From ad8ee97954d8bd77330deb33e33f837a73c1cb19 Mon Sep 17 00:00:00 2001
From: Valentyne Stigloher <pixunil@posteo.eu>
Date: Thu, 20 Mar 2025 13:01:10 +0100
Subject: [PATCH] (refactor) migrate /api/sources/** from express to h3

---
 components/Avoiding.vue                 |   2 +-
 components/SourceSubmitForm.vue         |   2 +-
 components/nouns/NounsSubmitForm.vue    |   2 +-
 locale/pl/nouns/dukatywy.vue            |   2 +-
 locale/pl/nouns/iksatywy.vue            |   2 +-
 locale/pl/nouns/osobatywy.vue           |   2 +-
 pages/sources.vue                       |   3 +-
 server/api/search.get.ts                |   2 +-
 server/api/sources/[id].get.ts          |  21 +++
 server/api/sources/approve/[id].post.ts |  20 ++
 server/api/sources/hide/[id].post.ts    |  27 +++
 server/api/sources/index.get.ts         |  11 ++
 server/api/sources/keys.get.ts          |  17 ++
 server/api/sources/remove/[id].post.ts  |  27 +++
 server/api/sources/submit.post.ts       |  43 +++++
 server/express/sources.ts               | 232 ------------------------
 server/index.ts                         |   2 -
 server/nouns.ts                         |   2 +-
 server/sources.ts                       | 110 +++++++++++
 19 files changed, 285 insertions(+), 244 deletions(-)
 create mode 100644 server/api/sources/[id].get.ts
 create mode 100644 server/api/sources/approve/[id].post.ts
 create mode 100644 server/api/sources/hide/[id].post.ts
 create mode 100644 server/api/sources/index.get.ts
 create mode 100644 server/api/sources/keys.get.ts
 create mode 100644 server/api/sources/remove/[id].post.ts
 create mode 100644 server/api/sources/submit.post.ts
 delete mode 100644 server/express/sources.ts
 create mode 100644 server/sources.ts

diff --git a/components/Avoiding.vue b/components/Avoiding.vue
index 062464e0a..79e94a3b9 100644
--- a/components/Avoiding.vue
+++ b/components/Avoiding.vue
@@ -17,7 +17,7 @@ const { data: sourcesRaw } = useAsyncData(async () => {
 });
 
 const sources = computed(() => {
-    if (!key) {
+    if (!key || !sourcesRaw.value) {
         return;
     }
 
diff --git a/components/SourceSubmitForm.vue b/components/SourceSubmitForm.vue
index a60a162ed..6e046b9d9 100644
--- a/components/SourceSubmitForm.vue
+++ b/components/SourceSubmitForm.vue
@@ -80,7 +80,7 @@ const edit = (source: Source): void => {
 defineExpose({ edit });
 
 const pronounLibrary = await loadPronounLibrary(config);
-const { data: keys } = await useFetch('/api/sources/keys', { lazy: true, default: () => [] });
+const { data: keys } = await useFetch('/api/sources/keys', { lazy: true, default: () => ({}) });
 </script>
 
 <template>
diff --git a/components/nouns/NounsSubmitForm.vue b/components/nouns/NounsSubmitForm.vue
index eea45109f..971f4f825 100644
--- a/components/nouns/NounsSubmitForm.vue
+++ b/components/nouns/NounsSubmitForm.vue
@@ -97,7 +97,7 @@ const focus = (editable = true): void => {
 defineExpose({ edit, focus });
 
 const abbreviations = await loadNounAbbreviations();
-const { data: sourcesKeys } = await useFetch('/api/sources/keys', { lazy: true, default: () => [] });
+const { data: sourcesKeys } = await useFetch('/api/sources/keys', { lazy: true, default: () => ({}) });
 </script>
 
 <template>
diff --git a/locale/pl/nouns/dukatywy.vue b/locale/pl/nouns/dukatywy.vue
index 9beb166dc..ed2ee6bab 100644
--- a/locale/pl/nouns/dukatywy.vue
+++ b/locale/pl/nouns/dukatywy.vue
@@ -207,7 +207,7 @@ const generatorResult = computed(() => {
 
 const sources = ref<Record<string, Source[] | undefined>>();
 onMounted(async () => {
-    const rawSources = await $fetch('/api/sources?pronoun=dukatywy');
+    const rawSources = await $fetch('/api/sources', { query: { pronoun: 'dukatywy' } });
     sources.value = {
         '': new SourceLibrary(config, rawSources).getForPronoun('dukatywy'),
     };
diff --git a/locale/pl/nouns/iksatywy.vue b/locale/pl/nouns/iksatywy.vue
index daca1c25c..cd03f8277 100644
--- a/locale/pl/nouns/iksatywy.vue
+++ b/locale/pl/nouns/iksatywy.vue
@@ -149,7 +149,7 @@ const generatorResult = computed(() => {
 
 const sources = ref<Record<string, Source[] | undefined>>();
 onMounted(async () => {
-    const rawSources = await $fetch('/api/sources?pronoun=iksatywy');
+    const rawSources = await $fetch('/api/sources', { query: { pronoun: 'iksatywy' } });
     sources.value = {
         '': new SourceLibrary(config, rawSources).getForPronoun('iksatywy'),
     };
diff --git a/locale/pl/nouns/osobatywy.vue b/locale/pl/nouns/osobatywy.vue
index 25646d88f..cf5c2f5f6 100644
--- a/locale/pl/nouns/osobatywy.vue
+++ b/locale/pl/nouns/osobatywy.vue
@@ -64,7 +64,7 @@ const personNouns = [
 
 const sources = ref<Record<string, Source[] | undefined>>();
 onMounted(async () => {
-    const rawSources = await $fetch('/api/sources?pronoun=osobatywy');
+    const rawSources = await $fetch('/api/sources', { query: { pronoun: 'osobatywy' } });
     sources.value = {
         '': new SourceLibrary(config, rawSources).getForPronoun('osobatywy'),
     };
diff --git a/pages/sources.vue b/pages/sources.vue
index a92b1e6dc..4e09bb7e3 100644
--- a/pages/sources.vue
+++ b/pages/sources.vue
@@ -1,7 +1,6 @@
 <script setup lang="ts">
 import type SourceSubmitForm from '~/components/SourceSubmitForm.vue';
 import { Source, SourceLibrary } from '~/src/classes.ts';
-import type { SourceRaw } from '~/src/classes.ts';
 import { loadPronounLibrary } from '~/src/data.ts';
 import { changeSourceInjectionKey } from '~/src/injectionKeys.ts';
 
@@ -22,7 +21,7 @@ useSimpleHead({
 
 const filter = useFilterWithCategory();
 
-const { data: rawSources } = await useFetch<SourceRaw[]>('/api/sources', { lazy: true });
+const { data: rawSources } = await useFetch('/api/sources', { lazy: true });
 const sourceLibrary = computed(() => {
     if (rawSources.value === null) {
         return undefined;
diff --git a/server/api/search.get.ts b/server/api/search.get.ts
index 9d9d7d918..4c00f0d03 100644
--- a/server/api/search.get.ts
+++ b/server/api/search.get.ts
@@ -11,10 +11,10 @@ import localeDescriptions from '~/locale/locales.ts';
 import { getPosts } from '~/server/blog.ts';
 import { getLocale, loadCalendar, loadConfig, loadPronounLibrary, loadTranslator } from '~/server/data.ts';
 import { getInclusiveEntries } from '~/server/express/inclusive.ts';
-import { getSourcesEntries } from '~/server/express/sources.ts';
 import { getTermsEntries } from '~/server/express/terms.ts';
 import { getNounEntries } from '~/server/nouns.ts';
 import { rootDir } from '~/server/paths.ts';
+import { getSourcesEntries } from '~/server/sources.ts';
 import { shortForVariant } from '~/src/buildPronoun.ts';
 import { Day } from '~/src/calendar/helpers.ts';
 import { getUrlForLocale } from '~/src/domain.ts';
diff --git a/server/api/sources/[id].get.ts b/server/api/sources/[id].get.ts
new file mode 100644
index 000000000..1d0012fe3
--- /dev/null
+++ b/server/api/sources/[id].get.ts
@@ -0,0 +1,21 @@
+import SQL from 'sql-template-strings';
+
+import { getLocale } from '~/server/data.ts';
+import { linkOtherVersions } from '~/server/sources.ts';
+
+export default defineEventHandler(async (event) => {
+    const { isGranted } = await useAuthentication(event);
+
+    const locale = getLocale(event);
+
+    const id = getRouterParam(event, 'id');
+    const db = useDatabase();
+    return await linkOtherVersions(db, isGranted, locale, await db.all(SQL`
+        SELECT s.*, u.username AS submitter FROM sources s
+        LEFT JOIN users u ON s.submitter_id = u.id
+        WHERE s.locale = ${locale}
+        AND s.deleted = 0
+        AND s.approved >= ${isGranted('sources') ? 0 : 1}
+        AND s.id = ${id}
+    `));
+});
diff --git a/server/api/sources/approve/[id].post.ts b/server/api/sources/approve/[id].post.ts
new file mode 100644
index 000000000..7cf8864b6
--- /dev/null
+++ b/server/api/sources/approve/[id].post.ts
@@ -0,0 +1,20 @@
+import { auditLog } from '~/server/audit.ts';
+import { getLocale } from '~/server/data.ts';
+import { approveSourceEntry } from '~/server/sources.ts';
+
+export default defineEventHandler(async (event) => {
+    const { user, isGranted } = await useAuthentication(event);
+    if (!isGranted('sources')) {
+        throw createError({
+            status: 401,
+            statusMessage: 'Unauthorised',
+        });
+    }
+
+    const id = getRouterParam(event, 'id')!;
+    const db = useDatabase();
+
+    await approveSourceEntry(db, id, getLocale(event));
+
+    await auditLog({ user }, 'sources/approved', { id });
+});
diff --git a/server/api/sources/hide/[id].post.ts b/server/api/sources/hide/[id].post.ts
new file mode 100644
index 000000000..f0f846fa7
--- /dev/null
+++ b/server/api/sources/hide/[id].post.ts
@@ -0,0 +1,27 @@
+import SQL from 'sql-template-strings';
+
+import { auditLog } from '~/server/audit.ts';
+import { getLocale } from '~/server/data.ts';
+
+export default defineEventHandler(async (event) => {
+    const { user, isGranted } = await useAuthentication(event);
+    if (!isGranted('sources')) {
+        throw createError({
+            status: 401,
+            statusMessage: 'Unauthorised',
+        });
+    }
+
+    const id = getRouterParam(event, 'id');
+    const db = useDatabase();
+
+    await db.get(SQL`
+        UPDATE sources
+        SET approved = 0
+        WHERE id = ${id}
+    `);
+
+    await invalidateCacheKind('sources', getLocale(event));
+
+    await auditLog({ user }, 'sources/hidden', { id });
+});
diff --git a/server/api/sources/index.get.ts b/server/api/sources/index.get.ts
new file mode 100644
index 000000000..b0908aeed
--- /dev/null
+++ b/server/api/sources/index.get.ts
@@ -0,0 +1,11 @@
+import { getLocale } from '~/server/data.ts';
+import { getSourcesEntries } from '~/server/sources.ts';
+
+export default defineEventHandler(async (event) => {
+    const locale = getLocale(event);
+    const pronounsFilter = getQuery(event).pronoun as string | undefined;
+
+    const { isGranted } = await useAuthentication(event);
+    const db = useDatabase();
+    return await getSourcesEntries(db, isGranted, locale, pronounsFilter);
+});
diff --git a/server/api/sources/keys.get.ts b/server/api/sources/keys.get.ts
new file mode 100644
index 000000000..d97b62536
--- /dev/null
+++ b/server/api/sources/keys.get.ts
@@ -0,0 +1,17 @@
+import SQL from 'sql-template-strings';
+
+export default defineEventHandler(async (): Promise<Record<string, string>> => {
+    const db = useDatabase();
+
+    const keys = await db.all<{ key: string }>(SQL`
+        SELECT trim(key) AS key
+        FROM sources
+        WHERE key IS NOT NULL
+          AND deleted = 0
+          AND approved = 1
+        GROUP BY key
+        ORDER BY key
+    `);
+
+    return Object.fromEntries(keys.map((k) => [k.key, k.key]));
+});
diff --git a/server/api/sources/remove/[id].post.ts b/server/api/sources/remove/[id].post.ts
new file mode 100644
index 000000000..bd7769389
--- /dev/null
+++ b/server/api/sources/remove/[id].post.ts
@@ -0,0 +1,27 @@
+import SQL from 'sql-template-strings';
+
+import { auditLog } from '~/server/audit.ts';
+import { getLocale } from '~/server/data.ts';
+
+export default defineEventHandler(async (event) => {
+    const { user, isGranted } = await useAuthentication(event);
+    if (!isGranted('sources')) {
+        throw createError({
+            status: 401,
+            statusMessage: 'Unauthorised',
+        });
+    }
+
+    const id = getRouterParam(event, 'id');
+    const db = useDatabase();
+
+    await db.get(SQL`
+        UPDATE sources
+        SET deleted=1
+        WHERE id = ${id}
+    `);
+
+    await invalidateCacheKind('sources', getLocale(event));
+
+    await auditLog({ user }, 'sources/removed', { id });
+});
diff --git a/server/api/sources/submit.post.ts b/server/api/sources/submit.post.ts
new file mode 100644
index 000000000..8c4f46105
--- /dev/null
+++ b/server/api/sources/submit.post.ts
@@ -0,0 +1,43 @@
+import SQL from 'sql-template-strings';
+import { ulid } from 'ulid';
+
+import { auditLog } from '~/server/audit.ts';
+import { getLocale } from '~/server/data.ts';
+import { approveSourceEntry } from '~/server/sources.ts';
+import { isAllowedToPost } from '~/server/user.ts';
+import { clearKey } from '~/src/helpers.ts';
+
+export default defineEventHandler(async (event) => {
+    const { user, isGranted } = await useAuthentication(event);
+    const db = useDatabase();
+
+    if (!user || !await isAllowedToPost(db, user)) {
+        throw createError({
+            status: 401,
+            statusMessage: 'Unauthorised',
+        });
+    }
+
+    const locale = getLocale(event);
+
+    const body = await readBody(event);
+    const id = ulid();
+    await db.get(SQL`
+        INSERT INTO sources (id, locale, pronouns, type, author, title, extra, year, fragments, comment, link, key, images, spoiler, submitter_id, base_id)
+        VALUES (
+            ${id}, ${locale}, ${body.pronouns.join(';')},
+            ${body.type}, ${body.author}, ${body.title}, ${body.extra}, ${body.year},
+            ${body.fragments.join('@').replace(/\n/g, '|')}, ${body.comment}, ${body.link},
+            ${clearKey(body.key)}, ${body.images ? body.images.join(',') : null}, ${body.spoiler ? 1 : 0},
+            ${user.id}, ${body.base}
+        )
+    `);
+    await auditLog({ user }, 'sources/submitted', body);
+
+    if (isGranted('sources')) {
+        await approveSourceEntry(db, id, locale);
+        await auditLog({ user }, 'sources/approved', { id });
+    }
+
+    setResponseStatus(event, 201, 'Created');
+});
diff --git a/server/express/sources.ts b/server/express/sources.ts
deleted file mode 100644
index bfcaf85d2..000000000
--- a/server/express/sources.ts
+++ /dev/null
@@ -1,232 +0,0 @@
-import { Router } from 'express';
-import type { Request } from 'express';
-import { getH3Event } from 'h3-express';
-import SQL from 'sql-template-strings';
-import { ulid } from 'ulid';
-
-import { clearKey, handleErrorAsync } from '../../src/helpers.ts';
-import { auditLog } from '../audit.ts';
-import type { Database } from '../db.ts';
-
-import { getLocale } from '~/server/data.ts';
-import type { SourceType } from '~/src/classes.ts';
-
-export interface SourceRow {
-    id: string;
-    locale: string;
-    pronouns: string;
-    type: SourceType;
-    author: string | null;
-    title: string;
-    extra: string | null;
-    year: number | null;
-    fragments: string;
-    comment: string | null;
-    link: string | null;
-    submitter_id: string | null;
-    approved: boolean;
-    deleted: number | null;
-    base_id: string | null;
-    key: string | null;
-    images: string | null;
-    spoiler: boolean;
-}
-
-const approve = async (db: Database, id: string, locale: string) => {
-    const { base_id } = (await db.get<Pick<SourceRow, 'base_id'>>(SQL`SELECT base_id FROM sources WHERE id=${id}`))!;
-    if (base_id) {
-        await db.get(SQL`
-            UPDATE sources
-            SET deleted=1
-            WHERE id = ${base_id}
-        `);
-    }
-    await db.get(SQL`
-        UPDATE sources
-        SET approved = 1, base_id = NULL
-        WHERE id = ${id}
-    `);
-    await invalidateCacheKind('sources', locale);
-};
-
-const keyGetMain = (key: string): string => {
-    return key.split('/')[0];
-};
-
-const linkOtherVersions = async (
-    db: Database,
-    isGranted: Request['isGranted'],
-    locale: string,
-    sources: SourceRow[],
-) => {
-    const keys = new Set(sources.filter((s) => !!s && s.key).map((s) => keyGetMain(clearKey(s.key)!)));
-
-    let sql = SQL`
-        SELECT s.*, u.username AS submitter FROM sources s
-        LEFT JOIN users u ON s.submitter_id = u.id
-        WHERE s.locale != ${locale}
-        AND s.deleted = 0
-        AND s.approved >= ${isGranted('sources') ? 0 : 1}
-        AND (`;
-    for (const key of keys) {
-        sql = sql.append(SQL`s.key = ${key} OR s.key LIKE ${`${key}/%`} OR `);
-    }
-    sql = sql.append(SQL`0=1)`);
-
-    const otherVersions = await db.all<SourceRow>(sql);
-
-    const otherVersionsMap: Record<string, SourceRow[]> = {};
-    otherVersions.forEach((version) => {
-        const k = keyGetMain(version.key!);
-        if (otherVersionsMap[k] === undefined) {
-            otherVersionsMap[k] = [];
-        }
-        otherVersionsMap[k].push(version);
-    });
-
-    return sources.map((s) => ({
-        ...s,
-        versions: s.key ? otherVersionsMap[keyGetMain(s.key)] || [] : [],
-    }));
-};
-
-const router = Router();
-
-export const getSourcesEntries = defineCachedFunction(async (
-    db: Database,
-    isGranted: Request['isGranted'],
-    locale: string,
-    pronounsFilter: string | undefined,
-) => {
-    const sql = SQL`
-        SELECT s.*, u.username AS submitter FROM sources s
-        LEFT JOIN users u ON s.submitter_id = u.id
-        WHERE s.locale = ${locale}
-        AND s.deleted = 0
-        AND s.approved >= ${isGranted('sources') ? 0 : 1}
-    `;
-    if (pronounsFilter) {
-        sql.append(SQL`AND s.pronouns LIKE ${`%${pronounsFilter}%`}`);
-    }
-    return await linkOtherVersions(db, isGranted, locale, await db.all(sql));
-}, {
-    name: 'sources',
-    getKey: (db, isGranted, locale, pronounsFilter) => {
-        return pronounsFilter ? `${locale}:pronouns:${pronounsFilter}` : `${locale}:default`;
-    },
-    shouldBypassCache: (db, isGranted) => isGranted('sources'),
-    maxAge: 24 * 60 * 60,
-});
-
-router.get('/sources', handleErrorAsync(async (req, res) => {
-    const locale = getLocale(getH3Event(req));
-    const pronounsFilter = req.query.pronoun as string | undefined;
-    return res.json(await getSourcesEntries(req.db, req.isGranted, locale, pronounsFilter));
-}));
-
-router.post('/sources/submit', handleErrorAsync(async (req, res) => {
-    if (!req.user || !await req.isUserAllowedToPost()) {
-        return res.status(401).json({ error: 'Unauthorised' });
-    }
-
-    const locale = getLocale(getH3Event(req));
-
-    const id = ulid();
-    await req.db.get(SQL`
-        INSERT INTO sources (id, locale, pronouns, type, author, title, extra, year, fragments, comment, link, key, images, spoiler, submitter_id, base_id)
-        VALUES (
-            ${id}, ${locale}, ${req.body.pronouns.join(';')},
-            ${req.body.type}, ${req.body.author}, ${req.body.title}, ${req.body.extra}, ${req.body.year},
-            ${req.body.fragments.join('@').replace(/\n/g, '|')}, ${req.body.comment}, ${req.body.link},
-            ${clearKey(req.body.key)}, ${req.body.images ? req.body.images.join(',') : null}, ${req.body.spoiler ? 1 : 0},
-            ${req.user ? req.user.id : null}, ${req.body.base}
-        )
-    `);
-    await auditLog(req, 'sources/submitted', { ...req.body });
-
-    if (req.isGranted('sources')) {
-        await approve(req.db, id, locale);
-        await auditLog(req, 'sources/approved', { id });
-    }
-
-    return res.json('ok');
-}));
-
-router.post('/sources/hide/:id', handleErrorAsync(async (req, res) => {
-    if (!req.isGranted('sources')) {
-        return res.status(401).json({ error: 'Unauthorised' });
-    }
-
-    await req.db.get(SQL`
-        UPDATE sources
-        SET approved = 0
-        WHERE id = ${req.params.id}
-    `);
-
-    await invalidateCacheKind('sources', getLocale(getH3Event(req)));
-
-    await auditLog(req, 'sources/hidden', { id: req.params.id });
-
-    return res.json('ok');
-}));
-
-router.post('/sources/approve/:id', handleErrorAsync(async (req, res) => {
-    if (!req.isGranted('sources')) {
-        return res.status(401).json({ error: 'Unauthorised' });
-    }
-
-    await approve(req.db, req.params.id, getLocale(getH3Event(req)));
-
-    await auditLog(req, 'sources/approved', { id: req.params.id });
-
-    return res.json('ok');
-}));
-
-router.post('/sources/remove/:id', handleErrorAsync(async (req, res) => {
-    if (!req.isGranted('sources')) {
-        return res.status(401).json({ error: 'Unauthorised' });
-    }
-
-    await req.db.get(SQL`
-        UPDATE sources
-        SET deleted=1
-        WHERE id = ${req.params.id}
-    `);
-
-    await invalidateCacheKind('sources', getLocale(getH3Event(req)));
-
-    await auditLog(req, 'sources/removed', { id: req.params.id });
-
-    return res.json('ok');
-}));
-
-router.get('/sources/keys', handleErrorAsync(async (req, res) => {
-    const keys = await req.db.all<{ key: string }>(SQL`
-        SELECT trim(key) AS key
-        FROM sources
-        WHERE key IS NOT NULL
-          AND deleted = 0
-          AND approved = 1
-        GROUP BY key
-        ORDER BY key
-    `);
-
-    return res.json(
-        Object.fromEntries(keys.map((k) => [k.key, k.key])),
-    );
-}));
-
-router.get('/sources/:id', handleErrorAsync(async (req, res) => {
-    const locale = getLocale(getH3Event(req));
-
-    return res.json(await linkOtherVersions(req.db, req.isGranted, locale, await req.db.all(SQL`
-        SELECT s.*, u.username AS submitter FROM sources s
-        LEFT JOIN users u ON s.submitter_id = u.id
-        WHERE s.locale = ${locale}
-        AND s.deleted = 0
-        AND s.approved >= ${req.isGranted('sources') ? 0 : 1}
-        AND s.id = ${req.params.id}
-    `)));
-}));
-
-export default router;
diff --git a/server/index.ts b/server/index.ts
index 9ba40b266..7ea565df1 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -27,7 +27,6 @@ import namesRoute from './express/names.ts';
 import profileRoute from './express/profile.ts';
 import pronounceRoute from './express/pronounce.ts';
 import sentryRoute from './express/sentry.ts';
-import sourcesRoute from './express/sources.ts';
 import subscriptionRoute from './express/subscription.ts';
 import termsRoute from './express/terms.ts';
 import translationsRoute from './express/translations.ts';
@@ -160,7 +159,6 @@ router.use(userRoute);
 router.use(profileRoute);
 router.use(adminRoute);
 router.use(mfaRoute);
-router.use(sourcesRoute);
 router.use(inclusiveRoute);
 router.use(termsRoute);
 router.use(pronounceRoute);
diff --git a/server/nouns.ts b/server/nouns.ts
index fc3bfc32e..bb7902067 100644
--- a/server/nouns.ts
+++ b/server/nouns.ts
@@ -1,8 +1,8 @@
 import SQL from 'sql-template-strings';
 
 import type { Database } from '~/server/db.ts';
-import type { SourceRow } from '~/server/express/sources.ts';
 import type { UserRow } from '~/server/express/user.ts';
+import type { SourceRow } from '~/server/sources.ts';
 import type { IsGrantedFn } from '~/server/utils/useAuthentication.ts';
 import { clearKey } from '~/src/helpers.ts';
 import type { User } from '~/src/user.ts';
diff --git a/server/sources.ts b/server/sources.ts
new file mode 100644
index 000000000..999be60b0
--- /dev/null
+++ b/server/sources.ts
@@ -0,0 +1,110 @@
+import SQL from 'sql-template-strings';
+
+import type { Database } from '~/server/db.ts';
+import type { SourceType } from '~/src/classes.ts';
+import { clearKey } from '~/src/helpers.ts';
+
+export interface SourceRow {
+    id: string;
+    locale: string;
+    pronouns: string;
+    type: SourceType;
+    author: string | null;
+    title: string;
+    extra: string | null;
+    year: number | null;
+    fragments: string;
+    comment: string | null;
+    link: string | null;
+    submitter_id: string | null;
+    approved: boolean;
+    deleted: number | null;
+    base_id: string | null;
+    key: string | null;
+    images: string | null;
+    spoiler: boolean;
+}
+
+const keyGetMain = (key: string): string => {
+    return key.split('/')[0];
+};
+
+export const linkOtherVersions = async (
+    db: Database,
+    isGranted: IsGrantedFn,
+    locale: string,
+    sources: SourceRow[],
+) => {
+    const keys = new Set(sources.filter((s) => !!s && s.key).map((s) => keyGetMain(clearKey(s.key)!)));
+
+    let sql = SQL`
+        SELECT s.*, u.username AS submitter FROM sources s
+        LEFT JOIN users u ON s.submitter_id = u.id
+        WHERE s.locale != ${locale}
+        AND s.deleted = 0
+        AND s.approved >= ${isGranted('sources') ? 0 : 1}
+        AND (`;
+    for (const key of keys) {
+        sql = sql.append(SQL`s.key = ${key} OR s.key LIKE ${`${key}/%`} OR `);
+    }
+    sql = sql.append(SQL`0=1)`);
+
+    const otherVersions = await db.all<SourceRow>(sql);
+
+    const otherVersionsMap: Record<string, SourceRow[]> = {};
+    otherVersions.forEach((version) => {
+        const k = keyGetMain(version.key!);
+        if (otherVersionsMap[k] === undefined) {
+            otherVersionsMap[k] = [];
+        }
+        otherVersionsMap[k].push(version);
+    });
+
+    return sources.map((s) => ({
+        ...s,
+        versions: s.key ? otherVersionsMap[keyGetMain(s.key)] || [] : [],
+    }));
+};
+
+export const getSourcesEntries = defineCachedFunction(async (
+    db: Database,
+    isGranted: IsGrantedFn,
+    locale: string,
+    pronounsFilter: string | undefined,
+) => {
+    const sql = SQL`
+        SELECT s.*, u.username AS submitter FROM sources s
+        LEFT JOIN users u ON s.submitter_id = u.id
+        WHERE s.locale = ${locale}
+        AND s.deleted = 0
+        AND s.approved >= ${isGranted('sources') ? 0 : 1}
+    `;
+    if (pronounsFilter) {
+        sql.append(SQL`AND s.pronouns LIKE ${`%${pronounsFilter}%`}`);
+    }
+    return await linkOtherVersions(db, isGranted, locale, await db.all(sql));
+}, {
+    name: 'sources',
+    getKey: (db, isGranted, locale, pronounsFilter) => {
+        return pronounsFilter ? `${locale}:pronouns:${pronounsFilter}` : `${locale}:default`;
+    },
+    shouldBypassCache: (db, isGranted) => isGranted('sources'),
+    maxAge: 24 * 60 * 60,
+});
+
+export const approveSourceEntry = async (db: Database, id: string, locale: string) => {
+    const { base_id } = (await db.get<Pick<SourceRow, 'base_id'>>(SQL`SELECT base_id FROM sources WHERE id=${id}`))!;
+    if (base_id) {
+        await db.get(SQL`
+            UPDATE sources
+            SET deleted=1
+            WHERE id = ${base_id}
+        `);
+    }
+    await db.get(SQL`
+        UPDATE sources
+        SET approved = 1, base_id = NULL
+        WHERE id = ${id}
+    `);
+    await invalidateCacheKind('sources', locale);
+};