fix: ads balance check

Cargo.toml

@@ -10,9 +10,9 @@ package.homepage = "https://tetratto.com"
 incremental = true
 
 [profile.release]
-opt-level = "z"
+opt-level = 3
 lto = true
-codegen-units = 1
+codegen-units = 2
 # panic = "abort"
 panic = "unwind"
 strip = true

crates/app/src/assets.rs

@@ -38,6 +38,7 @@ pub const STREAMS_JS: &str = include_str!("./public/js/streams.js");
 pub const CARP_JS: &str = include_str!("./public/js/carp.js");
 pub const PROTO_LINKS_JS: &str = include_str!("./public/js/proto_links.js");
 pub const APP_SDK_JS: &str = include_str!("./public/js/app_sdk.js");
+pub const ADS_JS: &str = include_str!("./public/js/ads.js");
 
 // html
 pub const BODY: &str = include_str!("./public/html/body.lisp");
@@ -152,6 +153,8 @@ pub const ECONOMY_WALLET: &str = include_str!("./public/html/economy/wallet.lisp
 pub const ECONOMY_PRODUCTS: &str = include_str!("./public/html/economy/products.lisp");
 pub const ECONOMY_EDIT: &str = include_str!("./public/html/economy/edit.lisp");
 pub const ECONOMY_PRODUCT: &str = include_str!("./public/html/economy/product.lisp");
+pub const ECONOMY_EDIT_AD: &str = include_str!("./public/html/economy/edit_ad.lisp");
+pub const ECONOMY_AD: &str = include_str!("./public/html/economy/ad.lisp");
 
 // langs
 pub const LANG_EN_US: &str = include_str!("./langs/en-US.toml");
@@ -390,6 +393,8 @@ pub(crate) async fn write_assets(config: &Config) -> PathBufD {
     write_template!(html_path->"economy/products.html"(crate::assets::ECONOMY_PRODUCTS) --config=config --lisp plugins);
     write_template!(html_path->"economy/edit.html"(crate::assets::ECONOMY_EDIT) --config=config --lisp plugins);
     write_template!(html_path->"economy/product.html"(crate::assets::ECONOMY_PRODUCT) --config=config --lisp plugins);
+    write_template!(html_path->"economy/edit_ad.html"(crate::assets::ECONOMY_EDIT_AD) --config=config --lisp plugins);
+    write_template!(html_path->"economy/ad.html"(crate::assets::ECONOMY_AD) --config=config --lisp plugins);
 
     html_path
 }

crates/app/src/langs/en-US.toml

@@ -208,6 +208,7 @@ version = "1.0.0"
 "settings:tab.billing" = "Billing"
 "settings:tab.uploads" = "Uploads"
 "settings:tab.invites" = "Invites"
+"setttings:label.applied_configurations" = "Applied configurations"
 
 "mod_panel:label.open_reported_content" = "Open reported content"
 "mod_panel:label.manage_profile" = "Manage profile"
@@ -337,9 +338,22 @@ version = "1.0.0"
 "economy:label.create_new" = "Create new product"
 "economy:label.price" = "Price"
 "economy:label.on_sale" = "On sale"
+"economy:label.single_use" = "Only allow users to purchase once"
 "economy:label.stock" = "Stock"
 "economy:label.unlimited" = "Unlimited"
 "economy:label.fulfillment_style" = "Fulfillment style"
 "economy:label.use_automail" = "Use automail"
 "economy:label.automail_message" = "Automail message"
 "economy:action.buy" = "Buy"
+"economy:label.already_purchased" = "Already purchased"
+"economy:label.snippet_data" = "Snippet data"
+"economy:action.apply" = "Apply"
+"economy:action.unapply" = "Unapply"
+"economy:label.thumbnails" = "Thumbnails"
+"economy:label.my_ads" = "My ads"
+"economy:label.create_new_ad" = "Create new advertisement"
+"economy:label.target" = "Target URL"
+"economy:label.image" = "Image"
+"economy:label.size_base" = "Size base"
+"economy:label.running" = "Running"
+"economy:label.embed_ads_on_my_site" = "Embed ads on my site"

crates/app/src/public/css/root.css

@@ -201,8 +201,7 @@ p {
 .name {
     max-width: 250px;
     overflow: hidden;
-    /* overflow-wrap: break-word; */
-    overflow-wrap: anywhere;
+    white-space: nowrap;
     text-overflow: ellipsis;
 }
 

crates/app/src/public/css/style.css

@@ -1,5 +1,10 @@
 @import url("root.css");
 
+/* ads */
+.tetratto_ad iframe {
+    border-radius: var(--radius);
+}
+
 /* media gallery */
 .media_gallery {
     display: grid;
@@ -12,7 +17,9 @@
 
 @media screen and (max-width: 900px) {
     .media_gallery {
-        grid-auto-flow: row dense;
+        /* grid-auto-flow: row dense; */ /* safari is the most shit browser ever dude, this property causes safari to make images overlap for lord knows why */
+        display: flex;
+        flex-direction: column;
     }
 }
 
@@ -556,6 +563,10 @@ input[type="checkbox"]:checked {
     background-image: url("/icons/check.svg");
 }
 
+label {
+    cursor: pointer;
+}
+
 /* pillmenu */
 .pillmenu {
     display: flex;

crates/app/src/public/html/body.lisp

@@ -1,5 +1,10 @@
 (div ("id" "toast_zone"))
 
+; ads
+(script ("src" "/js/ads.js?v=tetratto-{{ random_cache_breaker }}"))
+(script
+    (text "TetrattoAds.init();"))
+
 ; large text
 (text "{% if user and user.settings.large_text -%}")
 (style
@@ -76,6 +81,8 @@
             return;
         }
 
+        TetrattoAds.render_ads(\"{{ config.system_user }}\", \"\");
+
         atto.disconnect_observers();
         atto.remove_false_options();
         atto.clean_date_codes();

crates/app/src/public/html/communities/create_post.lisp

@@ -182,7 +182,7 @@
                             (text "{%- endif %} {%- endif %}")
                             (button
                                 ("class" "primary")
-                                (text "{{ text \"communities:action.create\" }}"))))))
+                                (str (text "communities:action.create")))))))
             (text "{% if not quoting -%}")
             (script
                 (text "async function create_post_from_form(e) {

crates/app/src/public/html/communities/list.lisp

@@ -39,7 +39,7 @@
                 (span
                     (text "Make this a forum community")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
     (text "{% if list|length >= 4 -%} {{ components::supporter_ad(body=\"Become a supporter to create up to 10 communities!\") }} {%- endif %} {%- endif %}")
     (div
         ("class" "card_nest w_full")

crates/app/src/public/html/communities/settings.lisp

@@ -1,7 +1,6 @@
 (text "{% extends \"root.html\" %} {% block head %}")
 (title
     (text "Community settings - {{ config.name }}"))
-
 (text "{% endblock %} {% block body %} {{ macros::nav() }}")
 (main
     ("class" "flex flex_col gap_2")
@@ -303,7 +302,7 @@
                         ("minlength" "2")
                         ("maxlength" "32")))
                 (button
-                    (text "{{ text \"communities:action.create\" }}"))))
+                    (str (text "communities:action.create")))))
         (text "{% for channel in channels %}")
         (div
             ("class" "card_nest")
@@ -447,7 +446,7 @@
                     (text "{{ text \"communities:label.upload\" }}")))
             (form
                 ("class" "card flex flex_col gap_2")
-                ("onsubmit" "upload_emoji(event)")
+                ("onsubmit" "create_emoji_from_form(event)")
                 (div
                     ("class" "flex flex_col gap_1")
                     (label
@@ -473,11 +472,10 @@
                         ("accept" "image/png,image/jpeg,image/avif,image/webp")
                         ("class" "w_full")))
                 (button
-                    (text "{{ text \"communities:action.create\" }}"))
+                    (str (text "communities:action.create")))
                 (span
                     ("class" "fade")
-                    (text "Emojis can be a maximum of 256 KiB, or 512x512px (width x
-                    height)."))))
+                    (text "Emojis can be a maximum of 256 KiB."))))
         (text "{% for emoji in emojis %}")
         (div
             ("class" "card secondary flex flex_wrap gap_2 items_center justify_between")
@@ -506,7 +504,7 @@
                         (text "{{ text \"stacks:label.remove\" }}")))))
         (text "{% endfor %}"))
     (script
-        (text "globalThis.upload_emoji = (e) => {
+        (text "globalThis.create_emoji_from_form = (e) => {
             e.preventDefault();
             e.target.querySelector(\"button\").style.display = \"none\";
 
@@ -525,6 +523,10 @@
                     ]);
 
                     e.target.querySelector(\"button\").removeAttribute(\"style\");
+
+                    if (res.ok) {
+                        e.target.reset();
+                    }
                 });
 
             alert(\"Emoji upload in progress. Please wait!\");
@@ -644,7 +646,7 @@
                         ("min" "0")
                         ("max" "256")))
                 (button
-                    (text "{{ text \"communities:action.create\" }}"))))
+                    (str (text "communities:action.create")))))
         (text "{% for id, topic in community.topics %}")
         (div
             ("class" "card_nest")

crates/app/src/public/html/components.lisp

@@ -87,13 +87,13 @@
     (span
         (text "{{ dislikes }}"))
     (text "{%- endif %}"))
-(text "{%- endif %} {%- endmacro %} {% macro full_username(user) -%} {% if user and user.username -%}")
+(text "{%- endif %} {%- endmacro %} {% macro full_username(user, wrap=true, max_width=\"180px\") -%} {% if user and user.username -%}")
 (div
-    ("class" "flex items_center")
+    ("class" "flex {% if wrap -%} flex_wrap {%- endif %} items_center")
     (a
         ("href" "/@{{ user.username }}")
-        ("class" "flush flex gap_1")
-        ("style" "font-weight: 600")
+        ("class" "name flush flex gap_1")
+        ("style" "font-weight: 600; max-width: {{ max_width }}")
         ("target" "_top")
         (text "{% if user.settings.private_profile -%}")
         (span
@@ -107,7 +107,7 @@
         (text "{% else %}")
         (text "{{ self::username(user=user) }}")
         (text "{%- endif %}"))
-    (text "{{ self::online_indicator(user=user) }} {% if user.is_verified -%}")
+    (text "{{ self::online_indicator(user=user) }} {% if not user.settings.hide_username_badges -%} {% if user.is_verified -%}")
     (span
         ("title" "Verified")
         ("style" "color: var(--color-primary)")
@@ -119,13 +119,19 @@
         ("style" "color: var(--color-primary);")
         ("class" "flex items_center")
         (text "{{ icon \"star\" }}"))
+    (text "{%- endif %} {% if user.checkouts|length > 0 -%}")
+    (span
+        ("title" "Donator")
+        ("style" "color: var(--color-primary);")
+        ("class" "flex items_center")
+        (text "{{ icon \"hand-heart\" }}"))
     (text "{%- endif %} {% if user.permissions|has_staff_badge -%}")
     (span
         ("title" "Staff")
         ("style" "color: var(--color-primary);")
         ("class" "flex items_center")
         (text "{{ icon \"shield-user\" }}"))
-    (text "{%- endif %}"))
+    (text "{%- endif %} {%- endif %}"))
 (text "{%- endif %} {%- endmacro %} {% macro repost(repost, post, owner, secondary=false, community=false, show_community=true, can_manage_post=false) -%}")
 (div
     ("style" "display: contents")
@@ -378,7 +384,7 @@
                         (text "{{ self::avatar(username=owner.username, size=\"24px\", selector_type=\"username\") }}"))
                     (text "{%- endif %}")
                     (span
-                        ("class" "name")
+                        ; ("class" "name")
                         (text "{{ self::full_username(user=owner) }}"))
                     (text "{{ self::post_info(post=post, community=community) }}")
                     (text "{% if post.context.is_pinned or post.context.is_profile_pinned -%} {{ icon \"pin\" }} {%- endif %}"))
@@ -459,14 +465,15 @@
     (text "{% if community and show_community and community.id != config.town_square or question %}"))
 (text "{%- endif %} {%- endmacro %}")
 
-(text "{% macro post_media(upload_ids) -%} {% if upload_ids|length > 0 -%}")
+(text "{% macro post_media(upload_ids, custom_click=false) -%} {% if upload_ids|length > 0 -%}")
 (div
     ("class" "media_gallery gap_2")
     (text "{% for upload in upload_ids %}")
     (img
         ("src" "/api/v1/uploads/{{ upload }}")
+        ("data-upload-id" "{{ upload }}")
         ("alt" "Image upload")
-        ("onclick" "trigger('ui::lightbox_open', ['/api/v1/uploads/{{ upload }}'])"))
+        ("onclick" "{% if custom_click -%} {{ custom_click }} {%- else -%} trigger('ui::lightbox_open', ['/api/v1/uploads/{{ upload }}']) {%- endif %}"))
     (text "{% endfor %}"))
 (text "{%- endif %} {%- endmacro %} {% macro notification(notification) -%}")
 (div
@@ -617,9 +624,8 @@
         (div
             ("class" "flex items_center")
             (b
-                (text "{{ self::username(user=user) }}"))
+                (text "{{ self::full_username(user=user) }}"))
             (text "{{ self::online_indicator(user=user) }}"))))
-
 (text "{%- endmacro %} {% macro pagination(page=0, items=0, key=\"\", value=\"\") -%}")
 (div
     ("class" "flex justify_between gap_2 w_full")
@@ -888,7 +894,7 @@
             (div
                 ("class" "flex gap_2")
                 (button
-                    (text "{{ text \"communities:action.create\" }}"))
+                    (str (text "communities:action.create")))
 
                 (text "{% if drawing_enabled -%}")
                 (button
@@ -1344,15 +1350,15 @@
             (text "Listening to "))
         (text "{{ other_user.connections.Spotify[1].data.artist }}")))
 
-(text "{%- endif %} {%- endmacro %} {% macro user_plate(user, show_menu=false, show_kick=false, secondary=false) -%}")
+(text "{%- endif %} {%- endmacro %} {% macro user_plate(user, show_menu=false, show_kick=false, secondary=false, full=false) -%}")
 (div
-    ("class" "flex gap_2 items_center card tiny user_plate {% if secondary -%}secondary{%- endif %}")
+    ("class" "flex gap_2 items_center card tiny user_plate {% if secondary -%}secondary{%- endif %} {% if full -%} w_full {%- endif %}")
     (a
         ("href" "/@{{ user.username }}")
         (text "{{ self::avatar(username=user.username, size=\"42px\", selector_type=\"username\") }}"))
     (div
         ("class" "flex justify_center flex_col")
-        ("style" "{% if show_menu or show_kick -%}width: 60%{% else %}max-width: 150px{%- endif %}")
+        ("style" "{% if show_menu or show_kick -%}width: 60%{% else %}max-width: calc(100% - 42px - var(--pad-4)){%- endif %}")
         (text "{{ self::full_username(user=user) }}")
         (div
             ("class" "user_status")
@@ -2485,6 +2491,13 @@
         (text "Create infinite Littleweb sites"))
     (li
         (text "Create infinite Littleweb domains"))
+    (li
+        (text "Create and sell CSS snippet products"))
+
+    (text "{% if config.enable_user_ads -%}")
+    (li
+        (text "No ads"))
+    (text "{%- endif %}")
 
     (text "{% if config.security.enable_invite_codes -%}")
     (li
@@ -2701,3 +2714,33 @@
         (icon (text "badge-cent"))
         (text "{{ product.price }}")))
 (text "{%- endmacro %}")
+
+(text "{% macro ad_listing_card(ad) -%}")
+(a
+    ("class" "card button lowered w_full flex flex_col gap_2")
+    ("href" "/product/ad/{{ ad.id }}/edit")
+    (b
+        ("class" "flex gap_2 items_center")
+        ("style" "height: 24px; text-decoration: {% if not ad.is_running -%} line-through {%- else -%} none {%- endif %}")
+        (icon (text "link"))
+        (text "{{ ad.target }}"))
+    (b
+        ("style" "height: 18px")
+        (text "{% if ad.is_running -%}")
+        (span
+            ("class" "green flex gap_2 items_center")
+            (icon (text "circle-check"))
+            (text "Running"))
+        (text "{% else %}")
+        (span
+            ("class" "red flex gap_2 items_center")
+            (icon (text "circle-x"))
+            (text "Not running"))
+        (text "{%- endif %}")))
+(text "{%- endmacro %}")
+
+(text "{% macro advertisement(size=\"Leaderboard\") -%}")
+(text "{% if not is_supporter and config.enable_user_ads -%}")
+(object ("class" "tetratto_ad") ("data-ad-size" "{{ size }}"))
+(text "{%- endif %}")
+(text "{%- endmacro %}")

crates/app/src/public/html/developer/home.lisp

@@ -54,7 +54,7 @@
                     ("placeholder" "redirect URL")
                     ("minlength" "2")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
 
     ; app listing
     (div

crates/app/src/public/html/economy/ad.lisp

@@ -0,0 +1,63 @@
+(text "<!doctype html>")
+(html
+    ("lang" "en")
+    (head
+        (meta ("charset" "UTF-8"))
+        (meta ("name" "viewport") ("content" "width=device-width, initial-scale=1.0"))
+        (meta ("http-equiv" "X-UA-Compatible") ("content" "ie=edge")))
+    (body
+        (a
+            ("href" "{% if not disable_click -%} {{ config.host }}/api/v1/ads/host/{{ host }}/{{ ad.id }}/click {%- endif %}")
+            ("title" "Advertisement")
+            ("target" "_blank")
+            ("class" "ad"))
+
+        (span ("class" "display_tag") (text "Ad"))
+
+        (style
+            (text "* {
+                margin: 0;
+                padding: 0;
+                box-sizing: border-box;
+            }
+
+            html,
+            body {
+                line-height: 1.5;
+                letter-spacing: 0.15px;
+                font-family:
+                    \"Inter\", \"Poppins\", \"Roboto\", ui-sans-serif, system-ui, sans-serif,
+                    \"Apple Color Emoji\", \"Segoe UI Emoji\", \"Segoe UI Symbol\",
+                    \"Noto Color Emoji\";
+            }
+
+            body {
+                overflow: hidden;
+                display: grid;
+                place-items: center;
+            }
+
+            a.ad {
+                display: inline;
+                width: 100dvw;
+                height: 100dvh;
+                background-image: url(\"{{ config.host|safe }}/api/v1/uploads/{{ ad.upload_id }}\");
+                background-position: center;
+                background-size: contain;
+            }
+
+            .display_tag {
+                position: absolute;
+                top: 0.5rem;
+                left: 0.5rem;
+                padding: 0.15rem 0.5rem;
+                background: hsla(0, 0%, 0%, 50%);
+                color: white;
+                font-weight: 600;
+                font-size: 10px;
+                user-select: none;
+                pointer-events: none;
+                border-radius: 0.4rem;
+                box-shadow: 0 0 2px hsla(0, 0%, 0%, 25%);
+                opacity: 25%;
+            }"))))

crates/app/src/public/html/economy/edit.lisp

@@ -4,6 +4,23 @@
 (text "{% endblock %} {% block body %} {{ macros::nav(selected=\"\") }}")
 (main
     ("class" "flex flex_col gap_2")
+    (div
+        ("class" "card_nest")
+        (div
+            ("class" "card small flex items_center gap_2")
+            (icon (text "images"))
+            (b
+                (str (text "economy:label.thumbnails"))))
+        (div
+            ("class" "card flex flex_col gap_2")
+            (text "{{ components::post_media(upload_ids=product.uploads.thumbnails, custom_click=\"remove_thumbnail(event.target)\") }}")
+            (text "{% if product.uploads.thumbnails|length < 4 -%}")
+            (button
+                ("onclick" "add_thumbnail()")
+                (icon (text "plus"))
+                (str (text "communities:label.upload")))
+            (text "{%- endif %}")))
+
     (div
         ("class" "card_nest")
         (div
@@ -77,10 +94,22 @@
                     ("oninput" "event.preventDefault(); update_on_sale_from_form(event.target.checked)"))
                 (span
                     (str (text "economy:label.on_sale"))))
+            (label
+                ("for" "single_use")
+                ("class" "flex items_center gap_2")
+                (input
+                    ("type" "checkbox")
+                    ("id" "single_use")
+                    ("name" "single_use")
+                    ("class" "w_content")
+                    ("checked" "{{ product.single_use }}")
+                    ("oninput" "event.preventDefault(); update_single_use_from_form(event.target.checked)"))
+                (span
+                    (str (text "economy:label.single_use"))))
             (div
                 ("class" "flex flex_col gap_1")
                 (label
-                    ("for" "title")
+                    ("for" "price")
                     (str (text "economy:label.price")))
                 (input
                     ("type" "number")
@@ -118,7 +147,7 @@
             (div
                 ("class" "flex flex_col gap_1")
                 (label
-                    ("for" "title")
+                    ("for" "stock")
                     (str (text "economy:label.stock")))
                 (input
                     ("type" "number")
@@ -138,11 +167,20 @@
             (icon (text "package-check"))
             (b
                 (str (text "economy:label.fulfillment_style"))))
-        (form
+        (div
             ("class" "card flex flex_col gap_2")
+            (select
+                ("id" "fulfillment_style_select")
+                ("onchange" "mirror_fulfillment_style_select(true)")
+                (option ("value" "mail") (text "Mail") ("selected" "{{ not product.method == \"ProfileStyle\" }}"))
+                (option ("value" "snippet") (text "CSS Snippet") ("selected" "{{ product.method == \"ProfileStyle\" }}")))
+            (form
+                ("class" "flex flex_col gap_2 hidden")
+                ("id" "mail_fulfillment")
                 ("onsubmit" "update_method_from_form(event)")
                 (p (text "If you choose to send an automated mail letter upon purchase, users will automatically receive the message you supply below."))
                 (p (text "If you disable automail, you'll be required to manually mail users who have purchased your product before the transfer is finalized."))
+                (text "{% set is_automail = product.method != \"ManualMail\" and product.method != \"ProfileStyle\" %}")
 
                 (label
                     ("for" "use_automail")
@@ -153,7 +191,7 @@
                         ("name" "use_automail")
                         ("class" "w_content")
                         ("oninput" "mirror_use_automail()")
-                    ("checked" "{% if product.method != \"ManualMail\" -%} true {%- else -%} false {%- endif %}"))
+                        ("checked" "{% if is_automail -%} true {%- else -%} false {%- endif %}"))
                     (span
                         (str (text "economy:label.use_automail"))))
                 (div
@@ -165,17 +203,122 @@
                         ("name" "automail_message")
                         ("id" "automail_message")
                         ("placeholder" "automail_message")
-                    (text "{% if product.method != \"ManualMail\" -%} {{ product.method.AutoMail }} {%- endif %}")))
-            (button (str (text "general:action.save")))))
+                        (text "{% if is_automail -%} {{ product.method.AutoMail }} {%- endif %}")))
+                (button (str (text "general:action.save"))))
+            (form
+                ("class" "flex flex_col gap_2 hidden")
+                ("id" "snippet_fulfillment")
+                ("onsubmit" "update_data_from_form(event)")
+                (text "{{ components::supporter_ad(body=\"Become a supporter to create snippets!\") }}")
+                (div
+                    ("class" "flex flex_col gap_1")
+                    (label
+                        ("for" "data")
+                        (str (text "economy:label.snippet_data")))
+                    (textarea
+                        ("name" "data")
+                        ("id" "data")
+                        ("placeholder" "data")
+                        (text "{{ product.data }}")))
+                (button (str (text "general:action.save"))))))
 
+    (div
+        ("class" "flex gap_2")
         (a
             ("class" "button secondary")
             ("href" "/product/{{ product.id }}")
             (icon (text "arrow-left"))
-        (str (text "general:action.back"))))
+            (str (text "general:action.back")))
+
+        (button
+            ("class" "lowered red")
+            ("onclick" "delete_product()")
+            (icon (text "trash"))
+            (str (text "general:action.delete")))))
 
 (script
-    (text "async function update_title_from_form(e) {
+    (text "async function add_thumbnail() {
+        await trigger(\"atto::debounce\", [\"products::update\"]);
+
+        const picker = document.createElement(\"input\");
+        picker.type = \"file\";
+        picker.accept = \"image/*\";
+        document.body.appendChild(picker);
+        picker.click();
+
+        picker.addEventListener(\"change\", () => {
+            // create body
+            const body = new FormData();
+
+            for (const file of picker.files) {
+                body.append(file.name, file);
+            }
+
+            body.append(
+                \"body\",
+                JSON.stringify({
+                    target: \"Thumbnails\"
+                }),
+            );
+
+            // ...
+            picker.remove();
+            fetch(\"/api/v1/products/{{ product.id }}/uploads\", {
+                method: \"POST\",
+                body,
+            })
+                .then((res) => res.json())
+                .then(async (res) => {
+                    trigger(\"atto::toast\", [
+                        res.ok ? \"success\" : \"error\",
+                        res.message,
+                    ]);
+
+                    if (res.ok) {
+                        setTimeout(() => {
+                            window.location.reload();
+                        }, 100);
+                    }
+                });
+        });
+    }
+
+    async function remove_thumbnail(target) {
+        await trigger(\"atto::debounce\", [\"products::update\"]);
+
+        if (
+            !(await trigger(\"atto::confirm\", [
+                \"Are you sure you would like to do this?\",
+            ]))
+        ) {
+            return;
+        }
+
+        fetch(\"/api/v1/products/{{ product.id }}/uploads/thumbnails\", {
+            method: \"DELETE\",
+            headers: {
+                \"Content-Type\": \"application/json\",
+            },
+            body: JSON.stringify({
+                idx: Array.from(target.parentElement.children).findIndex((x) => x.getAttribute(\"data-upload-id\") === target.getAttribute(\"data-upload-id\")),
+            }),
+        })
+            .then((res) => res.json())
+            .then(async (res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+
+                if (res.ok) {
+                    setTimeout(() => {
+                        window.location.reload();
+                    }, 100);
+                }
+            });
+    }
+
+    async function update_title_from_form(e) {
         e.preventDefault();
         await trigger(\"atto::debounce\", [\"products::update\"]);
 
@@ -240,6 +383,27 @@
             });
     }
 
+    async function update_single_use_from_form(single_use) {
+        await trigger(\"atto::debounce\", [\"products::update\"]);
+
+        fetch(\"/api/v1/products/{{ product.id }}/single_use\", {
+            method: \"POST\",
+            headers: {
+                \"Content-Type\": \"application/json\",
+            },
+            body: JSON.stringify({
+                single_use,
+            }),
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+            });
+    }
+
     async function update_price_from_form(e) {
         e.preventDefault();
         await trigger(\"atto::debounce\", [\"products::update\"]);
@@ -306,6 +470,49 @@
             });
     }
 
+    async function update_data_from_form(e) {
+        e.preventDefault();
+        await trigger(\"atto::debounce\", [\"products::update\"]);
+
+        fetch(\"/api/v1/products/{{ product.id }}/data\", {
+            method: \"POST\",
+            headers: {
+                \"Content-Type\": \"application/json\",
+            },
+            body: JSON.stringify({
+                data: e.target.data.value,
+            }),
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+            });
+    }
+
+    async function delete_product() {
+        if (
+            !(await trigger(\"atto::confirm\", [
+                \"Are you sure you would like to do this?\",
+            ]))
+        ) {
+            return;
+        }
+
+        fetch(\"/api/v1/products/{{ product.id }}\", {
+            method: \"DELETE\",
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+            });
+    };
+
     globalThis.mirror_use_automail = () => {
         const use_automail = document.getElementById(\"use_automail\").checked;
 
@@ -316,7 +523,46 @@
         }
     }
 
+    globalThis.mirror_fulfillment_style_select = (send = false) => {
+        const selected = document.getElementById(\"fulfillment_style_select\").selectedOptions[0].value;
+
+        if (selected === \"mail\") {
+            document.getElementById(\"mail_fulfillment\").classList.remove(\"hidden\");
+            document.getElementById(\"snippet_fulfillment\").classList.add(\"hidden\");
+
+            if (send) {
+                update_method_from_form({
+                    preventDefault: () => {},
+                    target: document.getElementById(\"mail_fulfillment\"),
+                });
+            }
+        } else {
+            document.getElementById(\"mail_fulfillment\").classList.add(\"hidden\");
+            document.getElementById(\"snippet_fulfillment\").classList.remove(\"hidden\");
+
+            if (send) {
+                fetch(\"/api/v1/products/{{ product.id }}/method\", {
+                    method: \"POST\",
+                    headers: {
+                        \"Content-Type\": \"application/json\",
+                    },
+                    body: JSON.stringify({
+                        method: \"ProfileStyle\",
+                    }),
+                })
+                    .then((res) => res.json())
+                    .then((res) => {
+                        trigger(\"atto::toast\", [
+                            res.ok ? \"success\" : \"error\",
+                            res.message,
+                        ]);
+                    });
+            }
+        }
+    }
+
     setTimeout(() => {
         mirror_use_automail();
+        mirror_fulfillment_style_select();
     }, 150);"))
 (text "{% endblock %}")

crates/app/src/public/html/economy/edit_ad.lisp

@@ -0,0 +1,97 @@
+(text "{% extends \"root.html\" %} {% block head %}")
+(title
+    (text "Manage advertisement - {{ config.name }}"))
+(text "{% endblock %} {% block body %} {{ macros::nav(selected=\"\") }}")
+(main
+    ("class" "flex flex_col gap_2")
+    (div
+        ("class" "card_nest")
+        (div
+            ("class" "card small flex gap_2 items_center")
+            (icon (text "link"))
+            (b
+                (text "{{ ad.target }}")))
+        (form
+            ("class" "card flex flex_col gap_2")
+            ("onsubmit" "event.preventDefault(); update_is_running_from_form(event.target.is_running.checked)")
+            (object ("class" "tetratto_ad") ("data-ad-size" "{{ ad.size }}") ("data-noclick" "true") ("data-ad-id" "{{ ad.id }}"))
+            (ul
+                (li
+                    (text "{% if ad.last_charge_time != 0 -%}")
+                    (text "Last charge: ") (span ("class" "date") (text "{{ ad.last_charge_time }}"))
+                    (text "{% else %}")
+                    (text "No previous charges")
+                    (text "{%- endif %}")))
+            (div ("class" "squig"))
+            (p (text "Each day your ad is viewed, you'll be charged 25 coins. This charge only applies to the very first view of the day."))
+            (p (text "Additionally, you'll be charged 2 coins per click on your ad. This fee will be paid to the user which hosts the site your ad was shown on."))
+            (p (text "Each of these transfers will be shown in your wallet's transfer table as either \"AdClick\" or \"AdCharge\"."))
+            (label
+                ("for" "is_running")
+                ("class" "flex items_center gap_2")
+                (input
+                    ("type" "checkbox")
+                    ("id" "is_running")
+                    ("name" "is_running")
+                    ("class" "w_content")
+                    ("checked" "{{ ad.is_running }}"))
+                (span
+                    (str (text "economy:label.running"))))
+            (button (str (text "general:action.save")))))
+
+    (div
+        ("class" "flex gap_2")
+        (a
+            ("class" "button secondary")
+            ("href" "/products")
+            (icon (text "arrow-left"))
+            (str (text "general:action.back")))
+
+        (button
+            ("class" "lowered red")
+            ("onclick" "delete_ad()")
+            (icon (text "trash"))
+            (str (text "general:action.delete")))))
+
+(script
+    (text "async function update_is_running_from_form(is_running) {
+        await trigger(\"atto::debounce\", [\"products::update\"]);
+        fetch(\"/api/v1/ads/{{ ad.id }}/running\", {
+            method: \"POST\",
+            headers: {
+                \"Content-Type\": \"application/json\",
+            },
+            body: JSON.stringify({
+                is_running,
+            }),
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+            });
+    }
+
+    async function delete_ad() {
+        if (
+            !(await trigger(\"atto::confirm\", [
+                \"Are you sure you would like to do this?\",
+            ]))
+        ) {
+            return;
+        }
+
+        fetch(\"/api/v1/ads/{{ ad.id }}\", {
+            method: \"DELETE\",
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+            });
+    };"))
+(text "{% endblock %}")

crates/app/src/public/html/economy/product.lisp

@@ -4,6 +4,7 @@
 (text "{% endblock %} {% block body %} {{ macros::nav(selected=\"\") }}")
 (main
     ("class" "flex flex_col gap_2")
+    (text "{{ components::post_media(upload_ids=product.uploads.thumbnails) }}")
     (div
         ("class" "card flex flex_col gap_2")
         (h3
@@ -19,21 +20,46 @@
             ("class" "card lowered w_full no_p_margin")
             (text "{{ product.description|markdown|safe }}"))
 
+        (text "{% if already_purchased -%}")
+        (span
+            ("class" "green flex items_center gap_2")
+            (icon (text "circle-check"))
+            (str (text "economy:label.already_purchased")))
+        (text "{%- endif %}")
+
         (div
             ("class" "flex gap_2 items_center")
+            (text "{% if user.id != product.owner -%}")
+            (text "{% if not already_purchased -%}")
+            ; price
             (a
                 ("class" "button camo lowered")
                 ("href" "/wallet")
                 ("target" "_blank")
                 (icon (text "badge-cent"))
                 (text "{{ product.price }}"))
-            (text "{% if user.id != product.owner -%}")
+            ; buy button
             (button
                 ("onclick" "purchase()")
                 ("disabled" "{{ product.stock == 0 }}")
                 (icon (text "piggy-bank"))
                 (str (text "economy:action.buy")))
             (text "{% else %}")
+            ; profile style snippets
+            (text "{% if product.method == \"ProfileStyle\" -%} {% if not product.id in applied_configurations_mapped -%}")
+            (button
+                ("onclick" "apply()")
+                (icon (text "check"))
+                (str (text "economy:action.apply")))
+            (text "{% else %}")
+            (button
+                ("onclick" "remove()")
+                (icon (text "x"))
+                (str (text "economy:action.unapply")))
+            (text "{%- endif %} {%- endif %}")
+            ; ...
+            (text "{%- endif %}")
+            (text "{% else %}")
             (a
                 ("class" "button")
                 ("href" "/product/{{ product.id }}/edit")
@@ -62,6 +88,59 @@
                     res.ok ? \"success\" : \"error\",
                     res.message,
                 ]);
+
+                if (res.ok) {
+                    window.location.reload();
+                }
+            });
+    }
+
+    async function apply() {
+        await trigger(\"atto::debounce\", [\"user::update\"]);
+        fetch(\"/api/v1/auth/user/{{ user.id }}/applied_configuration\", {
+            method: \"POST\",
+            headers: {
+                \"Content-Type\": \"application/json\",
+            },
+            body: JSON.stringify({
+                \"type\": \"StyleSnippet\",
+                \"id\": \"{{ product.id }}\",
+            }),
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+
+                if (res.ok) {
+                    window.location.reload();
+                }
+            });
+    }
+
+    async function remove() {
+        await trigger(\"atto::debounce\", [\"user::update\"]);
+        fetch(\"/api/v1/auth/user/{{ user.id }}/applied_configuration\", {
+            method: \"DELETE\",
+            headers: {
+                \"Content-Type\": \"application/json\",
+            },
+            body: JSON.stringify({
+                \"id\": \"{{ product.id }}\",
+            }),
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+
+                if (res.ok) {
+                    window.location.reload();
+                }
             });
     }"))
 (text "{% endblock %}")

crates/app/src/public/html/economy/products.lisp

@@ -43,7 +43,7 @@
                     ("minlength" "2")
                     ("maxlength" "1024")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
 
     ; product listing
     (div
@@ -56,7 +56,105 @@
         (div
             ("class" "card flex flex_col gap_2")
             (text "{% for item in list %} {{ components::product_listing_card(product=item, edit=true) }} {% endfor %}")
-            (text "{{ components::pagination(page=page, items=list|length) }}"))))
+            ; selective pagination
+            (text "{% if page_set_id == 0 -%}")
+            (text "{{ components::pagination(page=page, items=list|length) }}")
+            (text "{% else %}")
+            (text "{{ components::pagination(page=0, items=list|length) }}")
+            (text "{%- endif %}")))
+
+    (text "{% if config.enable_user_ads -%}")
+    (div ("class" "squig") ("style" "--background: var(--color-surface)"))
+
+    ; create new ad
+    (div
+        ("class" "card_nest")
+        (div
+            ("class" "card small")
+            (b
+                (str (text "economy:label.create_new_ad"))))
+        (form
+            ("class" "card flex flex_col gap_2")
+            ("onsubmit" "create_ad_from_form(event)")
+            (div
+                ("class" "flex flex_col gap_1")
+                (label
+                    ("for" "target")
+                    (str (text "economy:label.target")))
+                (input
+                    ("type" "url")
+                    ("name" "target")
+                    ("id" "target")
+                    ("placeholder" "target url")
+                    ("required" "")
+                    ("minlength" "2")
+                    ("maxlength" "128")))
+            (div
+                ("class" "flex flex_col gap_1")
+                (label
+                    ("for" "file")
+                    (str (text "economy:label.image")))
+                (input
+                    ("id" "file")
+                    ("name" "file")
+                    ("type" "file")
+                    ("accept" "image/png,image/jpeg,image/avif,image/webp,image/gif")
+                    ("required" "")
+                    ("class" "w_content")))
+            (div
+                ("class" "flex flex_col gap_1")
+                (label
+                    ("for" "size_base")
+                    (str (text "economy:label.size_base")))
+                (select
+                    ("id" "size_base")
+                    ("name" "size_base")
+                    (option ("value" "Leaderboard") (text "Leaderboard (720x90)"))
+                    (option ("value" "Billboard") (text "Billboard (970x250)"))
+                    (option ("value" "Skyscraper") (text "Skyscraper (160x600)"))
+                    (option ("value" "MediumRectangle") (text "Medium rectangle (300x250)"))
+                    (option ("value" "MobileLeaderboard") (text "Mobile leaderboard (320x50, mobile only)"))))
+            (button
+                (str (text "communities:action.create")))))
+
+    ; ad listing
+    (div
+        ("class" "card_nest")
+        (div
+            ("class" "card small flex items_center gap_2")
+            (icon (text "images"))
+            (str (text "economy:label.my_ads")))
+
+        (div
+            ("class" "card flex flex_col gap_2")
+            (text "{% for item in ads_list %} {{ components::ad_listing_card(ad=item) }} {% endfor %}")
+            ; selective pagination
+            (text "{% if page_set_id == 1 -%}")
+            (text "{{ components::pagination(page=page, items=ads_list|length, key=\"&page_set_id=1\") }}")
+            (text "{% else %}")
+            (text "{{ components::pagination(page=0, items=ads_list|length, key=\"&page_set_id=1\") }}")
+            (text "{%- endif %}")))
+
+    (div
+        ("class" "card_nest")
+        (div
+            ("class" "card small flex items_center gap_2")
+            (icon (text "code"))
+            (str (text "economy:label.embed_ads_on_my_site")))
+
+        (div
+            ("class" "card flex flex_col gap_2")
+            (p (text "You can embed the advertising network into your site to earn a (coin) commission from clicks."))
+            (p (text "Place the following into your site's HTML:"))
+            (pre (code (text "<script src=\"{{ config.host }}\"/js/ads.js\"></script>
+<script>TetrattoAds.init(); TetrattoAds.render_ads(\"{{ user.id }}\", \"{{ config.host }}\")</script>")))
+            (p (text "After you've done that, you can place your ads like so:"))
+            (pre (code (text "<object class=\"tetratto_ad\" data-ad-size=\"$size$\"></object>")))
+            (p
+                (text "In the above example, replace \"$size$\" with a size from ")
+                (a ("href" "https://tetratto.com/reference/tetratto/model/economy/enum.UserAdSize.html") (text "here"))
+                (text " keep in mind that the name of a size must be in title case. That means it's \"Leaderboard\", not \"leaderboard\"."))))
+    (text "{%- endif %}"))
 
 (script
     (text "async function create_product_from_form(e) {
@@ -87,5 +185,43 @@
                     }, 100);
                 }
             });
+    }
+
+    async function create_ad_from_form(e) {
+        e.preventDefault();
+        await trigger(\"atto::debounce\", [\"products::create\"]);
+
+        // create body
+        const body = new FormData();
+
+        for (const file of e.target.file.files) {
+            body.append(file.name, file);
+        }
+
+        body.append(
+            \"body\",
+            JSON.stringify({
+                target: e.target.target.value,
+                size: e.target.size_base.selectedOptions[0].value,
+            }),
+        );
+
+        // ...
+        fetch(\"/api/v1/ads\", {
+            method: \"POST\",
+            body,
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [
+                    res.ok ? \"success\" : \"error\",
+                    res.message,
+                ]);
+
+                if (res.ok) {
+                    e.target.reset();
+                    window.location.reload();
+                }
+            });
     }"))
 (text "{% endblock %}")

crates/app/src/public/html/economy/wallet.lisp

@@ -11,7 +11,13 @@
             (span
                 ("class" "flex items_center gap_2")
                 (icon (text "piggy-bank"))
-                (span (str (text "general:link.wallet")))))
+                (span (str (text "general:link.wallet"))))
+
+            (button
+                ("class" "lowered small square tiny big_icon")
+                ("onclick" "document.getElementById('buy_dialog').showModal()")
+                ("title" "Buy coins")
+                (icon (text "plus"))))
         (div
             ("class" "card lowered flex flex_col gap_4")
             (button
@@ -32,7 +38,7 @@
                 (icon (text "clock"))
                 (span (str (text "economy:label.recent_transfers")))))
         (div
-            ("class" "card lowered flex flex_col gap_4")
+            ("class" "card flex flex_col gap_4")
             (div
                 ("class" "w_full")
                 ("style" "overflow: auto")
@@ -43,26 +49,39 @@
                         (th (text "Sender"))
                         (th (text "Receiver"))
                         (th (text "Amount"))
-                        (th (text "Product")))
+                        (th (text "Product"))
+                        (th (text "Source"))
+                        (th (text "Actions")))
                     (tbody
                         (text "{% for transfer in list -%}")
                         (tr
-                            (td (span ("class" "date short") (text "{{ transfer[1] }}")))
-                            (td ("class" "w_content") (text "{{ components::full_username(user=transfer[3]) }}"))
-                            (td ("class" "w_content") (text "{{ components::full_username(user=transfer[4]) }}"))
+                            (td (span ("class" "date short") (text "{{ transfer[3].created }}")))
+                            (td ("class" "w_content") (text "{{ components::full_username(user=transfer[0], wrap=false) }}"))
+                            (td ("class" "w_content") (text "{{ components::full_username(user=transfer[1], wrap=false) }}"))
                             (td
                                 ("class" "flex items_center gap_1")
-                                (text "{{ transfer[2] }}")
-                                (text "{% if transfer[6] -%}")
+                                (text "{{ transfer[3].amount }}")
+                                (text "{% if transfer[3].is_pending -%}")
                                 (span ("class" "flex items_center gap_1") ("title" "Pending") (icon (text "clock")))
                                 (text "{%- endif %}"))
                             (td
-                                (text "{% if transfer[5] -%}")
+                                (text "{% if transfer[2] -%}")
                                 (a
-                                    ("href" "/product/{{ transfer[5].id }}")
+                                    ("href" "/product/{{ transfer[2].id }}")
                                     (icon (text "external-link")))
+                                (text "{%- endif %}"))
+                            (td (text "{{ transfer[3].source }}"))
+                            (td
+                                (text "{% if user.id == transfer[1].id and transfer[3].source == '\"Sale\"' -%}")
+                                ; we're the receiver
+                                (button
+                                    ("class" "small tiny square raised camo big_icon")
+                                    ("onclick" "issue_refund('{{ transfer[3].id }}')")
+                                    ("title" "Issue refund")
+                                    (icon (text "undo")))
                                 (text "{%- endif %}")))
-                        (text "{%- endfor %}")))))))
+                        (text "{%- endfor %}"))))
+            (text "{{ components::pagination(page=page, items=list|length) }}"))))
 
 (dialog
     ("id" "buy_dialog")
@@ -112,5 +131,23 @@
                     window.location.href = res.payload;
                 }
             });
+    }
+
+    globalThis.issue_refund = async (transfer) => {
+        if (
+            !(await trigger(\"atto::confirm\", [
+                \"Are you sure you would like to do this?\",
+            ]))
+        ) {
+            return;
+        }
+
+        fetch(`/api/v1/transfers/${transfer}/refund`, {
+            method: \"POST\",
+        })
+            .then((res) => res.json())
+            .then((res) => {
+                trigger(\"atto::toast\", [res.ok ? \"success\" : \"error\", res.message]);
+            });
     }"))
 (text "{% endblock %}")

crates/app/src/public/html/forge/home.lisp

@@ -30,7 +30,7 @@
                     ("minlength" "2")
                     ("maxlength" "32")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
     (text "{% else %}")
     (text "{{ components::developer_pass_ad(body=\"Get a developer pass to create forges!\") }}")
     (text "{%- endif %}")

crates/app/src/public/html/littleweb/domains.lisp

@@ -59,7 +59,7 @@
                     (option ("value" "{{ tld }}") (text ".{{ tld|lower }}"))
                     (text "{%- endfor %}")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))
+                (str (text "communities:action.create")))
 
             (details
                 (summary

crates/app/src/public/html/littleweb/services.lisp

@@ -45,7 +45,7 @@
                     ("minlength" "2")
                     ("maxlength" "32")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
     (text "{%- endif %}")
     (div
         ("class" "card_nest w_full")

crates/app/src/public/html/macros.lisp

@@ -79,6 +79,7 @@
                         ("href" "/mail")
                         (icon (text "mail"))
                         (str (text "general:link.mail")))
+                    (text "{% if config.stripe -%}")
                     (a
                         ("href" "/wallet")
                         (icon (text "piggy-bank"))
@@ -87,6 +88,7 @@
                         ("href" "/products")
                         (icon (text "store"))
                         (str (text "economy:label.my_products")))
+                    (text "{%- endif %}")
                     (a
                         ("href" "/journals/0/0")
                         (icon (text "notebook"))

crates/app/src/public/html/mod/file_report.lisp

@@ -28,7 +28,7 @@
                     ("required" "")
                     ("minlength" "16")))
             (button
-                (text "{{ text \"communities:action.create\" }}")))))
+                (str (text "communities:action.create"))))))
 
 (script
     (text "function create_report_from_form(e) {

crates/app/src/public/html/mod/ip_bans.lisp

@@ -19,7 +19,7 @@
                 ("class" "lowered small")
                 (text "{{ icon \"plus\" }}")
                 (span
-                    (text "{{ text \"communities:action.create\" }}"))))
+                    (str (text "communities:action.create")))))
         (div
             ("class" "card flex flex_col gap_2")
             (text "{% for item in items %}")

crates/app/src/public/html/mod/profile.lisp

@@ -84,7 +84,7 @@
                     const ui = await ns(\"ui\");
                     const element = document.getElementById(\"mod_options\");
 
-                    globalThis.profile_request = async (do_confirm, path, body) => {
+                    globalThis.profile_request = async (do_confirm, path, body = null, headers = { \"Content-Type\": \"application/json\" }, method = \"POST\") => {
                         if (do_confirm) {
                             if (
                                 !(await trigger(\"atto::confirm\", [
@@ -96,11 +96,9 @@
                         }
 
                         fetch(`/api/v1/auth/user/{{ profile.id }}/${path}`, {
-                            method: \"POST\",
-                            headers: {
-                                \"Content-Type\": \"application/json\",
-                            },
-                            body: JSON.stringify(body),
+                            method,
+                            headers: headers != null ? headers : undefined,
+                            body: body != null ? JSON.stringify(body) : undefined,
                         })
                             .then((res) => res.json())
                             .then((res) => {
@@ -265,9 +263,15 @@
                 (span
                     (text "{{ text \"mod_panel:label.associations\" }}"))))
         (div
-            ("class" "card lowered flex flex_wrap gap_2")
+            ("class" "card flex flex_wrap gap_4 flex_collapse")
             (text "{% for user in associations -%}")
-            (text "{{ components::user_plate(user=user, show_menu=false) }}")
+            (div
+                ("class" "flex flex_row gap_2 items_center card small secondary")
+                (text "{{ components::user_plate(user=user, show_menu=false, secondary=true, full=true) }}")
+                (button
+                    ("class" "small square red lowered")
+                    ("onclick" "profile_request(true, 'associations/{{ user.id }}', null, null, 'DELETE')")
+                    (icon (text "x"))))
             (text "{%- endfor %}")))
     (text "{% if invite -%}")
     (div

crates/app/src/public/html/mod/warnings.lisp

@@ -37,7 +37,7 @@
                     ("minlength" "2")
                     ("maxlength" "4096")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
     (div
         ("class" "card_nest")
         (div

crates/app/src/public/html/post/post.lisp

@@ -88,7 +88,7 @@
                 ("class" "flex gap_2")
                 (text "{{ components::emoji_picker(element_id=\"content\", render_dialog=true) }} {% if is_supporter -%} {{ components::file_picker(files_list_id=\"files_list\") }} {% endif %}")
                 (button
-                    (text "{{ text \"communities:action.create\" }}")))))
+                    (str (text "communities:action.create"))))))
     (text "{%- endif %}")
     (div
         ("class" "pillmenu")

crates/app/src/public/html/profile/base.lisp

@@ -304,7 +304,7 @@
 
                             globalThis.request_transfer = async () => {
                                 await trigger(\"atto::debounce\", [\"economy::transfer\"]);
-                                const amount = Number.parseInt((await trigger(\"atto::prompt\", [\"Request amount:\"])) || \"\");
+                                const amount = Number.parseInt((await trigger(\"atto::prompt\", [\"Request amount:\"])) || \"0\");
 
                                 if (amount === 0) {
                                     return;
@@ -468,6 +468,12 @@
                 ("class" "rhs w_full flex flex_col gap_4")
                 (text "{% block content %}{% endblock %}")))))
 
+(text "{% if not use_user_theme -%}")
+(text "{% for cnf in applied_configurations -%}")
+(text "{{ cnf|safe }}")
+(text "{%- endfor %}")
+(text "{%- endif %}")
+
 (text "{% if not is_self and profile.settings.warning -%}")
 (script
     (text "setTimeout(() => {

crates/app/src/public/html/profile/settings.lisp

@@ -1162,6 +1162,26 @@
                         ("class" "fade")
                         (text "This represents the site theme shown to users viewing
                         your profile.")))))
+        (text "{% if profile.applied_configurations|length > 0 -%}")
+        (div
+            ("class" "card_nest")
+            ("ui_ident" "applied_configurations")
+            (div
+                ("class" "card small flex items_center gap_2")
+                (icon (text "cog"))
+                (str (text "setttings:label.applied_configurations")))
+            (div
+                ("class" "card")
+                (p (text "Products that you have purchased and applied to your profile are displayed below. Snippets are always synced to the product, meaning the owner could update it at any time."))
+                (ul
+                    (text "{% for cnf in profile.applied_configurations -%}")
+                    (li
+                        (text "{{ cnf[0] }} ")
+                        (a
+                            ("href" "/product/{{ cnf[1] }}")
+                            (text "{{ cnf[1] }}")))
+                    (text "{%- endfor %}"))))
+        (text "{%- endif %}")
         (button
             ("onclick" "save_settings()")
             ("id" "save_button")
@@ -1742,6 +1762,7 @@
                 \"import_export\",
                 \"theme_preference\",
                 \"profile_theme\",
+                \"applied_configurations\",
             ]);
 
             ui.generate_settings_ui(
@@ -1906,6 +1927,14 @@
                         \"{{ profile.settings.hide_social_follows }}\",
                         \"checkbox\",
                     ],
+                    [
+                        [
+                            \"hide_username_badges\",
+                            \"Hide badges from your username (outside of your profile)\",
+                        ],
+                        \"{{ profile.settings.hide_username_badges }}\",
+                        \"checkbox\",
+                    ],
                     [[], \"Questions\", \"title\"],
                     [
                         [

crates/app/src/public/html/stacks/list.lisp

@@ -29,7 +29,7 @@
                     ("minlength" "2")
                     ("maxlength" "32")))
             (button
-                (text "{{ text \"communities:action.create\" }}"))))
+                (str (text "communities:action.create")))))
     (text "{%- endif %}")
     (div
         ("class" "card_nest w_full")

crates/app/src/public/html/timelines/all.lisp

@@ -4,7 +4,9 @@
 (text "{% endblock %} {% block body %} {{ macros::nav() }}")
 (main
     ("class" "flex flex_col gap_2")
-    (text "{{ macros::timelines_nav(selected=\"all\", posts=\"/all\", questions=\"/all/questions\", forum_posts=\"/all/forum_posts\") }} {% if not user -%}")
+    (text "{{ macros::timelines_nav(selected=\"all\", posts=\"/all\", questions=\"/all/questions\", forum_posts=\"/all/forum_posts\") }}")
+    (text "{{ components::advertisement(size=\"Leaderboard\") }}")
+    (text "{% if not user -%}")
     (div
         ("class" "card_nest")
         (div

crates/app/src/public/js/ads.js

@@ -0,0 +1,65 @@
+globalThis.TetrattoAds = {
+    AD_SIZES: {
+        Billboard: [970, 250],
+        Leaderboard: [720, 90],
+        Skyscraper: [160, 600],
+        MediumRectangle: [300, 250],
+        MobileLeaderboard: [320, 50],
+    },
+    IS_MOBILE: window.innerWidth <= 900 && window.innerHeight <= 900,
+};
+
+globalThis.TetrattoAds.init = () => {
+    const styles = document.createElement("style");
+    styles.id = "tetratto_ads_css";
+    styles.setAttribute("data-turbo-permanent", "true");
+
+    styles.innerHTML = `.tetratto_ad {
+        width: 100%;
+        display: grid;
+        place-items: center;
+    }
+
+    .tetratto_ad,
+    .tetratto_ad iframe {
+        max-width: 100%;
+        background: transparent;
+    }`;
+
+    document.head.appendChild(styles);
+};
+
+globalThis.TetrattoAds.render_ads = (
+    host_id = 0,
+    tetratto = "https://tetratto.com",
+) => {
+    for (const element of Array.from(
+        document.querySelectorAll(".tetratto_ad"),
+    )) {
+        if (element.children.length > 0) {
+            continue;
+        }
+
+        const iframe = document.createElement("iframe");
+        let size = element.getAttribute("data-ad-size") || "MediumRectangle";
+
+        if (size === "Leaderboard" && TetrattoAds.IS_MOBILE) {
+            size = "MobileLeaderboard";
+        }
+
+        const size_px = TetrattoAds.AD_SIZES[size];
+
+        const noclick =
+            element.getAttribute("data-noclick") === "true" || false;
+        const ad_id = element.getAttribute("data-ad-id");
+
+        iframe.src = `${tetratto}/adn/${ad_id ? ad_id : "random"}?size=${size}&host=${host_id}&noclick=${noclick}`;
+        iframe.setAttribute("frameborder", "0");
+        iframe.loading = "lazy";
+
+        iframe.style.width = `${size_px[0]}px`;
+        iframe.style.height = `${size_px[1]}px`;
+
+        element.appendChild(iframe);
+    }
+};

crates/app/src/routes/api/v1/ads.rs

@@ -0,0 +1,146 @@
+use crate::{
+    cookie::CookieJar,
+    get_user_from_token,
+    image::{save_webp_buffer, JsonMultipart},
+    State,
+};
+use axum::{
+    extract::Path,
+    response::{IntoResponse, Redirect},
+    Extension, Json,
+};
+use tetratto_core::model::{
+    economy::UserAd,
+    oauth,
+    uploads::{MediaType, MediaUpload},
+    ApiReturn, Error,
+};
+use super::{CreateAd, UpdateAdIsRunning};
+
+const MAXIMUM_AD_FILE_SIZE: usize = 2_097_152;
+
+pub async fn create_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    JsonMultipart(bytes_parts, req): JsonMultipart<CreateAd>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserCreateProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    // get file
+    let file = match bytes_parts.get(0) {
+        Some(x) => x,
+        None => return Json(Error::Unknown.into()),
+    };
+
+    if file.len() > MAXIMUM_AD_FILE_SIZE {
+        return Json(Error::FileTooLarge.into());
+    }
+
+    let upload = match data
+        .create_upload(MediaUpload::new(MediaType::Webp, user.id))
+        .await
+    {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    match data
+        .create_ad(UserAd::new(user.id, upload.id, req.target, req.size))
+        .await
+    {
+        Ok(_) => {
+            // write image
+            if let Err(e) =
+                save_webp_buffer(&upload.path(&data.0.0).to_string(), file.to_vec(), None)
+            {
+                return Json(Error::MiscError(e.to_string()).into());
+            }
+
+            // ...
+            Json(ApiReturn {
+                ok: true,
+                message: "Ad created".to_string(),
+                payload: (),
+            })
+        }
+        Err(e) => Json(e.into()),
+    }
+}
+
+pub async fn delete_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data.delete_ad(id, &user).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Ad deleted".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
+pub async fn update_is_running_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateAdIsRunning>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    let ad = match data.get_ad_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    if !ad.is_running && user.coins < 50 {
+        return Json(
+            Error::MiscError(
+                "You must have a minimum of 50 coins in your balance to run ads".to_string(),
+            )
+            .into(),
+        );
+    }
+
+    match data
+        .update_ad_is_running(id, &user, if req.is_running { 1 } else { 0 })
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Ad updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
+pub async fn click_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path((host, id)): Path<(usize, usize)>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = get_user_from_token!(jar, data);
+
+    match data.ad_click(host, id, user).await {
+        Ok(t) => Redirect::to(&t),
+        Err(_) => Redirect::to(&data.0.0.host),
+    }
+}

crates/app/src/routes/api/v1/auth/connections/stripe.rs

@@ -7,7 +7,7 @@ use axum::{
 };
 use tetratto_core::model::{
     auth::{Notification, User},
-    economy::{CoinTransfer, CoinTransferMethod},
+    economy::{CoinTransfer, CoinTransferMethod, CoinTransferSource},
     moderation::AuditLogEntry,
     permissions::{FinePermission, SecondaryPermission},
     ApiReturn, Error,
@@ -635,6 +635,7 @@ pub async fn handle_stupid_fucking_checkout_success_session(
                     user.id,
                     100,
                     CoinTransferMethod::Transfer,
+                    CoinTransferSource::Purchase,
                 ),
                 true,
             )
@@ -651,6 +652,7 @@ pub async fn handle_stupid_fucking_checkout_success_session(
                     user.id,
                     400,
                     CoinTransferMethod::Transfer,
+                    CoinTransferSource::Purchase,
                 ),
                 true,
             )

crates/app/src/routes/api/v1/auth/profile.rs

@@ -3,10 +3,11 @@ use crate::{
     get_user_from_token,
     model::{ApiReturn, Error},
     routes::api::v1::{
-        AppendAssociations, AwardAchievement, DeleteUser, DisableTotp, RefreshGrantToken,
-        UpdateSecondaryUserRole, UpdateUserAwaitingPurchase, UpdateUserBanExpire,
-        UpdateUserBanReason, UpdateUserInviteCode, UpdateUserIsDeactivated, UpdateUserIsVerified,
-        UpdateUserPassword, UpdateUserRole, UpdateUserUsername,
+        AddAppliedConfiguration, AppendAssociations, AwardAchievement, DeleteUser, DisableTotp,
+        RefreshGrantToken, RemoveAppliedConfiguration, UpdateSecondaryUserRole,
+        UpdateUserAwaitingPurchase, UpdateUserBanExpire, UpdateUserBanReason, UpdateUserInviteCode,
+        UpdateUserIsDeactivated, UpdateUserIsVerified, UpdateUserPassword, UpdateUserRole,
+        UpdateUserUsername,
     },
     State,
 };
@@ -24,6 +25,7 @@ use tetratto_core::{
     cache::Cache,
     model::{
         auth::{AchievementName, InviteCode, Token, UserSettings, SELF_SERVE_ACHIEVEMENTS},
+        economy::CoinTransferMethod,
         moderation::AuditLogEntry,
         oauth,
         permissions::FinePermission,
@@ -180,8 +182,108 @@ pub async fn update_user_settings_request(
     }
 }
 
+/// Add the given applied configuration.
+pub async fn add_applied_configuration_request(
+    jar: CookieJar,
+    Path(id): Path<usize>,
+    Extension(data): Extension<State>,
+    Json(req): Json<AddAppliedConfiguration>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let mut user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProfile) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    if user.id != id && !user.permissions.check(FinePermission::MANAGE_USERS) {
+        return Json(Error::NotAllowed.into());
+    }
+
+    let product_id: usize = match req.id.parse() {
+        Ok(x) => x,
+        Err(e) => return Json(Error::MiscError(e.to_string()).into()),
+    };
+
+    let product = match data.get_product_by_id(product_id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    if data
+        .get_transfer_by_sender_method(user.id, CoinTransferMethod::Purchase(product.id))
+        .await
+        .is_err()
+    {
+        return Json(Error::NotAllowed.into());
+    }
+
+    // update
+    user.applied_configurations.push((req.r#type, product.id));
+
+    // ...
+    match data
+        .update_user_applied_configurations(id, user.applied_configurations)
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Applied configurations updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
+/// Remove the given applied configuration.
+pub async fn remove_applied_configuration_request(
+    jar: CookieJar,
+    Path(id): Path<usize>,
+    Extension(data): Extension<State>,
+    Json(req): Json<RemoveAppliedConfiguration>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let mut user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProfile) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    if user.id != id && !user.permissions.check(FinePermission::MANAGE_USERS) {
+        return Json(Error::NotAllowed.into());
+    }
+
+    let product_id: usize = match req.id.parse() {
+        Ok(x) => x,
+        Err(e) => return Json(Error::MiscError(e.to_string()).into()),
+    };
+
+    // update
+    user.applied_configurations.remove(
+        match user
+            .applied_configurations
+            .iter()
+            .position(|x| x.1 == product_id)
+        {
+            Some(x) => x,
+            None => return Json(Error::GeneralNotFound("configuration".to_string()).into()),
+        },
+    );
+
+    // ...
+    match data
+        .update_user_applied_configurations(id, user.applied_configurations)
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Applied configurations updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
 /// Append associations to the current user.
-pub async fn append_associations_request(
+pub async fn append_association_request(
     jar: CookieJar,
     Extension(data): Extension<State>,
     Json(req): Json<AppendAssociations>,
@@ -229,6 +331,50 @@ pub async fn append_associations_request(
     }
 }
 
+/// Remove an association from the given user.
+pub async fn remove_association_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path((uid, association)): Path<(usize, usize)>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProfile) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    if !user.permissions.check(FinePermission::MANAGE_USERS) {
+        return Json(Error::NotAllowed.into());
+    }
+
+    // get user
+    let mut other_user = match data.get_user_by_id(uid).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    // find association and remove
+    other_user.associated.remove(
+        match other_user.associated.iter().position(|x| x == &association) {
+            Some(x) => x,
+            None => return Json(Error::GeneralNotFound("association".to_string()).into()),
+        },
+    );
+
+    // ...
+    match data
+        .update_user_associated(other_user.id, other_user.associated)
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Associations updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
 /// Update the password of the given user.
 ///
 /// Does not support third-party grants.

crates/app/src/routes/api/v1/mod.rs

@@ -1,3 +1,4 @@
+pub mod ads;
 pub mod app_data;
 pub mod apps;
 pub mod auth;
@@ -25,13 +26,13 @@ use axum::{
 use serde::Deserialize;
 use tetratto_core::model::{
     apps::{AppDataSelectMode, AppDataSelectQuery, AppQuota, DeveloperPassStorageQuota},
-    auth::AchievementName,
+    auth::{AchievementName, AppliedConfigType},
     communities::{
         CommunityContext, CommunityJoinAccess, CommunityReadAccess, CommunityWriteAccess,
         PollOption, PostContext,
     },
     communities_permissions::CommunityPermission,
-    economy::ProductFulfillmentMethod,
+    economy::{ProductFulfillmentMethod, UserAdSize},
     journals::JournalPrivacyPermission,
     littleweb::{DomainData, DomainTld, ServiceFsEntry},
     oauth::AppScope,
@@ -333,6 +334,14 @@ pub fn routes() -> Router {
             "/auth/user/{id}/settings",
             post(auth::profile::update_user_settings_request),
         )
+        .route(
+            "/auth/user/{id}/applied_configuration",
+            post(auth::profile::add_applied_configuration_request),
+        )
+        .route(
+            "/auth/user/{id}/applied_configuration",
+            delete(auth::profile::remove_applied_configuration_request),
+        )
         .route(
             "/auth/user/{id}/role",
             post(auth::profile::update_user_role_request),
@@ -389,6 +398,10 @@ pub fn routes() -> Router {
             "/auth/user/{id}/totp/codes",
             post(auth::profile::refresh_totp_codes_request),
         )
+        .route(
+            "/auth/user/{id}/associations/{association}",
+            delete(auth::profile::remove_association_request),
+        )
         .route(
             "/auth/user/{username}/totp/check",
             get(auth::profile::has_totp_enabled_request),
@@ -396,7 +409,7 @@ pub fn routes() -> Router {
         .route("/auth/user/me/seen", post(auth::profile::seen_request))
         .route(
             "/auth/user/me/append_associations",
-            put(auth::profile::append_associations_request),
+            put(auth::profile::append_association_request),
         )
         .route("/auth/user/find/{id}", get(auth::profile::redirect_from_id))
         .route(
@@ -719,6 +732,10 @@ pub fn routes() -> Router {
         // transfers
         .route("/transfers", post(transfers::create_request))
         .route("/transfers/ask", post(transfers::ask_request))
+        .route(
+            "/transfers/{id}/refund",
+            post(transfers::create_refund_request),
+        )
         // products
         .route("/products", post(products::create_request))
         .route("/products/{id}", delete(products::delete_request))
@@ -728,16 +745,34 @@ pub fn routes() -> Router {
             "/products/{id}/description",
             post(products::update_description_request),
         )
+        .route("/products/{id}/data", post(products::update_data_request))
         .route(
             "/products/{id}/on_sale",
             post(products::update_on_sale_request),
         )
+        .route(
+            "/products/{id}/single_use",
+            post(products::update_single_use_request),
+        )
         .route("/products/{id}/price", post(products::update_price_request))
         .route(
             "/products/{id}/method",
             post(products::update_method_request),
         )
         .route("/products/{id}/stock", post(products::update_stock_request))
+        .route(
+            "/products/{id}/uploads",
+            post(products::update_uploads_request),
+        )
+        .route(
+            "/products/{id}/uploads/thumbnails",
+            delete(products::remove_thumbnail_request),
+        )
+        // ads
+        .route("/ads", post(ads::create_request))
+        .route("/ads/{id}", delete(ads::delete_request))
+        .route("/ads/{id}/running", post(ads::update_is_running_request))
+        .route("/ads/host/{host}/{id}/click", get(ads::click_request))
 }
 
 pub fn lw_routes() -> Router {
@@ -1270,11 +1305,21 @@ pub struct UpdateProductDescription {
     pub description: String,
 }
 
+#[derive(Deserialize)]
+pub struct UpdateProductData {
+    pub data: String,
+}
+
 #[derive(Deserialize)]
 pub struct UpdateProductOnSale {
     pub on_sale: bool,
 }
 
+#[derive(Deserialize)]
+pub struct UpdateProductSingleUse {
+    pub single_use: bool,
+}
+
 #[derive(Deserialize)]
 pub struct UpdateProductPrice {
     pub price: i32,
@@ -1289,3 +1334,41 @@ pub struct UpdateProductMethod {
 pub struct UpdateProductStock {
     pub stock: i32,
 }
+
+#[derive(Deserialize)]
+pub struct AddAppliedConfiguration {
+    pub r#type: AppliedConfigType,
+    pub id: String,
+}
+
+#[derive(Deserialize)]
+pub struct RemoveAppliedConfiguration {
+    pub id: String,
+}
+
+#[derive(Deserialize, PartialEq, Eq)]
+pub enum ProductUploadTarget {
+    Thumbnails,
+    Reward,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateProductUploads {
+    pub target: ProductUploadTarget,
+}
+
+#[derive(Deserialize)]
+pub struct RemoveProductThumbnail {
+    pub idx: usize,
+}
+
+#[derive(Deserialize)]
+pub struct CreateAd {
+    pub target: String,
+    pub size: UserAdSize,
+}
+
+#[derive(Deserialize)]
+pub struct UpdateAdIsRunning {
+    pub is_running: bool,
+}

crates/app/src/routes/api/v1/products.rs

@@ -1,9 +1,21 @@
-use crate::{get_user_from_token, State, cookie::CookieJar};
+use crate::{
+    cookie::CookieJar,
+    get_user_from_token,
+    image::{save_webp_buffer, JsonMultipart},
+    State,
+};
 use axum::{extract::Path, response::IntoResponse, Extension, Json};
-use tetratto_core::model::{economy::Product, oauth, ApiReturn, Error};
+use tetratto_core::model::{
+    economy::{Product, ProductFulfillmentMethod},
+    oauth,
+    permissions::FinePermission,
+    uploads::{MediaType, MediaUpload},
+    ApiReturn, Error,
+};
 use super::{
-    CreateProduct, UpdateProductDescription, UpdateProductMethod, UpdateProductOnSale,
-    UpdateProductPrice, UpdateProductStock, UpdateProductTitle,
+    CreateProduct, ProductUploadTarget, RemoveProductThumbnail, UpdateProductData,
+    UpdateProductDescription, UpdateProductMethod, UpdateProductOnSale, UpdateProductPrice,
+    UpdateProductSingleUse, UpdateProductStock, UpdateProductTitle, UpdateProductUploads,
 };
 
 pub async fn create_request(
@@ -36,7 +48,7 @@ pub async fn delete_request(
     Path(id): Path<usize>,
 ) -> impl IntoResponse {
     let data = &(data.read().await).0;
-    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserCreateProducts) {
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
         Some(ua) => ua,
         None => return Json(Error::NotAllowed.into()),
     };
@@ -112,6 +124,33 @@ pub async fn update_description_request(
     }
 }
 
+pub async fn update_data_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(mut req): Json<UpdateProductData>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    req.data = req.data.trim().to_string();
+    if req.data.len() > 16384 {
+        return Json(Error::DataTooLong("data".to_string()).into());
+    }
+
+    match data.update_product_data(id, &user, &req.data).await {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Product updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
 pub async fn update_on_sale_request(
     jar: CookieJar,
     Extension(data): Extension<State>,
@@ -137,6 +176,31 @@ pub async fn update_on_sale_request(
     }
 }
 
+pub async fn update_single_use_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<UpdateProductSingleUse>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    match data
+        .update_product_single_use(id, &user, if req.single_use { 1 } else { 0 })
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Product updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
 pub async fn update_price_request(
     jar: CookieJar,
     Extension(data): Extension<State>,
@@ -149,7 +213,14 @@ pub async fn update_price_request(
         None => return Json(Error::NotAllowed.into()),
     };
 
-    if req.price < 25 {
+    let product = match data.get_product_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    let can_be_free = product.method != ProductFulfillmentMethod::ProfileStyle;
+
+    if req.price < 25 && (!can_be_free || req.price != 0) {
         return Json(
             Error::MiscError(
                 "Price is too low, please use a price of 25 coins or more".to_string(),
@@ -180,6 +251,24 @@ pub async fn update_method_request(
         None => return Json(Error::NotAllowed.into()),
     };
 
+    if req.method == ProductFulfillmentMethod::ProfileStyle
+        && !user.permissions.check(FinePermission::SUPPORTER)
+    {
+        return Json(Error::RequiresSupporter.into());
+    }
+
+    let product = match data.get_product_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    if req.method == ProductFulfillmentMethod::ProfileStyle && product.price == 0 {
+        // no free profile styles
+        if let Err(e) = data.update_product_price(id, &user, 25).await {
+            return Json(e.into());
+        }
+    }
+
     match data.update_product_method(id, &user, req.method).await {
         Ok(_) => Json(ApiReturn {
             ok: true,
@@ -232,3 +321,163 @@ pub async fn buy_request(
         Err(e) => Json(e.into()),
     }
 }
+
+const MAXIMUM_THUMBNAIL_FILE_SIZE: usize = 2_097_152;
+const MAXIMUM_REWARD_FILE_SIZE: usize = 4_194_304;
+
+/// Update the product's uploads. Only reads one multipart file entry.
+pub async fn update_uploads_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    JsonMultipart(bytes_parts, req): JsonMultipart<UpdateProductUploads>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    let mut product = match data.get_product_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    if user.id != product.owner && !user.permissions.check(FinePermission::MANAGE_USERS) {
+        return Json(Error::NotAllowed.into());
+    }
+
+    // apply to target
+    match req.target {
+        ProductUploadTarget::Thumbnails => {
+            if product.uploads.thumbnails.len() == 4 {
+                return Json(
+                    Error::MiscError("Too many thumbnails exist. Please remove one".to_string())
+                        .into(),
+                );
+            }
+
+            // create upload
+            let file = match bytes_parts.get(0) {
+                Some(x) => x,
+                None => return Json(Error::Unknown.into()),
+            };
+
+            if file.len() > MAXIMUM_THUMBNAIL_FILE_SIZE {
+                return Json(Error::FileTooLarge.into());
+            }
+
+            let upload = match data
+                .create_upload(MediaUpload::new(MediaType::Webp, user.id))
+                .await
+            {
+                Ok(x) => x,
+                Err(e) => return Json(e.into()),
+            };
+
+            product.uploads.thumbnails.push(upload.id);
+
+            // write image
+            if let Err(e) =
+                save_webp_buffer(&upload.path(&data.0.0).to_string(), file.to_vec(), None)
+            {
+                return Json(Error::MiscError(e.to_string()).into());
+            }
+        }
+        ProductUploadTarget::Reward => {
+            // remove old
+            if product.uploads.reward != 0 {
+                if let Err(e) = data.delete_upload(product.uploads.reward).await {
+                    return Json(e.into());
+                }
+            }
+
+            // create upload
+            let file = match bytes_parts.get(0) {
+                Some(x) => x,
+                None => return Json(Error::Unknown.into()),
+            };
+
+            if file.len() > MAXIMUM_REWARD_FILE_SIZE {
+                return Json(Error::FileTooLarge.into());
+            }
+
+            let upload = match data
+                .create_upload(MediaUpload::new(MediaType::Webp, user.id))
+                .await
+            {
+                Ok(x) => x,
+                Err(e) => return Json(e.into()),
+            };
+
+            product.uploads.reward = upload.id;
+
+            // write image
+            if let Err(e) =
+                save_webp_buffer(&upload.path(&data.0.0).to_string(), file.to_vec(), None)
+            {
+                return Json(Error::MiscError(e.to_string()).into());
+            }
+        }
+    }
+
+    // ...
+    match data
+        .update_product_uploads(id, &user, product.uploads)
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Product updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}
+
+pub async fn remove_thumbnail_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+    Json(req): Json<RemoveProductThumbnail>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserManageProducts) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    let mut product = match data.get_product_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    if user.id != product.owner && !user.permissions.check(FinePermission::MANAGE_USERS) {
+        return Json(Error::NotAllowed.into());
+    }
+
+    // remove upload
+    let thumbnail = match product.uploads.thumbnails.get(req.idx) {
+        Some(x) => x,
+        None => return Json(Error::GeneralNotFound("thumbnail".to_string()).into()),
+    };
+
+    if let Err(e) = data.delete_upload(*thumbnail).await {
+        return Json(e.into());
+    }
+
+    product.uploads.thumbnails.remove(req.idx);
+
+    // ...
+    match data
+        .update_product_uploads(id, &user, product.uploads)
+        .await
+    {
+        Ok(_) => Json(ApiReturn {
+            ok: true,
+            message: "Product updated".to_string(),
+            payload: (),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}

crates/app/src/routes/api/v1/transfers.rs

@@ -1,7 +1,7 @@
 use crate::{get_user_from_token, State, cookie::CookieJar};
-use axum::{response::IntoResponse, Extension, Json};
+use axum::{response::IntoResponse, Extension, Json, extract::Path};
 use tetratto_core::model::{
-    economy::{CoinTransfer, CoinTransferMethod},
+    economy::{CoinTransfer, CoinTransferMethod, CoinTransferSource},
     oauth,
     requests::{ActionData, ActionRequest, ActionType},
     ApiReturn, Error,
@@ -29,6 +29,7 @@ pub async fn create_request(
                 },
                 req.amount,
                 CoinTransferMethod::Transfer, // this endpoint is ONLY for regular transfers; products export a buy endpoint for the other method
+                CoinTransferSource::General,
             ),
             true,
         )
@@ -74,3 +75,46 @@ pub async fn ask_request(
         Err(e) => Json(e.into()),
     }
 }
+
+pub async fn create_refund_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+) -> impl IntoResponse {
+    let data = &(data.read().await).0;
+    let user = match get_user_from_token!(jar, data, oauth::AppScope::UserSendCoins) {
+        Some(ua) => ua,
+        None => return Json(Error::NotAllowed.into()),
+    };
+
+    let other_transfer = match data.get_transfer_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Json(e.into()),
+    };
+
+    if user.id != other_transfer.receiver || other_transfer.source != CoinTransferSource::Sale {
+        // only the receiver of the funds can issue a refund (atm)
+        return Json(Error::NotAllowed.into());
+    }
+
+    match data
+        .create_transfer(
+            &mut CoinTransfer::new(
+                other_transfer.receiver,
+                other_transfer.sender,
+                other_transfer.amount,
+                CoinTransferMethod::Transfer,
+                CoinTransferSource::Refund,
+            ),
+            true,
+        )
+        .await
+    {
+        Ok(s) => Json(ApiReturn {
+            ok: true,
+            message: "Transfer created".to_string(),
+            payload: s.to_string(),
+        }),
+        Err(e) => Json(e.into()),
+    }
+}

crates/app/src/routes/api/v1/uploads.rs

@@ -20,7 +20,7 @@ pub async fn get_request(
                 Body::from(read_image(PathBufD::current().extend(&[
                     data.0.0.dirs.media.as_str(),
                     "images",
-                    "default-avatar.svg",
+                    "default-banner.svg",
                 ]))),
             ));
         }
@@ -34,7 +34,7 @@ pub async fn get_request(
             Body::from(read_image(PathBufD::current().extend(&[
                 data.0.0.dirs.media.as_str(),
                 "images",
-                "default-avatar.svg",
+                "default-banner.svg",
             ]))),
         ));
     }

crates/app/src/routes/assets.rs

@@ -21,3 +21,4 @@ serve_asset!(streams_js_request: STREAMS_JS("text/javascript"));
 serve_asset!(carp_js_request: CARP_JS("text/javascript"));
 serve_asset!(proto_links_request: PROTO_LINKS_JS("text/javascript"));
 serve_asset!(app_sdk_request: APP_SDK_JS("text/javascript"));
+serve_asset!(ads_request: ADS_JS("text/javascript"));

crates/app/src/routes/mod.rs

@@ -22,6 +22,7 @@ pub fn routes(config: &Config) -> Router {
         .route("/js/carp.js", get(assets::carp_js_request))
         .route("/js/proto_links.js", get(assets::proto_links_request))
         .route("/js/app_sdk.js", get(assets::app_sdk_request))
+        .route("/js/ads.js", get(assets::ads_request))
         .nest_service(
             "/public",
             get_service(tower_http::services::ServeDir::new(&config.dirs.assets)),

crates/app/src/routes/pages/economy.rs

@@ -4,9 +4,13 @@ use axum::{
     Extension,
 };
 use crate::cookie::CookieJar;
-use tetratto_core::model::Error;
+use tetratto_core::model::{
+    economy::{CoinTransferMethod, UserAd, UserAdSize},
+    Error,
+};
 use crate::{assets::initial_context, get_lang, get_user_from_token, State};
 use super::{render_error, PaginatedQuery};
+use serde::Deserialize;
 
 /// `/wallet`
 pub async fn wallet_request(
@@ -60,7 +64,36 @@ pub async fn products_request(
         }
     };
 
-    let list = match data.0.get_products_by_user(user.id, 12, props.page).await {
+    let list = match data
+        .0
+        .get_products_by_user(
+            user.id,
+            12,
+            if props.page_set_id == 0 {
+                props.page
+            } else {
+                0
+            },
+        )
+        .await
+    {
+        Ok(x) => x,
+        Err(e) => return Err(Html(render_error(e, &jar, &data, &Some(user)).await)),
+    };
+
+    let ads_list = match data
+        .0
+        .get_ads_by_user(
+            user.id,
+            12,
+            if props.page_set_id == 1 {
+                props.page
+            } else {
+                0
+            },
+        )
+        .await
+    {
         Ok(x) => x,
         Err(e) => return Err(Html(render_error(e, &jar, &data, &Some(user)).await)),
     };
@@ -69,7 +102,9 @@ pub async fn products_request(
     let mut context = initial_context(&data.0.0.0, lang, &Some(user)).await;
 
     context.insert("list", &list);
+    context.insert("ads_list", &ads_list);
     context.insert("page", &props.page);
+    context.insert("page_set_id", &props.page_set_id);
 
     // return
     Ok(Html(
@@ -138,14 +173,154 @@ pub async fn product_request(
         Err(e) => return Err(Html(render_error(e, &jar, &data, &Some(user)).await)),
     };
 
+    let already_purchased = if product.single_use {
+        data.0
+            .get_transfer_by_sender_method(user.id, CoinTransferMethod::Purchase(product.id))
+            .await
+            .is_ok()
+    } else {
+        false
+    };
+
+    let applied_configurations_mapped: Vec<usize> =
+        user.applied_configurations.iter().map(|x| x.1).collect();
+
     let lang = get_lang!(jar, data.0);
     let mut context = initial_context(&data.0.0.0, lang, &Some(user)).await;
 
     context.insert("product", &product);
     context.insert("owner", &owner);
+    context.insert("already_purchased", &already_purchased);
+    context.insert(
+        "applied_configurations_mapped",
+        &applied_configurations_mapped,
+    );
 
     // return
     Ok(Html(
         data.1.render("economy/product.html", &context).unwrap(),
     ))
 }
+
+/// `/product/ad/{id}/edit`
+pub async fn edit_ad_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Path(id): Path<usize>,
+) -> impl IntoResponse {
+    let data = data.read().await;
+    let user = match get_user_from_token!(jar, data.0) {
+        Some(ua) => ua,
+        None => {
+            return Err(Html(
+                render_error(Error::NotAllowed, &jar, &data, &None).await,
+            ));
+        }
+    };
+
+    let ad = match data.0.get_ad_by_id(id).await {
+        Ok(x) => x,
+        Err(e) => return Err(Html(render_error(e, &jar, &data, &Some(user)).await)),
+    };
+
+    if user.id != ad.owner {
+        return Err(Html(
+            render_error(Error::NotAllowed, &jar, &data, &None).await,
+        ));
+    }
+
+    let lang = get_lang!(jar, data.0);
+    let mut context = initial_context(&data.0.0.0, lang, &Some(user)).await;
+    context.insert("ad", &ad);
+
+    // return
+    Ok(Html(
+        data.1.render("economy/edit_ad.html", &context).unwrap(),
+    ))
+}
+
+#[derive(Deserialize)]
+pub struct RandomAdQuery {
+    pub host: usize,
+    #[serde(default)]
+    pub size: UserAdSize,
+    #[serde(default)]
+    pub noclick: bool,
+}
+
+/// `/adn/random`
+pub async fn random_ad_request(
+    Extension(data): Extension<State>,
+    Query(props): Query<RandomAdQuery>,
+) -> impl IntoResponse {
+    let data = data.read().await;
+    let ad = match data.0.random_ad_charged(props.size.clone()).await {
+        Ok(x) => x,
+        Err(_) => UserAd {
+            id: 0,
+            created: 0,
+            upload_id: 0,
+            owner: data.0.0.0.system_user,
+            target: data.0.0.0.host.clone(),
+            last_charge_time: 0,
+            is_running: true,
+            size: props.size,
+        },
+    };
+
+    let mut context = tera::Context::new();
+    context.insert("disable_click", &props.noclick);
+    context.insert("config", &data.0.0.0);
+    context.insert("host", &props.host);
+    context.insert("ad", &ad);
+
+    // return
+    (
+        [(
+            "content-security-policy",
+            "default-src 'self' *.spotify.com musicbrainz.org; img-src * data:; media-src *; font-src *; style-src 'unsafe-inline' 'self' *; script-src 'self' 'unsafe-inline' *; worker-src * blob:; object-src 'self' *; upgrade-insecure-requests; connect-src * localhost; frame-src 'self' blob: *; frame-ancestors *",
+        )],
+        Html(data.1.render("economy/ad.html", &context).unwrap()),
+    )
+}
+
+/// `/adn/{id}`
+pub async fn known_ad_request(
+    Extension(data): Extension<State>,
+    Query(props): Query<RandomAdQuery>,
+    Path(id): Path<usize>,
+) -> impl IntoResponse {
+    let data = data.read().await;
+    let ad = match data.0.get_ad_by_id(id).await {
+        Ok(x) => x,
+        Err(_) => UserAd {
+            // polyfill ad
+            id: 0,
+            created: 0,
+            upload_id: 0,
+            owner: data.0.0.0.system_user,
+            target: data.0.0.0.host.clone(),
+            last_charge_time: 0,
+            is_running: true,
+            size: props.size,
+        },
+    };
+
+    let mut context = tera::Context::new();
+    context.insert("disable_click", &props.noclick);
+    context.insert("config", &data.0.0.0);
+    context.insert("host", &props.host);
+    context.insert("ad", &ad);
+
+    // return
+    (
+        [
+            (
+                "content-security-policy",
+                "default-src 'self' *.spotify.com musicbrainz.org; img-src * data:; media-src *; font-src *; style-src 'unsafe-inline' 'self' *; script-src 'self' 'unsafe-inline' *; worker-src * blob:; object-src 'self' *; upgrade-insecure-requests; connect-src * localhost; frame-src 'self' blob: *; frame-ancestors *",
+            ),
+            ("Cache-Control", "no-cache"),
+        ],
+        Html(data.1.render("economy/ad.html", &context).unwrap()),
+    )
+}

crates/app/src/routes/pages/misc.rs

@@ -1,6 +1,7 @@
 use super::{PaginatedQuery, render_error};
 use crate::{
-    assets::initial_context, check_user_blocked_or_private, get_lang, get_user_from_token, State,
+    assets::initial_context, check_user_blocked_or_private, get_lang, get_user_from_token,
+    InnerState, State,
 };
 use axum::{
     extract::{Path, Query},
@@ -9,11 +10,14 @@ use axum::{
 };
 use crate::cookie::CookieJar;
 use serde::Deserialize;
-use tetratto_core::model::{
-    auth::{AchievementName, DefaultTimelineChoice, ACHIEVEMENTS},
+use tetratto_core::{
+    database::FullPost,
+    model::{
+        auth::{AchievementName, DefaultTimelineChoice, ACHIEVEMENTS, User},
         permissions::FinePermission,
         requests::ActionType,
         Error,
+    },
 };
 use std::fs::read_to_string;
 use pathbufd::PathBufD;
@@ -685,15 +689,12 @@ pub struct TimelineQuery {
     pub responses_only: bool,
 }
 
-/// `/_swiss_army_timeline`
-pub async fn swiss_army_timeline_request(
-    jar: CookieJar,
-    Extension(data): Extension<State>,
-    Query(req): Query<TimelineQuery>,
-) -> impl IntoResponse {
-    let data = data.read().await;
-    let user = get_user_from_token!(jar, data.0);
-
+async fn swiss_army_timeline(
+    data: &InnerState,
+    user: Option<User>,
+    req: &TimelineQuery,
+    jar: &CookieJar,
+) -> std::result::Result<Vec<FullPost>, Html<String>> {
     let ignore_users = crate::ignore_users_gen!(user, data);
 
     let list = if req.stack_id != 0 {
@@ -807,12 +808,41 @@ pub async fn swiss_army_timeline_request(
                         None
                     },
                 ),
-                Err(e) => return Ok(Html(render_error(e, &jar, &data, &user).await)),
+                Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
             },
-            Err(e) => return Ok(Html(render_error(e, &jar, &data, &user).await)),
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
         }
     };
 
+    Ok(list)
+}
+
+/// `/_swiss_army_timeline`
+pub async fn swiss_army_timeline_request(
+    jar: CookieJar,
+    Extension(data): Extension<State>,
+    Query(mut req): Query<TimelineQuery>,
+) -> impl IntoResponse {
+    let data = data.read().await;
+    let user = get_user_from_token!(jar, data.0);
+
+    let mut empty_retries = 0; // how many times we've retried because of an empty list
+    let mut list = Vec::new();
+
+    while empty_retries < 2 {
+        list = match swiss_army_timeline(&data, user.clone(), &req, &jar).await {
+            Ok(x) => x,
+            Err(e) => return Err(e),
+        };
+
+        if list.len() == 0 && empty_retries != 2 {
+            empty_retries += 1;
+            req.page += 1;
+        } else {
+            break;
+        }
+    }
+
     let lang = get_lang!(jar, data.0);
     let mut context = initial_context(&data.0.0.0, lang, &user).await;
 

crates/app/src/routes/pages/mod.rs

@@ -166,6 +166,9 @@ pub fn routes() -> Router {
         .route("/products", get(economy::products_request))
         .route("/product/{id}/edit", get(economy::edit_product_request))
         .route("/product/{id}", get(economy::product_request))
+        .route("/product/ad/{id}/edit", get(economy::edit_ad_request))
+        .route("/adn/random", get(economy::random_ad_request))
+        .route("/adn/{id}", get(economy::known_ad_request))
 }
 
 pub fn lw_routes() -> Router {
@@ -188,6 +191,11 @@ pub async fn render_error(
 pub struct PaginatedQuery {
     #[serde(default)]
     pub page: usize,
+    /// The list set on this page to be affected by the page increment.
+    ///
+    /// This value depends on the page this query is for.
+    #[serde(default)]
+    pub page_set_id: usize,
     #[serde(default)]
     pub before: usize,
 }

crates/app/src/routes/pages/profile.rs

@@ -232,6 +232,7 @@ pub fn profile_context(
     user: &Option<User>,
     profile: &User,
     communities: &Vec<Community>,
+    applied_configurations: Vec<String>,
     is_self: bool,
     is_following: bool,
     is_following_you: bool,
@@ -244,6 +245,7 @@ pub fn profile_context(
     context.insert("is_following_you", &is_following_you);
     context.insert("is_blocking", &is_blocking);
     context.insert("warning_hash", &hash(profile.settings.warning.clone()));
+    context.insert("applied_configurations", &applied_configurations);
 
     context.insert(
         "is_supporter",
@@ -376,6 +378,10 @@ pub async fn posts_request(
         &user,
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+        },
         is_self,
         is_following,
         is_following_you,
@@ -492,6 +498,10 @@ pub async fn replies_request(
         &user,
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+        },
         is_self,
         is_following,
         is_following_you,
@@ -604,6 +614,10 @@ pub async fn media_request(
         &user,
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+        },
         is_self,
         is_following,
         is_following_you,
@@ -690,9 +704,13 @@ pub async fn shop_request(
     context.insert("page", &props.page);
     profile_context(
         &mut context,
-        &Some(user),
+        &Some(user.clone()),
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &Some(user)).await)),
+        },
         is_self,
         is_following,
         is_following_you,
@@ -784,9 +802,13 @@ pub async fn outbox_request(
     context.insert("page", &props.page);
     profile_context(
         &mut context,
-        &Some(user),
+        &Some(user.clone()),
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &Some(user)).await)),
+        },
         is_self,
         is_following,
         is_following_you,
@@ -896,6 +918,10 @@ pub async fn following_request(
         &user,
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+        },
         is_self,
         is_following,
         is_following_you,
@@ -1005,6 +1031,10 @@ pub async fn followers_request(
         &user,
         &other_user,
         &communities,
+        match data.0.get_applied_configurations(&other_user).await {
+            Ok(x) => x,
+            Err(e) => return Err(Html(render_error(e, &jar, &data, &user).await)),
+        },
         is_self,
         is_following,
         is_following_you,

crates/app/src/sanitize.rs

@@ -9,9 +9,9 @@ pub fn color_escape(color: &str) -> String {
             .replace(">", "%gt;")
             .replace("}", "")
             .replace("{", "")
-            .replace("url(\"", "url(\"/api/v0/util/ext/image?img=")
-            .replace("url('", "url('/api/v0/util/ext/image?img=")
-            .replace("url(https://", "url(/api/v0/util/ext/image?img=https://"),
+            .replace("url(\"", "url(\"/api/v1/util/proxy?url=")
+            .replace("url('", "url('/api/v1/util/proxy?url=")
+            .replace("url(https://", "url(/api/v1/util/proxy?url=https://"),
     )
 }
 

crates/core/src/config.rs

@@ -344,6 +344,9 @@ pub struct Config {
     /// A list of banned content in posts.
     #[serde(default)]
     pub banned_data: Vec<StringBan>,
+    /// If user ads are enabled.
+    #[serde(default)]
+    pub enable_user_ads: bool,
 }
 
 fn default_name() -> String {
@@ -463,6 +466,7 @@ impl Default for Config {
             stripe: None,
             manuals: default_manuals(),
             banned_data: default_banned_data(),
+            enable_user_ads: false,
         }
     }
 }

crates/core/src/database/ads.rs

@@ -0,0 +1,268 @@
+use crate::model::{
+    auth::{User, UserWarning},
+    economy::{CoinTransfer, CoinTransferMethod, CoinTransferSource, UserAd, UserAdSize},
+    permissions::FinePermission,
+    Error, Result,
+};
+use crate::{auto_method, DataManager};
+use oiseau::{cache::Cache, execute, get, params, query_row, query_rows, PostgresRow};
+use tetratto_shared::unix_epoch_timestamp;
+
+impl DataManager {
+    /// Get a [`UserAd`] from an SQL row.
+    pub(crate) fn get_ad_from_row(x: &PostgresRow) -> UserAd {
+        UserAd {
+            id: get!(x->0(i64)) as usize,
+            created: get!(x->1(i64)) as usize,
+            owner: get!(x->2(i64)) as usize,
+            upload_id: get!(x->3(i64)) as usize,
+            target: get!(x->4(String)),
+            last_charge_time: get!(x->5(i64)) as usize,
+            is_running: get!(x->6(i32)) as i8 == 1,
+            size: serde_json::from_str(&get!(x->7(String))).unwrap(),
+        }
+    }
+
+    auto_method!(get_ad_by_id(usize as i64)@get_ad_from_row -> "SELECT * FROM ads WHERE id = $1" --name="ad" --returns=UserAd --cache-key-tmpl="atto.ad:{}");
+
+    /// Get all ads by user.
+    ///
+    /// # Arguments
+    /// * `id` - the ID of the user to fetch ads for
+    /// * `batch` - the limit of items in each page
+    /// * `page` - the page number
+    pub async fn get_ads_by_user(
+        &self,
+        id: usize,
+        batch: usize,
+        page: usize,
+    ) -> Result<Vec<UserAd>> {
+        let conn = match self.0.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = query_rows!(
+            &conn,
+            "SELECT * FROM ads WHERE owner = $1 ORDER BY created DESC LIMIT $2 OFFSET $3",
+            &[&(id as i64), &(batch as i64), &((page * batch) as i64)],
+            |x| { Self::get_ad_from_row(x) }
+        );
+
+        if res.is_err() {
+            return Err(Error::GeneralNotFound("ad".to_string()));
+        }
+
+        Ok(res.unwrap())
+    }
+
+    /// Disable all ads by the given user.
+    ///
+    /// # Arguments
+    /// * `id` - the ID of the user to kill ads from
+    pub async fn stop_all_ads_by_user(&self, id: usize) -> Result<Vec<UserAd>> {
+        let conn = match self.0.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = query_rows!(
+            &conn,
+            "UPDATE ads SET is_running = 0 WHERE owner = $1",
+            &[&(id as i64)],
+            |x| { Self::get_ad_from_row(x) }
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        Ok(res.unwrap())
+    }
+
+    /// Create a new ad in the database.
+    ///
+    /// # Arguments
+    /// * `data` - a mock [`UserAd`] object to insert
+    pub async fn create_ad(&self, data: UserAd) -> Result<UserAd> {
+        // check values
+        if data.target.len() < 2 {
+            return Err(Error::DataTooShort("description".to_string()));
+        } else if data.target.len() > 256 {
+            return Err(Error::DataTooLong("description".to_string()));
+        }
+
+        // charge for first day
+        if data.is_running {
+            self.create_transfer(
+                &mut CoinTransfer::new(
+                    data.owner,
+                    self.0.0.system_user,
+                    Self::AD_RUN_CHARGE,
+                    CoinTransferMethod::Transfer,
+                    CoinTransferSource::AdCharge,
+                ),
+                true,
+            )
+            .await?;
+        }
+
+        // ...
+        let conn = match self.0.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = execute!(
+            &conn,
+            "INSERT INTO ads VALUES (DEFAULT, $1, $2, $3, $4, $5, $6, $7)",
+            params![
+                &(data.created as i64),
+                &(data.owner as i64),
+                &(data.upload_id as i64),
+                &data.target,
+                &(data.last_charge_time as i64),
+                &if data.is_running { 1 } else { 0 },
+                &serde_json::to_string(&data.size).unwrap()
+            ]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        Ok(data)
+    }
+
+    pub async fn delete_ad(&self, id: usize, user: &User) -> Result<()> {
+        let ad = self.get_ad_by_id(id).await?;
+
+        // check user permission
+        if user.id != ad.owner && !user.permissions.check(FinePermission::MANAGE_USERS) {
+            return Err(Error::NotAllowed);
+        }
+
+        // remove upload
+        self.delete_upload(ad.upload_id).await?;
+
+        // ...
+        let conn = match self.0.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = execute!(&conn, "DELETE FROM ads WHERE id = $1", &[&(id as i64)]);
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        // ...
+        self.0.1.remove(format!("atto.ad:{}", id)).await;
+        Ok(())
+    }
+
+    /// Pull a random running ad.
+    pub async fn random_ad(&self, size: UserAdSize) -> Result<UserAd> {
+        let conn = match self.0.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = query_row!(
+            &conn,
+            "SELECT * FROM ads WHERE is_running = 1 AND size = $1 ORDER BY RANDOM() DESC LIMIT 1",
+            &[&serde_json::to_string(&size).unwrap()],
+            |x| { Ok(Self::get_ad_from_row(x)) }
+        );
+
+        if res.is_err() {
+            return Err(Error::GeneralNotFound("ad".to_string()));
+        }
+
+        Ok(res.unwrap())
+    }
+
+    const MINIMUM_DELTA_FOR_CHARGE: usize = 604_800_000; // 7 days
+    /// The amount charged to a [`UserAd`] owner each day the ad is running (and is pulled from the pool).
+    pub const AD_RUN_CHARGE: i32 = 25;
+    /// The amount charged to a [`UserAd`] owner each time the ad is clicked.
+    pub const AD_CLICK_CHARGE: i32 = 2;
+
+    /// Get a random ad and check if the ad owner needs to be charged for this period.
+    pub async fn random_ad_charged(&self, size: UserAdSize) -> Result<UserAd> {
+        let ad = self.random_ad(size).await?;
+
+        let now = unix_epoch_timestamp();
+        let delta = now - ad.last_charge_time;
+
+        if delta >= Self::MINIMUM_DELTA_FOR_CHARGE {
+            if let Err(e) = self
+                .create_transfer(
+                    &mut CoinTransfer::new(
+                        ad.owner,
+                        self.0.0.system_user,
+                        Self::AD_RUN_CHARGE,
+                        CoinTransferMethod::Transfer,
+                        CoinTransferSource::AdCharge,
+                    ),
+                    true,
+                )
+                .await
+            {
+                // boo user cannot afford to keep running their ads
+                self.stop_all_ads_by_user(ad.owner).await?;
+                return Err(e);
+            };
+
+            self.update_ad_last_charge_time(ad.id, now as i64).await?;
+        }
+
+        Ok(ad)
+    }
+
+    /// Handle a click on an ad from the given host.
+    ///
+    /// Hosts are just the ID of the user that is embedding the ad on their page.
+    pub async fn ad_click(&self, host: usize, ad: usize, user: Option<User>) -> Result<String> {
+        let ad = self.get_ad_by_id(ad).await?;
+
+        if let Some(ref ua) = user {
+            if ua.id == host {
+                self.create_user_warning(
+                    UserWarning::new(
+                        ua.id,
+                        self.0.0.system_user,
+                        "Automated warning: do not click on ads on your own site! This incident has been reported.".to_string()
+                    )
+                ).await?;
+
+                return Ok(ad.target);
+            }
+        }
+
+        // create click transfer
+        if let Err(e) = self
+            .create_transfer(
+                &mut CoinTransfer::new(
+                    ad.owner,
+                    host,
+                    Self::AD_CLICK_CHARGE,
+                    CoinTransferMethod::Transfer,
+                    CoinTransferSource::AdClick,
+                ),
+                true,
+            )
+            .await
+        {
+            self.stop_all_ads_by_user(ad.owner).await?;
+            return Err(e);
+        }
+
+        // return
+        Ok(ad.target)
+    }
+
+    auto_method!(update_ad_is_running(i32)@get_ad_by_id:FinePermission::MANAGE_USERS; -> "UPDATE ads SET is_running = $1 WHERE id = $2" --cache-key-tmpl="atto.ad:{}");
+    auto_method!(update_ad_last_charge_time(i64) -> "UPDATE ads SET last_charge_time = $1 WHERE id = $2" --cache-key-tmpl="atto.ad:{}");
+}

crates/core/src/database/auth.rs

@@ -1,15 +1,15 @@
 use super::common::NAME_REGEX;
 use oiseau::cache::Cache;
-use crate::model::auth::{
-    Achievement, AchievementName, AchievementRarity, Notification, UserConnections, ACHIEVEMENTS,
-};
-use crate::model::moderation::AuditLogEntry;
-use crate::model::oauth::AuthGrant;
-use crate::model::permissions::SecondaryPermission;
 use crate::model::{
     Error, Result,
     auth::{Token, User, UserSettings},
-    permissions::FinePermission,
+    permissions::{FinePermission, SecondaryPermission},
+    oauth::AuthGrant,
+    moderation::AuditLogEntry,
+    auth::{
+        Achievement, AchievementName, AchievementRarity, Notification, UserConnections,
+        ACHIEVEMENTS, AppliedConfigType,
+    },
 };
 use pathbufd::PathBufD;
 use std::fs::{exists, remove_file};
@@ -130,6 +130,7 @@ impl DataManager {
             ban_expire: get!(x->30(i64)) as usize,
             coins: get!(x->31(i32)),
             checkouts: serde_json::from_str(&get!(x->32(String)).to_string()).unwrap(),
+            applied_configurations: serde_json::from_str(&get!(x->33(String)).to_string()).unwrap(),
         }
     }
 
@@ -286,7 +287,7 @@ impl DataManager {
 
         let res = execute!(
             &conn,
-            "INSERT INTO users VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33)",
+            "INSERT INTO users VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25, $26, $27, $28, $29, $30, $31, $32, $33, $34)",
             params![
                 &(data.id as i64),
                 &(data.created as i64),
@@ -321,6 +322,7 @@ impl DataManager {
                 &(data.ban_expire as i64),
                 &(data.coins as i32),
                 &serde_json::to_string(&data.checkouts).unwrap(),
+                &serde_json::to_string(&data.applied_configurations).unwrap(),
             ]
         );
 
@@ -538,6 +540,68 @@ impl DataManager {
             return Err(Error::DatabaseError(e.to_string()));
         }
 
+        // delete transfers
+        let res = execute!(
+            &conn,
+            "DELETE FROM transfers WHERE sender = $1 OR receiver = $1",
+            &[&(id as i64)]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        // delete products
+        let res = execute!(
+            &conn,
+            "DELETE FROM products WHERE owner = $1",
+            &[&(id as i64)]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        // delete domains
+        let res = execute!(
+            &conn,
+            "DELETE FROM domains WHERE owner = $1",
+            &[&(id as i64)]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        // delete services
+        let res = execute!(
+            &conn,
+            "DELETE FROM services WHERE owner = $1",
+            &[&(id as i64)]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        // delete letters
+        let res = execute!(
+            &conn,
+            "DELETE FROM letters WHERE owner = $1",
+            &[&(id as i64)]
+        );
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
+        // delete ads
+        let res = execute!(&conn, "DELETE FROM ads WHERE owner = $1", &[&(id as i64)]);
+
+        if let Err(e) = res {
+            return Err(Error::DatabaseError(e.to_string()));
+        }
+
         // delete user follows... individually since it requires updating user counts
         for follow in self.get_userfollows_by_receiver_all(id).await? {
             self.delete_userfollow(follow.id, &user, true).await?;
@@ -1036,6 +1100,38 @@ impl DataManager {
         Ok((totp.get_secret_base32(), qr, recovery))
     }
 
+    /// Get all applied configurations as a vector of strings from the given user.
+    pub async fn get_applied_configurations(&self, user: &User) -> Result<Vec<String>> {
+        let mut out = Vec::new();
+
+        for config in &user.applied_configurations {
+            let product = self.get_product_by_id(config.1).await?;
+            let owner = self.get_user_by_id_with_void(product.owner).await?;
+
+            if config.0 == AppliedConfigType::StyleSnippet
+                && !owner.permissions.check(FinePermission::SUPPORTER)
+            {
+                out.push(format!(
+                    "<script>console.warn(\"{} has stopped their supporter subscription, so this applied configuration no longer works.\");</script>",
+                    owner.username
+                ));
+
+                continue;
+            }
+
+            out.push(match config.0 {
+                AppliedConfigType::StyleSnippet => {
+                    format!(
+                        "<style>{}</style>",
+                        product.data.replace("<", "&lt;").replace(">", "&gt;")
+                    )
+                }
+            })
+        }
+
+        Ok(out)
+    }
+
     pub async fn cache_clear_user(&self, user: &User) {
         self.0.1.remove(format!("atto.user:{}", user.id)).await;
         self.0
@@ -1064,6 +1160,7 @@ impl DataManager {
     auto_method!(update_user_ban_expire(i64)@get_user_by_id -> "UPDATE users SET ban_expire = $1 WHERE id = $2" --cache-key-tmpl=cache_clear_user);
     auto_method!(update_user_coins(i32)@get_user_by_id -> "UPDATE users SET coins = $1 WHERE id = $2" --cache-key-tmpl=cache_clear_user);
     auto_method!(update_user_checkouts(Vec<String>)@get_user_by_id -> "UPDATE users SET checkouts = $1 WHERE id = $2" --serde --cache-key-tmpl=cache_clear_user);
+    auto_method!(update_user_applied_configurations(Vec<(AppliedConfigType, usize)>)@get_user_by_id -> "UPDATE users SET applied_configurations = $1 WHERE id = $2" --serde --cache-key-tmpl=cache_clear_user);
 
     auto_method!(get_user_by_stripe_id(&str)@get_user_from_row -> "SELECT * FROM users WHERE stripe_id = $1" --name="user" --returns=User);
     auto_method!(update_user_stripe_id(&str)@get_user_by_id -> "UPDATE users SET stripe_id = $1 WHERE id = $2" --cache-key-tmpl=cache_clear_user);

crates/core/src/database/common.rs

@@ -46,6 +46,7 @@ impl DataManager {
         execute!(&conn, common::CREATE_TABLE_LETTERS).unwrap();
         execute!(&conn, common::CREATE_TABLE_TRANSFERS).unwrap();
         execute!(&conn, common::CREATE_TABLE_PRODUCTS).unwrap();
+        execute!(&conn, common::CREATE_TABLE_ADS).unwrap();
 
         for x in common::VERSION_MIGRATIONS.split(";") {
             execute!(&conn, x).unwrap();

crates/core/src/database/drivers/common.rs

@@ -34,3 +34,4 @@ pub const CREATE_TABLE_APP_DATA: &str = include_str!("./sql/create_app_data.sql"
 pub const CREATE_TABLE_LETTERS: &str = include_str!("./sql/create_letters.sql");
 pub const CREATE_TABLE_TRANSFERS: &str = include_str!("./sql/create_transfers.sql");
 pub const CREATE_TABLE_PRODUCTS: &str = include_str!("./sql/create_products.sql");
+pub const CREATE_TABLE_ADS: &str = include_str!("./sql/create_ads.sql");

crates/core/src/database/drivers/sql/create_ads.sql

@@ -0,0 +1,10 @@
+CREATE TABLE IF NOT EXISTS ads (
+    id BIGINT PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    created BIGINT NOT NULL,
+    owner BIGINT NOT NULL,
+    upload_id BIGINT NOT NULL,
+    target TEXT NOT NULL,
+    last_charge_time BIGINT NOT NULL,
+    is_running INT NOT NULL,
+    size TEXT NOT NULL
+)

crates/core/src/database/drivers/sql/create_products.sql

@@ -7,5 +7,8 @@ CREATE TABLE IF NOT EXISTS products (
     method TEXT NOT NULL,
     on_sale INT NOT NULL,
     price INT NOT NULL,
-    stock INT NOT NULL
+    stock INT NOT NULL,
+    single_use INT NOT NULL,
+    data TEXT NOT NULL,
+    uploads TEXT NOT NULL
 )

crates/core/src/database/drivers/sql/create_transfers.sql

@@ -5,5 +5,6 @@ CREATE TABLE IF NOT EXISTS transfers (
     receiver BIGINT NOT NULL,
     amount INT NOT NULL,
     is_pending INT NOT NULL,
-    method TEXT NOT NULL
+    method TEXT NOT NULL,
+    source TEXT NOT NULL
 )

crates/core/src/database/drivers/sql/create_users.sql

@@ -31,5 +31,6 @@ CREATE TABLE IF NOT EXISTS users (
     is_deactivated INT NOT NULL,
     ban_expire BIGINT NOT NULL,
     coins INT NOT NULL,
-    checkouts TEXT NOT NULL
+    checkouts TEXT NOT NULL,
+    applied_configurations TEXT NOT NULL
 )

crates/core/src/database/drivers/sql/version_migrations.sql

@@ -45,3 +45,23 @@ ADD COLUMN IF NOT EXISTS data TEXT DEFAULT '"Null"';
 -- users checkouts
 ALTER TABLE users
 ADD COLUMN IF NOT EXISTS checkouts TEXT DEFAULT '[]';
+
+-- products single_use
+ALTER TABLE products
+ADD COLUMN IF NOT EXISTS single_use INT DEFAULT 1;
+
+-- transfers source
+ALTER TABLE transfers
+ADD COLUMN IF NOT EXISTS source TEXT DEFAULT '"General"';
+
+-- products data
+ALTER TABLE products
+ADD COLUMN IF NOT EXISTS data TEXT DEFAULT '';
+
+-- users applied_configurations
+ALTER TABLE users
+ADD COLUMN IF NOT EXISTS applied_configurations TEXT DEFAULT '[]';
+
+-- products uploads
+ALTER TABLE products
+ADD COLUMN IF NOT EXISTS uploads TEXT DEFAULT '{}';

crates/core/src/database/mod.rs

@@ -1,3 +1,4 @@
+mod ads;
 pub mod app_data;
 mod apps;
 mod audit_log;
@@ -39,3 +40,4 @@ mod userfollows;
 
 pub use drivers::DataManager;
 pub use common::NAME_REGEX;
+pub use posts::FullPost;

crates/core/src/database/posts.rs

@@ -2221,8 +2221,10 @@ impl DataManager {
 
         // decr parent comment count
         if let Some(replying_to) = y.replying_to {
+            if replying_to != 0 {
                 self.decr_post_comments(replying_to).await.unwrap();
             }
+        }
 
         // decr user post count
         let owner = self.get_user_by_id(y.owner).await?;

crates/core/src/database/products.rs

@@ -1,6 +1,9 @@
 use crate::model::{
     auth::User,
-    economy::{CoinTransfer, CoinTransferMethod, Product, ProductFulfillmentMethod},
+    economy::{
+        CoinTransfer, CoinTransferMethod, CoinTransferSource, Product, ProductFulfillmentMethod,
+        ProductUploads,
+    },
     mail::Letter,
     permissions::FinePermission,
     Error, Result,
@@ -21,6 +24,9 @@ impl DataManager {
             on_sale: get!(x->6(i32)) as i8 == 1,
             price: get!(x->7(i32)),
             stock: get!(x->8(i32)),
+            single_use: get!(x->9(i32)) as i8 == 1,
+            data: get!(x->10(String)),
+            uploads: serde_json::from_str(&get!(x->11(String))).unwrap(),
         }
     }
 
@@ -57,7 +63,7 @@ impl DataManager {
         Ok(res.unwrap())
     }
 
-    const MAXIMUM_FREE_PRODUCTS: usize = 5;
+    const MAXIMUM_FREE_PRODUCTS: usize = 10;
 
     /// Create a new product in the database.
     ///
@@ -103,7 +109,7 @@ impl DataManager {
 
         let res = execute!(
             &conn,
-            "INSERT INTO products VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)",
+            "INSERT INTO products VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)",
             params![
                 &(data.id as i64),
                 &(data.created as i64),
@@ -113,7 +119,10 @@ impl DataManager {
                 &serde_json::to_string(&data.method).unwrap(),
                 &{ if data.on_sale { 1 } else { 0 } },
                 &data.price,
-                &(data.stock as i32)
+                &(data.stock as i32),
+                &{ if data.single_use { 1 } else { 0 } },
+                &data.data,
+                &serde_json::to_string(&data.uploads).unwrap(),
             ]
         );
 
@@ -131,11 +140,28 @@ impl DataManager {
         customer: &mut User,
     ) -> Result<CoinTransfer> {
         let product = self.get_product_by_id(product).await?;
+
+        // handle single_use product
+        if product.single_use {
+            if self
+                .get_transfer_by_sender_method(
+                    customer.id,
+                    CoinTransferMethod::Purchase(product.id),
+                )
+                .await
+                .is_ok()
+            {
+                return Err(Error::MiscError("You already own this product".to_string()));
+            }
+        }
+
+        // ...
         let mut transfer = CoinTransfer::new(
             customer.id,
             product.owner,
             product.price,
             CoinTransferMethod::Purchase(product.id),
+            CoinTransferSource::Sale,
         );
 
         if !product.stock.is_negative() {
@@ -198,6 +224,21 @@ If your product is a purchase of goods or services, please be sure to fulfill th
                 // return
                 Ok(transfer)
             }
+            ProductFulfillmentMethod::ProfileStyle => {
+                // pretty much an automail without the message
+                self.create_transfer(&mut transfer, true).await?;
+
+                self.create_letter(Letter::new(
+                    self.0.0.system_user,
+                    vec![customer.id],
+                    format!("Thank you for purchasing \"{}\"", product.title),
+                    "You've purchased a CSS snippet which can be applied to your profile through the product's page!".to_string(),
+                    0,
+                ))
+                .await?;
+
+                Ok(transfer)
+            }
         }
     }
 
@@ -209,6 +250,15 @@ If your product is a purchase of goods or services, please be sure to fulfill th
             return Err(Error::NotAllowed);
         }
 
+        // remove uploads
+        for upload in product.uploads.thumbnails {
+            self.delete_upload(upload).await?;
+        }
+
+        if product.uploads.reward != 0 {
+            self.delete_upload(product.uploads.reward).await?;
+        }
+
         // ...
         let conn = match self.0.connect().await {
             Ok(c) => c,
@@ -231,6 +281,9 @@ If your product is a purchase of goods or services, please be sure to fulfill th
     auto_method!(update_product_price(i32)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET price = $1 WHERE id = $2" --cache-key-tmpl="atto.product:{}");
     auto_method!(update_product_on_sale(i32)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET on_sale = $1 WHERE id = $2" --cache-key-tmpl="atto.product:{}");
     auto_method!(update_product_method(ProductFulfillmentMethod)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET method = $1 WHERE id = $2" --serde --cache-key-tmpl="atto.product:{}");
+    auto_method!(update_product_single_use(i32)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET single_use = $1 WHERE id = $2" --cache-key-tmpl="atto.product:{}");
+    auto_method!(update_product_data(&str)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET data = $1 WHERE id = $2" --cache-key-tmpl="atto.product:{}");
+    auto_method!(update_product_uploads(ProductUploads)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET uploads = $1 WHERE id = $2" --serde --cache-key-tmpl="atto.product:{}");
 
     auto_method!(update_product_stock(i32)@get_product_by_id:FinePermission::MANAGE_USERS; -> "UPDATE products SET stock = $1 WHERE id = $2" --cache-key-tmpl="atto.product:{}");
     auto_method!(incr_product_stock() -> "UPDATE products SET stock = stock + 1 WHERE id = $1" --cache-key-tmpl="atto.product:{}" --incr);

crates/core/src/database/requests.rs

@@ -29,7 +29,14 @@ impl DataManager {
             .get(format!("atto.request:{}:{}", id, linked_asset))
             .await
         {
-            return Ok(serde_json::from_str(&cached).unwrap());
+            if let Ok(x) = serde_json::from_str(&cached) {
+                return Ok(x);
+            } else {
+                self.0
+                    .1
+                    .remove(format!("atto.request:{}:{}", id, linked_asset))
+                    .await;
+            }
         }
 
         let conn = match self.0.connect().await {

crates/core/src/database/transfers.rs

@@ -1,11 +1,11 @@
 use std::collections::HashMap;
 use crate::model::{
-    Error, Result,
-    economy::{CoinTransferMethod, Product, CoinTransfer},
     auth::{Notification, User},
+    economy::{CoinTransfer, CoinTransferMethod, CoinTransferSource, Product},
+    Error, Result,
 };
 use crate::{auto_method, DataManager};
-use oiseau::{cache::Cache, execute, get, params, query_rows, PostgresRow};
+use oiseau::{cache::Cache, execute, get, params, query_row, query_rows, PostgresRow};
 
 impl DataManager {
     /// Get a [`CoinTransfer`] from an SQL row.
@@ -18,6 +18,7 @@ impl DataManager {
             amount: get!(x->4(i32)),
             is_pending: get!(x->5(i32)) as i8 == 1,
             method: serde_json::from_str(&get!(x->6(String))).unwrap(),
+            source: serde_json::from_str(&get!(x->7(String))).unwrap(),
         }
     }
 
@@ -27,16 +28,13 @@ impl DataManager {
     pub async fn fill_transfers(
         &self,
         list: Vec<CoinTransfer>,
-    ) -> Result<Vec<(usize, usize, i32, User, User, Option<Product>, bool)>> {
+    ) -> Result<Vec<(User, User, Option<Product>, CoinTransfer)>> {
         let mut out = Vec::new();
         let mut seen_users: HashMap<usize, User> = HashMap::new();
         let mut seen_products: HashMap<usize, Product> = HashMap::new();
 
         for transfer in list {
             out.push((
-                transfer.id,
-                transfer.created,
-                transfer.amount,
                 if let Some(user) = seen_users.get(&transfer.sender) {
                     user.to_owned()
                 } else {
@@ -54,16 +52,20 @@ impl DataManager {
                 match transfer.method {
                     CoinTransferMethod::Transfer => None,
                     CoinTransferMethod::Purchase(id) => {
-                        Some(if let Some(product) = seen_products.get(&id) {
-                            product.to_owned()
+                        if let Some(product) = seen_products.get(&id) {
+                            Some(product.to_owned())
                         } else {
-                            let product = self.get_product_by_id(id).await?;
+                            match self.get_product_by_id(id).await {
+                                Ok(product) => {
                                     seen_products.insert(product.id, product.clone());
-                            product
-                        })
+                                    Some(product)
+                                }
+                                Err(_) => None,
+                            }
+                        }
                     }
                 },
-                transfer.is_pending,
+                transfer,
             ));
         }
 
@@ -101,6 +103,35 @@ impl DataManager {
         Ok(res.unwrap())
     }
 
+    /// Get a transfer by user and method.
+    ///
+    /// # Arguments
+    /// * `id` - the ID of the user to fetch transfers for
+    /// * `method` - the transfer method
+    pub async fn get_transfer_by_sender_method(
+        &self,
+        id: usize,
+        method: CoinTransferMethod,
+    ) -> Result<CoinTransfer> {
+        let conn = match self.0.connect().await {
+            Ok(c) => c,
+            Err(e) => return Err(Error::DatabaseConnection(e.to_string())),
+        };
+
+        let res = query_row!(
+            &conn,
+            "SELECT * FROM transfers WHERE sender = $1 AND method = $2 LIMIT 1",
+            params![&(id as i64), &serde_json::to_string(&method).unwrap()],
+            |x| { Ok(Self::get_transfer_from_row(x)) }
+        );
+
+        if res.is_err() {
+            return Err(Error::GeneralNotFound("transfer".to_string()));
+        }
+
+        Ok(res.unwrap())
+    }
+
     /// Create a new transfer in the database.
     ///
     /// # Arguments
@@ -129,6 +160,16 @@ impl DataManager {
             }
 
             self.update_user_coins(receiver.id, receiver.coins).await?;
+
+            // handle refund notification
+            if data.source == CoinTransferSource::Refund {
+                self.create_notification(Notification::new(
+                    "A coin refund has been issued to your account!".to_string(),
+                    "You've been issued a refund for a prior purchase. The product will remain in your account, but your coins have been returned.".to_string(),
+                    receiver.id,
+                ))
+                .await?;
+            }
         } else {
             // we haven't applied the transfer, so this must be pending
             data.is_pending = true;
@@ -142,7 +183,7 @@ impl DataManager {
 
         let res = execute!(
             &conn,
-            "INSERT INTO transfers VALUES ($1, $2, $3, $4, $5, $6, $7)",
+            "INSERT INTO transfers VALUES ($1, $2, $3, $4, $5, $6, $7, $8)",
             params![
                 &(data.id as i64),
                 &(data.created as i64),
@@ -151,6 +192,7 @@ impl DataManager {
                 &data.amount,
                 &{ if data.is_pending { 1 } else { 0 } },
                 &serde_json::to_string(&data.method).unwrap(),
+                &serde_json::to_string(&data.source).unwrap(),
             ]
         );
 

crates/core/src/model/auth.rs

@@ -101,11 +101,20 @@ pub struct User {
     /// already applied this purchase.
     #[serde(default)]
     pub checkouts: Vec<String>,
+    /// The IDs of products to be applied to the user's profile.
+    #[serde(default)]
+    pub applied_configurations: Vec<(AppliedConfigType, usize)>,
 }
 
 pub type UserConnections =
     HashMap<ConnectionService, (ExternalConnectionInfo, ExternalConnectionData)>;
 
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+pub enum AppliedConfigType {
+    /// An HTML `<style>` snippet.
+    StyleSnippet,
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize)]
 pub enum ThemePreference {
     Auto,
@@ -362,6 +371,9 @@ pub struct UserSettings {
     /// If your profile has the "Shop" tab enabled.
     #[serde(default)]
     pub enable_shop: bool,
+    /// Hide all badges from your username (everywhere but on profile).
+    #[serde(default)]
+    pub hide_username_badges: bool,
 }
 
 fn mime_avif() -> String {
@@ -414,6 +426,7 @@ impl User {
             ban_expire: 0,
             coins: 0,
             checkouts: Vec::new(),
+            applied_configurations: Vec::new(),
         }
     }
 

crates/core/src/model/economy.rs

@@ -10,6 +10,33 @@ pub enum ProductFulfillmentMethod {
     ///
     /// This will leave the [`CoinTransfer`] pending until you send this mail.
     ManualMail,
+    /// A CSS snippet which can be applied to user profiles.
+    ///
+    /// Only supporters can create products like this.
+    ProfileStyle,
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct ProductUploads {
+    /// Promotional thumbnails shown on the product page.
+    ///
+    /// Maximum of 4 with a maximum upload size of 2 MiB.
+    #[serde(default)]
+    pub thumbnails: Vec<usize>,
+    /// Reward given to users through active configurations after they purchase the product.
+    //
+    //  Maximum upload size of 4 MiB.
+    #[serde(default)]
+    pub reward: usize,
+}
+
+impl Default for ProductUploads {
+    fn default() -> Self {
+        Self {
+            thumbnails: Vec::new(),
+            reward: 0,
+        }
+    }
 }
 
 #[derive(Clone, Serialize, Deserialize)]
@@ -29,6 +56,15 @@ pub struct Product {
     ///
     /// A negative stock means the product has unlimited stock.
     pub stock: i32,
+    /// If this product is limited to one purchase per person.
+    #[serde(default)]
+    pub single_use: bool,
+    /// Data for this product. Only used by snippets.
+    #[serde(default)]
+    pub data: String,
+    /// Uploads for this product.
+    #[serde(default)]
+    pub uploads: ProductUploads,
 }
 
 impl Product {
@@ -44,6 +80,9 @@ impl Product {
             on_sale: false,
             price: 0,
             stock: 0,
+            single_use: true,
+            data: String::new(),
+            uploads: ProductUploads::default(),
         }
     }
 }
@@ -55,6 +94,22 @@ pub enum CoinTransferMethod {
     Purchase(usize),
 }
 
+#[derive(Serialize, Deserialize, PartialEq, Eq)]
+pub enum CoinTransferSource {
+    /// An unknown source, such as a transfer request.
+    General,
+    /// A product sale.
+    Sale,
+    /// A purchase of coins through Stripe.
+    Purchase,
+    /// A refund of coins.
+    Refund,
+    /// The charge for keeping an ad running.
+    AdCharge,
+    /// Gained coins from a click on an ad on your site.
+    AdClick,
+}
+
 #[derive(Serialize, Deserialize)]
 pub struct CoinTransfer {
     pub id: usize,
@@ -64,11 +119,18 @@ pub struct CoinTransfer {
     pub amount: i32,
     pub is_pending: bool,
     pub method: CoinTransferMethod,
+    pub source: CoinTransferSource,
 }
 
 impl CoinTransfer {
     /// Create a new [`CoinTransfer`].
-    pub fn new(sender: usize, receiver: usize, amount: i32, method: CoinTransferMethod) -> Self {
+    pub fn new(
+        sender: usize,
+        receiver: usize,
+        amount: i32,
+        method: CoinTransferMethod,
+        source: CoinTransferSource,
+    ) -> Self {
         Self {
             id: Snowflake::new().to_string().parse::<usize>().unwrap(),
             created: unix_epoch_timestamp(),
@@ -77,6 +139,7 @@ impl CoinTransfer {
             amount,
             is_pending: false,
             method,
+            source,
         }
     }
 
@@ -90,3 +153,69 @@ impl CoinTransfer {
         (sender.coins < 0, receiver.coins < 0)
     }
 }
+
+/// <https://en.wikipedia.org/wiki/Web_banner#Standard_sizes>
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub enum UserAdSize {
+    /// 970x250
+    Billboard,
+    /// 720x90
+    Leaderboard,
+    /// 160x600
+    Skyscraper,
+    /// 300x250
+    MediumRectangle,
+    /// 320x50 - mobile only
+    MobileLeaderboard,
+}
+
+impl Default for UserAdSize {
+    fn default() -> Self {
+        Self::MediumRectangle
+    }
+}
+
+impl UserAdSize {
+    /// Get the dimensions of the size in CSS pixels.
+    pub fn dimensions(&self) -> (u16, u16) {
+        match self {
+            Self::Billboard => (970, 250),
+            Self::Leaderboard => (720, 90),
+            Self::Skyscraper => (160, 600),
+            Self::MediumRectangle => (300, 250),
+            Self::MobileLeaderboard => (320, 50),
+        }
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct UserAd {
+    pub id: usize,
+    pub created: usize,
+    pub owner: usize,
+    pub upload_id: usize,
+    pub target: String,
+    /// The time that the owner was last charged for keeping this ad up.
+    ///
+    /// Ads cost 50 coins per day of running.
+    pub last_charge_time: usize,
+    pub is_running: bool,
+    pub size: UserAdSize,
+}
+
+impl UserAd {
+    /// Create a new [`UserAd`].
+    pub fn new(owner: usize, upload_id: usize, target: String, size: UserAdSize) -> Self {
+        let created = unix_epoch_timestamp();
+        Self {
+            id: 0, // will be overwritten by postgres
+            created,
+            owner,
+            upload_id,
+            target,
+            last_charge_time: 0,
+            is_running: false,
+            size,
+        }
+    }
+}