Simplify form post actions.HEADmaster

Put account management pages under "/account" URL prefix.

Set logged in user in res.locals for use in pug templates.

Tweak verification flow.

Require password to change name and mail.

Show user statistics on profile (use pug mixin).

Remove "api" prefix on many routes.

22 files changed, 132 insertions, 93 deletions

diff --git a/views/change_about.pug b/views/account_change_about.pug
index b5e2c84..7a0531e 100644
--- a/views/change_about.pug
+++ b/views/account_change_about.pug
@@ -10,7 +10,7 @@ html
 		include header
 		article
 			h1 Change profile text
-			form(method="post" action="/change-about")
+			form(method="post")
 				p Name: #{user.name}
 				p Mail: #{user.mail}
 				p
diff --git a/views/change_mail.pug b/views/account_change_mail.pug
index d244e98..4d0605a 100644
--- a/views/change_mail.pug
+++ b/views/account_change_mail.pug
@@ -11,7 +11,7 @@ html
 			if flash
 				p.error= flash
 
-			form(method="post" action="/change-mail")
+			form(method="post")
 				p Name: #{user.name}
 				p Mail: #{user.mail}
 				p
@@ -19,4 +19,8 @@ html
 						br
 						input(type="text" name="newmail" required)
 				p
+					label Password:
+						br
+						input(type="password" name="password" required)
+				p
 					button(type="submit") Change mail
diff --git a/views/change_name.pug b/views/account_change_name.pug
index 03763ac..b1845ab 100644
--- a/views/change_name.pug
+++ b/views/account_change_name.pug
@@ -11,7 +11,7 @@ html
 			if flash
 				p.error= flash
 
-			form(method="post" action="/change-name")
+			form(method="post")
 				p Name: #{user.name}
 				p Mail: #{user.mail}
 				p
@@ -19,4 +19,8 @@ html
 						br
 						input(type="text" name="newname" required)
 				p
+					label Password:
+						br
+						input(type="password" name="password" required)
+				p
 					button(type="submit") Change name
diff --git a/views/change_password.pug b/views/account_change_password.pug
index 022a67c..ca8e973 100644
--- a/views/change_password.pug
+++ b/views/account_change_password.pug
@@ -11,7 +11,7 @@ html
 			if flash
 				p.error= flash
 
-			form(method="post" action="/change-password")
+			form(method="post")
 				p Name: #{user.name}
 				p Mail: #{user.mail}
 				p
diff --git a/views/delete_account.pug b/views/account_delete.pug
index e16e1b6..54c3bc4 100644
--- a/views/delete_account.pug
+++ b/views/account_delete.pug
@@ -11,7 +11,7 @@ html
 			if flash
 				p.error= flash
 
-			form(method="post" action="/delete-account")
+			form(method="post")
 				p Name: #{user.name}
 				p Mail: #{user.mail}
 				p
diff --git a/views/forgot_password.pug b/views/account_forgot_password.pug
index 935cae1..0913857 100644
--- a/views/forgot_password.pug
+++ b/views/account_forgot_password.pug
@@ -15,7 +15,7 @@ html
 			if user
 				p You're already logged in!
 			else
-				form(method="post" action="/forgot-password")
+				form(method="post")
 					p
 						label Mail:
 							br
diff --git a/views/account_mail_verify.pug b/views/account_mail_verify.pug
new file mode 100644
index 0000000..fddf2fa
--- /dev/null
+++ b/views/account_mail_verify.pug
@@ -0,0 +1,32 @@
+//- vim:ts=4:sw=4:
+doctype html
+html
+	head
+		include head
+		title Verify mail
+	body
+		include header
+		article
+			h1 Verify mail
+			if flash
+				p.error= flash
+
+			p Your mail address is <code>#{user.mail}</code>
+
+			p If the above address is wrong, you can <a href="/account/change-mail">change it</a>!
+
+			if sent_token
+				p Your token is in the mail!
+			else
+				form(method="post" action="/account/mail/verify-send")
+					p
+						button(type="submit") Send token
+
+			form(method="post")
+				p
+					label Enter your mail verification token here:
+						br
+						input(type="text" name="token" size=32 value=token style="font-family:monospace" required)
+				p
+					button(type="submit") Verify
+
diff --git a/views/reset_password.pug b/views/account_reset_password.pug
index 2fda418..8707ebc 100644
--- a/views/reset_password.pug
+++ b/views/account_reset_password.pug
@@ -13,7 +13,7 @@ html
 
 			p You should have received a password reset token in your mail.
 
-			form(method="post" action="/reset-password")
+			form(method="post")
 				p
 					label Mail:
 						br
diff --git a/views/webhook.pug b/views/account_webhook.pug
index 20d20ac..b9817ef 100644
--- a/views/webhook.pug
+++ b/views/account_webhook.pug
@@ -14,7 +14,7 @@ html(lang="en")
 			- var format = webhook && webhook.format || ""
 			- var prefix = webhook && webhook.prefix || ""
 
-			form(action="/api/webhook/update" method="post")
+			form(action="/account/webhook/update" method="post")
 				if webhook && webhook.error
 					p.error ERROR: #{webhook.error}
 				p Webhook URL:
@@ -34,7 +34,7 @@ html(lang="en")
 					button(type="submit") Create
 
 			if webhook
-				form(action="/api/webhook/delete" method="post")
+				form(action="/account/webhook/delete" method="post")
 					button(type="submit") Delete
 
 			h2 Discord Notifications
diff --git a/views/search_user.pug b/views/contacts_search.pug
index 308cc41..308cc41 100644
--- a/views/search_user.pug
+++ b/views/contacts_search.pug
diff --git a/views/create-index.pug b/views/create_index.pug
index c508be7..c508be7 100644
--- a/views/create-index.pug
+++ b/views/create_index.pug
diff --git a/views/create.pug b/views/create_title.pug
index c4c5c2a..c4c5c2a 100644
--- a/views/create.pug
+++ b/views/create_title.pug
diff --git a/views/head.pug b/views/head.pug
index eec1299..da73d4e 100644
--- a/views/head.pug
+++ b/views/head.pug
@@ -212,3 +212,36 @@ mixin tourlist(seeds, pools, fin)
 					+poollist(pools, "Active", TM_ICON_ACTIVE)
 				div
 					+poollist(fin, "Finished", TM_ICON_FINISHED)
+
+mixin userstats(who, ratings)
+		if (who.move_time_mean !== null)
+			h3 Response time
+			div Average response time: #{format_minutes(who.move_time_mean)}
+			if (who.move_time_q2 !== null)
+				div Median response time: #{format_minutes(who.move_time_q2)}
+			if (who.move_time_q1 !== null && who.move_time_q2 !== null)
+				div Middle half of response times: #{format_minutes(who.move_time_q1)} to #{format_minutes(who.move_time_q3)}
+
+		h3 Timeouts
+		div Total number of timeouts: #{who.timeout_total}
+		div Games completed since last timeout: #{who.games_since_timeout}
+
+		if ratings.length > 0
+			h3 Most played games
+			table
+				thead
+					tr
+						th Title
+						th Count
+						th Last played
+						if user && user.user_id === 1
+							th Elo
+				tbody
+					each row in ratings
+						tr
+							td
+								a.black(href="/" + row.title_id)= row.title_name
+							td.r= row.count
+							td.r= row.last
+							if user && user.user_id === 1
+								td.r= row.rating
diff --git a/views/login.pug b/views/login.pug
index 9a44b44..ec8be48 100644
--- a/views/login.pug
+++ b/views/login.pug
@@ -19,7 +19,7 @@ html
 					p You need to be logged in to view this page!
 					p Log in below, or <a href="/signup">sign up</a> for a free account.
 
-				form(method="post" action="/login")
+				form(method="post")
 					input(type="hidden" name="redirect" value=redirect)
 					p
 						label Name or mail:
@@ -33,4 +33,4 @@ html
 					p
 						button(type="submit") Login
 				p
-					a(href="/forgot-password") Forgot password
+					a(href="/account/forgot-password") Forgot password
diff --git a/views/profile.pug b/views/profile.pug
index 4ecf289..fc9a1d3 100644
--- a/views/profile.pug
+++ b/views/profile.pug
@@ -7,43 +7,60 @@ html
 	body
 		include header
 		article
-			h1= SITE_NAME
+			h1 Profile
 
 			p Welcome, <a class="black" href="/user/#{user.name}">#{user.name}</a>!
+
+			if who.about
+				p.box= who.about
+
+			p Member since #{human_date(who.ctime)}.
+
+			+userstats(who, ratings)
+
+			h3 Notifications
+
 			p Your mail address is #{user.mail}
 
 			if ENABLE_MAIL
-				if !user.is_verified
-					p &#x26a0; <a href="/verify-mail">Verify your mail address!</a>
+				if !mail.is_verified
+					p &#x26a0; <a href="/account/mail/verify">Verify your mail address!</a>
 					p You must verify your mail address before you can enable notifications.
 				else
-					if !user.notify
-						p <a href="/subscribe">Enable mail notifications</a>
-				if user.notify
-					p <a href="/unsubscribe">Disable mail notifications</a>
+					if !mail.notify
+						p <a href="/account/mail/subscribe">Enable mail notifications</a>
+				if mail.notify
+					p <a href="/account/mail/unsubscribe">Disable mail notifications</a>
+			else
+				p.error Mail notifications are disabled on this server.
+
+			if ENABLE_WEBHOOKS
+				if !webhook
+					p <a href="/account/webhook">Configure webhook</a>
+				else if webhook.error
+					dl
+						dt <a href="/account/webhook">Configure webhook</a>
+						dd.error ERROR: #{webhook.error}
+				else
+					dl
+						dt <a href="/account/webhook">Configure webhook</a>
+						dd= new URL(webhook.url).hostname
+			else
+				p.error Webhook notifications are disabled on this server.
+
+			h3 Account
 
 			p
-				| <a href="/change-password">Change password</a>
+				| <a href="/account/change-password">Change password</a>
 				br
-				| <a href="/change-mail">Change mail address</a>
+				| <a href="/account/change-mail">Change mail address</a>
 				br
-				| <a href="/change-name">Change user name</a>
+				| <a href="/account/change-name">Change user name</a>
 				br
-				| <a href="/change-about">Change profile text</a>
-				br
-				| <a href="/delete-account">Delete account</a>
+				| <a href="/account/change-about">Change profile text</a>
 
-			if ENABLE_WEBHOOKS
-				if !user.webhook
-					p <a href="/webhook">Configure webhook</a>
-				else if user.webhook.error
-					dl
-						dt <a href="/webhook">Configure webhook</a>
-						dd.error ERROR: #{user.webhook.error}
-				else
-					dl
-						dt <a href="/webhook">Configure webhook</a>
-						dd= new URL(user.webhook.url).hostname
+			p
+				| <a href="/account/delete">Delete account</a>
 
 			p
 				form(action="/logout" method="post")
diff --git a/views/signup.pug b/views/signup.pug
index 63b9ab3..5dec458 100644
--- a/views/signup.pug
+++ b/views/signup.pug
@@ -15,7 +15,7 @@ html
 			if user
 				p You're already logged in!
 			else
-				form(method="post" action="/signup")
+				form(method="post")
 					p You need to sign up for a free account to play games on #{SITE_NAME_P}
 					p
 						label Name:
diff --git a/views/game_stats.pug b/views/stats_title.pug
index 692c30b..aed6e63 100644
--- a/views/game_stats.pug
+++ b/views/stats_title.pug
@@ -19,7 +19,7 @@ html
 				tbody
 					each row in ratings
 						tr
-							td= row.name
+							td <a class="black" href="/stats/user/#{row.name}">#{row.name}</a>
 							td.r= row.rating
 							td.r= row.count
 							td.r= row.last
diff --git a/views/user_stats.pug b/views/stats_user.pug
index 3b201ef..3b201ef 100644
--- a/views/user_stats.pug
+++ b/views/stats_user.pug
diff --git a/views/info.pug b/views/title.pug
index 32837e9..32837e9 100644
--- a/views/info.pug
+++ b/views/title.pug
diff --git a/views/tm_seed.pug b/views/tm_seed.pug
index 45659c5..abf02c1 100644
--- a/views/tm_seed.pug
+++ b/views/tm_seed.pug
@@ -67,11 +67,11 @@ html
 
 					if user
 						if queue.find(p => p.user_id === user.user_id)
-							form(method="post" action="/api/tm/withdraw/" + seed.seed_id + "/" + (ix+1))
+							form(method="post" action="/tm/withdraw/" + seed.seed_id + "/" + (ix+1))
 								button(disabled) Register
 								button(type="submit") Withdraw
 						else if may_register && may_join_seed_level(user.user_id, seed.seed_id, ix+1)
-							form(method="post" action="/api/tm/register/" + seed.seed_id + "/" + (ix+1))
+							form(method="post" action="/tm/register/" + seed.seed_id + "/" + (ix+1))
 								button(type="submit") Register
 								button(disabled) Withdraw
 						else
@@ -81,7 +81,7 @@ html
 
 						if user.user_id === 1
 							if queue.length >= seed.pool_size
-								form(method="post" action="/api/tm/start/" + seed.seed_id + "/" + (ix+1))
+								form(method="post" action="/tm/start/" + seed.seed_id + "/" + (ix+1))
 									button(type="submit") Start
 					else
 						p <a href="/login">Login</a> or <a href="/signup">sign up</a> to register.
diff --git a/views/user.pug b/views/user.pug
index c3e8925..b5859a2 100644
--- a/views/user.pug
+++ b/views/user.pug
@@ -24,7 +24,7 @@ html
 			h1= who.name
 
 			if who.about
-				p.about= who.about
+				p.box= who.about
 
 			p Member since #{human_date(who.ctime)}.
 			p Last seen #{human_date(who.atime)}.
@@ -42,37 +42,7 @@ html
 						br
 						a(href="/contacts/add-enemy/"+who.name) Add to blacklist
 
-			if (who.move_time_mean !== null)
-				h3 Response time
-				div Average response time: #{format_minutes(who.move_time_mean)}
-				if (who.move_time_q2 !== null)
-					div Median response time: #{format_minutes(who.move_time_q2)}
-				if (who.move_time_q1 !== null && who.move_time_q2 !== null)
-					div Middle half of response times: #{format_minutes(who.move_time_q1)} to #{format_minutes(who.move_time_q3)}
-
-			h3 Timeouts
-			div Total number of timeouts: #{who.timeout_total}
-			div Games completed since last timeout: #{who.games_since_timeout}
-
-			if ratings.length > 0
-				h3 Most played games
-				table
-					thead
-						tr
-							th Title
-							th Count
-							th Last played
-							if user && user.user_id === 1
-								th Elo
-					tbody
-						each row in ratings
-							tr
-								td
-									a.black(href="/" + row.title_id)= row.title_name
-								td.r= row.count
-								td.r= row.last
-								if user && user.user_id === 1
-									td.r= row.rating
+			+userstats(who, ratings)
 
 			+tourlist(null, active_pools, finished_pools)
 
diff --git a/views/verify_mail.pug b/views/verify_mail.pug
deleted file mode 100644
index 01a2e82..0000000
--- a/views/verify_mail.pug
+++ /dev/null
@@ -1,21 +0,0 @@
-//- vim:ts=4:sw=4:
-doctype html
-html
-	head
-		include head
-		title Verify mail
-	body
-		include header
-		article
-			h1 Verify mail
-			if flash
-				p.error= flash
-
-			form(method="post" action="/verify-mail")
-				p A token has been sent to #{user.mail}.
-				p
-					label Enter the token here:
-						br
-						input(type="text" name="token" size=32 value=token style="font-family:monospace" required)
-				p
-					button(type="submit") Verify