--- a/src/lib/User.luan	Mon Nov 28 20:33:47 2022 -0700
+++ b/src/lib/User.luan	Mon Nov 28 22:00:43 2022 -0700
@@ -1,11 +1,15 @@
 local Luan = require "luan:Luan.luan"
 local error = Luan.error
 local set_metatable = Luan.set_metatable or error()
+local type = Luan.type or error()
+local to_string = Luan.to_string or error()
 local range = Luan.range or error()
 local set_local_only = Luan.set_local_only or error()
 local get_local_only = Luan.get_local_only or error()
 local String = require "luan:String.luan"
 local sub_string = String.sub or error()
+local to_number = String.to_number or error()
+local regex = String.regex or error()
 local Table = require "luan:Table.luan"
 local concat = Table.concat or error()
 local Math = require "luan:Math.luan"
@@ -14,6 +18,8 @@
 local time_now = Time.now or error()
 local Html = require "luan:Html.luan"
 local html_encode = Html.encode or error()
+local Number = require "luan:Number.luan"
+local long = Number.long or error()
 local Lucene = require "luan:lucene/Lucene.luan"
 local lucene_quote = Lucene.quote or error()
 local Http = require "luan:http/Http.luan"
@@ -23,7 +29,7 @@
 
 local User = {}
 
-local users_by_name = {}
+local users_by_id = {}
 
 local function from_doc(doc)
 	doc.type == "user" or error "wrong type"
@@ -34,7 +40,7 @@
 		name = doc.user_name
 		created = doc.created
 	}
-	set_local_only(users_by_name,user.name,user)
+	set_local_only(users_by_id,user.id,user)
 	return user
 end
 
@@ -72,9 +78,10 @@
 	end
 
 	function user.login()
-		Http.response.set_persistent_cookie("user",user.name)
+		local id = to_string(user.id)
+		Http.response.set_persistent_cookie("user",id)
 		Http.response.set_persistent_cookie("password",user.password)
-		Http.request.cookies.user = user.name or error()
+		Http.request.cookies.user = id
 		Http.request.cookies.password = user.password or error()
 	end
 
@@ -82,31 +89,38 @@
 	return user
 end
 
-function User.get_by_id(id)
+local function get_by_id(id)
+	if type(id) == "string" then
+		id = to_number(id)
+		if id == nil then return nil end
+	end
+	id = long(id)
+	if not Db.is_in_transaction() then
+		local user = get_local_only(users_by_id,id)
+		if user ~= nil then return user end
+	end
 	local doc = Db.get_document("id:"..id)
 	return doc and from_doc(doc)
 end
+User.get_by_id = get_by_id
 
 function User.get_by_email(email)
 	local doc = Db.get_document("user_email:"..lucene_quote(email))
 	return doc and from_doc(doc)
 end
 
-local function get_by_name(name)
-	local user = get_local_only(users_by_name,name)
-	if user ~= nil then return user end
+function User.get_by_name(name)
 	local doc = Db.get_document("user_name:"..lucene_quote(name))
 	return doc and from_doc(doc)
 end
-User.get_by_name = get_by_name
 
 function User.current()
-	local name = Http.request.cookies.user
+	local id = Http.request.cookies.user
 	local password = Http.request.cookies.password
-	if name == nil or password == nil then
+	if id == nil or password == nil then
 		return nil
 	end
-	local user = get_by_name(name)
+	local user = get_by_id(id)
 	if user == nil or user.password ~= password then
 		return nil
 	end
@@ -140,8 +154,10 @@
 function User.get_or_create_by_email(email,change_password)
 	local user = User.get_by_email(email)
 	if user == nil then
-		user = User.new{ email=email, password=new_password() }
-		user.save()
+		run_in_transaction( function()
+			user = User.new{ email=email, password=new_password() }
+			user.save()
+		end )
 	elseif change_password then
 		run_in_transaction( function()
 			user = user.reload()
@@ -152,4 +168,6 @@
 	return user
 end
 
+User.name_regex = regex "^[a-zA-Z0-9_-]+$"
+
 return User