Merge pull request 'Alpha 7' (#22 ) from alpha-7 into main

Reviewed-on: #22
Add bookmark item search (#15 )
2024-05-26 21:33:12 +00:00 · 2024-05-26 16:56:30 -04:00 · 2024-05-26 14:18:20 -04:00 · 2024-05-25 23:03:39 -04:00 · 2024-05-25 12:31:48 -04:00 · 2024-05-23 23:02:07 -04:00
33 changed files with 1951 additions and 415 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 .idea
 src/data/*.db
+src/user-config.php
--- a/INSTALLING.md
+++ b/INSTALLING.md
@@ -17,7 +17,7 @@ _(More environments will be detailed as part of a later release; an nginx revers

 ## PHP Requirements

-This is written to target PHP 8.3, and requires the `curl`, `DOM`, and `SQLite3` modules. _(FrankenPHP contains these modules as part of its build.)_
+This is written to target PHP 8.3, and requires the `curl`, `DOM`, and `SQLite3` modules and the `php-cli` feature. _(FrankenPHP contains all these as part of its build.)_

 # Setup and Configuration

@@ -27,14 +27,14 @@ The default `Caddyfile` will run the site at `http://localhost:8205`. To have th

 ## Feed Reader Central Behavior

-Within the `/src` directory, there is a file named `user-config.php`. This file is the place for customizations and configuration of the instance's behavior.
+Within the `/src` directory, there is a file named `user-config.dist.php`. Rename this file to `user-config.php`; this is where customizations and configuration of the instance's behavior are placed.

 ### Security Model

-There ~~are~~ will be three supported security models, designed around different ways the software may be deployed.
+There are three supported security models, designed around different ways the software may be deployed. `SECURITY_MODEL` in `user-config.php` **must be set** to one of these values. 
 - `Securty::SINGLE_USER` assumes that all connections to the instance are the same person. There is no password required, and no username or e-mail address will be displayed for that user. This is a good setup for a single user on a home intranet. **DO NOT PUT AN INSTANCE WITH THIS CONFIGURATION ON THE PUBLIC INTERNET!** If you do, you deserve what you get.
- `Security::SINGLE_USER_WITH_PASSWORD` _(not yet implemented)_ will be the same as the above, but will require a password. This setup is ideal for intranets where the user does not want any other users ending up marking their feeds as read just by browsing them.
- `Security::MULTI_USER` _(not yet implemented)_ will require a known e-mail address and password be provided to establish the identity of each user. This will be the most appropriate setup for an Internet-facing instance, even if there is only one user.
+- `Security::SINGLE_USER_WITH_PASSWORD` is the same as the above but requires a password. This setup is ideal for intranets where the user does not want any other users ending up marking their feeds as read just by browsing them.
+- `Security::MULTI_USER` requires a known e-mail address and password be provided to establish the identity of each user. This is the most appropriate setup for an Internet-facing instance, even if there is only one user.

 ### Database Name

@@ -43,3 +43,12 @@ Data is stored under the `/src/data` directory, and the default database name is
 ### Date/Time Format

 The default format for dates and times look like "May 28, 2023 at 3:15pm". Changing the string there will alter the display on the main page and when reading an item. Any [supported PHP date or time token](https://www.php.net/manual/en/datetime.format.php) is supported.
+
+### Item Purging
+
+Feed Reader Central tries to keep the database tidy by purging items that have been read and are no longer required. There are four variants:
+- `Feed::PURGE_NONE` does no purging (items have a "Delete" button, so they may be deleted manually) 
+- `Feed::PURGE_READ` purges non-bookmarked read items for a feed whenever it is refreshed. This is the most aggressive purging strategy, but it is also the only one that will not purge unread items.
+- `Feed::PURGE_BY_DAYS` purges non-bookmarked items that are older than `PURGE_NUMBER` days old. This is the default value, and `PURGE_NUMBER`'s default value is 30; items will be kept for 30 days, read or unread.
+- `Feed::PURGE_BY_COUNT` purges items to preserve at most `PURGE_NUMBER` non-bookmarked items for each feed.
+ 
--- a/src/app-config.php
+++ b/src/app-config.php
@@ -0,0 +1,34 @@
+<?php
+
+/** The current Feed Reader Central version */
+const FRC_VERSION = '1.0.0-alpha7';
+
+spl_autoload_register(function ($class) {
+    $file = implode(DIRECTORY_SEPARATOR, [__DIR__, 'lib', "$class.php"]);
+    if (file_exists($file)) {
+        require $file;
+        return true;
+    }
+    return false;
+});
+
+require 'user-config.php';
+
+Data::ensureDb();
+
+/** @var string The date the world wide web was created */
+const WWW_EPOCH = '1993-04-30T00:00:00+00:00';
+
+/**
+ * Capitalize the first letter of the given string
+ *
+ * @param string $value The string to be capitalized
+ * @return string The given string with the first letter capitalized
+ */
+function init_cap(string $value): string {
+    return match (strlen($value)) {
+        0       => "",
+        1       => strtoupper($value),
+        default => strtoupper(substr($value, 0, 1)) . substr($value, 1),
+    };
+}
--- a/src/cli-start.php
+++ b/src/cli-start.php
@@ -0,0 +1,30 @@
+<?php
+require 'app-config.php';
+
+if (php_sapi_name() != 'cli') {
+    http_response_code(404);
+    die('Not Found');
+}
+
+/**
+ * Print a line with a newline character at the end (printf + newline = printfn; surprised this isn't built in!)
+ *
+ * @param string $format The format string
+ * @param mixed ...$values The values for the placeholders in the string
+ */
+function printfn(string $format, mixed ...$values): void {
+    printf($format . PHP_EOL, ...$values);
+}
+
+/**
+ * Display a title for a CLI run
+ *
+ * @param string $title The title to display on the command line
+ */
+function cli_title(string $title): void {
+    $appTitle = 'Feed Reader Central ~ v' . FRC_VERSION;
+    $dashes   = '  +' . str_repeat('-', strlen($title) + 2) . '+' . str_repeat('-', strlen($appTitle) + 2) . '+';
+    printfn($dashes);
+    printfn('  | %s | %s |', $title, $appTitle);
+    printfn($dashes . PHP_EOL);
+}
--- a/src/lib/Data.php
+++ b/src/lib/Data.php
@@ -9,11 +9,36 @@ class Data {
     * @return SQLite3 A new connection to the database
     */
    public static function getConnection(): SQLite3 {
-        $db = new SQLite3('../data/' . DATABASE_NAME);
+        $db = new SQLite3(implode(DIRECTORY_SEPARATOR, [__DIR__, '..', 'data', DATABASE_NAME]));
        $db->exec('PRAGMA foreign_keys = ON;');
        return $db;
    }

+    /**
+     * Create the search index and synchronization triggers for the item table
+     *
+     * @param SQLite3 $db The database connection on which these will be created
+     */
+    public static function createSearchIndex(SQLite3 $db): void {
+        $db->exec("CREATE VIRTUAL TABLE item_search USING fts5(content, content='item', content_rowid='id')");
+        $db->exec(<<<'SQL'
+                CREATE TRIGGER item_ai AFTER INSERT ON item BEGIN
+                    INSERT INTO item_search (rowid, content) VALUES (new.id, new.content);
+                END;
+                SQL);
+        $db->exec(<<<'SQL'
+                CREATE TRIGGER item_au AFTER UPDATE ON item BEGIN
+                    INSERT INTO item_search (item_search, rowid, content) VALUES ('delete', old.id, old.content);
+                    INSERT INTO item_search (rowid, content) VALUES (new.id, new.content);
+                END;
+                SQL);
+        $db->exec(<<<'SQL'
+                CREATE TRIGGER item_ad AFTER DELETE ON item BEGIN
+                    INSERT INTO item_search (item_search, rowid, content) VALUES ('delete', old.id, old.content);
+                END;
+                SQL);
+    }
+
    /**
     * Make sure the expected tables exist
     */
@@ -23,17 +48,16 @@ class Data {
        $tableQuery = $db->query("SELECT name FROM sqlite_master WHERE type = 'table'");
        while ($table = $tableQuery->fetchArray(SQLITE3_NUM)) $tables[] = $table[0];
        if (!in_array('frc_user', $tables)) {
-            $query = <<<'SQL'
+            $db->exec(<<<'SQL'
                CREATE TABLE frc_user (
                    id       INTEGER NOT NULL PRIMARY KEY,
                    email    TEXT    NOT NULL,
                    password TEXT    NOT NULL)
-                SQL;
-            $db->exec($query);
+                SQL);
            $db->exec('CREATE INDEX idx_user_email ON frc_user (email)');
        }
        if (!in_array('feed', $tables)) {
-            $query = <<<'SQL'
+            $db->exec(<<<'SQL'
                CREATE TABLE feed (
                    id         INTEGER NOT NULL PRIMARY KEY,
                    user_id    INTEGER NOT NULL,
@@ -42,11 +66,10 @@ class Data {
                    updated_on TEXT,
                    checked_on TEXT,
                    FOREIGN KEY (user_id) REFERENCES frc_user (id))
-                SQL;
-            $db->exec($query);
+                SQL);
        }
        if (!in_array('item', $tables)) {
-            $query = <<<'SQL'
+            $db->exec(<<<'SQL'
                CREATE TABLE item (
                    id            INTEGER NOT NULL PRIMARY KEY,
                    feed_id       INTEGER NOT NULL,
@@ -59,53 +82,12 @@ class Data {
                    is_read       BOOLEAN NOT NULL DEFAULT 0,
                    is_bookmarked BOOLEAN NOT NULL DEFAULT 0,
                    FOREIGN KEY (feed_id) REFERENCES feed (id))
-                SQL;
-            $db->exec($query);
+                SQL);
+            self::createSearchIndex($db);
        }
        $db->close();
    }

-    /**
-     * Find a user by their ID
-     *
-     * @param string $email The e-mail address of the user to retrieve
-     * @return array|null The user information, or null if the user is not found
-     */
-    public static function findUserByEmail(string $email): ?array {
-        $db = self::getConnection();
-        try {
-            $query = $db->prepare('SELECT * FROM frc_user WHERE email = :email');
-            $query->bindValue(':email', $email);
-            $result = $query->execute();
-            if ($result) {
-                $user = $result->fetchArray(SQLITE3_ASSOC);
-                if ($user) return $user;
-                return null;
-            }
-            return null;
-        } finally {
-            $db->close();
-        }
-    }
-
-    /**
-     * Add a user
-     *
-     * @param string $email The e-mail address for the user
-     * @param string $password The user's password
-     */
-    public static function addUser(string $email, string $password): void {
-        $db = self::getConnection();
-        try {
-            $query = $db->prepare('INSERT INTO frc_user (email, password) VALUES (:email, :password)');
-            $query->bindValue(':email', $email);
-            $query->bindValue(':password', password_hash($password, PASSWORD_DEFAULT));
-            $query->execute();
-        } finally {
-            $db->close();
-        }
-    }
-
    /**
     * Parse/format a date/time from a string
     *
@@ -121,22 +103,12 @@ class Data {
    }

    /**
-     * Retrieve a feed by its ID for the current user
+     * Return the last SQLite error message as a result array
     *
-     * @param int $feedId The ID of the feed to retrieve
-     * @param ?SQLite3 $dbConn A database connection to use (optional; will use standalone if not provided)
-     * @return array|bool The data for the feed if found, false if not found
+     * @param SQLite3 $db The database connection on which the error has occurred
+     * @return string[] ['error' => message] for last SQLite error message
     */
-    public static function retrieveFeedById(int $feedId, ?SQLite3 $dbConn = null): array|bool {
-        $db = $dbConn ?? self::getConnection();
-        try {
-            $query = $db->prepare('SELECT * FROM feed WHERE id = :id AND user_id = :user');
-            $query->bindValue(':id', $feedId);
-            $query->bindValue(':user', $_REQUEST[Key::USER_ID]);
-            $result = $query->execute();
-            return $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
-        } finally {
-            if (is_null($dbConn)) $db->close();
-        }
+    public static function error(SQLite3 $db): array {
+        return ['error' => 'SQLite error: ' . $db->lastErrorMsg()];
    }
 }
--- a/src/lib/Feed.php
+++ b/src/lib/Feed.php
@@ -1,15 +1,47 @@
 <?php
+
 /**
 * Feed retrieval, parsing, and manipulation
 */
 class Feed {

+    /** @var string The URL for the feed */
+    public string $url = '';
+
+    /** @var string The title of the feed */
+    public string $title = '';
+
+    /** @var ?string When the feed was last updated */
+    public ?string $updatedOn = null;
+
+    /** @var FeedItem[] The items contained in the feed */
+    public array $items = [];
+
    /** @var string The XML namespace for Atom feeds */
    public const string ATOM_NS = 'http://www.w3.org/2005/Atom';

    /** @var string The XML namespace for the `<content:encoded>` tag that allows HTML content in a feed */
    public const string CONTENT_NS = 'http://purl.org/rss/1.0/modules/content/';

+    /** @var string The XML namespace for XHTML */
+    public const string XHTML_NS = 'http://www.w3.org/1999/xhtml';
+
+    /** @var string The user agent for Feed Reader Central's refresh requests */
+    private const string USER_AGENT =
+        'FeedReaderCentral/' . FRC_VERSION . ' +https://bitbadger.solutions/open-source/feed-reader-central';
+
+    /** @var int Do not purge items */
+    public const int PURGE_NONE = 0;
+
+    /** @var int Purge all read items (will not purge unread items) */
+    public const int PURGE_READ = 1;
+
+    /** @var int Purge items older than the specified number of days */
+    public const int PURGE_BY_DAYS = 2;
+
+    /** @var int Purge items in number greater than the specified number of items to keep */
+    public const int PURGE_BY_COUNT = 3;
+
    /**
     * When parsing XML into a DOMDocument, errors are presented as warnings; this creates an exception for them
     *
@@ -19,7 +51,7 @@ class Feed {
     * @throws DOMException If the error is a warning
     */
    private static function xmlParseError(int $errno, string $errstr): bool {
-        if ($errno == E_WARNING && substr_count($errstr, 'DOMDocument::loadXml()') > 0) {
+        if ($errno == E_WARNING && substr_count($errstr, 'DOMDocument::loadXML()') > 0) {
            throw new DOMException($errstr, $errno);
        }
        return false;
@@ -45,102 +77,196 @@ class Feed {
    }

    /**
-     * Get the value of a child element by its tag name
+     * Get the value of a child element by its tag name for an RSS feed
     *
-     * @param DOMElement $element The parent element
+     * @param DOMNode $element The parent element
     * @param string $tagName The name of the tag whose value should be obtained
     * @return string The value of the element (or "[element] not found" if that element does not exist)
     */
-    private static function eltValue(DOMElement $element, string $tagName): string {
+    public static function rssValue(DOMNode $element, string $tagName): string {
        $tags = $element->getElementsByTagName($tagName);
        return $tags->length == 0 ? "$tagName not found" : $tags->item(0)->textContent;
    }

    /**
-     * Retrieve the feed
+     * Extract items from an RSS feed
     *
-     * @param string $url
-     * @return array|DOMDocument[]|string[]|DOMElement[]
-     *      ['ok' => feedXml, 'url' => actualUrl, 'channel' => channel, 'updated' => updatedDate] if successful,
-     *      ['error' => message] if not
+     * @param DOMDocument $xml The XML received from the feed
+     * @param string $url The actual URL for the feed
+     * @return array|Feed[]|string[] ['ok' => feed] if successful, ['error' => message] if not
     */
-    public static function retrieveFeed(string $url): array {
-        $feedReq = curl_init($url);
-        curl_setopt($feedReq, CURLOPT_FOLLOWLOCATION, true);
-        curl_setopt($feedReq, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($feedReq, CURLOPT_CONNECTTIMEOUT, 5);
-        curl_setopt($feedReq, CURLOPT_TIMEOUT,        15);
-
-        $feedContent = curl_exec($feedReq);
-
-        $result = array();
-        $error  = curl_error($feedReq);
-        $code   = curl_getinfo($feedReq, CURLINFO_RESPONSE_CODE);
-        if ($error) {
-            $result['error'] = $error;
-        } else if ($code == 200) {
-            $parsed = self::parseFeed($feedContent);
-            if (array_key_exists('error', $parsed)) {
-                $result['error'] = $parsed['error'];
-            } else {
-                $result['ok']  = $parsed['ok'];
-                $result['url'] = curl_getinfo($feedReq, CURLINFO_EFFECTIVE_URL);
-
-                $channel = $result['ok']->getElementsByTagName('channel')->item(0);
-                if ($channel instanceof DOMElement) {
-                    $result['channel'] = $channel;
-                } else {
-                    return ['error' => "Channel element not found ($channel->nodeType)"];
+    private static function fromRSS(DOMDocument $xml, string $url): array {
+        $channel = $xml->getElementsByTagName('channel')->item(0);
+        if (!($channel instanceof DOMElement)) {
+            $type = $channel?->nodeType ?? -1;
+            return ['error' => "Channel element not found ($type)"];
        }

-                // In Atom feeds, lastBuildDate contains the last time an item in the feed was updated; if that is not
-                // present, use the pubDate element instead
-                $updated = self::eltValue($channel, 'lastBuildDate');
-                if ($updated == 'lastBuildDate not found') {
-                    $updated = self::eltValue($channel, 'pubDate');
-                    if ($updated == 'pubDate not found') $updated = null;
+        // The Atom namespace provides a lastBuildDate, which contains the last time an item in the feed was updated; if
+        // that is not present, use the pubDate element instead
+        if (($updatedOn = self::rssValue($channel, 'lastBuildDate')) == 'lastBuildDate not found') {
+            if (($updatedOn = self::rssValue($channel, 'pubDate')) == 'pubDate not found') {
+                $updatedOn = null;
            }
-                $result['updated'] = Data::formatDate($updated);
-                return $result;
-
-            }
-        } else {
-            $result['error'] = "Prospective feed URL $url returned HTTP Code $code: $feedContent";
        }

-        curl_close($feedReq);
+        $feed            = new Feed();
+        $feed->title     = self::rssValue($channel, 'title');
+        $feed->url       = $url;
+        $feed->updatedOn = Data::formatDate($updatedOn);
+        foreach ($channel->getElementsByTagName('item') as $item) $feed->items[] = FeedItem::fromRSS($item);
+
+        return ['ok' => $feed];
+    }
+
+    /**
+     * Get an attribute value from a DOM node
+     *
+     * @param DOMNode $node The node with an attribute value to obtain
+     * @param string $name The name of the attribute whose value should be obtained
+     * @return string The attribute value if it exists, an empty string if not
+     */
+    private static function attrValue(DOMNode $node, string $name): string {
+        return ($node->hasAttributes() ? $node->attributes->getNamedItem($name)?->value : null) ?? '';
+
+    }
+    /**
+     * Get the value of a child element by its tag name for an Atom feed
+     *
+     * (Atom feeds can have type attributes on nearly any value. For our purposes, types "text" and "html" will work as
+     * regular string values; for "xhtml", though, we will need to get the `<div>` and extract its contents instead.)
+     *
+     * @param DOMNode $element The parent element
+     * @param string $tagName The name of the tag whose value should be obtained
+     * @return string The value of the element (or "[element] not found" if that element does not exist)
+     */
+    public static function atomValue(DOMNode $element, string $tagName): string {
+        $tags = $element->getElementsByTagName($tagName);
+        if ($tags->length == 0) return "$tagName not found";
+        $tag = $tags->item(0);
+        if (!($tag instanceof DOMElement)) return $tag->textContent;
+        if (self::attrValue($tag, 'type') == 'xhtml') {
+            $div = $tag->getElementsByTagNameNS(Feed::XHTML_NS, 'div');
+            if ($div->length == 0) return "-- invalid XHTML content --";
+            return $div->item(0)->textContent;
+        }
+        return $tag->textContent;
+    }
+
+    /**
+     * Extract items from an Atom feed
+     *
+     * @param DOMDocument $xml The XML received from the feed
+     * @param string $url The actual URL for the feed
+     * @return array|Feed[] ['ok' => feed]
+     */
+    private static function fromAtom(DOMDocument $xml, string $url): array {
+        $root = $xml->getElementsByTagNameNS(self::ATOM_NS, 'feed')->item(0);
+        if (($updatedOn = self::atomValue($root, 'updated')) == 'pubDate not found') $updatedOn = null;
+
+        $feed            = new Feed();
+        $feed->title     = self::atomValue($root, 'title');
+        $feed->url       = $url;
+        $feed->updatedOn = Data::formatDate($updatedOn);
+        foreach ($root->getElementsByTagName('entry') as $entry) $feed->items[] = FeedItem::fromAtom($entry);
+
+        return ['ok' => $feed];
+    }
+
+    /**
+     * Retrieve a document (http/https)
+     *
+     * @param string $url The URL of the document to retrieve
+     * @return array ['content' => document content, 'error' => error message, 'code' => HTTP response code,
+     *      'url' => effective URL]
+     */
+    private static function retrieveDocument(string $url): array {
+        $docReq = curl_init($url);
+        curl_setopt($docReq, CURLOPT_FOLLOWLOCATION, true);
+        curl_setopt($docReq, CURLOPT_RETURNTRANSFER, true);
+        curl_setopt($docReq, CURLOPT_CONNECTTIMEOUT, 5);
+        curl_setopt($docReq, CURLOPT_TIMEOUT,        15);
+        curl_setopt($docReq, CURLOPT_USERAGENT,      self::USER_AGENT);
+
+        $result = [
+            'content' => curl_exec($docReq),
+            'error'   => curl_error($docReq),
+            'code'    => curl_getinfo($docReq, CURLINFO_RESPONSE_CODE),
+            'url'     => curl_getinfo($docReq, CURLINFO_EFFECTIVE_URL)
+        ];
+
+        curl_close($docReq);
        return $result;
    }

    /**
-     * Extract the fields we need to keep from the feed
+     * Derive a feed URL from an HTML document
     *
-     * @param DOMElement $item The item from the feed
-     * @return array The fields for the item as an associative array
+     * @param string $content The HTML document content from which to derive a feed URL
+     * @return array|string[] ['ok' => feed URL] if successful, ['error' => message] if not
     */
-    private static function itemFields(DOMElement $item): array {
-        $itemGuid = self::eltValue($item, 'guid');
-        $updNodes = $item->getElementsByTagNameNS(self::ATOM_NS,    'updated');
-        $encNodes = $item->getElementsByTagNameNS(self::CONTENT_NS, 'encoded');
-        return [
-            'guid'      => $itemGuid == 'guid not found' ? self::eltValue($item, 'link') : $itemGuid,
-            'title'     => self::eltValue($item, 'title'),
-            'link'      => self::eltValue($item, 'link'),
-            'published' => Data::formatDate(self::eltValue($item, 'pubDate')),
-            'updated'   => Data::formatDate($updNodes->length > 0 ? $updNodes->item(0)->textContent : null),
-            'content'   => $encNodes->length > 0 ? $encNodes->item(0)->textContent
-                                                 : self::eltValue($item, 'description')
-        ];
+    private static function deriveFeedFromHTML(string $content): array {
+        $html = new DOMDocument();
+        $html->loadHTML(substr($content, 0, strpos($content, '</head>') + 7));
+        $headTags = $html->getElementsByTagName('head');
+        if ($headTags->length < 1) return ['error' => 'Cannot find feed at this URL'];
+        $head = $headTags->item(0);
+        foreach ($head->getElementsByTagName('link') as $link) {
+            if (self::attrValue($link, 'rel') == 'alternate') {
+                $type = self::attrValue($link, 'type');
+                if ($type == 'application/rss+xml' || $type == 'application/atom+xml') {
+                    return ['ok' => self::attrValue($link, 'href')];
+                }
+            }
+        }
+        return ['error' => 'Cannot find feed at this URL'];
+    }
+
+    /**
+     * Retrieve the feed
+     *
+     * @param string $url The URL of the feed to retrieve
+     * @return array|Feed[]|string[] ['ok' => feed] if successful, ['error' => message] if not
+     */
+    public static function retrieveFeed(string $url): array {
+        $doc = self::retrieveDocument($url);
+
+        if ($doc['error'] != '') return ['error' => $doc['error']];
+        if ($doc['code'] != 200) {
+            return ['error' => "Prospective feed URL $url returned HTTP Code {$doc['code']}: {$doc['content']}"];
+        }
+
+        $start = strtolower(strlen($doc['content']) >= 9 ? substr($doc['content'], 0, 9) : $doc['content']);
+        if ($start == '<!doctype' || str_starts_with($start, '<html')) {
+            $derivedURL = self::deriveFeedFromHTML($doc['content']);
+            if (key_exists('error', $derivedURL)) return ['error' => $derivedURL['error']];
+            $feedURL = $derivedURL['ok'];
+            if (!str_starts_with($feedURL, 'http')) {
+                // Relative URL; feed should be retrieved in the context of the original URL
+                $original = parse_url($url);
+                $port     = key_exists('port', $original) ? ":{$original['port']}" : '';
+                $feedURL  = $original['scheme'] . '://' . $original['host'] . $port . $feedURL;
+            }
+            $doc = self::retrieveDocument($feedURL);
+        }
+
+        $parsed = self::parseFeed($doc['content']);
+        if (key_exists('error', $parsed)) return ['error' => $parsed['error']];
+
+        $extract = $parsed['ok']->getElementsByTagNameNS(self::ATOM_NS, 'feed')->length > 0
+            ? self::fromAtom(...) : self::fromRSS(...);
+        return $extract($parsed['ok'], $doc['url']);
    }

    /**
     * Update a feed item
     *
     * @param int $itemId The ID of the item to be updated
-     * @param array $item The fields from the updated item
+     * @param FeedItem $item The item to be updated
     * @param SQLite3 $db A database connection to use for the update
+     * @return bool|SQLite3Result The result if the update is successful, false if it failed
     */
-    private static function updateItem(int $itemId, array $item, SQLite3 $db): void {
+    private static function updateItem(int $itemId, FeedItem $item, SQLite3 $db): bool|SQLite3Result {
        $query = $db->prepare(<<<'SQL'
            UPDATE item
               SET title        = :title,
@@ -150,22 +276,23 @@ class Feed {
                   is_read      = 0
             WHERE id = :id
            SQL);
-        $query->bindValue(':title',     $item['title']);
-        $query->bindValue(':published', $item['published']);
-        $query->bindValue(':updated',   $item['updated']);
-        $query->bindValue(':content',   $item['content']);
+        $query->bindValue(':title',     $item->title);
+        $query->bindValue(':published', $item->publishedOn);
+        $query->bindValue(':updated',   $item->updatedOn);
+        $query->bindValue(':content',   $item->content);
        $query->bindValue(':id',        $itemId);
-        $query->execute();
+        return $query->execute();
    }

    /**
     * Add a feed item
     *
     * @param int $feedId The ID of the feed to which the item should be added
-     * @param array $item The fields for the item
+     * @param FeedItem $item The item to be added
     * @param SQLite3 $db A database connection to use for the addition
+     * @return bool|SQLite3Result The result if the update is successful, false if it failed
     */
-    private static function addItem(int $feedId, array $item, SQLite3 $db): void {
+    private static function addItem(int $feedId, FeedItem $item, SQLite3 $db): bool|SQLite3Result {
        $query = $db->prepare(<<<'SQL'
            INSERT INTO item (
                feed_id, item_guid, item_link, title, published_on, updated_on, content
@@ -174,73 +301,107 @@ class Feed {
            )
            SQL);
        $query->bindValue(':feed',      $feedId);
-        $query->bindValue(':guid',      $item['guid']);
-        $query->bindValue(':link',      $item['link']);
-        $query->bindValue(':title',     $item['title']);
-        $query->bindValue(':published', $item['published']);
-        $query->bindValue(':updated',   $item['updated']);
-        $query->bindValue(':content',   $item['content']);
-        $query->execute();
+        $query->bindValue(':guid',      $item->guid);
+        $query->bindValue(':link',      $item->link);
+        $query->bindValue(':title',     $item->title);
+        $query->bindValue(':published', $item->publishedOn);
+        $query->bindValue(':updated',   $item->updatedOn);
+        $query->bindValue(':content',   $item->content);
+        return $query->execute();
    }

    /**
     * Update a feed's items
     *
     * @param int $feedId The ID of the feed to which these items belong
-     * @param DOMElement $channel The RSS feed items
+     * @param Feed $feed The extracted Atom or RSS feed items
+     * @param DateTimeInterface $lastChecked When this feed was last checked (only new items will be added)
     * @return array ['ok' => true] if successful, ['error' => message] if not
     */
-    public static function updateItems(int $feedId, DOMElement $channel, SQLite3 $db): array {
-        try {
-            foreach ($channel->getElementsByTagName('item') as $rawItem) {
-                $item = self::itemFields($rawItem);
+    public static function updateItems(int $feedId, Feed $feed, DateTimeInterface $lastChecked, SQLite3 $db): array {
+        $results =
+            array_map(function ($item) use ($db, $feedId) {
                $existsQuery = $db->prepare(
                    'SELECT id, published_on, updated_on FROM item WHERE feed_id = :feed AND item_guid = :guid');
                $existsQuery->bindValue(':feed', $feedId);
-                $existsQuery->bindValue(':guid', $item['guid']);
-                $exists = $existsQuery->execute();
-                if ($exists) {
-                    $existing = $exists->fetchArray(SQLITE3_ASSOC);
-                    if ($existing) {
-                        if (   $existing['published_on']     != $item['published']
-                            || $existing['updated_on'] ?? '' != $item['updated'] ?? '') {
-                            self::updateItem($existing['id'], $item, $db);
+                $existsQuery->bindValue(':guid', $item->guid);
+                if ($exists = $existsQuery->execute()) {
+                    if ($existing = $exists->fetchArray(SQLITE3_ASSOC)) {
+                        if (   $existing['published_on']       != $item->publishedOn
+                            || ($existing['updated_on'] ?? '') != ($item->updatedOn ?? '')) {
+                            if (!self::updateItem($existing['id'], $item, $db)) return Data::error($db);
                        }
                    } else {
-                        self::addItem($feedId, $item, $db);
+                        if (!self::addItem($feedId, $item, $db)) return Data::error($db);
                    }
                } else {
-                    throw new Exception($db->lastErrorMsg());
+                    return Data::error($db);
                }
+                return ['ok' => true];
+            }, array_filter($feed->items,
+                fn($it) => date_create_immutable($it->updatedOn ?? $it->publishedOn) >= $lastChecked));
+        $errors = array_map(fn($it) => $it['error'], array_filter($results, fn($it) => array_key_exists('error', $it)));
+        return sizeof($errors) > 0 ? ['error' => implode("\n", $errors)] : ['ok' => true];
    }
+
+    /**
+     * Purge items for a feed
+     *
+     * @param int $feedId The ID of the feed to be purged
+     * @param SQLite3 $db The database connection on which items should be purged
+     * @return array|string[]|true[] ['ok' => true] if purging was successful, ['error' => message] if not
+     */
+    private static function purgeItems(int $feedId, SQLite3 $db): array {
+        if (!array_search(PURGE_TYPE, [self::PURGE_READ, self::PURGE_BY_DAYS, self::PURGE_BY_COUNT])) {
+            return ['error' => 'Unrecognized purge type ' . PURGE_TYPE];
+        }
+
+        try {
+            $sql = match (PURGE_TYPE) {
+                self::PURGE_READ     => 'AND is_read = 1',
+                self::PURGE_BY_DAYS  => 'AND date(coalesce(updated_on, published_on)) < date(:oldest)',
+                self::PURGE_BY_COUNT => 'AND id IN (SELECT id FROM item WHERE feed_id = :feed
+                                         ORDER BY date(coalesce(updated_on, published_on)) DESC
+                                         LIMIT -1 OFFSET :keep)'
+            };
+
+            $purge = $db->prepare("DELETE FROM item WHERE feed_id = :feed AND is_bookmarked = 0 $sql");
+            $purge->bindValue(':feed', $feedId);
+            if (PURGE_TYPE == self::PURGE_BY_DAYS) {
+                $purge->bindValue(':oldest', Data::formatDate('-' . PURGE_NUMBER . ' day'));
+            } elseif (PURGE_TYPE == self::PURGE_BY_COUNT) {
+                $purge->bindValue(':keep', PURGE_NUMBER);
+            }
+            return $purge->execute() ? ['ok' => true] : Data::error($db);
        } catch (Exception $ex) {
            return ['error' => $ex->getMessage()];
        }
-        return ['ok', true];
    }

    /**
     * Refresh a feed
     *
+     * @param int $feedId The ID of the feed to be refreshed
     * @param string $url The URL of the feed to be refreshed
     * @param SQLite3 $db A database connection to use to refresh the feed
     * @return array|string[]|true[] ['ok' => true] if successful, ['error' => message] if not
     */
-    private static function refreshFeed(string $url, SQLite3 $db): array {
-        $feedQuery = $db->prepare('SELECT id FROM feed WHERE url = :url AND user_id = :user');
-        $feedQuery->bindValue(':url',  $url);
-        $feedQuery->bindValue(':user', $_REQUEST[Key::USER_ID]);
-        $feedResult = $feedQuery->execute();
-        $feedId = $feedResult ? $feedResult->fetchArray(SQLITE3_NUM)[0] : -1;
-        if ($feedId < 0) return ['error' => "No feed for URL $url found"];
+    public static function refreshFeed(int $feedId, string $url, SQLite3 $db): array {
+        $feedRetrieval = self::retrieveFeed($url);
+        if (key_exists('error', $feedRetrieval)) return $feedRetrieval;
+        $feed = $feedRetrieval['ok'];

-        $feed = self::retrieveFeed($url);
-        if (array_key_exists('error', $feed)) return $feed;
+        $lastCheckedQuery = $db->prepare('SELECT checked_on FROM feed where id = :id');
+        $lastCheckedQuery->bindValue(':id', $feedId);
+        if (!($lastCheckedResult = $lastCheckedQuery->execute())) return Data::error($db);
+        if (!($lastChecked = date_create_immutable($lastCheckedResult->fetchArray(SQLITE3_NUM)[0] ?? WWW_EPOCH))) {
+            return ['error' => 'Could not derive date last checked for feed'];
+        }

-        $itemUpdate = self::updateItems($feedId, $feed['channel'], $db);
-        if (array_key_exists('error', $itemUpdate)) return $itemUpdate;
+        $itemUpdate = self::updateItems($feedId, $feed, $lastChecked, $db);
+        if (key_exists('error', $itemUpdate)) return $itemUpdate;

-        $urlUpdate = $url == $feed['url'] ? '' : ', url = :url';
+        $urlUpdate = $url == $feed->url ? '' : ', url = :url';
        $feedUpdate = $db->prepare(<<<SQL
            UPDATE feed
               SET title      = :title,
@@ -249,14 +410,14 @@ class Feed {
                   $urlUpdate
             WHERE id = :id
            SQL);
-        $feedUpdate->bindValue(':title',   self::eltValue($feed['channel'], 'title'));
-        $feedUpdate->bindValue(':updated', $feed['updated']);
+        $feedUpdate->bindValue(':title',   $feed->title);
+        $feedUpdate->bindValue(':updated', $feed->updatedOn);
        $feedUpdate->bindValue(':checked', Data::formatDate('now'));
        $feedUpdate->bindValue(':id',      $feedId);
-        if ($urlUpdate != '') $feedUpdate->bindValue(':url', $feed['url']);
-        $feedUpdate->execute();
+        if ($urlUpdate != '') $feedUpdate->bindValue(':url', $feed->url);
+        if (!$feedUpdate->execute()) return Data::error($db);

-        return ['ok' => true];
+        return PURGE_TYPE == self::PURGE_NONE ? ['ok' => true] : self::purgeItems($feedId, $db);
    }

    /**
@@ -266,25 +427,34 @@ class Feed {
     * @return array ['ok' => feedId] if successful, ['error' => message] if not
     */
    public static function add(string $url, SQLite3 $db): array {
-        $feed = self::retrieveFeed($url);
-        if (array_key_exists('error', $feed)) return $feed;
+        $feedExtract = self::retrieveFeed($url);
+        if (key_exists('error', $feedExtract)) return $feedExtract;
+
+        $feed = $feedExtract['ok'];
+
+        $existsQuery = $db->prepare('SELECT COUNT(*) FROM feed WHERE user_id = :user AND url = :url');
+        $existsQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
+        $existsQuery->bindValue(':url',  $feed->url);
+        if (!($exists = $existsQuery->execute()))    return Data::error($db);
+        if ($exists->fetchArray(SQLITE3_NUM)[0] > 0) return ['error' => "Already subscribed to feed $feed->url"];

        $query = $db->prepare(<<<'SQL'
-            INSERT INTO feed (user_id, url, title, updated_on, checked_on)
-            VALUES (:user, :url, :title, :updated, :checked)
+            INSERT INTO feed (
+                user_id, url, title, updated_on, checked_on
+            ) VALUES (
+                :user, :url, :title, :updated, :checked
+            )
            SQL);
-        $query->bindValue(':user',    $_REQUEST[Key::USER_ID]);
-        $query->bindValue(':url',     $feed['url']);
-        $query->bindValue(':title',   self::eltValue($feed['channel'], 'title'));
-        $query->bindValue(':updated', $feed['updated']);
+        $query->bindValue(':user',    $_SESSION[Key::USER_ID]);
+        $query->bindValue(':url',     $feed->url);
+        $query->bindValue(':title',   $feed->title);
+        $query->bindValue(':updated', $feed->updatedOn);
        $query->bindValue(':checked', Data::formatDate('now'));
-        $result = $query->execute();
+        if (!$query->execute()) return Data::error($db);

-        $feedId = $result ? $db->lastInsertRowID() : -1;
-        if ($feedId < 0) return ['error' => $db->lastErrorMsg()];
-
-        $result = self::updateItems($feedId, $feed['channel'], $db);
-        if (array_key_exists('error', $result)) return $result;
+        $feedId = $db->lastInsertRowID();
+        $result = self::updateItems($feedId, $feed, date_create_immutable(WWW_EPOCH), $db);
+        if (key_exists('error', $result)) return $result;

        return ['ok' => $feedId];
    }
@@ -294,36 +464,68 @@ class Feed {
     *
     * @param array $existing The existing RSS feed
     * @param string $url The URL with which the existing feed should be modified
+     * @param SQLite3 $db The database connection on which to execute the update
     * @return bool[]|string[] [ 'ok' => true ] if successful, [ 'error' => message ] if not
     */
    public static function update(array $existing, string $url, SQLite3 $db): array {
        $query = $db->prepare('UPDATE feed SET url = :url WHERE id = :id AND user_id = :user');
        $query->bindValue(':url',  $url);
        $query->bindValue(':id',   $existing['id']);
-        $query->bindValue(':user', $_REQUEST[Key::USER_ID]);
-        $query->execute();
+        $query->bindValue(':user', $_SESSION[Key::USER_ID]);
+        if (!$query->execute()) return Data::error($db);

-        return self::refreshFeed($url, $db);
+        return self::refreshFeed($existing['id'], $url, $db);
    }

    /**
-     * @param SQLite3 $db
-     * @return array|true[] ['ok => true] if successful, ['error' => message] if not (may have multiple error lines)
+     * Retrieve all feeds, optionally for a specific user
+     *
+     * @param SQLite3 $db The database connection to use to retrieve the feeds
+     * @param int $user The ID of the user whose feeds should be retrieved (optional, defaults to all feeds)
+     * @return array An array of arrays with ['id', 'url', 'email'] keys
+     */
+    public static function retrieveAll(SQLite3 $db, int $user = 0): array {
+        $extraSQL = $user > 0 ? ' WHERE u.id = :user' : '';
+        $query = $db->prepare(
+            "SELECT f.id, f.url, u.email FROM feed f INNER JOIN frc_user u ON u.id = f.user_id$extraSQL");
+        if ($user > 0) $query->bindValue(':user', $user);
+        if (!($result = $query->execute())) return Data::error($db);
+        $feeds = [];
+        while ($feed = $result->fetchArray(SQLITE3_ASSOC)) $feeds[] = $feed;
+        return $feeds;
+    }
+
+    /**
+     * Refresh all feeds
+     *
+     * @param SQLite3 $db The database connection to use for refreshing feeds
+     * @return array|true[]|string[] ['ok' => true] if successful,
+     *      ['error' => message] if not (may have multiple error lines)
     */
    public static function refreshAll(SQLite3 $db): array {
-        $query = $db->prepare('SELECT url FROM feed WHERE user_id = :user');
-        $query->bindValue(':user', $_REQUEST[Key::USER_ID]);
-        $result = $query->execute();
-        $url    = $result ? $result->fetchArray(SQLITE3_NUM) : false;
-        if ($url) {
-            $errors = array();
-            while ($url) {
-                $updateResult = self::refreshFeed($url[0], $db);
-                if (array_key_exists('error', $updateResult)) $errors[] = $updateResult['error'];
-                $url = $result->fetchArray(SQLITE3_NUM);
-            }
+        $feeds = self::retrieveAll($db, $_SESSION[Key::USER_ID]);
+        if (key_exists('error', $feeds)) return $feeds;
+
+        $errors = [];
+        array_walk($feeds, function ($feed) use ($db, &$errors) {
+            $result = self::refreshFeed($feed['id'], $feed['url'], $db);
+            if (key_exists('error', $result)) $errors[] = $result['error'];
+        });
+
        return sizeof($errors) == 0 ? ['ok' => true] : ['error' => implode("\n", $errors)];
    }
-        return ['error' => $db->lastErrorMsg()];
+
+    /**
+     * Retrieve a feed by its ID for the current user
+     *
+     * @param int $feedId The ID of the feed to retrieve
+     * @param SQLite3 $db A database connection to use to retrieve the feed
+     * @return array|bool The data for the feed if found, false if not found
+     */
+    public static function retrieveById(int $feedId, SQLite3 $db): array|bool {
+        $query = $db->prepare('SELECT * FROM feed WHERE id = :id AND user_id = :user');
+        $query->bindValue(':id', $feedId);
+        $query->bindValue(':user', $_SESSION[Key::USER_ID]);
+        return ($result = $query->execute()) ? $result->fetchArray(SQLITE3_ASSOC) : false;
    }
 }
--- a/src/lib/FeedItem.php
+++ b/src/lib/FeedItem.php
@@ -0,0 +1,80 @@
+<?php
+
+/**
+ * Information for a feed item
+ */
+class FeedItem {
+
+    /** @var string The title of the feed item */
+    public string $title = '';
+
+    /** @var string The unique ID for the feed item */
+    public string $guid = '';
+
+    /** @var string The link to the original content */
+    public string $link = '';
+
+    /** @var string When this item was published */
+    public string $publishedOn = '';
+
+    /** @var ?string When this item was last updated */
+    public ?string $updatedOn = null;
+
+    /** @var string The content for the item */
+    public string $content = '';
+
+    /**
+     * Construct a feed item from an Atom feed's `<entry>` tag
+     *
+     * @param DOMNode $node The XML node from which a feed item should be constructed
+     * @return FeedItem A feed item constructed from the given node
+     */
+    public static function fromAtom(DOMNode $node): FeedItem {
+        $guid = Feed::atomValue($node, 'id');
+        $link = '';
+        foreach ($node->getElementsByTagName('link') as $linkElt) {
+            if ($linkElt->hasAttributes()) {
+                $relAttr = $linkElt->attributes->getNamedItem('rel');
+                if ($relAttr && $relAttr->value == 'alternate') {
+                    $link = $linkElt->attributes->getNamedItem('href')->value;
+                    break;
+                }
+            }
+        }
+        if ($link == '' && str_starts_with($guid, 'http')) $link = $guid;
+
+        $item              = new FeedItem();
+        $item->guid        = $guid;
+        $item->title       = Feed::atomValue($node, 'title');
+        $item->link        = $link;
+        $item->publishedOn = Data::formatDate(Feed::atomValue($node, 'published'));
+        $item->updatedOn   = Data::formatDate(Feed::atomValue($node, 'updated'));
+        $item->content     = Feed::atomValue($node, 'content');
+
+        return $item;
+    }
+
+    /**
+     * Construct a feed item from an RSS feed's `<item>` tag
+     *
+     * @param DOMNode $node The XML node from which a feed item should be constructed
+     * @return FeedItem A feed item constructed from the given node
+     */
+    public static function fromRSS(DOMNode $node): FeedItem {
+        $itemGuid = Feed::rssValue($node, 'guid');
+        $updNodes = $node->getElementsByTagNameNS(Feed::ATOM_NS,    'updated');
+        $encNodes = $node->getElementsByTagNameNS(Feed::CONTENT_NS, 'encoded');
+
+        $item              = new FeedItem();
+        $item->guid        = $itemGuid == 'guid not found' ? Feed::rssValue($node, 'link') : $itemGuid;
+        $item->title       = Feed::rssValue($node, 'title');
+        $item->link        = Feed::rssValue($node, 'link');
+        $item->publishedOn = Data::formatDate(Feed::rssValue($node, 'pubDate'));
+        $item->updatedOn   = Data::formatDate($updNodes->length > 0 ? $updNodes->item(0)->textContent : null);
+        $item->content     = $encNodes->length > 0
+            ? $encNodes->item(0)->textContent
+            : Feed::rssValue($node, 'description');
+
+        return $item;
+    }
+}
--- a/src/lib/ItemList.php
+++ b/src/lib/ItemList.php
@@ -0,0 +1,191 @@
+<?php
+
+/**
+ * A list of items to be displayed
+ *
+ * This is a wrapper for retrieval and display of arbitrary lists of items based on a SQLite result.
+ */
+class ItemList {
+
+    /** @var SQLite3Result The list of items to be displayed */
+    private SQLite3Result $items;
+
+    /** @var string The error message generated by executing a query */
+    public string $error = '';
+
+    /**
+     * Is there an error condition associated with this list?
+     *
+     * @return bool True if there is an error condition associated with this list, false if not
+     */
+    public function isError(): bool {
+        return $this->error != '';
+    }
+
+    /** @var bool Whether to render a link to the feed to which the item belongs */
+    public bool $linkFeed = false;
+
+    /** @var bool Whether to display the feed to which the item belongs */
+    public bool $displayFeed = false;
+
+    /** @var bool Whether to show read / bookmarked indicators on posts */
+    public bool $showIndicators = false;
+
+    /**
+     * Constructor
+     *
+     * @param SQLite3 $db The database connection (used to retrieve error information if the query fails)
+     * @param SQLite3Stmt $query The query to retrieve the items for this list
+     * @param string $itemType The type of item being displayed (unread, bookmark, etc.)
+     * @param string $returnURL The URL to which the item page should return once the item has been viewed
+     */
+    private function __construct(SQLite3 $db, SQLite3Stmt $query, public string $itemType, public string $returnURL = '') {
+        $result = $query->execute();
+        if (!$result) {
+            $this->error = Data::error($db)['error'];
+        } else {
+            $this->items = $result;
+        }
+    }
+
+    /**
+     * Create an item list query
+     *
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @param array $criteria One or more SQL WHERE conditions (will be combined with AND)
+     * @param array $parameters Parameters to be added to the query (key index 0, value index 1; optional)
+     * @return SQLite3Stmt The query, ready to be executed
+     */
+    private static function makeQuery(SQLite3 $db, array $criteria, array $parameters = []): SQLite3Stmt {
+        $where = empty($criteria) ? '' : 'AND ' . implode(' AND ', $criteria);
+        $sql   = <<<SQL
+        SELECT item.id, item.feed_id, item.title AS item_title, coalesce(item.updated_on, item.published_on) AS as_of,
+               item.is_read, item.is_bookmarked, feed.title AS feed_title
+        FROM item INNER JOIN feed ON feed.id = item.feed_id
+        WHERE feed.user_id = :userId $where
+        ORDER BY coalesce(item.updated_on, item.published_on) DESC
+        SQL;
+        $query = $db->prepare($sql);
+        $query->bindValue(':userId', $_SESSION[Key::USER_ID]);
+        foreach ($parameters as $param) $query->bindValue($param[0], $param[1]);
+        return $query;
+    }
+
+    /**
+     * Create an item list with all the current user's bookmarked items
+     *
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @return static An item list with all bookmarked items
+     */
+    public static function allBookmarked(SQLite3 $db): static {
+        $list = new static($db, self::makeQuery($db, ['item.is_bookmarked = 1']), 'Bookmarked', '/?bookmarked');
+        $list->linkFeed = true;
+        return $list;
+    }
+
+    /**
+     * Create an item list with all the current user's unread items
+     *
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @return static An item list with all unread items
+     */
+    public static function allUnread(SQLite3 $db): static {
+        $list = new static($db, self::makeQuery($db, ['item.is_read = 0']), 'Unread');
+        $list->linkFeed = true;
+        return $list;
+    }
+
+    /**
+     * Create an item list with all items for the given feed
+     *
+     * @param int $feedId The ID of the feed for which items should be retrieved
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @return static An item list with all items for the given feed
+     */
+    public static function allForFeed(int $feedId, SQLite3 $db): static {
+        $list = new static($db, self::makeQuery($db, ['feed.id = :feed'], [[':feed', $feedId]]), '',
+            "/feed/items?id=$feedId");
+        $list->showIndicators = true;
+        return $list;
+    }
+
+    /**
+     * Create an item list with unread items for the given feed
+     *
+     * @param int $feedId The ID of the feed for which items should be retrieved
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @return static An item list with unread items for the given feed
+     */
+    public static function unreadForFeed(int $feedId, SQLite3 $db): static {
+        return new static($db, self::makeQuery($db, ['feed.id = :feed', 'item.is_read = 0'], [[':feed', $feedId]]),
+            'Unread', "/feed/items?id=$feedId&unread");
+    }
+
+    /**
+     * Create an item list with bookmarked items for the given feed
+     *
+     * @param int $feedId The ID of the feed for which items should be retrieved
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @return static An item list with bookmarked items for the given feed
+     */
+    public static function bookmarkedForFeed(int $feedId, SQLite3 $db): static {
+        return new static($db,
+            self::makeQuery($db, ['feed.id = :feed', 'item.is_bookmarked = 1'], [[':feed', $feedId]]), 'Bookmarked',
+            "/feed/items?id=$feedId&bookmarked");
+    }
+
+    /**
+     * Create an item list with items matching given search terms
+     *
+     * @param string $search The item search terms / query
+     * @param bool $isBookmarked Whether to restrict the search to bookmarked items
+     * @param SQLite3 $db The database connection to use to obtain items
+     * @return static An item list match the given search terms
+     */
+    public static function matchingSearch(string $search, bool $isBookmarked, SQLite3 $db): static {
+        $where   = $isBookmarked ? ['item.is_bookmarked = 1'] : [];
+        $where[] = 'item.id IN (SELECT ROWID FROM item_search WHERE content MATCH :search)';
+        $list = new static($db, self::makeQuery($db, $where, [[':search', $search]]),
+            'Matching' . ($isBookmarked ? ' Bookmarked' : ''),
+            "/search?search=$search&items=" . ($isBookmarked ? 'bookmarked' : 'all'));
+        $list->showIndicators = true;
+        $list->displayFeed    = true;
+        return $list;
+    }
+
+    /**
+     * Render this item list
+     */
+    public function render(): void {
+        if ($this->isError()) { ?>
+            <p>Error retrieving list:<br><?=$this->error?><?php
+            return;
+        }
+        $item = $this->items->fetchArray(SQLITE3_ASSOC);
+        $return = $this->returnURL == '' ? '' : '&from=' . urlencode($this->returnURL);
+        echo '<article>';
+        if ($item) {
+            while ($item) { ?>
+                <p><?=hx_get("/item?id={$item['id']}$return", strip_tags($item['item_title']))?><br>
+                <small><?php
+                    if ($this->showIndicators) {
+                        if (!$item['is_read']) echo '<strong>Unread</strong> &nbsp; ';
+                        if ($item['is_bookmarked']) echo '<strong>Bookmarked</strong> &nbsp; ';
+                    }
+                    echo '<em>' . date_time($item['as_of']) . '</em>';
+                    if ($this->linkFeed) {
+                        echo ' &bull; ' .
+                            hx_get("/feed/items?id={$item['feed_id']}&" . strtolower($this->itemType),
+                                htmlentities($item['feed_title']));
+                    } elseif ($this->displayFeed) {
+                        echo ' &bull; ' . htmlentities($item['feed_title']);
+                    } ?>
+                </small><?php
+                $item = $this->items->fetchArray(SQLITE3_ASSOC);
+            }
+        } else { ?>
+            <p><em>There are no <?=strtolower($this->itemType)?> items</em><?php
+        }
+        echo '</article>';
+    }
+}
--- a/src/lib/Key.php
+++ b/src/lib/Key.php
@@ -2,10 +2,10 @@

 class Key {

-    /** @var string The $_REQUEST key for teh current user's e-mail address */
+    /** @var string The $_SESSION key for the current user's e-mail address */
    public const string USER_EMAIL = 'FRC_USER_EMAIL';

-    /** @var string The $_REQUEST key for the current user's ID */
+    /** @var string The $_SESSION key for the current user's ID */
    public const string USER_ID = 'FRC_USER_ID';

    /** @var string The $_REQUEST key for the array of user messages to display */
--- a/src/lib/Security.php
+++ b/src/lib/Security.php
@@ -14,38 +14,134 @@ class Security {
    /** @var int Require users to provide e-mail address and password */
    public const int MULTI_USER = 2;

+    /** @var string The e-mail address for the single user */
+    public const string SINGLE_USER_EMAIL = 'solouser@example.com';
+
+    /** @var string The password for the single user with no password */
+    public const string SINGLE_USER_PASSWORD = 'no-password-required';
+
+    /** @var string The password algorithm to use for our passwords */
+    public const string PW_ALGORITHM = PASSWORD_DEFAULT;
+
    /**
-     * Verify that user is logged on
-     * @param bool $redirectIfAnonymous Whether to redirect the request if there is no user logged on
+     * Find a user by their ID
+     *
+     * @param string $email The e-mail address of the user to retrieve
+     * @param SQLite3 $db The data connection to use to retrieve the user
+     * @return array|false The user information, or null if the user is not found
     */
-    public static function verifyUser(bool $redirectIfAnonymous = true): void {
-        switch (SECURITY_MODEL) {
-            case self::SINGLE_USER:
-                $user = self::retrieveSingleUser();
-                break;
-            case self::SINGLE_USER_WITH_PASSWORD:
-                die('Single User w/ Password has not yet been implemented');
-            case self::MULTI_USER:
-                die('Multi-User Mode has not yet been implemented');
-            default:
-                die('Unrecognized security model (' . SECURITY_MODEL . ')');
-        }
-        if (!$user && $redirectIfAnonymous) {
-            header('/logon?returnTo=' . $_SERVER['REQUEST_URI'], true, HTTP_REDIRECT_TEMP);
-            die();
-        }
-        $_REQUEST[Key::USER_ID]    = $user['id'];
-        $_REQUEST[Key::USER_EMAIL] = $user['email'];
+    public static function findUserByEmail(string $email, SQLite3 $db): array|false {
+        $query = $db->prepare('SELECT * FROM frc_user WHERE email = :email');
+        $query->bindValue(':email', $email);
+        $result = $query->execute();
+        return $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
    }

    /**
-     * Retrieve the single user
-     * @return array The user information for the single user
+     * Add a user
+     *
+     * @param string $email The e-mail address for the user
+     * @param string $password The user's password
+     * @param SQLite3 $db The data connection to use to add the user
     */
-    private static function retrieveSingleUser(): array {
-        $user = Data::findUserByEmail('solouser@example.com');
-        if ($user) return $user;
-        Data::addUser('solouser@example.com', 'no-password-required');
-        return Data::findUserByEmail('solouser@example.com');
+    public static function addUser(string $email, string $password, SQLite3 $db): void {
+        $query = $db->prepare('INSERT INTO frc_user (email, password) VALUES (:email, :password)');
+        $query->bindValue(':email',    $email);
+        $query->bindValue(':password', password_hash($password, self::PW_ALGORITHM));
+        $query->execute();
+    }
+
+    /**
+     * Verify a user's password
+     *
+     * @param array $user The user information retrieved from the database
+     * @param string $password The password provided by the user
+     * @param string|null $returnTo The URL to which the user should be redirected
+     * @param SQLite3 $db The database connection to use to verify the user's credentials
+     */
+    private static function verifyPassword(array $user, string $password, ?string $returnTo, SQLite3 $db): void {
+        if (password_verify($password, $user['password'])) {
+            if (password_needs_rehash($user['password'], self::PW_ALGORITHM)) {
+                $rehash = $db->prepare('UPDATE frc_user SET password = :hash WHERE id = :id');
+                $rehash->bindValue(':hash', password_hash($password, self::PW_ALGORITHM));
+                $rehash->bindValue(':id',   $user['id']);
+                $rehash->execute();
+            }
+            $_SESSION[Key::USER_ID]    = $user['id'];
+            $_SESSION[Key::USER_EMAIL] = $user['email'];
+            frc_redirect($returnTo ?? '/');
+        }
+    }
+
+    /**
+     * Log on a user with e-mail address and password
+     *
+     * @param string $email The e-mail address for the user (cannot be the single-user mode user)
+     * @param string $password The password provided by the user
+     * @param string|null $returnTo The URL to which the user should be redirected
+     * @param SQLite3 $db The database connection to use to verify the user's credentials
+     */
+    public static function logOnUser(string $email, string $password, ?string $returnTo, SQLite3 $db): void {
+        if (SECURITY_MODEL == self::SINGLE_USER_WITH_PASSWORD) {
+            $dbEmail = self::SINGLE_USER_EMAIL;
+        } else {
+            if ($email == self::SINGLE_USER_EMAIL) {
+                add_error('Invalid credentials; log on unsuccessful');
+                return;
+            }
+            $dbEmail = $email;
+        }
+        $user = self::findUserByEmail($dbEmail, $db);
+        if ($user) self::verifyPassword($user, $password, $returnTo, $db);
+        add_error('Invalid credentials; log on unsuccessful');
+    }
+
+    /**
+     * Update the password for the given user
+     *
+     * @param string $email The e-mail address of the user whose password should be updated
+     * @param string $password The new password for this user
+     * @param SQLite3 $db The database connection to use in updating the password
+     */
+    public static function updatePassword(string $email, string $password, SQLite3 $db): void {
+        $query = $db->prepare('UPDATE frc_user SET password = :password WHERE email = :email');
+        $query->bindValue(':password', password_hash($password, self::PW_ALGORITHM));
+        $query->bindValue(':email',    $email);
+        $query->execute();
+    }
+
+    /**
+     * Log on the single user
+     *
+     * @param SQLite3 $db The data connection to use to retrieve the user
+     */
+    private static function logOnSingleUser(SQLite3 $db): void {
+        $user = self::findUserByEmail(self::SINGLE_USER_EMAIL, $db);
+        if (!$user) {
+            self::addUser(self::SINGLE_USER_EMAIL, self::SINGLE_USER_PASSWORD, $db);
+            $user = self::findUserByEmail(self::SINGLE_USER_EMAIL, $db);
+        }
+        self::verifyPassword($user, self::SINGLE_USER_PASSWORD, $_GET['returnTo'], $db);
+    }
+
+    /**
+     * Verify that user is logged on
+     *
+     * @param SQLite3 $db The data connection to use if required
+     * @param bool $redirectIfAnonymous Whether to redirect the request if there is no user logged on
+     */
+    public static function verifyUser(SQLite3 $db, bool $redirectIfAnonymous = true): void {
+        if (key_exists(Key::USER_ID, $_SESSION)) return;
+
+        if (SECURITY_MODEL == self::SINGLE_USER) self::logOnSingleUser($db);
+
+        if (SECURITY_MODEL != self::SINGLE_USER_WITH_PASSWORD && SECURITY_MODEL != self::MULTI_USER) {
+            die('Unrecognized security model (' . SECURITY_MODEL . ')');
+        }
+
+        if ($redirectIfAnonymous) {
+            header("Location: /user/log-on?returnTo={$_SERVER['REQUEST_URI']}", true, 307);
+            die();
+        }
    }
 }
--- a/src/public/assets/bookmark-add.png
+++ b/src/public/assets/bookmark-add.png
--- a/src/public/assets/bookmark-added.png
+++ b/src/public/assets/bookmark-added.png
--- a/src/public/assets/htmx.min.js
+++ b/src/public/assets/htmx.min.js
--- a/src/public/assets/style.css
+++ b/src/public/assets/style.css
@@ -22,25 +22,59 @@ header {
    border-bottom-right-radius: .5rem;
    color: white;
    display: flex;
-    flex-flow: row nowrap;
+    flex-flow: row wrap;
    justify-content: space-between;
    align-items: baseline;
-
+    div, nav {
+        margin-bottom: .25rem;
+    }
    .title {
        font-size: 1.5rem;
    }
-
+    .version {
+        font-size: .85rem;
+        padding-left: .5rem;
+        color: rgba(255, 255, 255, .75);
+    }
    a:link, a:visited {
        color: white;
    }
+    nav {
+        display: flex;
+        flex-flow: row wrap;
+        gap: 0 .4rem;
+    }
 }
 main {
    padding: 0 .5rem;
-
-    .item_heading {
-        margin-bottom: 0;
+    .refresh, .loading {
+        font-style: italic;
+        font-size: .9rem;
+    }
+    .htmx-request .refresh {
+        display: none;
+    }
+    .loading {
+        display: none;
+    }
+    .htmx-request .loading {
+        display: inline;
+    }
+    .user_messages {
+        display: flex;
+        flex-flow: column;
+        justify-content: center;
+    }
+    .user_message {
+        margin: .25rem auto;
+        border: solid 1px navy;
+        border-radius: .5rem;
+        background-color: rgba(255, 255, 255, .75);
+        padding: .25rem;
+    }
+    .user_messages + h1 {
+        margin-top: .25rem;
    }
-
    .item_published {
        margin-bottom: 1rem;
        line-height: 1.2;
@@ -49,19 +83,73 @@ main {
 article {
    max-width: 60rem;
    margin: auto;
-
    .item_content {
        border: solid 1px navy;
        border-radius: .5rem;
        background-color: white;
        padding: .5rem;
+        img {
+            max-width: 100%;
+            object-fit: contain;
+        }
+    }
+    .meta {
+        font-size: .9rem;
+    }
+    &.docs {
+        line-height: 1.4rem;
    }
 }
-input[type=url], input[type=text] {
-    width: 50%;
+form {
+    display: flex;
+    flex-flow: row wrap;
+    justify-content: center;
+    gap: 0 2rem;
+    label {
+        font-size: .9rem;
+        font-weight: bold;
+        input, select {
+            display: block;
+        }
+    }
+    .break {
+        flex-basis: 100%;
+        height: 1rem;
+        width: 0;
+    }
+    input[type=url],
+    input[type=text],
+    input[type=email],
+    input[type=password],
+    select {
+        min-width: 12rem;
+        max-width: 100%;
        font-size: 1rem;
        padding: .25rem;
        border-radius: .25rem;
+        background-color: white;
+        border: solid 2px navy;
+    }
+    select {
+        min-width: unset;
+        max-width: unset;
+    }
+}
+@media all and (min-width: 60rem) {
+    form {
+        input[type=url],
+        input[type=text],
+        input[type=email],
+        input[type=password] {
+            min-width: 25rem;
+        }
+    }
+}
+.action_buttons {
+    margin: 1rem 0;
+    display: flex;
+    flex-flow: row nowrap;
+    justify-content: space-evenly;
 }
 button,
 .action_buttons a:link,
@@ -74,16 +162,40 @@ button,
    border-radius: .25rem;
    cursor: pointer;
    border: none;
-}
-button:hover,
-.action_buttons a:hover {
+    &:hover {
        text-decoration: none;
        cursor: pointer;
        background: linear-gradient(navy, #000032);
+    }
 }
-.action_buttons {
-    margin: 1rem 0;
-    display: flex;
-    flex-flow: row nowrap;
-    justify-content: space-evenly;
+code {
+    font-size: .9rem;
+}
+p.back-link {
+    margin-top: -1rem;
+}
+.item_heading {
+    margin-bottom: 0;
+    .bookmark {
+        padding: 0;
+        border: solid 1px black;
+        border-radius: .5rem;
+        &.add {
+            background-color: lightgray;
+            &:hover {
+                background: linear-gradient(lightgreen, gray);
+            }
+        }
+        &.remove {
+            background: linear-gradient(lightgreen, green);
+            &:hover {
+                background: linear-gradient(gray, lightgreen);
+            }
+        }
+        img {
+            max-width: 1.5rem;
+            max-height: 1.5rem;
+            padding: .5rem;
+        }
+    }
 }
--- a/src/public/bookmark.php
+++ b/src/public/bookmark.php
@@ -0,0 +1,49 @@
+<?php
+
+/**
+ * Bookmark Partial Handler
+ *
+ * This will display a button which will either add or remove a bookmark for a given item.
+ */
+
+include '../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db);
+
+$id = $_GET['id'];
+
+$existsQuery = $db->prepare(
+    'SELECT item.id FROM item INNER JOIN feed ON feed.id = item.feed_id WHERE item.id = :id AND feed.user_id = :user');
+$existsQuery->bindValue(':id',   $id);
+$existsQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
+$existsResult = $existsQuery->execute();
+$exists = $existsResult ? $existsResult->fetchArray(SQLITE3_ASSOC) : false;
+
+if (!$exists) not_found();
+
+if (key_exists('action', $_GET)) {
+    if ($_GET['action'] == 'add') {
+        $flag = 1;
+    } elseif ($_GET['action'] == 'remove') {
+        $flag = 0;
+    }
+    if (isset($flag)) {
+        $update = $db->prepare('UPDATE item SET is_bookmarked = :flag WHERE id = :id');
+        $update->bindValue(':id',   $id);
+        $update->bindValue(':flag', $flag);
+        if (!$update->execute()) die(Data::error($db)['error']);
+    }
+}
+
+$bookQuery = $db->prepare('SELECT id, is_bookmarked FROM item WHERE id = :id');
+$bookQuery->bindValue(':id', $id);
+$bookResult = $bookQuery->execute();
+$bookmark = $bookResult ? $bookResult->fetchArray(SQLITE3_ASSOC) : ['id' => $id, 'is_bookmarked' => 0];
+
+$action = $bookmark['is_bookmarked'] ? 'remove' : 'add';
+$icon   = $bookmark['is_bookmarked'] ? 'added'  : 'add'; ?>
+<button class="bookmark <?=$action?>" type=button role=button hx-patch="/bookmark?id=<?=$id?>&action=<?=$action?>"
+        hx-target=this hx-swap=outerHTML hx-push-url=false title="<?=init_cap($action)?> Bookmark">
+    <img src=/assets/bookmark-<?=$icon?>.png alt="<?=$action?> bookmark">
+</button><?php
--- a/src/public/docs/index.php
+++ b/src/public/docs/index.php
@@ -0,0 +1,17 @@
+<?php
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db, redirectIfAnonymous: false);
+
+page_head('Documentation'); ?>
+<h1>Documentation Home</h1>
+<article>
+    <p><?=hx_get('./the-cli', 'About the CLI')?> provides orientation on Feed Reader Central&rsquo;s command line
+        interface
+    <p><?=hx_get('./security-modes', 'Configuring Security Modes')?> describes the three security modes and how to
+        manage each of them
+    <p><?=hx_get('./refresh-feeds', 'Refresh Feeds')?> has instructions on how feeds can be refreshed on a schedule
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/docs/refresh-feeds.php
+++ b/src/public/docs/refresh-feeds.php
@@ -0,0 +1,52 @@
+<?php
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db, redirectIfAnonymous: false);
+
+page_head('Refresh Feeds | Documentation'); ?>
+<h1>Refresh Feeds</h1>
+<p class=back-link><?=hx_get('./', '&lang;&lang; Documentation Home')?>
+<article class=docs>
+    <h2>Manual Feed Refresh</h2>
+    <p>Next to the &ldquo;Your Unread Items&rdquo; heading on the main page, there is a link labeled &ldquo;Refresh All
+        Feeds&rdquo;. Clicking this link will reload the main page once the feeds have been refreshed. Depending on the
+        number and size of feeds, this may take a bit of time; each feed is refreshed individually.
+    <h2>Automatic Refreshing</h2>
+    <p>The <code>refresh</code> utility script will perform this refresh from the CLI. As it runs, it will list the
+        feeds as it processes them, and if it encounters any errors, that is noted as well. This process can be
+        automated via <code>cron</code> on Linux or Mac systems. This is most easily implemented by writing a small
+        shell script to provide some environment settings, then telling <code>cron</code> to run that script.
+    <pre class=item_content>
+#!/bin/bash
+exec 1> >(logger -t feed-reader-central) 2>&1
+cd /path/to/frc
+php-cli util/refresh.php all</pre>
+    <p>Save this (<code>frc-refresh.sh</code> might be a good name) and be sure it is executable
+        (<code>chmod +x ./frc-refresh.sh</code>). Before we put it in crontab, though, let&rsquo;s understand what each
+        line does:
+    <ul>
+        <li>Line 1 tells the operating system to use the <code>bash</code> shell.
+        <li>Line 2 directs all output to the system log (<code>/var/log/syslog</code>), labeling each entry with
+            <code>feed-reader-central</code>. This lets you review the output for its runs in a log that is already
+            maintained and rotated by the operating system.
+        <li>Line 3 changes the current directory to the one where Feed Reader Central is installed; modify it for where
+            you have installed it. Since we are setting up for a <a href=./the-cli>CLI execution</a>, this should place
+            us one directory up from <code>/public</code>.
+        <li>Line 4 executes the refresh script.
+    </ul>
+    <p>Finally, we are ready to add this to our crontab. Enter <code>crontab -e</code> to edit the file, then add a row
+        at the bottom that looks like this:
+    <pre class=item_content>
+0 */6 * * *  /path/to/job/frc-refresh.sh</pre>
+    <p>The items before the path specify when it should run. This example will run at the top of the hour every six
+        hours. Crontab schedules can be tricky to create; a full treatment is outside the scope of this documentation.
+        However, <a href=https://crontab.guru/#0_*/6_*_*_* target=_blank rel=noopener title="Crontab.guru">this site</a>
+        lets you put values in each position and it translates that to words; this lets you see if what you put is what
+        you meant.
+    <p>This should not require many resources; the majority of its time will be spent waiting for the websites to return
+        their feeds so it can process them. However, if you want it to yield to everything else happening on the server,
+        add <code>nice -n 1</code> (with a trailing space) before the path to the script.
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/docs/security-modes.php
+++ b/src/public/docs/security-modes.php
@@ -0,0 +1,62 @@
+<?php
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db, redirectIfAnonymous: false);
+
+page_head('Security Modes | Documentation'); ?>
+<h1>Configuring Security Modes</h1>
+<p class=back-link><?=hx_get('./', '&lang;&lang; Documentation Home')?>
+<article class=docs>
+    <h2>Security Modes</h2>
+    <p><strong>Single-User</strong> mode assumes that every connection to the application is the same person. It is
+        designed for one person to use on a trusted internal network; under no circumstances should an instance
+        configured this way be reachable from the Internet. However, it is a low-friction way to keep up with feeds from
+        multiple devices on a home network.
+    <p><strong>Single-User with Password</strong> mode operates the same way as Single-User mode does, but the
+        application will require a password. Depending on the strength of the password, this model may be appropriate
+        for Internet access, but its intent is more for keeping other internal network users from accessing the site
+        and reading the items before its intended user is able to do so. The password should be set using the CLI.
+    <p><strong>Multi-User</strong> mode requires both an e-mail address and password before allowing the user to
+        proceed. It is the most appropriate configuration for an Internet-facing instance, and it can also be used to
+        provide access to multiple users on an internal network. Managing users is performed via the CLI.
+    <h2 id=manage-users>Managing Users in Multi-User Mode</h2>
+    <p>Users can be added or deleted, and passwords set, using the <code>user</code> CLI utility.<br><br>
+        <em>(For all the &ldquo;password&rdquo; parameters, if a character in the password conflicts with a shell escape
+            character, enclose the password in double-quotes for *sh or single-quotes for PowerShell.)</em>
+    <h3>Add a User</h3>
+    <p><code>php-cli utils/user.php add-user alice@example.com AlicesSecur3P4ssword</code>
+    <p>The utility should respond with the e-mail address and password that were added. If a user with that e-mail
+        address already exists, the utility will not add it again.
+    <h3>Set a User&rsquo;s Password</h3>
+    <p><code>php-cli utils/user.php set-password bob@example.com AN3wPassCauseB0bForg0t1t</code>
+    <h3>Delete a User</h3>
+    <p><code>php-cli utils/user.php delete-user carol@example.com</code>
+    <p>The utility will require confirmation that the user and their feeds should be deleted. Any input that starts with
+        the letter &ldquo;y&rdquo; will confirm, and any other input will cancel the process.
+    <h2 id=change-to-multi>Changing from Single-User to Multi-User Mode</h2>
+    <p>In Single-User mode, the application uses a known e-mail address and password to mimic multi-user mode where that
+        user is always logged on. If you have been using the application this way, and decide that you want to run in
+        multi-user mode instead, you will need to update <code>SECURITY_MODEL</code> in <code>user-config.php</code> to
+        <code>Security::MULTI_USER</code>.
+    <p>The e-mail address used for Single-User mode is not allowed to log on in Multi-User mode. If you want to preserve
+        the feeds defined by the single user, use the CLI to replace its e-mail address and password.
+    <p><code>php-cli utils/user.php migrate-single-user dave@example.com Dav3sPas$wort</code>
+    <p>If, however, you do not wish to maintain the single user&rsquo;s information at all, delete it.
+    <p><code>php-cli utils/user.php remove-single-user</code>
+    <h2 id=change-multi-to-single>Changing from Multi-User to any Single-User Mode</h2>
+    <p>This scenario is possible, but not really advisable. When the application is in any Single-User mode, it only
+        displays feeds from the Single-User mode user. The information for the other users remains in the database,
+        though, so this change is not destructive.
+    <h2 id=change-single-to-pw>Changing from Single-User to Single-User with Password Mode</h2>
+    <p>Set <code>SECURITY_MODEL</code> in <code>user-config.php</code> to
+        <code>Security::SINGLE_USER_WITH_PASSWORD</code>, then use the <code>user</code> CLI utility to set a password.
+    <p><code>php-cli util/user.php set-single-password aNiceC0mplexPassw0rd</code>
+    <h2 id=change-pw-to-single>Changing from Single-User with Password to Single-User Mode</h2>
+    <p>If you decide you do not want to enter a password, but want to maintain single-user mode, set
+        <code>SECURITY_MODEL</code> in <code>user-config.php</code> to <code>Security::SINGLE_USER</code>, then run the
+        <code>user</code> CLI utility to reset the single user back to its expected default.
+    <p><code>php-cli util/user.php reset-single-password</code>
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/docs/the-cli.php
+++ b/src/public/docs/the-cli.php
@@ -0,0 +1,24 @@
+<?php
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db, redirectIfAnonymous: false);
+
+page_head('About the CLI | Documentation'); ?>
+<h1>About the CLI</h1>
+<p class=back-link><?=hx_get('./', '&lang;&lang; Documentation Home')?>
+<article class=docs>
+    <p>Feed Reader Central&rsquo;s low-friction design includes having many administrative tasks run in a terminal or
+        shell. &ldquo;CLI&rdquo; is short for &ldquo;Command Line Interface&rdquo;, and refers to commands that are run
+        via PHP&rsquo;s <code>php-cli</code> command. Ensure that the version of PHP installed also has that feature
+        enabled. (If you are using the recommended
+        <a href=https://frankenphp.dev target=_blank rel=noopener>FrankenPHP</a> environment, it has PHP CLI support;
+        use <code>frankenphp php-cli</code> instead of <code>php-cli</code> when following instructions here.)
+    <h2>Running CLI Commands</h2>
+    <p>CLI commands should be run from the same directory with <code>start.php</code>; this will be one directory level
+        up from <code>/public</code>, the web root directory. CLI utilities are in the <code>/util</code> directory, so
+        an invocation will follow the pattern:
+    <p><code>php-cli util/some-process.php command option1 option2</code>
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/feed.php
+++ b/src/public/feed.php
@@ -1,61 +0,0 @@
-<?php
-/**
- * Add/Edit Feed Page
- *
- * Allows users to add or edit RSS feeds
- */
-
-include '../start.php';
-
-Security::verifyUser();
-
-$feedId = array_key_exists('id', $_GET) ? $_GET['id'] : '';
-$db     = Data::getConnection();
-
-if ($_SERVER['REQUEST_METHOD'] == 'POST') {
-    $isNew = $_POST['id'] == 'new';
-    if ($isNew) {
-        $result = Feed::add($_POST['url'], $db);
-    } else {
-        $toEdit = Data::retrieveFeedById($_POST['id'], $db);
-        $result = $toEdit ? Feed::update($toEdit, $_POST['url'], $db) : ['error' => "Feed {$_POST['id']} not found"];
-    }
-    if (array_key_exists('ok', $result)) {
-        add_info('Feed saved successfully');
-        $feedId = $isNew ? $result['ok'] : $_POST['id'];
-    } else {
-        add_error($result['error']);
-        $feedId = 'error';
-    }
-}
-
-if ($feedId == 'new') {
-    $title = 'Add RSS Feed';
-    $feed = [ 'id' => $_GET['id'], 'url' => '' ];
-} else {
-    $title = 'Edit RSS Feed';
-    if ($feedId == 'error') {
-        $feed = ['id' => $_POST['id'] ?? '', 'url' => $_POST['url'] ?? ''];
-    } else {
-        $feed = Data::retrieveFeedById((int) $feedId, $db);
-        if (!$feed) {
-            http_response_code(404);
-            die();
-        }
-    }
-}
-
-page_head($title); ?>
-<h1><?=$title?></h1>
-<article>
-    <form method=POST action=/feed hx-post=/feed>
-        <input type=hidden name=id value=<?=$feed['id']?>>
-        <label>
-            Feed URL
-            <input type=url name=url required autofocus value="<?=$feed['url']?>">
-        </label><br>
-        <button type=submit>Save</button>
-    </form>
-</article><?php
-page_foot();
-$db->close();
--- a/src/public/feed/index.php
+++ b/src/public/feed/index.php
@@ -0,0 +1,70 @@
+<?php
+/**
+ * Add/Edit/Delete Feed Page
+ *
+ * Allows users to add, edit, and delete feeds
+ */
+
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db);
+
+$feedId = $_GET['id'] ?? '';
+
+if ($_SERVER['REQUEST_METHOD'] == 'DELETE') {
+    if (!($feed = Feed::retrieveById($feedId, $db))) not_found();
+    $itemDelete = $db->prepare('DELETE FROM item WHERE feed_id = :feed');
+    $itemDelete->bindValue(':feed', $feed['id']);
+    if (!$itemDelete->execute()) add_error(Data::error($db)['error']);
+    $feedDelete = $db->prepare('DELETE FROM feed WHERE id = :feed');
+    $feedDelete->bindValue(':feed', $feed['id']);
+    if ($feedDelete->execute()) {
+        add_info('Feed &ldquo;' . htmlentities($feed['title']) . '&rdquo; deleted successfully');
+    } else {
+        add_error(Data::error($db)['error']);
+    }
+    frc_redirect('/feeds');
+}
+
+if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+    $isNew = $_POST['id'] == 'new';
+    if ($isNew) {
+        $result = Feed::add($_POST['url'], $db);
+    } else {
+        $toEdit = Feed::retrieveById($_POST['id'], $db);
+        $result = $toEdit ? Feed::update($toEdit, $_POST['url'], $db) : ['error' => "Feed {$_POST['id']} not found"];
+    }
+    if (key_exists('ok', $result)) {
+        add_info('Feed saved successfully');
+        frc_redirect('/feeds');
+    }
+    add_error($result['error']);
+    $feedId = 'error';
+}
+
+if ($feedId == 'new') {
+    $title = 'Add RSS Feed';
+    $feed = [ 'id' => $_GET['id'], 'url' => ''];
+} else {
+    $title = 'Edit RSS Feed';
+    if ($feedId == 'error') {
+        $feed = ['id' => $_POST['id'] ?? '', 'url' => $_POST['url'] ?? ''];
+    } elseif (!($feed = Feed::retrieveById((int) $feedId, $db))) not_found();
+}
+
+page_head($title); ?>
+<h1><?=$title?></h1>
+<article>
+    <form method=POST action=/feed/ hx-post=/feed/>
+        <input type=hidden name=id value=<?=$feed['id']?>>
+        <label>
+            Feed URL
+            <input type=url name=url required autofocus value="<?=$feed['url']?>">
+        </label>
+        <span class=break></span>
+        <button type=submit>Save</button>
+    </form>
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/feed/items.php
+++ b/src/public/feed/items.php
@@ -0,0 +1,30 @@
+<?php
+/**
+ * Feed Item List Page
+ *
+ * Lists items in a given feed (all, unread, or bookmarked)
+ */
+
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db);
+
+if (!($feed = Feed::retrieveById($_GET['id'], $db))) not_found();
+
+$list = match (true) {
+    key_exists('unread',     $_GET) => ItemList::unreadForFeed($feed['id'], $db),
+    key_exists('bookmarked', $_GET) => ItemList::bookmarkedForFeed($feed['id'], $db),
+    default                         => ItemList::allForFeed($feed['id'], $db)
+};
+
+page_head(($list->itemType != '' ? "$list->itemType Items | " : '') . strip_tags($feed['title']));
+if ($list->itemType == '') {
+    echo '<h1>' . htmlentities($feed['title']) . '</h1>';
+} else {
+    echo '<h1 class=item_heading>' . htmlentities($feed['title']) . '</h1>';
+    echo "<div class=item_published>$list->itemType Items</div>";
+}
+$list->render();
+page_foot();
+$db->close();
--- a/src/public/feeds.php
+++ b/src/public/feeds.php
@@ -0,0 +1,51 @@
+<?php
+/**
+ * Feed Maintenance Page
+ *
+ * List feeds and provide links for maintenance actions
+ */
+
+include '../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db);
+
+$feedQuery = $db->prepare('SELECT * FROM feed WHERE user_id = :user ORDER BY lower(title)');
+$feedQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
+if (!($feedResult = $feedQuery->execute())) {
+    add_error(Data::error($db)['error']);
+}
+
+page_head('Your Feeds'); ?>
+<h1>Your Feeds</h1>
+<article>
+    <p class=action_buttons><?=hx_get('/feed/?id=new', 'Add Feed')?></p><?php
+    if ($feedResult) {
+        while ($feed = $feedResult->fetchArray(SQLITE3_ASSOC)) {
+            $feedId = $feed['id'];
+            $countQuery = $db->prepare(<<<'SQL'
+                SELECT (SELECT COUNT(*) FROM item WHERE feed_id = :feed)                       AS total,
+                       (SELECT COUNT(*) FROM item WHERE feed_id = :feed AND is_read = 0)       AS unread,
+                       (SELECT COUNT(*) FROM item WHERE feed_id = :feed AND is_bookmarked = 1) AS marked
+                SQL);
+            $countQuery->bindValue(':feed', $feed['id']);
+            $countResult = $countQuery->execute();
+            $counts = $countResult
+                ? $countResult->fetchArray(SQLITE3_ASSOC) : ['total' => 0, 'unread' => 0, 'marked' => 0]; ?>
+            <p><strong><?=htmlentities($feed['title'])?></strong><br>
+                <span class=meta><em>Last Updated <?=date_time($feed['updated_on'])?> &bull;
+                    As of <?=date_time($feed['checked_on'])?></em><br>
+                <?=hx_get("/feed/?id=$feedId", 'Edit')?> &bull; Read
+                <?=$counts['unread'] > 0 ? hx_get("/feed/items?id=$feedId&unread", 'Unread') : 'Unread'?>
+                (<?=$counts['unread']?>) |
+                <?=$counts['total'] > 0 ? hx_get("/feed/items?id=$feedId", 'All') : 'All'?> (<?=$counts['total']?>) |
+                <?=$counts['marked'] > 0 ? hx_get("/feed/items?id=$feedId&bookmarked", 'Bookmarked') : 'Bookmarked'?>
+                (<?=$counts['marked']?>) &bull;
+                <a href=/feed/?id=<?=$feedId?> hx-delete=/feed/?id=<?=$feedId?>
+                   hx-confirm="Are you sure you want to delete &ldquo;<?=htmlentities($feed['title'], ENT_QUOTES)?>&rdquo;? This will remove the feed and all its items, including unread and bookmarked.">Delete</a>
+                </span><?php
+        }
+    } ?>
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/index.php
+++ b/src/public/index.php
@@ -2,47 +2,36 @@
 /**
 * Home Page
 *
- * Displays a list of unread feed items for the current user
+ * Displays a list of unread or bookmarked items for the current user
 */

 include '../start.php';

-Security::verifyUser();
-
 $db = Data::getConnection();
+Security::verifyUser($db);

-if (array_key_exists('refresh', $_GET)) {
+if (key_exists('refresh', $_GET)) {
    $refreshResult = Feed::refreshAll($db);
-    if (array_key_exists('ok', $refreshResult)) {
+    if (key_exists('ok', $refreshResult)) {
        add_info('All feeds refreshed successfully');
    } else {
        add_error(nl2br($refreshResult['error']));
    }
 }

-$result = $db->query(<<<'SQL'
-    SELECT item.id, item.title AS item_title, coalesce(item.updated_on, item.published_on) AS as_of,
-           feed.title AS feed_title
-      FROM item
-           INNER JOIN feed ON feed.id = item.feed_id
-     WHERE item.is_read = 0
-     ORDER BY coalesce(item.updated_on, item.published_on) DESC
-    SQL);
-$item   = $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
-
-page_head('Welcome'); ?>
-<h1>Your Unread Items &nbsp; <a href=/?refresh><small><small><em>(Refresh All Feeds)</em></small></small></a></h1>
-<article><?php
-if ($item) {
-    while ($item) { ?>
-        <p><a href=/item?id=<?=$item['id']?>><?=$item['item_title']?></a><br>
-            <?=$item['feed_title']?><br><small><em><?=date_time($item['as_of'])?></em></small><?php
-        $item = $result->fetchArray(SQLITE3_ASSOC);
-    }
-} else { ?>
-    <p>There are no unread items</p><?php
-} ?>
-</article><?php
+$list = match (true) {
+    key_exists('bookmarked', $_GET) => ItemList::allBookmarked($db),
+    default                         => ItemList::allUnread($db)
+};
+$title = "Your $list->itemType Items";

+page_head($title);
+echo "<h1>$title";
+if ($list->itemType == 'Unread') {
+    echo ' &nbsp; ' . hx_get('/?refresh', '(Refresh All Feeds)', 'class=refresh hx-indicator="closest h1"')
+        . '<span class=loading>Refreshing&hellip;</span>';
+}
+echo '</h1>';
+$list->render();
 page_foot();
 $db->close();
--- a/src/public/item.php
+++ b/src/public/item.php
@@ -8,9 +8,8 @@

 include '../start.php';

-Security::verifyUser();
-
 $db = Data::getConnection();
+Security::verifyUser($db);

 if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    // "Keep as New" button sends a POST request to reset the is_read flag before going back to the list of unread items
@@ -20,7 +19,7 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') {
         WHERE item.id = :id AND feed.user_id = :user
        SQL);
    $isValidQuery->bindValue(':id',   $_POST['id']);
-    $isValidQuery->bindValue(':user', $_REQUEST[Key::USER_ID]);
+    $isValidQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
    $isValidResult = $isValidQuery->execute();
    if ($isValidResult && $isValidResult->fetchArray(SQLITE3_NUM)[0] == 1) {
        $keepUnread = $db->prepare('UPDATE item SET is_read = 0 WHERE id = :id');
@@ -28,18 +27,40 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') {
        $keepUnread->execute();
    }
    $db->close();
-    frc_redirect('/');
+    frc_redirect($_POST['from']);
+}
+
+$from = $_GET['from'] ?? '/';
+
+if ($_SERVER['REQUEST_METHOD'] == 'DELETE') {
+    $deleteQuery = $db->prepare(<<<'SQL'
+        DELETE FROM item
+         WHERE id IN (
+                 SELECT item.id
+                   FROM item INNER JOIN feed ON feed.id = item.feed_id
+                  WHERE item.id      = :id
+                    AND feed.user_id = :user)
+        SQL);
+    $deleteQuery->bindValue(':id',   $_GET['id']);
+    $deleteQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
+    if ($deleteQuery->execute()) {
+        add_info('Item deleted');
+    } else {
+        add_error(Data::error($db)['error']);
+    }
+    $db->close();
+    frc_redirect($from);
 }

 $query = $db->prepare(<<<'SQL'
-    SELECT item.title AS item_title, item.item_link, item.published_on, item.updated_on, item.content, item.is_encoded,
+    SELECT item.title AS item_title, item.item_link, item.published_on, item.updated_on, item.content,
           feed.title AS feed_title
      FROM item INNER JOIN feed ON feed.id = item.feed_id
     WHERE item.id      = :id
       AND feed.user_id = :user
    SQL);
 $query->bindValue(':id',   $_GET['id']);
-$query->bindValue(':user', $_REQUEST[Key::USER_ID]);
+$query->bindValue(':user', $_SESSION[Key::USER_ID]);
 $result = $query->execute();
 $item = $result ? $result->fetchArray(SQLITE3_ASSOC) : false;

@@ -54,7 +75,9 @@ $updated   = isset($item['updated_on']) ? date_time($item['updated_on']) : null;

 page_head(htmlentities("{$item['item_title']} | {$item['feed_title']}")); ?>
 <h1 class=item_heading>
-    <a href="<?=$item['item_link']?>" target=_blank rel=noopener><?=$item['item_title']?></a><br>
+    <span class=bookmark hx-get="/bookmark?id=<?=$_GET['id']?>" hx-trigger=load hx-target=this hx-swap=outerHTML
+          hx-push-url=false></span>
+    <a href="<?=$item['item_link']?>" target=_blank rel=noopener><?=strip_tags($item['item_title'])?></a><br>
 </h1>
 <div class=item_published>
    From <strong><?=htmlentities($item['feed_title'])?></strong><br>
@@ -62,10 +85,12 @@ page_head(htmlentities("{$item['item_title']} | {$item['feed_title']}")); ?>
 </div>
 <article>
    <div class=item_content><?=str_replace('<a ', '<a target=_blank rel=noopener ', $item['content'])?></div>
-    <form class=action_buttons action=/item method=POST>
+    <form class=action_buttons action=/item method=POST hx-post=/item>
        <input type=hidden name=id value=<?=$_GET['id']?>>
-        <a href="/">Done</a>
+        <input type=hidden name=from value="<?=$from?>">
+        <?=hx_get($from, 'Done')?>
        <button type=submit>Keep as New</button>
+        <button type=button hx-delete=/item>Delete</button>
    </form>
 </article><?php
 page_foot();
--- a/src/public/search.php
+++ b/src/public/search.php
@@ -0,0 +1,45 @@
+<?php
+
+/**
+ * Item Search Page
+ *
+ * Search for items across all feeds
+ */
+
+include '../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db);
+
+$search = $_GET['search'] ?? '';
+$items  = $_GET['items']  ?? 'all';
+
+if ($search != '') {
+    $list = ItemList::matchingSearch($search, $items == 'bookmarked', $db);
+}
+
+page_head('Item Search'); ?>
+<h1>Item Search</h1>
+<article>
+    <form method=GET action=/search>
+        <label>
+            Search Criteria
+            <input type=text name=search required autofocus value="<?=htmlspecialchars($search)?>">
+        </label>
+        <label>
+            Items to Search
+            <select name=items>
+                <option value=all <?=$items == 'all' ? ' selected' : ''?>>All</option>
+                <option value=bookmarked <?=$items == 'bookmarked' ? ' selected' : ''?>>Bookmarked</option>
+            </select>
+        </label>
+        <span class=break></span>
+        <button type=submit>Search</button>
+    </form><?php
+    if (isset($list)) { ?>
+        <hr><?php
+        $list->render();
+    } ?>
+</article><?php
+page_foot();
+$db->close();
--- a/src/public/user/log-off.php
+++ b/src/public/user/log-off.php
@@ -0,0 +1,10 @@
+<?php
+/**
+ * User Log Off Page
+ */
+
+include '../../start.php';
+
+if (key_exists(Key::USER_ID, $_SESSION)) session_destroy();
+
+frc_redirect('/');
--- a/src/public/user/log-on.php
+++ b/src/public/user/log-on.php
@@ -0,0 +1,40 @@
+<?php
+include '../../start.php';
+
+$db = Data::getConnection();
+Security::verifyUser($db, redirectIfAnonymous: false);
+
+// Users already logged on have no need of this page
+if (key_exists(Key::USER_ID, $_SESSION)) frc_redirect('/');
+
+if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+    Security::logOnUser($_POST['email'] ?? '', $_POST['password'], $_POST['returnTo'] ?? null, $db);
+    // If we're still here, something didn't work; preserve the returnTo parameter
+    $_GET['returnTo'] = $_POST['returnTo'];
+}
+
+$isSingle = SECURITY_MODEL == Security::SINGLE_USER_WITH_PASSWORD;
+
+page_head('Log On'); ?>
+<h1>Log On</h1>
+<article>
+    <form method=POST action=/user/log-on><?php
+        if (($_GET['returnTo'] ?? '') != '') { ?>
+            <input type=hidden name=returnTo value="<?=$_GET['returnTo']?>"><?php
+        }
+        if (!$isSingle) { ?>
+            <label>
+                E-mail Address
+                <input type=email name=email required autofocus>
+            </label><?php
+        } ?>
+        <label>
+            Password
+            <input type=password name=password required<?=$isSingle ? ' autofocus' : ''?>>
+        </label>
+        <span class=break></span>
+        <button type=submit>Log On</button>
+    </form>
+</article><?php
+page_foot();
+$db->close();
--- a/src/start.php
+++ b/src/start.php
@@ -1,18 +1,13 @@
 <?php
 use JetBrains\PhpStorm\NoReturn;

-spl_autoload_register(function ($class) {
-    $file = implode(DIRECTORY_SEPARATOR, [__DIR__, 'lib', "$class.php"]);
-    if (file_exists($file)) {
-        require $file;
-        return true;
-    }
-    return false;
-});
+require 'app-config.php';

-require 'user-config.php';
-
-Data::ensureDb();
+session_start([
+    'name'            => 'FRCSESSION',
+    'use_strict_mode' => true,
+    'cookie_httponly' => true,
+    'cookie_samesite' => 'Strict']);

 /**
 * Add a message to be displayed at the top of the page
@@ -21,8 +16,8 @@ Data::ensureDb();
 * @param string $message The message itself
 */
 function add_message(string $level, string $message): void {
-    if (!array_key_exists(Key::USER_MSG, $_REQUEST)) $_REQUEST[Key::USER_MSG] = array();
-    $_REQUEST[Key::USER_MSG][] = ['level' => $level, 'message' => $message];
+    if (!key_exists(Key::USER_MSG, $_SESSION)) $_SESSION[Key::USER_MSG] = array();
+    $_SESSION[Key::USER_MSG][] = ['level' => $level, 'message' => $message];
 }

 /**
@@ -43,36 +38,87 @@ function add_info(string $message): void {
    add_message('INFO', $message);
 }

+/** @var bool $is_htmx True if this request was initiated by htmx, false if not */
+$is_htmx = key_exists('HTTP_HX_REQUEST', $_SERVER) && !key_exists('HTTP_HX_HISTORY_RESTORE_REQUEST', $_SERVER);
+
+function nav_link(string $link, bool $isFirst = false) {
+    $sep = $isFirst ? '' : ' | ';
+    echo "<span>$sep$link</span>";
+}
+
+/**
+ * Render the title bar for the page
+ */
+function title_bar(): void {
+    $version = match (true) {
+        str_ends_with(FRC_VERSION, '.0.0') => substr(FRC_VERSION, 0, strlen(FRC_VERSION) - 4),
+        str_ends_with(FRC_VERSION, '.0')   => substr(FRC_VERSION, 0, strlen(FRC_VERSION) - 2),
+        default                            => FRC_VERSION
+    }; ?>
+    <header hx-target=#main hx-push-url=true>
+        <div><a href=/ class=title>Feed Reader Central</a><span class=version>v<?=$version?></span></div>
+        <nav><?php
+            if (key_exists(Key::USER_ID, $_SESSION)) {
+                $db = Data::getConnection();
+                try {
+                    $bookQuery = $db->prepare(<<<'SQL'
+                        SELECT EXISTS(
+                            SELECT 1
+                              FROM item INNER JOIN feed ON item.feed_id = feed.id
+                             WHERE feed.user_id = :id AND item.is_bookmarked = 1)
+                        SQL);
+                    $bookQuery->bindValue(':id', $_SESSION[Key::USER_ID]);
+                    $bookResult   = $bookQuery->execute();
+                    $hasBookmarks = $bookResult && $bookResult->fetchArray(SQLITE3_NUM)[0];
+                    nav_link(hx_get('/feeds', 'Feeds'), true);
+                    if ($hasBookmarks) nav_link(hx_get('/?bookmarked', 'Bookmarked'));
+                    nav_link(hx_get('/search', 'Search'));
+                    nav_link(hx_get('/docs/', 'Docs'));
+                    nav_link('<a href=/user/log-off>Log Off</a>');
+                    if ($_SESSION[Key::USER_EMAIL] != Security::SINGLE_USER_EMAIL) {
+                        nav_link($_SESSION[Key::USER_EMAIL]);
+                    }
+                } finally {
+                    $db->close();
+                }
+            } else {
+                nav_link(hx_get('/user/log-on', 'Log On'), true);
+                nav_link(hx_get('/docs/', 'Docs'));
+            } ?>
+        </nav>
+    </header>
+    <main id=main hx-target=this hx-push-url=true hx-swap="innerHTML show:window:top"><?php
+}
+
 /**
 * Render the page title
 * @param string $title The title of the page being displayed
 */
 function page_head(string $title): void {
-    ?><!DOCTYPE html>
+    global $is_htmx;
+    ?>
+<!DOCTYPE html>
 <html lang=en>
 <head>
+    <title><?=$title?> | Feed Reader Central</title><?php
+    if (!$is_htmx) { ?>
        <meta name=viewport content="width=device-width, initial-scale=1">
-    <title><?=$title?> | Feed Reader Central</title>
-    <link href=/assets/style.css rel=stylesheet>
-</head>
-<body>
-<header>
-    <a class=title href="/">Feed Reader Central</a>
-    <div><?php
-        if (array_key_exists(Key::USER_ID, $_REQUEST)) {
-            echo '<a href=/feed?id=new>Add Feed</a>';
-            if ($_REQUEST[Key::USER_EMAIL] != 'solouser@example.com') echo " | {$_REQUEST[Key::USER_EMAIL]}";
+        <meta name=htmx-config content='{"historyCacheSize":0}'>
+        <link href=/assets/style.css rel=stylesheet><?php
    } ?>
-    </div>
-</header>
-<main hx-target=this><?php
-    if (array_key_exists(Key::USER_MSG, $_REQUEST)) {
-        foreach ($_REQUEST[Key::USER_MSG] as $msg) { ?>
-            <div>
+</head>
+<body><?php
+    if (!$is_htmx) title_bar();
+    if (sizeof($messages = $_SESSION[Key::USER_MSG] ?? []) > 0) { ?>
+        <div class=user_messages><?php
+            array_walk($messages, function ($msg) { ?>
+                <div class=user_message>
                    <?=$msg['level'] == 'INFO' ? '' : "<strong>{$msg['level']}</strong><br>"?>
                    <?=$msg['message']?>
                </div><?php
-        }
+            }); ?>
+        </div><?php
+        $_SESSION[Key::USER_MSG] = [];
    }
 }

@@ -80,7 +126,12 @@ function page_head(string $title): void {
 * Render the end of the page
 */
 function page_foot(): void {
-    ?></main></body></html><?php
+    global $is_htmx; ?>
+    </main><?php
+    if (!$is_htmx) echo '<script src=/assets/htmx.min.js></script>'; ?>
+</body>
+</html><?php
+    session_commit();
 }

 /**
@@ -94,8 +145,8 @@ function frc_redirect(string $value): void {
        http_response_code(400);
        die();
    }
-    header("Location: $value");
-    http_response_code(303);
+    session_commit();
+    header("Location: $value", true, 303);
    die();
 }

@@ -112,3 +163,25 @@ function date_time(string $value): string {
        return '(invalid date)';
    }
 }
+
+/**
+ * Create an anchor tag with both `href` and `hx-get` attributes
+ *
+ * @param string $url The URL to which navigation should occur
+ * @param string $text The text for the link
+ * @param string $extraAttrs Extra attributes for the anchor tag (must be attribute-encoded)
+ * @return string The anchor tag with both `href` and `hx-get` attributes
+ */
+function hx_get(string $url, string $text, string $extraAttrs = ''): string {
+    $attrs = $extraAttrs != '' ? " $extraAttrs" : '';
+    return "<a href=\"$url\" hx-get=\"$url\"$attrs>$text</a>";
+}
+
+/**
+ * Return a 404 Not Found
+ */
+#[NoReturn]
+function not_found(): void {
+    http_response_code(404);
+    die('Not Found');
+}
--- a/src/user-config.dist.php
+++ b/src/user-config.dist.php
@@ -3,6 +3,8 @@
 * USER CONFIGURATION ITEMS
 *
 * Editing the values here customizes the behavior of Feed Reader Central
+ *
+ * On initial installation, rename this file to user-config.php and configure it as desired
 */


@@ -11,10 +13,8 @@
 * - Security::SINGLE_USER (no e-mail required, does not require a password)
 * - Security::SINGLE_USER_WITH_PASSWORD (no e-mail required, does require a password)
 * - Security::MULTI_USER (e-mail and password required for all users)
- *
- * (NOTE THAT ONLY SINGLE_USER IS CURRENTLY IMPLEMENTED)
 */
-const SECURITY_MODEL = Security::SINGLE_USER;
+const SECURITY_MODEL = 'CONFIGURE_ME';

 /** The name of the database file where users and feeds should be kept */
 const DATABASE_NAME = 'frc.db';
@@ -26,5 +26,16 @@ const DATABASE_NAME = 'frc.db';
 */
 const DATE_TIME_FORMAT = 'F j, Y \a\t g:ia';

-// END USER CONFIGURATION ITEMS
-//   (editing below this line is not advised)
+/**
+ * How should item purging be done? (Purging never applies to bookmarked items.) Options are:
+ * - Feed::PURGE_NONE - Do not purge items
+ * - Feed::PURGE_READ - Purge all read items whenever purging is run (will not purge unread items)
+ * - Feed::PURGE_BY_DAYS - Purge read and unread items older than a number of days (PURGE_NUMBER below)
+ * - Feed::PURGE_BY_COUNT - Purge read and unread items beyond the number to keep (PURGE_NUMBER below)
+ */
+const PURGE_TYPE = Feed::PURGE_BY_DAYS;
+
+/**
+ * For purge-by-days, how many days of items should be kept; for purge-by-count, how many items should be kept
+ */
+const PURGE_NUMBER = 30;
--- a/src/util/refresh.php
+++ b/src/util/refresh.php
@@ -0,0 +1,53 @@
+<?php
+use JetBrains\PhpStorm\NoReturn;
+
+require __DIR__ . '/../cli-start.php';
+
+cli_title('FEED REFRESH');
+
+if ($argc < 2) display_help();
+
+switch ($argv[1]) {
+    case 'all':
+        refresh_all();
+        break;
+    default:
+        printfn('Unrecognized option "%s"', $argv[1]);
+        display_help();
+}
+
+
+/**
+ * Display the options for this utility and exit
+ */
+#[NoReturn]
+function display_help(): void {
+    printfn('Options:');
+    printfn(' - all');
+    printfn('     Refreshes all feeds');
+    exit(0);
+}
+
+function refresh_all(): void {
+    $db = Data::getConnection();
+
+    try {
+        $feeds = Feed::retrieveAll($db);
+        if (array_key_exists('error', $feeds)) {
+            printfn('SQLite error: %s', $feeds['error']);
+            return;
+        }
+        array_walk($feeds, function ($feed) use ($db) {
+            $result = Feed::refreshFeed($feed['id'], $feed['url'], $db);
+            if (array_key_exists('error', $result)) {
+                printfn('ERR (%s) %s', $feed['email'], $feed['url']);
+                printfn('         %s', $result['error']);
+            } else {
+                printfn('OK  (%s) %s', $feed['email'], $feed['url']);
+            }
+        });
+        printfn(PHP_EOL . 'All feeds refreshed');
+    } finally {
+        $db->close();
+    }
+}
--- a/src/util/search.php
+++ b/src/util/search.php
@@ -0,0 +1,49 @@
+<?php
+use JetBrains\PhpStorm\NoReturn;
+
+require __DIR__ . '/../cli-start.php';
+
+cli_title('SEARCH MAINTENANCE');
+
+if ($argc < 2) display_help();
+
+switch ($argv[1]) {
+    case 'rebuild':
+        rebuild_index();
+        break;
+    default:
+        printfn('Unrecognized option "%s"', $argv[1]);
+        display_help();
+}
+
+
+/**
+ * Display the options for this utility and exit
+ */
+#[NoReturn]
+function display_help(): void {
+    printfn('Options:');
+    printfn(' - rebuild');
+    printfn('     Rebuilds search index');
+    exit(0);
+}
+
+/**
+ * Rebuild the search index, creating it if it does not already exist
+ */
+function rebuild_index(): void {
+    $db = Data::getConnection();
+
+    try {
+        $hasIndex = $db->query("SELECT COUNT(*) FROM sqlite_master WHERE name = 'item_ai'");
+        if ($hasIndex->fetchArray(SQLITE3_NUM)[0] == 0) {
+            printfn('Creating search index....');
+            Data::createSearchIndex($db);
+        }
+        printfn('Rebuilding search index...');
+        $db->exec("INSERT INTO item_search (item_search) VALUES ('rebuild')");
+        printfn(PHP_EOL . 'Search index rebuilt');
+    } finally {
+        $db->close();
+    }
+}
--- a/src/util/user.php
+++ b/src/util/user.php
@@ -0,0 +1,219 @@
+<?php
+use JetBrains\PhpStorm\NoReturn;
+
+require __DIR__ . '/../cli-start.php';
+
+cli_title('USER MAINTENANCE');
+
+if ($argc < 2) display_help();
+
+switch ($argv[1]) {
+    case 'add-user':
+        if ($argc < 4) {
+            printfn('Missing parameters: add-user requires e-mail and password');
+            exit(-1);
+        }
+        add_user();
+        break;
+    case 'set-password':
+        if ($argc < 4) {
+            printfn('Missing parameters: set-password requires e-mail and password');
+            exit(-1);
+        }
+        set_password($argv[2], $argv[3]);
+        break;
+    case 'delete-user':
+        if ($argc < 3) {
+            printfn('Missing parameters: delete-user requires e-mail address');
+            exit(-1);
+        }
+        delete_user($argv[2]);
+        break;
+    case 'set-single-password':
+        if ($argc < 3) {
+            printfn('Missing parameters: set-single-password requires a new password');
+            exit(-1);
+        }
+        set_password(Security::SINGLE_USER_EMAIL, $argv[2]);
+        break;
+    case 'reset-single-password':
+        set_password(Security::SINGLE_USER_EMAIL, Security::SINGLE_USER_PASSWORD);
+        break;
+    case 'migrate-single-user':
+        if ($argc < 4) {
+            printfn('Missing parameters: migrate-single-user requires e-mail and password');
+            exit(-1);
+        }
+        migrate_single_user();
+        break;
+    case 'remove-single-user':
+        delete_user(Security::SINGLE_USER_EMAIL);
+        break;
+    default:
+        printfn('Unrecognized option "%s"', $argv[1]);
+        display_help();
+}
+
+
+/**
+ * Display the options for this utility and exit
+ */
+#[NoReturn]
+function display_help(): void {
+    printfn('Options:');
+    printfn(' - add-user [e-mail] [password]');
+    printfn('     Adds a new user to this instance');
+    printfn(' - set-password [e-mail] [password]');
+    printfn('     Sets the password for the given user');
+    printfn(' - delete-user [e-mail]');
+    printfn('     Deletes a user and all their data' . PHP_EOL);
+    printfn('To assist with changing from single-user to single-user-with-password mode:');
+    printfn(' - set-single-password [password]');
+    printfn('     Sets the password for the single-user mode user');
+    printfn(' - reset-single-password');
+    printfn('     Resets the single-user mode user\'s password to its default' . PHP_EOL);
+    printfn('To assist with changing from single-user to multi-user mode:');
+    printfn(' - migrate-single-user [e-mail] [password]');
+    printfn('     Changes the e-mail address and password for the single-user mode user');
+    printfn(' - remove-single-user');
+    printfn('     Removes the single-user mode user and its data');
+    exit(0);
+}
+
+/**
+ * Add a new user
+ */
+function add_user(): void {
+    global $argv;
+
+    $db = Data::getConnection();
+
+    try {
+        // Ensure there is not already a user with this e-mail address
+        $user = Security::findUserByEmail($argv[2], $db);
+        if ($user) {
+            printfn('A user with e-mail address "%s" already exists', $argv[2]);
+            return;
+        }
+
+        Security::addUser($argv[2], $argv[3], $db);
+
+        printfn('User "%s" with password "%s" added successfully', $argv[2], $argv[3]);
+    } finally {
+        $db->close();
+    }
+}
+
+/**
+ * Get the way we will refer to the user against whom action is being taken
+ *
+ * @param string $email The e-mail address of the user
+ * @return string The string to use when displaying results
+ */
+function display_user(string $email): string {
+    return $email == Security::SINGLE_USER_EMAIL ? 'single-user mode user' : "user \"$email\"";
+}
+
+/**
+ * Set a user's password
+ */
+function set_password(string $email, string $password): void {
+    $db = Data::getConnection();
+    try {
+        $displayUser = display_user($email);
+
+        // Ensure this user exists
+        $user = Security::findUserByEmail($email, $db);
+        if (!$user) {
+            printfn('No %s exists', $displayUser);
+            return;
+        }
+
+        Security::updatePassword($email, $password, $db);
+
+        $msg = $email == Security::SINGLE_USER_EMAIL && $password == Security::SINGLE_USER_PASSWORD
+            ? 'reset' : sprintf('set to "%s"', $password);
+        printfn('%s password %s successfully', init_cap($displayUser), $msg);
+    } finally {
+        $db->close();
+    }
+}
+
+/**
+ * Delete a user
+ *
+ * @param string $email The e-mail address of the user to be deleted
+ */
+function delete_user(string $email): void {
+
+    $db = Data::getConnection();
+
+    try {
+        $displayUser = display_user($email);
+
+        // Get the ID for the provided e-mail address
+        $user = Security::findUserByEmail($email, $db);
+        if (!$user) {
+            printfn('No %s exists', $displayUser);
+            return;
+        }
+
+        $feedCountQuery = $db->prepare('SELECT COUNT(*) FROM feed WHERE user_id = :user');
+        $feedCountQuery->bindValue(':user', $user['id']);
+        $feedCountResult = $feedCountQuery->execute();
+        if (!$feedCountResult) {
+            printfn('SQLite error: %s', $db->lastErrorMsg());
+            return;
+        }
+        $feedCount = $feedCountResult->fetchArray(SQLITE3_NUM);
+
+        $proceed = readline("Delete the $displayUser and their $feedCount[0] feed(s)? (y/N)" . PHP_EOL);
+        if (!$proceed || !str_starts_with(strtolower($proceed), 'y')) {
+            printfn('Deletion canceled');
+            return;
+        }
+
+        $itemDelete = $db->prepare('DELETE FROM item WHERE feed_id IN (SELECT id FROM feed WHERE user_id = :user)');
+        $itemDelete->bindValue(':user', $user['id']);
+        $itemDelete->execute();
+
+        $feedDelete = $db->prepare('DELETE FROM feed WHERE user_id = :user');
+        $feedDelete->bindValue(':user', $user['id']);
+        $feedDelete->execute();
+
+        $userDelete = $db->prepare('DELETE FROM frc_user WHERE id = :user');
+        $userDelete->bindValue(':user', $user['id']);
+        $userDelete->execute();
+
+        printfn('%s deleted successfully', init_cap($displayUser));
+    } finally {
+        $db->close();
+    }
+}
+
+/**
+ * Change the single-user mode user to a different e-mail address and password
+ */
+function migrate_single_user(): void {
+    global $argv;
+
+    $db = Data::getConnection();
+
+    try {
+        $single = Security::findUserByEmail(Security::SINGLE_USER_EMAIL, $db);
+        if (!$single) {
+            printfn('There is no single-user mode user to be migrated');
+            return;
+        }
+
+        $migrateQuery = $db->prepare('UPDATE frc_user SET email = :email, password = :password WHERE id = :id');
+        $migrateQuery->bindValue(':email',    $argv[2]);
+        $migrateQuery->bindValue(':password', password_hash($argv[3], Security::PW_ALGORITHM));
+        $migrateQuery->bindValue(':id',       $single['id']);
+        $migrateQuery->execute();
+
+        printfn('The single user has been moved to "%s", with password "%s"', $argv[2], $argv[3]);
+    } finally {
+        $db->close();
+    }
+}
Author	SHA1	Message	Date
Daniel J. Summers	da34f36530	Merge pull request 'Alpha 7' (#22 ) from alpha-7 into main Reviewed-on: #22	2024-05-26 21:33:12 +00:00
Daniel J. Summers	58dd7a4ffb	Add bookmark item search (#15 ) - Implement form styling throughout - Modify header links for narrower views - Clean up CSS	2024-05-26 16:56:30 -04:00
Daniel J. Summers	9d59bfb1c6	Add search index (#15 ) - Add utility rebuild script - Add Search to header - Add shell of search page - Add search query support to ItemList	2024-05-26 14:18:20 -04:00
Daniel J. Summers	210377b4da	Move list retrieve/render to class (#15 ) - array_key_exists -> key_exists	2024-05-25 23:03:39 -04:00
Daniel J. Summers	c4e85e6734	Link name to bookmarked page (#14 ) - Tweak CSS	2024-05-25 12:31:48 -04:00
Daniel J. Summers	2495136fc9	First cut of read bookmarked item page (#14 ) - Added Bookmarked link to header if items exist	2024-05-23 23:02:07 -04:00
Daniel J. Summers	f4273935cb	Add item bookmark buttons (#14 ) Implemented as a toggle button - Move init_cap func where web can see it - Bump version to alpha7	2024-05-23 22:06:16 -04:00
Daniel J. Summers	4fa4dcb831	Alpha 6: Feed-level Pages (#21 ) Reviewed-on: #21	2024-05-23 23:04:41 +00:00
Daniel J. Summers	93377ffa0e	Merge pull request 'Alpha 5' (#20 ) from add-via-html into main Reviewed-on: #20	2024-04-30 23:46:36 +00:00
Daniel J. Summers	b14399deb8	Add no purge, manual delete options (#12 ) - Add htmx, hx attributes - Only add/update items since last check - Move messages to session to persist across redirects - Polish styles a bit (still WIP)	2024-04-30 18:51:09 -04:00
Daniel J. Summers	d8ba178c55	Add pruning support (#12 )	2024-04-29 23:01:49 -04:00
Daniel J. Summers	473dded4f9	Add docs for scheduled refresh (#11 ) - Add user agent for feed requests	2024-04-28 21:16:42 -04:00
Daniel J. Summers	10638101d3	Add refresh utility script (#11 )	2024-04-28 14:09:53 -04:00
Daniel J. Summers	1826ecd588	Derive feed from HTML (#10 ) - Prevent duplicate feed subscriptions - Move FeedItem to its own file	2024-04-27 22:05:39 -04:00
Daniel J. Summers	27f7a4c7d9	Merge pull request 'Implement remaining security models' (#19 ) from security-models into main Reviewed-on: #19	2024-04-27 23:14:48 +00:00
Daniel J. Summers	2ac4a87865	Rename user config (#18 ) - Update installation instructions	2024-04-27 19:09:13 -04:00
Daniel J. Summers	36373aae01	Add docs for security models (#9 ) - Change default security to CONFIGURE_ME - Fix log on return URL handling - Update INSTALLING security model descriptions	2024-04-27 18:54:57 -04:00
Daniel J. Summers	9611893da3	Add single-user password utils (#9 ) - Constrain images to reading viewport	2024-04-27 16:34:59 -04:00
Daniel J. Summers	0df40f3cfd	Add version to page header	2024-04-27 14:11:31 -04:00
Daniel J. Summers	bf6b2a0ffa	Add single-user handling (#9 ) - Disallow log on for single-user mode user - Improve CLI header display	2024-04-27 13:54:09 -04:00
Daniel J. Summers	c1790b58fd	Add user maintenance CLI (#9 ) - Add CLI infrastructure - Add user to index page query - Strip tags from title - Move item parsing to FeedItem	2024-04-27 13:01:57 -04:00
Daniel J. Summers	7b21b86550	Merge branch 'main' into security-models	2024-04-26 20:49:34 -04:00
Daniel J. Summers	ce83b2a389	Add Atom support (#17 )	2024-04-25 21:19:29 -04:00
Daniel J. Summers	9d476b644b	Remove is_encoded reference (#16 )	2024-04-17 09:03:57 -04:00
Daniel J. Summers	cab26db255	First cut of log on page (#9 ) - Add session support - Refactor security handling to use db connection - Fix db path issue	2024-04-15 23:25:58 -04:00