Phase 5: library & stats

- Full library home page: question list with per-user mastery stats,
  search/source filter, sort (A-Z, weakest first, most-seen), source
  breakdown in header, Take a test CTA.
- GET/POST /questions/{id}: view and edit question text, source, answers;
  radio-select correct answer; shows seen×/correct% stat.
- POST /questions/{id}/delete: hard delete (cascades to answers via FK).
- repo: ListQuestions supports SortWeakest/SortMostSeen via LEFT JOIN;
  added CountBySource, UpdateQuestion, UpdateAnswers, DeleteQuestion.
- render: added pct template func (correct*100/seen).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/server/main.go

@@ -56,8 +56,9 @@ func main() {
 	ensureIcons("web/static")
 
 	authH := handlers.NewAuthHandler(authMgr, repo, renderer)
-	homeH := handlers.NewHomeHandler(authMgr, renderer)
+	homeH := handlers.NewHomeHandler(authMgr, repo, renderer)
 	uploadH := handlers.NewUploadHandler(authMgr, repo, llmClient, renderer, cfg.DataDir)
+	questionH := handlers.NewQuestionHandler(authMgr, repo, renderer)
 
 	r := chi.NewRouter()
 	r.Use(middleware.RequestID)
@@ -85,6 +86,9 @@ func main() {
 		r.Post("/upload", uploadH.UploadPost)
 		r.Get("/import/{id}", uploadH.ImportGet)
 		r.Post("/import/{id}", uploadH.ImportPost)
+		r.Get("/questions/{id}", questionH.Show)
+		r.Post("/questions/{id}", questionH.Edit)
+		r.Post("/questions/{id}/delete", questionH.Delete)
 	})
 
 	srv := &http.Server{

internal/db/repo.go

@@ -149,23 +149,37 @@ func (r *Repo) GetQuestion(id string) (*models.Question, []*models.Answer, error
 }
 
 func (r *Repo) ListQuestions(f ListFilter) ([]*models.Question, error) {
-	var where []string
 	var args []any
 
+	join := ""
+	if f.UserID != 0 && (f.Sort == SortWeakest || f.Sort == SortMostSeen) {
+		join = " LEFT JOIN user_question_stats s ON s.question_id = q.id AND s.user_id = ?"
+		args = append(args, f.UserID)
+	}
+
+	var where []string
 	if f.Source != "" {
-		where = append(where, "source = ?")
+		where = append(where, "q.source = ?")
 		args = append(args, f.Source)
 	}
 	if f.Search != "" {
-		where = append(where, "text LIKE ?")
+		where = append(where, "q.text LIKE ?")
 		args = append(args, "%"+f.Search+"%")
 	}
 
-	query := "SELECT id, text, source, created_at FROM questions"
+	query := "SELECT q.id, q.text, q.source, q.created_at FROM questions q" + join
 	if len(where) > 0 {
 		query += " WHERE " + strings.Join(where, " AND ")
 	}
-	query += " ORDER BY text COLLATE NOCASE ASC"
+
+	switch f.Sort {
+	case SortWeakest:
+		query += " ORDER BY CASE WHEN s.times_seen IS NULL OR s.times_seen = 0 THEN 0.0 ELSE CAST(s.times_correct AS REAL) / s.times_seen END ASC, q.text COLLATE NOCASE ASC"
+	case SortMostSeen:
+		query += " ORDER BY COALESCE(s.times_seen, 0) DESC, q.text COLLATE NOCASE ASC"
+	default:
+		query += " ORDER BY q.text COLLATE NOCASE ASC"
+	}
 
 	rows, err := r.db.Query(query, args...)
 	if err != nil {
@@ -206,6 +220,61 @@ func (r *Repo) ListSources() ([]string, error) {
 	return sources, rows.Err()
 }
 
+// SourceStat holds a source name with its question count.
+type SourceStat struct {
+	Source string
+	Count  int
+}
+
+func (r *Repo) CountBySource() ([]SourceStat, error) {
+	rows, err := r.db.Query(
+		"SELECT source, COUNT(*) FROM questions WHERE source != '' GROUP BY source ORDER BY source",
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var stats []SourceStat
+	for rows.Next() {
+		var s SourceStat
+		if err := rows.Scan(&s.Source, &s.Count); err != nil {
+			return nil, err
+		}
+		stats = append(stats, s)
+	}
+	return stats, rows.Err()
+}
+
+func (r *Repo) UpdateQuestion(id, text, source string) error {
+	_, err := r.db.Exec("UPDATE questions SET text = ?, source = ? WHERE id = ?", text, source, id)
+	return err
+}
+
+// AnswerUpdate carries the fields to write for a single answer row.
+type AnswerUpdate struct {
+	ID        int64
+	Text      string
+	IsCorrect bool
+}
+
+func (r *Repo) UpdateAnswers(updates []AnswerUpdate) error {
+	for _, u := range updates {
+		if _, err := r.db.Exec(
+			"UPDATE answers SET text = ?, is_correct = ? WHERE id = ?",
+			u.Text, u.IsCorrect, u.ID,
+		); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *Repo) DeleteQuestion(id string) error {
+	_, err := r.db.Exec("DELETE FROM questions WHERE id = ?", id)
+	return err
+}
+
 func (r *Repo) CountQuestions() (int, error) {
 	var n int
 	return n, r.db.QueryRow("SELECT COUNT(*) FROM questions").Scan(&n)

internal/handlers/home.go

@@ -1,20 +1,89 @@
 package handlers
 
 import (
+	"log/slog"
 	"net/http"
 
 	"qbank/internal/auth"
+	"qbank/internal/db"
+	"qbank/internal/models"
 )
 
+// QuestionRow pairs a question with its per-user stat for the library display.
+type QuestionRow struct {
+	Q    *models.Question
+	Stat *models.UserQuestionStat // nil = never seen in a test
+}
+
 type HomeHandler struct {
 	auth   *auth.Manager
+	repo   *db.Repo
 	render *Renderer
 }
 
-func NewHomeHandler(a *auth.Manager, r *Renderer) *HomeHandler {
-	return &HomeHandler{auth: a, render: r}
+func NewHomeHandler(a *auth.Manager, repo *db.Repo, r *Renderer) *HomeHandler {
+	return &HomeHandler{auth: a, repo: repo, render: r}
 }
 
 func (h *HomeHandler) Handle(w http.ResponseWriter, r *http.Request) {
-	h.render.Render(w, http.StatusOK, "home", BaseData(h.auth, r))
+	user := auth.UserFromCtx(r.Context())
+
+	sortParam := r.URL.Query().Get("sort")
+	search := r.URL.Query().Get("q")
+	source := r.URL.Query().Get("source")
+
+	var sortOrder db.SortOrder
+	switch sortParam {
+	case "weakest":
+		sortOrder = db.SortWeakest
+	case "seen":
+		sortOrder = db.SortMostSeen
+	default:
+		sortParam = "alpha"
+		sortOrder = db.SortAlpha
+	}
+
+	questions, err := h.repo.ListQuestions(db.ListFilter{
+		Source: source,
+		Search: search,
+		Sort:   sortOrder,
+		UserID: user.ID,
+	})
+	if err != nil {
+		slog.Error("list questions", "err", err)
+		HTTPError(w, http.StatusInternalServerError)
+		return
+	}
+
+	ids := make([]string, len(questions))
+	for i, q := range questions {
+		ids[i] = q.ID
+	}
+
+	stats, err := h.repo.GetStatsForUser(user.ID, ids)
+	if err != nil {
+		slog.Error("get stats", "err", err)
+		HTTPError(w, http.StatusInternalServerError)
+		return
+	}
+
+	rows := make([]QuestionRow, len(questions))
+	for i, q := range questions {
+		rows[i] = QuestionRow{Q: q, Stat: stats[q.ID]}
+	}
+
+	totalQ, _ := h.repo.CountQuestions()
+	totalA, _ := h.repo.CountAnswers()
+	sourceCounts, _ := h.repo.CountBySource()
+
+	data := BaseData(h.auth, r)
+	data["Questions"] = rows
+	data["TotalQ"] = totalQ
+	data["TotalA"] = totalA
+	data["SourceStats"] = sourceCounts
+	data["Sort"] = sortParam
+	data["Search"] = search
+	data["SelectedSource"] = source
+
+	h.render.Render(w, http.StatusOK, "home", data)
 }

internal/handlers/question.go

@@ -0,0 +1,112 @@
+package handlers
+
+import (
+	"fmt"
+	"log/slog"
+	"net/http"
+	"strconv"
+
+	"github.com/go-chi/chi/v5"
+
+	"qbank/internal/auth"
+	"qbank/internal/db"
+)
+
+type QuestionHandler struct {
+	auth   *auth.Manager
+	repo   *db.Repo
+	render *Renderer
+}
+
+func NewQuestionHandler(a *auth.Manager, repo *db.Repo, r *Renderer) *QuestionHandler {
+	return &QuestionHandler{auth: a, repo: repo, render: r}
+}
+
+func (h *QuestionHandler) Show(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+	user := auth.UserFromCtx(r.Context())
+
+	q, answers, err := h.repo.GetQuestion(id)
+	if err != nil {
+		HTTPError(w, http.StatusNotFound)
+		return
+	}
+
+	stats, _ := h.repo.GetStatsForUser(user.ID, []string{id})
+
+	data := BaseData(h.auth, r)
+	data["Question"] = q
+	data["Answers"] = answers
+	data["Stat"] = stats[id]
+
+	h.render.Render(w, http.StatusOK, "question", data)
+}
+
+func (h *QuestionHandler) Edit(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+
+	if !h.auth.CheckCSRF(r) {
+		HTTPError(w, http.StatusForbidden)
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, 1<<20)
+	if err := r.ParseForm(); err != nil {
+		HTTPError(w, http.StatusBadRequest)
+		return
+	}
+
+	_, answers, err := h.repo.GetQuestion(id)
+	if err != nil {
+		HTTPError(w, http.StatusNotFound)
+		return
+	}
+
+	text := r.FormValue("q_text")
+	source := r.FormValue("source")
+	correctIdx, _ := strconv.Atoi(r.FormValue("correct"))
+
+	if err := h.repo.UpdateQuestion(id, text, source); err != nil {
+		slog.Error("update question", "err", err)
+		HTTPError(w, http.StatusInternalServerError)
+		return
+	}
+
+	updates := make([]db.AnswerUpdate, len(answers))
+	for i, a := range answers {
+		updates[i] = db.AnswerUpdate{
+			ID:        a.ID,
+			Text:      r.FormValue(fmt.Sprintf("a_text_%d", i)),
+			IsCorrect: i == correctIdx,
+		}
+	}
+	if err := h.repo.UpdateAnswers(updates); err != nil {
+		slog.Error("update answers", "err", err)
+		HTTPError(w, http.StatusInternalServerError)
+		return
+	}
+
+	h.auth.SetFlash(r, "Question saved.")
+	http.Redirect(w, r, "/questions/"+id, http.StatusSeeOther)
+}
+
+func (h *QuestionHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id := chi.URLParam(r, "id")
+
+	if !h.auth.CheckCSRF(r) {
+		HTTPError(w, http.StatusForbidden)
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, 4096)
+	r.ParseForm()
+
+	if err := h.repo.DeleteQuestion(id); err != nil {
+		slog.Error("delete question", "err", err)
+		HTTPError(w, http.StatusInternalServerError)
+		return
+	}
+
+	h.auth.SetFlash(r, "Question deleted.")
+	http.Redirect(w, r, "/", http.StatusSeeOther)
+}

internal/handlers/render.go

@@ -11,6 +11,12 @@ import (
 
 var tmplFuncs = template.FuncMap{
 	"inc": func(i int) int { return i + 1 },
+	"pct": func(correct, seen int) int {
+		if seen == 0 {
+			return 0
+		}
+		return correct * 100 / seen
+	},
 }
 
 // Renderer parses and executes HTML templates from a directory.

web/templates/home.html

@@ -1,7 +1,79 @@
 {{define "content"}}
-<h1 class="text-2xl font-bold text-gray-800 mb-2">Library</h1>
-<p class="text-gray-500 text-sm">
-  No questions yet.
-  <a href="/upload" class="text-blue-600 hover:underline">Upload a document</a> to get started.
-</p>
+<div class="mb-5 flex items-baseline justify-between">
+  <h1 class="text-2xl font-bold text-gray-800">Library</h1>
+  <a href="/upload" class="text-sm text-blue-600 hover:underline">+ Upload</a>
+</div>
+
+{{if eq .TotalQ 0}}
+<div class="text-center py-16 text-gray-400">
+  <p class="text-lg">No questions yet.</p>
+  <a href="/upload" class="mt-4 inline-block text-blue-600 hover:underline text-sm">Upload a document to get started</a>
+</div>
+{{else}}
+
+<div class="mb-5 text-sm text-gray-500">
+  {{.TotalQ}} question{{if ne .TotalQ 1}}s{{end}} · {{.TotalA}} answer{{if ne .TotalA 1}}s{{end}}
+  {{if .SourceStats}}
+  <span class="mx-1">·</span>
+  {{range $i, $s := .SourceStats}}{{if $i}}<span class="mx-0.5 text-gray-300">|</span>{{end}}<span>{{$s.Source}} ({{$s.Count}})</span>{{end}}
+  {{end}}
+</div>
+
+<form method="get" action="/" class="flex flex-wrap gap-2 mb-4">
+  <input type="text" name="q" value="{{.Search}}" placeholder="Search…"
+         class="flex-1 min-w-0 border border-gray-300 rounded-md px-3 py-1.5 text-sm
+                focus:outline-none focus:ring-2 focus:ring-blue-500">
+  {{if .SourceStats}}
+  <select name="source" onchange="this.form.submit()"
+          class="border border-gray-300 rounded-md px-2 py-1.5 text-sm
+                 focus:outline-none focus:ring-2 focus:ring-blue-500 bg-white">
+    <option value="">All sources</option>
+    {{range .SourceStats}}
+    <option value="{{.Source}}" {{if eq .Source $.SelectedSource}}selected{{end}}>{{.Source}}</option>
+    {{end}}
+  </select>
+  {{end}}
+  <select name="sort" onchange="this.form.submit()"
+          class="border border-gray-300 rounded-md px-2 py-1.5 text-sm
+                 focus:outline-none focus:ring-2 focus:ring-blue-500 bg-white">
+    <option value="alpha" {{if eq .Sort "alpha"}}selected{{end}}>A–Z</option>
+    <option value="weakest" {{if eq .Sort "weakest"}}selected{{end}}>Weakest first</option>
+    <option value="seen" {{if eq .Sort "seen"}}selected{{end}}>Most seen</option>
+  </select>
+  <button type="submit"
+          class="bg-blue-600 hover:bg-blue-700 text-white px-4 py-1.5 rounded-md text-sm font-medium">
+    Search
+  </button>
+</form>
+
+{{if .Questions}}
+<div class="space-y-2">
+  {{range .Questions}}
+  <a href="/questions/{{.Q.ID}}"
+     class="block bg-white border border-gray-200 rounded-lg px-4 py-3 hover:border-blue-300 hover:shadow-sm transition-all">
+    <div class="flex items-start justify-between gap-4">
+      <p class="text-sm text-gray-800 line-clamp-2">{{.Q.Text}}</p>
+      <span class="text-xs text-gray-400 whitespace-nowrap mt-0.5 flex-shrink-0">
+        {{if .Stat}}{{.Stat.TimesSeen}}× · {{pct .Stat.TimesCorrect .Stat.TimesSeen}}%{{else}}—{{end}}
+      </span>
+    </div>
+    {{if .Q.Source}}
+    <p class="text-xs text-gray-400 mt-1">{{.Q.Source}}</p>
+    {{end}}
+  </a>
+  {{end}}
+</div>
+{{else}}
+<p class="text-center py-8 text-gray-400 text-sm">No questions match your filter.</p>
+{{end}}
+
+<div class="mt-6 text-center">
+  <a href="/test/new"
+     class="inline-block bg-blue-600 hover:bg-blue-700 text-white px-8 py-2.5 rounded-md
+            text-sm font-semibold shadow-sm">
+    Take a test
+  </a>
+</div>
+
+{{end}}
 {{end}}

web/templates/question.html

@@ -0,0 +1,71 @@
+{{define "content"}}
+<div class="mb-5 flex items-center justify-between">
+  <a href="/" class="text-sm text-gray-500 hover:underline">← Library</a>
+  {{if .Stat}}
+  <p class="text-xs text-gray-500">
+    Seen {{.Stat.TimesSeen}}× · {{.Stat.TimesCorrect}} correct ({{pct .Stat.TimesCorrect .Stat.TimesSeen}}%)
+  </p>
+  {{else}}
+  <p class="text-xs text-gray-400">Not yet seen in a test</p>
+  {{end}}
+</div>
+
+<form method="post" action="/questions/{{.Question.ID}}" class="space-y-4">
+  <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+
+  <div>
+    <label class="block text-sm font-medium text-gray-700 mb-1">Question</label>
+    <textarea name="q_text" rows="4" required
+              class="w-full border border-gray-300 rounded-md px-3 py-2 text-sm shadow-sm
+                     focus:outline-none focus:ring-2 focus:ring-blue-500 resize-y">{{.Question.Text}}</textarea>
+  </div>
+
+  <div>
+    <label class="block text-sm font-medium text-gray-700 mb-1">Source</label>
+    <input type="text" name="source" value="{{.Question.Source}}"
+           class="w-full border border-gray-300 rounded-md px-3 py-1.5 text-sm shadow-sm
+                  focus:outline-none focus:ring-2 focus:ring-blue-500">
+  </div>
+
+  <div>
+    <label class="block text-sm font-medium text-gray-700 mb-2">Answers</label>
+    <div class="space-y-2">
+      {{range $i, $a := .Answers}}
+      <div class="flex items-center gap-3">
+        <input type="radio" name="correct" value="{{$i}}"
+               {{if $a.IsCorrect}}checked{{end}}
+               class="text-blue-600 focus:ring-blue-500 flex-shrink-0">
+        <input type="text" name="a_text_{{$i}}" value="{{$a.Text}}" required
+               class="flex-1 border border-gray-300 rounded-md px-3 py-1.5 text-sm shadow-sm
+                      focus:outline-none focus:ring-2 focus:ring-blue-500">
+      </div>
+      {{end}}
+    </div>
+    <p class="text-xs text-gray-400 mt-1">Select the radio button next to the correct answer.</p>
+  </div>
+
+  <div class="flex gap-3 pt-2">
+    <button type="submit"
+            class="flex-1 bg-blue-600 hover:bg-blue-700 text-white py-2.5 px-4 rounded-md
+                   text-sm font-semibold shadow-sm">
+      Save changes
+    </button>
+    <a href="/"
+       class="px-4 py-2.5 border border-gray-300 rounded-md text-sm font-medium text-gray-700
+              hover:bg-gray-50 text-center">
+      Cancel
+    </a>
+  </div>
+</form>
+
+<div class="mt-6 pt-6 border-t border-gray-200">
+  <form method="post" action="/questions/{{.Question.ID}}/delete">
+    <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+    <button type="submit"
+            onclick="return confirm('Delete this question? This cannot be undone.')"
+            class="text-sm text-red-600 hover:text-red-800 hover:underline">
+      Delete this question
+    </button>
+  </form>
+</div>
+{{end}}