feat(tgbot-back): start to develop back

Implemented fetchUserTitlesAsync func and embedded it in the code of the front in the trial mode. It needs to be restructured

.forgejo/workflows/build-and-deploy.yml

@@ -18,14 +18,10 @@ jobs:
       - uses: actions/setup-go@v6
         with:
           go-version: '^1.25'
-          check-latest: false
-          cache-dependency-path: |
-            modules/backend/go.sum
       
-      - name: Build Go app
+      - name: Build backend
         run: |
           cd modules/backend
-          go mod tidy
           go build -o nyanimedb .
           tar -czvf nyanimedb-backend.tar.gz nyanimedb
 
@@ -35,6 +31,18 @@ jobs:
           name: nyanimedb-backend.tar.gz
           path: modules/backend/nyanimedb-backend.tar.gz
 
+      - name: Build auth
+        run: |
+          cd modules/auth
+          go build -o auth .
+          tar -czvf nyanimedb-auth.tar.gz auth
+
+      - name: Upload built auth to artifactory
+        uses: actions/upload-artifact@v3
+        with:
+          name: nyanimedb-auth.tar.gz
+          path: modules/auth/nyanimedb-auth.tar.gz
+
       # Build frontend
       - uses: actions/setup-node@v5
         with:
@@ -76,6 +84,14 @@ jobs:
           push: true
           tags: meowgit.nekoea.red/nihonium/nyanimedb-backend:latest
 
+      - name: Build and push auth image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfiles/Dockerfile_auth
+          push: true
+          tags: meowgit.nekoea.red/nihonium/nyanimedb-auth:latest
+
       - name: Build and push frontend image
         uses: docker/build-push-action@v6
         with:
@@ -85,7 +101,7 @@ jobs:
           tags: meowgit.nekoea.red/nihonium/nyanimedb-frontend:latest
 
   deploy:
-    runs-on: self-hosted
+    runs-on: debian-test
     needs: build
     env:
       POSTGRES_USER: ${{ secrets.POSTGRES_USER }}
@@ -95,6 +111,12 @@ jobs:
       POSTGRES_VERSION: 18
       LOG_LEVEL: ${{ vars.LOG_LEVEL }}
       DATABASE_URL: ${{ secrets.DATABASE_URL }}
+      SERVICE_ADDRESS: ${{ vars.SERVICE_ADDRESS }}
+      RABBITMQ_URL: ${{ secrets.RABBITMQ_URL }}
+      JWT_PRIVATE_KEY: ${{ secrets.JWT_PRIVATE_KEY }}
+      RABBITMQ_DEFAULT_USER: ${{ secrets.RABBITMQ_USER }}
+      RABBITMQ_DEFAULT_PASS: ${{ secrets.RABBITMQ_PASSWORD }}
+      AUTH_ENABLED: ${{ vars.AUTH_ENABLED }}
 
     steps:
       - name: Checkout code

Dockerfiles/Dockerfile_auth

@@ -0,0 +1,6 @@
+FROM ubuntu:22.04
+
+WORKDIR /app
+COPY --chmod=755 modules/auth/auth /app
+EXPOSE 8082
+ENTRYPOINT ["/app/auth"]

api/_build/oapi-codegen.yaml

@@ -0,0 +1,6 @@
+package: oapi
+generate:
+  strict-server: true
+  gin-server: true
+  models: true
+output: api/api.gen.go

api/_build/openapi.yaml

@@ -0,0 +1,750 @@
+openapi: 3.0.4
+info:
+  title: 'Titles, Users, Reviews, Tags, and Media API'
+  version: 1.0.0
+servers:
+  - url: /api/v1
+paths:
+  /titles:
+    get:
+      summary: Get titles
+      parameters:
+        - $ref: '#/components/parameters/cursor'
+        - $ref: '#/components/parameters/title_sort'
+        - name: sort_forward
+          in: query
+          schema:
+            type: boolean
+            default: true
+        - name: ext_search
+          in: query
+          schema:
+            type: boolean
+            default: false
+        - name: word
+          in: query
+          schema:
+            type: string
+        - name: status
+          in: query
+          description: List of title statuses to filter
+          schema:
+            type: array
+            items:
+              $ref: '#/components/schemas/TitleStatus'
+          explode: false
+          style: form
+        - name: rating
+          in: query
+          schema:
+            type: number
+            format: double
+        - name: release_year
+          in: query
+          schema:
+            type: integer
+            format: int32
+        - name: release_season
+          in: query
+          schema:
+            $ref: '#/components/schemas/ReleaseSeason'
+        - name: limit
+          in: query
+          schema:
+            type: integer
+            format: int32
+            default: 10
+        - name: offset
+          in: query
+          schema:
+            type: integer
+            format: int32
+            default: 0
+        - name: fields
+          in: query
+          schema:
+            type: string
+            default: all
+      responses:
+        '200':
+          description: List of titles with cursor
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    description: List of titles
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/Title'
+                  cursor:
+                    $ref: '#/components/schemas/CursorObj'
+                required:
+                  - data
+                  - cursor
+        '204':
+          description: No titles found
+        '400':
+          description: Request params are not correct
+        '500':
+          description: Unknown server error
+  '/titles/{title_id}':
+    get:
+      operationId: getTitle
+      summary: Get title description
+      parameters:
+        - name: title_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+        - name: fields
+          in: query
+          schema:
+            type: string
+            default: all
+      responses:
+        '200':
+          description: Title description
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/Title'
+        '204':
+          description: No title found
+        '400':
+          description: Request params are not correct
+        '404':
+          description: Title not found
+        '500':
+          description: Unknown server error
+      security:
+        - JwtAuthCookies: []
+  '/users/{user_id}':
+    get:
+      operationId: getUsersId
+      summary: Get user info
+      parameters:
+        - name: user_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: fields
+          in: query
+          schema:
+            type: string
+            default: all
+      responses:
+        '200':
+          description: User info
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+        '400':
+          description: Request params are not correct
+        '404':
+          description: User not found
+        '500':
+          description: Unknown server error
+    patch:
+      operationId: updateUser
+      summary: Partially update a user account
+      description: |
+        Update selected user profile fields (excluding password). 
+        Password updates must be done via the dedicated auth-service (`/auth/`).
+        Fields not provided in the request body remain unchanged.
+      parameters:
+        - name: user_id
+          in: path
+          description: User ID (primary key)
+          required: true
+          schema:
+            type: integer
+            format: int64
+          example: 123
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              description: Only provided fields are updated. Omitted fields remain unchanged.
+              type: object
+              properties:
+                avatar_id:
+                  description: ID of the user avatar (references `images.id`); set to `null` to remove avatar
+                  type: integer
+                  format: int64
+                  example: 42
+                  nullable: true
+                mail:
+                  description: User email (must be unique and valid)
+                  type: string
+                  format: email
+                  example: john.doe.updated@example.com
+                  pattern: '^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\\.[a-zA-Z0-9_-]+$'
+                nickname:
+                  description: 'Username (alphanumeric + `_` or `-`, 3–16 chars)'
+                  type: string
+                  example: john_doe_43
+                  maxLength: 16
+                  minLength: 3
+                  pattern: '^[a-zA-Z0-9_-]{3,16}$'
+                disp_name:
+                  description: Display name
+                  type: string
+                  example: John Smith
+                  maxLength: 32
+                user_desc:
+                  description: User description / bio
+                  type: string
+                  example: Just a curious developer.
+                  maxLength: 512
+              additionalProperties: false
+      responses:
+        '200':
+          description: User updated successfully. Returns updated user representation (excluding sensitive fields).
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/User'
+        '400':
+          description: 'Invalid input (e.g., validation failed, nickname/email conflict, malformed JSON)'
+        '401':
+          description: Unauthorized — missing or invalid authentication token
+        '403':
+          description: 'Forbidden — user is not allowed to modify this resource (e.g., not own profile & no admin rights)'
+        '404':
+          description: User not found
+        '409':
+          description: 'Conflict — e.g., requested `nickname` or `mail` already taken by another user'
+        '422':
+          description: 'Unprocessable Entity — semantic errors not caught by schema (e.g., invalid `avatar_id`)'
+        '500':
+          description: Unknown server error
+      security:
+        - XsrfAuthHeader: []
+  '/users/{user_id}/titles':
+    get:
+      operationId: getUserTitles
+      summary: Get user titles
+      parameters:
+        - $ref: '#/components/parameters/cursor'
+        - $ref: '#/components/parameters/title_sort'
+        - name: user_id
+          in: path
+          required: true
+          schema:
+            type: string
+        - name: sort_forward
+          in: query
+          schema:
+            type: boolean
+            default: true
+        - name: word
+          in: query
+          schema:
+            type: string
+        - name: status
+          in: query
+          description: List of title statuses to filter
+          schema:
+            type: array
+            items:
+              $ref: '#/components/schemas/TitleStatus'
+          explode: false
+          style: form
+        - name: watch_status
+          in: query
+          schema:
+            type: array
+            items:
+              $ref: '#/components/schemas/UserTitleStatus'
+          explode: false
+          style: form
+        - name: rating
+          in: query
+          schema:
+            type: number
+            format: double
+        - name: my_rate
+          in: query
+          schema:
+            type: integer
+            format: int32
+        - name: release_year
+          in: query
+          schema:
+            type: integer
+            format: int32
+        - name: release_season
+          in: query
+          schema:
+            $ref: '#/components/schemas/ReleaseSeason'
+        - name: limit
+          in: query
+          schema:
+            type: integer
+            format: int32
+            default: 10
+        - name: fields
+          in: query
+          schema:
+            type: string
+            default: all
+      responses:
+        '200':
+          description: List of user titles
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    type: array
+                    items:
+                      $ref: '#/components/schemas/UserTitle'
+                  cursor:
+                    $ref: '#/components/schemas/CursorObj'
+                required:
+                  - data
+                  - cursor
+        '204':
+          description: No titles found
+        '400':
+          description: Request params are not correct
+        '404':
+          description: User not found
+        '500':
+          description: Unknown server error
+    post:
+      operationId: addUserTitle
+      summary: Add a title to a user
+      description: 'User adding title to list af watched, status required'
+      parameters:
+        - name: user_id
+          in: path
+          description: ID of the user to assign the title to
+          required: true
+          schema:
+            type: integer
+            format: int64
+          example: 123
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                title_id:
+                  type: integer
+                  format: int64
+                status:
+                  $ref: '#/components/schemas/UserTitleStatus'
+                rate:
+                  type: integer
+                  format: int32
+              required:
+                - title_id
+                - status
+      responses:
+        '200':
+          description: Title successfully added to user
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UserTitleMini'
+        '400':
+          description: 'Invalid request body (missing fields, invalid types, etc.)'
+        '401':
+          description: Unauthorized — missing or invalid auth token
+        '403':
+          description: Forbidden — user not allowed to assign titles to this user
+        '404':
+          description: User or Title not found
+        '409':
+          description: Conflict — title already assigned to user (if applicable)
+        '500':
+          description: Internal server error
+  '/users/{user_id}/titles/{title_id}':
+    get:
+      operationId: getUserTitle
+      summary: Get user title
+      parameters:
+        - name: user_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+        - name: title_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+      responses:
+        '200':
+          description: User titles
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UserTitleMini'
+        '204':
+          description: No user title found
+        '400':
+          description: Request params are not correct
+        '404':
+          description: User or title not found
+        '500':
+          description: Unknown server error
+    patch:
+      operationId: updateUserTitle
+      summary: Update a usertitle
+      description: User updating title list of watched
+      parameters:
+        - name: user_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+        - name: title_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                status:
+                  $ref: '#/components/schemas/UserTitleStatus'
+                rate:
+                  type: integer
+                  format: int32
+      responses:
+        '200':
+          description: Title successfully updated
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/UserTitleMini'
+        '400':
+          description: 'Invalid request body (missing fields, invalid types, etc.)'
+        '401':
+          description: Unauthorized — missing or invalid auth token
+        '403':
+          description: Forbidden — user not allowed to update title
+        '404':
+          description: User or Title not found
+        '500':
+          description: Internal server error
+      security:
+        - XsrfAuthHeader: []
+    delete:
+      operationId: deleteUserTitle
+      summary: Delete a usertitle
+      description: User deleting title from list of watched
+      parameters:
+        - name: user_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+        - name: title_id
+          in: path
+          required: true
+          schema:
+            type: integer
+            format: int64
+      responses:
+        '200':
+          description: Title successfully deleted
+        '401':
+          description: Unauthorized — missing or invalid auth token
+        '403':
+          description: Forbidden — user not allowed to delete title
+        '404':
+          description: User or Title not found
+        '500':
+          description: Internal server error
+      security:
+        - XsrfAuthHeader: []
+components:
+  parameters:
+    cursor:
+      in: query
+      name: cursor
+      required: false
+      schema:
+        type: string
+    title_sort:
+      in: query
+      name: sort
+      required: false
+      schema:
+        $ref: '#/components/schemas/TitleSort'
+  schemas:
+    TitleSort:
+      description: Title sort order
+      type: string
+      default: id
+      enum:
+        - id
+        - year
+        - rating
+        - views
+    TitleStatus:
+      description: Title status
+      type: string
+      enum:
+        - finished
+        - ongoing
+        - planned
+    ReleaseSeason:
+      description: Title release season
+      type: string
+      enum:
+        - winter
+        - spring
+        - summer
+        - fall
+    StorageType:
+      description: Image storage type
+      type: string
+      enum:
+        - s3
+        - local
+    Image:
+      type: object
+      properties:
+        id:
+          type: integer
+          format: int64
+        storage_type:
+          $ref: '#/components/schemas/StorageType'
+        image_path:
+          type: string
+    Studio:
+      type: object
+      properties:
+        id:
+          type: integer
+          format: int64
+        name:
+          type: string
+        poster:
+          $ref: '#/components/schemas/Image'
+        description:
+          type: string
+      required:
+        - id
+        - name
+    Tag:
+      description: 'A localized tag: keys are language codes (ISO 639-1), values are tag names'
+      type: object
+      example:
+        en: Shojo
+        ru: Сёдзё
+        ja: 少女
+      additionalProperties:
+        type: string
+    Tags:
+      description: Array of localized tags
+      type: array
+      items:
+        $ref: '#/components/schemas/Tag'
+      example:
+        - en: Shojo
+          ru: Сёдзё
+          ja: 少女
+        - en: Shounen
+          ru: Сёнен
+          ja: 少年
+    Title:
+      type: object
+      properties:
+        id:
+          description: Unique title ID (primary key)
+          type: integer
+          format: int64
+          example: 1
+        title_names:
+          description: 'Localized titles. Key = language (ISO 639-1), value = list of names'
+          type: object
+          example:
+            en:
+              - Attack on Titan
+              - AoT
+            ru:
+              - Атака титанов
+              - Титаны
+            ja:
+              - 進撃の巨人
+          additionalProperties:
+            type: array
+            items:
+              type: string
+              example: Attack on Titan
+            minItems: 1
+            example:
+              - Attack on Titan
+              - AoT
+        studio:
+          $ref: '#/components/schemas/Studio'
+        tags:
+          $ref: '#/components/schemas/Tags'
+        poster:
+          $ref: '#/components/schemas/Image'
+        title_status:
+          $ref: '#/components/schemas/TitleStatus'
+        rating:
+          type: number
+          format: double
+        rating_count:
+          type: integer
+          format: int32
+        release_year:
+          type: integer
+          format: int32
+        release_season:
+          $ref: '#/components/schemas/ReleaseSeason'
+        episodes_aired:
+          type: integer
+          format: int32
+        episodes_all:
+          type: integer
+          format: int32
+        episodes_len:
+          type: object
+          additionalProperties:
+            type: number
+            format: double
+      required:
+        - id
+        - title_names
+        - tags
+    CursorObj:
+      type: object
+      properties:
+        id:
+          type: integer
+          format: int64
+        param:
+          type: string
+      required:
+        - id
+    User:
+      type: object
+      properties:
+        id:
+          description: Unique user ID (primary key)
+          type: integer
+          format: int64
+          example: 1
+        image:
+          $ref: '#/components/schemas/Image'
+        mail:
+          description: User email
+          type: string
+          format: email
+          example: john.doe@example.com
+        nickname:
+          description: Username (alphanumeric + _ or -)
+          type: string
+          example: john_doe_42
+          maxLength: 16
+        disp_name:
+          description: Display name
+          type: string
+          example: John Doe
+          maxLength: 32
+        user_desc:
+          description: User description
+          type: string
+          example: Just a regular user.
+          maxLength: 512
+        creation_date:
+          description: Timestamp when the user was created
+          type: string
+          format: date-time
+          example: '2025-10-10T23:45:47.908073Z'
+      required:
+        - user_id
+        - nickname
+    UserTitleStatus:
+      description: User's title status
+      type: string
+      enum:
+        - finished
+        - planned
+        - dropped
+        - in-progress
+    UserTitle:
+      type: object
+      properties:
+        user_id:
+          type: integer
+          format: int64
+        title:
+          $ref: '#/components/schemas/Title'
+        status:
+          $ref: '#/components/schemas/UserTitleStatus'
+        rate:
+          type: integer
+          format: int32
+        review_id:
+          type: integer
+          format: int64
+        ctime:
+          type: string
+          format: date-time
+      required:
+        - user_id
+        - title_id
+        - status
+    UserTitleMini:
+      type: object
+      properties:
+        user_id:
+          type: integer
+          format: int64
+        title_id:
+          type: integer
+          format: int64
+        status:
+          $ref: '#/components/schemas/UserTitleStatus'
+        rate:
+          type: integer
+          format: int32
+        review_id:
+          type: integer
+          format: int64
+        ctime:
+          type: string
+          format: date-time
+      required:
+        - user_id
+        - title_id
+        - status
+    Review:
+      type: object
+      additionalProperties: true
+  securitySchemes:
+    XsrfAuthHeader:
+      type: apiKey
+      in: header
+      name: X-XSRF-TOKEN
+      description: |
+        Anti-CSRF token. Must match the `XSRF-TOKEN` cookie.
+        Required for all state-changing requests (POST/PUT/PATCH/DELETE).

api/openapi.yaml

@@ -1,4 +1,4 @@
-openapi: 3.1.1
+openapi: 3.0.4
 info:
   title: Titles, Users, Reviews, Tags, and Media API
   version: 1.0.0
@@ -7,754 +7,21 @@ servers:
   - url: /api/v1
 
 paths:
-  /title:
-    get:
-      summary: Get titles
-      parameters:
-        - in: query
-          name: word
-          schema:
-            type: string
-        - in: query
-          name: status
-          schema:
-            $ref: '#/components/schemas/TitleStatus'
-        - in: query
-          name: rating
-          schema:
-            type: number
-            format: double
-        - in: query
-          name: release_year
-          schema:
-            type: integer
-            format: int32
-        - in: query
-          name: release_season
-          schema:
-            $ref: '#/components/schemas/ReleaseSeason'
-        - in: query
-          name: limit
-          schema:
-            type: integer
-            format: int32
-            default: 10
-        - in: query
-          name: offset
-          schema:
-            type: integer
-            format: int32
-            default: 0
-        - in: query
-          name: fields
-          schema:
-            type: string
-            default: all
-      responses:
-        '200':
-          description: List of titles
-          content:
-            application/json:
-              schema:
-                type: array
-                items:
-                  $ref: '#/components/schemas/Title'
-        '204':
-          description: No titles found
-        '400':
-          description: Request params are not correct
-        '500':
-          description: Unknown server error
-
-  /title/{title_id}:
-    get:
-      summary: Get title description
-      parameters:
-        - in: path
-          name: title_id
-          required: true
-          schema:
-            type: integer
-            format: int64
-        - in: query
-          name: fields
-          schema:
-            type: string
-            default: all
-      responses:
-        '200':
-          description: Title description
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Title'
-        '404':
-          description: Title not found
-        '400':
-          description: Request params are not correct
-        '500':
-          description: Unknown server error
-        '204':
-          description: No title found
-
-#     patch:
-#       summary: Update title info
-#       parameters:
-#         - in: path
-#           name: title_id
-#           required: true
-#           schema:
-#             type: string
-#       requestBody:
-#         required: true
-#         content:
-#           application/json:
-#             schema:
-#               $ref: '#/components/schemas/Title'
-#       responses:
-#         '200':
-#           description: Update result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-#                   user_json:
-#                     $ref: '#/components/schemas/User'
-
-#   /title/{title_id}/reviews:
-#     get:
-#       summary: Get title reviews
-#       parameters:
-#         - in: path
-#           name: title_id
-#           required: true
-#           schema:
-#             type: string
-#         - in: query
-#           name: limit
-#           schema:
-#             type: integer
-#             default: 10
-#         - in: query
-#           name: offset
-#           schema:
-#             type: integer
-#             default: 0
-#       responses:
-#         '200':
-#           description: List of reviews
-#           content:
-#             application/json:
-#               schema:
-#                 type: array
-#                 items:
-#                   $ref: '#/components/schemas/Review'
-#         '204':
-#           description: No reviews found
-
+  /titles:
+    $ref: "./paths/titles.yaml"
+  /titles/{title_id}:
+    $ref: "./paths/titles-id.yaml"
   /users/{user_id}:
-    get:
-      summary: Get user info
-      parameters:
-        - in: path
-          name: user_id
-          required: true
-          schema:
-            type: string
-        - in: query
-          name: fields
-          schema:
-            type: string
-            default: all
-      responses:
-        '200':
-          description: User info
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/User'
-        '404':
-          description: User not found
-        '400':
-          description: Request params are not correct
-        '500':
-          description: Unknown server error
-
-    # patch:
-    #   summary: Update user
-    #   parameters:
-    #     - in: path
-    #       name: user_id
-    #       required: true
-    #       schema:
-    #         type: string
-    #   requestBody:
-    #     required: true
-    #     content:
-    #       application/json:
-    #         schema:
-    #           $ref: '#/components/schemas/User'
-    #   responses:
-    #     '200':
-    #       description: Update result
-    #       content:
-    #         application/json:
-    #           schema:
-    #             type: object
-    #             properties:
-    #               success:
-    #                 type: boolean
-    #               error:
-    #                 type: string
-
-    # delete:
-    #   summary: Delete user
-    #   parameters:
-    #     - in: path
-    #       name: user_id
-    #       required: true
-    #       schema:
-    #         type: string
-    #   responses:
-    #     '200':
-    #       description: Delete result
-    #       content:
-    #         application/json:
-    #           schema:
-    #             type: object
-    #             properties:
-    #               success:
-    #                 type: boolean
-    #               error:
-    #                 type: string
-
-  /users:
-  #   get:
-  #     summary: Search user
-  #     parameters:
-  #       - in: query
-  #         name: query
-  #         schema:
-  #           type: string
-  #       - in: query
-  #         name: fields
-  #         schema:
-  #           type: string
-  #     responses:
-  #       '200':
-  #         description: List of users
-  #         content:
-  #           application/json:
-  #             schema:
-  #               type: array
-  #               items:
-  #                 $ref: '#/components/schemas/User'
-
-    # post:
-    #   summary: Add new user
-    #   requestBody:
-    #     required: true
-    #     content:
-    #       application/json:
-    #         schema:
-    #           $ref: '#/components/schemas/User'
-    #   responses:
-    #     '200':
-    #       description: Add result
-    #       content:
-    #         application/json:
-    #           schema:
-    #             type: object
-    #             properties:
-    #               success:
-    #                 type: boolean
-    #               error:
-    #                 type: string
-    #               user_json:
-    #                 $ref: '#/components/schemas/User'
-
-#   /users/{user_id}/titles:
-#     get:
-#       summary: Get user titles
-#       parameters:
-#         - in: path
-#           name: user_id
-#           required: true
-#           schema:
-#             type: string
-#         - in: query
-#           name: query
-#           schema:
-#             type: string
-#         - in: query
-#           name: limit
-#           schema:
-#             type: integer
-#             default: 10
-#         - in: query
-#           name: offset
-#           schema:
-#             type: integer
-#             default: 0
-#         - in: query
-#           name: fields
-#           schema:
-#             type: string
-#             default: all
-#       responses:
-#         '200':
-#           description: List of user titles
-#           content:
-#             application/json:
-#               schema:
-#                 type: array
-#                 items:
-#                   $ref: '#/components/schemas/UserTitle'
-#         '204':
-#           description: No titles found
-
-#     post:
-#       summary: Add user title
-#       parameters:
-#         - in: path
-#           name: user_id
-#           required: true
-#           schema:
-#             type: string
-#       requestBody:
-#         required: true
-#         content:
-#           application/json:
-#             schema:
-#               type: object
-#               properties:
-#                 title_id:
-#                   type: string
-#                 status:
-#                   type: string
-#       responses:
-#         '200':
-#           description: Add result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-
-#     patch:
-#       summary: Update user title
-#       parameters:
-#         - in: path
-#           name: user_id
-#           required: true
-#           schema:
-#             type: string
-#       requestBody:
-#         required: true
-#         content:
-#           application/json:
-#             schema:
-#               $ref: '#/components/schemas/UserTitle'
-#       responses:
-#         '200':
-#           description: Update result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-
-#     delete:
-#       summary: Delete user title
-#       parameters:
-#         - in: path
-#           name: user_id
-#           required: true
-#           schema:
-#             type: string
-#         - in: query
-#           name: title_id
-#           schema:
-#             type: string
-#       responses:
-#         '200':
-#           description: Delete result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-
-#   /users/{user_id}/reviews:
-#     get:
-#       summary: Get user reviews
-#       parameters:
-#         - in: path
-#           name: user_id
-#           required: true
-#           schema:
-#             type: string
-#         - in: query
-#           name: limit
-#           schema:
-#             type: integer
-#             default: 10
-#         - in: query
-#           name: offset
-#           schema:
-#             type: integer
-#             default: 0
-#       responses:
-#         '200':
-#           description: List of reviews
-#           content:
-#             application/json:
-#               schema:
-#                 type: array
-#                 items:
-#                   $ref: '#/components/schemas/Review'
-
-#   /reviews:
-#     post:
-#       summary: Add review
-#       requestBody:
-#         required: true
-#         content:
-#           application/json:
-#             schema:
-#               $ref: '#/components/schemas/Review'
-#       responses:
-#         '200':
-#           description: Add result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-
-#   /reviews/{review_id}:
-#     patch:
-#       summary: Update review
-#       parameters:
-#         - in: path
-#           name: review_id
-#           required: true
-#           schema:
-#             type: string
-#       requestBody:
-#         required: true
-#         content:
-#           application/json:
-#             schema:
-#               $ref: '#/components/schemas/Review'
-#       responses:
-#         '200':
-#           description: Update result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-#     delete:
-#       summary: Delete review
-#       parameters:
-#         - in: path
-#           name: review_id
-#           required: true
-#           schema:
-#             type: string
-#       responses:
-#         '200':
-#           description: Delete result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-
-#   /tags:
-#     get:
-#       summary: Get tags
-#       parameters:
-#         - in: query
-#           name: limit
-#           schema:
-#             type: integer
-#             default: 10
-#         - in: query
-#           name: offset
-#           schema:
-#             type: integer
-#             default: 0
-#         - in: query
-#           name: fields
-#           schema:
-#             type: string
-#       responses:
-#         '200':
-#           description: List of tags
-#           content:
-#             application/json:
-#               schema:
-#                 type: array
-#                 items:
-#                   $ref: '#/components/schemas/Tag'
-
-#   /media:
-#     post:
-#       summary: Upload image
-#       responses:
-#         '200':
-#           description: Upload result
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-#                   image_id:
-#                     type: string
-
-#     get:
-#       summary: Get image path
-#       parameters:
-#         - in: query
-#           name: image_id
-#           required: true
-#           schema:
-#             type: string
-#       responses:
-#         '200':
-#           description: Image path
-#           content:
-#             application/json:
-#               schema:
-#                 type: object
-#                 properties:
-#                   success:
-#                     type: boolean
-#                   error:
-#                     type: string
-#                   image_path:
-#                     type: string
+    $ref: "./paths/users-id.yaml"
+  /users/{user_id}/titles:
+    $ref: "./paths/users-id-titles.yaml"
+  /users/{user_id}/titles/{title_id}:
+    $ref: "./paths/users-id-titles-id.yaml"
 
 components:
+  parameters:
+    $ref: "./parameters/_index.yaml"
   schemas:
-    Image:
-      type: object
-      properties:
-        id:
-          type: integer
-          format: int64
-        storage_type:
-          type: string
-        image_path:
-          type: string
-
-    TitleStatus:
-      type: string
-      description: Title status
-      enum:
-        - finished
-        - ongoing
-        - planned
-
-    ReleaseSeason:
-      type: string
-      description: Title release season
-      enum:
-        - winter
-        - spring
-        - summer
-        - fall
-
-    UserTitleStatus:
-      type: string
-      description: User's title status
-      enum:
-        - finished
-        - planned
-        - dropped
-        - in-progress
-
-    Review:
-      type: object
-      additionalProperties: true
-
-    Tag:
-      type: object
-      description: "A localized tag: keys are language codes (ISO 639-1), values are tag names"
-      additionalProperties:
-        type: string
-      example:
-        en: "Shojo"
-        ru: "Сёдзё"
-        ja: "少女"
-
-    Tags:
-      type: array
-      description: "Array of localized tags"
-      items:
-        $ref: '#/components/schemas/Tag'
-      example:
-        - en: "Shojo"
-          ru: "Сёдзё"
-          ja: "少女"
-        - en: "Shounen"
-          ru: "Сёнен"
-          ja: "少年"
-
-    Studio:
-      type: object
-      required:
-        - id
-        - name
-      properties:
-        id:
-          type: integer
-          format: int64
-        name:
-          type: string
-        poster:
-          $ref: '#/components/schemas/Image'
-        description:
-          type: string
-
-
-    Title:
-      type: object
-      required:
-        - id
-        - title_names
-        - tags
-      properties:
-        id:
-          type: integer
-          format: int64
-          description: Unique title ID (primary key)
-          example: 1
-        title_names:
-          type: object
-          description: "Localized titles. Key = language (ISO 639-1), value = list of names"
-          additionalProperties:
-            type: array
-            items:
-              type: string
-              example: "Attack on Titan"
-            minItems: 1
-            example: ["Attack on Titan", "AoT"]
-          example:
-            en: ["Attack on Titan", "AoT"]
-            ru: ["Атака титанов", "Титаны"]
-            ja: ["進撃の巨人"]
-        studio:
-          $ref: '#/components/schemas/Studio'
-        tags:
-          $ref: '#/components/schemas/Tags'
-        poster:
-          $ref: '#/components/schemas/Image'
-        title_status:
-          $ref: '#/components/schemas/TitleStatus'
-        rating:
-          type: number
-          format: double
-        rating_count:
-          type: integer
-          format: int32
-        release_year:
-          type: integer
-          format: int32
-        release_season:
-          $ref: '#/components/schemas/ReleaseSeason'
-        episodes_aired:
-          type: integer
-          format: int32
-        episodes_all:
-          type: integer
-          format: int32
-        episodes_len:
-          type: object
-          additionalProperties:
-            type: number
-            format: double
-      additionalProperties: true
-
-    User:
-      type: object
-      properties:
-        id:
-          type: integer
-          format: int64
-          description: Unique user ID (primary key)
-          example: 1
-        avatar_id:
-          type: integer
-          format: int64
-          description: ID of the user avatar (references images table)
-          nullable: true
-          example: null
-        mail:
-          type: string
-          format: email
-          description: User email
-          example: "john.doe@example.com"
-        nickname:
-          type: string
-          description: Username (alphanumeric + _ or -)
-          maxLength: 16
-          example: "john_doe_42"
-        disp_name:
-          type: string
-          description: Display name
-          maxLength: 32
-          example: "John Doe"
-        user_desc:
-          type: string
-          description: User description
-          maxLength: 512
-          example: "Just a regular user."
-        creation_date:
-          type: string
-          format: date-time
-          description: Timestamp when the user was created
-          example: "2025-10-10T23:45:47.908073Z"
-      required:
-        - user_id
-        - nickname
-        # - creation_date
-
-    UserTitle:
-      type: object
-      additionalProperties: true
+    $ref: "./schemas/_index.yaml"
+  securitySchemes:
+    $ref: "./securitySchemes/_index.yaml"

api/parameters/_index.yaml

@@ -0,0 +1,4 @@
+cursor:
+  $ref: "./cursor.yaml"
+title_sort:
+  $ref: "./title_sort.yaml"

api/parameters/cursor.yaml

@@ -0,0 +1,5 @@
+in: query
+name: cursor
+required: false
+schema:
+  type: string

api/parameters/title_sort.yaml

@@ -0,0 +1,5 @@
+in: query
+name: sort
+required: false
+schema:
+  $ref: '../schemas/TitleSort.yaml'

api/paths/titles-id.yaml

@@ -0,0 +1,32 @@
+get:
+  summary: Get title description
+  security:
+  - JwtAuthCookies: []
+  operationId: getTitle
+  parameters:
+    - in: path
+      name: title_id
+      required: true
+      schema:
+        type: integer
+        format: int64
+    - in: query
+      name: fields
+      schema:
+        type: string
+        default: all
+  responses:
+    '200':
+      description: Title description
+      content:
+        application/json:
+          schema:
+            $ref: "../schemas/Title.yaml"
+    '404':
+      description: Title not found
+    '400':
+      description: Request params are not correct
+    '500':
+      description: Unknown server error
+    '204':
+      description: No title found

api/paths/titles.yaml

@@ -0,0 +1,83 @@
+get:
+  summary: Get titles
+  parameters:
+    - $ref: "../parameters/cursor.yaml"
+    - $ref: "../parameters/title_sort.yaml"
+    - in: query
+      name: sort_forward
+      schema:
+        type: boolean
+        default: true
+    - in: query
+      name: ext_search
+      schema:
+        type: boolean
+        default: false
+    - in: query
+      name: word
+      schema:
+        type: string
+    - in: query
+      name: status
+      schema:
+        type: array
+        items:
+          $ref: '../schemas/enums/TitleStatus.yaml'
+      description: List of title statuses to filter
+      style: form
+      explode: false
+    - in: query
+      name: rating
+      schema:
+        type: number
+        format: double
+    - in: query
+      name: release_year
+      schema:
+        type: integer
+        format: int32
+    - in: query
+      name: release_season
+      schema:
+        $ref: '../schemas/enums/ReleaseSeason.yaml'
+    - in: query
+      name: limit
+      schema:
+        type: integer
+        format: int32
+        default: 10
+    - in: query
+      name: offset
+      schema:
+        type: integer
+        format: int32
+        default: 0
+    - in: query
+      name: fields
+      schema:
+        type: string
+        default: all
+  responses:
+    '200':
+      description: List of titles with cursor
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              data:
+                type: array
+                items:
+                  $ref: '../schemas/Title.yaml'
+                description: List of titles
+              cursor:
+                $ref: '../schemas/CursorObj.yaml'
+            required:
+            - data
+            - cursor
+    '204':
+      description: No titles found
+    '400':
+      description: Request params are not correct
+    '500':
+      description: Unknown server error

api/paths/users-id-titles-id.yaml

@@ -0,0 +1,111 @@
+get:
+  summary: Get user title
+  operationId: getUserTitle
+  parameters:
+  - in: path
+    name: user_id
+    required: true
+    schema:
+      type: integer
+      format: int64
+  - in: path
+    name: title_id
+    required: true
+    schema:
+      type: integer
+      format: int64
+  responses:
+    '200':
+      description: User titles
+      content:
+        application/json:
+          schema:
+            $ref: '../schemas/UserTitleMini.yaml'
+    '204':
+      description: No user title found
+    '400':
+      description: Request params are not correct
+    '404':
+      description: User or title not found
+    '500':
+      description: Unknown server error
+
+patch:
+  summary: Update a usertitle
+  description: User updating title list of watched
+  operationId: updateUserTitle
+  security:
+    - XsrfAuthHeader: []
+  parameters:
+  - in: path
+    name: user_id
+    required: true
+    schema:
+      type: integer
+      format: int64
+  - in: path
+    name: title_id
+    required: true
+    schema:
+      type: integer
+      format: int64
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          type: object
+          properties:
+            status:
+              $ref: '../schemas/enums/UserTitleStatus.yaml'
+            rate:
+              type: integer
+              format: int32
+  responses:
+    '200':
+      description: Title successfully updated
+      content:
+        application/json:
+          schema:
+            $ref: '../schemas/UserTitleMini.yaml'
+    '400':
+      description: Invalid request body (missing fields, invalid types, etc.)
+    '401':
+      description: Unauthorized — missing or invalid auth token
+    '403':
+      description: Forbidden — user not allowed to update title
+    '404':
+      description: User or Title not found
+    '500':
+      description: Internal server error
+
+delete:
+  summary: Delete a usertitle
+  description: User deleting title from list of watched
+  operationId: deleteUserTitle
+  security:
+    - XsrfAuthHeader: []
+  parameters:
+  - in: path
+    name: user_id
+    required: true
+    schema:
+      type: integer
+      format: int64
+  - in: path
+    name: title_id
+    required: true
+    schema:
+      type: integer
+      format: int64
+  responses:
+    '200':
+      description: Title successfully deleted
+    '401':
+      description: Unauthorized — missing or invalid auth token
+    '403':
+      description: Forbidden — user not allowed to delete title
+    '404':
+      description: User or Title not found
+    '500':
+      description: Internal server error

api/paths/users-id-titles.yaml

@@ -0,0 +1,143 @@
+get:
+  summary: Get user titles
+  operationId: getUserTitles
+  parameters:
+  - $ref: '../parameters/cursor.yaml'
+  - $ref: "../parameters/title_sort.yaml"
+  - in: path
+    name: user_id
+    required: true
+    schema:
+      type: string
+  - in: query
+    name: sort_forward
+    schema:
+      type: boolean
+      default: true
+  - in: query
+    name: word
+    schema:
+      type: string
+  - in: query
+    name: status
+    schema:
+      type: array
+      items:
+        $ref: '../schemas/enums/TitleStatus.yaml'
+    description: List of title statuses to filter
+    style: form
+    explode: false
+  - in: query
+    name: watch_status
+    schema:
+      type: array
+      items:
+        $ref: '../schemas/enums/UserTitleStatus.yaml'
+    style: form
+    explode: false
+  - in: query
+    name: rating
+    schema:
+      type: number
+      format: double
+  - in: query
+    name: my_rate
+    schema:
+      type: integer
+      format: int32
+  - in: query
+    name: release_year
+    schema:
+      type: integer
+      format: int32
+  - in: query
+    name: release_season
+    schema:
+      $ref: '../schemas/enums/ReleaseSeason.yaml'
+  - in: query
+    name: limit
+    schema:
+      type: integer
+      format: int32
+      default: 10
+  - in: query
+    name: fields
+    schema:
+      type: string
+      default: all
+  responses:
+    '200':
+      description: List of user titles
+      content:
+        application/json:
+          schema:
+            type: object
+            properties:
+              data:
+                type: array
+                items:
+                  $ref: '../schemas/UserTitle.yaml'
+              cursor:
+                $ref: '../schemas/CursorObj.yaml'
+            required:
+            - data
+            - cursor
+    '204':
+      description: No titles found
+    '400':
+      description: Request params are not correct
+    '404':
+      description: User not found
+    '500':
+      description: Unknown server error
+
+post:
+  summary: Add a title to a user
+  description: User adding title to list af watched, status required
+  operationId: addUserTitle
+  parameters:
+    - name: user_id
+      in: path
+      required: true
+      schema:
+        type: integer
+        format: int64
+      description: ID of the user to assign the title to
+      example: 123
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          type: object
+          required:
+            - title_id
+            - status
+          properties:
+            title_id:
+              type: integer
+              format: int64
+            status:
+              $ref: '../schemas/enums/UserTitleStatus.yaml'
+            rate:
+              type: integer
+              format: int32
+  responses:
+    '200':
+      description: Title successfully added to user
+      content:
+        application/json:
+          schema:
+            $ref: '../schemas/UserTitleMini.yaml'
+    '400':
+      description: Invalid request body (missing fields, invalid types, etc.)
+    '401':
+      description: Unauthorized — missing or invalid auth token
+    '403':
+      description: Forbidden — user not allowed to assign titles to this user
+    '404':
+      description: User or Title not found
+    '409':
+      description: Conflict — title already assigned to user (if applicable)
+    '500':
+      description: Internal server error

api/paths/users-id.yaml

@@ -0,0 +1,106 @@
+get:
+  summary: Get user info
+  operationId: getUsersId
+  parameters:
+  - in: path
+    name: user_id
+    required: true
+    schema:
+      type: string
+  - in: query
+    name: fields
+    schema:
+      type: string
+      default: all
+  responses:
+    '200':
+      description: User info
+      content:
+        application/json:
+          schema:
+            $ref: '../schemas/User.yaml'
+    '404':
+      description: User not found
+    '400':
+      description: Request params are not correct
+    '500':
+      description: Unknown server error
+
+patch:
+  summary: Partially update a user account
+  description: |
+    Update selected user profile fields (excluding password). 
+    Password updates must be done via the dedicated auth-service (`/auth/`).
+    Fields not provided in the request body remain unchanged.
+  operationId: updateUser
+  security:
+    - XsrfAuthHeader: []
+  parameters:
+    # - $ref: '../parameters/xsrf_token_header.yaml'
+    - name: user_id
+      in: path
+      required: true
+      schema:
+        type: integer
+        format: int64
+      description: User ID (primary key)
+      example: 123
+  requestBody:
+    required: true
+    content:
+      application/json:
+        schema:
+          type: object
+          properties:
+            avatar_id:
+              type: integer
+              format: int64
+              nullable: true
+              description: ID of the user avatar (references `images.id`); set to `null` to remove avatar
+              example: 42
+            mail:
+              type: string
+              format: email
+              pattern: '^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\\.[a-zA-Z0-9_-]+$'
+              description: User email (must be unique and valid)
+              example: john.doe.updated@example.com
+            nickname:
+              type: string
+              pattern: '^[a-zA-Z0-9_-]{3,16}$'
+              description: Username (alphanumeric + `_` or `-`, 3–16 chars)
+              maxLength: 16
+              minLength: 3
+              example: john_doe_43
+            disp_name:
+              type: string
+              description: Display name
+              maxLength: 32
+              example: John Smith
+            user_desc:
+              type: string
+              description: User description / bio
+              maxLength: 512
+              example: Just a curious developer.
+          additionalProperties: false
+          description: Only provided fields are updated. Omitted fields remain unchanged.
+  responses:
+    '200':
+      description: User updated successfully. Returns updated user representation (excluding sensitive fields).
+      content:
+        application/json:
+          schema:
+            $ref: '../schemas/User.yaml'
+    '400':
+      description: Invalid input (e.g., validation failed, nickname/email conflict, malformed JSON)
+    '401':
+      description: Unauthorized — missing or invalid authentication token
+    '403':
+      description: Forbidden — user is not allowed to modify this resource (e.g., not own profile & no admin rights)
+    '404':
+      description: User not found
+    '409':
+      description: Conflict — e.g., requested `nickname` or `mail` already taken by another user
+    '422':
+      description: Unprocessable Entity — semantic errors not caught by schema (e.g., invalid `avatar_id`)
+    '500':
+      description: Unknown server error

api/schemas/CursorObj.yaml

@@ -0,0 +1,9 @@
+type: object
+required:
+  - id
+properties:
+  id:
+    type: integer
+    format: int64
+  param:
+    type: string

api/schemas/Image.yaml

@@ -0,0 +1,10 @@
+type: object
+properties:
+# id выпиливаем
+  id: 
+    type: integer
+    format: int64
+  storage_type:
+    $ref: './enums/StorageType.yaml'
+  image_path:
+    type: string

api/schemas/JWTAuth.yaml

@@ -0,0 +1,7 @@
+# type: apiKey
+# in: cookie
+# name: access_token
+# scheme: bearer
+# bearerFormat: JWT
+# description: |
+#   JWT access token sent in `Cookie: access_token=...`.

api/schemas/Review.yaml

@@ -0,0 +1,2 @@
+type: object
+additionalProperties: true

api/schemas/Studio.yaml

@@ -0,0 +1,15 @@
+type: object
+required:
+  - id
+  - name
+properties:
+# id не нужен
+  id:
+    type: integer
+    format: int64
+  name:
+    type: string
+  poster:
+    $ref: ./Image.yaml
+  description:
+    type: string

api/schemas/Tag.yaml

@@ -0,0 +1,8 @@
+type: object
+description: 'A localized tag: keys are language codes (ISO 639-1), values are tag names'
+additionalProperties:
+  type: string
+example:
+  en: Shojo
+  ru: Сёдзё
+  ja: 少女

api/schemas/Tags.yaml

@@ -0,0 +1,11 @@
+type: array
+description: Array of localized tags
+items:
+  $ref: ./Tag.yaml
+example:
+- en: Shojo
+  ru: Сёдзё
+  ja: 少女
+- en: Shounen
+  ru: Сёнен
+  ja: 少年

api/schemas/Title.yaml

@@ -0,0 +1,62 @@
+type: object
+required:
+  - id
+  - title_names
+  - tags
+properties:
+  id:
+    type: integer
+    format: int64
+    description: Unique title ID (primary key)
+    example: 1
+  title_names:
+    type: object
+    description: Localized titles. Key = language (ISO 639-1), value = list of names
+    additionalProperties:
+      type: array
+      items:
+        type: string
+        example: Attack on Titan
+      minItems: 1
+      example:
+        - Attack on Titan
+        - AoT
+    example:
+      en:
+        - Attack on Titan
+        - AoT
+      ru:
+        - Атака титанов
+        - Титаны
+      ja:
+        - 進撃の巨人
+  studio:
+    $ref: ./Studio.yaml
+  tags:
+    $ref: ./Tags.yaml
+  poster:
+    $ref: ./Image.yaml
+  title_status:
+    $ref: ./enums/TitleStatus.yaml
+  rating:
+    type: number
+    format: double
+  rating_count:
+    type: integer
+    format: int32
+  release_year:
+    type: integer
+    format: int32
+  release_season:
+    $ref: ./enums/ReleaseSeason.yaml
+  episodes_aired:
+    type: integer
+    format: int32
+  episodes_all:
+    type: integer
+    format: int32
+  episodes_len:
+    type: object
+    additionalProperties:
+      type: number
+      format: double

api/schemas/TitleSort.yaml

@@ -0,0 +1,8 @@
+type: string
+description: Title sort order
+default: id
+enum:
+  - id
+  - year
+  - rating
+  - views

api/schemas/User.yaml

@@ -0,0 +1,37 @@
+type: object
+properties:
+  id:
+    type: integer
+    format: int64
+    description: Unique user ID (primary key)
+    example: 1
+  image:
+    $ref: '../schemas/Image.yaml'
+  mail:
+    type: string
+    format: email
+    description: User email
+    example: john.doe@example.com
+  nickname:
+    type: string
+    description: Username (alphanumeric + _ or -)
+    maxLength: 16
+    example: john_doe_42
+  disp_name:
+    type: string
+    description: Display name
+    maxLength: 32
+    example: John Doe
+  user_desc:
+    type: string
+    description: User description
+    maxLength: 512
+    example: Just a regular user.
+  creation_date:
+    type: string
+    format: date-time
+    description: Timestamp when the user was created
+    example: '2025-10-10T23:45:47.908073Z'
+required:
+  - user_id
+  - nickname

api/schemas/UserTitle.yaml

@@ -0,0 +1,22 @@
+type: object
+required:
+  - user_id
+  - title_id
+  - status
+properties:
+  user_id:
+    type: integer
+    format: int64
+  title:
+    $ref: ./Title.yaml
+  status:
+    $ref: ./enums/UserTitleStatus.yaml
+  rate:
+    type: integer
+    format: int32
+  review_id:
+    type: integer
+    format: int64
+  ctime:
+    type: string
+    format: date-time

api/schemas/UserTitleMini.yaml

@@ -0,0 +1,23 @@
+type: object
+required:
+  - user_id
+  - title_id
+  - status
+properties:
+  user_id:
+    type: integer
+    format: int64
+  title_id:
+    type: integer
+    format: int64
+  status:
+    $ref: ./enums/UserTitleStatus.yaml
+  rate:
+    type: integer
+    format: int32
+  review_id:
+    type: integer
+    format: int64
+  ctime:
+    type: string
+    format: date-time

api/schemas/_index.yaml

@@ -0,0 +1,28 @@
+CursorObj:
+  $ref: "./CursorObj.yaml"
+TitleSort:
+  $ref: "./TitleSort.yaml"
+Image:
+  $ref: "./Image.yaml"
+TitleStatus:
+  $ref: "./enums/TitleStatus.yaml"
+ReleaseSeason:
+  $ref: "./enums/ReleaseSeason.yaml"
+UserTitleStatus:
+  $ref: "./enums/UserTitleStatus.yaml"
+Review:
+  $ref: "./Review.yaml"
+Tag:
+  $ref: "./Tag.yaml"
+Tags:
+  $ref: "./Tags.yaml"
+Studio:
+  $ref: "./Studio.yaml"
+Title:
+  $ref: "./Title.yaml"
+User:
+  $ref: "./User.yaml"
+UserTitle:
+  $ref: "./UserTitle.yaml"
+# JwtAuth:
+#   $ref: "./JWTAuth.yaml"

api/schemas/enums/ReleaseSeason.yaml

@@ -0,0 +1,7 @@
+type: string
+description: Title release season
+enum:
+  - winter
+  - spring
+  - summer
+  - fall

api/schemas/enums/StorageType.yaml

@@ -0,0 +1,5 @@
+type: string
+description: Image storage type
+enum:
+  - s3
+  - local

api/schemas/enums/TitleStatus.yaml

@@ -0,0 +1,6 @@
+type: string
+description: Title status
+enum:
+  - finished
+  - ongoing
+  - planned

api/schemas/enums/UserTitleStatus.yaml

@@ -0,0 +1,7 @@
+type: string
+description: User's title status
+enum:
+  - finished
+  - planned
+  - dropped
+  - in-progress

api/schemas/updateUser.yaml

@@ -0,0 +1,26 @@
+type: object
+properties:
+  avatar_id:
+    type: integer
+    format: int64
+    nullable: true
+    description: ID of the user avatar (references `images.id`); set to `null` to remove avatar
+    example: 42
+  mail:
+    type: string
+    format: email
+    pattern: '^[a-zA-Z0-9._-]+@[a-zA-Z0-9._-]+\\.[a-zA-Z0-9_-]+$'
+    description: User email (must be unique and valid)
+    example: john.doe.updated@example.com
+  disp_name:
+    type: string
+    description: Display name
+    maxLength: 32
+    example: John Smith
+  user_desc:
+    type: string
+    description: User description / bio
+    maxLength: 512
+    example: Just a curious developer.
+additionalProperties: false
+description: Only provided fields are updated. Omitted fields remain unchanged.

api/securitySchemes/_index.yaml

@@ -0,0 +1,11 @@
+# accessToken:
+#   $ref: "./access_token.yaml"
+# csrfToken:
+#   $ref: "./xsrf_token_cookie.yaml"
+XsrfAuthHeader:
+  type: apiKey
+  in: header
+  name: X-XSRF-TOKEN
+  description: |
+    Anti-CSRF token. Must match the `XSRF-TOKEN` cookie.
+    Required for all state-changing requests (POST/PUT/PATCH/DELETE).

auth/auth.gen.go

@@ -0,0 +1,246 @@
+// Package auth provides primitives to interact with the openapi HTTP API.
+//
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.5.0 DO NOT EDIT.
+package auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	strictgin "github.com/oapi-codegen/runtime/strictmiddleware/gin"
+)
+
+// PostSignInJSONBody defines parameters for PostSignIn.
+type PostSignInJSONBody struct {
+	Nickname string `json:"nickname"`
+	Pass     string `json:"pass"`
+}
+
+// PostSignUpJSONBody defines parameters for PostSignUp.
+type PostSignUpJSONBody struct {
+	Nickname string `json:"nickname"`
+	Pass     string `json:"pass"`
+}
+
+// PostSignInJSONRequestBody defines body for PostSignIn for application/json ContentType.
+type PostSignInJSONRequestBody PostSignInJSONBody
+
+// PostSignUpJSONRequestBody defines body for PostSignUp for application/json ContentType.
+type PostSignUpJSONRequestBody PostSignUpJSONBody
+
+// ServerInterface represents all server handlers.
+type ServerInterface interface {
+	// Sign in a user and return JWT
+	// (POST /sign-in)
+	PostSignIn(c *gin.Context)
+	// Sign up a new user
+	// (POST /sign-up)
+	PostSignUp(c *gin.Context)
+}
+
+// ServerInterfaceWrapper converts contexts to parameters.
+type ServerInterfaceWrapper struct {
+	Handler            ServerInterface
+	HandlerMiddlewares []MiddlewareFunc
+	ErrorHandler       func(*gin.Context, error, int)
+}
+
+type MiddlewareFunc func(c *gin.Context)
+
+// PostSignIn operation middleware
+func (siw *ServerInterfaceWrapper) PostSignIn(c *gin.Context) {
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		middleware(c)
+		if c.IsAborted() {
+			return
+		}
+	}
+
+	siw.Handler.PostSignIn(c)
+}
+
+// PostSignUp operation middleware
+func (siw *ServerInterfaceWrapper) PostSignUp(c *gin.Context) {
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		middleware(c)
+		if c.IsAborted() {
+			return
+		}
+	}
+
+	siw.Handler.PostSignUp(c)
+}
+
+// GinServerOptions provides options for the Gin server.
+type GinServerOptions struct {
+	BaseURL      string
+	Middlewares  []MiddlewareFunc
+	ErrorHandler func(*gin.Context, error, int)
+}
+
+// RegisterHandlers creates http.Handler with routing matching OpenAPI spec.
+func RegisterHandlers(router gin.IRouter, si ServerInterface) {
+	RegisterHandlersWithOptions(router, si, GinServerOptions{})
+}
+
+// RegisterHandlersWithOptions creates http.Handler with additional options
+func RegisterHandlersWithOptions(router gin.IRouter, si ServerInterface, options GinServerOptions) {
+	errorHandler := options.ErrorHandler
+	if errorHandler == nil {
+		errorHandler = func(c *gin.Context, err error, statusCode int) {
+			c.JSON(statusCode, gin.H{"msg": err.Error()})
+		}
+	}
+
+	wrapper := ServerInterfaceWrapper{
+		Handler:            si,
+		HandlerMiddlewares: options.Middlewares,
+		ErrorHandler:       errorHandler,
+	}
+
+	router.POST(options.BaseURL+"/sign-in", wrapper.PostSignIn)
+	router.POST(options.BaseURL+"/sign-up", wrapper.PostSignUp)
+}
+
+type PostSignInRequestObject struct {
+	Body *PostSignInJSONRequestBody
+}
+
+type PostSignInResponseObject interface {
+	VisitPostSignInResponse(w http.ResponseWriter) error
+}
+
+type PostSignIn200JSONResponse struct {
+	UserId   int64  `json:"user_id"`
+	UserName string `json:"user_name"`
+}
+
+func (response PostSignIn200JSONResponse) VisitPostSignInResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+type PostSignIn401JSONResponse struct {
+	Error *string `json:"error,omitempty"`
+}
+
+func (response PostSignIn401JSONResponse) VisitPostSignInResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(401)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+type PostSignUpRequestObject struct {
+	Body *PostSignUpJSONRequestBody
+}
+
+type PostSignUpResponseObject interface {
+	VisitPostSignUpResponse(w http.ResponseWriter) error
+}
+
+type PostSignUp200JSONResponse struct {
+	UserId int64 `json:"user_id"`
+}
+
+func (response PostSignUp200JSONResponse) VisitPostSignUpResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+// StrictServerInterface represents all server handlers.
+type StrictServerInterface interface {
+	// Sign in a user and return JWT
+	// (POST /sign-in)
+	PostSignIn(ctx context.Context, request PostSignInRequestObject) (PostSignInResponseObject, error)
+	// Sign up a new user
+	// (POST /sign-up)
+	PostSignUp(ctx context.Context, request PostSignUpRequestObject) (PostSignUpResponseObject, error)
+}
+
+type StrictHandlerFunc = strictgin.StrictGinHandlerFunc
+type StrictMiddlewareFunc = strictgin.StrictGinMiddlewareFunc
+
+func NewStrictHandler(ssi StrictServerInterface, middlewares []StrictMiddlewareFunc) ServerInterface {
+	return &strictHandler{ssi: ssi, middlewares: middlewares}
+}
+
+type strictHandler struct {
+	ssi         StrictServerInterface
+	middlewares []StrictMiddlewareFunc
+}
+
+// PostSignIn operation middleware
+func (sh *strictHandler) PostSignIn(ctx *gin.Context) {
+	var request PostSignInRequestObject
+
+	var body PostSignInJSONRequestBody
+	if err := ctx.ShouldBindJSON(&body); err != nil {
+		ctx.Status(http.StatusBadRequest)
+		ctx.Error(err)
+		return
+	}
+	request.Body = &body
+
+	handler := func(ctx *gin.Context, request interface{}) (interface{}, error) {
+		return sh.ssi.PostSignIn(ctx, request.(PostSignInRequestObject))
+	}
+	for _, middleware := range sh.middlewares {
+		handler = middleware(handler, "PostSignIn")
+	}
+
+	response, err := handler(ctx, request)
+
+	if err != nil {
+		ctx.Error(err)
+		ctx.Status(http.StatusInternalServerError)
+	} else if validResponse, ok := response.(PostSignInResponseObject); ok {
+		if err := validResponse.VisitPostSignInResponse(ctx.Writer); err != nil {
+			ctx.Error(err)
+		}
+	} else if response != nil {
+		ctx.Error(fmt.Errorf("unexpected response type: %T", response))
+	}
+}
+
+// PostSignUp operation middleware
+func (sh *strictHandler) PostSignUp(ctx *gin.Context) {
+	var request PostSignUpRequestObject
+
+	var body PostSignUpJSONRequestBody
+	if err := ctx.ShouldBindJSON(&body); err != nil {
+		ctx.Status(http.StatusBadRequest)
+		ctx.Error(err)
+		return
+	}
+	request.Body = &body
+
+	handler := func(ctx *gin.Context, request interface{}) (interface{}, error) {
+		return sh.ssi.PostSignUp(ctx, request.(PostSignUpRequestObject))
+	}
+	for _, middleware := range sh.middlewares {
+		handler = middleware(handler, "PostSignUp")
+	}
+
+	response, err := handler(ctx, request)
+
+	if err != nil {
+		ctx.Error(err)
+		ctx.Status(http.StatusInternalServerError)
+	} else if validResponse, ok := response.(PostSignUpResponseObject); ok {
+		if err := validResponse.VisitPostSignUpResponse(ctx.Writer); err != nil {
+			ctx.Error(err)
+		}
+	} else if response != nil {
+		ctx.Error(fmt.Errorf("unexpected response type: %T", response))
+	}
+}

auth/auth/auth.gen.go

@@ -0,0 +1,329 @@
+// Package oapi_auth provides primitives to interact with the openapi HTTP API.
+//
+// Code generated by github.com/oapi-codegen/oapi-codegen/v2 version v2.5.0 DO NOT EDIT.
+package oapi_auth
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	strictgin "github.com/oapi-codegen/runtime/strictmiddleware/gin"
+)
+
+// PostAuthSignInJSONBody defines parameters for PostAuthSignIn.
+type PostAuthSignInJSONBody struct {
+	Nickname string `json:"nickname"`
+	Pass     string `json:"pass"`
+}
+
+// PostAuthSignUpJSONBody defines parameters for PostAuthSignUp.
+type PostAuthSignUpJSONBody struct {
+	Nickname string `json:"nickname"`
+	Pass     string `json:"pass"`
+}
+
+// PostAuthVerifyTokenJSONBody defines parameters for PostAuthVerifyToken.
+type PostAuthVerifyTokenJSONBody struct {
+	// Token JWT token to validate
+	Token string `json:"token"`
+}
+
+// PostAuthSignInJSONRequestBody defines body for PostAuthSignIn for application/json ContentType.
+type PostAuthSignInJSONRequestBody PostAuthSignInJSONBody
+
+// PostAuthSignUpJSONRequestBody defines body for PostAuthSignUp for application/json ContentType.
+type PostAuthSignUpJSONRequestBody PostAuthSignUpJSONBody
+
+// PostAuthVerifyTokenJSONRequestBody defines body for PostAuthVerifyToken for application/json ContentType.
+type PostAuthVerifyTokenJSONRequestBody PostAuthVerifyTokenJSONBody
+
+// ServerInterface represents all server handlers.
+type ServerInterface interface {
+	// Sign in a user and return JWT
+	// (POST /auth/sign-in)
+	PostAuthSignIn(c *gin.Context)
+	// Sign up a new user
+	// (POST /auth/sign-up)
+	PostAuthSignUp(c *gin.Context)
+	// Verify JWT validity
+	// (POST /auth/verify-token)
+	PostAuthVerifyToken(c *gin.Context)
+}
+
+// ServerInterfaceWrapper converts contexts to parameters.
+type ServerInterfaceWrapper struct {
+	Handler            ServerInterface
+	HandlerMiddlewares []MiddlewareFunc
+	ErrorHandler       func(*gin.Context, error, int)
+}
+
+type MiddlewareFunc func(c *gin.Context)
+
+// PostAuthSignIn operation middleware
+func (siw *ServerInterfaceWrapper) PostAuthSignIn(c *gin.Context) {
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		middleware(c)
+		if c.IsAborted() {
+			return
+		}
+	}
+
+	siw.Handler.PostAuthSignIn(c)
+}
+
+// PostAuthSignUp operation middleware
+func (siw *ServerInterfaceWrapper) PostAuthSignUp(c *gin.Context) {
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		middleware(c)
+		if c.IsAborted() {
+			return
+		}
+	}
+
+	siw.Handler.PostAuthSignUp(c)
+}
+
+// PostAuthVerifyToken operation middleware
+func (siw *ServerInterfaceWrapper) PostAuthVerifyToken(c *gin.Context) {
+
+	for _, middleware := range siw.HandlerMiddlewares {
+		middleware(c)
+		if c.IsAborted() {
+			return
+		}
+	}
+
+	siw.Handler.PostAuthVerifyToken(c)
+}
+
+// GinServerOptions provides options for the Gin server.
+type GinServerOptions struct {
+	BaseURL      string
+	Middlewares  []MiddlewareFunc
+	ErrorHandler func(*gin.Context, error, int)
+}
+
+// RegisterHandlers creates http.Handler with routing matching OpenAPI spec.
+func RegisterHandlers(router gin.IRouter, si ServerInterface) {
+	RegisterHandlersWithOptions(router, si, GinServerOptions{})
+}
+
+// RegisterHandlersWithOptions creates http.Handler with additional options
+func RegisterHandlersWithOptions(router gin.IRouter, si ServerInterface, options GinServerOptions) {
+	errorHandler := options.ErrorHandler
+	if errorHandler == nil {
+		errorHandler = func(c *gin.Context, err error, statusCode int) {
+			c.JSON(statusCode, gin.H{"msg": err.Error()})
+		}
+	}
+
+	wrapper := ServerInterfaceWrapper{
+		Handler:            si,
+		HandlerMiddlewares: options.Middlewares,
+		ErrorHandler:       errorHandler,
+	}
+
+	router.POST(options.BaseURL+"/auth/sign-in", wrapper.PostAuthSignIn)
+	router.POST(options.BaseURL+"/auth/sign-up", wrapper.PostAuthSignUp)
+	router.POST(options.BaseURL+"/auth/verify-token", wrapper.PostAuthVerifyToken)
+}
+
+type PostAuthSignInRequestObject struct {
+	Body *PostAuthSignInJSONRequestBody
+}
+
+type PostAuthSignInResponseObject interface {
+	VisitPostAuthSignInResponse(w http.ResponseWriter) error
+}
+
+type PostAuthSignIn200JSONResponse struct {
+	Error   *string `json:"error"`
+	Success *bool   `json:"success,omitempty"`
+
+	// Token JWT token to access protected endpoints
+	Token  *string `json:"token"`
+	UserId *string `json:"user_id"`
+}
+
+func (response PostAuthSignIn200JSONResponse) VisitPostAuthSignInResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+type PostAuthSignUpRequestObject struct {
+	Body *PostAuthSignUpJSONRequestBody
+}
+
+type PostAuthSignUpResponseObject interface {
+	VisitPostAuthSignUpResponse(w http.ResponseWriter) error
+}
+
+type PostAuthSignUp200JSONResponse struct {
+	Error   *string `json:"error"`
+	Success *bool   `json:"success,omitempty"`
+	UserId  *string `json:"user_id"`
+}
+
+func (response PostAuthSignUp200JSONResponse) VisitPostAuthSignUpResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+type PostAuthVerifyTokenRequestObject struct {
+	Body *PostAuthVerifyTokenJSONRequestBody
+}
+
+type PostAuthVerifyTokenResponseObject interface {
+	VisitPostAuthVerifyTokenResponse(w http.ResponseWriter) error
+}
+
+type PostAuthVerifyToken200JSONResponse struct {
+	// Error Error message if token is invalid
+	Error *string `json:"error"`
+
+	// UserId User ID extracted from token if valid
+	UserId *string `json:"user_id"`
+
+	// Valid True if token is valid
+	Valid *bool `json:"valid,omitempty"`
+}
+
+func (response PostAuthVerifyToken200JSONResponse) VisitPostAuthVerifyTokenResponse(w http.ResponseWriter) error {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+
+	return json.NewEncoder(w).Encode(response)
+}
+
+// StrictServerInterface represents all server handlers.
+type StrictServerInterface interface {
+	// Sign in a user and return JWT
+	// (POST /auth/sign-in)
+	PostAuthSignIn(ctx context.Context, request PostAuthSignInRequestObject) (PostAuthSignInResponseObject, error)
+	// Sign up a new user
+	// (POST /auth/sign-up)
+	PostAuthSignUp(ctx context.Context, request PostAuthSignUpRequestObject) (PostAuthSignUpResponseObject, error)
+	// Verify JWT validity
+	// (POST /auth/verify-token)
+	PostAuthVerifyToken(ctx context.Context, request PostAuthVerifyTokenRequestObject) (PostAuthVerifyTokenResponseObject, error)
+}
+
+type StrictHandlerFunc = strictgin.StrictGinHandlerFunc
+type StrictMiddlewareFunc = strictgin.StrictGinMiddlewareFunc
+
+func NewStrictHandler(ssi StrictServerInterface, middlewares []StrictMiddlewareFunc) ServerInterface {
+	return &strictHandler{ssi: ssi, middlewares: middlewares}
+}
+
+type strictHandler struct {
+	ssi         StrictServerInterface
+	middlewares []StrictMiddlewareFunc
+}
+
+// PostAuthSignIn operation middleware
+func (sh *strictHandler) PostAuthSignIn(ctx *gin.Context) {
+	var request PostAuthSignInRequestObject
+
+	var body PostAuthSignInJSONRequestBody
+	if err := ctx.ShouldBindJSON(&body); err != nil {
+		ctx.Status(http.StatusBadRequest)
+		ctx.Error(err)
+		return
+	}
+	request.Body = &body
+
+	handler := func(ctx *gin.Context, request interface{}) (interface{}, error) {
+		return sh.ssi.PostAuthSignIn(ctx, request.(PostAuthSignInRequestObject))
+	}
+	for _, middleware := range sh.middlewares {
+		handler = middleware(handler, "PostAuthSignIn")
+	}
+
+	response, err := handler(ctx, request)
+
+	if err != nil {
+		ctx.Error(err)
+		ctx.Status(http.StatusInternalServerError)
+	} else if validResponse, ok := response.(PostAuthSignInResponseObject); ok {
+		if err := validResponse.VisitPostAuthSignInResponse(ctx.Writer); err != nil {
+			ctx.Error(err)
+		}
+	} else if response != nil {
+		ctx.Error(fmt.Errorf("unexpected response type: %T", response))
+	}
+}
+
+// PostAuthSignUp operation middleware
+func (sh *strictHandler) PostAuthSignUp(ctx *gin.Context) {
+	var request PostAuthSignUpRequestObject
+
+	var body PostAuthSignUpJSONRequestBody
+	if err := ctx.ShouldBindJSON(&body); err != nil {
+		ctx.Status(http.StatusBadRequest)
+		ctx.Error(err)
+		return
+	}
+	request.Body = &body
+
+	handler := func(ctx *gin.Context, request interface{}) (interface{}, error) {
+		return sh.ssi.PostAuthSignUp(ctx, request.(PostAuthSignUpRequestObject))
+	}
+	for _, middleware := range sh.middlewares {
+		handler = middleware(handler, "PostAuthSignUp")
+	}
+
+	response, err := handler(ctx, request)
+
+	if err != nil {
+		ctx.Error(err)
+		ctx.Status(http.StatusInternalServerError)
+	} else if validResponse, ok := response.(PostAuthSignUpResponseObject); ok {
+		if err := validResponse.VisitPostAuthSignUpResponse(ctx.Writer); err != nil {
+			ctx.Error(err)
+		}
+	} else if response != nil {
+		ctx.Error(fmt.Errorf("unexpected response type: %T", response))
+	}
+}
+
+// PostAuthVerifyToken operation middleware
+func (sh *strictHandler) PostAuthVerifyToken(ctx *gin.Context) {
+	var request PostAuthVerifyTokenRequestObject
+
+	var body PostAuthVerifyTokenJSONRequestBody
+	if err := ctx.ShouldBindJSON(&body); err != nil {
+		ctx.Status(http.StatusBadRequest)
+		ctx.Error(err)
+		return
+	}
+	request.Body = &body
+
+	handler := func(ctx *gin.Context, request interface{}) (interface{}, error) {
+		return sh.ssi.PostAuthVerifyToken(ctx, request.(PostAuthVerifyTokenRequestObject))
+	}
+	for _, middleware := range sh.middlewares {
+		handler = middleware(handler, "PostAuthVerifyToken")
+	}
+
+	response, err := handler(ctx, request)
+
+	if err != nil {
+		ctx.Error(err)
+		ctx.Status(http.StatusInternalServerError)
+	} else if validResponse, ok := response.(PostAuthVerifyTokenResponseObject); ok {
+		if err := validResponse.VisitPostAuthVerifyTokenResponse(ctx.Writer); err != nil {
+			ctx.Error(err)
+		}
+	} else if response != nil {
+		ctx.Error(fmt.Errorf("unexpected response type: %T", response))
+	}
+}

auth/oapi-auth-codegen.yaml

@@ -0,0 +1,6 @@
+package: auth
+generate:
+  strict-server: true
+  gin-server: true
+  models: true
+output: auth/auth.gen.go

auth/openapi-auth.yaml

@@ -0,0 +1,160 @@
+openapi: 3.1.1
+info:
+  title: Auth Service
+  version: 1.0.0
+
+servers:
+  - url: /auth
+
+paths:
+  /sign-up:
+    post:
+      summary: Sign up a new user
+      tags: [Auth]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [nickname, pass]
+              properties:
+                nickname:
+                  type: string
+                pass:
+                  type: string
+                  format: password
+      responses:
+        "200":
+          description: Sign-up result
+          content:
+            application/json:
+              schema:
+                required:
+                  - user_id
+                type: object
+                properties:
+                  user_id:
+                    type: integer
+                    format: int64
+
+  /sign-in:
+    post:
+      summary: Sign in a user and return JWT
+      tags: [Auth]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [nickname, pass]
+              properties:
+                nickname:
+                  type: string
+                pass:
+                  type: string
+                  format: password
+      responses:
+        # This one also sets two cookies: access_token and refresh_token
+        "200":
+          description: Sign-in result with JWT
+          content:
+            application/json:
+              schema:
+                required:
+                  - user_id
+                  - user_name
+                type: object
+                properties:
+                  user_id:
+                    type: integer
+                    format: int64
+                  user_name:
+                    type: string
+        "401":
+          description: Access denied due to invalid credentials
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  error:
+                    type: string
+                    example: "Access denied"
+  # /auth/verify-token:
+  #   post:
+  #     summary: Verify JWT validity
+  #     tags: [Auth]
+  #     requestBody:
+  #       required: true
+  #       content:
+  #         application/json:
+  #           schema:
+  #             type: object
+  #             required: [token]
+  #             properties:
+  #               token:
+  #                 type: string
+  #                 description: JWT token to validate
+  #     responses:
+  #       "200":
+  #         description: Token validation result
+  #         content:
+  #           application/json:
+  #             schema:
+  #               type: object
+  #               properties:
+  #                 valid:
+  #                   type: boolean
+  #                   description: True if token is valid
+  #                 user_id:
+  #                   type: string
+  #                   nullable: true
+  #                   description: User ID extracted from token if valid
+  #                 error:
+  #                   type: string
+  #                   nullable: true
+  #                   description: Error message if token is invalid
+  # /auth/refresh-token:
+  #   post:
+  #     summary: Refresh JWT using a refresh token
+  #     tags: [Auth]
+  #     requestBody:
+  #       required: true
+  #       content:
+  #         application/json:
+  #           schema:
+  #             type: object
+  #             required: [refresh_token]
+  #             properties:
+  #               refresh_token:
+  #                 type: string
+  #                 description: JWT refresh token obtained from sign-in
+  #     responses:
+  #       "200":
+  #         description: New access (and optionally refresh) token
+  #         content:
+  #           application/json:
+  #             schema:
+  #               type: object
+  #               properties:
+  #                 valid:
+  #                   type: boolean
+  #                   description: True if refresh token was valid
+  #                 user_id:
+  #                   type: string
+  #                   nullable: true
+  #                   description: User ID extracted from refresh token
+  #                 access_token:
+  #                   type: string
+  #                   description: New access token
+  #                   nullable: true
+  #                 refresh_token:
+  #                   type: string
+  #                   description: New refresh token (optional)
+  #                   nullable: true
+  #                 error:
+  #                   type: string
+  #                   nullable: true
+  #                   description: Error message if refresh token is invalid

deploy/api_gen.ps1

@@ -0,0 +1,4 @@
+cd ./api
+openapi-format .\openapi.yaml --output .\_build\openapi.yaml --yaml
+cd ..
+oapi-codegen --config=api\oapi-codegen.yaml api\_build\openapi.yaml

deploy/docker-compose.yml

@@ -11,20 +11,34 @@ services:
       - "${POSTGRES_PORT}:5432"
     volumes:
       - postgres_data:/var/lib/postgresql
+    networks:
+      - nyanimedb-network
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
 
-  # pgadmin:
-  #   image: dpage/pgadmin4:${PGADMIN_VERSION}
-  #   container_name: pgadmin
-  #   restart: always
-  #   environment:
-  #     PGADMIN_DEFAULT_EMAIL: ${PGADMIN_EMAIL}
-  #     PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_PASSWORD}
-  #   ports:
-  #     - "${PGADMIN_PORT}:80"
-  #   depends_on:
-  #     - postgres
-  #   volumes:
-  #     - pgadmin_data:/var/lib/pgadmin
+  rabbitmq:
+    image: rabbitmq:3-management
+    container_name: rabbitmq
+    ports:
+      - "5672:5672"
+      - "15672:15672"
+    environment:
+      RABBITMQ_DEFAULT_USER: ${RABBITMQ_USER}
+      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_PASSWORD}
+    volumes:
+      - rabbitmq_data:/var/lib/rabbitmq
+    networks:
+      - nyanimedb-network
+    healthcheck:
+      test: ["CMD", "rabbitmqctl", "status"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
 
   nyanimedb-backend:
     image: meowgit.nekoea.red/nihonium/nyanimedb-backend:latest
@@ -33,10 +47,33 @@ services:
     environment:
       LOG_LEVEL: ${LOG_LEVEL}
       DATABASE_URL: ${DATABASE_URL}
+      SERVICE_ADDRESS: ${SERVICE_ADDRESS}
+      RABBITMQ_URL: ${RABBITMQ_URL}
+      JWT_PRIVATE_KEY: ${JWT_PRIVATE_KEY}
+      AUTH_ENABLED: ${AUTH_ENABLED}
     ports:
       - "8080:8080"
     depends_on:
       - postgres
+      - rabbitmq
+    networks:
+      - nyanimedb-network
+
+  nyanimedb-auth:
+    image: meowgit.nekoea.red/nihonium/nyanimedb-auth:latest
+    container_name: nyanimedb-auth
+    restart: always
+    environment:
+      LOG_LEVEL: ${LOG_LEVEL}
+      DATABASE_URL: ${DATABASE_URL}
+      SERVICE_ADDRESS: ${SERVICE_ADDRESS}
+      JWT_PRIVATE_KEY: ${JWT_PRIVATE_KEY}
+    ports:
+      - "8082:8082"
+    depends_on:
+      - postgres
+    networks:
+      - nyanimedb-network
   
   nyanimedb-frontend:
     image: meowgit.nekoea.red/nihonium/nyanimedb-frontend:latest
@@ -46,7 +83,12 @@ services:
       - "8081:80"
     depends_on:
       - nyanimedb-backend
+    networks:
+      - nyanimedb-network
 
 volumes:
   postgres_data:
-  pgadmin_data:
+  rabbitmq_data:
+
+networks:
+  nyanimedb-network:

deploy/generate.sh

@@ -1,3 +1,3 @@
-npx openapi-typescript-codegen --input ..\..\api\openapi.yaml --output ./src/api --client axios
+npx openapi-typescript-codegen --input ..\..\api\openapi.yaml --output ./src/api --client axios --useUnionTypes
 oapi-codegen --config=api/oapi-codegen.yaml .\api\openapi.yaml
 sqlc generate -f .\sql\sqlc.yaml     

go.mod

@@ -3,12 +3,14 @@ module nyanimedb
 go 1.25.0
 
 require (
+	github.com/alexedwards/argon2id v1.0.0
 	github.com/gin-contrib/cors v1.7.6
 	github.com/gin-gonic/gin v1.11.0
+	github.com/golang-jwt/jwt/v5 v5.3.0
 	github.com/jackc/pgx/v5 v5.7.6
 	github.com/oapi-codegen/runtime v1.1.2
 	github.com/pelletier/go-toml/v2 v2.2.4
-	golang.org/x/crypto v0.40.0
+	github.com/sirupsen/logrus v1.9.3
 )
 
 require (
@@ -26,6 +28,7 @@ require (
 	github.com/google/uuid v1.5.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
@@ -34,11 +37,12 @@ require (
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/quic-go/qpack v0.5.1 // indirect
 	github.com/quic-go/quic-go v0.54.0 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/rabbitmq/amqp091-go v1.10.0 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.3.0 // indirect
 	go.uber.org/mock v0.5.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
+	golang.org/x/crypto v0.40.0 // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect

go.sum

@@ -1,4 +1,6 @@
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
+github.com/alexedwards/argon2id v1.0.0 h1:wJzDx66hqWX7siL/SRUmgz3F8YMrd/nfX/xHHcQQP0w=
+github.com/alexedwards/argon2id v1.0.0/go.mod h1:tYKkqIjzXvZdzPvADMWOEZ+l6+BD6CtBXMj5fnJppiw=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
 github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
 github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
@@ -31,6 +33,8 @@ github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
 github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
 github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
+github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -68,9 +72,13 @@ github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
 github.com/quic-go/quic-go v0.54.0 h1:6s1YB9QotYI6Ospeiguknbp2Znb/jZYjZLRXn9kMQBg=
 github.com/quic-go/quic-go v0.54.0/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
+github.com/rabbitmq/amqp091-go v1.10.0 h1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=
+github.com/rabbitmq/amqp091-go v1.10.0/go.mod h1:Hy4jKW5kQART1u+JkDTF9YYOQUHXqMuhrgxOEeS7G4o=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
+github.com/streadway/amqp v1.1.0 h1:py12iX8XSyI7aN/3dUT8DFIDJazNJsVJdxNVEpnQTZM=
+github.com/streadway/amqp v1.1.0/go.mod h1:WYSrTEYHOXHd0nwFeUXAe2G2hRnQT+deZJJf88uS9Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
@@ -85,26 +93,64 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA=
 github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
 go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
 golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
 golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/crypto v0.40.0 h1:r4x+VvoG5Fm+eJcxMaY8CQM7Lb0l1lsmjGBQ6s8BfKM=
 golang.org/x/crypto v0.40.0/go.mod h1:Qr1vMER5WyS2dfPHAlsOj01wgLbsyWtFn/aY+5+ZdxY=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
 golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs=
 golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
 golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
 golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
 golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
 google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

modules/auth/handlers/handlers.go

@@ -0,0 +1,238 @@
+package handlers
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+	"net/http"
+	auth "nyanimedb/auth"
+	sqlc "nyanimedb/sql"
+	"strconv"
+	"time"
+
+	"github.com/alexedwards/argon2id"
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	log "github.com/sirupsen/logrus"
+)
+
+type Server struct {
+	db            *sqlc.Queries
+	JwtPrivateKey string
+}
+
+func NewServer(db *sqlc.Queries, JwtPrivatekey string) Server {
+	return Server{db: db, JwtPrivateKey: JwtPrivatekey}
+}
+
+func parseInt64(s string) (int32, error) {
+	i, err := strconv.ParseInt(s, 10, 64)
+	return int32(i), err
+}
+
+func HashPassword(password string) (string, error) {
+	params := &argon2id.Params{
+		Memory:      64 * 1024,
+		Iterations:  3,
+		Parallelism: 2,
+		SaltLength:  16,
+		KeyLength:   32,
+	}
+
+	return argon2id.CreateHash(password, params)
+}
+
+func CheckPassword(password, hash string) (bool, error) {
+	return argon2id.ComparePasswordAndHash(password, hash)
+}
+
+func (s Server) generateTokens(userID string) (accessToken string, refreshToken string, csrfToken string, err error) {
+	accessClaims := jwt.MapClaims{
+		"user_id": userID,
+		"exp":     time.Now().Add(15 * time.Minute).Unix(),
+	}
+	at := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
+	accessToken, err = at.SignedString([]byte(s.JwtPrivateKey))
+	if err != nil {
+		return "", "", "", err
+	}
+
+	refreshClaims := jwt.MapClaims{
+		"user_id": userID,
+		"exp":     time.Now().Add(7 * 24 * time.Hour).Unix(),
+	}
+	rt := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
+	refreshToken, err = rt.SignedString([]byte(s.JwtPrivateKey))
+	if err != nil {
+		return "", "", "", err
+	}
+
+	csrfBytes := make([]byte, 32)
+	_, err = rand.Read(csrfBytes)
+	if err != nil {
+		return "", "", "", err
+	}
+	csrfToken = base64.RawURLEncoding.EncodeToString(csrfBytes)
+
+	return accessToken, refreshToken, csrfToken, nil
+}
+
+func (s Server) PostSignUp(ctx context.Context, req auth.PostSignUpRequestObject) (auth.PostSignUpResponseObject, error) {
+	passhash, err := HashPassword(req.Body.Pass)
+	if err != nil {
+		log.Errorf("failed to hash password: %v", err)
+		// TODO: return 500
+	}
+
+	user_id, err := s.db.CreateNewUser(context.Background(), sqlc.CreateNewUserParams{
+		Passhash: passhash,
+		Nickname: req.Body.Nickname,
+	})
+	if err != nil {
+		log.Errorf("failed to create user %s: %v", req.Body.Nickname, err)
+		// TODO: check err and retyrn 400/500
+	}
+
+	return auth.PostSignUp200JSONResponse{
+		UserId: user_id,
+	}, nil
+}
+
+func (s Server) PostSignIn(ctx context.Context, req auth.PostSignInRequestObject) (auth.PostSignInResponseObject, error) {
+	ginCtx, ok := ctx.Value(gin.ContextKey).(*gin.Context)
+	if !ok {
+		log.Print("failed to get gin context")
+		// TODO: change to 500
+		return auth.PostSignIn200JSONResponse{}, fmt.Errorf("failed to get gin.Context from context.Context")
+	}
+
+	user, err := s.db.GetUserByNickname(context.Background(), req.Body.Nickname)
+	if err != nil {
+		log.Errorf("failed to get user by nickname %s: %v", req.Body.Nickname, err)
+		// TODO: return 400/500
+	}
+
+	ok, err = CheckPassword(req.Body.Pass, user.Passhash)
+	if err != nil {
+		log.Errorf("failed to check password for user %s: %v", req.Body.Nickname, err)
+		// TODO: return 500
+	}
+	if !ok {
+		err_msg := "invalid credentials"
+		return auth.PostSignIn401JSONResponse{
+			Error: &err_msg,
+		}, nil
+	}
+
+	accessToken, refreshToken, csrfToken, err := s.generateTokens(req.Body.Nickname)
+	if err != nil {
+		log.Errorf("failed to generate tokens for user %s: %v", req.Body.Nickname, err)
+		// TODO: return 500
+	}
+
+	// TODO: check cookie settings carefully
+	ginCtx.SetSameSite(http.SameSiteStrictMode)
+	ginCtx.SetCookie("access_token", accessToken, 900, "/api", "", false, true)
+	ginCtx.SetCookie("refresh_token", refreshToken, 1209600, "/auth", "", false, true)
+	ginCtx.SetCookie("xsrf_token", csrfToken, 1209600, "/", "", false, false)
+
+	result := auth.PostSignIn200JSONResponse{
+		UserId:   user.ID,
+		UserName: user.Nickname,
+	}
+	return result, nil
+}
+
+// func (s Server) PostAuthVerifyToken(ctx context.Context, req auth.PostAuthVerifyTokenRequestObject) (auth.PostAuthVerifyTokenResponseObject, error) {
+// 	valid := false
+// 	var userID *string
+// 	var errStr *string
+
+// 	token, err := jwt.Parse(req.Body.Token, func(t *jwt.Token) (interface{}, error) {
+// 		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+// 			return nil, fmt.Errorf("unexpected signing method")
+// 		}
+// 		return accessSecret, nil
+// 	})
+
+// 	if err != nil {
+// 		e := err.Error()
+// 		errStr = &e
+// 		return auth.PostAuthVerifyToken200JSONResponse{
+// 			Valid:  &valid,
+// 			UserId: userID,
+// 			Error:  errStr,
+// 		}, nil
+// 	}
+
+// 	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+// 		if uid, ok := claims["user_id"].(string); ok {
+// 			valid = true
+// 			userID = &uid
+// 		} else {
+// 			e := "user_id not found in token"
+// 			errStr = &e
+// 		}
+// 	} else {
+// 		e := "invalid token claims"
+// 		errStr = &e
+// 	}
+
+// 	return auth.PostAuthVerifyToken200JSONResponse{
+// 		Valid:  &valid,
+// 		UserId: userID,
+// 		Error:  errStr,
+// 	}, nil
+// }
+
+// func (s Server) PostAuthRefreshToken(ctx context.Context, req auth.PostAuthRefreshTokenRequestObject) (auth.PostAuthRefreshTokenResponseObject, error) {
+// 	valid := false
+// 	var userID *string
+// 	var errStr *string
+
+// 	token, err := jwt.Parse(req.Body.Token, func(t *jwt.Token) (interface{}, error) {
+// 		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+// 			return nil, fmt.Errorf("unexpected signing method")
+// 		}
+// 		return refreshSecret, nil
+// 	})
+
+// 	if err != nil {
+// 		e := err.Error()
+// 		errStr = &e
+// 		return auth.PostAuthVerifyToken200JSONResponse{
+// 			Valid:  &valid,
+// 			UserId: userID,
+// 			Error:  errStr,
+// 		}, nil
+// 	}
+
+// 	if claims, ok := token.Claims.(jwt.MapClaims); ok && token.Valid {
+// 		if uid, ok := claims["user_id"].(string); ok {
+// 			// Refresh token is valid, generate new tokens
+// 			newAccessToken, newRefreshToken, _ := generateTokens(uid)
+// 			valid = true
+// 			userID = &uid
+// 			return auth.PostAuthVerifyToken200JSONResponse{
+// 				Valid:  &valid,
+// 				UserId: userID,
+// 				Error:  nil,
+// 				Token:  &newAccessToken, // return new access token
+// 				// optionally return newRefreshToken as well
+// 			}, nil
+// 		} else {
+// 			e := "user_id not found in refresh token"
+// 			errStr = &e
+// 		}
+// 	} else {
+// 		e := "invalid refresh token claims"
+// 		errStr = &e
+// 	}
+
+// 	return auth.PostAuthVerifyToken200JSONResponse{
+// 		Valid:  &valid,
+// 		UserId: userID,
+// 		Error:  errStr,
+// 	}, nil
+// }

modules/auth/helpers.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"fmt"
+	"reflect"
+)
+
+func setField(obj interface{}, name string, value interface{}) error {
+	v := reflect.ValueOf(obj)
+
+	if v.Kind() != reflect.Ptr || v.Elem().Kind() != reflect.Struct {
+		return fmt.Errorf("expected pointer to a struct")
+	}
+
+	v = v.Elem()
+	field := v.FieldByName(name)
+
+	if !field.IsValid() {
+		return fmt.Errorf("no such field: %s", name)
+	}
+	if !field.CanSet() {
+		return fmt.Errorf("cannot set field: %s", name)
+	}
+
+	val := reflect.ValueOf(value)
+
+	if field.Type() != val.Type() {
+		return fmt.Errorf("provided value type (%s) doesn't match field type (%s)", val.Type(), field.Type())
+	}
+
+	field.Set(val)
+	return nil
+}

modules/auth/main.go

@@ -0,0 +1,101 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"reflect"
+	"time"
+
+	auth "nyanimedb/auth"
+	handlers "nyanimedb/modules/auth/handlers"
+	sqlc "nyanimedb/sql"
+
+	"github.com/gin-contrib/cors"
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/pelletier/go-toml/v2"
+	log "github.com/sirupsen/logrus"
+)
+
+var AppConfig Config
+
+func main() {
+	if len(os.Args) != 2 {
+		AppConfig.Mode = "env"
+	} else {
+		AppConfig.Mode = "argv"
+	}
+
+	err := InitConfig()
+	if err != nil {
+		log.Fatalf("Failed to init config: %v\n", err)
+	}
+
+	r := gin.Default()
+
+	pool, err := pgxpool.New(context.Background(), os.Getenv("DATABASE_URL"))
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Unable to connect to database: %v\n", err)
+		os.Exit(1)
+	}
+
+	var queries *sqlc.Queries = sqlc.New(pool)
+
+	server := handlers.NewServer(queries, AppConfig.JwtPrivateKey)
+
+	log.Info("allow origins:", AppConfig.ServiceAddress)
+	r.Use(cors.New(cors.Config{
+		AllowOrigins:     []string{"*"},
+		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE"},
+		AllowHeaders:     []string{"Origin", "Content-Type", "Accept"},
+		ExposeHeaders:    []string{"Content-Length"},
+		AllowCredentials: true,
+		MaxAge:           12 * time.Hour,
+	}))
+
+	auth.RegisterHandlers(r, auth.NewStrictHandler(
+		server,
+		[]auth.StrictMiddlewareFunc{},
+	))
+
+	r.Run(":8082")
+}
+
+func InitConfig() error {
+	if AppConfig.Mode == "argv" {
+		content, err := os.ReadFile(os.Args[1])
+		if err != nil {
+			return err
+		}
+
+		toml.Unmarshal(content, &AppConfig)
+
+		fmt.Printf("%+v\n", AppConfig)
+
+		return nil
+	} else if AppConfig.Mode == "env" {
+		f := reflect.ValueOf(AppConfig)
+
+		for i := 0; i < f.NumField(); i++ {
+			field := f.Type().Field(i)
+			tag := field.Tag
+			env_var := tag.Get("env")
+			fmt.Printf("Field: %v.\nEnvironment variable: %v.\n", field.Name, env_var)
+			if env_var != "" {
+				env_value, exists := os.LookupEnv(env_var)
+				if !exists {
+					return fmt.Errorf("there is no env variable %s", env_var)
+				}
+				err := setField(&AppConfig, field.Name, env_value)
+				if err != nil {
+					return fmt.Errorf("failed to set config field %s: %v", field.Name, err)
+				}
+			}
+		}
+
+		return nil
+	} else {
+		return fmt.Errorf("incorrect config mode")
+	}
+}

modules/auth/queries.sql

@@ -0,0 +1,11 @@
+-- name: GetUserByNickname :one
+SELECT *
+FROM users
+WHERE nickname = sqlc.arg('nickname');
+
+-- name: CreateNewUser :one
+INSERT 
+INTO users (passhash, nickname) 
+VALUES (sqlc.arg(passhash), sqlc.arg(nickname))
+RETURNING id;
+

modules/auth/types.go

@@ -0,0 +1,9 @@
+package main
+
+type Config struct {
+	Mode           string
+	ServiceAddress string `toml:"ServiceAddress" env:"SERVICE_ADDRESS"`
+	DdUrl          string `toml:"DbUrl" env:"DATABASE_URL"`
+	JwtPrivateKey  string `toml:"JwtPrivateKey" env:"JWT_PRIVATE_KEY"`
+	LogLevel       string `toml:"LogLevel" env:"LOG_LEVEL"`
+}

modules/backend/handlers/common.go

@@ -1,19 +1,165 @@
 package handlers
 
 import (
+	"encoding/json"
+	"fmt"
+	oapi "nyanimedb/api"
+	"nyanimedb/modules/backend/rmq"
 	sqlc "nyanimedb/sql"
 	"strconv"
 )
 
+type Handler struct {
+	publisher *rmq.Publisher
+}
+
+func New(publisher *rmq.Publisher) *Handler {
+	return &Handler{publisher: publisher}
+}
+
 type Server struct {
-	db *sqlc.Queries
+	db        *sqlc.Queries
+	publisher *rmq.Publisher
+	RPCclient *rmq.RPCClient
 }
 
-func NewServer(db *sqlc.Queries) Server {
-	return Server{db: db}
+func NewServer(db *sqlc.Queries, publisher *rmq.Publisher, rpcclient *rmq.RPCClient) *Server {
+	return &Server{
+		db:        db,
+		publisher: publisher,
+		RPCclient: rpcclient,
+	}
 }
 
-func parseInt64(s string) (int32, error) {
+func sql2StorageType(s *sqlc.StorageTypeT) (*oapi.StorageType, error) {
+	if s == nil {
+		return nil, nil
+	}
+	var t oapi.StorageType
+	switch *s {
+	case sqlc.StorageTypeTLocal:
+		t = oapi.Local
+	case sqlc.StorageTypeTS3:
+		t = oapi.S3
+	default:
+		return nil, fmt.Errorf("unexpected storage type: %s", *s)
+	}
+	return &t, nil
+}
+
+func (s Server) mapTitle(title sqlc.GetTitleByIDRow) (oapi.Title, error) {
+
+	oapi_title := oapi.Title{
+		EpisodesAired: title.EpisodesAired,
+		EpisodesAll:   title.EpisodesAll,
+		// EpisodesLen:   &episodes_lens,
+		Id: title.ID,
+		// Poster:        &oapi_image,
+		Rating:      title.Rating,
+		RatingCount: title.RatingCount,
+		// ReleaseSeason: &release_season,
+		ReleaseYear: title.ReleaseYear,
+		// Studio:        &oapi_studio,
+		// Tags:          oapi_tag_names,
+		// TitleNames:    title_names,
+		// TitleStatus:   oapi_status,
+		// AdditionalProperties:
+	}
+
+	title_names := make(map[string][]string, 0)
+	err := json.Unmarshal(title.TitleNames, &title_names)
+	if err != nil {
+		return oapi.Title{}, fmt.Errorf("unmarshal TitleNames: %v", err)
+	}
+	oapi_title.TitleNames = title_names
+
+	if len(title.EpisodesLen) > 0 {
+		episodes_lens := make(map[string]float64, 0)
+		err = json.Unmarshal(title.EpisodesLen, &episodes_lens)
+		if err != nil {
+			return oapi.Title{}, fmt.Errorf("unmarshal EpisodesLen: %v", err)
+		}
+		oapi_title.EpisodesLen = &episodes_lens
+	}
+
+	oapi_tag_names := make(oapi.Tags, 0)
+	err = json.Unmarshal(title.TagNames, &oapi_tag_names)
+	if err != nil {
+		return oapi.Title{}, fmt.Errorf("unmarshalling title_tag: %v", err)
+	}
+	oapi_title.Tags = oapi_tag_names
+
+	var oapi_studio oapi.Studio
+	if title.StudioName != nil {
+		oapi_studio.Name = *title.StudioName
+	}
+	if title.StudioID != 0 {
+		oapi_studio.Id = title.StudioID
+		oapi_studio.Description = title.StudioDesc
+		if title.StudioIllustID != nil {
+			oapi_studio.Poster = &oapi.Image{}
+			oapi_studio.Poster.Id = title.StudioIllustID
+			oapi_studio.Poster.ImagePath = title.StudioImagePath
+
+			s, err := sql2StorageType(title.StudioStorageType)
+			if err != nil {
+				return oapi.Title{}, fmt.Errorf("mapTitle, studio storage type: %v", err)
+			}
+			oapi_studio.Poster.StorageType = s
+
+		}
+	}
+	oapi_title.Studio = &oapi_studio
+
+	var oapi_image oapi.Image
+
+	if title.PosterID != nil {
+		oapi_image.Id = title.PosterID
+		oapi_image.ImagePath = title.TitleImagePath
+		s, err := sql2StorageType(title.TitleStorageType)
+		if err != nil {
+			return oapi.Title{}, fmt.Errorf("mapTitle, title starage type: %v", err)
+		}
+		oapi_image.StorageType = s
+	}
+	oapi_title.Poster = &oapi_image
+
+	var release_season oapi.ReleaseSeason
+	if title.ReleaseSeason != nil {
+		release_season = oapi.ReleaseSeason(*title.ReleaseSeason)
+	}
+	oapi_title.ReleaseSeason = &release_season
+
+	oapi_status, err := TitleStatus2oapi(&title.TitleStatus)
+	if err != nil {
+		return oapi.Title{}, fmt.Errorf("TitleStatus2oapi: %v", err)
+	}
+	oapi_title.TitleStatus = oapi_status
+
+	return oapi_title, nil
+}
+
+func parseInt64(s string) (int64, error) {
 	i, err := strconv.ParseInt(s, 10, 64)
-	return int32(i), err
+	return i, err
+}
+
+func TitleStatus2Sqlc(s *[]oapi.TitleStatus) ([]sqlc.TitleStatusT, error) {
+	var sqlc_status []sqlc.TitleStatusT
+	if s == nil {
+		return nil, nil
+	}
+	for _, t := range *s {
+		switch t {
+		case oapi.TitleStatusFinished:
+			sqlc_status = append(sqlc_status, sqlc.TitleStatusTFinished)
+		case oapi.TitleStatusOngoing:
+			sqlc_status = append(sqlc_status, sqlc.TitleStatusTOngoing)
+		case oapi.TitleStatusPlanned:
+			sqlc_status = append(sqlc_status, sqlc.TitleStatusTPlanned)
+		default:
+			return nil, fmt.Errorf("unexpected tittle status: %s", t)
+		}
+	}
+	return sqlc_status, nil
 }

modules/backend/handlers/cursor.go

@@ -0,0 +1,156 @@
+package handlers
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strconv"
+)
+
+// ParseCursorInto parses an opaque base64 cursor and injects values into target struct.
+//
+// Supported sort types:
+//   - "id"     → sets CursorID (must be *int64)
+//   - "year"   → sets CursorID (*int64) + CursorYear (*int32)
+//   - "rating" → sets CursorID (*int64) + CursorRating (*float64)
+//
+// Target struct may have any subset of these fields (e.g. only CursorID).
+// Unknown fields are ignored. Missing fields → values are dropped (safe).
+//
+// Returns error if cursor is invalid or inconsistent with sort_by.
+func ParseCursorInto(sortBy, cursorStr string, target any) error {
+	if cursorStr == "" {
+		return nil // no cursor → nothing to do
+	}
+
+	// 1. Decode cursor
+	payload, err := decodeCursor(cursorStr)
+	if err != nil {
+		return err
+	}
+
+	// 2. Extract ID (required for all types)
+	id, err := extractInt64(payload, "id")
+	if err != nil {
+		return fmt.Errorf("cursor: %v", err)
+	}
+
+	// 3. Get reflect value of target (must be ptr to struct)
+	v := reflect.ValueOf(target)
+	if v.Kind() != reflect.Pointer || v.IsNil() {
+		return fmt.Errorf("target must be non-nil pointer to struct")
+	}
+	v = v.Elem()
+	if v.Kind() != reflect.Struct {
+		return fmt.Errorf("target must be pointer to struct")
+	}
+
+	// 4. Helper: set field if exists and compatible
+	setField := func(fieldName string, value any) {
+		f := v.FieldByName(fieldName)
+		if !f.IsValid() || !f.CanSet() {
+			return // field not found or unexported
+		}
+		ft := f.Type()
+		vv := reflect.ValueOf(value)
+
+		// Case: field is *T, value is T → wrap in pointer
+		if ft.Kind() == reflect.Pointer {
+			elemType := ft.Elem()
+			if vv.Type().AssignableTo(elemType) {
+				ptr := reflect.New(elemType)
+				ptr.Elem().Set(vv)
+				f.Set(ptr)
+			}
+			// nil → leave as zero (nil pointer)
+		} else if vv.Type().AssignableTo(ft) {
+			f.Set(vv)
+		}
+		// else: type mismatch → silently skip (safe)
+	}
+
+	// 5. Dispatch by sort type
+	switch sortBy {
+	case "id":
+		setField("CursorID", id)
+
+	case "year":
+		setField("CursorID", id)
+		param, err := extractString(payload, "param")
+		if err != nil {
+			return fmt.Errorf("cursor year: %w", err)
+		}
+		year, err := strconv.Atoi(param)
+		if err != nil {
+			return fmt.Errorf("cursor year: param must be integer, got %q", param)
+		}
+		setField("CursorYear", int32(year)) // or int, depending on your schema
+
+	case "rating":
+		setField("CursorID", id)
+		param, err := extractString(payload, "param")
+		if err != nil {
+			return fmt.Errorf("cursor rating: %w", err)
+		}
+		rating, err := strconv.ParseFloat(param, 64)
+		if err != nil {
+			return fmt.Errorf("cursor rating: param must be float, got %q", param)
+		}
+		setField("CursorRating", rating)
+
+	default:
+		return fmt.Errorf("unsupported sort_by: %q", sortBy)
+	}
+
+	return nil
+}
+
+// --- helpers ---
+func decodeCursor(cursorStr string) (map[string]any, error) {
+	data, err := base64.RawURLEncoding.DecodeString(cursorStr)
+	if err != nil {
+		data, err = base64.StdEncoding.DecodeString(cursorStr)
+		if err != nil {
+			return nil, fmt.Errorf("invalid base64 cursor")
+		}
+	}
+	var m map[string]any
+	if err := json.Unmarshal(data, &m); err != nil {
+		return nil, fmt.Errorf("invalid cursor JSON: %w", err)
+	}
+	return m, nil
+}
+
+func extractInt64(m map[string]any, key string) (int64, error) {
+	v, ok := m[key]
+	if !ok {
+		return 0, fmt.Errorf("missing %q", key)
+	}
+	switch x := v.(type) {
+	case float64:
+		if x == float64(int64(x)) {
+			return int64(x), nil
+		}
+	case string:
+		i, err := strconv.ParseInt(x, 10, 64)
+		if err == nil {
+			return i, nil
+		}
+	case int64, int, int32:
+		return reflect.ValueOf(x).Int(), nil
+	}
+	return 0, fmt.Errorf("%q must be integer", key)
+}
+
+func extractString(m map[string]any, key string) (string, error) {
+	v, ok := m[key]
+	if !ok {
+		return "", fmt.Errorf("missing %q", key)
+	}
+	s, ok := v.(string)
+	if !ok {
+		return "", fmt.Errorf("%q must be string", key)
+	}
+	return s, nil
+}

modules/backend/handlers/titles.go

@@ -5,7 +5,10 @@ import (
 	"encoding/json"
 	"fmt"
 	oapi "nyanimedb/api"
+	"nyanimedb/modules/backend/rmq"
 	sqlc "nyanimedb/sql"
+	"strconv"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 	log "github.com/sirupsen/logrus"
@@ -19,18 +22,18 @@ func Word2Sqlc(s *string) *string {
 	return s
 }
 
-func TitleStatus2Sqlc(s *oapi.TitleStatus) (*sqlc.TitleStatusT, error) {
+func TitleStatus2oapi(s *sqlc.TitleStatusT) (*oapi.TitleStatus, error) {
 	if s == nil {
 		return nil, nil
 	}
-	var t sqlc.TitleStatusT
+	var t oapi.TitleStatus
 	switch *s {
-	case oapi.Finished:
-		t = sqlc.TitleStatusTFinished
-	case oapi.Ongoing:
-		t = sqlc.TitleStatusTOngoing
-	case oapi.Planned:
-		t = sqlc.TitleStatusTPlanned
+	case sqlc.TitleStatusTFinished:
+		t = oapi.TitleStatusFinished
+	case sqlc.TitleStatusTOngoing:
+		t = oapi.TitleStatusOngoing
+	case sqlc.TitleStatusTPlanned:
+		t = oapi.TitleStatusPlanned
 	default:
 		return nil, fmt.Errorf("unexpected tittle status: %s", *s)
 	}
@@ -80,178 +83,223 @@ func (s Server) GetTagsByTitleId(ctx context.Context, id int64) (oapi.Tags, erro
 	return oapi_tag_names, nil
 }
 
-func (s Server) GetImage(ctx context.Context, id int64) (*oapi.Image, error) {
+// func (s Server) GetImage(ctx context.Context, id int64) (*oapi.Image, error) {
 
-	var oapi_image oapi.Image
+// 	var oapi_image oapi.Image
 
-	sqlc_image, err := s.db.GetImageByID(ctx, id)
-	if err != nil {
-		if err == pgx.ErrNoRows {
-			return nil, nil
-		}
-		return &oapi_image, fmt.Errorf("query GetImageByID: %v", err)
-	}
+// 	sqlc_image, err := s.db.GetImageByID(ctx, id)
+// 	if err != nil {
+// 		if err == pgx.ErrNoRows {
+// 			return nil, nil //todo: error reference in db
+// 		}
+// 		return &oapi_image, fmt.Errorf("query GetImageByID: %v", err)
+// 	}
 
-	//can cast and dont use brain cause all this fields  required in image table
-	oapi_image.Id = &sqlc_image.ID
-	oapi_image.ImagePath = &sqlc_image.ImagePath
-	storageTypeStr := string(sqlc_image.StorageType)
-	oapi_image.StorageType = &storageTypeStr
+// 	//can cast and dont use brain cause all this fields  required in image table
+// 	oapi_image.Id = &sqlc_image.ID
+// 	oapi_image.ImagePath = &sqlc_image.ImagePath
+// 	storageTypeStr := string(sqlc_image.StorageType)
+// 	oapi_image.StorageType = string(storageTypeStr)
 
-	return &oapi_image, nil
-}
+// 	return &oapi_image, nil
+// }
 
-func (s Server) GetStudio(ctx context.Context, id int64) (*oapi.Studio, error) {
+// func (s Server) GetStudio(ctx context.Context, id int64) (*oapi.Studio, error) {
 
-	var oapi_studio oapi.Studio
+// 	var oapi_studio oapi.Studio
 
-	sqlc_studio, err := s.db.GetStudioByID(ctx, id)
-	if err != nil {
-		if err == pgx.ErrNoRows {
-			return nil, nil
-		}
-		return &oapi_studio, fmt.Errorf("query GetStudioByID: %v", err)
-	}
+// 	sqlc_studio, err := s.db.GetStudioByID(ctx, id)
+// 	if err != nil {
+// 		if err == pgx.ErrNoRows {
+// 			return nil, nil
+// 		}
+// 		return &oapi_studio, fmt.Errorf("query GetStudioByID: %v", err)
+// 	}
 
-	oapi_studio.Id = sqlc_studio.ID
-	oapi_studio.Name = sqlc_studio.StudioName
-	oapi_studio.Description = sqlc_studio.StudioDesc
+// 	oapi_studio.Id = sqlc_studio.ID
+// 	oapi_studio.Name = sqlc_studio.StudioName
+// 	oapi_studio.Description = sqlc_studio.StudioDesc
 
-	oapi_illust, err := s.GetImage(ctx, *sqlc_studio.IllustID)
-	if err != nil {
-		return &oapi_studio, fmt.Errorf("GetImage: %v", err)
-	}
-	if oapi_illust != nil {
-		oapi_studio.Poster = oapi_illust
-	}
+// 	if sqlc_studio.IllustID == nil {
+// 		return &oapi_studio, nil
+// 	}
+// 	oapi_illust, err := s.GetImage(ctx, *sqlc_studio.IllustID)
+// 	if err != nil {
+// 		return &oapi_studio, fmt.Errorf("GetImage: %v", err)
+// 	}
+// 	if oapi_illust != nil {
+// 		oapi_studio.Poster = oapi_illust
+// 	}
 
-	return &oapi_studio, nil
-}
+// 	return &oapi_studio, nil
+// }
 
-func (s Server) mapTitle(ctx context.Context, title sqlc.Title) (oapi.Title, error) {
-
-	var oapi_title oapi.Title
-
-	title_names := make(map[string][]string, 1)
-	err := json.Unmarshal(title.TitleNames, &title_names)
-	if err != nil {
-		return oapi_title, fmt.Errorf("unmarshal TitleNames: %v", err)
-	}
-
-	episodes_lens := make(map[string]float64, 1)
-	err = json.Unmarshal(title.EpisodesLen, &episodes_lens)
-	if err != nil {
-		return oapi_title, fmt.Errorf("unmarshal EpisodesLen: %v", err)
-	}
-
-	oapi_tag_names, err := s.GetTagsByTitleId(ctx, title.ID)
-	if err != nil {
-		return oapi_title, fmt.Errorf("GetTagsByTitleId: %v", err)
-	}
-	if oapi_tag_names != nil {
-		oapi_title.Tags = oapi_tag_names
-	}
-
-	oapi_image, err := s.GetImage(ctx, *title.PosterID)
-	if err != nil {
-		return oapi_title, fmt.Errorf("GetImage: %v", err)
-	}
-	if oapi_image != nil {
-		oapi_title.Poster = oapi_image
-	}
-
-	oapi_studio, err := s.GetStudio(ctx, title.StudioID)
-	if err != nil {
-		return oapi_title, fmt.Errorf("GetStudio: %v", err)
-	}
-	if oapi_studio != nil {
-		oapi_title.Studio = oapi_studio
-	}
-
-	if title.ReleaseSeason != nil {
-		rs := oapi.ReleaseSeason(*title.ReleaseSeason)
-		oapi_title.ReleaseSeason = &rs
-	} else {
-		oapi_title.ReleaseSeason = nil
-	}
-
-	ts := oapi.TitleStatus(title.TitleStatus)
-	oapi_title.TitleStatus = &ts
-
-	oapi_title.Id = title.ID
-	oapi_title.Rating = title.Rating
-	oapi_title.RatingCount = title.RatingCount
-	oapi_title.ReleaseYear = title.ReleaseYear
-	oapi_title.TitleNames = title_names
-	oapi_title.EpisodesAired = title.EpisodesAired
-	oapi_title.EpisodesAll = title.EpisodesAll
-	oapi_title.EpisodesLen = &episodes_lens
-
-	return oapi_title, nil
-}
-
-func (s Server) GetTitleTitleId(ctx context.Context, request oapi.GetTitleTitleIdRequestObject) (oapi.GetTitleTitleIdResponseObject, error) {
+func (s Server) GetTitle(ctx context.Context, request oapi.GetTitleRequestObject) (oapi.GetTitleResponseObject, error) {
 	var oapi_title oapi.Title
 
 	sqlc_title, err := s.db.GetTitleByID(ctx, request.TitleId)
 	if err != nil {
 		if err == pgx.ErrNoRows {
-			return oapi.GetTitleTitleId204Response{}, nil
+			return oapi.GetTitle204Response{}, nil
 		}
 		log.Errorf("%v", err)
-		return oapi.GetTitleTitleId500Response{}, nil
+		return oapi.GetTitle500Response{}, nil
 	}
 
-	oapi_title, err = s.mapTitle(ctx, sqlc_title)
-	if err != nil {
-		log.Errorf("%v", err)
-		return oapi.GetTitleTitleId500Response{}, nil
-	}
-
-	return oapi.GetTitleTitleId200JSONResponse(oapi_title), nil
-}
-
-func (s Server) GetTitle(ctx context.Context, request oapi.GetTitleRequestObject) (oapi.GetTitleResponseObject, error) {
-	opai_titles := make([]oapi.Title, 1)
-
-	word := Word2Sqlc(request.Params.Word)
-	status, err := TitleStatus2Sqlc(request.Params.Status)
-	if err != nil {
-		log.Errorf("%v", err)
-		return oapi.GetTitle400Response{}, err
-	}
-	season, err := ReleaseSeason2sqlc(request.Params.ReleaseSeason)
-	if err != nil {
-		log.Errorf("%v", err)
-		return oapi.GetTitle400Response{}, err
-	}
-	// param = nil means it will not be used
-	titles, err := s.db.SearchTitles(ctx, sqlc.SearchTitlesParams{
-		Word:          word,
-		Status:        status,
-		Rating:        request.Params.Rating,
-		ReleaseYear:   request.Params.ReleaseYear,
-		ReleaseSeason: season,
-		Offset:        request.Params.Offset,
-		Limit:         request.Params.Limit,
-	})
+	oapi_title, err = s.mapTitle(sqlc_title)
 	if err != nil {
 		log.Errorf("%v", err)
 		return oapi.GetTitle500Response{}, nil
 	}
-	if len(titles) == 0 {
-		return oapi.GetTitle204Response{}, nil
+
+	return oapi.GetTitle200JSONResponse(oapi_title), nil
+}
+
+func (s Server) GetTitles(ctx context.Context, request oapi.GetTitlesRequestObject) (oapi.GetTitlesResponseObject, error) {
+
+	opai_titles := make([]oapi.Title, 0)
+	mqreq := rmq.RabbitRequest{
+		Timestamp: time.Now(),
 	}
 
+	word := Word2Sqlc(request.Params.Word)
+	if word != nil {
+		mqreq.Name = *word
+	}
+
+	season, err := ReleaseSeason2sqlc(request.Params.ReleaseSeason)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetTitles400Response{}, err
+	}
+	if season != nil {
+		mqreq.Season = *request.Params.ReleaseSeason
+	}
+
+	title_statuses, err := TitleStatus2Sqlc(request.Params.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetTitles400Response{}, err
+	}
+	if title_statuses != nil {
+		mqreq.Statuses = *request.Params.Status
+	}
+
+	if request.Params.ExtSearch != nil && *request.Params.ExtSearch {
+
+		// Структура для ответа (должна совпадать с тем, что шлёт микросервис)
+		var reply struct {
+			Status  string `json:"status"`
+			Result  string `json:"result"`
+			Preview string `json:"preview_url"`
+		}
+
+		// Делаем RPC-вызов — и ЖДЁМ ответа
+		err := s.RPCclient.Call(
+			ctx,
+			"svc.media.process.requests", // ← очередь микросервиса
+			mqreq,
+			&reply,
+		)
+		if err != nil {
+			log.Errorf("RabitMQ: %v", err)
+			// return oapi.GetTitles500Response{}, err
+		}
+		// // Возвращаем результат
+		// return oapi.ProcessMedia200JSONResponse{
+		// 	Status:  reply.Status,
+		// 	Result:  reply.Result,
+		// 	Preview: reply.Preview,
+		// }, nil
+	}
+
+	params := sqlc.SearchTitlesParams{
+		Word:          word,
+		TitleStatuses: title_statuses,
+		Rating:        request.Params.Rating,
+		ReleaseYear:   request.Params.ReleaseYear,
+		ReleaseSeason: season,
+		Forward:       true, // default
+		SortBy:        "id", // default
+		Limit:         request.Params.Limit,
+	}
+
+	if request.Params.SortForward != nil {
+		params.Forward = *request.Params.SortForward
+	}
+	if request.Params.Sort != nil {
+		params.SortBy = string(*request.Params.Sort)
+		if request.Params.Cursor != nil {
+			// here we set CursorYear CursorID CursorRating fields
+			err := ParseCursorInto(string(*request.Params.Sort), string(*request.Params.Cursor), &params)
+			if err != nil {
+				log.Errorf("%v", err)
+				return oapi.GetTitles400Response{}, nil
+			}
+		}
+	}
+	// param = nil means it will not be used
+	titles, err := s.db.SearchTitles(ctx, params)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetTitles500Response{}, nil
+	}
+	if len(titles) == 0 {
+		return oapi.GetTitles204Response{}, nil
+	}
+
+	var new_cursor oapi.CursorObj
+
 	for _, title := range titles {
 
-		t, err := s.mapTitle(ctx, title)
+		_title := sqlc.GetTitleByIDRow{
+			ID: title.ID,
+			// StudioID:          title.StudioID,
+			PosterID:      title.PosterID,
+			TitleStatus:   title.TitleStatus,
+			Rating:        title.Rating,
+			RatingCount:   title.RatingCount,
+			ReleaseYear:   title.ReleaseYear,
+			ReleaseSeason: title.ReleaseSeason,
+			Season:        title.Season,
+			EpisodesAired: title.EpisodesAired,
+			EpisodesAll:   title.EpisodesAll,
+			// EpisodesLen:       title.EpisodesLen,
+			TitleStorageType: title.TitleStorageType,
+			TitleImagePath:   title.TitleImagePath,
+			TitleNames:       title.TitleNames,
+			TagNames:         title.TagNames,
+			StudioName:       title.StudioName,
+			// StudioIllustID:    title.StudioIllustID,
+			// StudioDesc:        title.StudioDesc,
+			// StudioStorageType: title.StudioStorageType,
+			// StudioImagePath:   title.StudioImagePath,
+		}
+
+		// if title.TitleStorageType != nil {
+		// 	s := *title.TitleStorageType
+		// 	_title.TitleStorageType = string(s)
+		// }
+
+		t, err := s.mapTitle(_title)
 		if err != nil {
 			log.Errorf("%v", err)
-			return oapi.GetTitle500Response{}, nil
+			return oapi.GetTitles500Response{}, nil
 		}
 		opai_titles = append(opai_titles, t)
+
+		new_cursor.Id = t.Id
+		if request.Params.Sort != nil {
+			switch string(*request.Params.Sort) {
+			case "year":
+				tmp := fmt.Sprint(*t.ReleaseYear)
+				new_cursor.Param = &tmp
+			case "rating":
+				tmp := strconv.FormatFloat(*t.Rating, 'f', -1, 64)
+				new_cursor.Param = &tmp
+			}
+		}
 	}
 
-	return oapi.GetTitle200JSONResponse(opai_titles), nil
+	return oapi.GetTitles200JSONResponse{Cursor: new_cursor, Data: opai_titles}, nil
 }

modules/backend/handlers/users.go

@@ -2,49 +2,486 @@ package handlers
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	oapi "nyanimedb/api"
 	sqlc "nyanimedb/sql"
+	"strconv"
+	"time"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/oapi-codegen/runtime/types"
+	log "github.com/sirupsen/logrus"
 )
 
-// type Server struct {
-// 	db *sqlc.Queries
-// }
+const (
+	pgErrDuplicateKey = "23505"
+)
 
-// func NewServer(db *sqlc.Queries) Server {
-// 	return Server{db: db}
-// }
-
-// func parseInt64(s string) (int32, error) {
-// 	i, err := strconv.ParseInt(s, 10, 64)
-// 	return int32(i), err
-// }
-
-func mapUser(u sqlc.GetUserByIDRow) oapi.User {
+func mapUser(u sqlc.GetUserByIDRow) (oapi.User, error) {
+	i := oapi.Image{
+		Id:        u.AvatarID,
+		ImagePath: u.ImagePath,
+	}
+	s, err := sql2StorageType(u.StorageType)
+	if err != nil {
+		return oapi.User{}, fmt.Errorf("mapUser, storage type: %v", err)
+	}
+	i.StorageType = s
 	return oapi.User{
-		AvatarId:     u.AvatarID,
+		Image:        &i,
 		CreationDate: &u.CreationDate,
 		DispName:     u.DispName,
 		Id:           &u.ID,
-		Mail:         (*types.Email)(u.Mail),
+		Mail:         StringToEmail(u.Mail),
 		Nickname:     u.Nickname,
 		UserDesc:     u.UserDesc,
-	}
+	}, nil
 }
 
-func (s Server) GetUsersUserId(ctx context.Context, req oapi.GetUsersUserIdRequestObject) (oapi.GetUsersUserIdResponseObject, error) {
+func (s Server) GetUsersId(ctx context.Context, req oapi.GetUsersIdRequestObject) (oapi.GetUsersIdResponseObject, error) {
 	userID, err := parseInt64(req.UserId)
 	if err != nil {
-		return oapi.GetUsersUserId404Response{}, nil
+		return oapi.GetUsersId404Response{}, nil
 	}
-	user, err := s.db.GetUserByID(context.TODO(), int64(userID))
+	_user, err := s.db.GetUserByID(context.TODO(), userID)
 	if err != nil {
 		if err == pgx.ErrNoRows {
-			return oapi.GetUsersUserId404Response{}, nil
+			return oapi.GetUsersId404Response{}, nil
 		}
 		return nil, err
 	}
-	return oapi.GetUsersUserId200JSONResponse(mapUser(user)), nil
+	user, err := mapUser(_user)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetUsersId500Response{}, err
+	}
+	return oapi.GetUsersId200JSONResponse(user), nil
+}
+
+func sqlDate2oapi(p_date pgtype.Timestamptz) *time.Time {
+	if p_date.Valid {
+		t := p_date.Time
+		return &t
+	}
+	return nil
+}
+
+// func UserTitleStatus2Sqlc(s *[]oapi.UserTitleStatus) (*SqlcUserStatus, error) {
+// 	var sqlc_status SqlcUserStatus
+// 	if s == nil {
+// 		return &sqlc_status, nil
+// 	}
+// 	for _, t := range *s {
+// 		switch t {
+// 		case oapi.UserTitleStatusFinished:
+// 			sqlc_status.finished = "finished"
+// 		case oapi.UserTitleStatusDropped:
+// 			sqlc_status.dropped = "dropped"
+// 		case oapi.UserTitleStatusPlanned:
+// 			sqlc_status.planned = "planned"
+// 		case oapi.UserTitleStatusInProgress:
+// 			sqlc_status.in_progress = "in-progress"
+// 		default:
+// 			return nil, fmt.Errorf("unexpected tittle status: %s", t)
+// 		}
+// 	}
+// 	return &sqlc_status, nil
+// }
+
+func sql2usertitlestatus(s sqlc.UsertitleStatusT) (oapi.UserTitleStatus, error) {
+	var status oapi.UserTitleStatus
+
+	switch s {
+	case sqlc.UsertitleStatusTFinished:
+		status = oapi.UserTitleStatusFinished
+	case sqlc.UsertitleStatusTDropped:
+		status = oapi.UserTitleStatusDropped
+	case sqlc.UsertitleStatusTPlanned:
+		status = oapi.UserTitleStatusPlanned
+	case sqlc.UsertitleStatusTInProgress:
+		status = oapi.UserTitleStatusInProgress
+	default:
+		return status, fmt.Errorf("unexpected tittle status: %s", s)
+	}
+
+	return status, nil
+}
+
+func UserTitleStatus2Sqlc(s *[]oapi.UserTitleStatus) ([]sqlc.UsertitleStatusT, error) {
+	var sqlc_status []sqlc.UsertitleStatusT
+	if s == nil {
+		return nil, nil
+	}
+	for _, t := range *s {
+		switch t {
+		case oapi.UserTitleStatusFinished:
+			sqlc_status = append(sqlc_status, sqlc.UsertitleStatusTFinished)
+		case oapi.UserTitleStatusInProgress:
+			sqlc_status = append(sqlc_status, sqlc.UsertitleStatusTInProgress)
+		case oapi.UserTitleStatusDropped:
+			sqlc_status = append(sqlc_status, sqlc.UsertitleStatusTDropped)
+		case oapi.UserTitleStatusPlanned:
+			sqlc_status = append(sqlc_status, sqlc.UsertitleStatusTPlanned)
+		default:
+			return nil, fmt.Errorf("unexpected tittle status: %s", t)
+		}
+	}
+	return sqlc_status, nil
+}
+
+func UserTitleStatus2Sqlc1(s *oapi.UserTitleStatus) (*sqlc.UsertitleStatusT, error) {
+	var sqlc_status sqlc.UsertitleStatusT = sqlc.UsertitleStatusTFinished
+	if s == nil {
+		return &sqlc_status, nil
+	}
+
+	switch *s {
+	case oapi.UserTitleStatusFinished:
+		sqlc_status = sqlc.UsertitleStatusTFinished
+	case oapi.UserTitleStatusInProgress:
+		sqlc_status = sqlc.UsertitleStatusTInProgress
+	case oapi.UserTitleStatusDropped:
+		sqlc_status = sqlc.UsertitleStatusTDropped
+	case oapi.UserTitleStatusPlanned:
+		sqlc_status = sqlc.UsertitleStatusTPlanned
+	default:
+		return nil, fmt.Errorf("unexpected tittle status: %s", *s)
+	}
+
+	return &sqlc_status, nil
+}
+
+func (s Server) mapUsertitle(ctx context.Context, t sqlc.SearchUserTitlesRow) (oapi.UserTitle, error) {
+
+	oapi_usertitle := oapi.UserTitle{
+		Ctime:    &t.UserCtime,
+		Rate:     t.UserRate,
+		ReviewId: t.ReviewID,
+		// Status: ,
+		// Title: ,
+		UserId: t.UserID,
+	}
+
+	status, err := sql2usertitlestatus(t.UsertitleStatus)
+	if err != nil {
+		return oapi_usertitle, fmt.Errorf("mapUsertitle: %v", err)
+	}
+	oapi_usertitle.Status = status
+
+	_title := sqlc.GetTitleByIDRow{
+		ID: t.ID,
+		// StudioID:          title.StudioID,
+		PosterID:      t.PosterID,
+		TitleStatus:   t.TitleStatus,
+		Rating:        t.Rating,
+		RatingCount:   t.RatingCount,
+		ReleaseYear:   t.ReleaseYear,
+		ReleaseSeason: t.ReleaseSeason,
+		Season:        t.Season,
+		EpisodesAired: t.EpisodesAired,
+		EpisodesAll:   t.EpisodesAll,
+		// EpisodesLen:       title.EpisodesLen,
+		TitleStorageType: t.TitleStorageType,
+		TitleImagePath:   t.TitleImagePath,
+		StudioName:       t.StudioName,
+		TitleNames:       t.TitleNames,
+		TagNames:         t.TagNames,
+		// StudioIllustID:    title.StudioIllustID,
+		// StudioDesc:        title.StudioDesc,
+		// StudioStorageType: title.StudioStorageType,
+		// StudioImagePath:   title.StudioImagePath,
+	}
+
+	oapi_title, err := s.mapTitle(_title)
+	if err != nil {
+		return oapi_usertitle, fmt.Errorf("mapUsertitle: %v", err)
+	}
+	oapi_usertitle.Title = &oapi_title
+
+	return oapi_usertitle, nil
+}
+
+func (s Server) GetUserTitles(ctx context.Context, request oapi.GetUserTitlesRequestObject) (oapi.GetUserTitlesResponseObject, error) {
+
+	oapi_usertitles := make([]oapi.UserTitle, 0)
+
+	word := Word2Sqlc(request.Params.Word)
+
+	season, err := ReleaseSeason2sqlc(request.Params.ReleaseSeason)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetUserTitles400Response{}, err
+	}
+
+	// var statuses_sort []string
+	// if request.Params.Status != nil {
+	// 	for _, s := range *request.Params.Status {
+	// 		ss := string(s) // s type is alias for string
+	// 		statuses_sort = append(statuses_sort, ss)
+	// 	}
+	// }
+
+	watch_status, err := UserTitleStatus2Sqlc(request.Params.WatchStatus)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetUserTitles400Response{}, err
+	}
+
+	title_statuses, err := TitleStatus2Sqlc(request.Params.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetUserTitles400Response{}, err
+	}
+
+	userID, err := parseInt64(request.UserId)
+	if err != nil {
+		log.Errorf("get user titles: %v", err)
+		return oapi.GetUserTitles404Response{}, err
+	}
+	params := sqlc.SearchUserTitlesParams{
+		UserID:            userID,
+		Word:              word,
+		TitleStatuses:     title_statuses,
+		UsertitleStatuses: watch_status,
+		Rating:            request.Params.Rating,
+		Rate:              request.Params.MyRate,
+		ReleaseYear:       request.Params.ReleaseYear,
+		ReleaseSeason:     season,
+		Forward:           true, // default
+		SortBy:            "id", // default
+		Limit:             request.Params.Limit,
+	}
+
+	if request.Params.SortForward != nil {
+		params.Forward = *request.Params.SortForward
+	}
+	if request.Params.Sort != nil {
+		params.SortBy = string(*request.Params.Sort)
+		if request.Params.Cursor != nil {
+			// here we set CursorYear CursorID CursorRating fields
+			err := ParseCursorInto(string(*request.Params.Sort), string(*request.Params.Cursor), &params)
+			if err != nil {
+				log.Errorf("%v", err)
+				return oapi.GetUserTitles400Response{}, nil
+			}
+		}
+	}
+	// param = nil means it will not be used
+	titles, err := s.db.SearchUserTitles(ctx, params)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetUserTitles500Response{}, nil
+	}
+	if len(titles) == 0 {
+		return oapi.GetUserTitles204Response{}, nil
+	}
+
+	var new_cursor oapi.CursorObj
+
+	for _, title := range titles {
+
+		t, err := s.mapUsertitle(ctx, title)
+		if err != nil {
+			log.Errorf("%v", err)
+			return oapi.GetUserTitles500Response{}, nil
+		}
+		oapi_usertitles = append(oapi_usertitles, t)
+
+		new_cursor.Id = t.Title.Id
+		if request.Params.Sort != nil {
+			switch string(*request.Params.Sort) {
+			case "year":
+				tmp := fmt.Sprint(*t.Title.ReleaseYear)
+				new_cursor.Param = &tmp
+			case "rating":
+				tmp := strconv.FormatFloat(*t.Title.Rating, 'f', -1, 64) // падает
+				new_cursor.Param = &tmp
+			}
+		}
+	}
+
+	return oapi.GetUserTitles200JSONResponse{Cursor: new_cursor, Data: oapi_usertitles}, nil
+}
+
+func EmailToStringPtr(e *types.Email) *string {
+	if e == nil {
+		return nil
+	}
+	s := string(*e)
+	return &s
+}
+
+func StringToEmail(e *string) *types.Email {
+	if e == nil {
+		return nil
+	}
+	s := types.Email(*e)
+	return &s
+}
+
+// UpdateUser implements oapi.StrictServerInterface.
+func (s Server) UpdateUser(ctx context.Context, request oapi.UpdateUserRequestObject) (oapi.UpdateUserResponseObject, error) {
+
+	params := sqlc.UpdateUserParams{
+		AvatarID: request.Body.AvatarId,
+		DispName: request.Body.DispName,
+		UserDesc: request.Body.UserDesc,
+		Mail:     EmailToStringPtr(request.Body.Mail),
+		UserID:   request.UserId,
+	}
+
+	user, err := s.db.UpdateUser(ctx, params)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.UpdateUser500Response{}, nil
+	}
+
+	oapi_user := oapi.User{ // maybe its possible to make one sqlc type and use one map func iinstead of this shit
+		// AvatarId:     user.AvatarID,
+		CreationDate: &user.CreationDate,
+		DispName:     user.DispName,
+		Id:           &user.ID,
+		Mail:         StringToEmail(user.Mail),
+		Nickname:     user.Nickname,
+		UserDesc:     user.UserDesc,
+	}
+
+	return oapi.UpdateUser200JSONResponse(oapi_user), nil
+}
+
+func (s Server) AddUserTitle(ctx context.Context, request oapi.AddUserTitleRequestObject) (oapi.AddUserTitleResponseObject, error) {
+	//TODO: add review if exists
+	status, err := UserTitleStatus2Sqlc1(&request.Body.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.AddUserTitle400Response{}, nil
+	}
+
+	params := sqlc.InsertUserTitleParams{
+		UserID:  request.UserId,
+		TitleID: request.Body.TitleId,
+		Status:  *status,
+		Rate:    request.Body.Rate,
+	}
+
+	user_title, err := s.db.InsertUserTitle(ctx, params)
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) {
+			// fmt.Println(pgErr.Message) // => syntax error at end of input
+			// fmt.Println(pgErr.Code)    // => 42601
+			if pgErr.Code == pgErrDuplicateKey { //duplicate key value
+				return oapi.AddUserTitle409Response{}, nil
+			}
+		} else {
+			log.Errorf("%v", err)
+			return oapi.AddUserTitle500Response{}, nil
+		}
+	}
+	oapi_status, err := sql2usertitlestatus(user_title.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.AddUserTitle500Response{}, nil
+	}
+	oapi_usertitle := oapi.UserTitleMini{
+		Ctime:    &user_title.Ctime,
+		Rate:     user_title.Rate,
+		ReviewId: user_title.ReviewID,
+		Status:   oapi_status,
+		TitleId:  user_title.TitleID,
+		UserId:   user_title.UserID,
+	}
+
+	return oapi.AddUserTitle200JSONResponse(oapi_usertitle), nil
+}
+
+// DeleteUserTitle implements oapi.StrictServerInterface.
+func (s Server) DeleteUserTitle(ctx context.Context, request oapi.DeleteUserTitleRequestObject) (oapi.DeleteUserTitleResponseObject, error) {
+	params := sqlc.DeleteUserTitleParams{
+		UserID:  request.UserId,
+		TitleID: request.TitleId,
+	}
+	_, err := s.db.DeleteUserTitle(ctx, params)
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return oapi.DeleteUserTitle404Response{}, nil
+		}
+		log.Errorf("%v", err)
+		return oapi.DeleteUserTitle500Response{}, nil
+	}
+	return oapi.DeleteUserTitle200Response{}, nil
+}
+
+// UpdateUserTitle implements oapi.StrictServerInterface.
+func (s Server) UpdateUserTitle(ctx context.Context, request oapi.UpdateUserTitleRequestObject) (oapi.UpdateUserTitleResponseObject, error) {
+
+	status, err := UserTitleStatus2Sqlc1(request.Body.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.UpdateUserTitle400Response{}, nil
+	}
+	params := sqlc.UpdateUserTitleParams{
+		Status:  status,
+		Rate:    request.Body.Rate,
+		UserID:  request.UserId,
+		TitleID: request.TitleId,
+	}
+
+	user_title, err := s.db.UpdateUserTitle(ctx, params)
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return oapi.UpdateUserTitle404Response{}, nil
+		}
+		log.Errorf("%v", err)
+		return oapi.UpdateUserTitle500Response{}, nil
+	}
+	oapi_status, err := sql2usertitlestatus(user_title.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.UpdateUserTitle500Response{}, nil
+	}
+
+	oapi_usertitle := oapi.UserTitleMini{
+		Ctime:    &user_title.Ctime,
+		Rate:     user_title.Rate,
+		ReviewId: user_title.ReviewID,
+		Status:   oapi_status,
+		TitleId:  user_title.TitleID,
+		UserId:   user_title.UserID,
+	}
+
+	return oapi.UpdateUserTitle200JSONResponse(oapi_usertitle), nil
+}
+
+func (s Server) GetUserTitle(ctx context.Context, request oapi.GetUserTitleRequestObject) (oapi.GetUserTitleResponseObject, error) {
+	user_title, err := s.db.GetUserTitleByID(ctx, sqlc.GetUserTitleByIDParams{
+		TitleID: request.TitleId,
+		UserID:  request.UserId,
+	})
+	if err != nil {
+		if err == pgx.ErrNoRows {
+			return oapi.GetUserTitle404Response{}, nil
+		} else {
+			log.Errorf("%v", err)
+			return oapi.GetUserTitle500Response{}, nil
+		}
+	}
+	oapi_status, err := sql2usertitlestatus(user_title.Status)
+	if err != nil {
+		log.Errorf("%v", err)
+		return oapi.GetUserTitle500Response{}, nil
+	}
+	oapi_usertitle := oapi.UserTitleMini{
+		Ctime:    &user_title.Ctime,
+		Rate:     user_title.Rate,
+		ReviewId: user_title.ReviewID,
+		Status:   oapi_status,
+		TitleId:  user_title.TitleID,
+		UserId:   user_title.UserID,
+	}
+
+	return oapi.GetUserTitle200JSONResponse(oapi_usertitle), nil
 }

modules/backend/main.go

@@ -3,6 +3,7 @@ package main
 import (
 	"context"
 	"fmt"
+	"net/http"
 	sqlc "nyanimedb/sql"
 	"os"
 	"reflect"
@@ -10,46 +11,64 @@ import (
 
 	oapi "nyanimedb/api"
 	handlers "nyanimedb/modules/backend/handlers"
+	middleware "nyanimedb/modules/backend/middlewares"
+	"nyanimedb/modules/backend/rmq"
 
 	"github.com/gin-contrib/cors"
 	"github.com/gin-gonic/gin"
-	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/pelletier/go-toml/v2"
+	"github.com/rabbitmq/amqp091-go"
+	log "github.com/sirupsen/logrus"
 )
 
 var AppConfig Config
 
 func main() {
-	// if len(os.Args) != 2 {
-	// 	AppConfig.Mode = "env"
-	// } else {
-	// 	AppConfig.Mode = "argv"
-	// }
+	if len(os.Args) != 2 {
+		AppConfig.Mode = "env"
+	} else {
+		AppConfig.Mode = "argv"
+	}
 
-	// err := InitConfig()
-	// if err != nil {
-	// 	log.Fatalf("Failed to init config: %v\n", err)
-	// }
+	err := InitConfig()
+	if err != nil {
+		log.Fatalf("Failed to init config: %v\n", err)
+	}
 
-	conn, err := pgx.Connect(context.Background(), os.Getenv("DATABASE_URL"))
+	pool, err := pgxpool.New(context.Background(), AppConfig.DdUrl)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Unable to connect to database: %v\n", err)
 		os.Exit(1)
 	}
 
-	defer conn.Close(context.Background())
+	defer pool.Close()
 
 	r := gin.Default()
 
-	queries := sqlc.New(conn)
+	if len(AppConfig.AuthEnabled) > 0 && AppConfig.AuthEnabled != "false" {
+		r.Use(middleware.CSRFMiddleware())
+		r.Use(middleware.JWTAuthMiddleware(AppConfig.JwtPrivateKey))
+	}
 
-	server := handlers.NewServer(queries)
-	// r.LoadHTMLGlob("templates/*")
+	queries := sqlc.New(pool)
+
+	rmqConn, err := amqp091.Dial(AppConfig.RmqURL)
+	if err != nil {
+		log.Fatalf("Failed to connect to RabbitMQ: %v", err)
+	}
+	defer rmqConn.Close()
+
+	publisher := rmq.NewPublisher(rmqConn)
+	rpcClient := rmq.NewRPCClient(rmqConn, 30*time.Second)
+
+	server := handlers.NewServer(queries, publisher, rpcClient)
 
 	r.Use(cors.New(cors.Config{
-		AllowOrigins:     []string{"*"}, // allow all origins, change to specific domains in production
-		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE"},
-		AllowHeaders:     []string{"Origin", "Content-Type", "Accept"},
+		AllowOrigins: []string{AppConfig.ServiceAddress},
+		// AllowOrigins:     []string{"*"},
+		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "PATCH"},
+		AllowHeaders:     []string{"Origin", "Content-Type", "Accept", "X-XSRF-TOKEN"},
 		ExposeHeaders:    []string{"Content-Length"},
 		AllowCredentials: true,
 		MaxAge:           12 * time.Hour,
@@ -57,27 +76,15 @@ func main() {
 
 	oapi.RegisterHandlers(r, oapi.NewStrictHandler(
 		server,
-		// сюда можно добавить middlewares, если нужно
+
 		[]oapi.StrictMiddlewareFunc{},
 	))
-	// r.GET("/", func(c *gin.Context) {
-	// 	c.HTML(http.StatusOK, "index.html", gin.H{
-	// 		"title":   "Welcome Page",
-	// 		"message": "Hello, Gin with HTML templates!",
-	// 	})
-	// })
 
-	// r.GET("/api", func(c *gin.Context) {
-	// 	items := []Item{
-	// 		{ID: 1, Title: "First Item", Description: "This is the description of the first item."},
-	// 		{ID: 2, Title: "Second Item", Description: "This is the description of the second item."},
-	// 		{ID: 3, Title: "Third Item", Description: "This is the description of the third item."},
-	// 	}
-
-	// 	c.JSON(http.StatusOK, items)
-	// })
-
-	r.Run(":8080")
+	// Запуск
+	log.Infof("Server starting on :8080")
+	if err := r.Run(":8080"); err != nil && err != http.ErrServerClosed {
+		log.Fatalf("server failed: %v", err)
+	}
 }
 
 func InitConfig() error {

modules/backend/middlewares/access.go

@@ -0,0 +1,109 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// ctxKey — приватный тип для ключа контекста
+type ctxKey struct{}
+
+// ginContextKey — уникальный ключ для хранения *gin.Context
+var ginContextKey = &ctxKey{}
+
+// GinContextToContext сохраняет *gin.Context в context.Context запроса
+func GinContextToContext(c *gin.Context) {
+	ctx := context.WithValue(c.Request.Context(), ginContextKey, c)
+	c.Request = c.Request.WithContext(ctx)
+}
+
+// GinContextFromContext извлекает *gin.Context из context.Context
+func GinContextFromContext(ctx context.Context) (*gin.Context, bool) {
+	ginCtx, ok := ctx.Value(ginContextKey).(*gin.Context)
+	return ginCtx, ok
+}
+
+func JWTAuthMiddleware(secret string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// 1. Получаем access_token из cookie
+		tokenStr, err := c.Cookie("access_token")
+		if err != nil {
+			abortWithJSON(c, http.StatusUnauthorized, "missing access_token cookie")
+			return
+		}
+
+		// 2. Парсим токен с MapClaims
+		token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
+			if t.Method != jwt.SigningMethodHS256 {
+				return nil, errors.New("unexpected signing method: " + t.Method.Alg())
+			}
+			return []byte(secret), nil // ← конвертируем string → []byte
+		})
+		if err != nil {
+			abortWithJSON(c, http.StatusUnauthorized, "invalid token: "+err.Error())
+			return
+		}
+
+		// 3. Проверяем валидность
+		if !token.Valid {
+			abortWithJSON(c, http.StatusUnauthorized, "token is invalid")
+			return
+		}
+
+		// 4. Извлекаем user_id из claims
+		claims, ok := token.Claims.(jwt.MapClaims)
+		if !ok {
+			abortWithJSON(c, http.StatusUnauthorized, "invalid claims format")
+			return
+		}
+
+		userID, ok := claims["user_id"].(string)
+		if !ok || userID == "" {
+			abortWithJSON(c, http.StatusUnauthorized, "user_id claim missing or invalid")
+			return
+		}
+
+		// 5. Сохраняем в контексте
+		c.Set("user_id", userID)
+
+		// 6. Для oapi-codegen — кладём gin.Context в request context
+		GinContextToContext(c)
+
+		c.Next()
+	}
+}
+
+// Вспомогательные функции (без изменений)
+func UserIDFromGin(c *gin.Context) (string, bool) {
+	id, exists := c.Get("user_id")
+	if !exists {
+		return "", false
+	}
+	if s, ok := id.(string); ok {
+		return s, true
+	}
+	return "", false
+}
+
+func UserIDFromContext(ctx context.Context) (string, error) {
+	ginCtx, ok := GinContextFromContext(ctx)
+	if !ok {
+		return "", errors.New("gin context not found")
+	}
+	userID, ok := UserIDFromGin(ginCtx)
+	if !ok {
+		return "", errors.New("user_id not found in context")
+	}
+	return userID, nil
+}
+
+func abortWithJSON(c *gin.Context, code int, message string) {
+	c.AbortWithStatusJSON(code, gin.H{
+		"error":   "unauthorized",
+		"message": message,
+	})
+}

modules/backend/middlewares/csrf.go

@@ -0,0 +1,70 @@
+package middleware
+
+import (
+	"crypto/subtle"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// CSRFMiddleware для Gin
+func CSRFMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// Пропускаем безопасные методы
+		if !isStateChangingMethod(c.Request.Method) {
+			c.Next()
+			return
+		}
+
+		// 1. Получаем токен из заголовка
+		headerToken := c.GetHeader("X-XSRF-TOKEN")
+		if headerToken == "" {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"error": "missing X-XSRF-TOKEN header",
+			})
+			return
+		}
+
+		// 2. Получаем токен из cookie
+		cookie, err := c.Cookie("xsrf_token")
+		if err != nil {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"error": "missing xsrf_token cookie",
+			})
+			return
+		}
+
+		// 3. Безопасное сравнение
+		if subtle.ConstantTimeCompare([]byte(headerToken), []byte(cookie)) != 1 {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
+				"error": "CSRF token mismatch",
+			})
+			return
+		}
+
+		// 4. Опционально: сохраняем токен в контексте
+		c.Set("csrf_token", headerToken)
+		c.Next()
+	}
+}
+
+func isStateChangingMethod(method string) bool {
+	switch method {
+	case http.MethodPost, http.MethodPut, http.MethodPatch, http.MethodDelete:
+		return true
+	default:
+		return false
+	}
+}
+
+// CSRFTokenFromGin извлекает токен из Gin context
+func CSRFTokenFromGin(c *gin.Context) (string, bool) {
+	token, exists := c.Get("xsrf_token")
+	if !exists {
+		return "", false
+	}
+	if s, ok := token.(string); ok {
+		return s, true
+	}
+	return "", false
+}

modules/backend/queries.sql

@@ -1,7 +1,7 @@
 -- name: GetImageByID :one
 SELECT id, storage_type, image_path
 FROM images
-WHERE id = sqlc.arg('illust_id');
+WHERE id = sqlc.arg('illust_id')::bigint;
 
 -- name: CreateImage :one
 INSERT INTO images (storage_type, image_path)
@@ -9,9 +9,19 @@ VALUES ($1, $2)
 RETURNING id, storage_type, image_path;
 
 -- name: GetUserByID :one
-SELECT id, avatar_id, mail, nickname, disp_name, user_desc, creation_date
-FROM users
-WHERE id = $1;
+SELECT 
+    t.id                as id,
+    t.avatar_id         as avatar_id,
+    t.mail              as mail,
+    t.nickname          as nickname,
+    t.disp_name         as disp_name,
+    t.user_desc         as user_desc,
+    t.creation_date     as creation_date,
+    i.storage_type      as storage_type,
+    i.image_path        as image_path
+FROM users as t
+LEFT JOIN images as i ON (t.avatar_id = i.id)
+WHERE t.id = sqlc.arg('id')::bigint;
 
 
 -- name: GetStudioByID :one
@@ -47,162 +57,347 @@ VALUES (
     sqlc.arg('tag_names')::jsonb)
 RETURNING id, tag_names;
 
--- -- name: ListUsers :many
--- SELECT user_id, avatar_id, passhash, mail, nickname, disp_name, user_desc, creation_date
--- FROM users
--- ORDER BY user_id
--- LIMIT $1 OFFSET $2;
-
--- -- name: CreateUser :one
--- INSERT INTO users (avatar_id, passhash, mail, nickname, disp_name, user_desc, creation_date)
--- VALUES ($1, $2, $3, $4, $5, $6, $7)
--- RETURNING user_id, avatar_id, nickname, disp_name, user_desc, creation_date;
-
--- -- name: UpdateUser :one
--- UPDATE users
--- SET
---   avatar_id = COALESCE(sqlc.narg('avatar_id'), avatar_id),
---   disp_name = COALESCE(sqlc.narg('disp_name'), disp_name),
---   user_desc = COALESCE(sqlc.narg('user_desc'), user_desc),
---   passhash  = COALESCE(sqlc.narg('passhash'), passhash)
--- WHERE user_id = sqlc.arg('user_id')
--- RETURNING user_id, avatar_id, nickname, disp_name, user_desc, creation_date;
-
--- -- name: DeleteUser :exec
--- DELETE FROM users
--- WHERE user_id = $1;
+-- name: UpdateUser :one
+UPDATE users
+SET
+  avatar_id = COALESCE(sqlc.narg('avatar_id'), avatar_id),
+  disp_name = COALESCE(sqlc.narg('disp_name'), disp_name),
+  user_desc = COALESCE(sqlc.narg('user_desc'), user_desc),
+  mail      = COALESCE(sqlc.narg('mail'), mail)
+WHERE id = sqlc.arg('user_id')
+RETURNING id, avatar_id, nickname, disp_name, user_desc, creation_date, mail;
 
 -- name: GetTitleByID :one
-SELECT *
-FROM titles
-WHERE id = sqlc.arg('title_id')::bigint;
+-- sqlc.struct: TitlesFull
+SELECT 
+    t.*,
+    i.storage_type                          as title_storage_type,
+    i.image_path                            as title_image_path,
+    COALESCE(
+        jsonb_agg(g.tag_names) FILTER (WHERE g.tag_names IS NOT NULL),
+        '[]'::jsonb
+    )::jsonb                                as tag_names,
+    s.studio_name                           as studio_name,
+    s.illust_id                             as studio_illust_id,
+    s.studio_desc                           as studio_desc,
+    si.storage_type                         as studio_storage_type,
+    si.image_path                           as studio_image_path
+
+FROM titles          as t
+LEFT JOIN images     as i    ON (t.poster_id = i.id)
+LEFT JOIN title_tags as tt   ON (t.id = tt.title_id)
+LEFT JOIN tags       as g    ON (tt.tag_id = g.id)
+LEFT JOIN studios    as s    ON (t.studio_id = s.id)
+LEFT JOIN images     as si   ON (s.illust_id = si.id)
+
+WHERE t.id = sqlc.arg('title_id')::bigint
+GROUP BY 
+    t.id, i.id, s.id, si.id;
 
 -- name: SearchTitles :many
 SELECT 
-    *
-FROM titles
-WHERE 
-    CASE 
-        WHEN sqlc.narg('word')::text IS NOT NULL THEN
-            (
-                SELECT bool_and(
-                    EXISTS (
-                        SELECT 1 
-                        FROM jsonb_each_text(title_names) AS t(key, val)
-                        WHERE val ILIKE pattern
-                    )
-                )
-                FROM unnest(
-                    ARRAY(
-                        SELECT '%' || trim(w) || '%'
-                        FROM unnest(string_to_array(sqlc.narg('word')::text, ' ')) AS w
-                        WHERE trim(w) <> ''
-                    )
-                ) AS pattern
-            )
-        ELSE true
+    t.id                                    as id,
+    t.title_names                           as title_names,
+    t.poster_id                             as poster_id,
+    t.title_status                          as title_status,
+    t.rating                                as rating,
+    t.rating_count                          as rating_count,
+    t.release_year                          as release_year,
+    t.release_season                        as release_season,
+    t.season                                as season,
+    t.episodes_aired                        as episodes_aired,
+    t.episodes_all                          as episodes_all,
+    i.storage_type                          as title_storage_type,
+    i.image_path                            as title_image_path,
+    COALESCE(
+        jsonb_agg(g.tag_names) FILTER (WHERE g.tag_names IS NOT NULL),
+        '[]'::jsonb
+    )::jsonb                                as tag_names,
+    s.studio_name                           as studio_name
+
+FROM titles          as t
+LEFT JOIN images     as i    ON (t.poster_id = i.id)
+LEFT JOIN title_tags as tt   ON (t.id = tt.title_id)
+LEFT JOIN tags       as g    ON (tt.tag_id = g.id)
+LEFT JOIN studios    as s    ON (t.studio_id = s.id)
+
+WHERE
+    CASE
+        WHEN sqlc.arg('forward')::boolean THEN
+        -- forward: greater than cursor (next page)
+            CASE sqlc.arg('sort_by')::text
+                WHEN 'year' THEN
+                    (sqlc.narg('cursor_year')::int IS NULL) OR
+                    (t.release_year > sqlc.narg('cursor_year')::int) OR
+                    (t.release_year = sqlc.narg('cursor_year')::int AND t.id > sqlc.narg('cursor_id')::bigint)
+
+                WHEN 'rating' THEN
+                        (sqlc.narg('cursor_rating')::float IS NULL) OR
+                        (t.rating > sqlc.narg('cursor_rating')::float) OR
+                        (t.rating = sqlc.narg('cursor_rating')::float AND t.id > sqlc.narg('cursor_id')::bigint)
+
+                WHEN 'id' THEN
+                    (sqlc.narg('cursor_id')::bigint IS NULL) OR
+                    (t.id > sqlc.narg('cursor_id')::bigint)
+
+                ELSE true  -- fallback
+            END
+
+    ELSE
+        -- backward: less than cursor (prev page)
+        CASE sqlc.arg('sort_by')::text
+            WHEN 'year' THEN
+                (sqlc.narg('cursor_year')::int IS NULL) OR
+                (t.release_year < sqlc.narg('cursor_year')::int) OR
+                (t.release_year = sqlc.narg('cursor_year')::int AND t.id < sqlc.narg('cursor_id')::bigint)
+
+            WHEN 'rating' THEN
+                (sqlc.narg('cursor_rating')::float IS NULL) OR
+                (t.rating < sqlc.narg('cursor_rating')::float) OR
+                (t.rating = sqlc.narg('cursor_rating')::float AND t.id < sqlc.narg('cursor_id')::bigint)
+
+            WHEN 'id' THEN
+                (sqlc.narg('cursor_id')::bigint IS NULL) OR
+                (t.id < sqlc.narg('cursor_id')::bigint)
+
+            ELSE true
+        END
     END
 
-    AND (sqlc.narg('status')::title_status_t IS NULL OR title_status = sqlc.narg('status')::title_status_t)
-    AND (sqlc.narg('rating')::float IS NULL OR rating >= sqlc.narg('rating')::float)
-    AND (sqlc.narg('release_year')::int IS NULL OR release_year = sqlc.narg('release_year')::int)
-    AND (sqlc.narg('release_season')::release_season_t IS NULL OR release_season = sqlc.narg('release_season')::release_season_t)
+    AND (
+        CASE 
+            WHEN sqlc.narg('word')::text IS NOT NULL THEN
+                (
+                    SELECT bool_and(
+                        EXISTS (
+                            SELECT 1 
+                            FROM jsonb_each_text(t.title_names) AS t(key, val)
+                            WHERE val ILIKE pattern
+                        )
+                    )
+                    FROM unnest(
+                        ARRAY(
+                            SELECT '%' || trim(w) || '%'
+                            FROM unnest(string_to_array(sqlc.narg('word')::text, ' ')) AS w
+                            WHERE trim(w) <> ''
+                        )
+                    ) AS pattern
+                )
+            ELSE true
+        END
+    )
 
-LIMIT COALESCE(sqlc.narg('limit')::int, 100) -- 100 is default limit
-OFFSET sqlc.narg('offset')::int;
+    AND (
+        sqlc.narg('title_statuses')::title_status_t[] IS NULL
+        OR array_length(sqlc.narg('title_statuses')::title_status_t[], 1) IS NULL
+        OR array_length(sqlc.narg('title_statuses')::title_status_t[], 1) = 0
+        OR t.title_status = ANY(sqlc.narg('title_statuses')::title_status_t[])
+    )
+    AND (sqlc.narg('rating')::float IS NULL OR t.rating >= sqlc.narg('rating')::float)
+    AND (sqlc.narg('release_year')::int IS NULL OR t.release_year = sqlc.narg('release_year')::int)
+    AND (sqlc.narg('release_season')::release_season_t IS NULL OR t.release_season = sqlc.narg('release_season')::release_season_t)
 
--- -- name: ListTitles :many
--- SELECT title_id, title_names, studio_id, poster_id, signal_ids,
---        title_status, rating, rating_count, release_year, release_season,
---        season, episodes_aired, episodes_all, episodes_len
--- FROM titles
--- ORDER BY title_id
--- LIMIT $1 OFFSET $2;
+GROUP BY 
+    t.id, i.id, s.id
 
--- -- name: UpdateTitle :one
--- UPDATE titles
--- SET
---   title_names = COALESCE(sqlc.narg('title_names'), title_names),
---   studio_id = COALESCE(sqlc.narg('studio_id'), studio_id),
---   poster_id = COALESCE(sqlc.narg('poster_id'), poster_id),
---   signal_ids = COALESCE(sqlc.narg('signal_ids'), signal_ids),
---   title_status = COALESCE(sqlc.narg('title_status'), title_status),
---   release_year = COALESCE(sqlc.narg('release_year'), release_year),
---   release_season = COALESCE(sqlc.narg('release_season'), release_season),
---   episodes_aired = COALESCE(sqlc.narg('episodes_aired'), episodes_aired),
---   episodes_all = COALESCE(sqlc.narg('episodes_all'), episodes_all),
---   episodes_len = COALESCE(sqlc.narg('episodes_len'), episodes_len)
--- WHERE title_id = sqlc.arg('title_id')
--- RETURNING *;
+ORDER BY
+    CASE WHEN sqlc.arg('forward')::boolean THEN
+        CASE
+            WHEN sqlc.arg('sort_by')::text = 'id' THEN t.id
+            WHEN sqlc.arg('sort_by')::text = 'year' THEN t.release_year
+            WHEN sqlc.arg('sort_by')::text = 'rating' THEN t.rating
+        END
+    END ASC,
+    CASE WHEN NOT sqlc.arg('forward')::boolean THEN
+        CASE
+            WHEN sqlc.arg('sort_by')::text = 'id' THEN t.id
+            WHEN sqlc.arg('sort_by')::text = 'year' THEN t.release_year
+            WHEN sqlc.arg('sort_by')::text = 'rating' THEN t.rating
+        END
+    END DESC,
+
+    CASE WHEN sqlc.arg('sort_by')::text <> 'id' THEN t.id END ASC
+
+LIMIT COALESCE(sqlc.narg('limit')::int, 100); -- 100 is default limit
+
+-- name: SearchUserTitles :many
+SELECT
+    t.id                                    as id,
+    t.title_names                           as title_names,
+    t.poster_id                             as poster_id,
+    t.title_status                          as title_status,
+    t.rating                                as rating,
+    t.rating_count                          as rating_count,
+    t.release_year                          as release_year,
+    t.release_season                        as release_season,
+    t.season                                as season,
+    t.episodes_aired                        as episodes_aired,
+    t.episodes_all                          as episodes_all,
+    u.user_id                               as user_id,
+    u.status                                as usertitle_status,
+    u.rate                                  as user_rate,
+    u.review_id                             as review_id,
+    u.ctime                                 as user_ctime,
+    i.storage_type                          as title_storage_type,
+    i.image_path                            as title_image_path,
+    COALESCE(
+        jsonb_agg(g.tag_names) FILTER (WHERE g.tag_names IS NOT NULL),
+        '[]'::jsonb
+    )::jsonb                                as tag_names,
+    s.studio_name                           as studio_name
+
+FROM usertitles         as u
+JOIN titles             as t    ON (u.title_id = t.id)
+LEFT JOIN images        as i    ON (t.poster_id = i.id)
+LEFT JOIN title_tags    as tt   ON (t.id = tt.title_id)
+LEFT JOIN tags          as g    ON (tt.tag_id = g.id)
+LEFT JOIN studios       as s    ON (t.studio_id = s.id)
+
+WHERE
+    u.user_id = sqlc.arg('user_id')::bigint
+    AND
+    CASE
+        WHEN sqlc.arg('forward')::boolean THEN
+        -- forward: greater than cursor (next page)
+            CASE sqlc.arg('sort_by')::text
+                WHEN 'year' THEN
+                    (sqlc.narg('cursor_year')::int IS NULL) OR
+                    (t.release_year > sqlc.narg('cursor_year')::int) OR
+                    (t.release_year = sqlc.narg('cursor_year')::int AND t.id > sqlc.narg('cursor_id')::bigint)
+
+                WHEN 'rating' THEN
+                        (sqlc.narg('cursor_rating')::float IS NULL) OR
+                        (t.rating > sqlc.narg('cursor_rating')::float) OR
+                        (t.rating = sqlc.narg('cursor_rating')::float AND t.id > sqlc.narg('cursor_id')::bigint)
+
+                WHEN 'id' THEN
+                    (sqlc.narg('cursor_id')::bigint IS NULL) OR
+                    (t.id > sqlc.narg('cursor_id')::bigint)
+
+                ELSE true  -- fallback
+            END
+
+    ELSE
+        -- backward: less than cursor (prev page)
+        CASE sqlc.arg('sort_by')::text
+            WHEN 'year' THEN
+                (sqlc.narg('cursor_year')::int IS NULL) OR
+                (t.release_year < sqlc.narg('cursor_year')::int) OR
+                (t.release_year = sqlc.narg('cursor_year')::int AND t.id < sqlc.narg('cursor_id')::bigint)
+
+            WHEN 'rating' THEN
+                (sqlc.narg('cursor_rating')::float IS NULL) OR
+                (t.rating < sqlc.narg('cursor_rating')::float) OR
+                (t.rating = sqlc.narg('cursor_rating')::float AND t.id < sqlc.narg('cursor_id')::bigint)
+
+            WHEN 'id' THEN
+                (sqlc.narg('cursor_id')::bigint IS NULL) OR
+                (t.id < sqlc.narg('cursor_id')::bigint)
+
+            ELSE true
+        END
+    END
+
+    AND (
+        CASE 
+            WHEN sqlc.narg('word')::text IS NOT NULL THEN
+                (
+                    SELECT bool_and(
+                        EXISTS (
+                            SELECT 1 
+                            FROM jsonb_each_text(t.title_names) AS t(key, val)
+                            WHERE val ILIKE pattern
+                        )
+                    )
+                    FROM unnest(
+                        ARRAY(
+                            SELECT '%' || trim(w) || '%'
+                            FROM unnest(string_to_array(sqlc.narg('word')::text, ' ')) AS w
+                            WHERE trim(w) <> ''
+                        )
+                    ) AS pattern
+                )
+            ELSE true
+        END
+    )
+
+    AND (
+        sqlc.narg('title_statuses')::title_status_t[] IS NULL
+        OR array_length(sqlc.narg('title_statuses')::title_status_t[], 1) IS NULL
+        OR array_length(sqlc.narg('title_statuses')::title_status_t[], 1) = 0
+        OR t.title_status = ANY(sqlc.narg('title_statuses')::title_status_t[])
+    )
+    AND (
+        sqlc.narg('usertitle_statuses')::usertitle_status_t[] IS NULL
+        OR array_length(sqlc.narg('usertitle_statuses')::usertitle_status_t[], 1) IS NULL
+        OR array_length(sqlc.narg('usertitle_statuses')::usertitle_status_t[], 1) = 0
+        OR u.status = ANY(sqlc.narg('usertitle_statuses')::usertitle_status_t[])
+    )
+    AND (sqlc.narg('rate')::int IS NULL OR u.rate >= sqlc.narg('rate')::int)
+    AND (sqlc.narg('rating')::float IS NULL OR t.rating >= sqlc.narg('rating')::float)
+    AND (sqlc.narg('release_year')::int IS NULL OR t.release_year = sqlc.narg('release_year')::int)
+    AND (sqlc.narg('release_season')::release_season_t IS NULL OR t.release_season = sqlc.narg('release_season')::release_season_t)
+
+GROUP BY 
+    t.id, u.user_id, u.status, u.rate, u.review_id, u.ctime, i.id, s.id
+
+ORDER BY
+    CASE WHEN sqlc.arg('forward')::boolean THEN
+        CASE
+            WHEN sqlc.arg('sort_by')::text = 'id' THEN t.id
+            WHEN sqlc.arg('sort_by')::text = 'year' THEN t.release_year
+            WHEN sqlc.arg('sort_by')::text = 'rating' THEN t.rating
+            WHEN sqlc.arg('sort_by')::text = 'rate' THEN u.rate
+        END
+    END ASC,
+    CASE WHEN NOT sqlc.arg('forward')::boolean THEN
+        CASE
+            WHEN sqlc.arg('sort_by')::text = 'id' THEN t.id
+            WHEN sqlc.arg('sort_by')::text = 'year' THEN t.release_year
+            WHEN sqlc.arg('sort_by')::text = 'rating' THEN t.rating
+            WHEN sqlc.arg('sort_by')::text = 'rate' THEN u.rate
+        END
+    END DESC,
+
+    CASE WHEN sqlc.arg('sort_by')::text <> 'id' THEN t.id END ASC
+
+LIMIT COALESCE(sqlc.narg('limit')::int, 100); -- 100 is default limit
 
 -- name: GetReviewByID :one
 SELECT *
 FROM reviews
 WHERE review_id = sqlc.arg('review_id')::bigint;
 
--- -- name: CreateReview :one
--- INSERT INTO reviews (user_id, title_id, image_ids, review_text, creation_date)
--- VALUES ($1, $2, $3, $4, $5)
--- RETURNING review_id, user_id, title_id, image_ids, review_text, creation_date;
+-- name: InsertUserTitle :one
+INSERT INTO usertitles (user_id, title_id, status, rate, review_id)
+VALUES (   
+    sqlc.arg('user_id')::bigint,
+    sqlc.arg('title_id')::bigint,
+    sqlc.arg('status')::usertitle_status_t,
+    sqlc.narg('rate')::int,
+    sqlc.narg('review_id')::bigint
+)
+RETURNING user_id, title_id, status, rate, review_id, ctime;
 
--- -- name: UpdateReview :one
--- UPDATE reviews
--- SET
---   image_ids = COALESCE(sqlc.narg('image_ids'), image_ids),
---   review_text = COALESCE(sqlc.narg('review_text'), review_text)
--- WHERE review_id = sqlc.arg('review_id')
--- RETURNING *;
+-- name: UpdateUserTitle :one
+-- Fails with sql.ErrNoRows if (user_id, title_id) not found
+UPDATE usertitles
+SET
+    status = COALESCE(sqlc.narg('status')::usertitle_status_t, status),
+    rate   = COALESCE(sqlc.narg('rate')::int, rate)
+WHERE
+    user_id = sqlc.arg('user_id')
+    AND title_id = sqlc.arg('title_id')
+RETURNING *;
 
--- -- name: DeleteReview :exec
--- DELETE FROM reviews
--- WHERE review_id = $1;
+-- name: DeleteUserTitle :one
+DELETE FROM usertitles
+WHERE user_id = sqlc.arg('user_id')
+  AND title_id = sqlc.arg('title_id')
+RETURNING *;
 
--- name: ListReviewsByTitle :many
--- SELECT review_id, user_id, title_id, image_ids, review_text, creation_date
--- FROM reviews
--- WHERE title_id = $1
--- ORDER BY creation_date DESC
--- LIMIT $2 OFFSET $3;
-
--- -- name: ListReviewsByUser :many
--- SELECT review_id, user_id, title_id, image_ids, review_text, creation_date
--- FROM reviews
--- WHERE user_id = $1
--- ORDER BY creation_date DESC
--- LIMIT $2 OFFSET $3;
-
--- -- name: GetUserTitle :one
--- SELECT usertitle_id, user_id, title_id, status, rate, review_id
--- FROM usertitles
--- WHERE user_id = $1 AND title_id = $2;
-
--- -- name: ListUserTitles :many
--- SELECT usertitle_id, user_id, title_id, status, rate, review_id
--- FROM usertitles
--- WHERE user_id = $1
--- ORDER BY usertitle_id
--- LIMIT $2 OFFSET $3;
-
--- -- name: CreateUserTitle :one
--- INSERT INTO usertitles (user_id, title_id, status, rate, review_id)
--- VALUES ($1, $2, $3, $4, $5)
--- RETURNING usertitle_id, user_id, title_id, status, rate, review_id;
-
--- -- name: UpdateUserTitle :one
--- UPDATE usertitles
--- SET
---   status = COALESCE(sqlc.narg('status'), status),
---   rate = COALESCE(sqlc.narg('rate'), rate),
---   review_id = COALESCE(sqlc.narg('review_id'), review_id)
--- WHERE user_id = $1 AND title_id = $2
--- RETURNING *;
-
--- -- name: DeleteUserTitle :exec
--- DELETE FROM usertitles
--- WHERE user_id = $1 AND ($2::int IS NULL OR title_id = $2);
-
--- -- name: ListTags :many
--- SELECT tag_id, tag_names
--- FROM tags
--- ORDER BY tag_id
--- LIMIT $1 OFFSET $2;
+-- name: GetUserTitleByID :one
+SELECT 
+    ut.*
+FROM usertitles      as ut
+WHERE ut.title_id = sqlc.arg('title_id')::bigint AND ut.user_id = sqlc.arg('user_id')::bigint;

modules/backend/rmq/rabbit.go

@@ -0,0 +1,261 @@
+package rmq
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	oapi "nyanimedb/api"
+	"sync"
+	"time"
+
+	amqp "github.com/rabbitmq/amqp091-go"
+)
+
+type RabbitRequest struct {
+	Name      string             `json:"name"`
+	Statuses  []oapi.TitleStatus `json:"statuses,omitempty"`
+	Rating    float64            `json:"rating,omitempty"`
+	Year      int32              `json:"year,omitempty"`
+	Season    oapi.ReleaseSeason `json:"season,omitempty"`
+	Timestamp time.Time          `json:"timestamp"`
+}
+
+// Publisher — потокобезопасный публикатор с пулом каналов.
+type Publisher struct {
+	conn *amqp.Connection
+	pool *sync.Pool
+}
+
+// NewPublisher создаёт новый Publisher.
+// conn должен быть уже установленным и healthy.
+// Рекомендуется передавать durable connection с reconnect-логикой.
+func NewPublisher(conn *amqp.Connection) *Publisher {
+	return &Publisher{
+		conn: conn,
+		pool: &sync.Pool{
+			New: func() any {
+				ch, err := conn.Channel()
+				if err != nil {
+					// Паника уместна: невозможность открыть канал — критическая ошибка инициализации
+					panic(fmt.Errorf("rmqpool: failed to create channel: %w", err))
+				}
+				return ch
+			},
+		},
+	}
+}
+
+// Publish публикует сообщение в указанную очередь.
+// Очередь объявляется как durable (если не существует).
+// Поддерживает context для отмены/таймаута.
+func (p *Publisher) Publish(
+	ctx context.Context,
+	queueName string,
+	payload RabbitRequest,
+	opts ...PublishOption,
+) error {
+	// Применяем опции
+	options := &publishOptions{
+		contentType:  "application/json",
+		deliveryMode: amqp.Persistent,
+		timestamp:    time.Now(),
+	}
+	for _, opt := range opts {
+		opt(options)
+	}
+
+	// Сериализуем payload
+	body, err := json.Marshal(payload)
+	if err != nil {
+		return fmt.Errorf("rmqpool: failed to marshal payload: %w", err)
+	}
+
+	// Берём канал из пула
+	ch := p.getChannel()
+	if ch == nil {
+		return fmt.Errorf("rmqpool: channel is nil (connection may be closed)")
+	}
+	defer p.returnChannel(ch)
+
+	// Объявляем очередь (idempotent)
+	q, err := ch.QueueDeclare(
+		queueName,
+		true,  // durable
+		false, // auto-delete
+		false, // exclusive
+		false, // no-wait
+		nil,   // args
+	)
+	if err != nil {
+		return fmt.Errorf("rmqpool: failed to declare queue %q: %w", queueName, err)
+	}
+
+	// Подготавливаем сообщение
+	msg := amqp.Publishing{
+		DeliveryMode: options.deliveryMode,
+		ContentType:  options.contentType,
+		Timestamp:    options.timestamp,
+		Body:         body,
+	}
+
+	// Публикуем с учётом контекста
+	done := make(chan error, 1)
+	go func() {
+		err := ch.Publish(
+			"",     // exchange (default)
+			q.Name, // routing key
+			false,  // mandatory
+			false,  // immediate
+			msg,
+		)
+		done <- err
+	}()
+
+	select {
+	case err := <-done:
+		return err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+func (p *Publisher) getChannel() *amqp.Channel {
+	raw := p.pool.Get()
+	if raw == nil {
+		ch, _ := p.conn.Channel()
+		return ch
+	}
+	ch := raw.(*amqp.Channel)
+	if ch.IsClosed() { // ← теперь есть!
+		ch.Close() // освободить ресурсы
+		ch, _ = p.conn.Channel()
+	}
+	return ch
+}
+
+// returnChannel возвращает канал в пул, если он жив.
+func (p *Publisher) returnChannel(ch *amqp.Channel) {
+	if ch != nil && !ch.IsClosed() {
+		p.pool.Put(ch)
+	}
+}
+
+// PublishOption позволяет кастомизировать публикацию.
+type PublishOption func(*publishOptions)
+
+type publishOptions struct {
+	contentType  string
+	deliveryMode uint8
+	timestamp    time.Time
+}
+
+// WithContentType устанавливает Content-Type (по умолчанию "application/json").
+func WithContentType(ct string) PublishOption {
+	return func(o *publishOptions) { o.contentType = ct }
+}
+
+// WithTransient делает сообщение transient (не сохраняется на диск).
+// По умолчанию — Persistent.
+func WithTransient() PublishOption {
+	return func(o *publishOptions) { o.deliveryMode = amqp.Transient }
+}
+
+// WithTimestamp устанавливает кастомную метку времени.
+func WithTimestamp(ts time.Time) PublishOption {
+	return func(o *publishOptions) { o.timestamp = ts }
+}
+
+type RPCClient struct {
+	conn    *amqp.Connection
+	timeout time.Duration
+}
+
+func NewRPCClient(conn *amqp.Connection, timeout time.Duration) *RPCClient {
+	return &RPCClient{conn: conn, timeout: timeout}
+}
+
+// Call отправляет запрос в очередь и ждёт ответа.
+// replyPayload — указатель на структуру, в которую раскодировать ответ (например, &MediaResponse{}).
+func (c *RPCClient) Call(
+	ctx context.Context,
+	requestQueue string,
+	request RabbitRequest,
+	replyPayload any,
+) error {
+	// 1. Создаём временный канал (не из пула!)
+	ch, err := c.conn.Channel()
+	if err != nil {
+		return fmt.Errorf("channel: %w", err)
+	}
+	defer ch.Close()
+
+	// 2. Создаём временную очередь для ответов
+	q, err := ch.QueueDeclare(
+		"",    // auto name
+		false, // not durable
+		true,  // exclusive
+		true,  // auto-delete
+		false,
+		nil,
+	)
+	if err != nil {
+		return fmt.Errorf("reply queue: %w", err)
+	}
+
+	// 3. Подписываемся на ответы
+	msgs, err := ch.Consume(
+		q.Name,
+		"",
+		true, // auto-ack
+		true, // exclusive
+		false,
+		false,
+		nil,
+	)
+	if err != nil {
+		return fmt.Errorf("consume: %w", err)
+	}
+
+	// 4. Готовим correlation ID
+	corrID := time.Now().UnixNano()
+
+	// 5. Сериализуем запрос
+	body, err := json.Marshal(request)
+	if err != nil {
+		return fmt.Errorf("marshal request: %w", err)
+	}
+
+	// 6. Публикуем запрос
+	err = ch.Publish(
+		"",
+		requestQueue,
+		false,
+		false,
+		amqp.Publishing{
+			ContentType:   "application/json",
+			CorrelationId: fmt.Sprintf("%d", corrID),
+			ReplyTo:       q.Name,
+			Timestamp:     time.Now(),
+			Body:          body,
+		},
+	)
+	if err != nil {
+		return fmt.Errorf("publish: %w", err)
+	}
+
+	// 7. Ждём ответ с таймаутом
+	ctx, cancel := context.WithTimeout(ctx, c.timeout)
+	defer cancel()
+
+	for {
+		select {
+		case msg := <-msgs:
+			if msg.CorrelationId == fmt.Sprintf("%d", corrID) {
+				return json.Unmarshal(msg.Body, replyPayload)
+			}
+			// игнорируем другие сообщения (маловероятно, но возможно)
+		case <-ctx.Done():
+			return ctx.Err() // timeout or cancelled
+		}
+	}
+}

modules/backend/types.go

@@ -1,12 +1,11 @@
 package main
 
 type Config struct {
-	Mode     string
-	LogLevel string `toml:"LogLevel" env:"LOG_LEVEL"`
-}
-
-type Item struct {
-	ID          int    `json:"id"`
-	Title       string `json:"title"`
-	Description string `json:"description"`
+	Mode           string
+	ServiceAddress string `toml:"ServiceAddress" env:"SERVICE_ADDRESS"`
+	DdUrl          string `toml:"DbUrl" env:"DATABASE_URL"`
+	JwtPrivateKey  string `toml:"JwtPrivateKey" env:"JWT_PRIVATE_KEY"`
+	LogLevel       string `toml:"LogLevel" env:"LOG_LEVEL"`
+	RmqURL         string `toml:"RabbitMQUrl" env:"RABBITMQ_URL"`
+	AuthEnabled    string `toml:"AuthEnabled" env:"AUTH_ENABLED"`
 }

modules/bot/back/include/BotToServer.hpp

@@ -0,0 +1,31 @@
+#pragma once
+#include "CppRestOpenAPIClient/ApiClient.h"
+#include "CppRestOpenAPIClient/ApiConfiguration.h"
+#include "CppRestOpenAPIClient/api/DefaultApi.h"
+#include "CppRestOpenAPIClient/model/User.h"
+#include "CppRestOpenAPIClient/model/GetUserTitles_200_response.h"
+#include "CppRestOpenAPIClient/model/UserTitle.h"
+#include "CppRestOpenAPIClient/model/Title.h"
+#include "constants.hpp"
+#include "structs.hpp"
+#include <iostream>
+#include <thread>
+#include <functional>
+#include <memory>
+#include <cpprest/asyncrt_utils.h>
+#include <boost/optional.hpp>
+
+using namespace org::openapitools::client::api;
+
+class BotToServer {
+public:
+    BotToServer();
+
+    // Асинхронный метод: получить список тайтлов пользователя
+    pplx::task<std::vector<BotStructs::Title>> fetchUserTitlesAsync(const std::string& userId);
+
+private:
+    std::shared_ptr<org::openapitools::client::api::ApiConfiguration> apiconfiguration;
+    std::shared_ptr<org::openapitools::client::api::ApiClient> apiclient;
+    std::shared_ptr<org::openapitools::client::api::DefaultApi> api;
+};

modules/bot/back/src/BotToServer.cpp

@@ -0,0 +1,93 @@
+#include "BotToServer.hpp"
+
+BotToServer::BotToServer() {
+    apiconfiguration = std::make_shared<ApiConfiguration>();
+    const char* envUrl = getenv("NYANIMEDBBASEURL");
+    if (!envUrl) {
+         std::runtime_error("Environment variable NYANIMEDBBASEURL is not set");
+    }
+    apiconfiguration->setBaseUrl(utility::conversions::to_string_t(envUrl));
+    apiconfiguration->setUserAgent(utility::conversions::to_string_t("OpenAPI Client"));
+    apiclient = std::make_shared<ApiClient>(apiconfiguration);
+    api = std::make_shared<DefaultApi>(apiclient);
+}
+
+// Вспомогательная функция: преобразует UserTitle → BotStructs::Title
+static BotStructs::Title mapUserTitleToBotTitle(
+    const std::shared_ptr<org::openapitools::client::model::UserTitle>& userTitle
+) {
+    if (!userTitle || !userTitle->titleIsSet()) {
+        return BotStructs::Title{0, "Invalid", "", -1};
+    }
+
+    auto apiTitle = userTitle->getTitle();
+    if (!apiTitle) {
+        return BotStructs::Title{0, "No Title", "", -1};
+    }
+
+    int64_t id = apiTitle->getId();
+
+    std::string name = "Untitled";
+    auto titleNames = apiTitle->getTitleNames();
+    utility::string_t ru = U("ru");
+
+    if (titleNames.find(ru) != titleNames.end() && !titleNames.at(ru).empty()) {
+        name = utility::conversions::to_utf8string(titleNames.at(ru).front());
+    } else if (!titleNames.empty()) {
+        const auto& firstLang = *titleNames.begin();
+        if (!firstLang.second.empty()) {
+            name = utility::conversions::to_utf8string(firstLang.second.front());
+        }
+    }
+
+    std::string description = ""; // описание пока не поддерживается в OpenAPI-модели
+    return BotStructs::Title{id, name, description, -1};
+}
+
+pplx::task<std::vector<BotStructs::Title>> BotToServer::fetchUserTitlesAsync(const std::string& userId) {
+    utility::string_t userIdW = utility::conversions::to_string_t(userId);
+    int32_t limit = static_cast<int32_t>(BotConstants::DISP_TITLES_NUM);
+
+    auto responseTask = api->getUserTitles(
+        userIdW,
+        boost::none, // cursor
+        boost::none, // sort
+        boost::none, // sortForward
+        boost::none, // word
+        boost::none, // status
+        boost::none, // watchStatus
+        boost::none, // rating
+        boost::none, // myRate
+        boost::none, // releaseYear
+        boost::none, // releaseSeason
+        limit,
+        boost::none  // fields
+    );
+
+    return responseTask.then([=](pplx::task<std::shared_ptr<org::openapitools::client::model::GetUserTitles_200_response>> task) {
+        try {
+            auto response = task.get();
+            if (!response) {
+                throw std::runtime_error("Null response from getUserTitles");
+            }
+
+            const auto& userTitles = response->getData();
+            std::vector<BotStructs::Title> result;
+            result.reserve(userTitles.size());
+
+            for (size_t i = 0; i < userTitles.size(); ++i) {
+                BotStructs::Title botTitle = mapUserTitleToBotTitle(userTitles[i]);
+                botTitle.num = static_cast<int64_t>(i); // 0-based индекс
+                result.push_back(botTitle);
+            }
+
+            return result;
+        } catch (const web::http::http_exception& e) {
+            std::cerr << "HTTP error in fetchUserTitlesAsync: " << e.what() << std::endl;
+            throw;
+        } catch (const std::exception& e) {
+            std::cerr << "Error in fetchUserTitlesAsync: " << e.what() << std::endl;
+            throw;
+        }
+    });
+}

modules/bot/front/CMakeLists.txt

@@ -1,7 +1,16 @@
 cmake_minimum_required(VERSION 3.10.2)
 project(AnimeBot)
 
-file(GLOB SOURCES "src/*.cpp")
+set(SOURCES "")
+file(GLOB_RECURSE SRC_FRONT "src/*.cpp")
+list(APPEND SOURCES ${SRC_FRONT})
+
+file(GLOB_RECURSE SRC_BACK "../back/src/*.cpp")
+list(APPEND SOURCES ${SRC_BACK})
+
+file(GLOB_RECURSE SRC_API "../generated-client/src/*.cpp")
+list(APPEND SOURCES ${SRC_API})
+
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wall")
@@ -12,8 +21,11 @@ find_package(Threads REQUIRED)
 find_package(OpenSSL REQUIRED)
 find_package(Boost COMPONENTS system REQUIRED)
 find_package(CURL)
+find_library(CPPREST_LIB cpprest REQUIRED)
 include_directories(/usr/local/include ${OPENSSL_INCLUDE_DIR} ${Boost_INCLUDE_DIR})
 include_directories(include/)
+include_directories(../back/include)
+include_directories(../generated-client/include)
 if (CURL_FOUND)
     include_directories(${CURL_INCLUDE_DIRS})
     add_definitions(-DHAVE_CURL)
@@ -21,4 +33,4 @@ endif()
 
 add_executable(AnimeBot ${SOURCES})
 
-target_link_libraries(AnimeBot /usr/local/lib/libTgBot.a ${CMAKE_THREAD_LIBS_INIT} ${OPENSSL_LIBRARIES} ${Boost_LIBRARIES} ${CURL_LIBRARIES})
+target_link_libraries(AnimeBot /usr/local/lib/libTgBot.a ${CMAKE_THREAD_LIBS_INIT} ${OPENSSL_LIBRARIES} ${Boost_LIBRARIES} ${CURL_LIBRARIES} ${CPPREST_LIB})

modules/bot/front/include/KeyboardFactory.hpp

@@ -7,7 +7,7 @@ public:
     static TgBot::InlineKeyboardMarkup::Ptr createMainMenu();
 
     /// Create keyboard for My_Titles
-    static TgBot::InlineKeyboardMarkup::Ptr createMyTitles(std::vector<Title> titles);
+    static TgBot::InlineKeyboardMarkup::Ptr createMyTitles(std::vector<BotStructs::Title> titles);
 
     /// Create keyboard for sendError
     static TgBot::InlineKeyboardMarkup::Ptr createError(const std::string& errorCallback);

modules/bot/front/include/constants.hpp

@@ -39,5 +39,6 @@ namespace BotConstants {
         const std::string MAIN_MENU = "Вас приветствует nyanimedb бот:)\nЧего будем делать?";
         const std::string SAD_ERROR = "У нас что-то случилось:(\nМы обязательно скоро исправимся";
         const std::string AUTH_ERROR = "Проблемы с авторизацией, попробуйте авторизоваться повторно";
+        const std::string SERVER_ERROR = "Не удалось загрузить данные. Попробуйте позже.";
     }
 }

modules/bot/front/include/handlers.hpp

@@ -3,6 +3,7 @@
 #include <string>
 #include <structs.hpp>
 #include <unordered_map>
+#include "BotToServer.hpp"
 
 /// @brief Структура возвращаемого значения класса BotHandlers для изменения текущего сообщения
 struct HandlerResult {
@@ -58,6 +59,7 @@ public:
 private:
     TgBot::Api botApi;
     std::unordered_map<int64_t, UserContext> userContexts;
+    BotToServer server_;
 
     void handleNavigation(TgBot::CallbackQuery::Ptr query, UserContext& ctx);
 
@@ -104,7 +106,7 @@ private:
     /// @brief Отрисовка текущего экрана (соотв. контексту)
     /// @param ctx - текущий контекст
     /// @return HandlerResult для нового состояния сообщения
-    HandlerResult renderCurrent(const UserContext& ctx);
+    HandlerResult renderCurrent(TgBot::CallbackQuery::Ptr query, const UserContext& ctx);
 
     /// @brief Логика переходов между контекстами (навигация на следующий шаг)
     /// @param query - запрос
@@ -120,4 +122,7 @@ private:
     /// @brief Посылает интерфейс обработки ошибки на callback запрос
     /// @param query запрос
     void sendError(TgBot::CallbackQuery::Ptr query, const std::string& errText);
+
+    // Форматирование для отображения в сообщении
+    std::string formatTitlesList(const std::vector<BotStructs::Title>& titles);
 };

modules/bot/front/include/structs.hpp

@@ -1,8 +1,10 @@
 #pragma once
 
+namespace BotStructs {
 struct Title {
     int64_t id;
     std::string name;
     std::string description;
     int64_t num;
 };
+}

modules/bot/front/src/KeyboardFactory.cpp

@@ -15,13 +15,13 @@ TgBot::InlineKeyboardMarkup::Ptr KeyboardFactory::createMainMenu() {
 }
 
 // TODO: Переписать с учетом констант на количество отображаемых тайтлов и нового callback'a
-TgBot::InlineKeyboardMarkup::Ptr KeyboardFactory::createMyTitles(std::vector<Title> titles) {
+TgBot::InlineKeyboardMarkup::Ptr KeyboardFactory::createMyTitles(std::vector<BotStructs::Title> titles) {
     auto keyboard = std::make_shared<TgBot::InlineKeyboardMarkup>();
     std::vector<TgBot::InlineKeyboardButton::Ptr> row;
     std::vector<std::vector<TgBot::InlineKeyboardButton::Ptr>> layout;
 
     int counter = 0;
-    for(Title& title : titles) {
+    for(BotStructs::Title& title : titles) {
         if(counter >= 6) {
             break;
         }

modules/bot/front/src/handlers.cpp

@@ -22,7 +22,7 @@ void BotHandlers::handleCallback(TgBot::CallbackQuery::Ptr query) {
 
 HandlerResult BotHandlers::returnMyTitles(int64_t userId, int64_t payload) {
     // Здесь должен происходить запрос на сервер
-    std::vector<Title> titles = {{123, "Школа мертвяков", "", 1}, {321, "KissXsis", "", 2}};
+    std::vector<BotStructs::Title> titles = {{123, "Школа мертвяков", "", 1}, {321, "KissXsis", "", 2}};
 
     struct HandlerResult result;
     result.keyboard = KeyboardFactory::createMyTitles(titles);
@@ -85,7 +85,8 @@ void BotHandlers::handleNavigation(TgBot::CallbackQuery::Ptr query, UserContext&
 
         ctx.history.back().payload = newPayload;
 
-        auto result = renderCurrent(ctx);
+        auto result = renderCurrent(query, ctx);
+        if(result.message == "meow") return; // TODO: убрать
         editMessage(query, result);
         return;
     }
@@ -96,7 +97,8 @@ void BotHandlers::handleNavigation(TgBot::CallbackQuery::Ptr query, UserContext&
             sendError(query, BotConstants::Text::SAD_ERROR);
             return;
         }
-        auto result = renderCurrent(ctx);
+        auto result = renderCurrent(query, ctx);
+        if(result.message == "meow") return; // TODO: убрать
         editMessage(query, result);
         return;
     }
@@ -109,7 +111,8 @@ void BotHandlers::handleNavigation(TgBot::CallbackQuery::Ptr query, UserContext&
     }
 
     ctx.history.push_back(*newStepOpt);
-    auto result = renderCurrent(ctx);
+    auto result = renderCurrent(query, ctx);
+    if(result.message == "meow") return; // TODO: убрать
     editMessage(query, result);
 }
 
@@ -161,15 +164,32 @@ void BotHandlers::editMessage(TgBot::CallbackQuery::Ptr query, HandlerResult res
     );
 }
 
-HandlerResult BotHandlers::renderCurrent(const UserContext& ctx) {
+HandlerResult BotHandlers::renderCurrent(TgBot::CallbackQuery::Ptr query, const UserContext& ctx) {
     const auto& step = ctx.history.back();
+    int64_t userId = query->from->id;
     switch (step.state) {
         case UserState::MAIN_MENU:
             return showMainMenu();
         case UserState::VIEWING_MY_TITLES:
-            return returnMyTitles(ctx.userId, step.payload); // payload = offset
+            server_.fetchUserTitlesAsync(std::to_string(2)) // ALARM: тестовое значение вместо userId
+                .then([this, query](pplx::task<std::vector<BotStructs::Title>> t) {
+                    try {
+                        auto titles = t.get();
+
+                        std::string message = formatTitlesList(titles);
+                        auto keyboard = KeyboardFactory::createMyTitles(titles);
+
+                        editMessage(query, {message, keyboard});
+
+                    } catch (const std::exception& e) {
+                        sendError(query, BotConstants::Text::SERVER_ERROR);
+                        // Логирование ошибки (например, в cerr)
+                    }
+                });
+
+            return {"meow", nullptr};
         /*
-            case UserState::VIEWING_TITLE_PAGE:
+        case UserState::VIEWING_TITLE_PAGE:
             return returnTitlePage(step.payload); // payload = titleId
         case UserState::VIEWING_REVIEW:
             return returnReview(step.payload); // payload = reviewId
@@ -256,4 +276,17 @@ void BotHandlers::handleError(TgBot::CallbackQuery::Ptr query, UserContext& ctx)
         HandlerResult result = {BotConstants::Text::AUTH_ERROR, nullptr};
         editMessage(query, result);
     }
+}
+
+std::string BotHandlers::formatTitlesList(const std::vector<BotStructs::Title>& titles) {
+    if (titles.empty()) {
+        return "У вас пока нет тайтлов.";
+    }
+
+    std::string msg;
+    for (size_t i = 0; i < titles.size(); ++i) {
+        // num — 0-based, но в сообщении показываем 1-based
+        msg += std::to_string(i + 1) + ". " + titles[i].name + "\n";
+    }
+    return msg;
 }

modules/frontend/nginx-default.conf

@@ -19,6 +19,15 @@ server {
         proxy_set_header Host $host;
         proxy_cache_bypass $http_upgrade;
     }
+    location /auth/ {
+        rewrite ^/auth/(.*)$ /$1 break;
+        proxy_pass http://nyanimedb-auth:8082/;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+    }
     #error_page  404              /404.html;
 
     error_page   500 502 503 504  /50x.html;

modules/frontend/package.json

@@ -10,10 +10,15 @@
     "preview": "vite preview"
   },
   "dependencies": {
+    "@headlessui/react": "^2.2.9",
+    "@heroicons/react": "^2.2.0",
+    "@tailwindcss/vite": "^4.1.17",
     "axios": "^1.12.2",
     "react": "^19.1.1",
+    "react-cookie": "^8.0.1",
     "react-dom": "^19.1.1",
-    "react-router-dom": "^7.9.4"
+    "react-router-dom": "^7.9.4",
+    "tailwindcss": "^4.1.17"
   },
   "devDependencies": {
     "@eslint/js": "^9.36.0",
@@ -29,5 +34,8 @@
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.45.0",
     "vite": "^7.1.7"
+  },
+  "engines": {
+    "node": "20.x"
   }
 }

modules/frontend/src/App.css

@@ -1,42 +0,0 @@
-#root {
-  max-width: 1280px;
-  margin: 0 auto;
-  padding: 2rem;
-  text-align: center;
-}
-
-.logo {
-  height: 6em;
-  padding: 1.5em;
-  will-change: filter;
-  transition: filter 300ms;
-}
-.logo:hover {
-  filter: drop-shadow(0 0 2em #646cffaa);
-}
-.logo.react:hover {
-  filter: drop-shadow(0 0 2em #61dafbaa);
-}
-
-@keyframes logo-spin {
-  from {
-    transform: rotate(0deg);
-  }
-  to {
-    transform: rotate(360deg);
-  }
-}
-
-@media (prefers-reduced-motion: no-preference) {
-  a:nth-of-type(2) .logo {
-    animation: logo-spin infinite 20s linear;
-  }
-}
-
-.card {
-  padding: 2em;
-}
-
-.read-the-docs {
-  color: #888;
-}

modules/frontend/src/App.tsx

@@ -1,15 +1,43 @@
 import React from "react";
 import { BrowserRouter as Router, Routes, Route } from "react-router-dom";
-import UserPage from "./components/UserPage/UserPage";
+import UserPage from "./pages/UserPage/UserPage";
+import TitlesPage from "./pages/TitlesPage/TitlesPage";
+import TitlePage from "./pages/TitlePage/TitlePage";
+import { LoginPage } from "./pages/LoginPage/LoginPage";
+import { Header } from "./components/Header/Header";
+
+// import { OpenAPI } from "./api";
+
+// OpenAPI.WITH_CREDENTIALS = true
 
 const App: React.FC = () => {
+  const username = localStorage.getItem("username") || undefined;
+  const userId = localStorage.getItem("userId");
+
   return (
     <Router>
+      <Header username={username} />
       <Routes>
+        {/* auth */}
+        <Route path="/login" element={<LoginPage />} />
+        <Route path="/signup" element={<LoginPage />} />
+        {/*<Route path="/signup" element={<LoginPage />} />*/}
+        
+        {/* users */}
+        {/*<Route path="/users" element={<UsersPage />} />*/}
         <Route path="/users/:id" element={<UserPage />} />
+        <Route
+          path="/profile"
+          element={userId ? <UserPage userId={userId} /> : <LoginPage />}
+        />
+
+        {/* titles */}
+        <Route path="/titles" element={<TitlesPage />} />
+        <Route path="/titles/:id" element={<TitlePage />} />
       </Routes>
     </Router>
   );
 };
 
+
 export default App;

modules/frontend/src/api/client.gen.ts

@@ -0,0 +1,16 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import { type ClientOptions, type Config, createClient, createConfig } from './client';
+import type { ClientOptions as ClientOptions2 } from './types.gen';
+
+/**
+ * The `createClientConfig()` function will be called on client initialization
+ * and the returned object will become the client's initial configuration.
+ *
+ * You may want to initialize your client this way instead of calling
+ * `setConfig()`. This is useful for example if you're using Next.js
+ * to ensure your client always has the correct values.
+ */
+export type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (override?: Config<ClientOptions & T>) => Config<Required<ClientOptions> & T>;
+
+export const client = createClient(createConfig<ClientOptions2>({ baseUrl: 'http://10.1.0.65:8081/api/v1' }));

modules/frontend/src/api/client/client.gen.ts

@@ -0,0 +1,301 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import { createSseClient } from '../core/serverSentEvents.gen';
+import type { HttpMethod } from '../core/types.gen';
+import { getValidRequestBody } from '../core/utils.gen';
+import type {
+  Client,
+  Config,
+  RequestOptions,
+  ResolvedRequestOptions,
+} from './types.gen';
+import {
+  buildUrl,
+  createConfig,
+  createInterceptors,
+  getParseAs,
+  mergeConfigs,
+  mergeHeaders,
+  setAuthParams,
+} from './utils.gen';
+
+type ReqInit = Omit<RequestInit, 'body' | 'headers'> & {
+  body?: any;
+  headers: ReturnType<typeof mergeHeaders>;
+};
+
+export const createClient = (config: Config = {}): Client => {
+  let _config = mergeConfigs(createConfig(), config);
+
+  const getConfig = (): Config => ({ ..._config });
+
+  const setConfig = (config: Config): Config => {
+    _config = mergeConfigs(_config, config);
+    return getConfig();
+  };
+
+  const interceptors = createInterceptors<
+    Request,
+    Response,
+    unknown,
+    ResolvedRequestOptions
+  >();
+
+  const beforeRequest = async (options: RequestOptions) => {
+    const opts = {
+      ..._config,
+      ...options,
+      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,
+      headers: mergeHeaders(_config.headers, options.headers),
+      serializedBody: undefined,
+    };
+
+    if (opts.security) {
+      await setAuthParams({
+        ...opts,
+        security: opts.security,
+      });
+    }
+
+    if (opts.requestValidator) {
+      await opts.requestValidator(opts);
+    }
+
+    if (opts.body !== undefined && opts.bodySerializer) {
+      opts.serializedBody = opts.bodySerializer(opts.body);
+    }
+
+    // remove Content-Type header if body is empty to avoid sending invalid requests
+    if (opts.body === undefined || opts.serializedBody === '') {
+      opts.headers.delete('Content-Type');
+    }
+
+    const url = buildUrl(opts);
+
+    return { opts, url };
+  };
+
+  const request: Client['request'] = async (options) => {
+    // @ts-expect-error
+    const { opts, url } = await beforeRequest(options);
+    const requestInit: ReqInit = {
+      redirect: 'follow',
+      ...opts,
+      body: getValidRequestBody(opts),
+    };
+
+    let request = new Request(url, requestInit);
+
+    for (const fn of interceptors.request.fns) {
+      if (fn) {
+        request = await fn(request, opts);
+      }
+    }
+
+    // fetch must be assigned here, otherwise it would throw the error:
+    // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation
+    const _fetch = opts.fetch!;
+    let response: Response;
+
+    try {
+      response = await _fetch(request);
+    } catch (error) {
+      // Handle fetch exceptions (AbortError, network errors, etc.)
+      let finalError = error;
+
+      for (const fn of interceptors.error.fns) {
+        if (fn) {
+          finalError = (await fn(
+            error,
+            undefined as any,
+            request,
+            opts,
+          )) as unknown;
+        }
+      }
+
+      finalError = finalError || ({} as unknown);
+
+      if (opts.throwOnError) {
+        throw finalError;
+      }
+
+      // Return error response
+      return opts.responseStyle === 'data'
+        ? undefined
+        : {
+            error: finalError,
+            request,
+            response: undefined as any,
+          };
+    }
+
+    for (const fn of interceptors.response.fns) {
+      if (fn) {
+        response = await fn(response, request, opts);
+      }
+    }
+
+    const result = {
+      request,
+      response,
+    };
+
+    if (response.ok) {
+      const parseAs =
+        (opts.parseAs === 'auto'
+          ? getParseAs(response.headers.get('Content-Type'))
+          : opts.parseAs) ?? 'json';
+
+      if (
+        response.status === 204 ||
+        response.headers.get('Content-Length') === '0'
+      ) {
+        let emptyData: any;
+        switch (parseAs) {
+          case 'arrayBuffer':
+          case 'blob':
+          case 'text':
+            emptyData = await response[parseAs]();
+            break;
+          case 'formData':
+            emptyData = new FormData();
+            break;
+          case 'stream':
+            emptyData = response.body;
+            break;
+          case 'json':
+          default:
+            emptyData = {};
+            break;
+        }
+        return opts.responseStyle === 'data'
+          ? emptyData
+          : {
+              data: emptyData,
+              ...result,
+            };
+      }
+
+      let data: any;
+      switch (parseAs) {
+        case 'arrayBuffer':
+        case 'blob':
+        case 'formData':
+        case 'json':
+        case 'text':
+          data = await response[parseAs]();
+          break;
+        case 'stream':
+          return opts.responseStyle === 'data'
+            ? response.body
+            : {
+                data: response.body,
+                ...result,
+              };
+      }
+
+      if (parseAs === 'json') {
+        if (opts.responseValidator) {
+          await opts.responseValidator(data);
+        }
+
+        if (opts.responseTransformer) {
+          data = await opts.responseTransformer(data);
+        }
+      }
+
+      return opts.responseStyle === 'data'
+        ? data
+        : {
+            data,
+            ...result,
+          };
+    }
+
+    const textError = await response.text();
+    let jsonError: unknown;
+
+    try {
+      jsonError = JSON.parse(textError);
+    } catch {
+      // noop
+    }
+
+    const error = jsonError ?? textError;
+    let finalError = error;
+
+    for (const fn of interceptors.error.fns) {
+      if (fn) {
+        finalError = (await fn(error, response, request, opts)) as string;
+      }
+    }
+
+    finalError = finalError || ({} as string);
+
+    if (opts.throwOnError) {
+      throw finalError;
+    }
+
+    // TODO: we probably want to return error and improve types
+    return opts.responseStyle === 'data'
+      ? undefined
+      : {
+          error: finalError,
+          ...result,
+        };
+  };
+
+  const makeMethodFn =
+    (method: Uppercase<HttpMethod>) => (options: RequestOptions) =>
+      request({ ...options, method });
+
+  const makeSseFn =
+    (method: Uppercase<HttpMethod>) => async (options: RequestOptions) => {
+      const { opts, url } = await beforeRequest(options);
+      return createSseClient({
+        ...opts,
+        body: opts.body as BodyInit | null | undefined,
+        headers: opts.headers as unknown as Record<string, string>,
+        method,
+        onRequest: async (url, init) => {
+          let request = new Request(url, init);
+          for (const fn of interceptors.request.fns) {
+            if (fn) {
+              request = await fn(request, opts);
+            }
+          }
+          return request;
+        },
+        url,
+      });
+    };
+
+  return {
+    buildUrl,
+    connect: makeMethodFn('CONNECT'),
+    delete: makeMethodFn('DELETE'),
+    get: makeMethodFn('GET'),
+    getConfig,
+    head: makeMethodFn('HEAD'),
+    interceptors,
+    options: makeMethodFn('OPTIONS'),
+    patch: makeMethodFn('PATCH'),
+    post: makeMethodFn('POST'),
+    put: makeMethodFn('PUT'),
+    request,
+    setConfig,
+    sse: {
+      connect: makeSseFn('CONNECT'),
+      delete: makeSseFn('DELETE'),
+      get: makeSseFn('GET'),
+      head: makeSseFn('HEAD'),
+      options: makeSseFn('OPTIONS'),
+      patch: makeSseFn('PATCH'),
+      post: makeSseFn('POST'),
+      put: makeSseFn('PUT'),
+      trace: makeSseFn('TRACE'),
+    },
+    trace: makeMethodFn('TRACE'),
+  } as Client;
+};

modules/frontend/src/api/client/index.ts

@@ -0,0 +1,25 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type { Auth } from '../core/auth.gen';
+export type { QuerySerializerOptions } from '../core/bodySerializer.gen';
+export {
+  formDataBodySerializer,
+  jsonBodySerializer,
+  urlSearchParamsBodySerializer,
+} from '../core/bodySerializer.gen';
+export { buildClientParams } from '../core/params.gen';
+export { serializeQueryKeyValue } from '../core/queryKeySerializer.gen';
+export { createClient } from './client.gen';
+export type {
+  Client,
+  ClientOptions,
+  Config,
+  CreateClientConfig,
+  Options,
+  RequestOptions,
+  RequestResult,
+  ResolvedRequestOptions,
+  ResponseStyle,
+  TDataShape,
+} from './types.gen';
+export { createConfig, mergeHeaders } from './utils.gen';

modules/frontend/src/api/client/types.gen.ts

@@ -0,0 +1,241 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { Auth } from '../core/auth.gen';
+import type {
+  ServerSentEventsOptions,
+  ServerSentEventsResult,
+} from '../core/serverSentEvents.gen';
+import type {
+  Client as CoreClient,
+  Config as CoreConfig,
+} from '../core/types.gen';
+import type { Middleware } from './utils.gen';
+
+export type ResponseStyle = 'data' | 'fields';
+
+export interface Config<T extends ClientOptions = ClientOptions>
+  extends Omit<RequestInit, 'body' | 'headers' | 'method'>,
+    CoreConfig {
+  /**
+   * Base URL for all requests made by this client.
+   */
+  baseUrl?: T['baseUrl'];
+  /**
+   * Fetch API implementation. You can use this option to provide a custom
+   * fetch instance.
+   *
+   * @default globalThis.fetch
+   */
+  fetch?: typeof fetch;
+  /**
+   * Please don't use the Fetch client for Next.js applications. The `next`
+   * options won't have any effect.
+   *
+   * Install {@link https://www.npmjs.com/package/@hey-api/client-next `@hey-api/client-next`} instead.
+   */
+  next?: never;
+  /**
+   * Return the response data parsed in a specified format. By default, `auto`
+   * will infer the appropriate method from the `Content-Type` response header.
+   * You can override this behavior with any of the {@link Body} methods.
+   * Select `stream` if you don't want to parse response data at all.
+   *
+   * @default 'auto'
+   */
+  parseAs?:
+    | 'arrayBuffer'
+    | 'auto'
+    | 'blob'
+    | 'formData'
+    | 'json'
+    | 'stream'
+    | 'text';
+  /**
+   * Should we return only data or multiple fields (data, error, response, etc.)?
+   *
+   * @default 'fields'
+   */
+  responseStyle?: ResponseStyle;
+  /**
+   * Throw an error instead of returning it in the response?
+   *
+   * @default false
+   */
+  throwOnError?: T['throwOnError'];
+}
+
+export interface RequestOptions<
+  TData = unknown,
+  TResponseStyle extends ResponseStyle = 'fields',
+  ThrowOnError extends boolean = boolean,
+  Url extends string = string,
+> extends Config<{
+      responseStyle: TResponseStyle;
+      throwOnError: ThrowOnError;
+    }>,
+    Pick<
+      ServerSentEventsOptions<TData>,
+      | 'onSseError'
+      | 'onSseEvent'
+      | 'sseDefaultRetryDelay'
+      | 'sseMaxRetryAttempts'
+      | 'sseMaxRetryDelay'
+    > {
+  /**
+   * Any body that you want to add to your request.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/fetch#body}
+   */
+  body?: unknown;
+  path?: Record<string, unknown>;
+  query?: Record<string, unknown>;
+  /**
+   * Security mechanism(s) to use for the request.
+   */
+  security?: ReadonlyArray<Auth>;
+  url: Url;
+}
+
+export interface ResolvedRequestOptions<
+  TResponseStyle extends ResponseStyle = 'fields',
+  ThrowOnError extends boolean = boolean,
+  Url extends string = string,
+> extends RequestOptions<unknown, TResponseStyle, ThrowOnError, Url> {
+  serializedBody?: string;
+}
+
+export type RequestResult<
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = boolean,
+  TResponseStyle extends ResponseStyle = 'fields',
+> = ThrowOnError extends true
+  ? Promise<
+      TResponseStyle extends 'data'
+        ? TData extends Record<string, unknown>
+          ? TData[keyof TData]
+          : TData
+        : {
+            data: TData extends Record<string, unknown>
+              ? TData[keyof TData]
+              : TData;
+            request: Request;
+            response: Response;
+          }
+    >
+  : Promise<
+      TResponseStyle extends 'data'
+        ?
+            | (TData extends Record<string, unknown>
+                ? TData[keyof TData]
+                : TData)
+            | undefined
+        : (
+            | {
+                data: TData extends Record<string, unknown>
+                  ? TData[keyof TData]
+                  : TData;
+                error: undefined;
+              }
+            | {
+                data: undefined;
+                error: TError extends Record<string, unknown>
+                  ? TError[keyof TError]
+                  : TError;
+              }
+          ) & {
+            request: Request;
+            response: Response;
+          }
+    >;
+
+export interface ClientOptions {
+  baseUrl?: string;
+  responseStyle?: ResponseStyle;
+  throwOnError?: boolean;
+}
+
+type MethodFn = <
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = false,
+  TResponseStyle extends ResponseStyle = 'fields',
+>(
+  options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, 'method'>,
+) => RequestResult<TData, TError, ThrowOnError, TResponseStyle>;
+
+type SseFn = <
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = false,
+  TResponseStyle extends ResponseStyle = 'fields',
+>(
+  options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, 'method'>,
+) => Promise<ServerSentEventsResult<TData, TError>>;
+
+type RequestFn = <
+  TData = unknown,
+  TError = unknown,
+  ThrowOnError extends boolean = false,
+  TResponseStyle extends ResponseStyle = 'fields',
+>(
+  options: Omit<RequestOptions<TData, TResponseStyle, ThrowOnError>, 'method'> &
+    Pick<
+      Required<RequestOptions<TData, TResponseStyle, ThrowOnError>>,
+      'method'
+    >,
+) => RequestResult<TData, TError, ThrowOnError, TResponseStyle>;
+
+type BuildUrlFn = <
+  TData extends {
+    body?: unknown;
+    path?: Record<string, unknown>;
+    query?: Record<string, unknown>;
+    url: string;
+  },
+>(
+  options: TData & Options<TData>,
+) => string;
+
+export type Client = CoreClient<
+  RequestFn,
+  Config,
+  MethodFn,
+  BuildUrlFn,
+  SseFn
+> & {
+  interceptors: Middleware<Request, Response, unknown, ResolvedRequestOptions>;
+};
+
+/**
+ * The `createClientConfig()` function will be called on client initialization
+ * and the returned object will become the client's initial configuration.
+ *
+ * You may want to initialize your client this way instead of calling
+ * `setConfig()`. This is useful for example if you're using Next.js
+ * to ensure your client always has the correct values.
+ */
+export type CreateClientConfig<T extends ClientOptions = ClientOptions> = (
+  override?: Config<ClientOptions & T>,
+) => Config<Required<ClientOptions> & T>;
+
+export interface TDataShape {
+  body?: unknown;
+  headers?: unknown;
+  path?: unknown;
+  query?: unknown;
+  url: string;
+}
+
+type OmitKeys<T, K> = Pick<T, Exclude<keyof T, K>>;
+
+export type Options<
+  TData extends TDataShape = TDataShape,
+  ThrowOnError extends boolean = boolean,
+  TResponse = unknown,
+  TResponseStyle extends ResponseStyle = 'fields',
+> = OmitKeys<
+  RequestOptions<TResponse, TResponseStyle, ThrowOnError>,
+  'body' | 'path' | 'query' | 'url'
+> &
+  ([TData] extends [never] ? unknown : Omit<TData, 'url'>);

modules/frontend/src/api/client/utils.gen.ts

@@ -0,0 +1,332 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import { getAuthToken } from '../core/auth.gen';
+import type { QuerySerializerOptions } from '../core/bodySerializer.gen';
+import { jsonBodySerializer } from '../core/bodySerializer.gen';
+import {
+  serializeArrayParam,
+  serializeObjectParam,
+  serializePrimitiveParam,
+} from '../core/pathSerializer.gen';
+import { getUrl } from '../core/utils.gen';
+import type { Client, ClientOptions, Config, RequestOptions } from './types.gen';
+
+export const createQuerySerializer = <T = unknown>({
+  parameters = {},
+  ...args
+}: QuerySerializerOptions = {}) => {
+  const querySerializer = (queryParams: T) => {
+    const search: string[] = [];
+    if (queryParams && typeof queryParams === 'object') {
+      for (const name in queryParams) {
+        const value = queryParams[name];
+
+        if (value === undefined || value === null) {
+          continue;
+        }
+
+        const options = parameters[name] || args;
+
+        if (Array.isArray(value)) {
+          const serializedArray = serializeArrayParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: 'form',
+            value,
+            ...options.array,
+          });
+          if (serializedArray) search.push(serializedArray);
+        } else if (typeof value === 'object') {
+          const serializedObject = serializeObjectParam({
+            allowReserved: options.allowReserved,
+            explode: true,
+            name,
+            style: 'deepObject',
+            value: value as Record<string, unknown>,
+            ...options.object,
+          });
+          if (serializedObject) search.push(serializedObject);
+        } else {
+          const serializedPrimitive = serializePrimitiveParam({
+            allowReserved: options.allowReserved,
+            name,
+            value: value as string,
+          });
+          if (serializedPrimitive) search.push(serializedPrimitive);
+        }
+      }
+    }
+    return search.join('&');
+  };
+  return querySerializer;
+};
+
+/**
+ * Infers parseAs value from provided Content-Type header.
+ */
+export const getParseAs = (
+  contentType: string | null,
+): Exclude<Config['parseAs'], 'auto'> => {
+  if (!contentType) {
+    // If no Content-Type header is provided, the best we can do is return the raw response body,
+    // which is effectively the same as the 'stream' option.
+    return 'stream';
+  }
+
+  const cleanContent = contentType.split(';')[0]?.trim();
+
+  if (!cleanContent) {
+    return;
+  }
+
+  if (
+    cleanContent.startsWith('application/json') ||
+    cleanContent.endsWith('+json')
+  ) {
+    return 'json';
+  }
+
+  if (cleanContent === 'multipart/form-data') {
+    return 'formData';
+  }
+
+  if (
+    ['application/', 'audio/', 'image/', 'video/'].some((type) =>
+      cleanContent.startsWith(type),
+    )
+  ) {
+    return 'blob';
+  }
+
+  if (cleanContent.startsWith('text/')) {
+    return 'text';
+  }
+
+  return;
+};
+
+const checkForExistence = (
+  options: Pick<RequestOptions, 'auth' | 'query'> & {
+    headers: Headers;
+  },
+  name?: string,
+): boolean => {
+  if (!name) {
+    return false;
+  }
+  if (
+    options.headers.has(name) ||
+    options.query?.[name] ||
+    options.headers.get('Cookie')?.includes(`${name}=`)
+  ) {
+    return true;
+  }
+  return false;
+};
+
+export const setAuthParams = async ({
+  security,
+  ...options
+}: Pick<Required<RequestOptions>, 'security'> &
+  Pick<RequestOptions, 'auth' | 'query'> & {
+    headers: Headers;
+  }) => {
+  for (const auth of security) {
+    if (checkForExistence(options, auth.name)) {
+      continue;
+    }
+
+    const token = await getAuthToken(auth, options.auth);
+
+    if (!token) {
+      continue;
+    }
+
+    const name = auth.name ?? 'Authorization';
+
+    switch (auth.in) {
+      case 'query':
+        if (!options.query) {
+          options.query = {};
+        }
+        options.query[name] = token;
+        break;
+      case 'cookie':
+        options.headers.append('Cookie', `${name}=${token}`);
+        break;
+      case 'header':
+      default:
+        options.headers.set(name, token);
+        break;
+    }
+  }
+};
+
+export const buildUrl: Client['buildUrl'] = (options) =>
+  getUrl({
+    baseUrl: options.baseUrl as string,
+    path: options.path,
+    query: options.query,
+    querySerializer:
+      typeof options.querySerializer === 'function'
+        ? options.querySerializer
+        : createQuerySerializer(options.querySerializer),
+    url: options.url,
+  });
+
+export const mergeConfigs = (a: Config, b: Config): Config => {
+  const config = { ...a, ...b };
+  if (config.baseUrl?.endsWith('/')) {
+    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);
+  }
+  config.headers = mergeHeaders(a.headers, b.headers);
+  return config;
+};
+
+const headersEntries = (headers: Headers): Array<[string, string]> => {
+  const entries: Array<[string, string]> = [];
+  headers.forEach((value, key) => {
+    entries.push([key, value]);
+  });
+  return entries;
+};
+
+export const mergeHeaders = (
+  ...headers: Array<Required<Config>['headers'] | undefined>
+): Headers => {
+  const mergedHeaders = new Headers();
+  for (const header of headers) {
+    if (!header) {
+      continue;
+    }
+
+    const iterator =
+      header instanceof Headers
+        ? headersEntries(header)
+        : Object.entries(header);
+
+    for (const [key, value] of iterator) {
+      if (value === null) {
+        mergedHeaders.delete(key);
+      } else if (Array.isArray(value)) {
+        for (const v of value) {
+          mergedHeaders.append(key, v as string);
+        }
+      } else if (value !== undefined) {
+        // assume object headers are meant to be JSON stringified, i.e. their
+        // content value in OpenAPI specification is 'application/json'
+        mergedHeaders.set(
+          key,
+          typeof value === 'object' ? JSON.stringify(value) : (value as string),
+        );
+      }
+    }
+  }
+  return mergedHeaders;
+};
+
+type ErrInterceptor<Err, Res, Req, Options> = (
+  error: Err,
+  response: Res,
+  request: Req,
+  options: Options,
+) => Err | Promise<Err>;
+
+type ReqInterceptor<Req, Options> = (
+  request: Req,
+  options: Options,
+) => Req | Promise<Req>;
+
+type ResInterceptor<Res, Req, Options> = (
+  response: Res,
+  request: Req,
+  options: Options,
+) => Res | Promise<Res>;
+
+class Interceptors<Interceptor> {
+  fns: Array<Interceptor | null> = [];
+
+  clear(): void {
+    this.fns = [];
+  }
+
+  eject(id: number | Interceptor): void {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = null;
+    }
+  }
+
+  exists(id: number | Interceptor): boolean {
+    const index = this.getInterceptorIndex(id);
+    return Boolean(this.fns[index]);
+  }
+
+  getInterceptorIndex(id: number | Interceptor): number {
+    if (typeof id === 'number') {
+      return this.fns[id] ? id : -1;
+    }
+    return this.fns.indexOf(id);
+  }
+
+  update(
+    id: number | Interceptor,
+    fn: Interceptor,
+  ): number | Interceptor | false {
+    const index = this.getInterceptorIndex(id);
+    if (this.fns[index]) {
+      this.fns[index] = fn;
+      return id;
+    }
+    return false;
+  }
+
+  use(fn: Interceptor): number {
+    this.fns.push(fn);
+    return this.fns.length - 1;
+  }
+}
+
+export interface Middleware<Req, Res, Err, Options> {
+  error: Interceptors<ErrInterceptor<Err, Res, Req, Options>>;
+  request: Interceptors<ReqInterceptor<Req, Options>>;
+  response: Interceptors<ResInterceptor<Res, Req, Options>>;
+}
+
+export const createInterceptors = <Req, Res, Err, Options>(): Middleware<
+  Req,
+  Res,
+  Err,
+  Options
+> => ({
+  error: new Interceptors<ErrInterceptor<Err, Res, Req, Options>>(),
+  request: new Interceptors<ReqInterceptor<Req, Options>>(),
+  response: new Interceptors<ResInterceptor<Res, Req, Options>>(),
+});
+
+const defaultQuerySerializer = createQuerySerializer({
+  allowReserved: false,
+  array: {
+    explode: true,
+    style: 'form',
+  },
+  object: {
+    explode: true,
+    style: 'deepObject',
+  },
+});
+
+const defaultHeaders = {
+  'Content-Type': 'application/json',
+};
+
+export const createConfig = <T extends ClientOptions = ClientOptions>(
+  override: Config<Omit<ClientOptions, keyof T> & T> = {},
+): Config<Omit<ClientOptions, keyof T> & T> => ({
+  ...jsonBodySerializer,
+  headers: defaultHeaders,
+  parseAs: 'auto',
+  querySerializer: defaultQuerySerializer,
+  ...override,
+});

modules/frontend/src/api/core/auth.gen.ts

@@ -0,0 +1,42 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type AuthToken = string | undefined;
+
+export interface Auth {
+  /**
+   * Which part of the request do we use to send the auth?
+   *
+   * @default 'header'
+   */
+  in?: 'header' | 'query' | 'cookie';
+  /**
+   * Header or query parameter name.
+   *
+   * @default 'Authorization'
+   */
+  name?: string;
+  scheme?: 'basic' | 'bearer';
+  type: 'apiKey' | 'http';
+}
+
+export const getAuthToken = async (
+  auth: Auth,
+  callback: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken,
+): Promise<string | undefined> => {
+  const token =
+    typeof callback === 'function' ? await callback(auth) : callback;
+
+  if (!token) {
+    return;
+  }
+
+  if (auth.scheme === 'bearer') {
+    return `Bearer ${token}`;
+  }
+
+  if (auth.scheme === 'basic') {
+    return `Basic ${btoa(token)}`;
+  }
+
+  return token;
+};

modules/frontend/src/api/core/bodySerializer.gen.ts

@@ -0,0 +1,100 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type {
+  ArrayStyle,
+  ObjectStyle,
+  SerializerOptions,
+} from './pathSerializer.gen';
+
+export type QuerySerializer = (query: Record<string, unknown>) => string;
+
+export type BodySerializer = (body: any) => any;
+
+type QuerySerializerOptionsObject = {
+  allowReserved?: boolean;
+  array?: Partial<SerializerOptions<ArrayStyle>>;
+  object?: Partial<SerializerOptions<ObjectStyle>>;
+};
+
+export type QuerySerializerOptions = QuerySerializerOptionsObject & {
+  /**
+   * Per-parameter serialization overrides. When provided, these settings
+   * override the global array/object settings for specific parameter names.
+   */
+  parameters?: Record<string, QuerySerializerOptionsObject>;
+};
+
+const serializeFormDataPair = (
+  data: FormData,
+  key: string,
+  value: unknown,
+): void => {
+  if (typeof value === 'string' || value instanceof Blob) {
+    data.append(key, value);
+  } else if (value instanceof Date) {
+    data.append(key, value.toISOString());
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+};
+
+const serializeUrlSearchParamsPair = (
+  data: URLSearchParams,
+  key: string,
+  value: unknown,
+): void => {
+  if (typeof value === 'string') {
+    data.append(key, value);
+  } else {
+    data.append(key, JSON.stringify(value));
+  }
+};
+
+export const formDataBodySerializer = {
+  bodySerializer: <T extends Record<string, any> | Array<Record<string, any>>>(
+    body: T,
+  ): FormData => {
+    const data = new FormData();
+
+    Object.entries(body).forEach(([key, value]) => {
+      if (value === undefined || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeFormDataPair(data, key, v));
+      } else {
+        serializeFormDataPair(data, key, value);
+      }
+    });
+
+    return data;
+  },
+};
+
+export const jsonBodySerializer = {
+  bodySerializer: <T>(body: T): string =>
+    JSON.stringify(body, (_key, value) =>
+      typeof value === 'bigint' ? value.toString() : value,
+    ),
+};
+
+export const urlSearchParamsBodySerializer = {
+  bodySerializer: <T extends Record<string, any> | Array<Record<string, any>>>(
+    body: T,
+  ): string => {
+    const data = new URLSearchParams();
+
+    Object.entries(body).forEach(([key, value]) => {
+      if (value === undefined || value === null) {
+        return;
+      }
+      if (Array.isArray(value)) {
+        value.forEach((v) => serializeUrlSearchParamsPair(data, key, v));
+      } else {
+        serializeUrlSearchParamsPair(data, key, value);
+      }
+    });
+
+    return data.toString();
+  },
+};

modules/frontend/src/api/core/params.gen.ts

@@ -0,0 +1,176 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+type Slot = 'body' | 'headers' | 'path' | 'query';
+
+export type Field =
+  | {
+      in: Exclude<Slot, 'body'>;
+      /**
+       * Field name. This is the name we want the user to see and use.
+       */
+      key: string;
+      /**
+       * Field mapped name. This is the name we want to use in the request.
+       * If omitted, we use the same value as `key`.
+       */
+      map?: string;
+    }
+  | {
+      in: Extract<Slot, 'body'>;
+      /**
+       * Key isn't required for bodies.
+       */
+      key?: string;
+      map?: string;
+    }
+  | {
+      /**
+       * Field name. This is the name we want the user to see and use.
+       */
+      key: string;
+      /**
+       * Field mapped name. This is the name we want to use in the request.
+       * If `in` is omitted, `map` aliases `key` to the transport layer.
+       */
+      map: Slot;
+    };
+
+export interface Fields {
+  allowExtra?: Partial<Record<Slot, boolean>>;
+  args?: ReadonlyArray<Field>;
+}
+
+export type FieldsConfig = ReadonlyArray<Field | Fields>;
+
+const extraPrefixesMap: Record<string, Slot> = {
+  $body_: 'body',
+  $headers_: 'headers',
+  $path_: 'path',
+  $query_: 'query',
+};
+const extraPrefixes = Object.entries(extraPrefixesMap);
+
+type KeyMap = Map<
+  string,
+  | {
+      in: Slot;
+      map?: string;
+    }
+  | {
+      in?: never;
+      map: Slot;
+    }
+>;
+
+const buildKeyMap = (fields: FieldsConfig, map?: KeyMap): KeyMap => {
+  if (!map) {
+    map = new Map();
+  }
+
+  for (const config of fields) {
+    if ('in' in config) {
+      if (config.key) {
+        map.set(config.key, {
+          in: config.in,
+          map: config.map,
+        });
+      }
+    } else if ('key' in config) {
+      map.set(config.key, {
+        map: config.map,
+      });
+    } else if (config.args) {
+      buildKeyMap(config.args, map);
+    }
+  }
+
+  return map;
+};
+
+interface Params {
+  body: unknown;
+  headers: Record<string, unknown>;
+  path: Record<string, unknown>;
+  query: Record<string, unknown>;
+}
+
+const stripEmptySlots = (params: Params) => {
+  for (const [slot, value] of Object.entries(params)) {
+    if (value && typeof value === 'object' && !Object.keys(value).length) {
+      delete params[slot as Slot];
+    }
+  }
+};
+
+export const buildClientParams = (
+  args: ReadonlyArray<unknown>,
+  fields: FieldsConfig,
+) => {
+  const params: Params = {
+    body: {},
+    headers: {},
+    path: {},
+    query: {},
+  };
+
+  const map = buildKeyMap(fields);
+
+  let config: FieldsConfig[number] | undefined;
+
+  for (const [index, arg] of args.entries()) {
+    if (fields[index]) {
+      config = fields[index];
+    }
+
+    if (!config) {
+      continue;
+    }
+
+    if ('in' in config) {
+      if (config.key) {
+        const field = map.get(config.key)!;
+        const name = field.map || config.key;
+        if (field.in) {
+          (params[field.in] as Record<string, unknown>)[name] = arg;
+        }
+      } else {
+        params.body = arg;
+      }
+    } else {
+      for (const [key, value] of Object.entries(arg ?? {})) {
+        const field = map.get(key);
+
+        if (field) {
+          if (field.in) {
+            const name = field.map || key;
+            (params[field.in] as Record<string, unknown>)[name] = value;
+          } else {
+            params[field.map] = value;
+          }
+        } else {
+          const extra = extraPrefixes.find(([prefix]) =>
+            key.startsWith(prefix),
+          );
+
+          if (extra) {
+            const [prefix, slot] = extra;
+            (params[slot] as Record<string, unknown>)[
+              key.slice(prefix.length)
+            ] = value;
+          } else if ('allowExtra' in config && config.allowExtra) {
+            for (const [slot, allowed] of Object.entries(config.allowExtra)) {
+              if (allowed) {
+                (params[slot as Slot] as Record<string, unknown>)[key] = value;
+                break;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  stripEmptySlots(params);
+
+  return params;
+};

modules/frontend/src/api/core/pathSerializer.gen.ts

@@ -0,0 +1,181 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+interface SerializeOptions<T>
+  extends SerializePrimitiveOptions,
+    SerializerOptions<T> {}
+
+interface SerializePrimitiveOptions {
+  allowReserved?: boolean;
+  name: string;
+}
+
+export interface SerializerOptions<T> {
+  /**
+   * @default true
+   */
+  explode: boolean;
+  style: T;
+}
+
+export type ArrayStyle = 'form' | 'spaceDelimited' | 'pipeDelimited';
+export type ArraySeparatorStyle = ArrayStyle | MatrixStyle;
+type MatrixStyle = 'label' | 'matrix' | 'simple';
+export type ObjectStyle = 'form' | 'deepObject';
+type ObjectSeparatorStyle = ObjectStyle | MatrixStyle;
+
+interface SerializePrimitiveParam extends SerializePrimitiveOptions {
+  value: string;
+}
+
+export const separatorArrayExplode = (style: ArraySeparatorStyle) => {
+  switch (style) {
+    case 'label':
+      return '.';
+    case 'matrix':
+      return ';';
+    case 'simple':
+      return ',';
+    default:
+      return '&';
+  }
+};
+
+export const separatorArrayNoExplode = (style: ArraySeparatorStyle) => {
+  switch (style) {
+    case 'form':
+      return ',';
+    case 'pipeDelimited':
+      return '|';
+    case 'spaceDelimited':
+      return '%20';
+    default:
+      return ',';
+  }
+};
+
+export const separatorObjectExplode = (style: ObjectSeparatorStyle) => {
+  switch (style) {
+    case 'label':
+      return '.';
+    case 'matrix':
+      return ';';
+    case 'simple':
+      return ',';
+    default:
+      return '&';
+  }
+};
+
+export const serializeArrayParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+}: SerializeOptions<ArraySeparatorStyle> & {
+  value: unknown[];
+}) => {
+  if (!explode) {
+    const joinedValues = (
+      allowReserved ? value : value.map((v) => encodeURIComponent(v as string))
+    ).join(separatorArrayNoExplode(style));
+    switch (style) {
+      case 'label':
+        return `.${joinedValues}`;
+      case 'matrix':
+        return `;${name}=${joinedValues}`;
+      case 'simple':
+        return joinedValues;
+      default:
+        return `${name}=${joinedValues}`;
+    }
+  }
+
+  const separator = separatorArrayExplode(style);
+  const joinedValues = value
+    .map((v) => {
+      if (style === 'label' || style === 'simple') {
+        return allowReserved ? v : encodeURIComponent(v as string);
+      }
+
+      return serializePrimitiveParam({
+        allowReserved,
+        name,
+        value: v as string,
+      });
+    })
+    .join(separator);
+  return style === 'label' || style === 'matrix'
+    ? separator + joinedValues
+    : joinedValues;
+};
+
+export const serializePrimitiveParam = ({
+  allowReserved,
+  name,
+  value,
+}: SerializePrimitiveParam) => {
+  if (value === undefined || value === null) {
+    return '';
+  }
+
+  if (typeof value === 'object') {
+    throw new Error(
+      'Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.',
+    );
+  }
+
+  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;
+};
+
+export const serializeObjectParam = ({
+  allowReserved,
+  explode,
+  name,
+  style,
+  value,
+  valueOnly,
+}: SerializeOptions<ObjectSeparatorStyle> & {
+  value: Record<string, unknown> | Date;
+  valueOnly?: boolean;
+}) => {
+  if (value instanceof Date) {
+    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;
+  }
+
+  if (style !== 'deepObject' && !explode) {
+    let values: string[] = [];
+    Object.entries(value).forEach(([key, v]) => {
+      values = [
+        ...values,
+        key,
+        allowReserved ? (v as string) : encodeURIComponent(v as string),
+      ];
+    });
+    const joinedValues = values.join(',');
+    switch (style) {
+      case 'form':
+        return `${name}=${joinedValues}`;
+      case 'label':
+        return `.${joinedValues}`;
+      case 'matrix':
+        return `;${name}=${joinedValues}`;
+      default:
+        return joinedValues;
+    }
+  }
+
+  const separator = separatorObjectExplode(style);
+  const joinedValues = Object.entries(value)
+    .map(([key, v]) =>
+      serializePrimitiveParam({
+        allowReserved,
+        name: style === 'deepObject' ? `${name}[${key}]` : key,
+        value: v as string,
+      }),
+    )
+    .join(separator);
+  return style === 'label' || style === 'matrix'
+    ? separator + joinedValues
+    : joinedValues;
+};

modules/frontend/src/api/core/queryKeySerializer.gen.ts

@@ -0,0 +1,136 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+/**
+ * JSON-friendly union that mirrors what Pinia Colada can hash.
+ */
+export type JsonValue =
+  | null
+  | string
+  | number
+  | boolean
+  | JsonValue[]
+  | { [key: string]: JsonValue };
+
+/**
+ * Replacer that converts non-JSON values (bigint, Date, etc.) to safe substitutes.
+ */
+export const queryKeyJsonReplacer = (_key: string, value: unknown) => {
+  if (
+    value === undefined ||
+    typeof value === 'function' ||
+    typeof value === 'symbol'
+  ) {
+    return undefined;
+  }
+  if (typeof value === 'bigint') {
+    return value.toString();
+  }
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+  return value;
+};
+
+/**
+ * Safely stringifies a value and parses it back into a JsonValue.
+ */
+export const stringifyToJsonValue = (input: unknown): JsonValue | undefined => {
+  try {
+    const json = JSON.stringify(input, queryKeyJsonReplacer);
+    if (json === undefined) {
+      return undefined;
+    }
+    return JSON.parse(json) as JsonValue;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Detects plain objects (including objects with a null prototype).
+ */
+const isPlainObject = (value: unknown): value is Record<string, unknown> => {
+  if (value === null || typeof value !== 'object') {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value as object);
+  return prototype === Object.prototype || prototype === null;
+};
+
+/**
+ * Turns URLSearchParams into a sorted JSON object for deterministic keys.
+ */
+const serializeSearchParams = (params: URLSearchParams): JsonValue => {
+  const entries = Array.from(params.entries()).sort(([a], [b]) =>
+    a.localeCompare(b),
+  );
+  const result: Record<string, JsonValue> = {};
+
+  for (const [key, value] of entries) {
+    const existing = result[key];
+    if (existing === undefined) {
+      result[key] = value;
+      continue;
+    }
+
+    if (Array.isArray(existing)) {
+      (existing as string[]).push(value);
+    } else {
+      result[key] = [existing, value];
+    }
+  }
+
+  return result;
+};
+
+/**
+ * Normalizes any accepted value into a JSON-friendly shape for query keys.
+ */
+export const serializeQueryKeyValue = (
+  value: unknown,
+): JsonValue | undefined => {
+  if (value === null) {
+    return null;
+  }
+
+  if (
+    typeof value === 'string' ||
+    typeof value === 'number' ||
+    typeof value === 'boolean'
+  ) {
+    return value;
+  }
+
+  if (
+    value === undefined ||
+    typeof value === 'function' ||
+    typeof value === 'symbol'
+  ) {
+    return undefined;
+  }
+
+  if (typeof value === 'bigint') {
+    return value.toString();
+  }
+
+  if (value instanceof Date) {
+    return value.toISOString();
+  }
+
+  if (Array.isArray(value)) {
+    return stringifyToJsonValue(value);
+  }
+
+  if (
+    typeof URLSearchParams !== 'undefined' &&
+    value instanceof URLSearchParams
+  ) {
+    return serializeSearchParams(value);
+  }
+
+  if (isPlainObject(value)) {
+    return stringifyToJsonValue(value);
+  }
+
+  return undefined;
+};

modules/frontend/src/api/core/serverSentEvents.gen.ts

@@ -0,0 +1,264 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { Config } from './types.gen';
+
+export type ServerSentEventsOptions<TData = unknown> = Omit<
+  RequestInit,
+  'method'
+> &
+  Pick<Config, 'method' | 'responseTransformer' | 'responseValidator'> & {
+    /**
+     * Fetch API implementation. You can use this option to provide a custom
+     * fetch instance.
+     *
+     * @default globalThis.fetch
+     */
+    fetch?: typeof fetch;
+    /**
+     * Implementing clients can call request interceptors inside this hook.
+     */
+    onRequest?: (url: string, init: RequestInit) => Promise<Request>;
+    /**
+     * Callback invoked when a network or parsing error occurs during streaming.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @param error The error that occurred.
+     */
+    onSseError?: (error: unknown) => void;
+    /**
+     * Callback invoked when an event is streamed from the server.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @param event Event streamed from the server.
+     * @returns Nothing (void).
+     */
+    onSseEvent?: (event: StreamEvent<TData>) => void;
+    serializedBody?: RequestInit['body'];
+    /**
+     * Default retry delay in milliseconds.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @default 3000
+     */
+    sseDefaultRetryDelay?: number;
+    /**
+     * Maximum number of retry attempts before giving up.
+     */
+    sseMaxRetryAttempts?: number;
+    /**
+     * Maximum retry delay in milliseconds.
+     *
+     * Applies only when exponential backoff is used.
+     *
+     * This option applies only if the endpoint returns a stream of events.
+     *
+     * @default 30000
+     */
+    sseMaxRetryDelay?: number;
+    /**
+     * Optional sleep function for retry backoff.
+     *
+     * Defaults to using `setTimeout`.
+     */
+    sseSleepFn?: (ms: number) => Promise<void>;
+    url: string;
+  };
+
+export interface StreamEvent<TData = unknown> {
+  data: TData;
+  event?: string;
+  id?: string;
+  retry?: number;
+}
+
+export type ServerSentEventsResult<
+  TData = unknown,
+  TReturn = void,
+  TNext = unknown,
+> = {
+  stream: AsyncGenerator<
+    TData extends Record<string, unknown> ? TData[keyof TData] : TData,
+    TReturn,
+    TNext
+  >;
+};
+
+export const createSseClient = <TData = unknown>({
+  onRequest,
+  onSseError,
+  onSseEvent,
+  responseTransformer,
+  responseValidator,
+  sseDefaultRetryDelay,
+  sseMaxRetryAttempts,
+  sseMaxRetryDelay,
+  sseSleepFn,
+  url,
+  ...options
+}: ServerSentEventsOptions): ServerSentEventsResult<TData> => {
+  let lastEventId: string | undefined;
+
+  const sleep =
+    sseSleepFn ??
+    ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));
+
+  const createStream = async function* () {
+    let retryDelay: number = sseDefaultRetryDelay ?? 3000;
+    let attempt = 0;
+    const signal = options.signal ?? new AbortController().signal;
+
+    while (true) {
+      if (signal.aborted) break;
+
+      attempt++;
+
+      const headers =
+        options.headers instanceof Headers
+          ? options.headers
+          : new Headers(options.headers as Record<string, string> | undefined);
+
+      if (lastEventId !== undefined) {
+        headers.set('Last-Event-ID', lastEventId);
+      }
+
+      try {
+        const requestInit: RequestInit = {
+          redirect: 'follow',
+          ...options,
+          body: options.serializedBody,
+          headers,
+          signal,
+        };
+        let request = new Request(url, requestInit);
+        if (onRequest) {
+          request = await onRequest(url, requestInit);
+        }
+        // fetch must be assigned here, otherwise it would throw the error:
+        // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation
+        const _fetch = options.fetch ?? globalThis.fetch;
+        const response = await _fetch(request);
+
+        if (!response.ok)
+          throw new Error(
+            `SSE failed: ${response.status} ${response.statusText}`,
+          );
+
+        if (!response.body) throw new Error('No body in SSE response');
+
+        const reader = response.body
+          .pipeThrough(new TextDecoderStream())
+          .getReader();
+
+        let buffer = '';
+
+        const abortHandler = () => {
+          try {
+            reader.cancel();
+          } catch {
+            // noop
+          }
+        };
+
+        signal.addEventListener('abort', abortHandler);
+
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            buffer += value;
+
+            const chunks = buffer.split('\n\n');
+            buffer = chunks.pop() ?? '';
+
+            for (const chunk of chunks) {
+              const lines = chunk.split('\n');
+              const dataLines: Array<string> = [];
+              let eventName: string | undefined;
+
+              for (const line of lines) {
+                if (line.startsWith('data:')) {
+                  dataLines.push(line.replace(/^data:\s*/, ''));
+                } else if (line.startsWith('event:')) {
+                  eventName = line.replace(/^event:\s*/, '');
+                } else if (line.startsWith('id:')) {
+                  lastEventId = line.replace(/^id:\s*/, '');
+                } else if (line.startsWith('retry:')) {
+                  const parsed = Number.parseInt(
+                    line.replace(/^retry:\s*/, ''),
+                    10,
+                  );
+                  if (!Number.isNaN(parsed)) {
+                    retryDelay = parsed;
+                  }
+                }
+              }
+
+              let data: unknown;
+              let parsedJson = false;
+
+              if (dataLines.length) {
+                const rawData = dataLines.join('\n');
+                try {
+                  data = JSON.parse(rawData);
+                  parsedJson = true;
+                } catch {
+                  data = rawData;
+                }
+              }
+
+              if (parsedJson) {
+                if (responseValidator) {
+                  await responseValidator(data);
+                }
+
+                if (responseTransformer) {
+                  data = await responseTransformer(data);
+                }
+              }
+
+              onSseEvent?.({
+                data,
+                event: eventName,
+                id: lastEventId,
+                retry: retryDelay,
+              });
+
+              if (dataLines.length) {
+                yield data as any;
+              }
+            }
+          }
+        } finally {
+          signal.removeEventListener('abort', abortHandler);
+          reader.releaseLock();
+        }
+
+        break; // exit loop on normal completion
+      } catch (error) {
+        // connection failed or aborted; retry after delay
+        onSseError?.(error);
+
+        if (
+          sseMaxRetryAttempts !== undefined &&
+          attempt >= sseMaxRetryAttempts
+        ) {
+          break; // stop after firing error
+        }
+
+        // exponential backoff: double retry each attempt, cap at 30s
+        const backoff = Math.min(
+          retryDelay * 2 ** (attempt - 1),
+          sseMaxRetryDelay ?? 30000,
+        );
+        await sleep(backoff);
+      }
+    }
+  };
+
+  const stream = createStream();
+
+  return { stream };
+};

modules/frontend/src/api/core/types.gen.ts

@@ -0,0 +1,118 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { Auth, AuthToken } from './auth.gen';
+import type {
+  BodySerializer,
+  QuerySerializer,
+  QuerySerializerOptions,
+} from './bodySerializer.gen';
+
+export type HttpMethod =
+  | 'connect'
+  | 'delete'
+  | 'get'
+  | 'head'
+  | 'options'
+  | 'patch'
+  | 'post'
+  | 'put'
+  | 'trace';
+
+export type Client<
+  RequestFn = never,
+  Config = unknown,
+  MethodFn = never,
+  BuildUrlFn = never,
+  SseFn = never,
+> = {
+  /**
+   * Returns the final request URL.
+   */
+  buildUrl: BuildUrlFn;
+  getConfig: () => Config;
+  request: RequestFn;
+  setConfig: (config: Config) => Config;
+} & {
+  [K in HttpMethod]: MethodFn;
+} & ([SseFn] extends [never]
+    ? { sse?: never }
+    : { sse: { [K in HttpMethod]: SseFn } });
+
+export interface Config {
+  /**
+   * Auth token or a function returning auth token. The resolved value will be
+   * added to the request payload as defined by its `security` array.
+   */
+  auth?: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken;
+  /**
+   * A function for serializing request body parameter. By default,
+   * {@link JSON.stringify()} will be used.
+   */
+  bodySerializer?: BodySerializer | null;
+  /**
+   * An object containing any HTTP headers that you want to pre-populate your
+   * `Headers` object with.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/Headers/Headers#init See more}
+   */
+  headers?:
+    | RequestInit['headers']
+    | Record<
+        string,
+        | string
+        | number
+        | boolean
+        | (string | number | boolean)[]
+        | null
+        | undefined
+        | unknown
+      >;
+  /**
+   * The request method.
+   *
+   * {@link https://developer.mozilla.org/docs/Web/API/fetch#method See more}
+   */
+  method?: Uppercase<HttpMethod>;
+  /**
+   * A function for serializing request query parameters. By default, arrays
+   * will be exploded in form style, objects will be exploded in deepObject
+   * style, and reserved characters are percent-encoded.
+   *
+   * This method will have no effect if the native `paramsSerializer()` Axios
+   * API function is used.
+   *
+   * {@link https://swagger.io/docs/specification/serialization/#query View examples}
+   */
+  querySerializer?: QuerySerializer | QuerySerializerOptions;
+  /**
+   * A function validating request data. This is useful if you want to ensure
+   * the request conforms to the desired shape, so it can be safely sent to
+   * the server.
+   */
+  requestValidator?: (data: unknown) => Promise<unknown>;
+  /**
+   * A function transforming response data before it's returned. This is useful
+   * for post-processing data, e.g. converting ISO strings into Date objects.
+   */
+  responseTransformer?: (data: unknown) => Promise<unknown>;
+  /**
+   * A function validating response data. This is useful if you want to ensure
+   * the response conforms to the desired shape, so it can be safely passed to
+   * the transformers and returned to the user.
+   */
+  responseValidator?: (data: unknown) => Promise<unknown>;
+}
+
+type IsExactlyNeverOrNeverUndefined<T> = [T] extends [never]
+  ? true
+  : [T] extends [never | undefined]
+    ? [undefined] extends [T]
+      ? false
+      : true
+    : false;
+
+export type OmitNever<T extends Record<string, unknown>> = {
+  [K in keyof T as IsExactlyNeverOrNeverUndefined<T[K]> extends true
+    ? never
+    : K]: T[K];
+};

modules/frontend/src/api/core/utils.gen.ts

@@ -0,0 +1,143 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { BodySerializer, QuerySerializer } from './bodySerializer.gen';
+import {
+  type ArraySeparatorStyle,
+  serializeArrayParam,
+  serializeObjectParam,
+  serializePrimitiveParam,
+} from './pathSerializer.gen';
+
+export interface PathSerializer {
+  path: Record<string, unknown>;
+  url: string;
+}
+
+export const PATH_PARAM_RE = /\{[^{}]+\}/g;
+
+export const defaultPathSerializer = ({ path, url: _url }: PathSerializer) => {
+  let url = _url;
+  const matches = _url.match(PATH_PARAM_RE);
+  if (matches) {
+    for (const match of matches) {
+      let explode = false;
+      let name = match.substring(1, match.length - 1);
+      let style: ArraySeparatorStyle = 'simple';
+
+      if (name.endsWith('*')) {
+        explode = true;
+        name = name.substring(0, name.length - 1);
+      }
+
+      if (name.startsWith('.')) {
+        name = name.substring(1);
+        style = 'label';
+      } else if (name.startsWith(';')) {
+        name = name.substring(1);
+        style = 'matrix';
+      }
+
+      const value = path[name];
+
+      if (value === undefined || value === null) {
+        continue;
+      }
+
+      if (Array.isArray(value)) {
+        url = url.replace(
+          match,
+          serializeArrayParam({ explode, name, style, value }),
+        );
+        continue;
+      }
+
+      if (typeof value === 'object') {
+        url = url.replace(
+          match,
+          serializeObjectParam({
+            explode,
+            name,
+            style,
+            value: value as Record<string, unknown>,
+            valueOnly: true,
+          }),
+        );
+        continue;
+      }
+
+      if (style === 'matrix') {
+        url = url.replace(
+          match,
+          `;${serializePrimitiveParam({
+            name,
+            value: value as string,
+          })}`,
+        );
+        continue;
+      }
+
+      const replaceValue = encodeURIComponent(
+        style === 'label' ? `.${value as string}` : (value as string),
+      );
+      url = url.replace(match, replaceValue);
+    }
+  }
+  return url;
+};
+
+export const getUrl = ({
+  baseUrl,
+  path,
+  query,
+  querySerializer,
+  url: _url,
+}: {
+  baseUrl?: string;
+  path?: Record<string, unknown>;
+  query?: Record<string, unknown>;
+  querySerializer: QuerySerializer;
+  url: string;
+}) => {
+  const pathUrl = _url.startsWith('/') ? _url : `/${_url}`;
+  let url = (baseUrl ?? '') + pathUrl;
+  if (path) {
+    url = defaultPathSerializer({ path, url });
+  }
+  let search = query ? querySerializer(query) : '';
+  if (search.startsWith('?')) {
+    search = search.substring(1);
+  }
+  if (search) {
+    url += `?${search}`;
+  }
+  return url;
+};
+
+export function getValidRequestBody(options: {
+  body?: unknown;
+  bodySerializer?: BodySerializer | null;
+  serializedBody?: unknown;
+}) {
+  const hasBody = options.body !== undefined;
+  const isSerializedBody = hasBody && options.bodySerializer;
+
+  if (isSerializedBody) {
+    if ('serializedBody' in options) {
+      const hasSerializedBody =
+        options.serializedBody !== undefined && options.serializedBody !== '';
+
+      return hasSerializedBody ? options.serializedBody : null;
+    }
+
+    // not all clients implement a serializedBody property (i.e. client-axios)
+    return options.body !== '' ? options.body : null;
+  }
+
+  // plain/text body
+  if (hasBody) {
+    return options.body;
+  }
+
+  // no body was provided
+  return undefined;
+}

modules/frontend/src/api/index.ts

@@ -1,16 +1,4 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-export { ApiError } from './core/ApiError';
-export { CancelablePromise, CancelError } from './core/CancelablePromise';
-export { OpenAPI } from './core/OpenAPI';
-export type { OpenAPIConfig } from './core/OpenAPI';
+// This file is auto-generated by @hey-api/openapi-ts
 
-export type { Review } from './models/Review';
-export type { Tag } from './models/Tag';
-export type { Title } from './models/Title';
-export type { User } from './models/User';
-export type { UserTitle } from './models/UserTitle';
-
-export { DefaultService } from './services/DefaultService';
+export type * from './types.gen';
+export * from './sdk.gen';

modules/frontend/src/api/models/Review.ts

@@ -1,5 +0,0 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-export type Review = Record<string, any>;

modules/frontend/src/api/models/Tag.ts

@@ -1,5 +0,0 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-export type Tag = Record<string, any>;

modules/frontend/src/api/models/Title.ts

@@ -1,5 +0,0 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-export type Title = Record<string, any>;

modules/frontend/src/api/models/User.ts

@@ -1,35 +0,0 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-export type User = {
-    /**
-     * Unique user ID (primary key)
-     */
-    id?: number;
-    /**
-     * ID of the user avatar (references images table)
-     */
-    avatar_id?: number | null;
-    /**
-     * User email
-     */
-    mail?: string;
-    /**
-     * Username (alphanumeric + _ or -)
-     */
-    nickname: string;
-    /**
-     * Display name
-     */
-    disp_name?: string;
-    /**
-     * User description
-     */
-    user_desc?: string;
-    /**
-     * Timestamp when the user was created
-     */
-    creation_date: string;
-};
-

modules/frontend/src/api/models/UserTitle.ts

@@ -1,5 +0,0 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-export type UserTitle = Record<string, any>;

modules/frontend/src/api/sdk.gen.ts

@@ -0,0 +1,110 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+import type { Client, Options as Options2, TDataShape } from './client';
+import { client } from './client.gen';
+import type { AddUserTitleData, AddUserTitleErrors, AddUserTitleResponses, DeleteUserTitleData, DeleteUserTitleErrors, DeleteUserTitleResponses, GetTitleData, GetTitleErrors, GetTitleResponses, GetTitlesData, GetTitlesErrors, GetTitlesResponses, GetUsersIdData, GetUsersIdErrors, GetUsersIdResponses, GetUserTitleData, GetUserTitleErrors, GetUserTitleResponses, GetUserTitlesData, GetUserTitlesErrors, GetUserTitlesResponses, UpdateUserData, UpdateUserErrors, UpdateUserResponses, UpdateUserTitleData, UpdateUserTitleErrors, UpdateUserTitleResponses } from './types.gen';
+
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = Options2<TData, ThrowOnError> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: Record<string, unknown>;
+};
+
+/**
+ * Get titles
+ */
+export const getTitles = <ThrowOnError extends boolean = false>(options?: Options<GetTitlesData, ThrowOnError>) => (options?.client ?? client).get<GetTitlesResponses, GetTitlesErrors, ThrowOnError>({
+    querySerializer: { parameters: { status: { array: { explode: false } } } },
+    url: '/titles',
+    ...options
+});
+
+/**
+ * Get title description
+ */
+export const getTitle = <ThrowOnError extends boolean = false>(options: Options<GetTitleData, ThrowOnError>) => (options.client ?? client).get<GetTitleResponses, GetTitleErrors, ThrowOnError>({ url: '/titles/{title_id}', ...options });
+
+/**
+ * Get user info
+ */
+export const getUsersId = <ThrowOnError extends boolean = false>(options: Options<GetUsersIdData, ThrowOnError>) => (options.client ?? client).get<GetUsersIdResponses, GetUsersIdErrors, ThrowOnError>({ url: '/users/{user_id}', ...options });
+
+/**
+ * Partially update a user account
+ *
+ * Update selected user profile fields (excluding password).
+ * Password updates must be done via the dedicated auth-service (`/auth/`).
+ * Fields not provided in the request body remain unchanged.
+ *
+ */
+export const updateUser = <ThrowOnError extends boolean = false>(options: Options<UpdateUserData, ThrowOnError>) => (options.client ?? client).patch<UpdateUserResponses, UpdateUserErrors, ThrowOnError>({
+    security: [{ name: 'X-XSRF-TOKEN', type: 'apiKey' }],
+    url: '/users/{user_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+
+/**
+ * Get user titles
+ */
+export const getUserTitles = <ThrowOnError extends boolean = false>(options: Options<GetUserTitlesData, ThrowOnError>) => (options.client ?? client).get<GetUserTitlesResponses, GetUserTitlesErrors, ThrowOnError>({
+    querySerializer: { parameters: { status: { array: { explode: false } }, watch_status: { array: { explode: false } } } },
+    url: '/users/{user_id}/titles',
+    ...options
+});
+
+/**
+ * Add a title to a user
+ *
+ * User adding title to list af watched, status required
+ */
+export const addUserTitle = <ThrowOnError extends boolean = false>(options: Options<AddUserTitleData, ThrowOnError>) => (options.client ?? client).post<AddUserTitleResponses, AddUserTitleErrors, ThrowOnError>({
+    url: '/users/{user_id}/titles',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});
+
+/**
+ * Delete a usertitle
+ *
+ * User deleting title from list of watched
+ */
+export const deleteUserTitle = <ThrowOnError extends boolean = false>(options: Options<DeleteUserTitleData, ThrowOnError>) => (options.client ?? client).delete<DeleteUserTitleResponses, DeleteUserTitleErrors, ThrowOnError>({
+    security: [{ name: 'X-XSRF-TOKEN', type: 'apiKey' }],
+    url: '/users/{user_id}/titles/{title_id}',
+    ...options
+});
+
+/**
+ * Get user title
+ */
+export const getUserTitle = <ThrowOnError extends boolean = false>(options: Options<GetUserTitleData, ThrowOnError>) => (options.client ?? client).get<GetUserTitleResponses, GetUserTitleErrors, ThrowOnError>({ url: '/users/{user_id}/titles/{title_id}', ...options });
+
+/**
+ * Update a usertitle
+ *
+ * User updating title list of watched
+ */
+export const updateUserTitle = <ThrowOnError extends boolean = false>(options: Options<UpdateUserTitleData, ThrowOnError>) => (options.client ?? client).patch<UpdateUserTitleResponses, UpdateUserTitleErrors, ThrowOnError>({
+    security: [{ name: 'X-XSRF-TOKEN', type: 'apiKey' }],
+    url: '/users/{user_id}/titles/{title_id}',
+    ...options,
+    headers: {
+        'Content-Type': 'application/json',
+        ...options.headers
+    }
+});

modules/frontend/src/api/services/DefaultService.ts

@@ -1,35 +0,0 @@
-/* generated using openapi-typescript-codegen -- do not edit */
-/* istanbul ignore file */
-/* tslint:disable */
-/* eslint-disable */
-import type { User } from '../models/User';
-import type { CancelablePromise } from '../core/CancelablePromise';
-import { OpenAPI } from '../core/OpenAPI';
-import { request as __request } from '../core/request';
-export class DefaultService {
-    /**
-     * Get user info
-     * @param userId
-     * @param fields
-     * @returns User User info
-     * @throws ApiError
-     */
-    public static getUsers(
-        userId: string,
-        fields: string = 'all',
-    ): CancelablePromise<User> {
-        return __request(OpenAPI, {
-            method: 'GET',
-            url: '/users/{user_id}',
-            path: {
-                'user_id': userId,
-            },
-            query: {
-                'fields': fields,
-            },
-            errors: {
-                404: `User not found`,
-            },
-        });
-    }
-}

modules/frontend/src/api/types.gen.ts

@@ -0,0 +1,570 @@
+// This file is auto-generated by @hey-api/openapi-ts
+
+export type ClientOptions = {
+    baseUrl: `${string}://${string}/api/v1` | (string & {});
+};
+
+/**
+ * Title sort order
+ */
+export type TitleSort = 'id' | 'year' | 'rating' | 'views';
+
+/**
+ * Title status
+ */
+export type TitleStatus = 'finished' | 'ongoing' | 'planned';
+
+/**
+ * Title release season
+ */
+export type ReleaseSeason = 'winter' | 'spring' | 'summer' | 'fall';
+
+/**
+ * Image storage type
+ */
+export type StorageType = 's3' | 'local';
+
+export type Image = {
+    id?: number;
+    storage_type?: StorageType;
+    image_path?: string;
+};
+
+export type Studio = {
+    id: number;
+    name: string;
+    poster?: Image;
+    description?: string;
+};
+
+/**
+ * A localized tag: keys are language codes (ISO 639-1), values are tag names
+ */
+export type Tag = {
+    [key: string]: string;
+};
+
+/**
+ * Array of localized tags
+ */
+export type Tags = Array<Tag>;
+
+export type Title = {
+    /**
+     * Unique title ID (primary key)
+     */
+    id: number;
+    /**
+     * Localized titles. Key = language (ISO 639-1), value = list of names
+     */
+    title_names: {
+        [key: string]: Array<string>;
+    };
+    studio?: Studio;
+    tags: Tags;
+    poster?: Image;
+    title_status?: TitleStatus;
+    rating?: number;
+    rating_count?: number;
+    release_year?: number;
+    release_season?: ReleaseSeason;
+    episodes_aired?: number;
+    episodes_all?: number;
+    episodes_len?: {
+        [key: string]: number;
+    };
+};
+
+export type CursorObj = {
+    id: number;
+    param?: string;
+};
+
+export type User = {
+    /**
+     * Unique user ID (primary key)
+     */
+    id?: number;
+    image?: Image;
+    /**
+     * User email
+     */
+    mail?: string;
+    /**
+     * Username (alphanumeric + _ or -)
+     */
+    nickname: string;
+    /**
+     * Display name
+     */
+    disp_name?: string;
+    /**
+     * User description
+     */
+    user_desc?: string;
+    /**
+     * Timestamp when the user was created
+     */
+    creation_date?: string;
+};
+
+/**
+ * User's title status
+ */
+export type UserTitleStatus = 'finished' | 'planned' | 'dropped' | 'in-progress';
+
+export type UserTitle = {
+    user_id: number;
+    title?: Title;
+    status: UserTitleStatus;
+    rate?: number;
+    review_id?: number;
+    ctime?: string;
+};
+
+export type UserTitleMini = {
+    user_id: number;
+    title_id: number;
+    status: UserTitleStatus;
+    rate?: number;
+    review_id?: number;
+    ctime?: string;
+};
+
+export type Review = {
+    [key: string]: unknown;
+};
+
+export type Cursor = string;
+
+export type TitleSort2 = TitleSort;
+
+export type GetTitlesData = {
+    body?: never;
+    path?: never;
+    query?: {
+        cursor?: string;
+        sort?: TitleSort;
+        sort_forward?: boolean;
+        ext_search?: boolean;
+        word?: string;
+        /**
+         * List of title statuses to filter
+         */
+        status?: Array<TitleStatus>;
+        rating?: number;
+        release_year?: number;
+        release_season?: ReleaseSeason;
+        limit?: number;
+        offset?: number;
+        fields?: string;
+    };
+    url: '/titles';
+};
+
+export type GetTitlesErrors = {
+    /**
+     * Request params are not correct
+     */
+    400: unknown;
+    /**
+     * Unknown server error
+     */
+    500: unknown;
+};
+
+export type GetTitlesResponses = {
+    /**
+     * List of titles with cursor
+     */
+    200: {
+        /**
+         * List of titles
+         */
+        data: Array<Title>;
+        cursor: CursorObj;
+    };
+    /**
+     * No titles found
+     */
+    204: void;
+};
+
+export type GetTitlesResponse = GetTitlesResponses[keyof GetTitlesResponses];
+
+export type GetTitleData = {
+    body?: never;
+    path: {
+        title_id: number;
+    };
+    query?: {
+        fields?: string;
+    };
+    url: '/titles/{title_id}';
+};
+
+export type GetTitleErrors = {
+    /**
+     * Request params are not correct
+     */
+    400: unknown;
+    /**
+     * Title not found
+     */
+    404: unknown;
+    /**
+     * Unknown server error
+     */
+    500: unknown;
+};
+
+export type GetTitleResponses = {
+    /**
+     * Title description
+     */
+    200: Title;
+    /**
+     * No title found
+     */
+    204: void;
+};
+
+export type GetTitleResponse = GetTitleResponses[keyof GetTitleResponses];
+
+export type GetUsersIdData = {
+    body?: never;
+    path: {
+        user_id: string;
+    };
+    query?: {
+        fields?: string;
+    };
+    url: '/users/{user_id}';
+};
+
+export type GetUsersIdErrors = {
+    /**
+     * Request params are not correct
+     */
+    400: unknown;
+    /**
+     * User not found
+     */
+    404: unknown;
+    /**
+     * Unknown server error
+     */
+    500: unknown;
+};
+
+export type GetUsersIdResponses = {
+    /**
+     * User info
+     */
+    200: User;
+};
+
+export type GetUsersIdResponse = GetUsersIdResponses[keyof GetUsersIdResponses];
+
+export type UpdateUserData = {
+    /**
+     * Only provided fields are updated. Omitted fields remain unchanged.
+     */
+    body: {
+        /**
+         * ID of the user avatar (references `images.id`); set to `null` to remove avatar
+         */
+        avatar_id?: number | null;
+        /**
+         * User email (must be unique and valid)
+         */
+        mail?: string;
+        /**
+         * Username (alphanumeric + `_` or `-`, 3–16 chars)
+         */
+        nickname?: string;
+        /**
+         * Display name
+         */
+        disp_name?: string;
+        /**
+         * User description / bio
+         */
+        user_desc?: string;
+    };
+    path: {
+        /**
+         * User ID (primary key)
+         */
+        user_id: number;
+    };
+    query?: never;
+    url: '/users/{user_id}';
+};
+
+export type UpdateUserErrors = {
+    /**
+     * Invalid input (e.g., validation failed, nickname/email conflict, malformed JSON)
+     */
+    400: unknown;
+    /**
+     * Unauthorized — missing or invalid authentication token
+     */
+    401: unknown;
+    /**
+     * Forbidden — user is not allowed to modify this resource (e.g., not own profile & no admin rights)
+     */
+    403: unknown;
+    /**
+     * User not found
+     */
+    404: unknown;
+    /**
+     * Conflict — e.g., requested `nickname` or `mail` already taken by another user
+     */
+    409: unknown;
+    /**
+     * Unprocessable Entity — semantic errors not caught by schema (e.g., invalid `avatar_id`)
+     */
+    422: unknown;
+    /**
+     * Unknown server error
+     */
+    500: unknown;
+};
+
+export type UpdateUserResponses = {
+    /**
+     * User updated successfully. Returns updated user representation (excluding sensitive fields).
+     */
+    200: User;
+};
+
+export type UpdateUserResponse = UpdateUserResponses[keyof UpdateUserResponses];
+
+export type GetUserTitlesData = {
+    body?: never;
+    path: {
+        user_id: string;
+    };
+    query?: {
+        cursor?: string;
+        sort?: TitleSort;
+        sort_forward?: boolean;
+        word?: string;
+        /**
+         * List of title statuses to filter
+         */
+        status?: Array<TitleStatus>;
+        watch_status?: Array<UserTitleStatus>;
+        rating?: number;
+        my_rate?: number;
+        release_year?: number;
+        release_season?: ReleaseSeason;
+        limit?: number;
+        fields?: string;
+    };
+    url: '/users/{user_id}/titles';
+};
+
+export type GetUserTitlesErrors = {
+    /**
+     * Request params are not correct
+     */
+    400: unknown;
+    /**
+     * User not found
+     */
+    404: unknown;
+    /**
+     * Unknown server error
+     */
+    500: unknown;
+};
+
+export type GetUserTitlesResponses = {
+    /**
+     * List of user titles
+     */
+    200: {
+        data: Array<UserTitle>;
+        cursor: CursorObj;
+    };
+    /**
+     * No titles found
+     */
+    204: void;
+};
+
+export type GetUserTitlesResponse = GetUserTitlesResponses[keyof GetUserTitlesResponses];
+
+export type AddUserTitleData = {
+    body: {
+        title_id: number;
+        status: UserTitleStatus;
+        rate?: number;
+    };
+    path: {
+        /**
+         * ID of the user to assign the title to
+         */
+        user_id: number;
+    };
+    query?: never;
+    url: '/users/{user_id}/titles';
+};
+
+export type AddUserTitleErrors = {
+    /**
+     * Invalid request body (missing fields, invalid types, etc.)
+     */
+    400: unknown;
+    /**
+     * Unauthorized — missing or invalid auth token
+     */
+    401: unknown;
+    /**
+     * Forbidden — user not allowed to assign titles to this user
+     */
+    403: unknown;
+    /**
+     * User or Title not found
+     */
+    404: unknown;
+    /**
+     * Conflict — title already assigned to user (if applicable)
+     */
+    409: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type AddUserTitleResponses = {
+    /**
+     * Title successfully added to user
+     */
+    200: UserTitleMini;
+};
+
+export type AddUserTitleResponse = AddUserTitleResponses[keyof AddUserTitleResponses];
+
+export type DeleteUserTitleData = {
+    body?: never;
+    path: {
+        user_id: number;
+        title_id: number;
+    };
+    query?: never;
+    url: '/users/{user_id}/titles/{title_id}';
+};
+
+export type DeleteUserTitleErrors = {
+    /**
+     * Unauthorized — missing or invalid auth token
+     */
+    401: unknown;
+    /**
+     * Forbidden — user not allowed to delete title
+     */
+    403: unknown;
+    /**
+     * User or Title not found
+     */
+    404: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type DeleteUserTitleResponses = {
+    /**
+     * Title successfully deleted
+     */
+    200: unknown;
+};
+
+export type GetUserTitleData = {
+    body?: never;
+    path: {
+        user_id: number;
+        title_id: number;
+    };
+    query?: never;
+    url: '/users/{user_id}/titles/{title_id}';
+};
+
+export type GetUserTitleErrors = {
+    /**
+     * Request params are not correct
+     */
+    400: unknown;
+    /**
+     * User or title not found
+     */
+    404: unknown;
+    /**
+     * Unknown server error
+     */
+    500: unknown;
+};
+
+export type GetUserTitleResponses = {
+    /**
+     * User titles
+     */
+    200: UserTitleMini;
+    /**
+     * No user title found
+     */
+    204: void;
+};
+
+export type GetUserTitleResponse = GetUserTitleResponses[keyof GetUserTitleResponses];
+
+export type UpdateUserTitleData = {
+    body: {
+        status?: UserTitleStatus;
+        rate?: number;
+    };
+    path: {
+        user_id: number;
+        title_id: number;
+    };
+    query?: never;
+    url: '/users/{user_id}/titles/{title_id}';
+};
+
+export type UpdateUserTitleErrors = {
+    /**
+     * Invalid request body (missing fields, invalid types, etc.)
+     */
+    400: unknown;
+    /**
+     * Unauthorized — missing or invalid auth token
+     */
+    401: unknown;
+    /**
+     * Forbidden — user not allowed to update title
+     */
+    403: unknown;
+    /**
+     * User or Title not found
+     */
+    404: unknown;
+    /**
+     * Internal server error
+     */
+    500: unknown;
+};
+
+export type UpdateUserTitleResponses = {
+    /**
+     * Title successfully updated
+     */
+    200: UserTitleMini;
+};
+
+export type UpdateUserTitleResponse = UpdateUserTitleResponses[keyof UpdateUserTitleResponses];

modules/frontend/src/auth/core/OpenAPI.ts

@@ -20,7 +20,7 @@ export type OpenAPIConfig = {
 };
 
 export const OpenAPI: OpenAPIConfig = {
-    BASE: '/api/v1',
+    BASE: 'http://10.1.0.65:8081/auth',
     VERSION: '1.0.0',
     WITH_CREDENTIALS: false,
     CREDENTIALS: 'include',

modules/frontend/src/auth/index.ts

@@ -0,0 +1,10 @@
+/* generated using openapi-typescript-codegen -- do not edit */
+/* istanbul ignore file */
+/* tslint:disable */
+/* eslint-disable */
+export { ApiError } from './core/ApiError';
+export { CancelablePromise, CancelError } from './core/CancelablePromise';
+export { OpenAPI } from './core/OpenAPI';
+export type { OpenAPIConfig } from './core/OpenAPI';
+
+export { AuthService } from './services/AuthService';