Add polls, thread IDs & markup enhancements

Bump version to 1.0.4 and implement several feature additions and markup/UI improvements:

- Database: add polls, poll_options and poll_votes tables with UNIQUE(poll_id, ip_hash) to enforce one vote per IP; helper queries for creating polls, fetching poll data (with vote counts and user choice), casting votes, and resolving poll context.
- Handlers: accept poll fields in new-thread multipart parsing; create polls when OP supplies question + ≥2 options (duration clamped 1 minute–30 days); new POST /vote handler to cast votes with CSRF and expiry checks.
- Templates/UI: show permanent thread numeric badges and clickable [#id] links; new poll creator UI in new-thread form (add/remove options, duration), poll rendering on thread pages (voting form and results view anchored at #poll); markup hint bar; resizable expanded images and media improvements.
- Sanitizer/markup: add cross-board links (>>>/board/123 and >>>/board/), spoiler tags, emoji shortcodes, improved greentext handling (collapsible groups), URL/reply handling and ordering of transforms; word filters run on raw text before escaping.
- Static/CSS: per-board uploads route (/boards), styles for thread IDs, spoilers, poll UI, cross-board links, and media resize/rotation; fix greentext/quote class mismatch.

Also update CHANGELOG with feature list and adjust upload/data directory naming. The commit focuses on adding polls and richer post markup while preserving XSS-safe escaping and enforcing CSRF and vote uniqueness.

Author: csd113

CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to RustChan will be documented in this file.
 
+## [1.0.4] - 2026-03-03
+
+### Added
+- **Thread IDs** — every thread is now assigned a permanent numeric ID displayed as a badge (`Thread No.1234`) at the top of its page. Board index thread summaries show a clickable `[ #1234 ]` link beside each post number.
+- **Cross-board links** — post bodies now parse `>>>/board/123` into a clickable link to that thread and `>>>/board/` into a board index link. Cross-board links are styled in amber to distinguish them from local reply links.
+- **Emoji shortcodes** — 25 shortcodes supported in post bodies (e.g. `:fire:` → 🔥, `:think:` → 🤔, `:based:` → 🗿, `:kek:` → 🤣). Applied after HTML transforms to avoid conflicts.
+- **Spoiler tags** — `[spoiler]text[/spoiler]` hides content behind a same-color block; clicking or hovering reveals it with a smooth transition.
+- **Markup hint bar** — a compact row of syntax reminders is shown below the body textarea in the new thread form listing available markup options.
+- **Thread polls** — the new thread form includes a collapsible `[ 📊 Add a Poll ]` section. Polls are OP-only, support 2–10 options (dynamically added/removed), and require a duration in hours or minutes (clamped to 1 minute–30 days). Votes are cast via a radio-button form, one vote per IP enforced at the database level. Results display as a percentage bar chart after voting or once the poll closes. Polls are anchored at `#poll` on their thread page.
+- **Resizable expanded images** — expanded images support `resize: both`, allowing users to drag the corner to any size without reloading.
+- **Per-board upload directories** — files are now stored under `rustchan-data/boards/{board}/` and thumbnails under `rustchan-data/boards/{board}/thumbs/` for clean per-board organisation.
+
+### Changed
+- **Data directory renamed** from `chan-data/` to `rustchan-data/` for clarity.
+- **Upload directory renamed** from `uploads/` to `boards/` inside the data directory. The static file route changed from `/uploads/` to `/boards/` accordingly.
+- **Bold** (`**text**`) and **italic** (`__text__`) markup now render correctly in all post bodies.
+
+### Fixed
+- Greentext CSS class mismatch — renderer emits `class="quote"` but the stylesheet only targeted `.greentext`; both are now covered.
+- Spoiler CSS specificity — `.post-body` color was overriding the spoiler hide rule; selectors updated to `.post-body .spoiler`.
+- Poll "Question" input overflowing the form on narrow layouts — label and input now use `width: 100%; box-sizing: border-box` and `min-width: 0`.
+
+---
+
 ## [1.0.3] - 2026-03-03
 
 ### Changed

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustchan"
-version = "1.0.3"
+version = "1.0.4"
 edition = "2021"
 # FIX[LOW-1]: Removed hardware-specific description. This binary is portable
 # and targets any architecture/OS that Rust supports.

src/db.rs

@@ -149,6 +149,33 @@ fn create_schema(conn: &rusqlite::Connection) -> Result<()> {
             replacement TEXT NOT NULL
         );
 
+        -- Polls (one per thread, OP only)
+        CREATE TABLE IF NOT EXISTS polls (
+            id         INTEGER PRIMARY KEY AUTOINCREMENT,
+            thread_id  INTEGER NOT NULL UNIQUE REFERENCES threads(id) ON DELETE CASCADE,
+            question   TEXT NOT NULL,
+            expires_at INTEGER NOT NULL,
+            created_at INTEGER NOT NULL DEFAULT (unixepoch())
+        );
+
+        -- Poll options
+        CREATE TABLE IF NOT EXISTS poll_options (
+            id       INTEGER PRIMARY KEY AUTOINCREMENT,
+            poll_id  INTEGER NOT NULL REFERENCES polls(id) ON DELETE CASCADE,
+            text     TEXT NOT NULL,
+            position INTEGER NOT NULL DEFAULT 0
+        );
+
+        -- Poll votes — one per (poll, ip_hash) pair
+        CREATE TABLE IF NOT EXISTS poll_votes (
+            id        INTEGER PRIMARY KEY AUTOINCREMENT,
+            poll_id   INTEGER NOT NULL REFERENCES polls(id) ON DELETE CASCADE,
+            option_id INTEGER NOT NULL REFERENCES poll_options(id) ON DELETE CASCADE,
+            ip_hash   TEXT NOT NULL,
+            created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+            UNIQUE(poll_id, ip_hash)
+        );
+
         -- Indices for common query patterns
         CREATE INDEX IF NOT EXISTS idx_threads_board_sticky_bumped
             ON threads(board_id, sticky DESC, bumped_at DESC);
@@ -171,6 +198,7 @@ fn create_schema(conn: &rusqlite::Connection) -> Result<()> {
     let migrations = [
         "ALTER TABLE boards ADD COLUMN allow_video   INTEGER NOT NULL DEFAULT 1",
         "ALTER TABLE boards ADD COLUMN allow_tripcodes INTEGER NOT NULL DEFAULT 1",
+        // Poll tables added later — CREATE TABLE IF NOT EXISTS handles this gracefully
     ];
     for sql in &migrations {
         let _ = conn.execute(sql, []);   // ignore "duplicate column" errors
@@ -849,6 +877,136 @@ pub fn record_file_hash(
     Ok(())
 }
 
+// ─── Poll queries ─────────────────────────────────────────────────────────────
+
+/// Create a poll with its options atomically.
+pub fn create_poll(
+    conn: &rusqlite::Connection,
+    thread_id: i64,
+    question: &str,
+    options: &[String],
+    expires_at: i64,
+) -> Result<i64> {
+    conn.execute(
+        "INSERT INTO polls (thread_id, question, expires_at) VALUES (?1, ?2, ?3)",
+        params![thread_id, question, expires_at],
+    )?;
+    let poll_id = conn.last_insert_rowid();
+    for (i, text) in options.iter().enumerate() {
+        conn.execute(
+            "INSERT INTO poll_options (poll_id, text, position) VALUES (?1, ?2, ?3)",
+            params![poll_id, text, i as i64],
+        )?;
+    }
+    Ok(poll_id)
+}
+
+/// Fetch the full poll for a thread including vote counts and the user's choice.
+pub fn get_poll_for_thread(
+    conn: &rusqlite::Connection,
+    thread_id: i64,
+    ip_hash: &str,
+) -> Result<Option<crate::models::PollData>> {
+    let now = chrono::Utc::now().timestamp();
+
+    let poll_row = conn
+        .query_row(
+            "SELECT id, thread_id, question, expires_at, created_at FROM polls WHERE thread_id = ?1",
+            params![thread_id],
+            |r| {
+                Ok(crate::models::Poll {
+                    id: r.get(0)?,
+                    thread_id: r.get(1)?,
+                    question: r.get(2)?,
+                    expires_at: r.get(3)?,
+                    created_at: r.get(4)?,
+                })
+            },
+        )
+        .optional()?;
+
+    let poll = match poll_row {
+        Some(p) => p,
+        None    => return Ok(None),
+    };
+
+    // Options with live vote counts
+    let mut stmt = conn.prepare_cached(
+        "SELECT po.id, po.poll_id, po.text, po.position,
+                COUNT(pv.id) as vote_count
+         FROM poll_options po
+         LEFT JOIN poll_votes pv ON pv.option_id = po.id
+         WHERE po.poll_id = ?1
+         GROUP BY po.id
+         ORDER BY po.position ASC",
+    )?;
+    let options: Vec<crate::models::PollOption> = stmt
+        .query_map(params![poll.id], |r| {
+            Ok(crate::models::PollOption {
+                id:         r.get(0)?,
+                poll_id:    r.get(1)?,
+                text:       r.get(2)?,
+                position:   r.get(3)?,
+                vote_count: r.get(4)?,
+            })
+        })?
+        .collect::<rusqlite::Result<_>>()?;
+
+    let total_votes: i64 = options.iter().map(|o| o.vote_count).sum();
+
+    // Did this user vote, and for which option?
+    let user_voted_option: Option<i64> = conn
+        .query_row(
+            "SELECT option_id FROM poll_votes WHERE poll_id = ?1 AND ip_hash = ?2",
+            params![poll.id, ip_hash],
+            |r| r.get(0),
+        )
+        .optional()?;
+
+    let is_expired = poll.expires_at <= now;
+
+    Ok(Some(crate::models::PollData {
+        poll,
+        options,
+        total_votes,
+        user_voted_option,
+        is_expired,
+    }))
+}
+
+/// Cast a vote. Returns true if vote was recorded, false if already voted.
+pub fn cast_vote(
+    conn: &rusqlite::Connection,
+    poll_id: i64,
+    option_id: i64,
+    ip_hash: &str,
+) -> Result<bool> {
+    let result = conn.execute(
+        "INSERT OR IGNORE INTO poll_votes (poll_id, option_id, ip_hash)
+         VALUES (?1, ?2, ?3)",
+        params![poll_id, option_id, ip_hash],
+    )?;
+    Ok(result > 0)
+}
+
+/// Resolve (poll_id, thread_id, board_short) from an option_id.
+pub fn get_poll_context(
+    conn: &rusqlite::Connection,
+    option_id: i64,
+) -> Result<Option<(i64, i64, String)>> {
+    Ok(conn.query_row(
+        "SELECT p.id, p.thread_id, b.short_name
+         FROM poll_options po
+         JOIN polls p ON p.id = po.poll_id
+         JOIN threads t ON t.id = p.thread_id
+         JOIN boards b ON b.id = t.board_id
+         WHERE po.id = ?1",
+        params![option_id],
+        |r| Ok((r.get(0)?, r.get(1)?, r.get(2)?)),
+    )
+    .optional()?)
+}
+
 // ─── Row mapping helpers ──────────────────────────────────────────────────────
 
 fn map_board(row: &rusqlite::Row<'_>) -> rusqlite::Result<Board> {

src/handlers/board.rs

@@ -163,14 +163,16 @@ pub async fn create_thread(
     let name_val      = form.name;
     let subject_val   = form.subject;
     let del_token_val = form.deletion_token;
+    let poll_question  = form.poll_question;
+    let poll_options   = form.poll_options;
+    let poll_duration  = form.poll_duration_secs;
 
     let redirect_url = tokio::task::spawn_blocking({
         let pool = state.db.clone();
         move || -> Result<String> {
             let conn = pool.get()?;
             let board = db::get_board_by_short(&conn, &board_short)?
                 .ok_or_else(|| AppError::NotFound(format!("Board /{board_short}/ not found")))?;
-
             let ip_hash = hash_ip(&client_ip, &cookie_secret);
             if let Some(reason) = db::is_banned(&conn, &ip_hash)? {
                 return Err(AppError::Forbidden(format!(
@@ -256,6 +258,20 @@ pub async fn create_thread(
                 &new_post,
             )?;
 
+            // Create poll if question + at least 2 options were supplied
+            let q = poll_question.trim().to_string();
+            let valid_opts: Vec<String> = poll_options.iter()
+                .map(|o| o.trim().to_string())
+                .filter(|o| !o.is_empty())
+                .collect();
+            if !q.is_empty() && valid_opts.len() >= 2 {
+                if let Some(secs) = poll_duration {
+                    let secs = secs.max(60).min(30 * 24 * 3600); // clamp 1 min..30 days
+                    let expires_at = chrono::Utc::now().timestamp() + secs;
+                    db::create_poll(&conn, thread_id, &q, &valid_opts, expires_at)?;
+                }
+            }
+
             let max_threads = board.max_threads;
             let paths = db::prune_old_threads(&conn, board.id, max_threads)?;
             for path in paths {

src/handlers/mod.rs

@@ -20,6 +20,11 @@ pub struct PostFormData {
     pub deletion_token: String,
     /// Raw bytes + original filename if a file was attached.
     pub file: Option<(Vec<u8>, String)>,
+    // ── Poll fields (only used when creating a new thread) ────────────────
+    pub poll_question: String,
+    pub poll_options: Vec<String>,
+    /// Duration in seconds (parsed from value + unit)
+    pub poll_duration_secs: Option<i64>,
 }
 
 /// Drain all fields from a multipart form into [`PostFormData`].
@@ -34,6 +39,10 @@ pub async fn parse_post_multipart(
     let mut body = String::new();
     let mut deletion_token = String::new();
     let mut file: Option<(Vec<u8>, String)> = None;
+    let mut poll_question = String::new();
+    let mut poll_options: Vec<String> = Vec::new();
+    let mut poll_duration_value: Option<i64> = None;
+    let mut poll_duration_unit = String::from("hours");
 
     while let Some(field) = multipart
         .next_field()
@@ -51,6 +60,21 @@ pub async fn parse_post_multipart(
             Some("subject")        => subject         = field.text().await.unwrap_or_default(),
             Some("body")           => body            = field.text().await.unwrap_or_default(),
             Some("deletion_token") => deletion_token  = field.text().await.unwrap_or_default(),
+            Some("poll_question")  => poll_question   = field.text().await.unwrap_or_default(),
+            Some("poll_option") => {
+                let v = field.text().await.unwrap_or_default();
+                let trimmed = v.trim().to_string();
+                if !trimmed.is_empty() {
+                    poll_options.push(trimmed);
+                }
+            }
+            Some("poll_duration_value") => {
+                let v = field.text().await.unwrap_or_default();
+                poll_duration_value = v.trim().parse::<i64>().ok();
+            }
+            Some("poll_duration_unit") => {
+                poll_duration_unit = field.text().await.unwrap_or_default();
+            }
             Some("file") => {
                 let fname = field.file_name().unwrap_or("upload").to_string();
                 let bytes = field
@@ -65,5 +89,17 @@ pub async fn parse_post_multipart(
         }
     }
 
-    Ok(PostFormData { csrf_verified, name, subject, body, deletion_token, file })
+    // Convert duration value + unit → seconds
+    let poll_duration_secs = if !poll_question.trim().is_empty() {
+        poll_duration_value.map(|v| {
+            if poll_duration_unit == "minutes" { v * 60 } else { v * 3600 }
+        })
+    } else {
+        None
+    };
+
+    Ok(PostFormData {
+        csrf_verified, name, subject, body, deletion_token, file,
+        poll_question, poll_options, poll_duration_secs,
+    })
 }