--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/lib/User.luan	Tue Jul 08 15:55:34 2025 -0600
@@ -0,0 +1,129 @@
+local Luan = require "luan:Luan.luan"
+local error = Luan.error
+local range = Luan.range or error()
+local to_string = Luan.to_string or error()
+local get_local_only = Luan.get_local_only or error()
+local set_local_only = Luan.set_local_only or error()
+local String = require "luan:String.luan"
+local sub_string = String.sub or error()
+local Math = require "luan:Math.luan"
+local random = Math.random or error()
+local Table = require "luan:Table.luan"
+local concat = Table.concat or error()
+local Http = require "luan:http/Http.luan"
+local Lucene = require "luan:lucene/Lucene.luan"
+local lucene_quote = Lucene.quote or error()
+local Db = require "site:/lib/Db.luan"
+local run_in_transaction = Db.run_in_transaction or error()
+local Utils = require "site:/lib/Utils.luan"
+local base_url = Utils.base_url or error()
+
+
+local User = {}
+
+local function from_doc(doc)
+	doc.type == "user" or error "wrong type"
+	return User.new {
+		id = doc.id
+		email = doc.user_email
+		password = doc.password
+	}
+end
+
+local function to_doc(user)
+	return {
+		type = "user"
+		id = user.id
+		user_email = user.email or error()
+		password = user.password or error()
+	}
+end
+
+function User.new(user)
+
+	function user.save()
+		local doc = to_doc(user)
+		Db.save(doc)
+		user.id = doc.id
+	end
+
+	function user.login()
+		local id = to_string(user.id)
+		Http.response.set_persistent_cookie("user",id)
+		Http.response.set_persistent_cookie("password",user.password)
+		Http.request.cookies.user = id
+		Http.request.cookies.password = user.password or error()
+	end
+
+	function user.login_url()
+		return base_url().."/do_login.html?user="..user.id.."&password="..user.password
+	end
+
+	return user
+end
+
+local function get_by_id(id)
+	local doc = Db.get_document("id:"..id)
+	return doc and doc.type=="user" and from_doc(doc) or nil
+end
+User.get_by_id = get_by_id
+
+local password_chars = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+do
+	local t = {}
+	for i in range(1,#password_chars) do
+		t[#t+1] = sub_string(password_chars,i,i)
+	end
+	password_chars = t
+end	
+
+local function new_password()
+	local n = #password_chars
+	local t = {}
+	for _ in range(1,10) do
+		t[#t+1] = password_chars[random(n)]
+	end
+	return concat(t)
+end
+
+local function get_by_email(email)
+	local doc = Db.get_document("user_email:"..lucene_quote(email))
+	return doc and from_doc(doc)
+end
+-- User.get_by_email = get_by_email
+
+function User.get_or_create_by_email(email)
+	return run_in_transaction( function()
+		local user = get_by_email(email)
+		if user == nil then
+			user = User.new{
+				email = email
+				password = new_password()
+				notify_email = email
+			}
+			user.save()
+		end
+		return user
+	end )
+end
+
+local function current()
+	local user = get_local_only(User,"current")
+	if user == nil then
+		local id = Http.request.cookies.user
+		local password = Http.request.cookies.password
+		if id == nil or password == nil then
+			user = "nil"
+		else
+			user = get_by_id(id)
+			if user == nil or user.password ~= password then
+				user = "nil"
+			end
+		end
+		set_local_only(User,"current",user)
+	end
+	return user ~= "nil" and user or nil
+end
+User.current = current
+
+return User