpec)
+	if err != nil {
+		slog.Error("git2d CmdTreeRaw failed", "error", err, "path", repoPath, "spec", pathSpec)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	repoURLRoot := "/" + misc.SegmentsToURL(base.GroupPath) + "/-/repos/" + url.PathEscape(repoRow.Name) + "/"
+
+	switch {
+	case files != nil:
+		if !base.DirMode && misc.RedirectDir(w, r) {
+			return
+		}
+		data := map[string]any{
+			"BaseData":         base,
+			"group_path":       base.GroupPath,
+			"repo_name":        repoRow.Name,
+			"repo_description": repoRow.Description,
+			"repo_url_root":    repoURLRoot,
+			"ref_name":         base.RefName,
+			"path_spec":        pathSpec,
+			"files":            files,
+			"global": map[string]any{
+				"forge_title": base.Global.ForgeTitle,
+			},
+		}
+		if err := h.r.Render(w, "repo_raw_dir", data); err != nil {
+			slog.Error("render repo raw dir", "error", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	case content != "":
+		if base.DirMode && misc.RedirectNoDir(w, r) {
+			return
+		}
+		w.Header().Set("Content-Type", "application/octet-stream")
+		_, _ = w.Write([]byte(content))
+	default:
+		http.Error(w, "Unknown object type", http.StatusInternalServerError)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/repo/tree.go b/forged/internal/incoming/web/handlers/repo/tree.go
new file mode 100644
index 0000000..627c998
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/repo/tree.go
@@ -0,0 +1,110 @@
+package repo
+
+import (
+	"fmt"
+	"html/template"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"strings"
+
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+	"go.lindenii.runxiyu.org/forge/forged/internal/ipc/git2c"
+)
+
+func (h *HTTP) Tree(w http.ResponseWriter, r *http.Request, v wtypes.Vars) {
+	base := wtypes.Base(r)
+	repoName := v["repo"]
+	rawPathSpec := v["rest"]
+	pathSpec := strings.TrimSuffix(rawPathSpec, "/")
+
+	var userID int64
+	if base.UserID != "" {
+		_, _ = fmt.Sscan(base.UserID, &userID)
+	}
+	grp, err := base.Global.Queries.GetGroupByPath(r.Context(), queries.GetGroupByPathParams{Column1: base.GroupPath, UserID: userID})
+	if err != nil {
+		slog.Error("get group by path", "error", err)
+		http.Error(w, "Group not found", http.StatusNotFound)
+		return
+	}
+	repoRow, err := base.Global.Queries.GetRepoByGroupAndName(r.Context(), queries.GetRepoByGroupAndNameParams{GroupID: grp.ID, Name: repoName})
+	if err != nil {
+		slog.Error("get repo by name", "error", err)
+		http.Error(w, "Repository not found", http.StatusNotFound)
+		return
+	}
+
+	repoPath := filepath.Join(base.Global.Config.Git.RepoDir, fmt.Sprintf("%d.git", repoRow.ID))
+
+	client, err := git2c.NewClient(r.Context(), base.Global.Config.Git.Socket)
+	if err != nil {
+		slog.Error("git2d connect failed", "error", err)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+	defer func() { _ = client.Close() }()
+
+	files, content, err := client.CmdTreeRaw(repoPath, pathSpec)
+	if err != nil {
+		slog.Error("git2d CmdTreeRaw failed", "error", err, "path", repoPath, "spec", pathSpec)
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		return
+	}
+
+	repoURLRoot := "/" + misc.SegmentsToURL(base.GroupPath) + "/-/repos/" + url.PathEscape(repoRow.Name) + "/"
+
+	switch {
+	case files != nil:
+		if !base.DirMode && misc.RedirectDir(w, r) {
+			return
+		}
+		data := map[string]any{
+			"BaseData":         base,
+			"group_path":       base.GroupPath,
+			"repo_name":        repoRow.Name,
+			"repo_description": repoRow.Description,
+			"repo_url_root":    repoURLRoot,
+			"ref_name":         base.RefName,
+			"path_spec":        pathSpec,
+			"files":            files,
+			"readme_filename":  "README.md",
+			"readme":           template.HTML("<p>README rendering here is WIP.</p>"),
+			"global": map[string]any{
+				"forge_title": base.Global.ForgeTitle,
+			},
+		}
+		if err := h.r.Render(w, "repo_tree_dir", data); err != nil {
+			slog.Error("render repo tree dir", "error", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	case content != "":
+		if base.DirMode && misc.RedirectNoDir(w, r) {
+			return
+		}
+		escaped := template.HTMLEscapeString(content)
+		rendered := template.HTML("<pre class=\"chroma\"><code>" + escaped + "</code></pre>")
+		data := map[string]any{
+			"BaseData":         base,
+			"group_path":       base.GroupPath,
+			"repo_name":        repoRow.Name,
+			"repo_description": repoRow.Description,
+			"repo_url_root":    repoURLRoot,
+			"ref_name":         base.RefName,
+			"path_spec":        pathSpec,
+			"file_contents":    rendered,
+			"global": map[string]any{
+				"forge_title": base.Global.ForgeTitle,
+			},
+		}
+		if err := h.r.Render(w, "repo_tree_file", data); err != nil {
+			slog.Error("render repo tree file", "error", err)
+			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+		}
+	default:
+		http.Error(w, "Unknown object type", http.StatusInternalServerError)
+	}
+}
diff --git a/forged/internal/incoming/web/handlers/special/login.go b/forged/internal/incoming/web/handlers/special/login.go
new file mode 100644
index 0000000..5672f1f
--- /dev/null
+++ b/forged/internal/incoming/web/handlers/special/login.go
@@ -0,0 +1,119 @@
+package handlers
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"errors"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/argon2id"
+	"go.lindenii.runxiyu.org/forge/forged/internal/common/misc"
+	"go.lindenii.runxiyu.org/forge/forged/internal/database/queries"
+	"go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/templates"
+	wtypes "go.lindenii.runxiyu.org/forge/forged/internal/incoming/web/types"
+)
+
+type LoginHTTP struct {
+	r            templates.Renderer
+	cookieExpiry int
+}
+
+func NewLoginHTTP(r templates.Renderer, cookieExpiry int) *LoginHTTP {
+	return &LoginHTTP{
+		r:            r,
+		cookieExpiry: cookieExpiry,
+	}
+}
+
+func (h *LoginHTTP) Login(w http.ResponseWriter, r *http.Request, _ wtypes.Vars) {
+	renderLoginPage := func(loginError string) bool {
+		err := h.r.Render(w, "login", struct {
+			BaseData   *wtypes.BaseData
+			LoginError string
+		}{
+			BaseData:   wtypes.Base(r),
+			LoginError: loginError,
+		})
+		if err != nil {
+			log.Println("failed to render login page", "error", err)
+			http.Error(w, "Failed to render login page", http.StatusInternalServerError)
+			return true
+		}
+		return false
+	}
+
+	if r.Method == http.MethodGet {
+		renderLoginPage("")
+		return
+	}
+
+	username := r.PostFormValue("username")
+	password := r.PostFormValue("password")
+
+	userCreds, err := wtypes.Base(r).Global.Queries.GetUserCreds(r.Context(), &username)
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			renderLoginPage("User not found")
+			return
+		}
+		log.Println("failed to get user credentials", "error", err)
+		http.Error(w, "Failed to get user credentials", http.StatusInternalServerError)
+		return
+	}
+
+	if userCreds.PasswordHash == "" {
+		renderLoginPage("No password set for this user")
+		return
+	}
+
+	passwordMatches, err := argon2id.ComparePasswordAndHash(password, userCreds.PasswordHash)
+	if err != nil {
+		log.Println("failed to compare password and hash", "error", err)
+		http.Error(w, "Failed to verify password", http.StatusInternalServerError)
+		return
+	}
+
+	if !passwordMatches {
+		renderLoginPage("Invalid password")
+		return
+	}
+
+	cookieValue := rand.Text()
+
+	now := time.Now()
+	expiry := now.Add(time.Duration(h.cookieExpiry) * time.Second)
+
+	cookie := &http.Cookie{
+		Name:     "session",
+		Value:    cookieValue,
+		SameSite: http.SameSiteLaxMode,
+		HttpOnly: true,
+		Secure:   false, // TODO
+		Expires:  expiry,
+		Path:     "/",
+	} //exhaustruct:ignore
+
+	http.SetCookie(w, cookie)
+
+	tokenHash := sha256.Sum256(misc.StringToBytes(cookieValue))
+
+	err = wtypes.Base(r).Global.Queries.InsertSession(r.Context(), queries.InsertSessionParams{
+		UserID:    userCreds.ID,
+		TokenHash: tokenHash[:],
+		ExpiresAt: pgtype.Timestamptz{
+			Time:  expiry,
+			Valid: true,
+		},
+	})
+	if err != nil {
+		log.Println("failed to insert session", "error", err)
+		http.Error(w, "Failed to create session", http.StatusInternalServerError)
+		return
+	}
+
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}