20 files changed, 353 insertions, 388 deletions

diff --git a/src/web/_controller/_index.php b/src/web/_controller/_index.php
deleted file mode 100644
index 2fd7db2..0000000
--- a/src/web/_controller/_index.php
+++ /dev/null
@@ -1,23 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class _index_controller extends Controller {
-
-	// the home model
-	private $home_model;
-
-	// the request model
-	private $request_model;
-
-	// the caceh model
-	private $cache_model;
-
-	public function index(): void {
-		if ($this->main->session) {
-			$this->redirect('/home');
-		} else {
-			$this->redirect('/auth/login');
-		}
-	}
-
-}
-
-?>
diff --git a/src/web/_controller/_meta.php b/src/web/_controller/_meta.php
index bec3c65..06c7c0a 100644
--- a/src/web/_controller/_meta.php
+++ b/src/web/_controller/_meta.php
@@ -1,21 +1,21 @@
 <?php /* Copyright (c) 2024 Freya Murphy */
-class _meta_controller extends Controller {
+class _meta_controller extends XSS_Controller {
 
 	public function manifest(): void {
 
 		$json = array(
-			'short_name' => 'xssbook.com',
-			'name' => 'xssbook.com',
+			'short_name' => CONFIG['domain'],
+			'name' => CONFIG['domain'],
 			'icons' => [
 				array(
-					'src' => 'https://xssbook.com/public/icons/logo512.png',
+					'src' => $this->get_url('public/icons/logo512.png'),
 					'type' => 'image/png',
 					'sizes' => '512x512',
 					'purpose' => 'any maskable'
 				)
 			],
-			'id' => 'https://xssbook.com/home',
-			'start_url' => 'https://xssbook.com/home',
+			'id' => $this->get_url('home'),
+			'start_url' => $this->get_url('home'),
 			'background_color' => '#181818',
 			'display' => 'standalone',
 			'scope' => '/',
diff --git a/src/web/_controller/_modal.php b/src/web/_controller/_modal.php
new file mode 100644
index 0000000..0447ca8
--- /dev/null
+++ b/src/web/_controller/_modal.php
@@ -0,0 +1,28 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class _modal_controller extends XSS_Controller {
+
+	/**
+	 * @param string $name
+	 * @param array $data
+	*/
+	private function modal($name): void {
+		$data = $this->model->get_data();
+		$data['title'] = ucwords(lang($name . '_modal_title'));
+		$data['content'] = $name;
+		$this->view('_template/modal', $data);
+	}
+
+	public function new_post(): void {
+		$this->load_lang('post');
+		$this->modal('new_post');
+	}
+
+	public function about(): void {
+		$this->modal('about');
+	}
+
+	public function register(): void {
+		$this->load_lang('auth');
+		$this->modal('register');
+	}
+}
diff --git a/src/web/_controller/_util/post.php b/src/web/_controller/_post.php
index 5346497..56c997f 100644
--- a/src/web/_controller/_util/post.php
+++ b/src/web/_controller/_post.php
@@ -1,30 +1,22 @@
 <?php /* Copyright (c) 2024 Freya Murphy */
-class Post_controller extends Controller {
+class _post_controller extends XSS_Controller {
 
-	// the request model
-	private $request_model;
+	private $auth_model;
 
-	// the caceh model
-	private $cache_model;
-
-	// page size
-	private $page_size;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->request_model = $this->load->model('request');
-		$this->cache_model = $this->load->model('cache');
-		$this->page_size = 10;
+	function __construct() {
+		parent::__construct();
+		$this->auth_model = $this->load_model('auth');
+		$this->load_lang('post');
 	}
 
 	public function index(): void {
-		$this->view('template/posts');
+		$this->view('_template/posts');
 	}
 
 	public function post(): void {
-		$pid = $this->request_model->get_int('id', 0);
+		$pid = $this->get_int('id', 0);
 
-		$post = $this->db
+		$post = $this->db()
 			->select('p.*, l.id as like_id')
 			->from('api.post p')
 			->join('api.like l', 'p.id = l.post_id AND l.user_id')
@@ -33,42 +25,37 @@ class Post_controller extends Controller {
 			->eq($pid)
 			->row();
 
-		if (!$post) {
+		if (!$post)
 			return;
-		}
 
-		$users = $this->cache_model->get_users([$post]);
+		$users = $this->model->get_users([$post]);
 		$uid = $post['user_id'];
 
-		if (!array_key_exists($uid, $users)) {
+		if (!isset($users[$uid]))
 			return;
-		}
 
 		$user = $users[$uid];
 
-		$data = array(
-			'user' => $user,
-			'page_size' => $this->page_size,
-			'post' => $post
-		);
-		$this->view('template/post', $data);
+		$data = $this->model->get_data();
+		$data['user'] = $user;
+		$data['page_size'] = POST_PAGE_SIZE;
+		$data['post'] = $post;
+		$this->view('_template/post', $data);
 	}
 
     /**
      * @return array<string,mixed>
      */
     public function posts(): array {
-		$page = $this->request_model->get_int('page', 0);
-		$max = $this->request_model->get_int('max');
-		$offset = $page * $this->page_size;
-		$filter_uid = $this->request_model->get_int('user_id', FALSE);
+		$page = $this->get_int('page', 0);
+		$max = $this->get_int('max');
+		$offset = $page * POST_PAGE_SIZE;
+		$filter_uid = $this->get_int('user_id', FALSE);
 
-		$user = $this->main->user();
+		$user = $this->auth_model->session();
 		$uid = isset($user) ? $user['id'] : NULL;
 
-		$query = $this->db;
-
-		$query = $this->db
+		$query = $this->db()
 			->select('p.*, l.id as like_id')
 			->from('api.post p')
 			->join('api.like l', 'p.id = l.post_id AND l.user_id')
@@ -86,23 +73,23 @@ class Post_controller extends Controller {
 
 		$posts = $query
 			->order_by('p.id', 'DESC')
-			->limit($this->page_size)
+			->limit(POST_PAGE_SIZE)
 			->offset($offset)
 			->rows();
 
-		$users = $this->cache_model->get_users($posts);
+		$users = $this->model->get_users($posts);
 		$max = 0;
 
 		foreach ($posts as $post) {
 			$max = max($max, $post['id']);
-			$data = array();
-			$data['page_size'] = $this->page_size;
+			$data = $this->model->get_data();
+			$data['page_size'] = POST_PAGE_SIZE;
 			$data['user'] = $users[$post['user_id']];
 			$data['post'] = $post;
-			$this->view('template/post', $data);
+			$this->view('_template/post', $data);
 		}
 
-		$query = $this->db
+		$query = $this->db()
 			->select('COUNT(p.id) as pc')
 			->from('api.post p');
 
@@ -117,16 +104,17 @@ class Post_controller extends Controller {
 		return array(
 			'loaded' => count($posts),
 			'total' => $pc,
-			'page_size' => $this->page_size,
+			'page_size' => POST_PAGE_SIZE,
+
 			'max' => $max,
 			'filter_uid' => $filter_uid
 		);
 	}
 
 	public function comment(): void {
-		$cid = $this->request_model->get_int('id', 0);
+		$cid = $this->get_int('id', 0);
 
-		$comment = $this->db
+		$comment = $this->db()
 			->select('*')
 			->from('api.comment')
 			->where('id')
@@ -137,7 +125,7 @@ class Post_controller extends Controller {
 			return;
 		}
 
-		$users = $this->cache_model->get_users([$comment]);
+		$users = $this->model->get_users([$comment]);
 		$uid = $comment['user_id'];
 
 		if (!array_key_exists($uid, $users)) {
@@ -146,23 +134,24 @@ class Post_controller extends Controller {
 
 		$user = $users[$uid];
 
-		$data = array(
-			'user' => $user,
-			'comment' => $comment
-		);
-		$this->view('template/comment', $data);
+		$data = $this->model->get_data();
+		$data['user'] = $user;
+		$data['comment'] = $comment;
+		$this->view('_template/comment', $data);
 	}
 
     /**
      * @return array<string,mixed>
      */
     public function comments(): array {
-		$page = $this->request_model->get_int('page', 0);
-		$max = $this->request_model->get_int('max');
-		$id = $this->request_model->get_int('id', 0);
-		$offset = $page * $this->page_size;
+		$page = $this->get_int('page', 0);
+		$max = $this->get_int('max');
+		$id = $this->get_int('id', 0);
+		$offset = $page * COMMENT_PAGE_SIZE;
+
+		$user = $this->auth_model->session();
 
-		$query = $this->db
+		$query = $this->db()
 			->select('*')
 			->from('api.comment')
 			->where('post_id')
@@ -177,11 +166,11 @@ class Post_controller extends Controller {
 
 		$comments = $query
 			->order_by('id', 'ASC')
-			->limit($this->page_size)
+			->limit(COMMENT_PAGE_SIZE)
 			->offset($offset)
 			->rows();
 
-		$users = $this->cache_model->get_users($comments);
+		$users = $this->model->get_users($comments);
 		$max = 0;
 
 		// only add this hr when not logged in
@@ -190,22 +179,22 @@ class Post_controller extends Controller {
 		if (
 			count($comments) &&
 				$page == 0 &&
-				$this->main->session === NULL
+				$user === NULL
 		) {
 			echo '<hr>';
 		}
 
 		foreach ($comments as $comment) {
 			$max = max($max, $comment['id']);
-			$data = array();
+			$data = $this->model->get_data();
 			$data['user'] = $users[$comment['user_id']];
 			$data['comment'] = $comment;
-			$this->view('template/comment', $data);
+			$this->view('_template/comment', $data);
 		}
 
 		return array(
 			'loaded' => count($comments),
-			'page_size' => $this->page_size,
+			'page_size' => COMMENT_PAGE_SIZE,
 			'max' => $max,
 		);
 	}
diff --git a/src/web/_controller/_template.php b/src/web/_controller/_template.php
new file mode 100644
index 0000000..9c82956
--- /dev/null
+++ b/src/web/_controller/_template.php
@@ -0,0 +1,21 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class _template_controller extends XSS_Controller {
+
+	public function toast(): void {
+		$msg = $this->get_string('msg') ?? '';
+		$detail = $this->get_string('detail');
+		$hint = $this->get_string('hint');
+		$type = $this->get_string('type', 'error');
+
+		$data = array(
+			'msg' => $msg,
+			'detail' => $detail,
+			'hint' => $hint,
+			'type' => $type,
+		);
+
+		$this->view('_template/toast', $data);
+	}
+
+}
+
diff --git a/src/web/_controller/apps/auth.php b/src/web/_controller/apps/auth.php
deleted file mode 100644
index 1df74da..0000000
--- a/src/web/_controller/apps/auth.php
+++ /dev/null
@@ -1,56 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Auth_controller extends Controller {
-
-	// the home model
-	private $auth_model;
-
-	// the post controller
-	protected $post_controller;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->auth_model = $this->load->model('apps/auth');
-	}
-
-	public function index(): void {
-		if ($this->main->session) {
-			$this->redirect('/home');
-		} else {
-			$this->redirect('/auth/login');
-		}
-	}
-
-	public function login(): void {
-		if ($this->main->session) {
-			$this->redirect('/home');
-		}
-
-		parent::index();
-		$data = $this->auth_model->get_data();
-		$this->view('head', $data);
-		$this->view('apps/auth/login', $data);
-		$this->view('footer', $data);
-	}
-
-	public function logout(): void {
-		if ($this->main->session) {
-			$_SESSION['jwt'] = NULL;
-		}
-		$this->redirect('/auth/login');
-	}
-
-	public function update(): void {
-		if (!$this->is_ajax()) {
-			$this->error(400);
-		}
-		if (!isset($_POST['key']) || !isset($_POST['value'])) {
-			$this->error(400);
-		}
-		$key = $_POST['key'];
-		$value = $_POST['value'];
-		$_SESSION[$key] = $value;
-	}
-
-}
-
-?>
diff --git a/src/web/_controller/apps/error.php b/src/web/_controller/apps/error.php
deleted file mode 100644
index 03bbd8d..0000000
--- a/src/web/_controller/apps/error.php
+++ /dev/null
@@ -1,21 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Error_controller extends Controller {
-
-	private $error_model;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->error_model = $this->load->model('apps/error');
-	}
-
-	public function index(): void {
-		parent::index();
-		$data = $this->error_model->get_data();
-		$this->view('header', $data);
-		$this->view('apps/error/main', $data);
-		$this->view('footer', $data);
-	}
-
-}
-
-?>
diff --git a/src/web/_controller/apps/home.php b/src/web/_controller/apps/home.php
deleted file mode 100644
index c9a116d..0000000
--- a/src/web/_controller/apps/home.php
+++ /dev/null
@@ -1,26 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Home_controller extends Controller {
-
-	// the home model
-	private $home_model;
-
-	// the post controller
-	protected $post_controller;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->home_model = $this->load->model('apps/home');
-		$this->post_controller = $this->load->controller('_util/post');
-	}
-
-	public function index(): void {
-		parent::index();
-		$data = $this->home_model->get_data();
-		$this->view('header', $data);
-		$this->view('apps/home/main', $data);
-		$this->view('footer', $data);
-	}
-
-}
-
-?>
diff --git a/src/web/_controller/apps/people.php b/src/web/_controller/apps/people.php
deleted file mode 100644
index 86da3b3..0000000
--- a/src/web/_controller/apps/people.php
+++ /dev/null
@@ -1,48 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class People_controller extends Controller {
-
-	// the people model
-	private $people_model;
-
-	// format model
-	protected $format_model;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->people_model = $this->load->model('apps/people');
-		$this->format_model = $this->load->model('format');
-	}
-
-	public function index(): void {
-		parent::index();
-		$data = $this->people_model->get_data();
-		$this->view('header', $data);
-		$this->view('apps/people/header', $data);
-		$this->view('apps/people/main', $data);
-		$this->view('apps/people/footer', $data);
-		$this->view('footer', $data);
-	}
-
-	public function content(): void {
-		$data = $this->people_model->get_data();
-		$this->view('apps/people/main', $data);
-	}
-
-    /**
-     * @return array<string,mixed>
-     */
-    public function people(): array {
-		$data = $this->people_model->get_users();
-
-		$this->view('apps/people/people', $data);
-
-		$max = 0;
-		foreach ($data['users'] as $user) {
-			$max = max($max, $user['id']);
-		}
-
-		return $data;
-	}
-}
-
-?>
diff --git a/src/web/_controller/apps/profile.php b/src/web/_controller/apps/profile.php
deleted file mode 100644
index 9e9fca6..0000000
--- a/src/web/_controller/apps/profile.php
+++ /dev/null
@@ -1,44 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Profile_controller extends Controller {
-
-	// the home model
-	private $profile_model;
-
-	// the format model
-	protected $format_model;
-
-	// the post controller
-	protected $post_controller;
-
-	// the people controller
-	protected $people_controller;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->profile_model = $this->load->model('apps/profile');
-		$this->people_controller = $this->load->controller('apps/people');
-		$this->format_model = $this->load->model('format');
-		$this->post_controller = $this->load->controller('_util/post');
-	}
-
-	public function index(): void {
-
-		if ($this->main->user() && !isset($_GET['id'])) {
-			$this->redirect('/profile?id=' . $this->main->user()['id']);
-		}
-
-		parent::index();
-		$data = $this->profile_model->get_data();
-
-		if (!$data) {
-			$this->error(404);
-		}
-
-		$this->view('header', $data);
-		$this->view('apps/profile/main', $data);
-		$this->view('footer', $data);
-	}
-
-}
-
-?>
diff --git a/src/web/_controller/apps/settings.php b/src/web/_controller/apps/settings.php
deleted file mode 100644
index 8a409cc..0000000
--- a/src/web/_controller/apps/settings.php
+++ /dev/null
@@ -1,41 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Settings_controller extends Controller {
-
-	// the home model
-	private $settings_model;
-
-	// the format model
-	protected $format_model;
-
-	// the post controller
-	protected $post_controller;
-
-	// the people controller
-	protected $people_controller;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->settings_model = $this->load->model('apps/settings');
-	}
-
-	public function index(): void {
-		if (!$this->main->session) {
-			$this->redirect('/auth/login');
-		}
-
-		parent::index();
-		$data = $this->settings_model->get_data();
-
-		if (!$data) {
-			$this->error(404);
-		}
-
-		$this->load->app_lang($this->main->info['lang'], 'auth');
-		$this->view('header', $data);
-		$this->view('apps/settings/main', $data);
-		$this->view('footer', $data);
-	}
-
-}
-
-?>
diff --git a/src/web/_controller/auth.php b/src/web/_controller/auth.php
new file mode 100644
index 0000000..fd1931c
--- /dev/null
+++ b/src/web/_controller/auth.php
@@ -0,0 +1,45 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class Auth_controller extends XSS_Controller {
+
+	private $auth_model;
+
+	function __construct() {
+		parent::__construct();
+		$this->auth_model = $this->load_model('auth');
+		$this->load_lang('auth');
+	}
+
+	public function index(): void {
+		$this->load_controller('index')->index();
+	}
+
+	public function login(): void {
+		if ($this->auth_model->session())
+			$this->redirect('/home');
+
+		parent::index();
+		$data = $this->auth_model->get_data();
+		$this->view('head', $data);
+		$this->view('auth/main', $data);
+		$this->view('footer', $data);
+	}
+
+	public function logout(): void {
+		if ($this->auth_model->session())
+			$_SESSION['jwt'] = NULL;
+		$this->redirect('/auth/login');
+	}
+
+	public function update(): void {
+		$key = $this->post_data('key');
+		$value = $this->post_data('value');
+
+		if (!$key || !$value)
+			$this->error(400);
+
+		$_SESSION[$key] = $value;
+	}
+
+}
+
+?>
diff --git a/src/web/_controller/error.php b/src/web/_controller/error.php
new file mode 100644
index 0000000..55034ba
--- /dev/null
+++ b/src/web/_controller/error.php
@@ -0,0 +1,36 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class Error_controller extends XSS_Controller {
+
+	private $error_model;
+
+	function __construct() {
+		parent::__construct();
+		$this->error_model = $this->load_model('error');
+	}
+
+	public function index(): void {
+		$this->code(404);
+	}
+
+	public function code($code): void {
+		parent::index();
+
+		$code = intval($code);
+		if ($code == 404 && rand(0, 100) > 95)
+			$code = 451;
+		if (!is_valid_status_code($code))
+			$code = 404;
+		$msg = status_code_msg($code);
+
+		$data = $this->error_model->get_data();
+		$data['title'] = $code;
+		$data['msg'] = $msg;
+
+		$this->view('header', $data);
+		$this->view('error/main', $data);
+		$this->view('footer', $data);
+	}
+
+}
+
+?>
diff --git a/src/web/_controller/home.php b/src/web/_controller/home.php
new file mode 100644
index 0000000..dc9da4d
--- /dev/null
+++ b/src/web/_controller/home.php
@@ -0,0 +1,27 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class Home_controller extends XSS_Controller {
+
+	// the home model
+	protected $home_model;
+
+	// the post controller
+	protected $post_controller;
+
+	function __construct() {
+		parent::__construct();
+		$this->home_model = $this->load_model('home');
+		$this->post_controller = $this->load_controller('_post');
+		$this->load_lang('post', 'home');
+	}
+
+	public function index(): void {
+		parent::index();
+		$data = $this->home_model->get_data();
+		$this->view('header', $data);
+		$this->view('home/main', $data);
+		$this->view('footer', $data);
+	}
+
+}
+
+?>
diff --git a/src/web/_controller/index.php b/src/web/_controller/index.php
new file mode 100644
index 0000000..0822a22
--- /dev/null
+++ b/src/web/_controller/index.php
@@ -0,0 +1,16 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class Index_controller extends XSS_Controller {
+
+	public function index(): void {
+		$auth_model = $this->load_model('auth');
+		$session = $auth_model->session();
+
+		$home = $this->get_url('home');
+		$login = $this->get_url('auth/login');
+
+		$this->redirect($session ? $home : $login);
+	}
+
+}
+
+?>
diff --git a/src/web/_controller/modal.php b/src/web/_controller/modal.php
deleted file mode 100644
index da17cca..0000000
--- a/src/web/_controller/modal.php
+++ /dev/null
@@ -1,38 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Modal_controller extends Controller {
-
-
-	function __construct($load) {
-		parent::__construct($load);
-	}
-
-    /**
-	 * @param string $name
-	 * @param array $data
-     */
-    private function modal($name, $data = array()): void {
-		$title = ucwords(lang($name . '_modal_title'));
-		$data['title'] = $title;
-		$data['content'] = $name;
-		$this->view('template/modal', $data);
-	}
-
-	public function new_post(): void {
-		$this->modal('new_post');
-	}
-
-	public function about(): void {
-		$this->modal('about');
-	}
-
-	public function register(): void {
-		$this->load->app_lang(
-			$this->main->info['lang'],
-			'auth'
-		);
-		$this->modal('register');
-	}
-}
-
-?>
-
diff --git a/src/web/_controller/people.php b/src/web/_controller/people.php
new file mode 100644
index 0000000..bb2db2c
--- /dev/null
+++ b/src/web/_controller/people.php
@@ -0,0 +1,45 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class People_controller extends XSS_Controller {
+
+	// the people model
+	private $people_model;
+
+	function __construct() {
+		parent::__construct();
+		$this->people_model = $this->load_model('people');
+		$this->load_lang('people');
+	}
+
+	public function index(): void {
+		parent::index();
+		$data = $this->people_model->get_data();
+		$this->view('header', $data);
+		$this->view('people/header', $data);
+		$this->view('people/main', $data);
+		$this->view('people/footer', $data);
+		$this->view('footer', $data);
+	}
+
+	public function content(): void {
+		$data = $this->people_model->get_data();
+		$this->view('people/main', $data);
+	}
+
+	/**
+	 * @return array<string,mixed>
+	 */
+	public function people(): array {
+		$data = $this->people_model->get_people();
+
+		$this->view('people/people', $data);
+
+		$max = 0;
+		foreach ($data['users'] as $user) {
+			$max = max($max, $user['id']);
+		}
+
+		return $data;
+	}
+}
+
+?>
diff --git a/src/web/_controller/profile.php b/src/web/_controller/profile.php
new file mode 100644
index 0000000..dd02ed2
--- /dev/null
+++ b/src/web/_controller/profile.php
@@ -0,0 +1,44 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class Profile_controller extends XSS_Controller {
+
+	// the profile model
+	private $profile_model;
+
+	// the post controller
+	protected $post_controller;
+
+	// the people controller
+	protected $people_controller;
+
+	function __construct() {
+		parent::__construct();
+		$this->profile_model = $this->load_model('profile');
+		$this->people_controller = $this->load_controller('people');
+		$this->post_controller = $this->load_controller('_post');
+		$this->load_lang('profile');
+	}
+
+	public function index(): void {
+		$id = $this->get_int('id');
+
+		parent::index();
+		$data = $this->profile_model->get_data();
+
+		// profile does not exist
+		if (!$data) {
+			// not logged in and trying to access own profile
+			if (!$id)
+				$this->redirect('/auth/login');
+			// directly accessing unknown user id => 404
+			else
+				$this->error(404);
+		}
+
+		$this->view('header', $data);
+		$this->view('profile/main', $data);
+		$this->view('footer', $data);
+	}
+
+}
+
+?>
diff --git a/src/web/_controller/settings.php b/src/web/_controller/settings.php
new file mode 100644
index 0000000..e42389f
--- /dev/null
+++ b/src/web/_controller/settings.php
@@ -0,0 +1,34 @@
+<?php /* Copyright (c) 2024 Freya Murphy */
+class Settings_controller extends XSS_Controller {
+
+	// the settings model
+	private $settings_model;
+
+	// the auth model
+	private $auth_model;
+
+	function __construct() {
+		parent::__construct();
+		$this->settings_model = $this->load_model('settings');
+		$this->auth_model = $this->load_model('auth');
+		$this->load_lang('auth', 'settings');
+	}
+
+	public function index(): void {
+		if (!$this->auth_model->session())
+			$this->redirect('/auth/login');
+
+		parent::index();
+		$data = $this->settings_model->get_data();
+
+		if (!$data)
+			$this->error(404);
+
+		$this->view('header', $data);
+		$this->view('settings/main', $data);
+		$this->view('footer', $data);
+	}
+
+}
+
+?>
diff --git a/src/web/_controller/template.php b/src/web/_controller/template.php
deleted file mode 100644
index 879eadc..0000000
--- a/src/web/_controller/template.php
+++ /dev/null
@@ -1,23 +0,0 @@
-<?php /* Copyright (c) 2024 Freya Murphy */
-class Template_controller extends Controller {
-
-	// the request model
-	private $request_model;
-
-	function __construct($load) {
-		parent::__construct($load);
-		$this->request_model = $this->load->model('request');
-	}
-
-	public function toast(): void {
-		$data = array(
-			'msg' => $this->request_model->get_str('msg', FALSE),
-			'detail' => $this->request_model->get_str('detail', FALSE),
-			'hint' => $this->request_model->get_str('hint', FALSE),
-			'type' => $this->request_model->get_str('type', 'error')
-		);
-		$this->view('template/toast', $data);
-	}
-
-}
-