--

 --	loona - tiny CMS

 --	Written by Timm S. Mueller <tmueller at neoscientists.org>

 --	See copyright notice in COPYRIGHT

 --

 local Class = require "tek.class"

 local lib = require "tek.lib"

 local luahtml = require "tek.lib.luahtml"

 local posix = require "tek.os.posix"

 local cgi = require "tek.class.cgi"

 local Request = require "tek.class.cgi.request"

 local util = require "tek.class.loona.util"

 local Markup = require "tek.class.markup"

 local boxed_G = {

 	string = string, table = table,

 	assert = assert, collectgarbage = collectgarbage, dofile = dofile,

 	error = error, getfenv = getfenv, getmetatable = getmetatable,

 	ipairs = ipairs, load = load, loadfile = loadfile, loadstring = loadstring,

 	next = next, pairs = pairs, pcall = pcall, print = print,

 	rawequal = rawequal, rawget = rawget, rawset = rawset, require = require,

 	select = select, setfenv = setfenv, setmetatable = setmetatable,

 	tonumber = tonumber, tostring = tostring, type = type, unpack = unpack,

 	xpcall = xpcall

 }

 local table, string, assert, unpack, ipairs, pairs, type, require, setfenv =

 	table, string, assert, unpack, ipairs, pairs, type, require, setfenv

 local open, remove, rename, getenv, time, date =

 	io.open, os.remove, os.rename, os.getenv, os.time, os.date

 local setmetatable = setmetatable

 -------------------------------------------------------------------------------

 --	Module setup:

 -------------------------------------------------------------------------------

 module("tek.class.loona", Class)

 _VERSION = "LOona Class 5.1"

 -------------------------------------------------------------------------------

 --	Markup:

 -------------------------------------------------------------------------------

 Markup = Markup:newClass()

 function Markup:init()

 	self.depth = 1

 	return ''

 end

 function Markup:exit()

 	return ''

 end

 function Markup:argument(name, text)

 	return ', function()%>', '<%end'

 end

 function Markup:func(is_dynamic, args)

 	if is_dynamic then

 		self.is_dynamic_content = true

 	end

 	local t = { '<%loona:include("', args[1], '"' }

 	table.remove(args, 1)

 	for _, v in ipairs(args) do

 		table.insert(t, ',' .. v)

 	end

 	return table.concat(t), ')%>'

 end

 function Markup:link(link)

 	local func = link:match("^(.*)%(%)$")

 	if func then

 		return '<%=loona:link("' .. '#' .. self:encodeurl(func, true) .. '", [[', ']])%>'

 	elseif link:match("^%a*://.*$") then

 		return '<%=loona:elink("' .. self:encodeurl(link, true) .. '", [[', ']])%>'

 	else

 		return '<%=loona:link("' .. link .. '", [[', ']])%>'

 	end

 end

 function Markup:indent()

 	return '<div class="indent">', '</div>'

 end

 -------------------------------------------------------------------------------

 --	class Session:

 -------------------------------------------------------------------------------

 local Session = Class:newClass()

 function Session.new(class, self)

 	self = Class.new(class, self or { })

 	assert(self.id, "No session Id")

  	assert(self.sessiondir, "No session directory")

 	self.name = self.id:gsub("(.)", function(a)

 		return ("%02x"):format(a:byte())

 	end)

 	self.filename = self.sessiondir .. "/" .. self.name

 	-- remove non-dotted files (expired sessions) from sessions dir:

 	util.expire(self.sessiondir, "[^.]%S+", self.maxage or 600)

 	-- load session state:

 	self.data = lib.source(self.filename) or { }

 	return self

 end

 function Session:save()

 	local f = open(self.filename, "wb")

 	assert(f, "Failed to open session file for writing")

 	lib.dump(self.data, function(...)

 		f:write(...)

 	end)

 	f:close()

 end

 function Session:delete()

 	remove(self.filename)

 end

 -------------------------------------------------------------------------------

 --	class Loona

 -------------------------------------------------------------------------------

 local Loona = _M

 function Loona:dbmsg(msg, detail)

  	return (msg and detail and self.authuser) and

  		("%s : %s"):format(msg, detail) or msg

 end

 function Loona:checkprofilename(n)

 	assert(n:match("^%w+$") and n ~= "current",

 		self:dbmsg("Invalid profile name", n))

 	return n

 end

 function Loona:checklanguage(n)

 	assert(n:match("^%l%l$"), self:dbmsg("Invalid language code", n))

 	return n

 end

 function Loona:checkbodyname(s)

 	s = s or "main"

 	assert(s:match("^[%w_]*%w+[%w_]*$"), self:dbmsg("Invalid body name", s))

 	return s

 end

 function Loona:deleteprofile(p, lang)

 	p = self.config.contentdir .. "/" .. p .. "_" .. (lang or self.lang)

 	for e in util.readdir(p) do

  		local success, msg = remove(p .. "/" .. e)

 		assert(success, self:dbmsg("Error removing entry in profile", msg))

 	end

 	return remove(p)

 end

 function Loona:copyprofile(dstprof, srcprof, dstlang, srclang)

 	local contentdir = self.config.contentdir

 	local src = ("%s/%s_%s"):format(contentdir,

 		srcprof or self.profile, srclang or self.lang)

 	local dst = ("%s/%s_%s"):format(contentdir,

 		dstprof or self.profile, dstlang or self.lang)

 	assert(src ~= dst, self:dbmsg("Attempt to copy profile over itself"))

 	assert(posix.stat(src, "mode") == "directory",

 		self:dbmsg("Source profile not a directory", src))

 	local success, msg = posix.mkdir(dst)

 	assert(success, self:dbmsg("Error creating profile directory " .. dst, msg))

 	for e in util.readdir(src) do

 		local ext = e:match("^[^.].*%.([^.]*)$")

 		if ext ~= "LOCK" then

 			local f = src .. "/" .. e

 			if posix.stat(f, "mode") == "file" then

 				success, msg = lib.copyfile(f, dst .. "/" .. e)

 				assert(success, self:dbmsg("Error copying file", msg))

 			end

 		end

 	end

 	-- create "current" symlink if none exists for new profile/language

 	if not posix.readlink(contentdir .. "/current_" .. dstlang) then

 		self:makecurrent(dstprof, dstlang)

 	end

 end

 function Loona:makecurrent(prof, lang)

 	prof = prof or self.profile

 	lang = lang or self.lang

 	local contentdir = self.config.contentdir

 	local newpath = ("%s/current_%s"):format(contentdir, lang)

 	local tmppath = newpath .. "." .. self.session.name

 	local success, msg = posix.symlink(prof .. "_" .. lang, tmppath)

 	assert(success, self:dbmsg("Cannot create symlink", msg))

 	success, msg = rename(tmppath, newpath)

 	assert(success, self:dbmsg("Cannot put symlink in place", msg))

 	return true

 end

 function Loona:publishprofile(profile, lang)

 	lang = lang or self.lang

 	local contentdir = self.config.contentdir

 	-- Get languages for the current profile

 	local plangs = { }

 	local lmatch = "^" .. self.profile .. "_(%w+)$"

 	for e in util.readdir(self.config.contentdir) do

 		local l = e:match(lmatch)

 		if l then

 			table.insert(plangs, l)

 		end

 	end

 	-- For all languages, update "current" symlink

 	for _, lang in ipairs(plangs) do

 		self:makecurrent(profile, lang)

 	end

 	-- These arguments are overwritten globally and need to get restored

 	local save_args = { self.args.lang, self.args.profile, self.args.session }

 	-- For all languages, unroll site to static HTML

 	for _, lang in ipairs(plangs) do

 		local ext = (#plangs == 1 and ".html") or (".html." .. lang)

 		self:recursesections(self.sections, function(self, s, e, path)

 			path = path and path .. "/" .. e.name or e.name

 			if not e.notvisible then

 				Loona:dumphtml {

 					request = self.request, -- reuse request

 					userdata = self.userdata, -- reuse userdata

 					requestpath = path, requestlang = lang,

 					htmlext = ext, insecure = true

 				}

 			end

 			return path

 		end)

 	end

 	-- Restore arguments

 	self.args.lang, self.args.profile, self.args.session = unpack(save_args)

 	-- Update file cache

 	local htdocs = self.config.htdocsdir

 	local cache = self.config.htmlcachedir

 	for e in util.readdir(cache) do

 		local f = e:match("^.*%.html%.?(%w*)$")

 		if f and f ~= "tmp" then

 			local success, msg = remove(htdocs .. "/" .. e)

 			success, msg = remove(cache .. "/" .. e)

  			assert(success,

  				self:dbmsg("Could not purge cached HTML file", msg))

 		end

 	end

 	for e in util.readdir(cache) do

 		local f = e:match("^(.*%.html%.?%w*)%.tmp$")

 		if f then

 			local success, msg = rename(cache .. "/" .. e, cache .. "/" .. f)

 			assert(success,

 				self:dbmsg("Could not update cached HTML file", msg))

 			success, msg = rename(htdocs .. "/" .. e, htdocs .. "/" .. f)

 			assert(success,

 				self:dbmsg("Could not update cached HTML file", msg))

 		end

 	end

 end

 function Loona:recursesections(s, func, ...)

 	for _, e in ipairs(s) do

 		local udata = { func(self, s, e, unpack(arg)) }

 		if e.subs then

 			self:recursesections(e.subs, func, unpack(udata))

 		end

 	end

 end

 function Loona:indexsections()

 	local userperm = self.session and self.session.data.permissions

 	userperm = userperm and userperm ~= "" and "[" .. userperm .. "]"

 	self:recursesections(self.sections, function(self, s, e)

 		local permitted = true

 		local sectperm = e.permissions

 		if sectperm and sectperm ~= "" and not self.authuser_seeall then

 			permitted = false

 			if userperm then

 				local num = sectperm:len()

 				sectperm:gsub(userperm, function() num = num - 1 end)

 				permitted = num == 0

 			end

 		end

 		e.notvalid = not permitted or (not self.secure and e.secure) or

 			(not self.authuser_visible and e.secret) or nil

 		e.notvisible = e.notvalid or not self.authuser_visible and e.hidden or nil

 		s[e.name] = e

 	end)

 end

 --	Decompose section path into a stack of sections, returning only up to

 --	the last valid element in the path. additionally returns the table of

 --	the last section path element (or the default section)

 function Loona:getsection(path)

 	local default = not self.authuser and self.config.defname

 	local tab = { { entries = self.sections, name = default } }

 	local ss = self.sections

 	local sectionpath

 	(path or ""):gsub("(%w+)/?", function(a)

 		if ss then

 			local s = ss[a]

 			if s and not s.notvalid then

 				sectionpath = s

 				tab[#tab].name = a

 				ss = s.subs

 				if ss then

 					table.insert(tab, { entries = ss })

 				end

 			else

 				ss = nil -- stop.

 			end

 		end

 	end)

 	if not self.section and not sectionpath then

 		sectionpath = self.sections[default]

 		if sectionpath then

 			table.insert(tab, { entries = sectionpath.subs })

 		end

 	end

 	return tab, sectionpath

 end

 function Loona:getpath(delimiter, maxdepth)

 	local t = { }

 	local d = 0

 	maxdepth = maxdepth or #self.submenus

 	for _, menu in ipairs(self.submenus) do

 		if menu.name then

 			table.insert(t, menu.name)

 		end

 		d = d + 1

 		if d == maxdepth then

 			break

 		end

 	end

 	return table.concat(t, delimiter or "/")

 end

 function Loona:deletesection(fname, all_bodies)

 	local fullname = self.contentdir .. "/" .. fname

 	local success, msg = remove(fullname)

 	if all_bodies then

 		local pat = "^" .. -- TODO: check

 			fname:gsub("%^%$%(%)%%%.%[%]%*%+%-%?", "%%%1") .. "%..*$"

 		for e in util.readdir(self.contentdir) do

 			if e:match(pat) then

 				remove(self.contentdir .. "/" .. e)

 			end

 		end

 	end

 	return success, msg

 end

 function Loona:addpath(path, e)

 	local tab = self.sections

 	path:gsub("(%w+)/?", function(a)

 		if tab then

 			local s = tab[a]

 			if s then

 				if not s.subs then

 					s.subs = { }

 				end

 				tab = s.subs

 			else

 				table.insert(tab, e)

 				tab[a] = e

  				tab = nil -- stop

 			end

 		end

 	end)

 	return e

 end

 local function lookupname(tab, val)

 	for i, v in ipairs(tab) do

 		if v.name == val then

 			return i

 		end

 	end

 end

 function Loona:rmpath(path)

 	local parent

 	local tab = self.sections

 	path:gsub("(%w+)/?", function(a)

 		if tab then

 			local idx = lookupname(tab, a)

 			if idx then

 				if tab[idx].subs then

 					parent = tab[idx]

 					tab = tab[idx].subs

 				else

 					table.remove(tab, idx)

 					tab[a] = nil

 					if #tab == 0 and parent then

 						parent.subs = nil

 					end

 					tab = nil

 				end

 			end

 		end

 	end)

 end

 function Loona:checkpath(path)

 	if path ~= "index" then -- "index" is reserved

 		local res, idx

 		local tab = self.sections

 		path:gsub("(%w+)/?", function(a)

 			if tab then

 				local i = lookupname(tab, a)

 				if i then

 					res, idx = tab, i

 					tab = tab[i].subs

 				else

 					res, idx, tab = nil, nil, nil

 				end

 			end

 		end)

 		return res, idx

 	end

 end

 function Loona:title()

 	return self.section and (self.section.title or self.section.label or

 		self.section.name) or ""

 end

 --	Run a site function snippet, with full error recovery

 --	(also recovers from errors in error handling function)

 function Loona:dosnippet(func, errfunc)

 	local ret = { lib.catch(func) }

 	if ret[1] == 0 or (errfunc and lib.catch(errfunc) == 0) then

 		return unpack(ret)

 	end

 	self:out("<h2>Error</h2>")

 	self:out("<h3>" .. self:encodeform(ret[2] or "") .. "</h3>")

 	if self.authuser_debug then

 		if type(ret[3]) == "string" then

 			self:out("<p>" .. self:encodeform(ret[3]) .. "</p>")

 		end

 		if ret[4] then

 			self:out("<pre>" .. self:encodeform(ret[4]) .. "</pre>")

 		end

 	end

 end

 function Loona:lockfile(file)

 	return not self.session and true or

 		posix.symlink(self.session.filename, file .. ".LOCK")

 end

 function Loona:unlockfile(file)

 	return not self.session and true or remove(file .. ".LOCK")

 end

 function Loona:saveindex()

 	local tempname = self.indexfname .. "." .. self.session.name

 	local f, msg = open(tempname, "wb")

 	assert(f, self:dbmsg("Error opening section file for writing", msg))

 	lib.dump(self.sections, function(...)

 		f:write(unpack(arg))

 	end)

 	f:close()

 	local success, msg = rename(tempname, self.indexfname)

 	assert(success, self:dbmsg("Error renaming section file", msg))

 end

 function Loona:savebody(fname, content)

 	fname = self.contentdir .. "/" .. fname

 	local f, msg = open(fname, "wb")

 	assert(f, self:dbmsg("Could not open file for writing", msg))

 	f:write(content or "")

 	f:close()

 end

 function Loona:runboxed(func, envitems, ...)

 	local fenv = {

  		arg = arg,

  		loona = self

  	}

  	if envitems then

 	 	for k, v in pairs(envitems) do

  			fenv[k] = v

  		end

  	end

  	setmetatable(fenv, { __index = boxed_G }) -- boxed global environment

 	setfenv(func, fenv)

 	return func()

 end

 function Loona:include(fname, ...)

 	assert(not fname:match("%W"), self:dbmsg("Invalid include name", fname))

 	local fname2 = ("%s/%s.lua"):format(self.config.extdir, fname)

 	local f, msg = open(fname2)

 	assert(f, self:dbmsg("Cannot open file", msg))

 	local parsed, msg = self:loadhtml(f, "loona:out", fname2)

 	msg = msg and (type(msg) == "string" and msg or msg.txt)

 	assert(parsed, self:dbmsg("Syntax error", msg))

 	return self:runboxed(parsed, nil, unpack(arg))

 end

 --	produce link target (simple)

 function Loona:shref(section, arg)

 	local args2 = { } -- propagated or new arguments

 	for _, a in ipairs(arg) do

 		local key, val = a:match("^([%w_]+)=(.*)$")

 		if key and val then -- "arg=val" sets/overrides argument

 			table.insert(args2, { name = key, value = val })

 		elseif self.args[a] then -- just "arg" propagates argument

 			table.insert(args2, { name = a, value = self.args[a] })

 		end

 	end

 	local doc = self:getdocname(section, #args2 > 0)

 	local url, anch = doc:match("^(.+)(#.+)$")

 	local notfirst = doc:match("%?")

 	local href = { anch and url or doc }

 	for i, arg in ipairs(args2) do

 		if i > 1 or notfirst then

 			table.insert(href, "&")

 		else

 			table.insert(href, "?")

 		end

 		table.insert(href, arg.name .. "=" .. cgi.encodeurl(arg.value))

 	end

 	if anch then

 		table.insert(href, anch)

 	end

 	return table.concat(href)

 end

 --	produce link target, implicit propagation of lang, profile, session

 function Loona:href(section, ...)

 	if self.session then

 		table.insert(arg, 1, "profile")

 		table.insert(arg, 1, "session")

 	end

 	if self.explicitlang then

 		table.insert(arg, 1, "lang")

 	end

 	return self:shref(section, arg)

 end

 function Loona:ilink(target, text, extra)

 	return ('<a href="%s"%s>%s</a>'):format(target, extra or "", text)

 end

 --	internal link, implicit propagation of lang, profile, session

 function Loona:link(section, text, ...)

 	return self:ilink(self:href(section, unpack(arg)), text or section,

 	' class="intlink"')

 end

 --	external link (opens in a new window), no argument propagation

 function Loona:elink(target, text)

 	return self:ilink(target, text or target, self.config.extlinkextra)

 end

 --	plain link, no implicit argument propagation

 function Loona:plink(section, text, ...)

 	return self:ilink(self:shref(section, arg), text or section)

 end

 --	user interface link, implicit propagation of lang, profile, session

 function Loona:uilink(section, text, ...)

 	return self:ilink(self:href(section, unpack(arg)), text or section,

 	' class="uilink"')

 end

 --	produce a hidden input value in forms

 function Loona:hidden(name, value)

 	return not value and "" or

 		('<input type="hidden" name="%s" value="%s" />'):format(name, value)

 end

 function Loona:scanprofiles(func)

 	local tab = { }

 	local dir = self.config.contentdir

 	for f in util.readdir(dir) do

 		if posix.lstat(dir .. "/" .. f, "mode") == "directory" then

 			f = func(f)

 			if f then

 				table.insert(tab, f)

 			end

 		end

 	end

 	table.sort(tab)

 	for _, v in ipairs(tab) do

 		tab[v] = v

 	end

 	return tab

 end

 function Loona:getprofiles(lang)

 	lang = lang or self.lang

 	return self:scanprofiles(function(f)

 		return f:match("^(%w+)_" .. lang .. "$")

 	end)

 end

 function Loona:getlanguages(prof)

 	prof = prof or self.profile

 	return self:scanprofiles(function(f)

 		return f:match("^" .. prof .. "_(%l%l)$")

 	end)

 end

 --	Functions to produce a navigation menu

 local newent = { name = "new", label = "[+]", action="actionnew=true" }

 function Loona:rmenu(level, render, path, addnew, recurse)

 	local sub = (addnew and level == #self.submenus + 1) and

 		{ name = "new", entries = { }} or self.submenus[level]

  	if sub and sub.entries then

 		local visible = { }

 		for _, e in ipairs(sub.entries) do

 			if not e.notvisible then

 				table.insert(visible, e)

 			end

 		end

 		if addnew then

 			table.insert(visible, newent)

 		end

 		local numvis = #visible

 		if numvis > 0 then

 			render.listbegin(self, level, numvis, path)

 			for idx, e in ipairs(visible) do

 				local label = self:encodeform(e.label or e.name)

 				local newpath = path and path .. "/" .. e.name or e.name

 				local active = (e.name == sub.name)

 				render.itembegin(self, level, idx, label)

 				render.link(self, level, newpath, label, active, e.action)

 				if recurse and active then

 					self:rmenu(level + 1, render, newpath, addnew, recurse)

 				end

 				render.itemend(self, level, idx, label)

 			end

 			render.listend(self)

 		end

 	end

 end

 function Loona:menu(level, recurse, render)

 	level = level or 1

 	render = render or { }

 	render.link = render.link or

 		function(self, level, path, label, active, ...)

 			self:out(('<a %shref="%s">%s</a>\n'):format(active and

 				'class="active" ' or "", self:href(path, unpack(arg)), label))

 		end

 	render.listbegin = render.listbegin or

 		function(self, level) -- , numvis, path

 			self:out('<ul id="menulevel' .. level .. '">\n')

 		end

 	render.listend = render.listend or

 		function(self)

 			self:out('</ul>\n')

 		end

 	render.itembegin = render.itembegin or

 		function(self) -- , level, idx

 			self:out('<li>\n')

 		end

 	render.itemend = render.itemend or

 		function(self)

 			self:out('</li>\n')

 		end

 	recurse = recurse == nil and true or recurse

 	local path = level > 1 and self:getpath("/", level - 1) or nil

 	local addnew = self.authuser_menu and

 		(not self.ispubprofile or self.config.editablepubprofile)

 	self:rmenu(level, render, path, addnew, recurse)

 end

 function Loona:loadcontent(fname)

 	if fname then

 		local f = open(self.contentdir .. "/" .. fname)

 		local c = f:read("*a")

 		f:close()

 		return c

 	end

 	return ""

 end

 function Loona:loadmarkup(fname)

 	return (fname and fname ~= "") and

 		self:domarkup(self:loadcontent(fname)) or ""

 end

 function Loona:editable(editkey, fname, savename)

 	local contentdir = self.contentdir

 	local edit, show, hidden, extramsg, changed

 	if self.authuser_edit or self.authuser_profile or self.authuser_menu then

 		local hiddenvars = table.concat( {

 			self:hidden("lang", self.args.lang),

 			self:hidden("profile", self.profile),

 			self:hidden("session", self.session.id),

 			self:hidden("editkey", editkey) }, " ")

 		local lockfname = fname and (contentdir .. "/" .. fname)

 		if self.useralert and editkey == self.args.editkey then

 			--	display user alert/request/confirmation

 			hidden = true

 			self:out([[

 			<form action="]] .. self.document .. [[" method="post" accept-charset="utf-8">

 				<fieldset>

 					<legend>]] .. self.useralert.text ..[[</legend>

 					]] .. (self.useralert.confirm or "") .. [[

 					]] .. (self.useralert.returnto or "") .. [[

 					<input type="submit" name="actioncancel" value="]] .. self.locale.CANCEL  ..[[" />

 					]] .. hiddenvars .. [[

 				</fieldset>

 			</form>

 			]])

 		elseif self.args.actionnew and editkey == "main" and self.authuser_menu then

 			--	form for creating a new section

 			hidden = true

 			if self.ispubprofile then

 				self:out([[<h2><span class="warn">]] .. self.locale.WARNING_YOU_ARE_IN_PUBLISHED_PROFILE ..[[</span></h2>]])

 			end

 			self:out([[

 			<form action="]] .. self.document .. [[" method="post" accept-charset="utf-8">

 				<fieldset>

 					<legend>

 						]] .. self.locale.CREATE_NEW_SECTION_UNDER .. " " .. self.sectionpath .. [[

 					</legend>

 					<table>

 						<tr>

 							<td align="right">

 								]] .. self.locale.PATHNAME .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="30" name="editname" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.MENULABEL .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="editlabel" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.WINDOWTITLE .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="edittitle" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.INVISIBLE .. [[

 							</td>

 							<td>

 								<input type="checkbox" name="editvisibility" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.SECRET .. [[

 							</td>

 							<td>

 								<input type="checkbox" name="editsecrecy" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.SECURE_CONNECTION .. [[

 							</td>

 							<td>

 								<input type="checkbox" name="editsecure" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.PERMISSIONS .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="editpermissions" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.REDIRECT .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="editredirect" />

 							</td>

 						</tr>

 					</table>

 					<input type="submit" name="actioncreate" value="]] .. self.locale.CREATE .. [[" />

 					]] .. hiddenvars .. [[

 				</fieldset>

 			</form>

 			<hr />

 			]])

 		elseif self.args.actioneditprops and editkey == "main" and

 			self.authuser_menu then

 			hidden = true

 			if self.ispubprofile then

 				self:out([[<h2><span class="warn">]] .. self.locale.WARNING_YOU_ARE_IN_PUBLISHED_PROFILE ..[[</span></h2>]])

 			end

 			self:out([[

 			<form action="]] ..self.document .. [[" method="post" accept-charset="utf-8">

 				<fieldset>

 					<legend>

 						]] .. self.locale.MODIFY_PROPERTIES_OF_SECTION .. " " .. self.sectionpath .. [[

 					</legend>

 					<table>

 						<tr>

 							<td align="right">

 								]] .. self.locale.MENULABEL .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="editlabel" value="]] .. (self.section.label or "") .. [[" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.WINDOWTITLE .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="edittitle" value="]] .. (self.section.title or "") .. [[" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.INVISIBLE .. [[

 							</td>

 							<td>

 								<input type="checkbox" name="editvisibility" ]] .. (self.section.hidden and 'checked="checked"' or "") .. [[/>

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.SECRET .. [[

 							</td>

 							<td>

 								<input type="checkbox" name="editsecrecy" ]] .. (self.section.secret and 'checked="checked"' or "") .. [[/>

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.SECURE_CONNECTION .. [[

 							</td>

 							<td>

 								<input type="checkbox" name="editsecure" ]] .. (self.section.secure and 'checked="checked"' or "") .. [[/>

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.PERMISSIONS .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="editpermissions" value="]] .. (self.section.permissions or "") .. [[" />

 							</td>

 						</tr>

 						<tr>

 							<td align="right">

 								]] .. self.locale.REDIRECT .. [[

 							</td>

 							<td>

 								<input size="30" maxlength="50" name="editredirect" value="]] .. (self.section.redirect or "") .. [[" />

 							</td>

 						</tr>

 					</table>

 					<input type="submit" name="actionsaveprops" value="]] .. self.locale.SAVE .. [[" />

 					<input type="submit" name="actioncancel" value="]] .. self.locale.CANCEL .. [[" />

 					]] .. hiddenvars .. [[

 				</fieldset>

 			</form>

 			]])

 		elseif (self.args.actioneditprofiles or

 			self.args.actioncreateprofile or

 			self.args.actionchangeprofile or

 			self.args.actionchangelanguage or

 			self.args.actionpublishprofile) and editkey == "main" and

 			self.authuser_profile then

 			hidden = true

 			self:out([[

 			<form action="]] .. self.document .. [[" method="post" accept-charset="utf-8">

 				<fieldset>

 					<legend>

 						]] .. self.locale.CHANGEPROFILE .. [[

 					</legend>

 					<select name="changeprofile" size="1">]])

 						for _, val in ipairs(self:getprofiles()) do

 							self:out('<option' .. (val == self.profile and ' selected="selected"' or '') .. '>')

 							self:out(val)

 							self:out('</option>')

 						end

 					self:out([[

 					</select>

 					<input type="submit" name="actionchangeprofile" value="]] .. self.locale.CHANGE ..[[" />

 					]] .. hiddenvars .. [[

 				</fieldset>

 			</form>

 			<form action="]] .. self.document .. [[" method="post" accept-charset="utf-8">

 				<fieldset>

 					<legend>

 						]] .. self.locale.CHANGELANGUAGE .. [[

 					</legend>

 					<select name="changelanguage" size="1">]])

 						for _, val in ipairs(self:getlanguages()) do

 							self:out('<option' .. (val == self.lang and ' selected="selected"' or '') .. '>')

 							self:out(val)

 							self:out('</option>')

 						end

 					self:out([[

 					</select>

 					<input type="submit" name="actionchangelanguage" value="]] .. self.locale.CHANGE ..[[" />

 					]] .. hiddenvars .. [[

 				</fieldset>

 			</form>

 			]])

 			if self.authuser_publish then

 				self:out([[

 				<form action="]] .. self.document ..[[" method="post" accept-charset="utf-8">

 					<fieldset>

 						<legend>

 							]] .. self.locale.CREATEPROFILE .. [[

 						</legend>

 						<input size="20" maxlength="20" name="createprofile" />

 						]] .. self.locale.LANGUAGE ..[[

 						<input size="2" maxlength="2" name="createlanguage" value="]] .. self.lang ..[[" />

 						<input type="submit" name="actioncreateprofile" value="]] .. self.locale.CREATE .. [[" />

 						]] .. hiddenvars .. [[

 					</fieldset>

 				</form>

 				]])

 			end

 			if (not self.ispubprofile or self.config.editablepubprofile) and

 				self.authuser_publish then

 				self:out([[

 				<form action="]] .. self.document .. [[" method="post" accept-charset="utf-8">

 					<fieldset>

 						<legend>

 							]] .. self.locale.PUBLISHPROFILE .. [[

 						</legend>

 						]] .. self:hidden("publishprofile", self.profile) .. [[

 						<input type="submit" name="actionpublishprofile" value="]] .. self.locale.PUBLISH .. [[" />

 						]] .. hiddenvars .. [[

 					</fieldset>

 				</form>

 				<form action="]] .. self.document .. [[" method="post" accept-charset="utf-8">

 					<fieldset>

 						<legend>

 							]] .. self.locale.DELETEPROFILE .. [[

 						</legend>

 						]] .. self:hidden("deleteprofile", self.profile) .. [[

 						<input type="submit" name="actiondeleteprofile" value="]] .. self.locale.DELETE .. [[" />

 						]] .. hiddenvars .. [[

 					</fieldset>

 				</form>

 				]])

 			end

 		elseif self.args.actionedit and editkey == self.args.editkey and self.authuser_edit then

 			if not self.section.redirect then

 				extramsg = self.ispubprofile and

 					self.locale.WARNING_YOU_ARE_IN_PUBLISHED_PROFILE

 				edit = self:loadcontent(fname):gsub("\194\160", " ") -- TODO

 				changed = self.section and (self.section.revisiondate or self.section.creationdate)

 			end

 		elseif self.args.actionpreview and editkey == self.args.editkey and

 			self.authuser_edit then

 			edit = self.args.editform

 			show = self:domarkup(edit:gsub(" ", "\194\160")) -- TODO

 		elseif self.args.actionsave and editkey == self.args.editkey

 			and self.authuser_edit then

 			local c = self.args.editform

 			local dynamic

 			if lockfname then

 				self:expire(contentdir, "[^.]%S+.LOCK")

 				if self:lockfile(lockfname) then

 					-- lock was expired, aquired a new one

 					extramsg = self.locale.SECTION_COULD_HAVE_CHANGED

 					edit = c

 				else

 					local tab = lib.source(lockfname .. ".LOCK")

 					if tab and tab.id == self.session.id then

 						-- lock already held and is mine - try to save:

 						local savec = c:gsub(" ", "\194\160") -- TODO

 						remove(contentdir .. "/" .. savename .. ".html")

 						self:savebody(savename, savec)

 						-- TODO: error handling

 						self:unlockfile(lockfname)

 						show, dynamic = self:domarkup(savec)

 						changed = time()

 					else

 						-- lock was expired and someone else has it now

 						extramsg = self.locale.SECTION_IN_USE

 						edit = c

 					end

 				end

 			else

 				-- new sidefile

 				local savec = c:gsub(" ", "\194\160") -- TODO

 				self:savebody(savename, savec)

 				-- TODO: error handling

 				show, dynamic = self:domarkup(savec)

 			end

 			-- mark dynamic text bodies

 			if not self.section.dynamic then

 				self.section.dynamic = { }

 			end

 			self.section.dynamic[editkey] = dynamic

 			local n = 0

 			for _ in pairs(self.section.dynamic) do

 				n = n + 1

 			end

 			if n == 0 then

 				self.section.dynamic = nil

 			end

 			self:saveindex()

 		elseif self.args.actioncancel and editkey == self.args.editkey then

 			if lockfname then

 				self:unlockfile(lockfname) -- remove lock

 			end

 		end

 		if editkey == "main" and self.section and self.section.redirect then

 			self:out('<h2>' .. self.locale.SECTION_IS_REDIRECT ..'</h2>')

 			self:out(self:link(self.section.redirect))

 			self:out('<hr />')

 		end

 		if edit then

 			self:expire(contentdir, "[^.]%S+.LOCK")

 			if fname and not self:lockfile(contentdir .. "/" .. fname) then

 				local tab = lib.source(contentdir .. "/" .. fname .. ".LOCK")

 				if tab and tab.id ~= self.session.id then

 					extramsg = self.locale.SECTION_IN_USE

 				end

 				-- else already owner

 			end

 			if extramsg then

 				self:out('<h2><span class="warn">' .. extramsg .. '</span></h2>')

 			end

 			self:out([[

 			<form action="]] .. self.document .. [[#preview" method="post" accept-charset="utf-8">

 				<fieldset>

 					<legend>

 						]] .. self.locale.EDIT_SECTION .. [[

 					</legend>

 					<textarea cols="80" rows="25" name="editform">

 ]] .. self:encodeform(edit) .. [[</textarea>

 					<br />

 					<input type="submit" name="actionsave" value="]] .. self.locale.SAVE .. [[" />

 					<input type="submit" name="actionpreview" value="]] .. self.locale.PREVIEW .. [[" />

 					<input type="submit" name="actioncancel" value="]] .. self.locale.CANCEL .. [[" />

 					]] .. hiddenvars .. [[

 				</fieldset>

 			</form>

 			]])

 		end

 	end

 	if not hidden then

 		self:dosnippet(function()

 			if not show then

 				show = self:loadmarkup(fname)

 				changed = self.section and (self.section.revisiondate or self.section.creationdate)

 			end

 			local parsed, msg = self:loadhtml(show, "loona:out", "<parsed html>")

 			assert(parsed, msg and "Syntax error : " .. msg)

 			self:runboxed(parsed)

 		end)

 	end

 	if self.authuser_profile or self.authuser_edit or self.authuser_menu then

 		self:out([[

 		<hr />

 		<div class="edit">]])

 			if editkey == "main" then

 				self:out([[

 				<a name="preview"></a>

 				]] .. self.authuser .. [[ : ]])

 				if self.authuser_profile then

 					self:out(self:uilink(self.sectionpath, "[" .. self.locale.PROFILE .. "]", "actioneditprofiles=true", "editkey=" .. editkey) .. [[ :

 						]] .. self.profile .. "_" .. self.lang)

 					if self.ispubprofile then

 						self:out([[

 							<span class="warn">[]] .. self.locale.PUBLIC .. [[]</span>]])

 					end

 					self:out(" : ")

 				end

 				self:out(self.sectionpath .. ' ')

 			end

 			if self.section and (not self.ispubprofile or self.config.editablepubprofile) then

 				if self.authuser_edit then

 					self:out('- ' .. self:uilink(self.sectionpath, "[" .. self.locale.EDIT .. "]", "actionedit=true", "editkey=" .. editkey) .. " ")

 				end

 				if editkey == "main" and self.authuser_menu then

 					self:out('- ' .. self:uilink(self.sectionpath, "[" .. self.locale.PROPERTIES .. "]", "actioneditprops=true", "editkey=" .. editkey) .. " ")

 				end

 				if (fname == savename or not self.section.subs) and (self.authuser_edit and self.authuser_menu) then

 					self:out('- ' .. self:uilink(self.sectionpath, "[" .. self.locale.DELETE .. "]", "actiondelete=true", "editkey=" .. editkey) .. " ")

 				end

 				if editkey == "main" and self.authuser_menu then

 					self:out('- ' .. self:uilink(self.sectionpath, "[" .. self.locale.MOVEUP .. "]", "actionup=true", "editkey=" .. editkey) .. " ")

 					self:out('- ' .. self:uilink(self.sectionpath, "[" .. self.locale.MOVEDOWN .. "]", "actiondown=true", "editkey=" .. editkey) .. " ")

 				end

 				if changed and editkey == "main" then

 					self:out('- ' .. self.locale.CHANGED .. ': ' .. date("%d-%b-%Y %T", changed))

 				end

 			end

 		self:out('</div>')

 	end

 end

 --	Get pathname of an existing content file that

 --	the current path is determined by (or defaults to)

 function Loona:getsectionpath(bodyname, requestpath)

 	local ext = (not bodyname or bodyname == "main") and "" or "." .. bodyname

 	local t, path, section = { }

 	for _, menu in ipairs(self.submenus) do

 		if menu.entries and menu.entries[menu.name] then

 			table.insert(t, menu.name)

 			local fn = table.concat(t, "_")

 			if posix.stat(self.contentdir .. "/" .. fn .. ext,

 				"mode") == "file" then

 				path, section = fn, menu

 			end

 		end

 	end

 	return path, ext, section

 end

 function Loona:body(name)

 	name = self:checkbodyname(name)

 	local path, ext = self:getsectionpath(name)

 	self:dosnippet(function()

 		self:editable(name, path and path .. ext, self.sectionname .. ext)

 	end)

 end

 function Loona:init()

 	-- get list of languages, in order of preference

 	-- TODO: respect quality parameter, not just order

 	local l = self.requestlang or self.args.lang

 	self.langs = { l and l:match("^%w+$") }

 	local s = getenv("HTTP_ACCEPT_LANGUAGE")

 	while s do

 		local l, r = s:match("^([%w.=]+)[,;](.*)$")

 		l = l or s

 		s = r

 		if l:match("^%w+$") then

 			table.insert(self.langs, l)

 		end

 	end

 	table.insert(self.langs, self.config.deflang)

 	-- get list of possible profiles

 	local profiles = { }

 	for e in util.readdir(self.config.contentdir) do

 		profiles[e] = e

 	end

 	-- get pubprofile

 	for _, lang in ipairs(self.langs) do

 		local p = posix.readlink(self.config.contentdir .. "/current_" .. lang)

 		p = p and p:match("^(%w+)_" .. lang .. "$")

 		if p then

 			self.pubprofile = p

 			break

 		end

 	end

 	-- get profile

 	local checkprofile = self.authuser and

 		(self.authuser_profile and self.args.profile or self.session.data.profile)

 		or self.config.defprofile or self.pubprofile or "work"

 	for _, lang in ipairs(self.langs) do

 		if profiles[checkprofile .. "_" .. lang] then

 			self.profile = checkprofile

 			self.lang = lang

 			break

 		end

 	end

 	assert(self.profile and self.lang, "Invalid profile or language")

 	self.ispubprofile = self.profile == self.pubprofile

 	-- write back language and profile

 	self.args.lang = (self.explicitlang or self.lang ~= self.config.deflang)

 		and self.lang or nil

 	self.args.profile = self.profile

 	-- determine content directory pathname and section filename

 	self.contentdir =

 		("%s/%s_%s"):format(self.config.contentdir, self.profile, self.lang)

  	self.indexfname = self.contentdir .. "/.sections"

 	-- load sections

  	self.sections = lib.source(self.indexfname)

 	-- index sections, determine visibility in menu

 	self:indexsections()

 	-- decompose request path, produce a stack of sections

 	self.submenus, self.section = self:getsection(self.requestpath)

 	-- handle redirects if not logged on

 	if not self.authuser_edit and self.section and self.section.redirect then

 		self.submenus, self.section = self:getsection(self.section.redirect)

 	end

 	-- section path and document name (refined)

 	self.sectionpath = self:getpath()

 	self.sectionname = self:getpath("_")

 end

 function Loona:handlechanges()

 	local save

 	if self.args.editkey == "main" then

 		-- In main editable section:

 		if self.args.actioncreate then

 			-- Create new section

 			local editname = self.args.editname:lower()

 			assert(not editname:match("%W"),

 				self:dbmsg("Invalid section name", editname))

 			if not (section and (section.subs or section)[editname]) then

 				local newpath = (self.sectionpath and

 					(self.sectionpath .. "/")) .. editname

 				local s = self:addpath(newpath, { name = editname,

 					label = self.args.editlabel ~= "" and

 						self.args.editlabel or nil,

 					title = self.args.edittitle ~= "" and

 						self.args.edittitle or nil,

 					redirect = self.args.editredirect ~= "" and

 						self.args.editredirect or nil,

 					permissions = self.args.editpermissions ~= "" and

 						self.args.editpermissions or nil,

 					hidden = self.args.editvisibility and true,

 					secret = self.args.editsecrecy and true,

 					secure = self.args.editsecure and true,

 					creator = self.authuser,

 					creationdate = time() })

 				save = true

 			end

 		elseif self.args.actionsave then

 			-- Save section

 			self.section.revisiondate = time()

 			self.section.revisioner = self.authuser

 			save = true

 		elseif self.args.actionsaveprops then

 			-- Save properties

 			self.section.hidden = self.args.editvisibility and true

 			self.section.secret = self.args.editsecrecy and true

 			self.section.secure = self.args.editsecure and true

 			self.section.label = self.args.editlabel ~= "" and

 				self.args.editlabel or nil

 			self.section.title = self.args.edittitle ~= "" and

 				self.args.edittitle or nil

 			self.section.redirect =

 				self.args.editredirect ~= "" and self.args.editredirect or nil

 			self.section.permissions =

 				self.args.editpermisisons ~= "" and self.args.editpermissions or nil

 			save = true

 		elseif self.args.actionup then

 			-- Move section up

 			local t, i = self:checkpath(self.sectionpath)

 			if t and i > 1 then

 				if self.ispubprofile and not self.args.actionconfirm then

 					self.useralert = {

 						text = self.locale.ALERT_MOVE_IN_PUBLISHED_PROFILE,

 						confirm =

 							'<input type="submit" name="actionup" value="' ..

 							self.locale.MOVE .. '" /> ' ..

 							self:hidden("actionconfirm", "true")

 					}

 				else

 					local item = table.remove(t, i)

 					table.insert(t, i - 1, item)

 					save = true

 				end

 			end

 		elseif self.args.actiondown then

 			-- Move section down

 			local t, i = self:checkpath(self.sectionpath)

 			if t and i < #t then

 				if self.ispubprofile and not self.args.actionconfirm then

 					self.useralert = {

 						text = self.locale.ALERT_MOVE_IN_PUBLISHED_PROFILE,

 						confirm =

 							'<input type="submit" name="actiondown" value="' ..

 							self.locale.MOVE .. '" /> ' ..

 							self:hidden("actionconfirm", "true")

 					}

 				else

 					local item = table.remove(t, i)

 					table.insert(t, i + 1, item)

 					save = true

 				end

 			end

 		elseif self.args.actioncreateprofile and self.args.createprofile then

 			-- Create profile

 			local c = self.args.createprofile

 			if c == "" then

 				c = self.profile

 			end

 			c = self:checkprofilename(c:lower())

 			local l = self:checklanguage((self.args.createlanguage or self.lang):lower())

 			if c == self.profile and l == self.lang then

 				self.useralert = {

 					text = self.locale.ALERT_CANNOT_COPY_PROFILE_TO_SELF,

 					returnto = self:hidden("actioneditprofiles", "true")

 				}

 			else

 				local profiles = self:getprofiles(l)

 				local text

 				if c == self.pubprofile then

 					text = self.locale.ALERT_OVERWRITE_PUBLISHED_PROFILE

 				elseif profiles[c] and l == self.lang then

 					text = self.locale.ALERT_OVERWRITE_EXISTING_PROFILE

 				end

 				if text and not self.args.actionconfirm then

 					self.useralert = {

 						text = text,

 						returnto = self:hidden("actioneditprofiles", "true"),

 						confirm = '<input type="submit" ' ..

 							'name="actioncreateprofile" value="' ..

 							self.locale.OVERWRITE .. '" /> ' ..

 							self:hidden("actionconfirm", "true") ..

 							self:hidden("createlanguage", l) ..

 							self:hidden("createprofile", c)

 					}

 				else

 					if profiles[c] then

 						self:deleteprofile(c, l)

 					end

 					self:copyprofile(c, self.profile, l, self.lang)

 				end

 			end

 		elseif self.args.actiondeleteprofile and self.args.deleteprofile then

 			-- Delete profile

 			local c = self:checkprofilename(self.args.deleteprofile:lower())

 			assert(c ~= self.pubprofile,

 				self:dbmsg("Cannot delete published profile", c))

 			if self.args.actionconfirm then

 				self:deleteprofile(c)

 				self.profile = nil

 				self.args.profile = nil

 				self:init()

 				save = true

 			else

 				self.useralert = {

 					text = self.locale.ALERT_DELETE_PROFILE,

 					returnto = self:hidden("actioneditprofiles", "true"),

 					confirm = '<input type="submit" ' ..

 						'name="actiondeleteprofile" value="' ..

 						self.locale.DELETE .. '" /> ' ..

 						self:hidden("actionconfirm", "true") ..

 						self:hidden("deleteprofile", c)

 				}

 			end

 		elseif self.args.actionchangeprofile and self.args.changeprofile then

 			-- Change profile

 			local c = self:checkprofilename(self.args.changeprofile:lower())

 			self.profile = c

 			self.args.profile = c

 			save = true

 		elseif self.args.actionchangelanguage and self.args.changelanguage then

 			-- Change language

 			local l = self:checklanguage(self.args.changelanguage:lower())

 			self.lang = l

 			self.args.lang = l

  			self.explicitlang = l

 			save = true

 		elseif self.args.actionpublishprofile and self.args.publishprofile then

 			-- Publish profile

 			local c = self:checkprofilename(self.args.publishprofile:lower())

 			if c ~= self.publicprofile then

 				if self.args.actionconfirm then

 					self:publishprofile(c)

 					save = true

 				else

 					self.useralert = {

 						text = self.locale.ALERT_PUBLISH_PROFILE,

 						returnto = self:hidden("actioneditprofiles", "true"),

 						confirm = '<input type="submit" ' ..

 							'name="actionpublishprofile" value="' ..

 							self.locale.PUBLISH .. '" /> ' ..

 							self:hidden("actionconfirm", "true") ..

 							self:hidden("publishprofile", c)

 					}

 				end

 			end

 		end

 	end

 	if self.args.actiondelete then

 		-- Delete section

 		if not self.args.actionconfirm then

 			self.useralert = {

 				text = self.ispubprofile and

 					self.locale.ALERT_DELETE_IN_PUBLISHED_PROFILE or

 					self.locale.ALERT_DELETE_SECTION,

 				confirm =

 					'<input type="submit" name="actiondelete" value="' ..

 					self.locale.DELETE .. '" /> ' ..

 					self:hidden("actionconfirm", "true")

 			}

 		else

 			local key = self.args.editkey

 			if key == "main" and not self.section.subs then

 				self:deletesection(self.sectionname, true) -- all bodies

 				self:rmpath(self.sectionpath) -- and node

 			else

 				local ext = (key == "main" and "") or "." .. key

 				self:deletesection(self.sectionname .. ext) -- only text

 				if self.section.dynamic then

 					self.section.dynamic[key] = nil

 					local n = 0

 					for _ in pairs(self.section.dynamic) do

 						n = n + 1

 					end

 					if n == 0 then

 						self.section.dynamic = nil

 					end

 				end

 			end

 			save = true

 		end

 	end

 	if save then

 		self:saveindex()

 		self:init()

 	end

 end

 function Loona:encodeform(s)

 	return util.encodeform(s)

 end

 function Loona:loadhtml(src, outfunc, chunkname)

  	return luahtml.load(src, outfunc, chunkname)

 end

 function Loona:domarkup(s)

 	local t = { }

 	local is_dynamic = Markup:new { input = s,

 		features = "hespcadlintf", indentchar = " ",

 		wrfunc = function(s) table.insert(t, s) end }:run()

 	return table.concat(t), is_dynamic

 end

 function Loona:expire(dir, pat, maxage)

 	return util.expire(dir, pat, maxage or self.config.sessionmaxage)

 end

 function Loona.new(class, self)

 	self = Class.new(class, self or { })

 	local parsed, msg

 	-- Buffer

 	self.out = self.out or function(self, s)

 		self.buf:out(s)

 	end

 	self.addheader = self.addheader or function(self, s)

 		self.buf:addheader(s)

 	end

 	-- Get configuration

 	self.config = self.config or lib.source(self.conffile or "../etc/config.lua") or { }

 	self.config.defname = self.config.defname or "home"

 	self.config.deflang = self.config.deflang or "en"

 	self.config.sessionmaxage = self.config.sessionmaxage or 6000

 	self.config.secureport = self.config.secureport or 443

 	self.config.passwdfile =

 		posix.abspath(self.config.passwdfile or "../etc/passwd.lua")

 	self.config.sessiondir =

 		posix.abspath(self.config.sessiondir or "../var/sessions")

 	self.config.extdir = posix.abspath(self.config.extdir or "../extensions")

 	self.config.contentdir = posix.abspath(self.config.contentdir or "../content")

 	self.config.localedir = posix.abspath(self.config.localedir or "../locale")

 	self.config.htdocsdir = posix.abspath(self.config.htdocsdir or "../htdocs")

 	self.config.htmlcachedir =

 		posix.abspath(self.config.htmlcachedir or "../var/htmlcache")

 	self.config.extlinkextra = self.config.extlinksamewindow and ' class="extlink"'

 		or ' class="extlink" onclick="void(window.open(this.href, \'\', \'\')); return false;"'

 	-- Create proxy for on-demand loading of locales

 	self.locale = { }

 	local locmt = { }

 	locmt.__index = function(_, key)

 		for _, l in ipairs(self.langs) do

 			locmt.__locale = lib.source(self.config.localedir .. "/" .. l)

 			if locmt.__locale then

 				break

 			end

 		end

 		locmt.__index = function(tab, key)

 			return locmt.__locale[key] or key

 		end

 		return locmt.__locale[key] or key

 	end

 	setmetatable(self.locale, locmt)

 	-- Get request, args, document, script name, request path

 	self.request = self.request or Request:new()

 	self.args = self.request:getargs()

 	self.cgi_document = self.request:getdocument()

 	self.requesthandler = self.requesthandler or self.cgi_document.Handler

  	self.requestdocument = self.requestdocument or self.cgi_document.Name

 	self.requestpath = self.requestpath or self.cgi_document.VirtualPath

 	self.explicitlang = not self.requestlang and self.args.lang

 	self.secure = not self.insecure and (self.request.SERVER_PORT == self.config.secureport)

 	-- Manage login and establish session

 	if not self.nologin then

 		local sid = self.args.session or self.request.UNIQUE_ID

 		self.session = self.session or Session:new {

 			id = sid,

 			sessiondir = self.config.sessiondir,

 			maxage = self.config.sessionmaxage

 		}

 		if self.args.login then

 			-- write back session ID into request args:

 			self.args.session = sid -- !

 			if self.args.login == "false" then

 				self.session:delete()

 				self.session = nil

 			elseif self.args.password then

 				self.loginfailed = true

 				local match, username, perm, profile =

 					self:checkpw(self.args.login, self.args.password)

 				if match then

 					self.session.data.authuser = self.args.login

 					self.session.data.username = username

 					self.session.data.permissions = perm

 					self.session.data.profile = profile

 					self.session.data.id = self.session.id

 					self.loginfailed = nil

 				end

 			end

 		end

 		self.authuser = self.session and self.session.data.authuser

 	end

 	if self.nologin or not self.authuser then

 		self.authuser = nil

 		self.session = nil

 		self.args.session = nil

 	else

 		self.authuser_edit = self.session.data.permissions:find("e") and true

 		self.authuser_menu = self.session.data.permissions:find("m") and true

 		self.authuser_publish = self.session.data.permissions:find("p") and true

 		self.authuser_profile = self.authuser_publish or

 			self.session.data.permissions:find("c") and true

 		self.authuser_visible = self.session.data.permissions:find("v") and true

 		self.authuser_debug = self.session.data.permissions:find("d") and true

 		self.authuser_seeall = self.session.data.permissions:find("a") and true

 	end

 	-- Get lang, locale, profile, section

 	self:init()

 	if self.authuser then -- TODO?

 		self:handlechanges()

 	else

 		self.args.profile = nil

 	end

 	-- Current document

 	self.document = self.requestdocument .. "/" .. self.sectionpath

 	if self.authuser then

 		self.getdocname = function(self, path)

 			local url, anch = path:match("^([^#]*)(#?.*)$")

 			path = url ~= "" and url

 			anch = anch or ""

 			return self.requestdocument .. "/" .. (path or self.sectionpath) .. anch

 		end

 	else

 		self.getdocname = function(self, path, haveargs)

 			local url, anch = path:match("^([^#]*)(#?.*)$")

 			path = url ~= "" and url

 			anch = anch or ""

 			local dyn, exists

 			dyn, path, exists = self:isdynamic(path or self.sectionpath)

 			if dyn or haveargs or not exists then

 				return self.requestdocument .. "/" .. path .. anch

 			end

 			path = path == self.config.defname and "index" or path

 			return "/" .. path:gsub("/", "_") .. ".html" .. anch

 		end

 	end

 	-- Save session state

 	if self.session then

 		self.session:save()

 	end

 	return self

 end

 function Loona:checkpw(login, passwd)

 	local pwddb = lib.source(self.config.passwdfile)

 	local pwdent = pwddb[login]

 	if pwdent and pwdent.password == passwd then

 		return true, pwdent.username or login,

 			pwdent.permissions or "", pwdent.profile

 	end

 end

 function Loona:run(fname)

 	self:indexdynamic()

 	fname = fname or self.requesthandler

 	local parsed, msg = self:loadhtml(open(fname), "loona:out", fname)

 	assert(parsed, self:dbmsg("HTML/Lua parsing failed", msg))

 	self:runboxed(parsed)

 	return self

 end

 function Loona:indexdynamic()

 	self:recursesections(self.sections, function(self, s, e, path, dynamic)

 		path = path and path .. "_" .. e.name or e.name

 		dynamic = dynamic or { }

 		for k in pairs(e.dynamic or { }) do

 			dynamic[k] = true

 		end

 		for k in pairs(dynamic) do

 			local ext = (k == "main" and "") or "." .. k

 			if posix.stat(self.contentdir .. "/" .. path .. ext,

 				"mode") == "file" then

 				dynamic[k] = e.dynamic and e.dynamic[k]

 			end

 		end

 		local n = 0

 		for k in pairs(dynamic) do

 			n = n + 1

 		end

 		if n > 0 then

 			e.dynamic = { }

 			for k in pairs(dynamic) do

 				e.dynamic[k] = true

 			end

 		else

 			e.dynamic = nil

 		end

 		return path, dynamic

 	end)

 end

 function Loona:isdynamic(path)

 	path = path or self.sectionpath

 	local exists

 	local t, i = self:checkpath(path)

 	if t then

 		exists = true

 		if t[i].redirect then

 			path = t[i].redirect

 			t, i, exists = self:isdynamic(path) -- TODO: prohibit endless recursion

 		end

 	end

 	if t then

 		if t[i] then

 			t = t[i].dynamic

 		end

 	end

 	return t, path, exists

 end

 function Loona:dumphtml(o)

 	local outbuf = { }

 	o = o or { }

 	o.nologin = true

 	o.out = function(self, s) table.insert(outbuf, s) end

 	o.addheader = function(self, s) end

 	o = self:new(o):run()

 	if not o:isdynamic() then

 		local path = o.sectionname

 		path = path == o.config.defname and "index" or path

 		local srcname = o.config.htdocsdir .. "/" .. path .. o.htmlext

 		local fh, msg = open(srcname .. ".tmp", "wb")

 		assert(fh, self:dbmsg("Could not write cached HTML", msg))

 		for _, line in ipairs(outbuf) do

 			fh:write(line)

 		end

 		fh:close()

 		local dstname = o.config.htmlcachedir .. "/" .. path .. o.htmlext

 		local success, msg = posix.symlink(srcname, dstname .. ".tmp")

 		-- assert(success, self:dbmsg("Could not link to cached HTML", msg))

 	end

 end