Basic features done

.gitignore

@@ -10,3 +10,5 @@ app.db
 # os
 .DS_Store
 Thumbs.db
+app.db-wal
+server

api/handlers.go

@@ -0,0 +1,589 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"html/template"
+	"log"
+	"net/http"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"sprintpadawan/lib"
+)
+
+type PingResponse struct {
+	Status  string `json:"status"`
+	Message string `json:"message"`
+}
+
+var templates *template.Template
+
+type contextKey string
+
+const userKey contextKey = "user"
+
+type sseClient struct {
+	ch     chan string
+	userID int
+}
+
+var (
+	// roomClients maps roomID → list of connected SSE clients
+	roomClients = make(map[int][]*sseClient)
+	clientsMu   sync.Mutex
+)
+
+func addSSEClient(roomID, userID int, ch chan string) {
+	clientsMu.Lock()
+	defer clientsMu.Unlock()
+	roomClients[roomID] = append(roomClients[roomID], &sseClient{ch: ch, userID: userID})
+}
+
+func removeSSEClient(roomID int, ch chan string) {
+	clientsMu.Lock()
+	defer clientsMu.Unlock()
+	clients := roomClients[roomID]
+	for i, c := range clients {
+		if c.ch == ch {
+			roomClients[roomID] = append(clients[:i], clients[i+1:]...)
+			break
+		}
+	}
+	if len(roomClients[roomID]) == 0 {
+		delete(roomClients, roomID)
+	}
+}
+
+func broadcast(roomID int, message string) {
+	clientsMu.Lock()
+	defer clientsMu.Unlock()
+	alive := roomClients[roomID][:0]
+	for _, c := range roomClients[roomID] {
+		select {
+		case c.ch <- message:
+			alive = append(alive, c)
+		default:
+			// drop dead client
+		}
+	}
+	roomClients[roomID] = alive
+}
+
+// GetConnectedUserIDs returns deduplicated user IDs connected to a room
+func GetConnectedUserIDs(roomID int) []int {
+	clientsMu.Lock()
+	defer clientsMu.Unlock()
+	seen := make(map[int]bool)
+	var ids []int
+	for _, c := range roomClients[roomID] {
+		if !seen[c.userID] {
+			seen[c.userID] = true
+			ids = append(ids, c.userID)
+		}
+	}
+	return ids
+}
+
+func init() {
+	templates = template.Must(template.New("").Funcs(template.FuncMap{
+		"scaleToOptions": scaleToOptions,
+		"derefInt": func(i *int) int {
+			if i == nil {
+				return 0
+			}
+			return *i
+		},
+	}).ParseGlob(filepath.Join("templates", "*.html")))
+}
+
+func scaleToOptions(scale string) []string {
+	switch scale {
+	case "fibonacci":
+		return []string{"1", "2", "3", "5", "8", "13", "21", "?"}
+	case "tshirt":
+		return []string{"XS", "S", "M", "L", "XL", "XXL", "?"}
+	case "linear":
+		return []string{"1", "2", "3", "4", "5", "6", "7", "8", "9", "10", "?"}
+	default:
+		return []string{"1", "2", "3", "5", "8", "13", "21", "?"}
+	}
+}
+
+func SetupRoutes(mux *http.ServeMux) {
+	mux.HandleFunc("/login", handleLogin)
+	mux.HandleFunc("/register", handleRegister)
+	mux.HandleFunc("/logout", handleLogout)
+
+	mux.HandleFunc("/", requireAuth(handleIndex))
+	mux.HandleFunc("/rooms/new", requireAuth(handleNewRoom))
+	mux.HandleFunc("/rooms/create", requireAuth(handleCreateRoom))
+	mux.HandleFunc("/rooms/join", requireAuth(handleJoinRoom))
+	mux.HandleFunc("/rooms/{id}", requireAuth(handleRoom))
+	mux.HandleFunc("/rooms/{id}/stories/new", requireAuth(handleNewStoryForm))
+	mux.HandleFunc("/rooms/{id}/stories", requireAuth(handleAddStory))
+	mux.HandleFunc("/rooms/{id}/active", requireAuth(handleSetActiveStory))
+	mux.HandleFunc("/rooms/{id}/vote", requireAuth(handleVote))
+	mux.HandleFunc("/rooms/{id}/reveal", requireAuth(handleReveal))
+	mux.HandleFunc("/rooms/{id}/stories/{story_id}/edit", requireAuth(handleEditStoryForm))
+	mux.HandleFunc("/rooms/{id}/stories/{story_id}/rename", requireAuth(handleRenameStory))
+	mux.HandleFunc("/rooms/{id}/stories/{story_id}/delete", requireAuth(handleDeleteStory))
+	mux.HandleFunc("/rooms/{id}/stories/{story_id}/unreveal", requireAuth(handleUnrevealStory))
+	mux.HandleFunc("/sse/{room_id}", requireAuth(handleSSE))
+}
+
+func requireAuth(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		cookie, err := r.Cookie("session_token")
+		if err != nil {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		user, err := lib.GetUserFromSession(cookie.Value)
+		if err != nil || user == nil {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		ctx := context.WithValue(r.Context(), userKey, user)
+		next.ServeHTTP(w, r.WithContext(ctx))
+	}
+}
+
+// isLoggedIn checks if the request has a valid session
+func isLoggedIn(r *http.Request) bool {
+	cookie, err := r.Cookie("session_token")
+	if err != nil {
+		return false
+	}
+	user, err := lib.GetUserFromSession(cookie.Value)
+	return err == nil && user != nil
+}
+
+func handleLogin(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet {
+		if isLoggedIn(r) {
+			http.Redirect(w, r, "/", http.StatusSeeOther)
+			return
+		}
+		templates.ExecuteTemplate(w, "login.html", nil)
+		return
+	}
+
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+
+	user, err := lib.GetUserByUsername(username)
+	if err != nil || !lib.CheckPasswordHash(password, user.PasswordHash) {
+		templates.ExecuteTemplate(w, "login.html", map[string]string{"Error": "Invalid credentials"})
+		return
+	}
+
+	sessionID, _ := lib.CreateSession(user.ID)
+	http.SetCookie(w, &http.Cookie{
+		Name:     "session_token",
+		Value:    sessionID,
+		Expires:  time.Now().Add(24 * time.Hour),
+		HttpOnly: true,
+		Path:     "/",
+	})
+
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func handleRegister(w http.ResponseWriter, r *http.Request) {
+	if r.Method == http.MethodGet {
+		if isLoggedIn(r) {
+			http.Redirect(w, r, "/", http.StatusSeeOther)
+			return
+		}
+		templates.ExecuteTemplate(w, "register.html", nil)
+		return
+	}
+
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+	confirm := r.FormValue("confirm_password")
+
+	if password != confirm {
+		templates.ExecuteTemplate(w, "register.html", map[string]string{"Error": "Passwords do not match"})
+		return
+	}
+
+	err := lib.CreateUser(username, password)
+	if err != nil {
+		templates.ExecuteTemplate(w, "register.html", map[string]string{"Error": "Username taken"})
+		return
+	}
+
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}
+
+func handleLogout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session_token")
+	if err == nil {
+		lib.DeleteSession(cookie.Value)
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:    "session_token",
+		Value:   "",
+		Expires: time.Now().Add(-1 * time.Hour),
+		Path:    "/",
+	})
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}
+
+func handleIndex(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path != "/" {
+		http.NotFound(w, r)
+		return
+	}
+	user := r.Context().Value(userKey).(*lib.User)
+	rooms, _ := lib.GetRoomsForUser(user.ID)
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	type RoomView struct {
+		ID         int
+		Name       string
+		Code       string
+		Scale      string
+		IsOwner   bool
+		MemberCount int
+	}
+	data := struct {
+		*lib.User
+		Rooms []RoomView
+	}{
+		User: user,
+	}
+	for _, room := range rooms {
+		members, _ := lib.GetRoomMembers(room.ID)
+		data.Rooms = append(data.Rooms, RoomView{
+			ID:          room.ID,
+			Name:        room.Name,
+			Code:       room.Code,
+			Scale:      room.Scale,
+			IsOwner:    room.OwnerID == user.ID,
+			MemberCount: len(members),
+		})
+	}
+	if err := templates.ExecuteTemplate(w, "index.html", data); err != nil {
+		log.Printf("template error: %v", err)
+		http.Error(w, "internal server error", http.StatusInternalServerError)
+	}
+}
+
+func handleNewRoom(w http.ResponseWriter, r *http.Request) {
+	if err := templates.ExecuteTemplate(w, "room_form.html", nil); err != nil {
+		log.Printf("template error: %v", err)
+	}
+}
+
+func handleCreateRoom(w http.ResponseWriter, r *http.Request) {
+	user := r.Context().Value(userKey).(*lib.User)
+	name := r.FormValue("name")
+	scale := r.FormValue("scale")
+	room, err := lib.CreateRoom(name, user.ID, scale)
+	if err != nil {
+		log.Printf("create room error: %v", err)
+		http.Error(w, "failed to create room", http.StatusInternalServerError)
+		return
+	}
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", room.ID), http.StatusSeeOther)
+}
+
+func handleJoinRoom(w http.ResponseWriter, r *http.Request) {
+	user := r.Context().Value(userKey).(*lib.User)
+	code := r.FormValue("code")
+	room, err := lib.GetRoomByCode(code)
+	if err != nil {
+		http.Error(w, "room not found", http.StatusNotFound)
+		return
+	}
+	lib.AddUserToRoom(room.ID, user.ID)
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", room.ID), http.StatusSeeOther)
+}
+
+func handleRoom(w http.ResponseWriter, r *http.Request) {
+	user := r.Context().Value(userKey).(*lib.User)
+	var id int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	room, err := lib.GetRoomByID(id)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+	lib.AddUserToRoom(room.ID, user.ID)
+	members, _ := lib.GetRoomMembers(room.ID)
+	stories, _ := lib.GetStoriesForRoom(room.ID)
+
+	// Add HasVoted logic
+	type MemberView struct {
+		Username string
+		HasVoted bool
+	}
+
+	var activeVotes []lib.Vote
+	if room.ActiveStoryID != nil {
+		activeVotes, _ = lib.GetVotesForStory(*room.ActiveStoryID)
+	}
+
+	// Filter to only connected members
+	connectedIDs := GetConnectedUserIDs(room.ID)
+	connectedMap := make(map[int]bool)
+	for _, cid := range connectedIDs {
+		connectedMap[cid] = true
+	}
+	// The current user loading the page will immediately connect to SSE
+	connectedMap[user.ID] = true
+
+	var memberViews []MemberView
+	for _, m := range members {
+		// Only include connected users
+		if !connectedMap[m.ID] {
+			continue
+		}
+		
+		hasVoted := false
+		for _, v := range activeVotes {
+			if v.UserID == m.ID {
+				hasVoted = true
+				break
+			}
+		}
+		memberViews = append(memberViews, MemberView{
+			Username: m.Username,
+			HasVoted: hasVoted,
+		})
+	}
+
+	userVotes := make(map[int]string)
+	storyVotes := make(map[int][]lib.VoteView)
+	for _, s := range stories {
+		votes, _ := lib.GetVotesForStory(s.ID)
+		for _, v := range votes {
+			if v.UserID == user.ID {
+				userVotes[s.ID] = v.Value
+			}
+		}
+		// For revealed stories, get votes with usernames
+		if s.Voted {
+			vv, _ := lib.GetVotesWithUsernames(s.ID)
+			storyVotes[s.ID] = vv
+		}
+	}
+
+	data := struct {
+		*lib.Room
+		User       *lib.User
+		Members    []MemberView
+		Stories    []lib.Story
+		IsOwner    bool
+		UserVotes  map[int]string
+		StoryVotes map[int][]lib.VoteView
+	}{
+		Room:       room,
+		User:       user,
+		Members:    memberViews,
+		Stories:    stories,
+		IsOwner:    room.OwnerID == user.ID,
+		UserVotes:  userVotes,
+		StoryVotes: storyVotes,
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	if err := templates.ExecuteTemplate(w, "room.html", data); err != nil {
+		log.Printf("template error: %v", err)
+	}
+}
+
+func handleNewStoryForm(w http.ResponseWriter, r *http.Request) {
+    var id int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	room, _ := lib.GetRoomByID(id)
+	if err := templates.ExecuteTemplate(w, "story_form.html", room); err != nil {
+		log.Printf("template error: %v", err)
+	}
+}
+
+func handleAddStory(w http.ResponseWriter, r *http.Request) {
+	var id int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	title := r.FormValue("title")
+	_, err := lib.CreateStory(id, title)
+	if err != nil {
+		log.Printf("create story error: %v", err)
+	}
+	broadcast(id, "refresh")
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", id), http.StatusSeeOther)
+}
+
+func handleSetActiveStory(w http.ResponseWriter, r *http.Request) {
+	var id int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	storyID := r.FormValue("story_id")
+	var sid int
+	fmt.Sscanf(storyID, "%d", &sid)
+
+	// Get the current room to find old active story
+	room, _ := lib.GetRoomByID(id)
+
+	// Unreveal and clear votes on the old active story (if any)
+	if room.ActiveStoryID != nil {
+		lib.UnrevealStory(*room.ActiveStoryID)
+		lib.ClearVotesForStory(*room.ActiveStoryID)
+	}
+
+	// Unreveal and clear votes on the new active story
+	lib.UnrevealStory(sid)
+	lib.ClearVotesForStory(sid)
+
+	// Set the new active story
+	lib.SetActiveStory(id, sid)
+
+	broadcast(id, "refresh")
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", id), http.StatusSeeOther)
+}
+
+func handleVote(w http.ResponseWriter, r *http.Request) {
+	var id int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	user := r.Context().Value(userKey).(*lib.User)
+	value := r.FormValue("value")
+	storyID := r.FormValue("story_id")
+	var sid int
+	fmt.Sscanf(storyID, "%d", &sid)
+	lib.VoteOnStory(sid, user.ID, value)
+	broadcast(id, "members") // Updates member panel with checkmarks
+
+	if r.Header.Get("HX-Request") == "true" {
+		room, _ := lib.GetRoomByID(id)
+		stories, _ := lib.GetStoriesForRoom(id)
+		var st lib.Story
+		for _, s := range stories {
+			if s.ID == sid {
+				st = s
+				break
+			}
+		}
+		tmplData := struct {
+			RoomID   int
+			Story    lib.Story
+			Scale    string
+			UserVote string
+		}{
+			RoomID:   id,
+			Story:    st,
+			Scale:    room.Scale,
+			UserVote: value,
+		}
+		templates.ExecuteTemplate(w, "vote_form.html", tmplData)
+		return
+	}
+
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", id), http.StatusSeeOther)
+}
+
+func handleReveal(w http.ResponseWriter, r *http.Request) {
+	var id int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	storyID := r.FormValue("story_id")
+	var sid int
+	fmt.Sscanf(storyID, "%d", &sid)
+	lib.RevealVotes(sid)
+	broadcast(id, "refresh")
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", id), http.StatusSeeOther)
+}
+
+func handleUnrevealStory(w http.ResponseWriter, r *http.Request) {
+	var id, sid int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	fmt.Sscanf(r.PathValue("story_id"), "%d", &sid)
+	lib.UnrevealStory(sid)
+	broadcast(id, "refresh")
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", id), http.StatusSeeOther)
+}
+
+func handleEditStoryForm(w http.ResponseWriter, r *http.Request) {
+	var id, sid int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	fmt.Sscanf(r.PathValue("story_id"), "%d", &sid)
+	stories, _ := lib.GetStoriesForRoom(id)
+	var story lib.Story
+	for _, s := range stories {
+		if s.ID == sid {
+			story = s
+			break
+		}
+	}
+	tmplData := struct {
+		RoomID int
+		Story  lib.Story
+	}{
+		RoomID: id,
+		Story:  story,
+	}
+	if err := templates.ExecuteTemplate(w, "story_edit.html", tmplData); err != nil {
+		log.Printf("template error: %v", err)
+	}
+}
+
+func handleRenameStory(w http.ResponseWriter, r *http.Request) {
+	var id, sid int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	fmt.Sscanf(r.PathValue("story_id"), "%d", &sid)
+	title := r.FormValue("title")
+	lib.RenameStory(sid, title)
+	broadcast(id, "refresh")
+	http.Redirect(w, r, fmt.Sprintf("/rooms/%d", id), http.StatusSeeOther)
+}
+
+func handleDeleteStory(w http.ResponseWriter, r *http.Request) {
+	var id, sid int
+	fmt.Sscanf(r.PathValue("id"), "%d", &id)
+	fmt.Sscanf(r.PathValue("story_id"), "%d", &sid)
+	lib.DeleteStory(sid)
+	broadcast(id, "refresh")
+	// Return empty HTML so the story-card is removed from the DOM
+	w.Header().Set("Content-Type", "text/html")
+	w.Write([]byte(""))
+}
+
+func handleSSE(w http.ResponseWriter, r *http.Request) {
+	var roomID int
+	fmt.Sscanf(r.PathValue("room_id"), "%d", &roomID)
+
+	user, ok := r.Context().Value(userKey).(*lib.User)
+	if !ok {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+
+	ch := make(chan string, 10)
+	addSSEClient(roomID, user.ID, ch)
+
+	// Broadcast members to other clients so they see the new member
+	go broadcast(roomID, "members")
+
+	w.Header().Set("Content-Type", "text/event-stream")
+	w.Header().Set("Cache-Control", "no-cache")
+	w.Header().Set("Connection", "keep-alive")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+
+	flusher, ok := w.(http.Flusher)
+	if !ok {
+		return
+	}
+
+	notify := r.Context().Done()
+	for {
+		select {
+		case <-notify:
+			removeSSEClient(roomID, ch)
+			// Broadcast members so others see member leave
+			go broadcast(roomID, "members")
+			return
+		case msg := <-ch:
+			fmt.Fprintf(w, "event: room-%d\ndata: %s\n\n", roomID, msg)
+			flusher.Flush()
+		}
+	}
+}

go.mod

@@ -3,7 +3,13 @@ module sprintpadawan
 go 1.26.1
 
 require (
-	github.com/google/uuid v1.6.0 // indirect
+	github.com/google/uuid v1.6.0
-	github.com/mattn/go-sqlite3 v1.14.42 // indirect
+	golang.org/x/crypto v0.50.0
-	golang.org/x/crypto v0.50.0 // indirect
+	turso.tech/database/tursogo v0.5.3
+)
+
+require (
+	github.com/ebitengine/purego v0.9.1 // indirect
+	github.com/tursodatabase/turso-go-platform-libs v0.5.3 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 )

go.sum

@@ -1,6 +1,20 @@
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/ebitengine/purego v0.9.1 h1:a/k2f2HQU3Pi399RPW1MOaZyhKJL9w/xFpKAg4q1s0A=
+github.com/ebitengine/purego v0.9.1/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/mattn/go-sqlite3 v1.14.42 h1:MigqEP4ZmHw3aIdIT7T+9TLa90Z6smwcthx+Azv4Cgo=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/mattn/go-sqlite3 v1.14.42/go.mod h1:pjEuOr8IwzLJP2MfGeTb0A35jauH+C2kbHKBr7yXKVQ=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tursodatabase/turso-go-platform-libs v0.5.3 h1:JvlE+vC2IbyVrxlAVuPoBKvDCQF9hX4c17amhthNqSg=
+github.com/tursodatabase/turso-go-platform-libs v0.5.3/go.mod h1:bo+Lpv5OYOX1gRV9L5DLKMsYxmDs56SkZwnCOLEFcxU=
 golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
 golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+turso.tech/database/tursogo v0.5.3 h1:ICh0AtACo8aVxPj/wsqCnT8Erl/WkNYuhy59/L5RDTI=
+turso.tech/database/tursogo v0.5.3/go.mod h1:JjsqX4S3fT1arHjqKuiuGxhJQE+VlYboU5YVqHOjy6s=

lib/db.go

@@ -3,25 +3,16 @@ package lib
 import (
 	"database/sql"
 	"log"
-	"time"
 
-	"github.com/google/uuid"
+	_ "turso.tech/database/tursogo"
-	_ "github.com/mattn/go-sqlite3"
-	"golang.org/x/crypto/bcrypt"
 )
 
 var DB *sql.DB
 
-type User struct {
-	ID           int
-	Username     string
-	PasswordHash string
-}
-
 // init sqlite db — always creates app.db at project root (run from root)
 func InitDB() {
 	var err error
-	DB, err = sql.Open("sqlite3", "./app.db")
+	DB, err = sql.Open("turso", "app.db")
 	if err != nil {
 		log.Fatal(err)
 	}
@@ -50,72 +41,66 @@ func InitDB() {
 	if err != nil {
 		log.Fatal(err)
 	}
-}
 
-// hash password
+	// make rooms table
-func HashPassword(password string) (string, error) {
+	roomTable := `
-	bytes, err := bcrypt.GenerateFromPassword([]byte(password), 14)
+	CREATE TABLE IF NOT EXISTS rooms (
-	return string(bytes), err
+		id INTEGER PRIMARY KEY AUTOINCREMENT,
-}
+		name TEXT NOT NULL,
-
+		code TEXT UNIQUE NOT NULL,
-// check password
+		scale TEXT NOT NULL DEFAULT 'fibonacci',
-func CheckPasswordHash(password, hash string) bool {
+		owner_id INTEGER NOT NULL,
-	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+		created_at DATETIME NOT NULL,
-	return err == nil
+		active_story_id INTEGER,
-}
+		FOREIGN KEY(owner_id) REFERENCES users(id)
-
+	);`
-// create new user
+	_, err = DB.Exec(roomTable)
-func CreateUser(username, password string) error {
-	hash, err := HashPassword(password)
 	if err != nil {
-		return err
+		log.Fatal(err)
-	}
-	_, err = DB.Exec("INSERT INTO users (username, password_hash) VALUES (?, ?)", username, hash)
-	return err
 	}
 
-// get user by name
+	// make room_members table
-func GetUserByUsername(username string) (*User, error) {
+	memberTable := `
-	row := DB.QueryRow("SELECT id, username, password_hash FROM users WHERE username = ?", username)
+	CREATE TABLE IF NOT EXISTS room_members (
-	u := &User{}
+		room_id INTEGER NOT NULL,
-	err := row.Scan(&u.ID, &u.Username, &u.PasswordHash)
+		user_id INTEGER NOT NULL,
+		joined_at DATETIME NOT NULL,
+		PRIMARY KEY (room_id, user_id),
+		FOREIGN KEY(room_id) REFERENCES rooms(id),
+		FOREIGN KEY(user_id) REFERENCES users(id)
+	);`
+	_, err = DB.Exec(memberTable)
 	if err != nil {
-		return nil, err
+		log.Fatal(err)
-	}
-	return u, nil
 	}
 
-// create session token
+	// make stories table
-func CreateSession(userID int) (string, error) {
+	storyTable := `
-	sessionID := uuid.New().String()
+	CREATE TABLE IF NOT EXISTS stories (
-	expiresAt := time.Now().Add(24 * time.Hour)
+		id INTEGER PRIMARY KEY AUTOINCREMENT,
-
+		room_id INTEGER NOT NULL,
-	_, err := DB.Exec("INSERT INTO sessions (id, user_id, expires_at) VALUES (?, ?, ?)", sessionID, userID, expiresAt)
+		title TEXT NOT NULL,
+		points INTEGER,
+		voted INTEGER NOT NULL DEFAULT 0,
+		FOREIGN KEY(room_id) REFERENCES rooms(id)
+	);`
+	_, err = DB.Exec(storyTable)
 	if err != nil {
-		return "", err
+		log.Fatal(err)
-	}
-	return sessionID, nil
 	}
 
-// get user from session
+	// make votes table
-func GetUserFromSession(sessionID string) (*User, error) {
+	voteTable := `
-	row := DB.QueryRow(`
+	CREATE TABLE IF NOT EXISTS votes (
-		SELECT u.id, u.username, u.password_hash
+		story_id INTEGER NOT NULL,
-		FROM users u
+		user_id INTEGER NOT NULL,
-		JOIN sessions s ON u.id = s.user_id
+		value TEXT NOT NULL,
-		WHERE s.id = ? AND s.expires_at > ?
+		PRIMARY KEY (story_id, user_id),
-	`, sessionID, time.Now())
+		FOREIGN KEY(story_id) REFERENCES stories(id),
-
+		FOREIGN KEY(user_id) REFERENCES users(id)
-	u := &User{}
+	);`
-	err := row.Scan(&u.ID, &u.Username, &u.PasswordHash)
+	_, err = DB.Exec(voteTable)
 	if err != nil {
-		return nil, err
+		log.Fatal(err)
 	}
-	return u, nil
-}
-
-// delete session
-func DeleteSession(sessionID string) error {
-	_, err := DB.Exec("DELETE FROM sessions WHERE id = ?", sessionID)
-	return err
 }

lib/room.go

@@ -0,0 +1,131 @@
+package lib
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+)
+
+type Room struct {
+	ID            int
+	Name          string
+	Code          string
+	Scale         string
+	OwnerID       int
+	CreatedAt     time.Time
+	ActiveStoryID *int
+}
+
+type RoomMember struct {
+	RoomID   int
+	UserID   int
+	JoinedAt time.Time
+}
+
+// generate unique room code
+func generateRoomCode() string {
+	code := uuid.New().String()[:8]
+	return code
+}
+
+// create room
+func CreateRoom(name string, ownerID int, scale string) (*Room, error) {
+	code := generateRoomCode()
+	_, err := DB.Exec("INSERT INTO rooms (name, code, scale, owner_id, created_at, active_story_id) VALUES (?, ?, ?, ?, ?, NULL)", name, code, scale, ownerID, time.Now())
+	if err != nil {
+		return nil, err
+	}
+	room := &Room{Name: name, Code: code, Scale: scale, OwnerID: ownerID, ActiveStoryID: nil}
+	row := DB.QueryRow("SELECT id, name, code, scale, owner_id, created_at, active_story_id FROM rooms WHERE code = ?", code)
+	err = row.Scan(&room.ID, &room.Name, &room.Code, &room.Scale, &room.OwnerID, &room.CreatedAt, &room.ActiveStoryID)
+	if err != nil {
+		return nil, err
+	}
+	// add owner as member
+	DB.Exec("INSERT INTO room_members (room_id, user_id, joined_at) VALUES (?, ?, ?)", room.ID, ownerID, time.Now())
+	return room, nil
+}
+
+// get room by id
+func GetRoomByID(id int) (*Room, error) {
+	row := DB.QueryRow("SELECT id, name, code, scale, owner_id, created_at, active_story_id FROM rooms WHERE id = ?", id)
+	r := &Room{}
+	err := row.Scan(&r.ID, &r.Name, &r.Code, &r.Scale, &r.OwnerID, &r.CreatedAt, &r.ActiveStoryID)
+	if err != nil {
+		return nil, err
+	}
+	return r, nil
+}
+
+// get room by code
+func GetRoomByCode(code string) (*Room, error) {
+	row := DB.QueryRow("SELECT id, name, code, scale, owner_id, created_at, active_story_id FROM rooms WHERE code = ?", code)
+	r := &Room{}
+	err := row.Scan(&r.ID, &r.Name, &r.Code, &r.Scale, &r.OwnerID, &r.CreatedAt, &r.ActiveStoryID)
+	if err != nil {
+		return nil, err
+	}
+	return r, nil
+}
+
+// get rooms for user
+func GetRoomsForUser(userID int) ([]Room, error) {
+	rows, err := DB.Query(`
+		SELECT r.id, r.name, r.code, r.scale, r.owner_id, r.created_at, r.active_story_id, COUNT(rm.user_id) as member_count
+		FROM rooms r
+		LEFT JOIN room_members rm ON r.id = rm.room_id
+		WHERE r.owner_id = ?
+		GROUP BY r.id
+	`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var rooms []Room
+	for rows.Next() {
+		var r Room
+		var memberCount int
+		err := rows.Scan(&r.ID, &r.Name, &r.Code, &r.Scale, &r.OwnerID, &r.CreatedAt, &r.ActiveStoryID, &memberCount)
+		if err != nil {
+			return nil, err
+		}
+		rooms = append(rooms, r)
+	}
+	return rooms, nil
+}
+
+// set active story for room
+func SetActiveStory(roomID, storyID int) error {
+	_, err := DB.Exec("UPDATE rooms SET active_story_id = ? WHERE id = ?", storyID, roomID)
+	return err
+}
+
+// add user to room
+func AddUserToRoom(roomID, userID int) error {
+	_, err := DB.Exec("INSERT OR IGNORE INTO room_members (room_id, user_id, joined_at) VALUES (?, ?, ?)", roomID, userID, time.Now())
+	return err
+}
+
+// get room members
+func GetRoomMembers(roomID int) ([]User, error) {
+	rows, err := DB.Query(`
+		SELECT u.id, u.username, u.password_hash
+		FROM users u
+		JOIN room_members rm ON u.id = rm.user_id
+		WHERE rm.room_id = ?
+	`, roomID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var members []User
+	for rows.Next() {
+		var u User
+		err := rows.Scan(&u.ID, &u.Username, &u.PasswordHash)
+		if err != nil {
+			return nil, err
+		}
+		members = append(members, u)
+	}
+	return members, nil
+}

lib/story.go

@@ -0,0 +1,170 @@
+package lib
+
+import (
+	"database/sql"
+	"fmt"
+)
+
+type Story struct {
+	ID        int
+	RoomID    int
+	Title     string
+	Points    *int
+	Voted     bool
+}
+
+type Vote struct {
+	ID      int
+	StoryID int
+	UserID  int
+	Value   string
+}
+
+// create story
+func CreateStory(roomID int, title string) (*Story, error) {
+	_, err := DB.Exec("INSERT INTO stories (room_id, title, voted) VALUES (?, ?, 0)", roomID, title)
+	if err != nil {
+		return nil, err
+	}
+	s := &Story{RoomID: roomID, Title: title}
+	row := DB.QueryRow("SELECT id, room_id, title, points, voted FROM stories WHERE room_id = ? ORDER BY id DESC LIMIT 1", roomID)
+	err = row.Scan(&s.ID, &s.RoomID, &s.Title, &s.Points, &s.Voted)
+	return s, err
+}
+
+// get stories for room
+func GetStoriesForRoom(roomID int) ([]Story, error) {
+	rows, err := DB.Query("SELECT id, room_id, title, points, voted FROM stories WHERE room_id = ? ORDER BY id", roomID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var stories []Story
+	for rows.Next() {
+		var s Story
+		var points sql.NullInt64
+		var voted int
+		err := rows.Scan(&s.ID, &s.RoomID, &s.Title, &points, &voted)
+		if err != nil {
+			return nil, err
+		}
+		if points.Valid {
+			p := int(points.Int64)
+			s.Points = &p
+		}
+		s.Voted = voted == 1
+		stories = append(stories, s)
+	}
+	return stories, nil
+}
+
+// vote on story
+func VoteOnStory(storyID, userID int, value string) error {
+	_, err := DB.Exec("INSERT OR REPLACE INTO votes (story_id, user_id, value) VALUES (?, ?, ?)", storyID, userID, value)
+	return err
+}
+
+// get votes for story
+func GetVotesForStory(storyID int) ([]Vote, error) {
+	rows, err := DB.Query("SELECT story_id, user_id, value FROM votes WHERE story_id = ?", storyID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var votes []Vote
+	for rows.Next() {
+		var v Vote
+		err := rows.Scan(&v.StoryID, &v.UserID, &v.Value)
+		if err != nil {
+			return nil, err
+		}
+		votes = append(votes, v)
+	}
+	return votes, nil
+}
+
+// reveal votes — just marks the story as revealed
+func RevealVotes(storyID int) error {
+	_, err := DB.Exec("UPDATE stories SET voted = 1 WHERE id = ?", storyID)
+	return err
+}
+
+type VoteView struct {
+	Username string
+	Value    string
+}
+
+// get votes with usernames for display
+func GetVotesWithUsernames(storyID int) ([]VoteView, error) {
+	rows, err := DB.Query(`
+		SELECT u.username, v.value
+		FROM votes v
+		JOIN users u ON v.user_id = u.id
+		WHERE v.story_id = ?
+	`, storyID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var views []VoteView
+	for rows.Next() {
+		var vv VoteView
+		err := rows.Scan(&vv.Username, &vv.Value)
+		if err != nil {
+			return nil, err
+		}
+		views = append(views, vv)
+	}
+	return views, nil
+}
+
+// unreveal story — set voted back to 0 and clear points
+func UnrevealStory(storyID int) error {
+	_, err := DB.Exec("UPDATE stories SET voted = 0, points = NULL WHERE id = ?", storyID)
+	return err
+}
+
+// clear all votes for a story
+func ClearVotesForStory(storyID int) error {
+	_, err := DB.Exec("DELETE FROM votes WHERE story_id = ?", storyID)
+	return err
+}
+
+// rename story
+func RenameStory(storyID int, title string) error {
+	_, err := DB.Exec("UPDATE stories SET title = ? WHERE id = ?", title, storyID)
+	return err
+}
+
+// delete story and its votes
+func DeleteStory(storyID int) error {
+	_, err := DB.Exec("DELETE FROM votes WHERE story_id = ?", storyID)
+	if err != nil {
+		return err
+	}
+	_, err = DB.Exec("DELETE FROM stories WHERE id = ?", storyID)
+	return err
+}
+
+func tshirtToPoints(s string) float64 {
+	switch s {
+	case "XS":
+		return 1
+	case "S":
+		return 3
+	case "M":
+		return 5
+	case "L":
+		return 8
+	case "XL":
+		return 13
+	case "XXL":
+		return 21
+	case "?":
+		return 0
+	default:
+		var n int
+		fmt.Sscanf(s, "%d", &n)
+		return float64(n)
+	}
+}

lib/user.go

@@ -0,0 +1,82 @@
+package lib
+
+import (
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/bcrypt"
+)
+
+type User struct {
+	ID           int
+	Username     string
+	PasswordHash string
+}
+
+// hash password
+func HashPassword(password string) (string, error) {
+	bytes, err := bcrypt.GenerateFromPassword([]byte(password), 14)
+	return string(bytes), err
+}
+
+// check password
+func CheckPasswordHash(password, hash string) bool {
+	err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password))
+	return err == nil
+}
+
+// create new user
+func CreateUser(username, password string) error {
+	hash, err := HashPassword(password)
+	if err != nil {
+		return err
+	}
+	_, err = DB.Exec("INSERT INTO users (username, password_hash) VALUES (?, ?)", username, hash)
+	return err
+}
+
+// get user by name
+func GetUserByUsername(username string) (*User, error) {
+	row := DB.QueryRow("SELECT id, username, password_hash FROM users WHERE username = ?", username)
+	u := &User{}
+	err := row.Scan(&u.ID, &u.Username, &u.PasswordHash)
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+// create session token
+func CreateSession(userID int) (string, error) {
+	sessionID := uuid.New().String()
+	expiresAt := time.Now().Add(24 * time.Hour)
+
+	_, err := DB.Exec("INSERT INTO sessions (id, user_id, expires_at) VALUES (?, ?, ?)", sessionID, userID, expiresAt)
+	if err != nil {
+		return "", err
+	}
+	return sessionID, nil
+}
+
+// get user from session
+func GetUserFromSession(sessionID string) (*User, error) {
+	row := DB.QueryRow(`
+		SELECT u.id, u.username, u.password_hash
+		FROM users u
+		JOIN sessions s ON u.id = s.user_id
+		WHERE s.id = ? AND s.expires_at > ?
+	`, sessionID, time.Now())
+
+	u := &User{}
+	err := row.Scan(&u.ID, &u.Username, &u.PasswordHash)
+	if err != nil {
+		return nil, err
+	}
+	return u, nil
+}
+
+// delete session
+func DeleteSession(sessionID string) error {
+	_, err := DB.Exec("DELETE FROM sessions WHERE id = ?", sessionID)
+	return err
+}

main.go

@@ -1,51 +1,22 @@
 package main
 
 import (
-	"context"
-	"encoding/json"
-	"html/template"
 	"log"
 	"net/http"
-	"path/filepath"
-	"time"
 
+	"sprintpadawan/api"
 	"sprintpadawan/lib"
 )
 
-type PingResponse struct {
-	Status  string `json:"status"`
-	Message string `json:"message"`
-}
-
-var templates *template.Template
-
-type contextKey string
-
-const userKey contextKey = "user"
-
 func main() {
 	lib.InitDB()
 
-	var err error
-	templates, err = template.ParseGlob(filepath.Join("templates", "*.html"))
-	if err != nil {
-		log.Fatalf("failed to parse templates: %v", err)
-	}
-
 	mux := http.NewServeMux()
 
 	// serve static assets
 	mux.Handle("/static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
 
-	// public routes
+	api.SetupRoutes(mux)
-	mux.HandleFunc("/login", handleLogin)
-	mux.HandleFunc("/register", handleRegister)
-	mux.HandleFunc("/logout", handleLogout)
-
-	// private routes
-	mux.HandleFunc("/", requireAuth(handleIndex))
-	mux.HandleFunc("/api/ping", requireAuth(handlePing))
-	mux.HandleFunc("/api/ping-partial", requireAuth(handlePingPartial))
 
 	addr := ":8080"
 	log.Printf("Starting SprintPadawan server on http://localhost%s", addr)
@@ -53,114 +24,3 @@ func main() {
 		log.Fatalf("server error: %v", err)
 	}
 }
-
-func requireAuth(next http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		cookie, err := r.Cookie("session_token")
-		if err != nil {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
-			return
-		}
-		user, err := lib.GetUserFromSession(cookie.Value)
-		if err != nil || user == nil {
-			http.Redirect(w, r, "/login", http.StatusSeeOther)
-			return
-		}
-		ctx := context.WithValue(r.Context(), userKey, user)
-		next.ServeHTTP(w, r.WithContext(ctx))
-	}
-}
-
-func handleLogin(w http.ResponseWriter, r *http.Request) {
-	if r.Method == http.MethodGet {
-		templates.ExecuteTemplate(w, "login.html", nil)
-		return
-	}
-
-	username := r.FormValue("username")
-	password := r.FormValue("password")
-
-	user, err := lib.GetUserByUsername(username)
-	if err != nil || !lib.CheckPasswordHash(password, user.PasswordHash) {
-		templates.ExecuteTemplate(w, "login.html", map[string]string{"Error": "Invalid credentials"})
-		return
-	}
-
-	sessionID, _ := lib.CreateSession(user.ID)
-	http.SetCookie(w, &http.Cookie{
-		Name:     "session_token",
-		Value:    sessionID,
-		Expires:  time.Now().Add(24 * time.Hour),
-		HttpOnly: true,
-		Path:     "/",
-	})
-
-	http.Redirect(w, r, "/", http.StatusSeeOther)
-}
-
-func handleRegister(w http.ResponseWriter, r *http.Request) {
-	if r.Method == http.MethodGet {
-		templates.ExecuteTemplate(w, "register.html", nil)
-		return
-	}
-
-	username := r.FormValue("username")
-	password := r.FormValue("password")
-	confirm := r.FormValue("confirm_password")
-
-	if password != confirm {
-		templates.ExecuteTemplate(w, "register.html", map[string]string{"Error": "Passwords do not match"})
-		return
-	}
-
-	err := lib.CreateUser(username, password)
-	if err != nil {
-		templates.ExecuteTemplate(w, "register.html", map[string]string{"Error": "Username taken"})
-		return
-	}
-
-	http.Redirect(w, r, "/login", http.StatusSeeOther)
-}
-
-func handleLogout(w http.ResponseWriter, r *http.Request) {
-	cookie, err := r.Cookie("session_token")
-	if err == nil {
-		lib.DeleteSession(cookie.Value)
-	}
-	http.SetCookie(w, &http.Cookie{
-		Name:    "session_token",
-		Value:   "",
-		Expires: time.Now().Add(-1 * time.Hour),
-		Path:    "/",
-	})
-	http.Redirect(w, r, "/login", http.StatusSeeOther)
-}
-
-func handleIndex(w http.ResponseWriter, r *http.Request) {
-	if r.URL.Path != "/" {
-		http.NotFound(w, r)
-		return
-	}
-	user := r.Context().Value(userKey).(*lib.User)
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := templates.ExecuteTemplate(w, "index.html", user); err != nil {
-		log.Printf("template error: %v", err)
-		http.Error(w, "internal server error", http.StatusInternalServerError)
-	}
-}
-
-func handlePing(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "application/json")
-	resp := PingResponse{Status: "ok", Message: "pong"}
-	if err := json.NewEncoder(w).Encode(resp); err != nil {
-		log.Printf("json encode error: %v", err)
-	}
-}
-
-func handlePingPartial(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := templates.ExecuteTemplate(w, "ping_result.html", PingResponse{Status: "ok", Message: "pong"}); err != nil {
-		log.Printf("template error: %v", err)
-		http.Error(w, "internal server error", http.StatusInternalServerError)
-	}
-}

static/js/sse.js

@@ -0,0 +1,290 @@
+/*
+Server Sent Events Extension
+============================
+This extension adds support for Server Sent Events to htmx.  See /www/extensions/sse.md for usage instructions.
+
+*/
+
+(function () {
+    /** @type {import("../htmx").HtmxInternalApi} */
+    var api
+
+    htmx.defineExtension('sse', {
+
+        /**
+         * Init saves the provided reference to the internal HTMX API.
+         *
+         * @param {import("../htmx").HtmxInternalApi} api
+         * @returns void
+         */
+        init: function (apiRef) {
+            // store a reference to the internal API.
+            api = apiRef
+
+            // set a function in the public API for creating new EventSource objects
+            if (htmx.createEventSource == undefined) {
+                htmx.createEventSource = createEventSource
+            }
+        },
+
+        getSelectors: function () {
+            return ['[sse-connect]', '[data-sse-connect]', '[sse-swap]', '[data-sse-swap]']
+        },
+
+        /**
+         * onEvent handles all events passed to this extension.
+         *
+         * @param {string} name
+         * @param {Event} evt
+         * @returns void
+         */
+        onEvent: function (name, evt) {
+            var parent = evt.target || evt.detail.elt
+            switch (name) {
+                case 'htmx:beforeCleanupElement':
+                    var internalData = api.getInternalData(parent)
+                    // Try to remove remove an EventSource when elements are removed
+                    var source = internalData.sseEventSource
+                    if (source) {
+                        api.triggerEvent(parent, 'htmx:sseClose', {
+                            source,
+                            type: 'nodeReplaced',
+                        })
+                        internalData.sseEventSource.close()
+                    }
+
+                    return
+
+                // Try to create EventSources when elements are processed
+                case 'htmx:afterProcessNode':
+                    ensureEventSourceOnElement(parent)
+            }
+        }
+    })
+
+    /// ////////////////////////////////////////////
+    // HELPER FUNCTIONS
+    /// ////////////////////////////////////////////
+
+    /**
+     * createEventSource is the default method for creating new EventSource objects.
+     * it is hoisted into htmx.config.createEventSource to be overridden by the user, if needed.
+     *
+     * @param {string} url
+     * @returns EventSource
+     */
+    function createEventSource(url) {
+        return new EventSource(url, { withCredentials: true })
+    }
+
+    /**
+     * registerSSE looks for attributes that can contain sse events, right
+     * now hx-trigger and sse-swap and adds listeners based on these attributes too
+     * the closest event source
+     *
+     * @param {HTMLElement} elt
+     */
+    function registerSSE(elt) {
+        // Add message handlers for every `sse-swap` attribute
+        if (api.getAttributeValue(elt, 'sse-swap')) {
+            // Find closest existing event source
+            var sourceElement = api.getClosestMatch(elt, hasEventSource)
+            if (sourceElement == null) {
+                // api.triggerErrorEvent(elt, "htmx:noSSESourceError")
+                return null // no eventsource in parentage, orphaned element
+            }
+
+            // Set internalData and source
+            var internalData = api.getInternalData(sourceElement)
+            var source = internalData.sseEventSource
+
+            var sseSwapAttr = api.getAttributeValue(elt, 'sse-swap')
+            var sseEventNames = sseSwapAttr.split(',')
+
+            for (var i = 0; i < sseEventNames.length; i++) {
+                const sseEventName = sseEventNames[i].trim()
+                const listener = function (event) {
+                    // If the source is missing then close SSE
+                    if (maybeCloseSSESource(sourceElement)) {
+                        return
+                    }
+
+                    // If the body no longer contains the element, remove the listener
+                    if (!api.bodyContains(elt)) {
+                        source.removeEventListener(sseEventName, listener)
+                        return
+                    }
+
+                    // swap the response into the DOM and trigger a notification
+                    if (!api.triggerEvent(elt, 'htmx:sseBeforeMessage', event)) {
+                        return
+                    }
+                    swap(elt, event.data)
+                    api.triggerEvent(elt, 'htmx:sseMessage', event)
+                }
+
+                // Register the new listener
+                api.getInternalData(elt).sseEventListener = listener
+                source.addEventListener(sseEventName, listener)
+            }
+        }
+
+        // Add message handlers for every `hx-trigger="sse:*"` attribute
+        if (api.getAttributeValue(elt, 'hx-trigger')) {
+            // Find closest existing event source
+            var sourceElement = api.getClosestMatch(elt, hasEventSource)
+            if (sourceElement == null) {
+                // api.triggerErrorEvent(elt, "htmx:noSSESourceError")
+                return null // no eventsource in parentage, orphaned element
+            }
+
+            // Set internalData and source
+            var internalData = api.getInternalData(sourceElement)
+            var source = internalData.sseEventSource
+
+            var triggerSpecs = api.getTriggerSpecs(elt)
+            triggerSpecs.forEach(function (ts) {
+                if (ts.trigger.slice(0, 4) !== 'sse:') {
+                    return
+                }
+
+                var listener = function (event) {
+                    if (maybeCloseSSESource(sourceElement)) {
+                        return
+                    }
+                    if (!api.bodyContains(elt)) {
+                        source.removeEventListener(ts.trigger.slice(4), listener)
+                    }
+                    // Trigger events to be handled by the rest of htmx
+                    htmx.trigger(elt, ts.trigger, event)
+                    htmx.trigger(elt, 'htmx:sseMessage', event)
+                }
+
+                // Register the new listener
+                api.getInternalData(elt).sseEventListener = listener
+                source.addEventListener(ts.trigger.slice(4), listener)
+            })
+        }
+    }
+
+    /**
+     * ensureEventSourceOnElement creates a new EventSource connection on the provided element.
+     * If a usable EventSource already exists, then it is returned.  If not, then a new EventSource
+     * is created and stored in the element's internalData.
+     * @param {HTMLElement} elt
+     * @param {number} retryCount
+     * @returns {EventSource | null}
+     */
+    function ensureEventSourceOnElement(elt, retryCount) {
+        if (elt == null) {
+            return null
+        }
+
+        // handle extension source creation attribute
+        if (api.getAttributeValue(elt, 'sse-connect')) {
+            var sseURL = api.getAttributeValue(elt, 'sse-connect')
+            if (sseURL == null) {
+                return
+            }
+
+            ensureEventSource(elt, sseURL, retryCount)
+        }
+
+        registerSSE(elt)
+    }
+
+    function ensureEventSource(elt, url, retryCount) {
+        var source = htmx.createEventSource(url)
+
+        source.onerror = function (err) {
+            // Log an error event
+            api.triggerErrorEvent(elt, 'htmx:sseError', { error: err, source })
+
+            // If parent no longer exists in the document, then clean up this EventSource
+            if (maybeCloseSSESource(elt)) {
+                return
+            }
+
+            // Otherwise, try to reconnect the EventSource
+            if (source.readyState === EventSource.CLOSED) {
+                retryCount = retryCount || 0
+                retryCount = Math.max(Math.min(retryCount * 2, 128), 1)
+                var timeout = retryCount * 500
+                window.setTimeout(function () {
+                    ensureEventSourceOnElement(elt, retryCount)
+                }, timeout)
+            }
+        }
+
+        source.onopen = function (evt) {
+            api.triggerEvent(elt, 'htmx:sseOpen', { source })
+
+            if (retryCount && retryCount > 0) {
+                const childrenToFix = elt.querySelectorAll("[sse-swap], [data-sse-swap], [hx-trigger], [data-hx-trigger]")
+                for (let i = 0; i < childrenToFix.length; i++) {
+                    registerSSE(childrenToFix[i])
+                }
+                // We want to increase the reconnection delay for consecutive failed attempts only
+                retryCount = 0
+            }
+        }
+
+        api.getInternalData(elt).sseEventSource = source
+
+
+        var closeAttribute = api.getAttributeValue(elt, "sse-close");
+        if (closeAttribute) {
+            // close eventsource when this message is received
+            source.addEventListener(closeAttribute, function () {
+                api.triggerEvent(elt, 'htmx:sseClose', {
+                    source,
+                    type: 'message',
+                })
+                source.close()
+            });
+        }
+    }
+
+    /**
+     * maybeCloseSSESource confirms that the parent element still exists.
+     * If not, then any associated SSE source is closed and the function returns true.
+     *
+     * @param {HTMLElement} elt
+     * @returns boolean
+     */
+    function maybeCloseSSESource(elt) {
+        if (!api.bodyContains(elt)) {
+            var source = api.getInternalData(elt).sseEventSource
+            if (source != undefined) {
+                api.triggerEvent(elt, 'htmx:sseClose', {
+                    source,
+                    type: 'nodeMissing',
+                })
+                source.close()
+                // source = null
+                return true
+            }
+        }
+        return false
+    }
+
+
+    /**
+     * @param {HTMLElement} elt
+     * @param {string} content
+     */
+    function swap(elt, content) {
+        api.withExtensions(elt, function (extension) {
+            content = extension.transformResponse(content, null, elt)
+        })
+
+        var swapSpec = api.getSwapSpecification(elt)
+        var target = api.getTarget(elt)
+        api.swap(target, content, swapSpec)
+    }
+
+
+    function hasEventSource(node) {
+        return api.getInternalData(node).sseEventSource != null
+    }
+})()

static/styles/main.css

@@ -838,33 +838,502 @@ footer a:hover {
     color: var(--text-primary);
 }
 
+/* rooms grid */
+.rooms-grid {
+    display: grid;
+    grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+    gap: 1rem;
+}
+
+.room-card {
+    display: block;
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-lg);
+    padding: 1.25rem 1.5rem;
+    text-decoration: none;
+    transition: all 0.15s;
+    position: relative;
+}
+
+.room-card:hover {
+    background: var(--bg-surface-hover);
+    border-color: var(--border-accent);
+    transform: translateY(-2px);
+}
+
+.room-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: flex-start;
+    margin-bottom: 0.75rem;
+}
+
+.room-name {
+    font-size: 1.1rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.room-code {
+    font-family: var(--font-mono);
+    font-size: 0.75rem;
+    color: var(--accent);
+    background: rgba(139, 92, 246, 0.12);
+    padding: 0.2rem 0.5rem;
+    border-radius: var(--radius-sm);
+}
+
+.room-meta {
+    display: flex;
+    gap: 1rem;
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+}
+
+.room-owner-badge {
+    position: absolute;
+    top: 1rem;
+    right: 1rem;
+    font-size: 0.65rem;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.05em;
+    color: var(--accent);
+    background: rgba(139, 92, 246, 0.15);
+    padding: 0.2rem 0.5rem;
+    border-radius: var(--radius-sm);
+}
+
+.empty-state {
+    text-align: center;
+    padding: 3rem;
+    color: var(--text-secondary);
+}
+
+/* modal */
+.modal-overlay {
+    position: fixed;
+    inset: 0;
+    background: rgba(0, 0, 0, 0.7);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    z-index: 100;
+    backdrop-filter: blur(4px);
+}
+
+.modal {
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-lg);
+    padding: 2rem;
+    max-width: 420px;
+    width: 90%;
+    box-shadow: var(--shadow-card);
+}
+
+.modal-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    margin-bottom: 1.5rem;
+}
+
+.modal-header h2 {
+    font-size: 1.25rem;
+    font-weight: 600;
+    color: var(--text-primary);
+}
+
+.modal-close {
+    background: none;
+    border: none;
+    color: var(--text-secondary);
+    font-size: 1.5rem;
+    cursor: pointer;
+    padding: 0.25rem;
+    line-height: 1;
+}
+
+.modal-close:hover {
+    color: var(--text-primary);
+}
+
+/* room detail */
+.back-btn {
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    width: 32px;
+    height: 32px;
+    border-radius: var(--radius-md);
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    color: var(--text-secondary);
+    text-decoration: none;
+    transition: all 0.15s;
+}
+
+.back-btn:hover {
+    background: var(--bg-surface-hover);
+    color: var(--text-primary);
+}
+
+.room-code-badge {
+    font-family: var(--font-mono);
+    font-size: 0.8rem;
+    color: var(--accent);
+    background: rgba(139, 92, 246, 0.12);
+    padding: 0.25rem 0.75rem;
+    border-radius: var(--radius-md);
+}
+
+.scale-badge {
+    font-size: 0.75rem;
+    color: var(--text-secondary);
+    background: var(--bg-surface);
+    padding: 0.25rem 0.75rem;
+    border-radius: var(--radius-md);
+    border: 1px solid var(--border);
+}
+
+.room-layout {
+    display: grid;
+    grid-template-columns: 1fr 240px;
+    gap: 1.5rem;
+    min-height: 400px;
+}
+
+.stories-panel,
+.members-panel {
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-lg);
+    padding: 1.25rem;
+}
+
+.panel-title {
+    font-size: 0.8rem;
+    font-weight: 700;
+    text-transform: uppercase;
+    letter-spacing: 0.08em;
+    color: var(--text-muted);
+    margin-bottom: 1rem;
+}
+
+.stories-list,
+.members-list {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+}
+
+.story-card {
+    background: rgba(255, 255, 255, 0.03);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    padding: 1rem;
+    transition: all 0.15s;
+}
+
+.story-card:hover {
+    border-color: var(--border-accent);
+}
+
+.story-revealed {
+    border-color: rgba(139, 92, 246, 0.3);
+    background: rgba(139, 92, 246, 0.05);
+}
+
+.story-header {
+    display: flex;
+    justify-content: space-between;
+    align-items: flex-start;
+    gap: 0.75rem;
+    margin-bottom: 0.75rem;
+}
+
+.story-title {
+    font-size: 0.95rem;
+    font-weight: 500;
+    color: var(--text-primary);
+    flex: 1 1 auto;
+    word-break: break-word;
+    margin-top: 0.15rem; /* align text baseline with buttons */
+}
+
+.story-actions {
+    display: flex;
+    gap: 0.4rem;
+    align-items: center;
+    flex-wrap: wrap;
+    flex: 0 0 auto;
+}
+
+.story-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    height: 26px;
+    padding: 0 0.6rem;
+    font-size: 0.75rem;
+    font-weight: 500;
+    border-radius: var(--radius-sm);
+    cursor: pointer;
+    transition: all 0.15s;
+    border: 1px solid transparent;
+}
+
+.story-btn-primary {
+    background: var(--accent);
+    color: white;
+    border-color: var(--accent);
+}
+.story-btn-primary:hover {
+    background: var(--accent-hover);
+    border-color: var(--accent-hover);
+}
+
+.story-btn-secondary {
+    background: transparent;
+    color: var(--text-secondary);
+    border-color: var(--border);
+}
+.story-btn-secondary:hover {
+    background: var(--bg-surface-hover);
+    color: var(--text-primary);
+}
+
+.story-badge {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    height: 26px;
+    padding: 0 0.6rem;
+    font-size: 0.75rem;
+    font-weight: 500;
+    border-radius: var(--radius-sm);
+}
+
+.story-badge-active {
+    color: var(--success-text);
+    border: 1px solid var(--success-border);
+    background: var(--success-bg);
+}
+
+.story-badge-revealed {
+    color: var(--accent);
+    border: 1px solid rgba(139, 92, 246, 0.4);
+    background: rgba(139, 92, 246, 0.1);
+}
+
+.story-points {
+    font-family: var(--font-mono);
+    font-size: 1rem;
+    font-weight: 700;
+    color: var(--accent);
+    background: rgba(139, 92, 246, 0.15);
+    padding: 0.25rem 0.75rem;
+    border-radius: var(--radius-md);
+}
+
+.vote-form {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.5rem;
+}
+
+.vote-option {
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    padding: 0.4rem 0.75rem;
+    font-family: var(--font-mono);
+    font-size: 0.85rem;
+    color: var(--text-secondary);
+    cursor: pointer;
+    transition: all 0.15s;
+}
+
+.vote-option:hover {
+    background: var(--bg-surface-hover);
+    border-color: var(--accent);
+    color: var(--text-primary);
+}
+
+.vote-option.vote-selected {
+    border-color: var(--accent);
+    background: rgba(139, 92, 246, 0.12);
+    color: var(--text-primary);
+}
+
+.story-active {
+    border-color: var(--success-border);
+    background: var(--success-bg);
+}
+
+.story-action-btn {
+    display: inline-flex;
+    align-items: center;
+    justify-content: center;
+    width: 26px;
+    height: 26px;
+    padding: 0;
+    border-radius: var(--radius-sm);
+    background: transparent;
+    border: 1px solid var(--border);
+    color: var(--text-muted);
+    cursor: pointer;
+    transition: all 0.15s;
+    flex-shrink: 0;
+}
+
+.story-action-btn:hover {
+    background: var(--bg-surface-hover);
+    color: var(--text-primary);
+    border-color: var(--border-accent);
+}
+
+.story-action-btn.story-action-delete:hover {
+    border-color: rgba(239, 68, 68, 0.4);
+    color: #f87171;
+    background: rgba(239, 68, 68, 0.06);
+}
+
+.revealed-votes {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0.5rem;
+    margin-top: 0.75rem;
+    padding-top: 0.75rem;
+    border-top: 1px solid var(--border);
+}
+
+.revealed-vote {
+    display: flex;
+    align-items: center;
+    gap: 0.4rem;
+    background: var(--bg-surface);
+    border: 1px solid var(--border);
+    border-radius: var(--radius-md);
+    padding: 0.3rem 0.6rem;
+}
+
+.revealed-vote-user {
+    font-size: 0.8rem;
+    color: var(--text-secondary);
+}
+
+.revealed-vote-value {
+    font-family: var(--font-mono);
+    font-size: 0.85rem;
+    font-weight: 700;
+    color: var(--accent);
+    background: rgba(139, 92, 246, 0.15);
+    padding: 0.1rem 0.4rem;
+    border-radius: var(--radius-sm);
+}
+
+.member-row {
+    display: flex;
+    align-items: center;
+    gap: 0.65rem;
+    padding: 0.5rem;
+    border-radius: var(--radius-md);
+}
+
+.member-name {
+    font-size: 0.9rem;
+    color: var(--text-secondary);
+}
+
+/* SSE indicator */
+.sse-indicator {
+    display: inline-flex;
+    align-items: center;
+    gap: 0.375rem;
+    font-size: 0.75rem;
+    font-weight: 500;
+    color: var(--success-text);
+    padding: 0.25rem 0.5rem;
+    border-radius: var(--radius-full);
+    background: var(--success-bg);
+    border: 1px solid var(--success-border);
+}
+
+.mobile-menu-btn {
+    display: none;
+    background: transparent;
+    border: none;
+    color: var(--text-secondary);
+    cursor: pointer;
+    padding: 0.25rem;
+    border-radius: var(--radius-sm);
+    transition: all 0.2s ease;
+}
+
+.mobile-menu-btn:hover {
+    color: var(--text-primary);
+    background: var(--bg-surface-hover);
+}
+
+.sse-dot {
+    width: 6px;
+    height: 6px;
+    border-radius: 50%;
+    background: var(--success-text);
+    animation: pulse 2s ease infinite;
+}
+
 /* ============================================================
    RESPONSIVE
    ============================================================ */
 
+.sidebar-backdrop {
+    display: none;
+    position: fixed;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    background: rgba(0, 0, 0, 0.6);
+    backdrop-filter: blur(4px);
+    z-index: 90;
+    opacity: 0;
+    transition: opacity 0.3s ease;
+}
+
 @media (max-width: 768px) {
     .app-shell {
         grid-template-columns: 1fr;
-        grid-template-rows: auto 1fr;
+    }
-        height: auto;
+
-        min-height: 100vh;
+    .mobile-menu-btn {
-        overflow-y: auto;
+        display: block;
+    }
+
+    .sidebar-backdrop.open {
+        display: block;
+        opacity: 1;
     }
 
     .sidebar {
-        border-right: none;
+        position: fixed;
-        border-bottom: 1px solid var(--border);
+        top: 0;
-        padding: 1rem;
+        left: 0;
+        bottom: 0;
+        width: 280px;
+        z-index: 100;
+        transform: translateX(-100%);
+        transition: transform 0.3s cubic-bezier(0.4, 0, 0.2, 1);
+        background: var(--bg); /* Opaque background for mobile menu */
+        border-right: 1px solid var(--border);
+        box-shadow: 0 0 20px rgba(0, 0, 0, 0.5);
     }
 
-    .sidebar-nav {
+    .sidebar.open {
-        flex-direction: row;
+        transform: translateX(0);
-        flex-wrap: wrap;
-        gap: 0.25rem;
-    }
-
-    .main-content {
-        overflow-y: unset;
     }
 
     .dashboard-grid {

templates/index.html

@@ -3,7 +3,7 @@
     <head>
         <meta charset="UTF-8" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-        <title>Dashboard &mdash; SprintPadawan</title>
+        <title>Dashboard — SprintPadawan</title>
         <link rel="preconnect" href="https://fonts.googleapis.com" />
         <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
         <link
@@ -11,12 +11,13 @@
             rel="stylesheet"
         />
         <link rel="stylesheet" href="/static/styles/main.css" />
-        <script src="https://unpkg.com/htmx.org@2.0.4" defer></script>
+        <script src="/static/js/htmx.min.js" defer></script>
     </head>
     <body class="app-body">
         <div class="app-shell">
+            <div id="sidebar-backdrop" class="sidebar-backdrop" onclick="document.getElementById('app-sidebar').classList.remove('open'); document.getElementById('sidebar-backdrop').classList.remove('open')"></div>
             <!-- sidebar -->
-            <aside class="sidebar">
+            <aside class="sidebar" id="app-sidebar">
                 <div class="sidebar-logo">
                     <div class="logo-icon">⚡</div>
                     <span class="logo-text"><span>Sprint</span>Padawan</span>
@@ -40,7 +41,7 @@
                             <rect x="3" y="14" width="7" height="7" />
                             <rect x="14" y="14" width="7" height="7" />
                         </svg>
-                        Dashboard
+                        Rooms
                     </a>
                 </nav>
 
@@ -77,74 +78,67 @@
                 </div>
             </aside>
 
-            <!-- main -->
             <div class="main-content">
                 <header class="topbar">
-                    <span class="topbar-title">Dashboard</span>
+                    <div style="display: flex; align-items: center; gap: 1rem;">
+                        <button class="mobile-menu-btn" onclick="document.getElementById('app-sidebar').classList.toggle('open'); document.getElementById('sidebar-backdrop').classList.toggle('open')">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                <line x1="3" y1="12" x2="21" y2="12"></line>
+                                <line x1="3" y1="6" x2="21" y2="6"></line>
+                                <line x1="3" y1="18" x2="21" y2="18"></line>
+                            </svg>
+                        </button>
+                        <span class="topbar-title">Planning Rooms</span>
+                    </div>
+                    <button class="btn-primary" style="width: auto; padding: 0.5rem 1rem;" hx-get="/rooms/new" hx-target="body" hx-swap="beforeend">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+                            <line x1="12" y1="5" x2="12" y2="19"></line>
+                            <line x1="5" y1="12" x2="19" y2="12"></line>
+                        </svg>
+                        Create Room
+                    </button>
                 </header>
 
                 <main class="page-content">
-                    <!-- greeting -->
                     <div class="welcome-hero">
                         <p class="welcome-greeting">
                             Welcome back, <span>{{.Username}}</span>
                         </p>
                         <p class="welcome-sub">
-                            Here's what's happening with your server.
+                            Create or join a planning room to start estimating.
                         </p>
                     </div>
 
-                    <!-- stat cards -->
+                    {{if .Rooms}}
-                    <div class="dashboard-grid">
+                    <div class="rooms-grid">
-                        <div class="dash-card">
+                        {{range .Rooms}}
-                            <div class="dash-card-label">Runtime</div>
+                        <a href="/rooms/{{.ID}}" class="room-card">
-                            <div class="dash-card-value">Go</div>
+                            <div class="room-header">
-                        </div>
+                                <span class="room-name">{{.Name}}</span>
-                        <div class="dash-card">
+                                <div style="display: flex; gap: 0.5rem; align-items: center;">
-                            <div class="dash-card-label">Reactivity</div>
+                                    {{if .IsOwner}}
-                            <div class="dash-card-value">HTMX</div>
+                                    <span class="room-owner-badge" style="position: static; margin: 0; padding: 0.2rem 0.5rem;">Owner</span>
-                        </div>
+                                    {{end}}
-                        <div class="dash-card">
+                                    <span class="room-code">{{.Code}}</span>
-                            <div class="dash-card-label">Port</div>
-                            <div class="dash-card-value">:8080</div>
                                 </div>
                             </div>
-
+                            <div class="room-meta">
-                    <!-- ping section -->
+                                <span class="room-scale">{{.Scale}}</span>
-                    <div class="welcome-hero">
+                                <span class="room-members">{{.MemberCount}} members</span>
-                        <p class="welcome-greeting" style="font-size: 1.1rem">
-                            Server Health
-                        </p>
-                        <p class="welcome-sub" style="margin-bottom: 1.25rem">
-                            Ping the server to check it's alive.
-                        </p>
-
-                        <button
-                            class="ping-btn"
-                            hx-get="/api/ping-partial"
-                            hx-target="#ping-result"
-                            hx-swap="innerHTML"
-                        >
-                            <svg
-                                xmlns="http://www.w3.org/2000/svg"
-                                width="15"
-                                height="15"
-                                viewBox="0 0 24 24"
-                                fill="none"
-                                stroke="currentColor"
-                                stroke-width="2.5"
-                                stroke-linecap="round"
-                                stroke-linejoin="round"
-                            >
-                                <path d="M22 12h-4l-3 9L9 3l-3 9H2" />
-                            </svg>
-                            Ping Server
-                        </button>
-
-                        <div id="ping-result" style="margin-top: 1.25rem"></div>
                             </div>
+                        </a>
+                        {{end}}
+                    </div>
+                    {{else}}
+                    <div class="empty-state">
+                        <p>No rooms yet. Create one to get started.</p>
+                    </div>
+                    {{end}}
                 </main>
             </div>
         </div>
+
+        <!-- modal container -->
+        <div id="modal-container"></div>
     </body>
 </html>

templates/ping_result.html

@@ -1,9 +0,0 @@
-{{define "ping_result.html"}}
-<div class="result-box">
-    <div class="result-dot"></div>
-    <div class="result-content">
-        <span class="result-label">{{.Status}}</span>
-        <span class="result-message">{{.Message}}</span>
-    </div>
-</div>
-{{end}}

templates/room.html

@@ -0,0 +1,274 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>{{.Name}} — SprintPadawan</title>
+        <link rel="preconnect" href="https://fonts.googleapis.com" />
+        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
+        <link
+            href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
+            rel="stylesheet"
+        />
+<link rel="stylesheet" href="/static/styles/main.css" />
+        <script src="/static/js/htmx.min.js" defer></script>
+    </head>
+    <body class="app-body">
+        <div class="app-shell">
+            <div id="sidebar-backdrop" class="sidebar-backdrop" onclick="document.getElementById('app-sidebar').classList.remove('open'); document.getElementById('sidebar-backdrop').classList.remove('open')"></div>
+            <aside class="sidebar" id="app-sidebar">
+                <div class="sidebar-logo">
+                    <div class="logo-icon">⚡</div>
+                    <span class="logo-text"><span>Sprint</span>Padawan</span>
+                </div>
+
+                <nav class="sidebar-nav">
+                    <a href="/" class="nav-item">
+                        <svg
+                            xmlns="http://www.w3.org/2000/svg"
+                            width="16"
+                            height="16"
+                            viewBox="0 0 24 24"
+                            fill="none"
+                            stroke="currentColor"
+                            stroke-width="2"
+                            stroke-linecap="round"
+                            stroke-linejoin="round"
+                        >
+                            <rect x="3" y="3" width="7" height="7" />
+                            <rect x="14" y="3" width="7" height="7" />
+                            <rect x="3" y="14" width="7" height="7" />
+                            <rect x="14" y="14" width="7" height="7" />
+                        </svg>
+                        Rooms
+                    </a>
+                </nav>
+
+                <div class="sidebar-footer">
+                    <div class="user-row">
+                        <div class="user-avatar">{{slice .User.Username 0 1}}</div>
+                        <div class="user-info">
+                            <span class="user-name">{{.User.Username}}</span>
+                            <span class="user-role">Member</span>
+                        </div>
+                    </div>
+                    <form method="POST" action="/logout">
+                        <button class="sign-out-btn" type="submit">
+                            <svg
+                                xmlns="http://www.w3.org/2000/svg"
+                                width="14"
+                                height="14"
+                                viewBox="0 0 24 24"
+                                fill="none"
+                                stroke="currentColor"
+                                stroke-width="2.5"
+                                stroke-linecap="round"
+                                stroke-linejoin="round"
+                            >
+                                <path
+                                    d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4"
+                                />
+                                <polyline points="16 17 21 12 16 7" />
+                                <line x1="21" y1="12" x2="9" y2="12" />
+                            </svg>
+                            Sign Out
+                        </button>
+                    </form>
+                </div>
+            </aside>
+
+            <div class="main-content">
+                <header class="topbar">
+                    <div style="display: flex; align-items: center; gap: 1rem;">
+                        <button class="mobile-menu-btn" onclick="document.getElementById('app-sidebar').classList.toggle('open'); document.getElementById('sidebar-backdrop').classList.toggle('open')">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                <line x1="3" y1="12" x2="21" y2="12"></line>
+                                <line x1="3" y1="6" x2="21" y2="6"></line>
+                                <line x1="3" y1="18" x2="21" y2="18"></line>
+                            </svg>
+                        </button>
+                        <a href="/" class="back-btn">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                <line x1="19" y1="12" x2="5" y2="12"></line>
+                                <polyline points="12 19 5 12 12 5"></polyline>
+                            </svg>
+                        </a>
+                        <span class="topbar-title">{{.Name}}</span>
+                        <span class="room-code-badge">{{.Code}}</span>
+                    </div>
+                    <div style="display: flex; align-items: center; gap: 0.75rem;">
+                        <span class="scale-badge">{{.Scale}}</span>
+                        {{if .IsOwner}}
+                        <button hx-get="/rooms/{{.ID}}/stories/new" hx-target="#modal-container" hx-swap="innerHTML" class="btn-primary" style="width: auto; padding: 0.5rem 1rem;">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round">
+                                <line x1="12" y1="5" x2="12" y2="19"></line>
+                                <line x1="5" y1="12" x2="19" y2="12"></line>
+                            </svg>
+                            Add Story
+                        </button>
+                        {{end}}
+                    </div>
+                </header>
+
+                <main class="page-content">
+                    <div class="room-layout">
+                        <!-- stories list -->
+                        <div class="stories-panel">
+                            <div style="display: flex; align-items: center; justify-content: space-between; margin-bottom: 1.5rem;">
+                                <h3 class="panel-title" style="margin-bottom: 0;">Stories</h3>
+                                <div class="sse-indicator">
+                                    <span class="sse-dot"></span>
+                                    <span>Live</span>
+                                </div>
+                            </div>
+                            {{if .Stories}}
+                            <div class="stories-list">
+                                {{range .Stories}}
+                                {{$isActive := eq (derefInt $.ActiveStoryID) .ID}}
+                                {{if or $.IsOwner (eq $.ActiveStoryID nil) $isActive .Voted}}
+                                <div class="story-card {{if .Voted}}story-revealed{{end}} {{if $isActive}}story-active{{end}}" id="story-{{.ID}}">
+                                    <div class="story-header">
+                                        <span class="story-title">{{.Title}}</span>
+                                        <div class="story-actions">
+                                            {{if .Voted}}
+                                            <span class="story-badge story-badge-revealed">Revealed</span>
+                                            {{if $.IsOwner}}
+                                            <form method="POST" action="/rooms/{{$.ID}}/stories/{{.ID}}/unreveal" style="margin:0;">
+                                                <button type="submit" class="story-btn story-btn-secondary">Hide</button>
+                                            </form>
+                                            {{end}}
+                                            {{else if $.IsOwner}}
+                                                {{if $isActive}}
+                                                <form method="POST" action="/rooms/{{$.ID}}/reveal" style="margin:0;">
+                                                    <input type="hidden" name="story_id" value="{{.ID}}" />
+                                                    <button type="submit" class="story-btn story-btn-primary">Reveal</button>
+                                                </form>
+                                                <span class="story-badge story-badge-active">Active</span>
+                                                {{else}}
+                                                <form method="POST" action="/rooms/{{$.ID}}/active" style="margin:0;">
+                                                    <input type="hidden" name="story_id" value="{{.ID}}" />
+                                                    <button type="submit" class="story-btn story-btn-secondary">Set Active</button>
+                                                </form>
+                                                {{end}}
+                                            {{end}}
+                                            {{if $.IsOwner}}
+                                            <button type="button" class="story-action-btn" hx-get="/rooms/{{$.ID}}/stories/{{.ID}}/edit" hx-target="#modal-container" hx-swap="innerHTML" title="Rename">
+                                                <svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                                    <path d="M11 4H4a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2v-7"/>
+                                                    <path d="M18.5 2.5a2.121 2.121 0 0 1 3 3L12 15l-4 1 1-4 9.5-9.5z"/>
+                                                </svg>
+                                            </button>
+                                            <button type="button" class="story-action-btn story-action-delete" hx-post="/rooms/{{$.ID}}/stories/{{.ID}}/delete" hx-target="#story-{{.ID}}" hx-swap="outerHTML" hx-confirm="Delete this story?" title="Delete">
+                                                <svg xmlns="http://www.w3.org/2000/svg" width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                                    <polyline points="3 6 5 6 21 6"/>
+                                                    <path d="M19 6v14a2 2 0 0 1-2 2H7a2 2 0 0 1-2-2V6m3 0V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v2"/>
+                                                </svg>
+                                            </button>
+                                            {{end}}
+                                        </div>
+                                    </div>
+                                    {{if $isActive}}
+                                    {{$userVote := index $.UserVotes .ID}}
+                                    <div class="vote-form" id="vote-form-{{.ID}}">
+                                        {{$storyID := .ID}}
+                                        {{range scaleToOptions $.Scale}}
+                                        <button type="button"
+                                            hx-post="/rooms/{{$.ID}}/vote"
+                                            hx-target="#vote-form-{{$storyID}}"
+                                            hx-swap="outerHTML"
+                                            hx-vals='{"story_id":"{{$storyID}}","value":"{{.}}"}'
+                                            class="vote-option {{if eq . $userVote}}vote-selected{{end}}">{{.}}</button>
+                                        {{end}}
+                                    </div>
+                                    <div class="voting-progress" style="margin-top: 1.5rem; border-top: 1px solid var(--border); padding-top: 1rem;">
+                                        <div style="font-size: 0.75rem; color: var(--text-muted); margin-bottom: 0.75rem; text-transform: uppercase; font-weight: 600; letter-spacing: 0.05em;">Voting Progress</div>
+                                        <div style="display: flex; gap: 0.5rem; flex-wrap: wrap;">
+                                            {{range $.Members}}
+                                            <div class="scale-badge" style="{{if .HasVoted}}color: var(--success-text); border-color: var(--success-border); background: var(--success-bg);{{else}}color: var(--text-muted); opacity: 0.7;{{end}}">
+                                                {{.Username}} {{if .HasVoted}}✓{{else}}...{{end}}
+                                            </div>
+                                            {{end}}
+                                        </div>
+                                    </div>
+                                    {{end}}
+                                    {{if .Voted}}
+                                    <div class="revealed-votes">
+                                        {{range index $.StoryVotes .ID}}
+                                        <div class="revealed-vote">
+                                            <span class="revealed-vote-user">{{.Username}}</span>
+                                            <span class="revealed-vote-value">{{.Value}}</span>
+                                        </div>
+                                        {{end}}
+                                    </div>
+                                    {{end}}
+                                </div>
+                                {{end}}
+                                {{end}}
+                            </div>
+                            {{else}}
+                            <div class="empty-state">
+                                <p>No stories yet. Add one to start voting.</p>
+                            </div>
+                            {{end}}
+                        </div>
+
+                        <!-- members panel -->
+                        <div class="members-panel">
+                            <h3 class="panel-title">Members ({{len .Members}})</h3>
+                            <div class="members-list">
+                                {{range .Members}}
+                                <div class="member-row">
+                                    <div class="user-avatar" style="width: 28px; height: 28px; font-size: 0.7rem;">{{slice .Username 0 1}}</div>
+                                    <span class="member-name">{{.Username}}</span>
+                                    {{if .HasVoted}}
+                                    <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="var(--success-text)" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" style="margin-left: auto;">
+                                        <polyline points="20 6 9 17 4 12"></polyline>
+                                    </svg>
+                                    {{end}}
+                                </div>
+                                {{end}}
+                            </div>
+                        </div>
+                    </div>
+                </main>
+            </div>
+        </div>
+
+        <!-- modal container -->
+        <div id="modal-container"></div>
+
+        <script>
+            (function() {
+                var roomID = {{.ID}};
+                var evtSource = new EventSource("/sse/" + roomID);
+                evtSource.addEventListener("room-" + roomID, function(e) {
+                    if (e.data === "refresh") {
+                        window.location.reload();
+                    } else if (e.data === "members") {
+                        fetch(window.location.href)
+                            .then(res => res.text())
+                            .then(html => {
+                                var parser = new DOMParser();
+                                var doc = parser.parseFromString(html, "text/html");
+                                var newPanel = doc.querySelector('.members-panel');
+                                var oldPanel = document.querySelector('.members-panel');
+                                if (newPanel && oldPanel) {
+                                    oldPanel.replaceWith(newPanel);
+                                }
+                                var newProgress = doc.querySelector('.voting-progress');
+                                var oldProgress = document.querySelector('.voting-progress');
+                                if (newProgress && oldProgress) {
+                                    oldProgress.replaceWith(newProgress);
+                                }
+                                var newRevealed = doc.querySelector('.revealed-votes');
+                                var oldRevealed = document.querySelector('.revealed-votes');
+                                if (newRevealed && oldRevealed) {
+                                    oldRevealed.replaceWith(newRevealed);
+                                }
+                            });
+                    }
+                });
+            })();
+        </script>
+    </body>
+</html>

templates/room_form.html

@@ -0,0 +1,31 @@
+<div class="modal-overlay" onclick="this.remove()">
+    <div class="modal" onclick="event.stopPropagation()">
+        <div class="modal-header">
+            <h2>Create Room</h2>
+            <button class="modal-close" onclick="this.closest('.modal-overlay').remove()">&times;</button>
+        </div>
+        <form method="POST" action="/rooms/create" class="auth-form">
+            <div class="form-group">
+                <label class="form-label">Room Name</label>
+                <input class="form-input" type="text" name="name" placeholder="Sprint Planning" required />
+            </div>
+            <div class="form-group">
+                <label class="form-label">Voting Scale</label>
+                <select class="form-input" name="scale">
+                    <option value="fibonacci">Fibonacci (1, 2, 3, 5, 8, 13, 21, ?)</option>
+                    <option value="tshirt">T-Shirt (XS, S, M, L, XL, XXL, ?)</option>
+                    <option value="linear">Linear (1, 2, 3, 4, 5, 6, 7, 8, 9, 10, ?)</option>
+                </select>
+            </div>
+            <button class="btn-primary" type="submit">Create Room</button>
+        </form>
+        <div class="divider" style="margin: 1.5rem 0"></div>
+        <form method="POST" action="/rooms/join" class="auth-form">
+            <div class="form-group">
+                <label class="form-label">Or Join Existing</label>
+                <input class="form-input" type="text" name="code" placeholder="Room code" required />
+            </div>
+            <button class="btn-primary" type="submit" style="background: var(--bg-surface); border: 1px solid var(--border);">Join Room</button>
+        </form>
+    </div>
+</div>

templates/story_edit.html

@@ -0,0 +1,15 @@
+<div class="modal-overlay" onclick="this.remove()">
+    <div class="modal" onclick="event.stopPropagation()">
+        <div class="modal-header">
+            <h2>Rename Story</h2>
+            <button class="modal-close" onclick="this.closest('.modal-overlay').remove()">&times;</button>
+        </div>
+        <form method="POST" action="/rooms/{{.RoomID}}/stories/{{.Story.ID}}/rename" class="auth-form">
+            <div class="form-group">
+                <label class="form-label">Story Title</label>
+                <input class="form-input" type="text" name="title" value="{{.Story.Title}}" required />
+            </div>
+            <button class="btn-primary" type="submit">Save</button>
+        </form>
+    </div>
+</div>

templates/story_form.html

@@ -0,0 +1,15 @@
+<div class="modal-overlay" onclick="this.remove()">
+    <div class="modal" onclick="event.stopPropagation()">
+        <div class="modal-header">
+            <h2>Add Story</h2>
+            <button class="modal-close" onclick="this.closest('.modal-overlay').remove()">&times;</button>
+        </div>
+        <form method="POST" action="/rooms/{{.ID}}/stories" class="auth-form">
+            <div class="form-group">
+                <label class="form-label">Story Title</label>
+                <input class="form-input" type="text" name="title" placeholder="e.g. As a user, I can..." required />
+            </div>
+            <button class="btn-primary" type="submit">Add Story</button>
+        </form>
+    </div>
+</div>

templates/vote_form.html

@@ -0,0 +1,13 @@
+<div class="vote-form" id="vote-form-{{.Story.ID}}">
+    {{$userVote := .UserVote}}
+    {{$roomID := .RoomID}}
+    {{$storyID := .Story.ID}}
+    {{range scaleToOptions .Scale}}
+    <button type="button"
+        hx-post="/rooms/{{$roomID}}/vote"
+        hx-target="#vote-form-{{$storyID}}"
+        hx-swap="outerHTML"
+        hx-vals='{"story_id":"{{$storyID}}","value":"{{.}}"}'
+        class="vote-option {{if eq . $userVote}}vote-selected{{end}}">{{.}}</button>
+    {{end}}
+</div>