style: .btn als flex-Button mit konsistentem Styling

Ermöglicht die Verwendung von .btn auf <button>-Elementen (nicht nur <a>-Links) mit einheitlicher Ausrichtung, Schrift und Cursor. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
refactor: replace can_upload boolean with role-based access control
2026-08-14 21:32:19 +02:00 · 2026-08-11 19:43:39 +02:00 · 2026-08-11 19:11:40 +02:00 · 2026-08-08 13:40:53 +02:00 · 2026-08-08 13:40:38 +02:00 · 2026-08-08 13:40:23 +02:00
15 changed files with 1453 additions and 107 deletions
@@ -0,0 +1,79 @@
+# eBook Library (Go + templ)
+
+Minimalistic, no-JS eBook library web app for reading files (EPUB/PDF) on a
+Tolino e-reader browser. UI text/comments are in German.
+
+## Build & run
+
+```bash
+go mod tidy                # install deps
+templ generate              # regenerate views/*_templ.go from views/*.templ (required after editing .templ files)
+go build ./...              # build check
+go run ./cmd/server          # run dev server on :8080
+```
+
+- `templ` CLI is required whenever `views/pages.templ` changes — generated
+  Go code lives in `views/pages_templ.go` and is checked into the repo, so it
+  must be regenerated and committed together with template edits.
+- No test suite exists yet.
+- Config via env vars: `ADDR` (default `:8080`), `BOOKS_DIR` (default `books`),
+  `USERS_DB` (default `users.db`).
+
+## Admin CLI
+
+```bash
+go run ./cmd/admin user add <name> [--role reader|uploader|admin]  # Standard: reader
+go run ./cmd/admin user list
+go run ./cmd/admin user delete <name>
+go run ./cmd/admin user set-role <name> <reader|uploader|admin>
+```
+
+## Architecture
+
+- `cmd/server/main.go` — entrypoint; wires `library.Service`, `users.Store` and
+  `web.Handler` together and starts the HTTP server.
+- `internal/library` — core domain logic, no HTTP dependency (unchanged).
+- `internal/users/role.go` — `Role` type (`reader`, `uploader`, `admin`),
+  `roleLevel` map für Hierarchie, `AtLeast(min Role)`, `ParseRole(s)`.
+  Neue Rollen: in `roleLevel` eintragen und ggf. Routen anpassen — kein
+  Schema-Change nötig.
+- `internal/users/store.go` — SQLite-backed user store. Migrations via
+  `_schema_version`-Tabelle (geordnete `migrations [][]string`); neue
+  Migrationen am Ende anhängen. `role TEXT` statt `can_upload INTEGER`.
+- `internal/web/middleware.go` — `requireRole(minRole users.Role)` ist die
+  zentrale Middleware; `requireAuth` ist ein Spezialfall davon (implizit
+  `RoleReader`).
+- Auth: `/login` und `/static/` sind die einzigen öffentlichen Routes.
+  Upload-Routes verwenden `requireRole(RoleUploader)`.
+
+**Rollen-Hierarchie:**
+```
+reader (0) < uploader (1) < admin (2)
+```
+- `cmd/admin/main.go` — CLI binary for user management; reads `USERS_DB` env var.
+- `internal/web/handlers.go` — HTTP handlers including `loginPage`,
+  `loginSubmit`, `logout`, `uploadPage`, `uploadSubmit`.
+- `internal/web/middleware.go` — `requireAuth` and `requireUpload` middleware;
+  session resolved from `"session"` cookie; stored in request context via `sessionKey`.
+- `views/pages.templ` — `LoginPage(errMsg)`, `UploadPage(errMsg)` added;
+  `IndexPage` now takes `canUpload bool`; `Layout` includes logout button.
+
+## Conventions
+
+- Path traversal guards matter: `downloadBook` validates the resolved book
+  path stays within `BooksDir()` before serving; `cleanEPUBPath` rejects
+  `../`-escaping hrefs inside EPUB zips; `uploadSubmit` validates the
+  destination path stays within `BooksDir()`. Preserve these checks in any
+  related changes.
+- Cover image reads are capped (`maxCoverBytes = 10 MiB`) to avoid decompression
+  abuse — keep similar limits when reading zip entries.
+- Handlers return `404` for missing/empty `id` and `500` on internal errors;
+  keep that pattern for new routes.
+- Auth: `/login` and `/static/` are the only public routes — everything else
+  goes through `requireAuth`. Routes needing upload permission use `requireUpload`
+  (which wraps `requireAuth`).
+- Session cookie: `HttpOnly`, `SameSite=Lax`, 30-day expiry; no `Secure` flag
+  set (intended for LAN use without TLS).
+- `modernc.org/sqlite` is a pure-Go SQLite driver (no CGo). `MaxOpenConns(1)`
+  is set because SQLite doesn't support concurrent writers.
+- `users.db` is gitignored; create it at runtime with the admin CLI.
@@ -24,3 +24,4 @@ dist/
 # Local env
 .env
 books/
+users.db
@@ -8,6 +8,8 @@ Minimalistische eBook-Bibliothek für den Tolino-Webbrowser.
 - Detailseite pro Buch
 - Download-Link pro Buch (für Tolino)
 - Schlichtes, kontrastreiches UI ohne JavaScript-Abhängigkeit
+- Login-Pflicht (Session-Cookie, 30 Tage)
+- Optionaler Buch-Upload für berechtigte Benutzer

 ## Voraussetzungen

@@ -34,13 +36,21 @@ go mod tidy
 templ generate
 ```

-3. Server starten:
+3. Ersten Benutzer anlegen:
+
+```bash
+go run ./cmd/admin user add <benutzername>
+# mit Upload-Recht:
+go run ./cmd/admin user add <benutzername> --upload
+```
+
+4. Server starten:

 ```bash
 go run ./cmd/server
 ```

-4. Browser öffnen:
+5. Browser öffnen:

 - `http://localhost:8080`

@@ -51,9 +61,25 @@ Lege deine Dateien in den Ordner `books/`:
 - `.epub` (bevorzugt)
 - `.pdf` (optional)

+Alternativ können Benutzer mit Upload-Recht Bücher direkt im Browser hochladen.
+
+## Benutzerverwaltung (CLI)
+
+Rollen (aufsteigend): `reader` → `uploader` → `admin`
+
+```bash
+go run ./cmd/admin user add <name> [--role reader|uploader|admin]
+go run ./cmd/admin user list
+go run ./cmd/admin user delete <name>
+go run ./cmd/admin user set-role <name> <reader|uploader|admin>
+```
+
 ## Konfiguration

 Umgebungsvariablen:

- `ADDR` (Standard `:8080`)
- `BOOKS_DIR` (Standard `books`)
+| Variable   | Standard   | Beschreibung                    |
+|------------|------------|---------------------------------|
+| `ADDR`     | `:8080`    | Listen-Adresse des Servers      |
+| `BOOKS_DIR`| `books`    | Verzeichnis mit Büchern         |
+| `USERS_DB` | `users.db` | Pfad zur SQLite-Benutzerdatenbank |
@@ -0,0 +1,156 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"syscall"
+
+	"github.com/arnef/ebooks/internal/users"
+	"golang.org/x/term"
+)
+
+func main() {
+	if len(os.Args) < 3 {
+		usage()
+		os.Exit(1)
+	}
+
+	dbPath := getenv("USERS_DB", "users.db")
+	store, err := users.Open(dbPath)
+	if err != nil {
+		fatalf("open db: %v\n", err)
+	}
+	defer store.Close()
+
+	resource := os.Args[1]
+	action := os.Args[2]
+
+	switch resource {
+	case "user":
+		handleUser(store, action, os.Args[3:])
+	default:
+		usage()
+		os.Exit(1)
+	}
+}
+
+func handleUser(store *users.Store, action string, args []string) {
+	switch action {
+	case "add":
+		if len(args) < 1 {
+			fatalf("usage: user add <username> [--role reader|uploader|admin]\n")
+		}
+		username := args[0]
+		role := users.RoleReader
+		if len(args) > 1 && args[1] == "--role" {
+			if len(args) < 3 {
+				fatalf("--role erwartet einen Wert: reader, uploader oder admin\n")
+			}
+			r, err := users.ParseRole(args[2])
+			if err != nil {
+				fatalf("%v\n", err)
+			}
+			role = r
+		}
+
+		password, err := readPassword(fmt.Sprintf("Passwort für '%s': ", username))
+		if err != nil {
+			fatalf("passwort lesen: %v\n", err)
+		}
+		confirm, err := readPassword("Passwort bestätigen: ")
+		if err != nil {
+			fatalf("passwort lesen: %v\n", err)
+		}
+		if password != confirm {
+			fatalf("Passwörter stimmen nicht überein.\n")
+		}
+
+		u, err := store.CreateUser(username, password, role)
+		if err != nil {
+			fatalf("user anlegen: %v\n", err)
+		}
+		fmt.Printf("✓ Benutzer '%s' angelegt (rolle: %s)\n", u.Username, u.Role)
+
+	case "list":
+		list, err := store.ListUsers()
+		if err != nil {
+			fatalf("user auflisten: %v\n", err)
+		}
+		if len(list) == 0 {
+			fmt.Println("Keine Benutzer vorhanden.")
+			return
+		}
+		fmt.Printf("%-20s  %s\n", "BENUTZERNAME", "ROLLE")
+		fmt.Println(strings.Repeat("-", 32))
+		for _, u := range list {
+			fmt.Printf("%-20s  %s\n", u.Username, u.Role)
+		}
+
+	case "delete":
+		if len(args) < 1 {
+			fatalf("usage: user delete <username>\n")
+		}
+		if err := store.DeleteUser(args[0]); err != nil {
+			fatalf("user löschen: %v\n", err)
+		}
+		fmt.Printf("✓ Benutzer '%s' gelöscht.\n", args[0])
+
+	case "set-role":
+		if len(args) < 2 {
+			fatalf("usage: user set-role <username> <reader|uploader|admin>\n")
+		}
+		role, err := users.ParseRole(args[1])
+		if err != nil {
+			fatalf("%v\n", err)
+		}
+		if err := store.SetRole(args[0], role); err != nil {
+			fatalf("rolle setzen: %v\n", err)
+		}
+		fmt.Printf("✓ Rolle für '%s' auf '%s' gesetzt.\n", args[0], role)
+
+	default:
+		usage()
+		os.Exit(1)
+	}
+}
+
+func readPassword(prompt string) (string, error) {
+	fmt.Print(prompt)
+	b, err := term.ReadPassword(int(syscall.Stdin))
+	fmt.Println()
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
+
+func getenv(key, fallback string) string {
+	if v := os.Getenv(key); v != "" {
+		return v
+	}
+	return fallback
+}
+
+func fatalf(format string, args ...any) {
+	fmt.Fprintf(os.Stderr, format, args...)
+	os.Exit(1)
+}
+
+func usage() {
+	fmt.Fprintln(os.Stderr, `ebooks-admin – Benutzerverwaltung
+
+Rollen (aufsteigend):
+  reader    Lesen und Herunterladen
+  uploader  Zusätzlich: Bücher hochladen
+  admin     Alle Rechte
+
+Befehle:
+  user add <name> [--role reader|uploader|admin]   Benutzer anlegen (Standard: reader)
+  user list                                         Alle Benutzer auflisten
+  user delete <name>                                Benutzer löschen
+  user set-role <name> <reader|uploader|admin>      Rolle ändern
+
+Umgebungsvariablen:
+  USERS_DB  Pfad zur SQLite-Datenbank (Standard: users.db)`)
+}
@@ -6,15 +6,23 @@ import (
 	"os"

 	"github.com/arnef/ebooks/internal/library"
+	"github.com/arnef/ebooks/internal/users"
 	"github.com/arnef/ebooks/internal/web"
 )

 func main() {
 	booksDir := getenv("BOOKS_DIR", "books")
 	addr := getenv("ADDR", ":8080")
+	usersDB := getenv("USERS_DB", "users.db")
+
+	store, err := users.Open(usersDB)
+	if err != nil {
+		log.Fatalf("users db: %v", err)
+	}
+	defer store.Close()

 	lib := library.New(booksDir)
-	h := web.NewHandler(lib)
+	h := web.NewHandler(lib, store)

 	mux := http.NewServeMux()
 	h.RegisterRoutes(mux)
@@ -2,7 +2,19 @@ module github.com/arnef/ebooks

 go 1.25.0

+require github.com/a-h/templ v0.3.1020
+
 require (
-	github.com/a-h/templ v0.3.1020
-	github.com/bmaupin/go-epub v0.0.0-20210915022040-e113c1c5e4a3
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/mattn/go-isatty v0.0.24 // indirect
+	github.com/ncruces/go-strftime v1.0.0 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	golang.org/x/crypto v0.54.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	modernc.org/libc v1.74.4 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.11.0 // indirect
+	modernc.org/sqlite v1.56.0 // indirect
 )
@@ -1,4 +1,28 @@
 github.com/a-h/templ v0.3.1020 h1:ypAT/L5ySWEnZ6Zft/5yfoWXYYkhFNvEFOeeqecg4tw=
 github.com/a-h/templ v0.3.1020/go.mod h1:A2DlK61v+K+NRoGnhmYbNYVmtYHcFO5/AisMvBdDxTM=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=
+github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A=
+github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
+github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
+golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+modernc.org/libc v1.74.4 h1:fX1Omw4o2/1C2iRkkIsrQTasJQldLhRmuPreXLoWs9k=
+modernc.org/libc v1.74.4/go.mod h1:eeQAS9W3sZeKYMFubydxJpII9ybHWshk+7or7bLG9co=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
+modernc.org/memory v1.11.0/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/sqlite v1.56.0 h1:/D8e2RfFqoy/Zc6PuC76U28zFwmI/sYx1Kjm4yEn9e0=
+modernc.org/sqlite v1.56.0/go.mod h1:yCJ2cmAaIkHQ25oXWrF8H4O1lIfPYPR26yCEDj2P3pQ=
@@ -97,17 +97,33 @@ func (s *Service) FindBook(id string) (*Book, error) {
 }

 func (s *Service) CoverBytes(id string) ([]byte, string, error) {
-	book, err := s.FindBook(id)
+	if id == "" {
+		return nil, "", nil
+	}
+
+	entries, err := os.ReadDir(s.booksDir)
 	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, "", nil
+		}
 		return nil, "", err
 	}
-	if book == nil {
-		return nil, "", nil
+
+	for _, e := range entries {
+		if e.IsDir() {
+			continue
 		}
-	if book.Format != "epub" {
-		return nil, "", nil
+		ext := strings.ToLower(filepath.Ext(e.Name()))
+		if ext != ".epub" {
+			continue
 		}
-	return readEPUBCover(book.Path)
+		if stableID(e.Name()) != id {
+			continue
+		}
+		return readEPUBCover(filepath.Join(s.booksDir, e.Name()))
+	}
+
+	return nil, "", nil
 }

 func stableID(input string) string {
@@ -182,15 +198,22 @@ func readEPUBCover(filePath string) ([]byte, string, error) {
 		if path.Clean(f.Name) != coverPath {
 			continue
 		}
+		const maxCoverBytes = 10 << 20 // 10 MiB
+		if f.UncompressedSize64 > uint64(maxCoverBytes) {
+			return nil, "", fmt.Errorf("cover image too large")
+		}
 		rc, err := f.Open()
 		if err != nil {
 			return nil, "", err
 		}
 		defer rc.Close()
-		data, err := io.ReadAll(rc)
+		data, err := io.ReadAll(io.LimitReader(rc, int64(maxCoverBytes)+1))
 		if err != nil {
 			return nil, "", err
 		}
+		if len(data) > maxCoverBytes {
+			return nil, "", fmt.Errorf("cover image too large")
+		}
 		return data, detectContentType(data, f.Name), nil
 	}

@@ -263,8 +286,12 @@ func findEPUBCoverPath(rootPath string, pkg packageXML) string {
 }

 func cleanEPUBPath(rootPath, href string) string {
+	href = strings.TrimSpace(href)
+	if href == "" || strings.HasPrefix(href, "/") {
+		return ""
+	}
 	joined := path.Clean(path.Join(rootPath, href))
-	if strings.HasPrefix(joined, "../") {
+	if joined == "." || strings.HasPrefix(joined, "../") || strings.HasPrefix(joined, "/") {
 		return ""
 	}
 	return joined
@@ -0,0 +1,43 @@
+package users
+
+import "fmt"
+
+// Role represents a user's access level. Roles are ordered hierarchically:
+// RoleReader < RoleUploader < RoleAdmin.
+// New roles can be inserted into roleLevel without changing existing code.
+type Role string
+
+const (
+	RoleReader   Role = "reader"
+	RoleUploader Role = "uploader"
+	RoleAdmin    Role = "admin"
+)
+
+// roleLevel defines the hierarchy. Higher = more permissions.
+var roleLevel = map[Role]int{
+	RoleReader:   0,
+	RoleUploader: 1,
+	RoleAdmin:    2,
+}
+
+// AtLeast reports whether r has at least the same privilege level as min.
+func (r Role) AtLeast(min Role) bool {
+	return roleLevel[r] >= roleLevel[min]
+}
+
+// IsValid reports whether r is a known role.
+func (r Role) IsValid() bool {
+	_, ok := roleLevel[r]
+	return ok
+}
+
+func (r Role) String() string { return string(r) }
+
+// ParseRole parses a role string. Returns an error for unknown values.
+func ParseRole(s string) (Role, error) {
+	r := Role(s)
+	if !r.IsValid() {
+		return "", fmt.Errorf("unbekannte Rolle %q, gültig: reader, uploader, admin", s)
+	}
+	return r, nil
+}
@@ -0,0 +1,271 @@
+package users
+
+import (
+	"crypto/rand"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+	_ "modernc.org/sqlite"
+)
+
+var ErrNotFound = errors.New("user not found")
+var ErrUserExists = errors.New("user already exists")
+
+type User struct {
+	ID       int64
+	Username string
+	Role     Role
+}
+
+type Session struct {
+	Token     string
+	UserID    int64
+	Username  string
+	Role      Role
+	ExpiresAt time.Time
+}
+
+type Store struct {
+	db *sql.DB
+}
+
+func Open(path string) (*Store, error) {
+	db, err := sql.Open("sqlite", path)
+	if err != nil {
+		return nil, err
+	}
+	db.SetMaxOpenConns(1) // SQLite doesn't support concurrent writers
+	s := &Store{db: db}
+	if err := s.migrate(); err != nil {
+		db.Close()
+		return nil, err
+	}
+	return s, nil
+}
+
+func (s *Store) Close() error { return s.db.Close() }
+
+// migrations is an ordered list of schema changes. Each entry is a slice of
+// SQL statements to execute in a transaction. Add new entries at the end only.
+var migrations = [][]string{
+	// v1: initial schema
+	{
+		`CREATE TABLE IF NOT EXISTS users (
+			id            INTEGER PRIMARY KEY AUTOINCREMENT,
+			username      TEXT    NOT NULL UNIQUE,
+			password_hash TEXT    NOT NULL,
+			can_upload    INTEGER NOT NULL DEFAULT 0
+		)`,
+		`CREATE TABLE IF NOT EXISTS sessions (
+			token      TEXT    PRIMARY KEY,
+			user_id    INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+			expires_at INTEGER NOT NULL
+		)`,
+	},
+	// v2: replace can_upload with role column; migrate existing data
+	{
+		`ALTER TABLE users ADD COLUMN role TEXT NOT NULL DEFAULT 'reader'`,
+		`UPDATE users SET role = CASE WHEN can_upload = 1 THEN 'uploader' ELSE 'reader' END`,
+	},
+}
+
+func (s *Store) migrate() error {
+	if _, err := s.db.Exec(
+		`CREATE TABLE IF NOT EXISTS _schema_version (version INTEGER NOT NULL)`,
+	); err != nil {
+		return err
+	}
+
+	var version int
+	if err := s.db.QueryRow(
+		`SELECT COALESCE(MAX(version), 0) FROM _schema_version`,
+	).Scan(&version); err != nil {
+		return err
+	}
+
+	for i, stmts := range migrations {
+		v := i + 1
+		if v <= version {
+			continue
+		}
+		tx, err := s.db.Begin()
+		if err != nil {
+			return err
+		}
+		for _, stmt := range stmts {
+			if _, err := tx.Exec(stmt); err != nil {
+				_ = tx.Rollback()
+				return fmt.Errorf("migration %d: %w", v, err)
+			}
+		}
+		if _, err := tx.Exec(`INSERT INTO _schema_version (version) VALUES (?)`, v); err != nil {
+			_ = tx.Rollback()
+			return err
+		}
+		if err := tx.Commit(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// CreateUser adds a new user with the given role. Returns ErrUserExists if the
+// username is already taken.
+func (s *Store) CreateUser(username, password string, role Role) (*User, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, err
+	}
+	res, err := s.db.Exec(
+		`INSERT INTO users (username, password_hash, role) VALUES (?, ?, ?)`,
+		username, string(hash), role,
+	)
+	if err != nil {
+		if isUnique(err) {
+			return nil, ErrUserExists
+		}
+		return nil, err
+	}
+	id, _ := res.LastInsertId()
+	return &User{ID: id, Username: username, Role: role}, nil
+}
+
+// SetRole changes the role of an existing user.
+func (s *Store) SetRole(username string, role Role) error {
+	res, err := s.db.Exec(
+		`UPDATE users SET role = ? WHERE username = ?`,
+		role, username,
+	)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// DeleteUser removes a user by username.
+func (s *Store) DeleteUser(username string) error {
+	res, err := s.db.Exec(`DELETE FROM users WHERE username = ?`, username)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// ListUsers returns all users ordered by username.
+func (s *Store) ListUsers() ([]User, error) {
+	rows, err := s.db.Query(`SELECT id, username, role FROM users ORDER BY username`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var users []User
+	for rows.Next() {
+		var u User
+		var roleStr string
+		if err := rows.Scan(&u.ID, &u.Username, &roleStr); err != nil {
+			return nil, err
+		}
+		u.Role = Role(roleStr)
+		users = append(users, u)
+	}
+	return users, rows.Err()
+}
+
+// Authenticate verifies credentials and returns the matching user, or nil on
+// wrong username/password.
+func (s *Store) Authenticate(username, password string) (*User, error) {
+	var u User
+	var hash, roleStr string
+	err := s.db.QueryRow(
+		`SELECT id, username, password_hash, role FROM users WHERE username = ?`,
+		username,
+	).Scan(&u.ID, &u.Username, &hash, &roleStr)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	if bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) != nil {
+		return nil, nil
+	}
+	u.Role = Role(roleStr)
+	return &u, nil
+}
+
+// CreateSession issues a new session token for a user (TTL: 30 days).
+func (s *Store) CreateSession(u *User) (*Session, error) {
+	token, err := randomToken()
+	if err != nil {
+		return nil, err
+	}
+	exp := time.Now().Add(30 * 24 * time.Hour)
+	if _, err = s.db.Exec(
+		`INSERT INTO sessions (token, user_id, expires_at) VALUES (?, ?, ?)`,
+		token, u.ID, exp.Unix(),
+	); err != nil {
+		return nil, err
+	}
+	return &Session{
+		Token:     token,
+		UserID:    u.ID,
+		Username:  u.Username,
+		Role:      u.Role,
+		ExpiresAt: exp,
+	}, nil
+}
+
+// LookupSession returns the session if valid, nil if not found or expired.
+func (s *Store) LookupSession(token string) (*Session, error) {
+	var sess Session
+	var roleStr string
+	var expUnix int64
+	err := s.db.QueryRow(`
+		SELECT s.token, s.user_id, u.username, u.role, s.expires_at
+		FROM sessions s JOIN users u ON u.id = s.user_id
+		WHERE s.token = ?
+	`, token).Scan(&sess.Token, &sess.UserID, &sess.Username, &roleStr, &expUnix)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	sess.ExpiresAt = time.Unix(expUnix, 0)
+	if time.Now().After(sess.ExpiresAt) {
+		_, _ = s.db.Exec(`DELETE FROM sessions WHERE token = ?`, token)
+		return nil, nil
+	}
+	sess.Role = Role(roleStr)
+	return &sess, nil
+}
+
+// DeleteSession invalidates a session token (logout).
+func (s *Store) DeleteSession(token string) error {
+	_, err := s.db.Exec(`DELETE FROM sessions WHERE token = ?`, token)
+	return err
+}
+
+func randomToken() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("random token: %w", err)
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func isUnique(err error) bool {
+	return err != nil && strings.Contains(strings.ToLower(err.Error()), "unique")
+}
@@ -3,29 +3,46 @@ package web
 import (
 	"context"
 	"errors"
+	"fmt"
+	"io"
 	"net/http"
+	"os"
 	"path/filepath"
 	"strings"

 	"github.com/a-h/templ"
 	"github.com/arnef/ebooks/internal/library"
+	"github.com/arnef/ebooks/internal/users"
 	"github.com/arnef/ebooks/views"
 )

+const maxUploadBytes = 512 << 20 // 512 MiB
+
 type Handler struct {
 	lib   *library.Service
+	store *users.Store
 }

-func NewHandler(lib *library.Service) *Handler {
-	return &Handler{lib: lib}
+func NewHandler(lib *library.Service, store *users.Store) *Handler {
+	return &Handler{lib: lib, store: store}
 }

 func (h *Handler) RegisterRoutes(mux *http.ServeMux) {
-	mux.HandleFunc("GET /", h.listBooks)
-	mux.HandleFunc("GET /book/{id}", h.bookDetails)
-	mux.HandleFunc("GET /download/{id}", h.downloadBook)
-	mux.HandleFunc("GET /cover/{id}", h.bookCover)
+	// Public
+	mux.HandleFunc("GET /login", h.loginPage)
+	mux.HandleFunc("POST /login", h.loginSubmit)
+	mux.HandleFunc("POST /logout", h.logout)
 	mux.Handle("GET /static/", http.StripPrefix("/static/", http.FileServer(http.Dir("static"))))
+
+	// Authenticated (any role)
+	mux.HandleFunc("GET /", h.requireAuth(h.listBooks))
+	mux.HandleFunc("GET /book/{id}", h.requireAuth(h.bookDetails))
+	mux.HandleFunc("GET /download/{id}", h.requireAuth(h.downloadBook))
+	mux.HandleFunc("GET /cover/{id}", h.requireAuth(h.bookCover))
+
+	// Uploader and above
+	mux.HandleFunc("GET /upload", h.requireRole(users.RoleUploader, h.uploadPage))
+	mux.HandleFunc("POST /upload", h.requireRole(users.RoleUploader, h.uploadSubmit))
 }

 func (h *Handler) listBooks(w http.ResponseWriter, r *http.Request) {
@@ -34,7 +51,9 @@ func (h *Handler) listBooks(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "failed to load books", http.StatusInternalServerError)
 		return
 	}
-	render(w, r.Context(), views.IndexPage(books))
+	sess := sessionFrom(r)
+	canUpload := sess != nil && sess.Role.AtLeast(users.RoleUploader)
+	render(w, r.Context(), views.IndexPage(books, canUpload))
 }

 func (h *Handler) bookDetails(w http.ResponseWriter, r *http.Request) {
@@ -116,3 +135,113 @@ func render(w http.ResponseWriter, ctx context.Context, c templ.Component) {
 		http.Error(w, "render failed", http.StatusInternalServerError)
 	}
 }
+
+// --- Auth handlers ---
+
+func (h *Handler) loginPage(w http.ResponseWriter, r *http.Request) {
+	render(w, r.Context(), views.LoginPage(""))
+}
+
+func (h *Handler) loginSubmit(w http.ResponseWriter, r *http.Request) {
+	username := r.FormValue("username")
+	password := r.FormValue("password")
+
+	user, err := h.store.Authenticate(username, password)
+	if err != nil {
+		http.Error(w, "interner Fehler", http.StatusInternalServerError)
+		return
+	}
+	if user == nil {
+		render(w, r.Context(), views.LoginPage("Benutzername oder Passwort falsch."))
+		return
+	}
+
+	sess, err := h.store.CreateSession(user)
+	if err != nil {
+		http.Error(w, "Session konnte nicht erstellt werden", http.StatusInternalServerError)
+		return
+	}
+
+	http.SetCookie(w, &http.Cookie{
+		Name:     "session",
+		Value:    sess.Token,
+		Path:     "/",
+		Expires:  sess.ExpiresAt,
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+	})
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
+
+func (h *Handler) logout(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("session")
+	if err == nil {
+		_ = h.store.DeleteSession(cookie.Value)
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:    "session",
+		Value:   "",
+		Path:    "/",
+		MaxAge:  -1,
+		HttpOnly: true,
+	})
+	http.Redirect(w, r, "/login", http.StatusSeeOther)
+}
+
+// --- Upload handlers ---
+
+func (h *Handler) uploadPage(w http.ResponseWriter, r *http.Request) {
+	render(w, r.Context(), views.UploadPage(""))
+}
+
+func (h *Handler) uploadSubmit(w http.ResponseWriter, r *http.Request) {
+	r.Body = http.MaxBytesReader(w, r.Body, maxUploadBytes)
+	if err := r.ParseMultipartForm(32 << 20); err != nil {
+		render(w, r.Context(), views.UploadPage("Datei zu groß oder ungültige Anfrage."))
+		return
+	}
+
+	file, header, err := r.FormFile("book")
+	if err != nil {
+		render(w, r.Context(), views.UploadPage("Keine Datei ausgewählt."))
+		return
+	}
+	defer file.Close()
+
+	ext := strings.ToLower(filepath.Ext(header.Filename))
+	if ext != ".epub" && ext != ".pdf" {
+		render(w, r.Context(), views.UploadPage("Nur EPUB- und PDF-Dateien erlaubt."))
+		return
+	}
+
+	// Sanitize filename: keep only base name, no path components.
+	safeFilename := filepath.Base(header.Filename)
+	destPath := filepath.Join(h.lib.BooksDir(), safeFilename)
+
+	// Check it still resolves inside BooksDir.
+	cleanBase := filepath.Clean(h.lib.BooksDir())
+	cleanDest := filepath.Clean(destPath)
+	if !strings.HasPrefix(cleanDest, cleanBase+string(filepath.Separator)) {
+		render(w, r.Context(), views.UploadPage("Ungültiger Dateiname."))
+		return
+	}
+
+	out, err := os.OpenFile(destPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o644)
+	if err != nil {
+		if os.IsExist(err) {
+			render(w, r.Context(), views.UploadPage(fmt.Sprintf("Datei '%s' existiert bereits.", safeFilename)))
+			return
+		}
+		http.Error(w, "Datei konnte nicht gespeichert werden", http.StatusInternalServerError)
+		return
+	}
+	defer out.Close()
+
+	if _, err := io.Copy(out, file); err != nil {
+		_ = os.Remove(destPath)
+		http.Error(w, "Upload fehlgeschlagen", http.StatusInternalServerError)
+		return
+	}
+
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}
@@ -0,0 +1,53 @@
+package web
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/arnef/ebooks/internal/users"
+)
+
+type contextKey int
+
+const sessionKey contextKey = iota
+
+// sessionFrom retrieves the session stored in request context.
+func sessionFrom(r *http.Request) *users.Session {
+	s, _ := r.Context().Value(sessionKey).(*users.Session)
+	return s
+}
+
+// requireAuth redirects unauthenticated requests to /login.
+func (h *Handler) requireAuth(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		sess, err := h.sessionFromRequest(r)
+		if err != nil || sess == nil {
+			http.Redirect(w, r, "/login", http.StatusSeeOther)
+			return
+		}
+		ctx := context.WithValue(r.Context(), sessionKey, sess)
+		next(w, r.WithContext(ctx))
+	}
+}
+
+// requireRole returns middleware that allows access only to users whose role is
+// at least minRole. Unknown sessions are redirected to /login; insufficient
+// role yields 403.
+func (h *Handler) requireRole(minRole users.Role, next http.HandlerFunc) http.HandlerFunc {
+	return h.requireAuth(func(w http.ResponseWriter, r *http.Request) {
+		sess := sessionFrom(r)
+		if !sess.Role.AtLeast(minRole) {
+			http.Error(w, "Keine Berechtigung", http.StatusForbidden)
+			return
+		}
+		next(w, r)
+	})
+}
+
+func (h *Handler) sessionFromRequest(r *http.Request) (*users.Session, error) {
+	cookie, err := r.Cookie("session")
+	if err != nil {
+		return nil, nil
+	}
+	return h.store.LookupSession(cookie.Value)
+}
@@ -73,61 +73,80 @@ h2 {

 .book-list {
  list-style: none;
-  margin: 0;
+  margin: 0 -0.25rem;
  padding: 0;
 }

 .book-item {
-  border: 1px solid #000;
-  margin-bottom: 0.6rem;
-  padding: 0.6rem;
+  display: inline-block;
+  width: 33.3333%;
+  vertical-align: top;
+  box-sizing: border-box;
+  padding: 0.25rem;
+  margin: 0;
+  border: none;
 }

 .book-card {
-  display: table;
-  width: 100%;
+  display: block;
+  border: 1px solid #000;
+  padding: 0.5rem;
  color: inherit;
  text-decoration: none;
 }

-.book-card-cover,
-.book-card-body {
-  display: table-cell;
-  vertical-align: top;
+.book-card-cover {
+  display: block;
+  margin-bottom: 0.5rem;
 }

-.book-card-cover {
-  width: 4.8rem;
-  padding-right: 0.75rem;
+.book-card-body {
+  display: block;
+}
+
+.book-detail-cover {
+  display: block;
+}
+
+.book-card-cover,
+.book-detail-cover {
+  text-align: center;
 }

 .book-cover,
 .book-cover-placeholder {
-  display: block;
-  width: 4.2rem;
-  height: 6rem;
+  display: inline-block;
+  width: 100%;
+  max-width: 100%;
+  aspect-ratio: 2 / 3;
  border: 1px solid #000;
  object-fit: cover;
+  vertical-align: top;
 }

 .book-cover-placeholder {
  text-align: center;
-  line-height: 6rem;
-  font-size: 0.8rem;
+  font-size: 0.75rem;
  font-weight: bold;
+  line-height: 1.2;
+  padding-top: 2.3rem;
+  box-sizing: border-box;
 }

 .book-cover-detail,
 .book-cover-placeholder-detail {
  width: 8rem;
  height: 11.5rem;
+  max-width: none;
  margin-bottom: 1rem;
 }

 .book-title {
  display: block;
-  min-height: 44px;
  font-weight: bold;
+  font-size: 0.95rem;
+  line-height: 1.25;
+  margin-bottom: 0.25rem;
 }

 .book-author,
@@ -136,10 +155,15 @@ h2 {
  margin-top: 0.2rem;
 }

+.book-author {
+  font-size: 0.85rem;
+  line-height: 1.25;
+}
+
 .format {
  display: block;
  margin-top: 0.2rem;
-  font-size: 0.95rem;
+  font-size: 0.85rem;
 }

 .book-detail {
@@ -171,16 +195,59 @@ h2 {
 }

 .btn {
-  display: inline-block;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
  min-height: 44px;
  padding: 0.7rem 1rem;
  border: 2px solid #000;
+  background: none;
  text-decoration: none;
  color: #000;
+  font-family: inherit;
+  font-size: inherit;
  font-weight: bold;
+  cursor: pointer;
+  box-sizing: border-box;
 }

 code {
  border: 1px solid #000;
  padding: 0.1rem 0.3rem;
 }
+
+/* --- Auth & Upload --- */
+
+.btn-logout {
+  background: none;
+  border: 1px solid #000;
+  cursor: pointer;
+  padding: 0.3rem 0.6rem;
+  font-size: 0.9rem;
+}
+
+.login-box {
+  max-width: 22rem;
+  margin-top: 3rem;
+}
+
+.login-form,
+.upload-form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+.login-form input,
+.upload-form input[type="file"] {
+  padding: 0.5rem;
+  font-size: 1rem;
+  border: 1px solid #000;
+}
+
+.error {
+  border: 2px solid #000;
+  padding: 0.5rem 0.75rem;
+  margin-bottom: 0.75rem;
+  font-weight: bold;
+}
@@ -21,6 +21,9 @@ templ Layout(title string, backHref string) {
          <a class="header-back" href={ backHref } aria-label="Zurück">←</a>
        }
        <h1><a href="/">eBook Library</a></h1>
+        <form method="post" action="/logout" style="margin-left:auto">
+          <button type="submit" class="btn-logout">Abmelden</button>
+        </form>
      </div>
    </header>
    <main class="container">
@@ -30,6 +33,57 @@ templ Layout(title string, backHref string) {
 </html>
 }

+templ LoginLayout(title string) {
+<!doctype html>
+<html lang="de">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>{ title }</title>
+    <link rel="stylesheet" href="/static/styles.css" />
+  </head>
+  <body>
+    <main class="container">
+      { children... }
+    </main>
+  </body>
+</html>
+}
+
+templ LoginPage(errMsg string) {
+  @LoginLayout("Anmelden") {
+    <section class="login-box">
+      <h2>Anmelden</h2>
+      if errMsg != "" {
+        <p class="error">{ errMsg }</p>
+      }
+      <form method="post" action="/login" class="login-form">
+        <label for="username">Benutzername</label>
+        <input id="username" type="text" name="username" required autofocus />
+        <label for="password">Passwort</label>
+        <input id="password" type="password" name="password" required />
+        <button type="submit" class="btn">Anmelden</button>
+      </form>
+    </section>
+  }
+}
+
+templ UploadPage(errMsg string) {
+  @Layout("Buch hochladen", "/") {
+    <section class="page-head">
+      <h2>Buch hochladen</h2>
+    </section>
+    if errMsg != "" {
+      <p class="error">{ errMsg }</p>
+    }
+    <form method="post" action="/upload" enctype="multipart/form-data" class="upload-form">
+      <label for="book">EPUB oder PDF auswählen</label>
+      <input id="book" type="file" name="book" accept=".epub,.pdf" required />
+      <button type="submit" class="btn">Hochladen</button>
+    </form>
+  }
+}
+
 templ BookCover(book library.Book, detail bool) {
  if book.HasCover {
    <img class={ coverClass(detail) } src={ "/cover/" + book.ID } alt={ "Cover von " + book.Title } loading="lazy" />
@@ -40,11 +94,14 @@ templ BookCover(book library.Book, detail bool) {
  }
 }

-templ IndexPage(books []library.Book) {
+templ IndexPage(books []library.Book, canUpload bool) {
  @Layout("Bibliothek", "") {
    <section class="page-head">
      <h2>Meine Bücher</h2>
      <p class="page-subtitle">Titel, Autor und Cover auf einen Blick.</p>
+      if canUpload {
+        <a class="btn" href="/upload">Buch hochladen</a>
+      }
    </section>
    if len(books) == 0 {
      <p>Keine eBooks gefunden. Lege EPUB- oder PDF-Dateien im Ordner <code>books/</code> ab.</p>
@@ -8,9 +8,12 @@ package views
 import "github.com/a-h/templ"
 import templruntime "github.com/a-h/templ/runtime"

-import "github.com/arnef/ebooks/internal/library"
+import (
+	"github.com/arnef/ebooks/internal/library"
+	"strings"
+)

-func Layout(title string) templ.Component {
+func Layout(title string, backHref string) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
@@ -38,13 +41,36 @@ func Layout(title string) templ.Component {
 		var templ_7745c5c3_Var2 string
 		templ_7745c5c3_Var2, templ_7745c5c3_Err = templ.JoinStringErrs(title)
 		if templ_7745c5c3_Err != nil {
-			return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 11, Col: 18}
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 14, Col: 18}
 		}
 		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var2))
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</title><link rel=\"stylesheet\" href=\"/static/styles.css\"></head><body><header class=\"header\"><h1><a href=\"/\">eBook Library</a></h1></header><main class=\"container\">")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 2, "</title><link rel=\"stylesheet\" href=\"/static/styles.css\"></head><body><header class=\"header\"><div class=\"header-bar\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		if backHref != "" {
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "<a class=\"header-back\" href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var3 templ.SafeURL
+			templ_7745c5c3_Var3, templ_7745c5c3_Err = templ.JoinURLErrs(backHref)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 21, Col: 48}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var3))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "\" aria-label=\"Zurück\">←</a>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<h1><a href=\"/\">eBook Library</a></h1><form method=\"post\" action=\"/logout\" style=\"margin-left:auto\"><button type=\"submit\" class=\"btn-logout\">Abmelden</button></form></div></header><main class=\"container\">")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -52,7 +78,7 @@ func Layout(title string) templ.Component {
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
-		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 3, "</main></body></html>")
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "</main></body></html>")
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -60,7 +86,7 @@ func Layout(title string) templ.Component {
 	})
 }

-func IndexPage(books []library.Book) templ.Component {
+func LoginLayout(title string) templ.Component {
 	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
@@ -76,12 +102,62 @@ func IndexPage(books []library.Book) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var3 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var3 == nil {
-			templ_7745c5c3_Var3 = templ.NopComponent
+		templ_7745c5c3_Var4 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var4 == nil {
+			templ_7745c5c3_Var4 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Var4 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "<!doctype html><html lang=\"de\"><head><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"><title>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		var templ_7745c5c3_Var5 string
+		templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinStringErrs(title)
+		if templ_7745c5c3_Err != nil {
+			return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 42, Col: 18}
+		}
+		_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "</title><link rel=\"stylesheet\" href=\"/static/styles.css\"></head><body><main class=\"container\">")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templ_7745c5c3_Var4.Render(ctx, templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</main></body></html>")
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		return nil
+	})
+}
+
+func LoginPage(errMsg string) templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var6 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var6 == nil {
+			templ_7745c5c3_Var6 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		templ_7745c5c3_Var7 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
@@ -93,73 +169,355 @@ func IndexPage(books []library.Book) templ.Component {
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 4, "<h2>Meine Bücher</h2>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "<section class=\"login-box\"><h2>Anmelden</h2>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			if len(books) == 0 {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 5, "<p>Keine eBooks gefunden. Lege EPUB- oder PDF-Dateien im Ordner <code>books/</code> ab.</p>")
+			if errMsg != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "<p class=\"error\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var8 string
+				templ_7745c5c3_Var8, templ_7745c5c3_Err = templ.JoinStringErrs(errMsg)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 58, Col: 33}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var8))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "</p>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "<form method=\"post\" action=\"/login\" class=\"login-form\"><label for=\"username\">Benutzername</label> <input id=\"username\" type=\"text\" name=\"username\" required autofocus> <label for=\"password\">Passwort</label> <input id=\"password\" type=\"password\" name=\"password\" required> <button type=\"submit\" class=\"btn\">Anmelden</button></form></section>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			return nil
+		})
+		templ_7745c5c3_Err = LoginLayout("Anmelden").Render(templ.WithChildren(ctx, templ_7745c5c3_Var7), templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		return nil
+	})
+}
+
+func UploadPage(errMsg string) templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var9 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var9 == nil {
+			templ_7745c5c3_Var9 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		templ_7745c5c3_Var10 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+			if !templ_7745c5c3_IsBuffer {
+				defer func() {
+					templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+					if templ_7745c5c3_Err == nil {
+						templ_7745c5c3_Err = templ_7745c5c3_BufErr
+					}
+				}()
+			}
+			ctx = templ.InitializeContext(ctx)
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "<section class=\"page-head\"><h2>Buch hochladen</h2></section>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if errMsg != "" {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "<p class=\"error\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				var templ_7745c5c3_Var11 string
+				templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(errMsg)
+				if templ_7745c5c3_Err != nil {
+					return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 77, Col: 31}
+				}
+				_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "</p>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 17, " <form method=\"post\" action=\"/upload\" enctype=\"multipart/form-data\" class=\"upload-form\"><label for=\"book\">EPUB oder PDF auswählen</label> <input id=\"book\" type=\"file\" name=\"book\" accept=\".epub,.pdf\" required> <button type=\"submit\" class=\"btn\">Hochladen</button></form>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			return nil
+		})
+		templ_7745c5c3_Err = Layout("Buch hochladen", "/").Render(templ.WithChildren(ctx, templ_7745c5c3_Var10), templ_7745c5c3_Buffer)
+		if templ_7745c5c3_Err != nil {
+			return templ_7745c5c3_Err
+		}
+		return nil
+	})
+}
+
+func BookCover(book library.Book, detail bool) templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var12 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var12 == nil {
+			templ_7745c5c3_Var12 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		if book.HasCover {
+			var templ_7745c5c3_Var13 = []any{coverClass(detail)}
+			templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var13...)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 18, "<img class=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var14 string
+			templ_7745c5c3_Var14, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var13).String())
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 1, Col: 0}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var14)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 19, "\" src=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var15 string
+			templ_7745c5c3_Var15, templ_7745c5c3_Err = templ.ResolveAttributeValue("/cover/" + book.ID)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 89, Col: 63}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var15)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 20, "\" alt=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var16 string
+			templ_7745c5c3_Var16, templ_7745c5c3_Err = templ.ResolveAttributeValue("Cover von " + book.Title)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 89, Col: 97}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var16)
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 21, "\" loading=\"lazy\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		} else {
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 6, "<ul class=\"book-list\">")
+			var templ_7745c5c3_Var17 = []any{placeholderClass(detail)}
+			templ_7745c5c3_Err = templ.RenderCSSItems(ctx, templ_7745c5c3_Buffer, templ_7745c5c3_Var17...)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-				for _, b := range books {
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 7, "<li class=\"book-item\"><a class=\"book-link\" href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 22, "<div class=\"")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-					var templ_7745c5c3_Var5 templ.SafeURL
-					templ_7745c5c3_Var5, templ_7745c5c3_Err = templ.JoinURLErrs("/book/" + b.ID)
+			var templ_7745c5c3_Var18 string
+			templ_7745c5c3_Var18, templ_7745c5c3_Err = templ.ResolveAttributeValue(templ.CSSClasses(templ_7745c5c3_Var17).String())
 			if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 34, Col: 55}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 1, Col: 0}
 			}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var5))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ_7745c5c3_Var18)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 8, "\">")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 23, "\" aria-hidden=\"true\"><span>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-					var templ_7745c5c3_Var6 string
-					templ_7745c5c3_Var6, templ_7745c5c3_Err = templ.JoinStringErrs(b.Title)
+			var templ_7745c5c3_Var19 string
+			templ_7745c5c3_Var19, templ_7745c5c3_Err = templ.JoinStringErrs(strings.ToUpper(book.Format))
 			if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 34, Col: 67}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 92, Col: 42}
 			}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var6))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var19))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 9, "</a> <span class=\"format\">")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					var templ_7745c5c3_Var7 string
-					templ_7745c5c3_Var7, templ_7745c5c3_Err = templ.JoinStringErrs(b.Format)
-					if templ_7745c5c3_Err != nil {
-						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 35, Col: 43}
-					}
-					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var7))
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 10, "</span></li>")
-					if templ_7745c5c3_Err != nil {
-						return templ_7745c5c3_Err
-					}
-				}
-				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 11, "</ul>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 24, "</span></div>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 		}
 		return nil
 	})
-		templ_7745c5c3_Err = Layout("Bibliothek").Render(templ.WithChildren(ctx, templ_7745c5c3_Var4), templ_7745c5c3_Buffer)
+}
+
+func IndexPage(books []library.Book, canUpload bool) templ.Component {
+	return templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+		if templ_7745c5c3_CtxErr := ctx.Err(); templ_7745c5c3_CtxErr != nil {
+			return templ_7745c5c3_CtxErr
+		}
+		templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+		if !templ_7745c5c3_IsBuffer {
+			defer func() {
+				templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+				if templ_7745c5c3_Err == nil {
+					templ_7745c5c3_Err = templ_7745c5c3_BufErr
+				}
+			}()
+		}
+		ctx = templ.InitializeContext(ctx)
+		templ_7745c5c3_Var20 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var20 == nil {
+			templ_7745c5c3_Var20 = templ.NopComponent
+		}
+		ctx = templ.ClearChildren(ctx)
+		templ_7745c5c3_Var21 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
+			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
+			if !templ_7745c5c3_IsBuffer {
+				defer func() {
+					templ_7745c5c3_BufErr := templruntime.ReleaseBuffer(templ_7745c5c3_Buffer)
+					if templ_7745c5c3_Err == nil {
+						templ_7745c5c3_Err = templ_7745c5c3_BufErr
+					}
+				}()
+			}
+			ctx = templ.InitializeContext(ctx)
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 25, "<section class=\"page-head\"><h2>Meine Bücher</h2><p class=\"page-subtitle\">Titel, Autor und Cover auf einen Blick.</p>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if canUpload {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 26, "<a class=\"btn\" href=\"/upload\">Buch hochladen</a>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 27, "</section>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			if len(books) == 0 {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 28, "<p>Keine eBooks gefunden. Lege EPUB- oder PDF-Dateien im Ordner <code>books/</code> ab.</p>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			} else {
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 29, "<ul class=\"book-list\">")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+				for _, b := range books {
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 30, "<li class=\"book-item\"><a class=\"book-card\" href=\"")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var22 templ.SafeURL
+					templ_7745c5c3_Var22, templ_7745c5c3_Err = templ.JoinURLErrs("/book/" + b.ID)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 112, Col: 55}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var22))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 31, "\"><div class=\"book-card-cover\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = BookCover(b, false).Render(ctx, templ_7745c5c3_Buffer)
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 32, "</div><div class=\"book-card-body\"><strong class=\"book-title\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var23 string
+					templ_7745c5c3_Var23, templ_7745c5c3_Err = templ.JoinStringErrs(b.Title)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 117, Col: 52}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var23))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 33, "</strong> <span class=\"book-author\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var24 string
+					templ_7745c5c3_Var24, templ_7745c5c3_Err = templ.JoinStringErrs(b.Author)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 118, Col: 52}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var24))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 34, "</span> <span class=\"format\">")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					var templ_7745c5c3_Var25 string
+					templ_7745c5c3_Var25, templ_7745c5c3_Err = templ.JoinStringErrs(b.Format)
+					if templ_7745c5c3_Err != nil {
+						return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 119, Col: 47}
+					}
+					_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var25))
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+					templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 35, "</span></div></a></li>")
+					if templ_7745c5c3_Err != nil {
+						return templ_7745c5c3_Err
+					}
+				}
+				templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 36, "</ul>")
+				if templ_7745c5c3_Err != nil {
+					return templ_7745c5c3_Err
+				}
+			}
+			return nil
+		})
+		templ_7745c5c3_Err = Layout("Bibliothek", "").Render(templ.WithChildren(ctx, templ_7745c5c3_Var21), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -183,12 +541,12 @@ func BookPage(book library.Book) templ.Component {
 			}()
 		}
 		ctx = templ.InitializeContext(ctx)
-		templ_7745c5c3_Var8 := templ.GetChildren(ctx)
-		if templ_7745c5c3_Var8 == nil {
-			templ_7745c5c3_Var8 = templ.NopComponent
+		templ_7745c5c3_Var26 := templ.GetChildren(ctx)
+		if templ_7745c5c3_Var26 == nil {
+			templ_7745c5c3_Var26 = templ.NopComponent
 		}
 		ctx = templ.ClearChildren(ctx)
-		templ_7745c5c3_Var9 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
+		templ_7745c5c3_Var27 := templruntime.GeneratedTemplate(func(templ_7745c5c3_Input templruntime.GeneratedComponentInput) (templ_7745c5c3_Err error) {
 			templ_7745c5c3_W, ctx := templ_7745c5c3_Input.Writer, templ_7745c5c3_Input.Context
 			templ_7745c5c3_Buffer, templ_7745c5c3_IsBuffer := templruntime.GetBuffer(templ_7745c5c3_W)
 			if !templ_7745c5c3_IsBuffer {
@@ -200,65 +558,86 @@ func BookPage(book library.Book) templ.Component {
 				}()
 			}
 			ctx = templ.InitializeContext(ctx)
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 12, "<article><h2>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 37, "<article class=\"book-detail\"><div class=\"book-detail-cover\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var10 string
-			templ_7745c5c3_Var10, templ_7745c5c3_Err = templ.JoinStringErrs(book.Title)
-			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 46, Col: 22}
-			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var10))
+			templ_7745c5c3_Err = BookCover(book, true).Render(ctx, templ_7745c5c3_Buffer)
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 13, "</h2><p><strong>Datei:</strong> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 38, "</div><div class=\"book-detail-body\"><h2>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var11 string
-			templ_7745c5c3_Var11, templ_7745c5c3_Err = templ.JoinStringErrs(book.Filename)
+			var templ_7745c5c3_Var28 string
+			templ_7745c5c3_Var28, templ_7745c5c3_Err = templ.JoinStringErrs(book.Title)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 47, Col: 48}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 136, Col: 24}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var11))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var28))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 14, "</p><p><strong>Format:</strong> ")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 39, "</h2><p class=\"book-author-detail\">")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var12 string
-			templ_7745c5c3_Var12, templ_7745c5c3_Err = templ.JoinStringErrs(book.Format)
+			var templ_7745c5c3_Var29 string
+			templ_7745c5c3_Var29, templ_7745c5c3_Err = templ.JoinStringErrs(book.Author)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 48, Col: 47}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 137, Col: 51}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var12))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var29))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 15, "</p><p><a class=\"btn\" href=\"")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 40, "</p><dl class=\"book-meta\"><div><dt>Datei</dt><dd>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			var templ_7745c5c3_Var13 templ.SafeURL
-			templ_7745c5c3_Var13, templ_7745c5c3_Err = templ.JoinURLErrs("/download/" + book.ID)
+			var templ_7745c5c3_Var30 string
+			templ_7745c5c3_Var30, templ_7745c5c3_Err = templ.JoinStringErrs(book.Filename)
 			if templ_7745c5c3_Err != nil {
-				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 49, Col: 53}
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 141, Col: 31}
 			}
-			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var13))
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var30))
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
-			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 16, "\">Auf Tolino herunterladen</a></p><p><a href=\"/\">← Zurück zur Liste</a></p></article>")
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 41, "</dd></div><div><dt>Format</dt><dd>")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var31 string
+			templ_7745c5c3_Var31, templ_7745c5c3_Err = templ.JoinStringErrs(book.Format)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 145, Col: 29}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var31))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 42, "</dd></div></dl><p><a class=\"btn\" href=\"")
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			var templ_7745c5c3_Var32 templ.SafeURL
+			templ_7745c5c3_Var32, templ_7745c5c3_Err = templ.JoinURLErrs("/download/" + book.ID)
+			if templ_7745c5c3_Err != nil {
+				return templ.Error{Err: templ_7745c5c3_Err, FileName: `views/pages.templ`, Line: 148, Col: 55}
+			}
+			_, templ_7745c5c3_Err = templ_7745c5c3_Buffer.WriteString(templ.EscapeString(templ_7745c5c3_Var32))
+			if templ_7745c5c3_Err != nil {
+				return templ_7745c5c3_Err
+			}
+			templ_7745c5c3_Err = templruntime.WriteString(templ_7745c5c3_Buffer, 43, "\">Auf Tolino herunterladen</a></p></div></article>")
 			if templ_7745c5c3_Err != nil {
 				return templ_7745c5c3_Err
 			}
 			return nil
 		})
-		templ_7745c5c3_Err = Layout(book.Title).Render(templ.WithChildren(ctx, templ_7745c5c3_Var9), templ_7745c5c3_Buffer)
+		templ_7745c5c3_Err = Layout(book.Title, "/").Render(templ.WithChildren(ctx, templ_7745c5c3_Var27), templ_7745c5c3_Buffer)
 		if templ_7745c5c3_Err != nil {
 			return templ_7745c5c3_Err
 		}
@@ -266,4 +645,18 @@ func BookPage(book library.Book) templ.Component {
 	})
 }

+func coverClass(detail bool) string {
+	if detail {
+		return "book-cover book-cover-detail"
+	}
+	return "book-cover"
+}
+
+func placeholderClass(detail bool) string {
+	if detail {
+		return "book-cover-placeholder book-cover-placeholder-detail"
+	}
+	return "book-cover-placeholder"
+}
+
 var _ = templruntime.GeneratedTemplate
Author	SHA1	Message	Date
arnefandCopilot	c877abf302	style: .btn als flex-Button mit konsistentem Styling Ermöglicht die Verwendung von .btn auf <button>-Elementen (nicht nur <a>-Links) mit einheitlicher Ausrichtung, Schrift und Cursor. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-08-14 21:32:19 +02:00
arnefandCopilot	817763887a	refactor: replace can_upload boolean with role-based access control Introduces a three-tier role hierarchy: reader < uploader < admin. - internal/users/role.go: Role type, roleLevel map, AtLeast(min), ParseRole() — new roles added by inserting into roleLevel only - internal/users/store.go: versioned migrations via _schema_version table; v2 migration adds 'role' column and migrates existing can_upload data; SetRole() replaces SetUpload(); Session carries Role instead of CanUpload - internal/web/middleware.go: generic requireRole(minRole) middleware replaces the ad-hoc requireUpload - internal/web/handlers.go: upload routes use requireRole(RoleUploader); listBooks derives canUpload from sess.Role.AtLeast(RoleUploader) - cmd/admin/main.go: user add --role <reader\|uploader\|admin>, user set-role replaces user set-upload - README, copilot-instructions updated Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-08-11 19:43:39 +02:00
arnefandCopilot	a66c370de4	feat: add authentication and book upload - Session-based login (username/password, 30-day cookie) - SQLite user store with bcrypt password hashing (modernc.org/sqlite) - Per-user upload permission (can_upload flag) - Admin CLI (cmd/admin) for user management: user add/list/delete/set-upload - Upload handler for EPUB/PDF with path-traversal protection - All routes protected by requireAuth middleware; /upload additionally requires requireUpload - Login/logout UI, upload form, logout button in header - New env var: USERS_DB (default: users.db, gitignored) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-08-11 19:11:40 +02:00
ArneandCopilot Autofix powered by AI	a8b31dae8a	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-08 13:40:53 +02:00
ArneandCopilot Autofix powered by AI	1f31d7afae	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-08 13:40:38 +02:00
ArneandCopilot Autofix powered by AI	15d323541c	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-08 13:40:23 +02:00
ArneandCopilot Autofix powered by AI	e5931aa5c7	Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-08 13:40:09 +02:00
arnef	a936c61ba3	update pages_templ	2026-08-08 13:36:19 +02:00
Arne	91173750ad	Use Tolino-compatible three-column overview layout	2026-08-06 22:02:44 +02:00
Arne	d5a03bc05f	Switch overview to three-column book grid	2026-08-06 21:12:34 +02:00