Release 0.15.4

Also replace functions with lambdas

.github/workflows/release.yml

@@ -0,0 +1,40 @@
+name: release
+
+on:
+  push:
+    tags:
+      - '*.*.*'
+
+jobs:
+  make-release:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: extract version
+        id: version
+        run: echo ::set-output name=VERSION::${GITHUB_REF#refs/tags/}
+      - name: create changelog
+        id: changelog
+        uses: jaywcjlove/changelog-generator@main
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          filter: 'Release \d+\.\d+\.\d+'
+      - name: setup JDK
+        uses: actions/setup-java@v2
+        with:
+          distribution: temurin
+          java-version: 18
+      - name: create dist
+        run: make dist
+      - name: release
+        uses: softprops/action-gh-release@v1
+        with:
+          body: |
+            ${{ steps.changelog.outputs.compareurl }}
+            ${{ steps.changelog.outputs.changelog }}
+          files: target/universal/ffxivbis-*.zip
+          fail_on_unmatched_files: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/run-tests.yml

@@ -0,0 +1,22 @@
+name: tests
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+jobs:
+  run-tests:
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v2
+      - name: setup JDK
+        uses: actions/setup-java@v2
+        with:
+          distribution: temurin
+          java-version: 18
+      - name: run tests
+        run: make tests

.gitignore

@@ -1,96 +1,89 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
+#### joe made this: http://goel.io/joe
 
-# C extensions
-*.so
+#### jetbrains ####
 
-# Distribution / packaging
-.Python
-env/
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-parts/
-sdist/
-*.egg-info/
-.installed.cfg
-*.egg
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and Webstorm
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 
-# PyInstaller
-#  Usually these files are written by a python script from a template
-#  before PyInstaller builds the exe, so as to inject date/other infos into it.
-*.manifest
-*.spec
+# User-specific stuff:
+.idea
 
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
+## File-based project format:
+*.iws
 
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.coverage
-.coverage.*
+## Plugin-specific files:
+
+# IntelliJ
+/out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+#### gradle ####
+
+.gradle
+/build/
+
+# Ignore Gradle GUI config
+gradle-app.setting
+
+# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
+!gradle-wrapper.jar
+
+# Cache of project
+.gradletasknamecache
+
+# # Work around https://youtrack.jetbrains.com/issue/IDEA-116898
+# gradle/wrapper/gradle-wrapper.properties
+
+#### java ####
+
+*.class
+
+# Mobile Tools for Java (J2ME)
+.mtj.tmp/
+
+# Package Files #
+*.jar
+*.war
+*.ear
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+hs_err_pid*
+
+#### scala ####
+
+*.class
+*.log
+
+# sbt specific
 .cache
-nosetests.xml
-coverage.xml
-*,cover
-.hypothesis/
-
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log*
-local_settings.py
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
+.history
+.lib/
+dist/*
 target/
+lib_managed/
+src_managed/
+project/boot/
+project/plugins/project/
+.bsp/
 
-# IPython Notebook
-.ipynb_checkpoints
+# Scala-IDE specific
+.scala_dependencies
+.worksheet
 
-# pyenv
-.python-version
-
-# celery beat schedule file
-celerybeat-schedule
-
-# dotenv
-.env
-
-# virtualenv
-venv/
-ENV/
-
-# Spyder project settings
-.spyderproject
-
-# Rope project settings
-.ropeproject
-
-*.deb
-
-.idea/
-
-.mypy_cache/
-
-/cache
+# ENSIME specific
+.ensime_cache/
+.ensime
 
 *.db
+*.sc

.scalafmt.conf

@@ -0,0 +1,35 @@
+version = 3.3.1
+
+runner.dialect = "scala213"
+
+maxColumn = 120
+
+align.preset = none
+
+continuationIndent {
+    defnSite = 2
+    extendSite = 2
+}
+
+rewrite {
+    rules = [
+        AvoidInfix,
+        RedundantBraces,
+        RedundantParens,
+        SortImports,
+        SortModifiers
+    ]
+
+    redundantBraces {
+        generalExpressions = yes
+        ifElseExpressions = yes
+        includeUnitMethods = yes
+        methodBodies = yes
+        parensForOneLineApply = yes
+        stringInterpolation = yes
+    }
+
+}
+
+importSelectors = singleLine
+trailingCommas = preserve

Makefile

@@ -0,0 +1,35 @@
+.PHONY: check clean compile dist push tests version
+.DEFAULT_GOAL := compile
+
+PROJECT := ffxivbis
+
+check:
+	sbt scalafmtCheck
+
+clean:
+	sbt clean
+
+compile: clean
+	sbt compile
+
+format:
+	sbt scalafmt
+
+dist: tests
+	sbt dist
+
+push: version dist
+	git add version.sbt
+	git commit -m "Release $(VERSION)"
+	git tag "$(VERSION)"
+	git push
+	git push --tags
+
+tests: compile check
+	sbt test
+
+version:
+ifndef VERSION
+	$(error VERSION is required, but not set)
+endif
+	sed -i '/version := "[0-9.]*/s/[^"][^)]*/version := "$(VERSION)"/' version.sbt

README.md

@@ -1,25 +1,24 @@
 # FFXIV BiS
 
-Service which allows to manage savage loot distribution easy.
+[![Build status](https://github.com/arcan1s/ffxivbis/actions/workflows/run-tests.yml/badge.svg)](https://github.com/arcan1s/ffxivbis/actions/workflows/run-tests.yml) ![GitHub release (latest by date)](https://img.shields.io/github/v/release/arcan1s/ffxivbis)
+
+Service which allows managing savage loot distribution easy.
 
 ## Installation and usage
 
-This service requires python >= 3.7. For other dependencies see `setup.py`.
-
-In general installation process looks like:
+In general compilation process looks like:
 
 ```bash
-python setup.py build
-python setup.py test  # if you want to run tests
+sbt dist
 ```
 
-Service can be run from `src` directory by using command:
+Or alternatively you can download the latest distribution zip from the releases page. Service can be run by using command:
 
 ```bash
-python -m service.application.application
+bin/ffxivbis
 ```
 
-To see all available options type `--help`.
+from the extracted archive root.
 
 ## Web service
 
@@ -27,56 +26,6 @@ REST API documentation is available at `http://0.0.0.0:8000/api-docs`. HTML repr
 
 *Note*: host and port depend on configuration settings. 
 
-## Configuration
+## Public service
 
-* `settings` section
-
-    General project settings.
-
-    * `include`: path to include configuration directory, string, optional.
-    * `logging`: path to logging configuration, see `logging.ini` for reference, string, optional.
-    * `database`: database provide name, string, required. Allowed values: `sqlite`, `postgres`.
-    * `priority`: methods of `Player` class which will be called to sort players for loot priority, space separated list of strings, required.
-    
-* `ariyala` section
-
-    Settings related to ariyala parser.
-    
-    * `ariyala_url`: ariyala base url, string, required.
-    * `request_timeout`: xivapi request timeout, float, optional, default 30.
-    * `xivapi_key`: xivapi developer key, string, optional.
-    * `xivapi_url`: xivapi base url, string, required.
-    
-* `auth` section
-
-    Authentication settings.
-    
-    * `enabled`: whether authentication enabled or not, boolean, required.
-    * `root_username`: username of administrator, string, required.
-    * `root_password`: md5 hashed password of administrator, string, required.
-    
-* `postgres` section
-
-    Database settings for `postgres` provider.
-    
-    * `database`: database name, string, required.
-    * `host`: database host, string, required.
-    * `password`: database password, string, required.
-    * `port`: database port, int, required.
-    * `username`: database username, string, required.
-    * `migrations_path`: path to database migrations, string, required.
-    
-* `sqlite` section
-
-    Database settings for `sqlite` provider.
-    
-    * `database_path`: path to sqlite database, string, required.
-    * `migrations_path`: path to database migrations, string, required.
-    
-* `web` section
-
-    Web server related settings.
-    
-    * `host`: address to bind, string, required.
-    * `port`: port to bind, int, required.
-    * `templates`: path to directory with jinja templates, string, required.
+There is also public service which is available at https://ffxivbis.arcanis.me.

TODO.md

@@ -1,3 +0,0 @@
-* [ ] items improvements
-* [ ] multiple parties support
-* [ ] pretty UI

build.sbt

@@ -0,0 +1,9 @@
+organization := "me.arcanis"
+
+name := "ffxivbis"
+
+scalaVersion := "2.13.12"
+
+scalacOptions ++= Seq("-deprecation", "-feature")
+
+enablePlugins(JavaAppPackaging)

extract_items.py

@@ -0,0 +1,56 @@
+import json
+import requests
+
+# NOTE: it does not cover all items, just workaround to extract most gear pieces from patches
+MIN_ILVL = 580
+MAX_ILVL = 605
+
+TOME = (
+    'radiant',
+)
+SAVAGE = (
+    'asphodelos',
+)
+
+
+payload = {
+    'queries': [
+        {
+            'slots': []
+        },
+        {
+            'jobs': [],
+            'minItemLevel': 580,
+            'maxItemLevel': 605
+        }
+    ],
+    'existing': []
+}
+# it does not support application/json
+r = requests.post('https://ffxiv.ariyala.com/items.app', data=json.dumps(payload))
+r.raise_for_status()
+
+result = []
+
+for item in r.json():
+    item_id = item['itemID']
+    source_dict = item['source']
+    name = item['name']['en']
+    if 'crafting' in source_dict:
+        source = 'Crafted'
+    elif 'gathering' in source_dict:
+        continue  # some random shit
+    elif 'purchase' in source_dict:
+        if any(tome in name.lower() for tome in TOME):
+            source = 'Tome'
+        elif any(savage in name.lower() for savage in SAVAGE):
+            source = 'Savage'
+        else:
+            source = None
+            continue
+    else:
+        raise RuntimeError(f'Unknown source {source_dict}')
+    result.append({'id': item_id, 'source': source, 'name': name})
+
+output = {'cached-items': result}
+print(json.dumps(output, indent=4, sort_keys=True))

libraries.sbt

@@ -0,0 +1,33 @@
+val AkkaVersion = "2.8.6"
+val AkkaHttpVersion = "10.5.3"
+val ScalaTestVersion = "3.2.19"
+
+libraryDependencies += "ch.qos.logback" % "logback-classic" % "1.5.6"
+libraryDependencies += "com.typesafe.scala-logging" %% "scala-logging" % "3.9.5"
+
+libraryDependencies += "com.typesafe.akka" %% "akka-http" % AkkaHttpVersion
+libraryDependencies += "com.typesafe.akka" %% "akka-http-spray-json" % AkkaHttpVersion
+libraryDependencies += "com.typesafe.akka" %% "akka-actor-typed" % AkkaVersion
+libraryDependencies += "com.typesafe.akka" %% "akka-stream" % AkkaVersion
+libraryDependencies += "com.github.swagger-akka-http" %% "swagger-akka-http" % "2.11.0"
+libraryDependencies += "jakarta.platform" % "jakarta.jakartaee-web-api" % "10.0.0"
+libraryDependencies += "ch.megard" %% "akka-http-cors" % "1.2.0"
+
+libraryDependencies += "io.spray" %%  "spray-json" % "1.3.6"
+
+libraryDependencies += "org.playframework.anorm" %% "anorm" % "2.7.0"
+libraryDependencies += "com.zaxxer" % "HikariCP" % "5.1.0" exclude("org.slf4j", "slf4j-api")
+libraryDependencies += "org.flywaydb" % "flyway-core" % "9.16.0"
+libraryDependencies += "org.xerial" % "sqlite-jdbc" % "3.46.0.0"
+libraryDependencies += "org.postgresql" % "postgresql" % "42.7.3"
+
+libraryDependencies += "org.mindrot" % "jbcrypt" % "0.4"
+libraryDependencies += "com.google.guava" % "guava" % "31.0.1-jre"
+
+// testing
+libraryDependencies += "org.scalactic" %% "scalactic" % ScalaTestVersion % "test"
+libraryDependencies += "org.scalatest" %% "scalatest" % ScalaTestVersion % "test"
+
+libraryDependencies += "com.typesafe.akka" %% "akka-actor-testkit-typed" % AkkaVersion % "test"
+libraryDependencies += "com.typesafe.akka" %% "akka-stream-testkit" % AkkaVersion % "test"
+libraryDependencies += "com.typesafe.akka" %% "akka-http-testkit" % AkkaHttpVersion % "test"

migrations/20190830_01_sYYZL-init-tables.py

@@ -1,38 +0,0 @@
-'''
-init tables
-'''
-
-from yoyo import step
-
-__depends__ = {}
-
-steps = [
-    step('''create table players (
-        player_id integer primary key,
-        created integer not null,
-        nick text not null,
-        job text not null,
-        bis_link text,
-        priority integer not null default 1
-    )'''),
-    step('''create unique index players_nick_job_idx on players(nick, job)'''),
-
-    step('''create table loot (
-        loot_id integer primary key,
-        player_id integer not null,
-        created integer not null,
-        piece text not null,
-        is_tome integer not null,
-        foreign key (player_id) references players(player_id) on delete cascade
-    )'''),
-    step('''create index loot_owner_idx on loot(player_id)'''),
-
-    step('''create table bis (
-        player_id integer not null,
-        created integer not null,
-        piece text not null,
-        is_tome integer not null,
-        foreign key (player_id) references players(player_id) on delete cascade
-    )'''),
-    step('''create unique index bis_piece_player_id_idx on bis(player_id, piece)''')
-]

migrations/20190910_01_tgBmx-users-table.py

@@ -1,17 +0,0 @@
-'''
-users table
-'''
-
-from yoyo import step
-
-__depends__ = {}
-
-steps = [
-    step('''create table users (
-        user_id integer primary key,
-        username text not null,
-        password text not null,
-        permission text not null
-    )'''),
-    step('''create unique index users_username_idx on users(username)''')
-]

package/ini/ffxivbis.ini

@@ -1,10 +0,0 @@
-[settings]
-include = ffxivbis.ini.d
-logging = ffxivbis.ini.d/logging.ini
-database = sqlite
-priority = is_required loot_count_bis loot_priority loot_count loot_count_total
-
-[web]
-host = 0.0.0.0
-port = 8000
-templates = templates

package/ini/ffxivbis.ini.d/ariyala.ini

@@ -1,4 +0,0 @@
-[ariyala]
-ariyala_url = https://ffxiv.ariyala.com
-request_timeout = 1
-xivapi_url = https://xivapi.com

package/ini/ffxivbis.ini.d/auth.ini

@@ -1,4 +0,0 @@
-[auth]
-enabled = yes
-root_username = admin
-root_password = $1$R3j4sym6$HtvrKOJ66f7w3.9Zc3U6h1

package/ini/ffxivbis.ini.d/logging.ini

@@ -1,44 +0,0 @@
-[loggers]
-keys = root,application,database,http
-
-[handlers]
-keys = file_handler
-
-[formatters]
-keys = generic_format
-
-[handler_console_handler]
-class = StreamHandler
-level = INFO
-formatter = generic_format
-args = (sys.stdout,)
-
-[handler_file_handler]
-class = logging.handlers.RotatingFileHandler
-level = INFO
-formatter = generic_format
-args = ('ffxivbis.log', 'a', 20971520, 20)
-
-[formatter_generic_format]
-format = [%(levelname)s] [%(asctime)s] [%(threadName)s] [%(name)s] [%(funcName)s]: %(message)s
-datefmt =
-
-[logger_root]
-level = INFO
-handlers = file_handler
-qualname = root
-
-[logger_application]
-level = INFO
-handlers = file_handler
-qualname = application
-
-[logger_database]
-level = INFO
-handlers = file_handler
-qualname = database
-
-[logger_http]
-level = INFO
-handlers = file_handler
-qualname = http

package/ini/ffxivbis.ini.d/sqlite.ini

@@ -1,3 +0,0 @@
-[sqlite]
-database_path = /home/arcanis/Documents/github/ffxivbis/ffxivbis.db
-migrations_path = /home/arcanis/Documents/github/ffxivbis/migrations

project/build.properties

@@ -0,0 +1 @@
+sbt.version = 1.7.1

project/plugins.sbt

@@ -0,0 +1,4 @@
+addSbtPlugin("org.scalameta" % "sbt-scalafmt" % "2.4.3")
+addSbtPlugin("org.scoverage" % "sbt-scoverage" % "1.9.3")
+addSbtPlugin("com.typesafe.sbt" % "sbt-native-packager" % "1.3.4")
+addDependencyTreePlugin

setup.cfg

@@ -1,5 +0,0 @@
-[aliases]
-test=pytest
-
-[tool:pytest]
-addopts = --verbose --pyargs .

setup.py

@@ -1,51 +0,0 @@
-from distutils.util import convert_path
-from setuptools import setup, find_packages
-from os import path
-
-
-here = path.abspath(path.dirname(__file__))
-metadata = dict()
-with open(convert_path('src/service/core/version.py')) as metadata_file:
-    exec(metadata_file.read(), metadata)
-
-
-setup(
-    name='ffxivbis',
-
-    version=metadata['__version__'],
-    zip_safe=False,
-
-    description='Helper to handle loot drop',
-
-    author='Evgeniy Alekseev',
-    author_email='i@arcanis.me',
-
-    license='BSD',
-
-    packages=find_packages(exclude=['contrib', 'docs', 'tests']),
-
-    install_requires=[
-        'aiohttp',
-        'aiohttp_jinja2',
-        'aiohttp_security',
-        'apispec',
-        'Jinja2',
-        'passlib',
-        'requests',
-        'yoyo_migrations'
-    ],
-    setup_requires=[
-        'pytest-runner'
-    ],
-    tests_require=[
-        'pytest', 'pytest-aiohttp', 'pytest-asyncio'
-    ],
-
-    include_package_data=True,
-
-    extras_require={
-        'Postgresql': ['aiopg'],
-        'SQLite':  ['aiosqlite'],
-        'test': ['coverage', 'pytest'],
-    },
-)

src/main/resources/db/migration/postgresql/V1_0__Create_tables.sql

@@ -0,0 +1,36 @@
+create table players (
+    party_id text not null,
+    player_id bigserial unique,
+    created bigint not null,
+    nick text not null,
+    job text not null,
+    bis_link text,
+    priority integer not null default 1);
+create unique index players_nick_job_idx on players(party_id, nick, job);
+
+create table loot (
+    loot_id bigserial unique,
+    player_id bigint not null,
+    created bigint not null,
+    piece text not null,
+    is_tome integer not null,
+    job text not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+create index loot_owner_idx on loot(player_id);
+
+create table bis (
+    player_id bigint not null,
+    created bigint not null,
+    piece text not null,
+    is_tome integer not null,
+    job text not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+create unique index bis_piece_player_id_idx on bis(player_id, piece);
+
+create table users (
+    party_id text not null,
+    user_id bigserial unique,
+    username text not null,
+    password text not null,
+    permission text not null);
+create unique index users_username_idx on users(party_id, username);

src/main/resources/db/migration/postgresql/V2_0__Migrate_rings.sql

@@ -0,0 +1,5 @@
+update loot set piece = 'left ring' where piece = 'leftRing';
+update loot set piece = 'right ring' where piece = 'rightRing';
+
+update bis set piece = 'left ring' where piece = 'leftRing';
+update bis set piece = 'right ring' where piece = 'rightRing';

src/main/resources/db/migration/postgresql/V3_0__Party_aliases.sql

@@ -0,0 +1,5 @@
+create table parties (
+    player_id bigserial unique,
+    party_name text not null,
+    party_alias text);
+create unique index parties_party_name_idx on parties(party_name);

src/main/resources/db/migration/postgresql/V4_0__Crafted_items.sql

@@ -0,0 +1,17 @@
+-- loot
+alter table loot add column piece_type text;
+
+update loot set piece_type = 'Tome' where is_tome = 1;
+update loot set piece_type = 'Savage' where is_tome = 0;
+
+alter table loot alter column piece_type set not null;
+alter table loot drop column is_tome;
+
+-- bis
+alter table bis add column piece_type text;
+
+update bis set piece_type = 'Tome' where is_tome = 1;
+update bis set piece_type = 'Savage' where is_tome = 0;
+
+alter table bis alter column piece_type set not null;
+alter table bis drop column is_tome;

src/main/resources/db/migration/postgresql/V5_0__Free_loot.sql

@@ -0,0 +1 @@
+alter table loot add column is_free_loot integer not null default 0;

src/main/resources/db/migration/postgresql/V6_0__Multipieces_bis.sql

@@ -0,0 +1,2 @@
+drop index bis_piece_player_id_idx;
+create index bis_piece_type_player_id_idx on bis(player_id, piece, piece_type);

src/main/resources/db/migration/postgresql/V6_1__Fix_column_name.sql

@@ -0,0 +1 @@
+alter table parties rename column player_id to party_id;

src/main/resources/db/migration/postgresql/V7_0__Unique_bis_type.sql

@@ -0,0 +1,2 @@
+drop index bis_piece_type_player_id_idx;
+create unique index bis_piece_type_player_id_idx on bis(player_id, piece, piece_type);

src/main/resources/db/migration/postgresql/V8_0__Remove_special_characters.sql

@@ -0,0 +1,3 @@
+update parties set party_alias = regexp_replace(party_alias, '[^A-Za-z0-9!@#$%^&*()\-_=+;:'',./? ]', '', 'g');
+update players set nick = regexp_replace(nick, '[^A-Za-z0-9!@#$%^&*()\-_=+;:'',./? ]', '', 'g');
+update users set username = regexp_replace(username, '[^A-Za-z0-9!@#$%^&*()\-_=+;:'',./? ]', '', 'g');

src/main/resources/db/migration/postgresql/V8_1__Set_null_to_links.sql

@@ -0,0 +1 @@
+update players set bis_link = null where bis_link = '';

src/main/resources/db/migration/sqlite/V1_0__Create_tables.sql

@@ -0,0 +1,36 @@
+create table players (
+    party_id text not null,
+    player_id integer primary key autoincrement,
+    created integer not null,
+    nick text not null,
+    job text not null,
+    bis_link text,
+    priority integer not null default 1);
+create unique index players_nick_job_idx on players(party_id, nick, job);
+
+create table loot (
+    loot_id integer primary key autoincrement,
+    player_id integer not null,
+    created integer not null,
+    piece text not null,
+    is_tome integer not null,
+    job text not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+create index loot_owner_idx on loot(player_id);
+
+create table bis (
+    player_id integer not null,
+    created integer not null,
+    piece text not null,
+    is_tome integer not null,
+    job text not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+create unique index bis_piece_player_id_idx on bis(player_id, piece);
+
+create table users (
+    party_id text not null,
+    user_id integer primary key autoincrement,
+    username text not null,
+    password text not null,
+    permission text not null);
+create unique index users_username_idx on users(party_id, username);

src/main/resources/db/migration/sqlite/V2_0__Migrate_rings.sql

@@ -0,0 +1,5 @@
+update loot set piece = 'left ring' where piece = 'leftRing';
+update loot set piece = 'right ring' where piece = 'rightRing';
+
+update bis set piece = 'left ring' where piece = 'leftRing';
+update bis set piece = 'right ring' where piece = 'rightRing';

src/main/resources/db/migration/sqlite/V3_0__Party_aliases.sql

@@ -0,0 +1,5 @@
+create table parties (
+    player_id integer primary key autoincrement,
+    party_name text not null,
+    party_alias text);
+create unique index parties_party_name_idx on parties(party_name);

src/main/resources/db/migration/sqlite/V4_0__Crafted_items.sql

@@ -0,0 +1,42 @@
+-- loot
+alter table loot add column piece_type text;
+
+update loot set piece_type = 'Tome' where is_tome = 1;
+update loot set piece_type = 'Savage' where is_tome = 0;
+
+create table loot_new (
+    loot_id integer primary key autoincrement,
+    player_id integer not null,
+    created integer not null,
+    piece text not null,
+    piece_type text not null,
+    job text not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+insert into loot_new select loot_id, player_id, created, piece, piece_type, job from loot;
+
+drop index loot_owner_idx;
+drop table loot;
+
+alter table loot_new rename to loot;
+create index loot_owner_idx on loot(player_id);
+
+-- bis
+alter table bis add column piece_type text;
+
+update bis set piece_type = 'Tome' where is_tome = 1;
+update bis set piece_type = 'Savage' where is_tome = 0;
+
+create table bis_new (
+    player_id integer not null,
+    created integer not null,
+    piece text not null,
+    piece_type text not null,
+    job text not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+insert into bis_new select player_id, created, piece, piece_type, job from bis;
+
+drop index bis_piece_player_id_idx;
+drop table bis;
+
+alter table bis_new rename to bis;
+create unique index bis_piece_player_id_idx on bis(player_id, piece);

src/main/resources/db/migration/sqlite/V5_0__Free_loot.sql

@@ -0,0 +1,20 @@
+alter table loot add column is_free_loot integer;
+
+update loot set is_free_loot = 0;
+
+create table loot_new (
+    loot_id integer primary key autoincrement,
+    player_id integer not null,
+    created integer not null,
+    piece text not null,
+    piece_type text not null,
+    job text not null,
+    is_free_loot integer not null,
+    foreign key (player_id) references players(player_id) on delete cascade);
+insert into loot_new select loot_id, player_id, created, piece, piece_type, job, is_free_loot from loot;
+
+drop index loot_owner_idx;
+drop table loot;
+
+alter table loot_new rename to loot;
+create index loot_owner_idx on loot(player_id);

src/main/resources/db/migration/sqlite/V6_0__Multipieces_bis.sql

@@ -0,0 +1,2 @@
+drop index bis_piece_player_id_idx;
+create index bis_piece_type_player_id_idx on bis(player_id, piece, piece_type);

src/main/resources/db/migration/sqlite/V6_1__Fix_column_name.sql

@@ -0,0 +1,11 @@
+create table parties_new (
+    party_id integer primary key autoincrement,
+    party_name text not null,
+    party_alias text);
+insert into parties_new select player_id, party_name, party_alias from parties;
+
+drop index parties_party_name_idx;
+drop table parties;
+
+alter table parties_new rename to parties;
+create unique index parties_party_name_idx on parties(party_name);

src/main/resources/db/migration/sqlite/V7_0__Unique_bis_type.sql

@@ -0,0 +1,2 @@
+drop index bis_piece_type_player_id_idx;
+create unique index bis_piece_type_player_id_idx on bis(player_id, piece, piece_type);

src/main/resources/html/api.html

@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>FFXIV loot helper API</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+    <!-- Embed elements Elements via Web Component -->
+    <script src="https://unpkg.com/@stoplight/elements/web-components.min.js"></script>
+    <link rel="stylesheet" href="https://unpkg.com/@stoplight/elements/styles.min.css" type="text/css">
+
+    <link rel="shortcut icon" href="/static/favicon.ico">
+</head>
+<body>
+
+    <elements-api
+            apiDescriptionUrl="/api-docs/swagger.json"
+            router="hash"
+            layout="sidebar"
+    />
+
+</body>
+</html>

src/main/resources/html/bis.html

@@ -0,0 +1,366 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Best in slot</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+
+    <link rel="shortcut icon" href="/static/favicon.ico">
+
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous" type="text/css">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.3/font/bootstrap-icons.css" type="text/css">
+
+    <link rel="stylesheet" href="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.css" type="text/css">
+
+
+    <link rel="stylesheet" href="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.css" type="text/css">
+
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+    <div class="container">
+        <nav class="navbar navbar-expand-lg justify-content-between align-items-center border-bottom">
+            <a class="navbar-brand" id="navbar-title">Party</a>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-bis">best in slot</a>
+                <a class="nav-item nav-link" id="navbar-loot">looted items</a>
+            </ul>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-users">users</a>
+            </ul>
+        </nav>
+    </div>
+
+    <div id="alert-placeholder" class="container"></div>
+
+    <div class="container">
+        <h2>Best in slot</h2>
+    </div>
+
+    <div class="container">
+        <div id="toolbar">
+            <button id="update-btn" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#update-bis-dialog" hidden>
+                <i class="bi bi-plus"></i> update
+            </button>
+            <button class="btn btn-secondary" onclick="reload()">
+                <i class="bi bi-arrow-clockwise"></i> reload
+            </button>
+            <button id="remove-btn" class="btn btn-danger" onclick="removePiece()" disabled hidden>
+                <i class="bi bi-trash"></i> remove
+            </button>
+        </div>
+
+        <table id="bis" class="table table-striped table-hover"
+               data-click-to-select="true"
+               data-export-options='{"fileName": "bis"}'
+               data-page-list="[25, 50, 100, all]"
+               data-page-size="25"
+               data-pagination="true"
+               data-resizable="true"
+               data-search="true"
+               data-show-columns="true"
+               data-show-columns-search="true"
+               data-show-columns-toggle-all="true"
+               data-show-export="true"
+               data-show-fullscreen="true"
+               data-show-search-clear-button="true"
+               data-single-select="true"
+               data-sortable="true"
+               data-sort-name="nick"
+               data-sort-order="asc"
+               data-sort-reset="true"
+               data-toolbar="#toolbar">
+            <thead class="table-primary">
+            <tr>
+                <th data-checkbox="true"></th>
+                <th data-sortable="true" data-switchable="false" data-field="nick">nick</th>
+                <th data-sortable="true" data-switchable="false" data-field="job">job</th>
+                <th data-sortable="true" data-field="piece">piece</th>
+                <th data-sortable="true" data-field="pieceType">piece type</th>
+            </tr>
+            </thead>
+        </table>
+    </div>
+
+    <div id="update-bis-dialog" tabindex="-1" role="dialog" class="modal fade">
+        <div class="modal-dialog" role="document">
+            <form class="modal-content" action="javascript:" onsubmit="updateBis()">
+                <div class="modal-header form-group row">
+                    <div class="btn-group" role="group" aria-label="Update bis">
+                        <input id="add-piece-btn" name="update-bis" type="radio" class="btn-check" autocomplete="off" checked>
+                        <label class="btn btn-outline-primary" for="add-piece-btn">add piece</label>
+
+                        <input id="update-bis-btn" name="update-bis" type="radio" class="btn-check" autocomplete="off">
+                        <label class="btn btn-outline-primary" for="update-bis-btn">update bis</label>
+
+                        <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="close"></button>
+                    </div>
+                </div>
+
+                <div class="modal-body">
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="player">player</label>
+                        <div class="col-sm-8">
+                            <select id="player" name="player" class="form-control" title="player" required></select>
+                        </div>
+                    </div>
+                    <div id="piece-row" class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="piece">piece</label>
+                        <div class="col-sm-8">
+                            <select id="piece" name="piece" class="form-control" title="piece"></select>
+                        </div>
+                    </div>
+                    <div id="piece-type-row" class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="piece-type">piece type</label>
+                        <div class="col-sm-8">
+                            <select id="piece-type" name="pieceType" class="form-control" title="piece-type"></select>
+                        </div>
+                    </div>
+                    <div id="bis-link-row" class="form-group row" style="display: none">
+                        <label class="col-sm-4 col-form-label" for="bis-link">link</label>
+                        <div class="col-sm-8">
+                            <input id="bis-link" name="link" class="form-control" placeholder="link to bis">
+                        </div>
+                    </div>
+
+                    <div class="modal-footer">
+                        <button type="button" class="btn btn-danger" data-bs-dismiss="modal">close</button>
+                        <button id="submit-add-bis-btn" type="submit" class="btn btn-primary">add</button>
+                        <button id="submit-set-bis-btn" type="submit" class="btn btn-primary" style="display: none">set</button>
+                    </div>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <div class="container">
+        <footer class="d-flex flex-wrap justify-content-between align-items-center border-top">
+            <ul class="nav">
+                <li><a class="nav-link" href="/" title="home">home</a></li>
+                <li><a class="nav-link" href="/api-docs" title="api">api</a></li>
+            </ul>
+
+            <ul class="nav">
+                <li><a id="sources-link" class="nav-link" href="https://github.com/arcan1s/ffxivbis" title="sources">ffxivbis</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/releases" title="releases list">releases</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/issues" title="issues tracker">report a bug</a></li>
+            </ul>
+        </footer>
+    </div>
+
+    <script src="https://cdn.jsdelivr.net/npm/jquery/dist/jquery.min.js"></script>
+
+    <script src="https://unpkg.com/tableexport.jquery.plugin/tableExport.min.js"></script>
+
+    <script src="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.min.js"></script>
+
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/export/bootstrap-table-export.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/resizable/bootstrap-table-resizable.js"></script>
+
+    <script src="/static/utils.js"></script>
+    <script src="/static/load.js"></script>
+
+    <script>
+        const [partyId, isReadOnly] = getPartyId();
+        const table = $("#bis");
+        const removeButton = $("#remove-btn");
+        const updateButton = $("#update-btn");
+
+        const submitAddBisButton = $("#submit-add-bis-btn");
+        const submitSetBisButton = $("#submit-set-bis-btn");
+        const updateBisDialog = $("#update-bis-dialog");
+
+        const addPieceButton = $("#add-piece-btn");
+        const updateBisButton = $("#update-bis-btn");
+
+        const bisLinkRow = $("#bis-link-row");
+        const pieceRow = $("#piece-row");
+        const pieceTypeRow = $("#piece-type-row");
+
+        const linkInput = $("#bis-link");
+        const pieceInput = $("#piece");
+        const pieceTypeInput = $("#piece-type");
+        const playerInput = $("#player");
+
+        function addPiece() {
+            const player = getCurrentOption(playerInput);
+            $.ajax({
+                url: `/api/v1/party/${partyId}/bis`,
+                data: JSON.stringify({
+                    action: "add",
+                    piece: {
+                        pieceType: pieceTypeInput.val(),
+                        job: player.dataset.job,
+                        piece: pieceInput.val(),
+                    },
+                    playerId: {
+                        partyId: partyId,
+                        nick: player.dataset.nick,
+                        job: player.dataset.job,
+                    },
+                }),
+                type: "POST",
+                contentType: "application/json",
+                success: _ => { reload(); },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+            updateBisDialog.modal("hide");
+            return true; // action expects boolean result
+        }
+
+        function hideControls() {
+            removeButton.attr("hidden", isReadOnly);
+            updateButton.attr("hidden", isReadOnly);
+        }
+
+        function hideLinkPart() {
+            bisLinkRow.hide();
+            linkInput.prop("required", false);
+            submitSetBisButton.hide();
+            pieceRow.show();
+            pieceTypeRow.show();
+            pieceInput.prop("required", true);
+            pieceTypeInput.prop("required", true);
+            submitAddBisButton.show();
+        }
+
+        function hidePiecePart() {
+            bisLinkRow.show();
+            linkInput.prop("required", true);
+            submitSetBisButton.show();
+            pieceRow.hide();
+            pieceTypeRow.hide();
+            pieceInput.prop("required", false);
+            pieceTypeInput.prop("required", false);
+            submitAddBisButton.hide();
+        }
+
+        function reload() {
+            table.bootstrapTable("showLoading");
+            $.ajax({
+                url: `/api/v1/party/${partyId}`,
+                type: "GET",
+                dataType: "json",
+                success: response => {
+                    const items = response.map(player => {
+                        return player.bis.map(loot => {
+                            return {
+                                nick: player.nick,
+                                job: player.job,
+                                piece: loot.piece,
+                                pieceType: loot.pieceType,
+                            };
+                        });
+                    });
+                    const payload = items.reduce((left, right) => { return left.concat(right); }, []);
+                    table.bootstrapTable("load", payload);
+                    table.bootstrapTable("uncheckAll");
+                    table.bootstrapTable("hideLoading");
+
+                    const options = response.map(player => {
+                        const option = document.createElement("option");
+                        option.innerText = formatPlayerId(player);
+                        option.dataset.nick = player.nick;
+                        option.dataset.job = player.job;
+                        return option;
+                    });
+                    playerInput.empty().append(options);
+                },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function removePiece() {
+            const pieces = table.bootstrapTable("getSelections");
+            pieces.map(loot => {
+                $.ajax({
+                    url: `/api/v1/party/${partyId}/bis`,
+                    data: JSON.stringify({
+                        action: "remove",
+                        piece: {
+                            pieceType: loot.pieceType,
+                            job: loot.job,
+                            piece: loot.piece,
+                        },
+                        playerId: {
+                            partyId: partyId,
+                            job: loot.job,
+                            nick: loot.nick,
+                        },
+                    }),
+                    type: "POST",
+                    contentType: "application/json",
+                    success: _ => { reload(); },
+                    error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+                });
+            });
+        }
+
+        function reset() {
+            if (updateBisButton.is(":checked")) {
+                hidePiecePart();
+            }
+            if (addPieceButton.is(":checked")) {
+                hideLinkPart();
+            }
+        }
+
+        function setBis() {
+            const player = getCurrentOption(playerInput);
+            $.ajax({
+                url: `/api/v1/party/${partyId}/bis`,
+                data: JSON.stringify({
+                    link: linkInput.val(),
+                    playerId: {
+                        partyId: partyId,
+                        nick: player.dataset.nick,
+                        job: player.dataset.job,
+                    },
+                }),
+                type: "PUT",
+                contentType: "application/json",
+                success: _ => { reload(); },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+            updateBisDialog.modal("hide");
+            return true; // action expects boolean result
+        }
+
+        function updateBis() {
+            if (updateBisButton.is(":checked")) {
+                return setBis();
+            }
+            if (addPieceButton.is(":checked")) {
+                return addPiece();
+            }
+            return false; // should not happen
+        }
+
+        $(() => {
+            setupFormClear(updateBisDialog, reset);
+            setupRemoveButton(table, removeButton);
+
+            loadHeader(partyId);
+            loadVersion();
+            loadTypes("/api/v1/types/pieces", pieceInput);
+            loadTypes("/api/v1/types/pieces/types", pieceTypeInput);
+
+            hideControls();
+
+            updateBisButton.click(() => { reset(); });
+            addPieceButton.click(() => { reset(); });
+
+            table.bootstrapTable({});
+            reload();
+            reset();
+        });
+    </script>
+
+</body>
+</html>

src/main/resources/html/index.html

@@ -0,0 +1,190 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>FFXIV loot helper</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+
+    <link rel="shortcut icon" href="/static/favicon.ico">
+
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous" type="text/css">
+
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+
+<body>
+
+    <div id="alert-placeholder" class="container"></div>
+
+    <div class="container mb-5">
+        <div class="form-group row">
+            <div class="btn-group" role="group" aria-label="Sign in">
+                <input id="signin-btn" name="signin" type="radio" class="btn-check" autocomplete="off" checked>
+                <label class="btn btn-outline-primary" for="signin-btn">login to existing party</label>
+
+                <input id="signup-btn" name="signin" type="radio" class="btn-check" autocomplete="off">
+                <label class="btn btn-outline-primary" for="signup-btn">create a new party</label>
+            </div>
+        </div>
+    </div>
+
+    <form id="signup-form" class="container mb-5" style="display: none">
+        <div class="form-group row">
+            <label class="col-sm-2 col-form-label" for="alias">party alias</label>
+            <div class="col-sm-10">
+                <input id="alias" name="alias" class="form-control" placeholder="alias">
+            </div>
+        </div>
+        <div class="form-group row">
+            <label class="col-sm-2 col-form-label" for="username">username</label>
+            <div class="col-sm-10">
+                <input id="username" name="username" class="form-control" placeholder="admin user name" onkeyup="disableAddButton()">
+            </div>
+        </div>
+        <div class="form-group row">
+            <label for="password" class="col-sm-2 col-form-label">password</label>
+            <div class="col-sm-10">
+                <input id="password" name="password" type="password" class="form-control" placeholder="admin password" onkeyup="disableAddButton()">
+            </div>
+        </div>
+        <div class="form-group row">
+            <div class="col-sm-10">
+                <button id="add-btn" type="button" class="btn btn-primary" onclick="createParty()" disabled>add</button>
+            </div>
+        </div>
+    </form>
+
+    <form id="signin-form" class="container mb-5">
+        <div class="form-group row">
+            <label class="col-sm-2 col-form-label" for="party-id">party id</label>
+            <div class="col-sm-10">
+                <input id="party-id" name="partyId" class="form-control" placeholder="id" onkeyup="disableRedirectButton()">
+            </div>
+        </div>
+        <div class="form-group row">
+            <div class="col-sm-10">
+                <button id="redirect-btn" type="button" class="btn btn-primary" onclick="redirectToParty()" disabled>go</button>
+            </div>
+        </div>
+    </form>
+
+    <div class="container">
+        <footer class="d-flex flex-wrap justify-content-between align-items-center border-top">
+            <ul class="nav">
+                <li><a class="nav-link" href="/api-docs" title="api">api</a></li>
+            </ul>
+
+            <ul class="nav">
+                <li><a id="sources-link" class="nav-link" href="https://github.com/arcan1s/ffxivbis" title="sources">ffxivbis</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/releases" title="releases list">releases</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/issues" title="issues tracker">report a bug</a></li>
+            </ul>
+        </footer>
+    </div>
+
+    <script src="https://cdn.jsdelivr.net/npm/jquery/dist/jquery.min.js"></script>
+
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
+
+    <script src="/static/utils.js"></script>
+    <script src="/static/load.js"></script>
+
+    <script>
+        const signinButton = $("#signin-btn");
+        const signupButton = $("#signup-btn");
+
+        const addButton = $("#add-btn");
+        const redirectButton = $("#redirect-btn");
+        const signinForm = $("#signin-form");
+        const signupForm = $("#signup-form");
+
+        const aliasInput = $("#alias");
+        const partyIdInput = $("#party-id");
+        const passwordInput = $("#password");
+        const usernameInput = $("#username");
+
+        function createDescription(partyId) {
+            $.ajax({
+                url: `/api/v1/party/${partyId}/description`,
+                data: JSON.stringify({
+                    partyId: partyId,
+                    partyAlias: aliasInput.val(),
+                }),
+                type: "POST",
+                contentType: "application/json",
+                success: function (_) { doRedirect(partyId); },
+                error: function (jqXHR, _, errorThrown) { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function createParty() {
+            $.ajax({
+                url: `/api/v1/party`,
+                data: JSON.stringify({
+                    partyId: "",
+                    username: usernameInput.val(),
+                    password: passwordInput.val(),
+                    permission: "admin",
+                }),
+                type: "POST",
+                contentType: "application/json",
+                dataType: "json",
+                success: function (data) {
+                    if (aliasInput.val()) {
+                        createDescription(data.partyId);
+                    } else {
+                        doRedirect(data.partyId);
+                    }
+                },
+                error: function (jqXHR, _, errorThrown) { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function disableAddButton() {
+            addButton.attr("disabled", !(passwordInput.val() && usernameInput.val()));
+        }
+
+        function disableRedirectButton() {
+            redirectButton.attr("disabled", !partyIdInput.val());
+        }
+
+        function doRedirect(partyId) {
+            location.href = `/party/${partyId}`;
+        }
+
+        function hideSigninPart() {
+            signinForm.hide();
+            signupForm.show();
+        }
+
+        function hideSignupPart() {
+            signinForm.show();
+            signupForm.hide();
+        }
+
+        function redirectToParty() {
+            return doRedirect(partyIdInput.val());
+        }
+
+        function reset() {
+            signinForm.trigger("reset");
+            signupForm.trigger("reset");
+            if (signinButton.is(":checked")) {
+                hideSignupPart();
+            }
+            if (signupButton.is(":checked")) {
+                hideSigninPart();
+            }
+        }
+
+        $(function () {
+            loadVersion();
+
+            signinButton.click(function () { reset(); });
+            signupButton.click(function () { reset(); });
+        });
+    </script>
+
+</body>
+</html>

src/main/resources/html/loot.html

@@ -0,0 +1,358 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Loot table</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+
+    <link rel="shortcut icon" href="/static/favicon.ico">
+
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous" type="text/css">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.3/font/bootstrap-icons.css" type="text/css">
+
+    <link rel="stylesheet" href="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.css" type="text/css">
+
+
+    <link rel="stylesheet" href="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.css" type="text/css">
+
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+    <div class="container">
+        <nav class="navbar navbar-expand-lg justify-content-between align-items-center border-bottom">
+            <a class="navbar-brand" id="navbar-title">Party</a>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-bis">best in slot</a>
+                <a class="nav-item nav-link" id="navbar-loot">looted items</a>
+            </ul>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-users">users</a>
+            </ul>
+        </nav>
+    </div>
+
+    <div id="alert-placeholder" class="container"></div>
+
+    <div class="container">
+        <h2>Looted items</h2>
+    </div>
+
+    <div class="container">
+        <div id="toolbar">
+            <button id="add-btn" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#add-loot-dialog" hidden>
+                <i class="bi bi-plus"></i> add
+            </button>
+            <button class="btn btn-secondary" onclick="reload()">
+                <i class="bi bi-arrow-clockwise"></i> reload
+            </button>
+            <button id="remove-btn" class="btn btn-danger" onclick="removeLoot()" disabled hidden>
+                <i class="bi bi-trash"></i> remove
+            </button>
+        </div>
+
+        <table id="loot" class="table table-striped table-hover"
+               data-click-to-select="true"
+               data-export-options='{"fileName": "loot"}'
+               data-page-list="[25, 50, 100, all]"
+               data-page-size="25"
+               data-pagination="true"
+               data-resizable="true"
+               data-search="true"
+               data-show-columns="true"
+               data-show-columns-search="true"
+               data-show-columns-toggle-all="true"
+               data-show-export="true"
+               data-show-fullscreen="true"
+               data-show-search-clear-button="true"
+               data-single-select="true"
+               data-sortable="true"
+               data-sort-name="timestamp"
+               data-sort-order="desc"
+               data-sort-reset="true"
+               data-toolbar="#toolbar">
+            <thead class="table-primary">
+            <tr>
+                <th data-checkbox="true"></th>
+                <th data-sortable="true" data-switchable="false" data-field="nick">nick</th>
+                <th data-sortable="true" data-switchable="false" data-field="job">job</th>
+                <th data-sortable="true" data-field="piece">piece</th>
+                <th data-sortable="true" data-field="pieceType">piece type</th>
+                <th data-sortable="true" data-field="isFreeLoot">is free loot</th>
+                <th data-sortable="true" data-field="timestamp">date</th>
+            </tr>
+            </thead>
+        </table>
+    </div>
+
+    <div id="add-loot-dialog" tabindex="-1" role="dialog" class="modal fade">
+        <div class="modal-dialog modal-lg" role="document">
+            <form class="modal-content" action="javascript:" onsubmit="addLootModal()">
+                <div class="modal-header">
+                    <h4 class="modal-title">add looted piece</h4>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="close"></button>
+                </div>
+
+                <div class="modal-body">
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="player">player</label>
+                        <div class="col-sm-8">
+                            <select id="player" name="player" class="form-control" title="player" required></select>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="piece">piece</label>
+                        <div class="col-sm-8">
+                            <select id="piece" name="piece" class="form-control" title="piece" required></select>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="piece-type">piece type</label>
+                        <div class="col-sm-8">
+                            <select id="piece-type" name="pieceType" class="form-control" title="pieceType" required></select>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="job">job</label>
+                        <div class="col-sm-8">
+                            <select id="job" name="job" class="form-control" title="job" required></select>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <div class="col-sm-4"></div>
+                        <div class="col-sm-8">
+                            <div class="form-check">
+                                <input id="free-loot" name="freeLoot" type="checkbox" class="form-check-input">
+                                <label class="form-check-label" for="free-loot">as free loot</label>
+                            </div>
+                        </div>
+                    </div>
+
+                    <table id="stats" class="table table-striped table-hover">
+                        <thead class="table-primary">
+                        <tr>
+                            <th data-formatter="addLootFormatter"></th>
+                            <th data-field="nick">nick</th>
+                            <th data-field="job">job</th>
+                            <th data-field="isRequired">required</th>
+                            <th data-field="lootCount">these pieces looted</th>
+                            <th data-field="lootCountBiS">total bis pieces looted</th>
+                            <th data-field="lootCountTotal">total pieces looted</th>
+                        </tr>
+                        </thead>
+                    </table>
+                </div>
+
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-danger" data-bs-dismiss="modal">close</button>
+                    <button type="button" class="btn btn-secondary" onclick="suggestLoot()">suggest</button>
+                    <button type="submit" class="btn btn-primary">add</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <div class="container">
+        <footer class="d-flex flex-wrap justify-content-between align-items-center border-top">
+            <ul class="nav">
+                <li><a class="nav-link" href="/" title="home">home</a></li>
+                <li><a class="nav-link" href="/api-docs" title="api">api</a></li>
+            </ul>
+
+            <ul class="nav">
+                <li><a id="sources-link" class="nav-link" href="https://github.com/arcan1s/ffxivbis" title="sources">ffxivbis</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/releases" title="releases list">releases</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/issues" title="issues tracker">report a bug</a></li>
+            </ul>
+        </footer>
+    </div>
+
+    <script src="https://cdn.jsdelivr.net/npm/jquery/dist/jquery.min.js"></script>
+
+    <script src="https://unpkg.com/tableexport.jquery.plugin/tableExport.min.js"></script>
+
+    <script src="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.min.js"></script>
+
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/export/bootstrap-table-export.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/resizable/bootstrap-table-resizable.js"></script>
+
+    <script src="/static/utils.js"></script>
+    <script src="/static/load.js"></script>
+
+    <script>
+        const [partyId, isReadOnly] = getPartyId();
+        const table = $("#loot");
+        const stats = $("#stats");
+        const addButton = $("#add-btn");
+        const removeButton = $("#remove-btn");
+
+        const addLootDialog = $("#add-loot-dialog");
+
+        const freeLootInput = $("#free-loot");
+        const jobInput = $("#job");
+        const pieceInput = $("#piece");
+        const pieceTypeInput = $("#piece-type");
+        const playerInput = $("#player");
+
+        function addLoot(nick, job) {
+            $.ajax({
+                url: `/api/v1/party/${partyId}/loot`,
+                data: JSON.stringify({
+                    action: "add",
+                    piece: {
+                        pieceType: pieceTypeInput.val(),
+                        job: job,
+                        piece: pieceInput.val(),
+                    },
+                    playerId: {
+                        partyId: partyId,
+                        nick: nick,
+                        job: job,
+                    },
+                    isFreeLoot: freeLootInput.is(":checked"),
+                }),
+                type: "POST",
+                contentType: "application/json",
+                success: _ => {
+                    addLootDialog.modal("hide");
+                    reload();
+                },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function addLootFormatter(value, row, index) {
+            return `<button type="button" class="btn btn-primary" onclick="addLoot('${row.nick}', '${row.job}')"><i class="bi bi-plus"></i></button>`;
+        }
+
+        function addLootModal() {
+            const player = getCurrentOption(playerInput);
+            addLoot(player.dataset.nick, player.dataset.job);
+            return true; // action expects boolean result
+        }
+
+        function hideControls() {
+            addButton.attr("hidden", isReadOnly);
+            removeButton.attr("hidden", isReadOnly);
+        }
+
+        function reload() {
+            table.bootstrapTable("showLoading");
+            $.ajax({
+                url: `/api/v1/party/${partyId}`,
+                type: "GET",
+                dataType: "json",
+                success: response => {
+                    const items = response.map(player => {
+                        return player.loot.map(loot => {
+                            return {
+                                nick: player.nick,
+                                job: player.job,
+                                piece: loot.piece.piece,
+                                pieceType: loot.piece.pieceType,
+                                isFreeLoot: loot.isFreeLoot ? "yes" : "no",
+                                timestamp: loot.timestamp,
+                            };
+                        });
+                    });
+                    const payload = items.reduce((left, right) => { return left.concat(right); }, []);
+                    table.bootstrapTable("load", payload);
+                    table.bootstrapTable("uncheckAll");
+                    table.bootstrapTable("hideLoading");
+
+                    const options = response.map(player => {
+                        const option = document.createElement("option");
+                        option.innerText = formatPlayerId(player);
+                        option.dataset.nick = player.nick;
+                        option.dataset.job = player.job;
+                        return option;
+                    });
+                    playerInput.empty().append(options);
+                },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function removeLoot() {
+            const pieces = table.bootstrapTable("getSelections");
+            pieces.map(loot => {
+                $.ajax({
+                    url: `/api/v1/party/${partyId}/loot`,
+                    data: JSON.stringify({
+                        action: "remove",
+                        piece: {
+                            pieceType: loot.pieceType,
+                            job: loot.job,
+                            piece: loot.piece,
+                        },
+                        playerId: {
+                            partyId: partyId,
+                            nick: loot.nick,
+                            job: loot.job,
+                        },
+                        isFreeLoot: loot.isFreeLoot === "yes",
+                    }),
+                    type: "POST",
+                    contentType: "application/json",
+                    success: _ => { reload(); },
+                    error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+                });
+            });
+        }
+
+        function suggestLoot() {
+            stats.bootstrapTable("showLoading");
+            $.ajax({
+                url: `/api/v1/party/${partyId}/loot`,
+                data: JSON.stringify({
+                    pieceType: pieceTypeInput.val(),
+                    job: jobInput.val(),
+                    piece: pieceInput.val(),
+                }),
+                type: "PUT",
+                contentType: "application/json",
+                dataType: "json",
+                success: response => {
+                    const payload = response.map(stat => {
+                        return {
+                            nick: stat.nick,
+                            job: stat.job,
+                            isRequired: stat.isRequired ? "yes" : "no",
+                            lootCount: stat.lootCount,
+                            lootCountBiS: stat.lootCountBiS,
+                            lootCountTotal: stat.lootCountTotal,
+                        };
+                    });
+                    stats.bootstrapTable("load", payload);
+                    stats.bootstrapTable("uncheckAll");
+                    stats.bootstrapTable("hideLoading");
+                },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        $(() => {
+            setupFormClear(addLootDialog);
+            setupRemoveButton(table, removeButton);
+
+            loadVersion();
+            loadHeader(partyId);
+            loadTypes("/api/v1/types/jobs/all", jobInput);
+            loadTypes("/api/v1/types/pieces", pieceInput);
+            loadTypes("/api/v1/types/pieces/types", pieceTypeInput);
+
+            hideControls();
+
+            table.bootstrapTable({});
+            stats.bootstrapTable({});
+            reload();
+        });
+    </script>
+
+</body>
+</html>

src/main/resources/html/party.html

@@ -0,0 +1,259 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>FFXIV loot helper</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+
+    <link rel="shortcut icon" href="/static/favicon.ico">
+
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous" type="text/css">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.3/font/bootstrap-icons.css" type="text/css">
+
+    <link rel="stylesheet" href="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.css" type="text/css">
+
+
+    <link rel="stylesheet" href="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.css" type="text/css">
+
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+    <div class="container">
+        <nav class="navbar navbar-expand-lg justify-content-between align-items-center border-bottom">
+            <a class="navbar-brand" id="navbar-title">Party</a>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-bis">best in slot</a>
+                <a class="nav-item nav-link" id="navbar-loot">looted items</a>
+            </ul>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-users">users</a>
+            </ul>
+        </nav>
+    </div>
+
+    <div id="alert-placeholder" class="container"></div>
+
+    <div class="container">
+        <div id="toolbar">
+            <button id="add-btn" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#add-player-dialog" hidden>
+                <i class="bi bi-plus"></i> add
+            </button>
+            <button class="btn btn-secondary" onclick="reload()">
+                <i class="bi bi-arrow-clockwise"></i> reload
+            </button>
+            <button id="remove-btn" class="btn btn-danger" onclick="removePlayers()" disabled hidden>
+                <i class="bi bi-trash"></i> remove
+            </button>
+        </div>
+
+        <table id="players" class="table table-striped table-hover"
+               data-click-to-select="true"
+               data-export-options='{"fileName": "players"}'
+               data-page-list="[25, 50, 100, all]"
+               data-page-size="25"
+               data-pagination="true"
+               data-resizable="true"
+               data-search="true"
+               data-show-columns="true"
+               data-show-columns-search="true"
+               data-show-columns-toggle-all="true"
+               data-show-export="true"
+               data-show-fullscreen="true"
+               data-show-search-clear-button="true"
+               data-single-select="true"
+               data-sortable="true"
+               data-sort-name="nick"
+               data-sort-order="asc"
+               data-sort-reset="true"
+               data-toolbar="#toolbar">
+            <thead class="table-primary">
+                <tr>
+                    <th data-checkbox="true"></th>
+                    <th data-sortable="true" data-switchable="false" data-field="nick">nick</th>
+                    <th data-sortable="true" data-field="job">job</th>
+                    <th data-sortable="true" data-field="link" data-formatter="bisLinkFormatter">best in slot link</th>
+                    <th data-sortable="true" data-field="lootCountBiS">total bis pieces looted</th>
+                    <th data-sortable="true" data-field="lootCountTotal">total pieces looted</th>
+                    <th data-sortable="true" data-field="priority">priority</th>
+                </tr>
+            </thead>
+        </table>
+    </div>
+
+    <div id="add-player-dialog" tabindex="-1" role="dialog" class="modal fade">
+        <div class="modal-dialog" role="document">
+            <form class="modal-content" action="javascript:" onsubmit="addPlayer()">
+                <div class="modal-header">
+                    <h4 class="modal-title">add new player</h4>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="close"></button>
+                </div>
+
+                <div class="modal-body">
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="nick">player name</label>
+                        <div class="col-sm-8">
+                            <input id="nick" name="nick" class="form-control" placeholder="nick" required>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="job">player job</label>
+                        <div class="col-sm-8">
+                            <select id="job" name="job" class="form-control" title="job" required></select>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="link">link to best in slot</label>
+                        <div class="col-sm-8">
+                            <input id="link" name="link" class="form-control" placeholder="link to bis">
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="priority">priority</label>
+                        <div class="col-sm-8">
+                            <input id="priority" name="priority" type="number" class="form-control" value="0">
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-danger" data-bs-dismiss="modal">close</button>
+                    <button type="submit" class="btn btn-primary">add</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <div class="container">
+        <footer class="d-flex flex-wrap justify-content-between align-items-center border-top">
+            <ul class="nav">
+                <li><a class="nav-link" href="/" title="home">home</a></li>
+                <li><a class="nav-link" href="/api-docs" title="api">api</a></li>
+            </ul>
+
+            <ul class="nav">
+                <li><a id="sources-link" class="nav-link" href="https://github.com/arcan1s/ffxivbis" title="sources">ffxivbis</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/releases" title="releases list">releases</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/issues" title="issues tracker">report a bug</a></li>
+            </ul>
+        </footer>
+    </div>
+
+    <script src="https://cdn.jsdelivr.net/npm/jquery/dist/jquery.min.js"></script>
+
+    <script src="https://unpkg.com/tableexport.jquery.plugin/tableExport.min.js"></script>
+
+    <script src="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.min.js"></script>
+
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/export/bootstrap-table-export.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/resizable/bootstrap-table-resizable.js"></script>
+
+    <script src="/static/utils.js"></script>
+    <script src="/static/load.js"></script>
+
+    <script>
+        const [partyId, isReadOnly] = getPartyId();
+        const table = $("#players");
+        const addButton = $("#add-btn");
+        const removeButton = $("#remove-btn");
+
+        const addPlayerDialog = $("#add-player-dialog");
+
+        const jobInput = $("#job");
+        const linkInput = $("#link");
+        const nickInput = $("#nick");
+        const priorityInput = $("#priority");
+
+        function addPlayer() {
+            $.ajax({
+                url: `/api/v1/party/${partyId}`,
+                data: JSON.stringify({
+                    action: "add",
+                    playerId: {
+                        partyId: partyId,
+                        job: jobInput.val(),
+                        nick: nickInput.val(),
+                        link: linkInput.val() || null,
+                        priority: parseInt(priorityInput.val(), 10),
+                    },
+                }),
+                type: "POST",
+                contentType: "application/json",
+                success: _ => { reload(); },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+            addPlayerDialog.modal("hide");
+            return true; // action expects boolean result
+        }
+
+        function bisLinkFormatter(link, row) {
+            if (link) {
+                return `<a href="${safe(link)}" title="${safe(row.nick)} best in slot for ${safe(row.job)}">${safe(link)}</a>`;
+            } else {
+                return "-";
+            }
+        }
+
+        function hideControls() {
+            addButton.attr("hidden", isReadOnly);
+            removeButton.attr("hidden", isReadOnly);
+        }
+
+        function reload() {
+            table.bootstrapTable("showLoading");
+            $.ajax({
+                url: `/api/v1/party/${partyId}`,
+                type: "GET",
+                dataType: "json",
+                success: response => {
+                    table.bootstrapTable("load", response);
+                    table.bootstrapTable("uncheckAll");
+                    table.bootstrapTable("hideLoading");
+                },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function removePlayers() {
+            const players = table.bootstrapTable("getSelections");
+            players.map(player => {
+                $.ajax({
+                    url: `/api/v1/party/${partyId}`,
+                    data: JSON.stringify({
+                        action: "remove",
+                        playerId: {
+                            partyId: partyId,
+                            job: player.job,
+                            nick: player.nick,
+                        },
+                    }),
+                    type: "POST",
+                    contentType: "application/json",
+                    success: _ => { reload(); },
+                    error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+                });
+            });
+        }
+
+        $(() => {
+            setupFormClear(addPlayerDialog);
+            setupRemoveButton(table, removeButton);
+
+            loadVersion();
+            loadHeader(partyId);
+            loadTypes("/api/v1/types/jobs", jobInput);
+
+            hideControls();
+
+            table.bootstrapTable({});
+            reload();
+        });
+    </script>
+
+</body>
+</html>

src/main/resources/html/users.html

@@ -0,0 +1,231 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>User management</title>
+
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+
+    <link rel="shortcut icon" href="/static/favicon.ico">
+
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/css/bootstrap.min.css" integrity="sha384-1BmE4kWBq78iYhFldvKuhfTAU6auU8tT94WrHftjDbrCEXSU1oBoqyl2QvZ6jIW3" crossorigin="anonymous" type="text/css">
+    <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.8.3/font/bootstrap-icons.css" type="text/css">
+
+    <link rel="stylesheet" href="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.css" type="text/css">
+
+
+    <link rel="stylesheet" href="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.css" type="text/css">
+
+    <link rel="stylesheet" href="/static/styles.css" type="text/css">
+</head>
+<body>
+
+    <div class="container">
+        <nav class="navbar navbar-expand-lg justify-content-between align-items-center border-bottom">
+            <a class="navbar-brand" id="navbar-title">Party</a>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-bis">best in slot</a>
+                <a class="nav-item nav-link" id="navbar-loot">looted items</a>
+            </ul>
+            <ul class="navbar-nav">
+                <a class="nav-item nav-link" id="navbar-users">users</a>
+            </ul>
+        </nav>
+    </div>
+
+    <div id="alert-placeholder" class="container"></div>
+
+    <div class="container">
+        <h2>Users</h2>
+    </div>
+
+    <div class="container">
+        <div id="toolbar">
+            <button id="add-btn" class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#add-user-dialog" hidden>
+                <i class="bi bi-plus"></i> add
+            </button>
+            <button class="btn btn-secondary" onclick="reload()">
+                <i class="bi bi-arrow-clockwise"></i> reload
+            </button>
+            <button id="remove-btn" class="btn btn-danger" onclick="removeUsers()" disabled hidden>
+                <i class="bi bi-trash"></i> remove
+            </button>
+        </div>
+
+        <table id="users" class="table table-striped table-hover"
+               data-click-to-select="true"
+               data-export-options='{"fileName": "users"}'
+               data-page-list="[25, 50, 100, all]"
+               data-page-size="25"
+               data-pagination="true"
+               data-resizable="true"
+               data-search="true"
+               data-show-columns="true"
+               data-show-columns-search="true"
+               data-show-columns-toggle-all="true"
+               data-show-export="true"
+               data-show-fullscreen="true"
+               data-show-search-clear-button="true"
+               data-single-select="true"
+               data-sortable="true"
+               data-sort-name="username"
+               data-sort-order="asc"
+               data-sort-reset="true"
+               data-toolbar="#toolbar">
+            <thead class="table-primary">
+            <tr>
+                <th data-checkbox="true"></th>
+                <th data-sortable="true" data-switchable="false" data-field="username">username</th>
+                <th data-sortable="true" data-field="permission">permission</th>
+            </tr>
+            </thead>
+        </table>
+    </div>
+
+    <div id="add-user-dialog" tabindex="-1" role="dialog" class="modal fade">
+        <div class="modal-dialog" role="document">
+            <form class="modal-content" action="javascript:" onsubmit="addUser()">
+                <div class="modal-header">
+                    <h4 class="modal-title">add new user</h4>
+                    <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="close"></button>
+                </div>
+
+                <div class="modal-body">
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="username">login</label>
+                        <div class="col-sm-8">
+                            <input id="username" name="username" class="form-control" placeholder="username" required>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="password">password</label>
+                        <div class="col-sm-8">
+                            <input id="password" name="password" type="password" class="form-control" placeholder="password" required>
+                        </div>
+                    </div>
+                    <div class="form-group row">
+                        <label class="col-sm-4 col-form-label" for="permission">permission</label>
+                        <div class="col-sm-8">
+                            <select id="permission" name="permission" class="form-control" title="permission" required></select>
+                        </div>
+                    </div>
+                </div>
+
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-danger" data-bs-dismiss="modal">close</button>
+                    <button type="submit" class="btn btn-primary">add</button>
+                </div>
+            </form>
+        </div>
+    </div>
+
+    <div class="container">
+        <footer class="d-flex flex-wrap justify-content-between align-items-center border-top">
+            <ul class="nav">
+                <li><a class="nav-link" href="/" title="home">home</a></li>
+                <li><a class="nav-link" href="/api-docs" title="api">api</a></li>
+            </ul>
+
+            <ul class="nav">
+                <li><a id="sources-link" class="nav-link" href="https://github.com/arcan1s/ffxivbis" title="sources">ffxivbis</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/releases" title="releases list">releases</a></li>
+                <li><a class="nav-link" href="https://github.com/arcan1s/ffxivbis/issues" title="issues tracker">report a bug</a></li>
+            </ul>
+        </footer>
+    </div>
+
+    <script src="https://cdn.jsdelivr.net/npm/jquery/dist/jquery.min.js"></script>
+
+    <script src="https://unpkg.com/tableexport.jquery.plugin/tableExport.min.js"></script>
+
+    <script src="https://unpkg.com/jquery-resizable-columns@0.2.3/dist/jquery.resizableColumns.min.js"></script>
+
+    <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.1.3/dist/js/bootstrap.bundle.min.js" integrity="sha384-ka7Sk0Gln4gmtz2MlQnikT1wXgYsOg+OMhuP+IlRH9sENBO0LRn5q+8nbTov4+1p" crossorigin="anonymous"></script>
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/bootstrap-table.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/export/bootstrap-table-export.min.js"></script>
+
+    <script src="https://unpkg.com/bootstrap-table@1.20.2/dist/extensions/resizable/bootstrap-table-resizable.js"></script>
+
+    <script src="/static/utils.js"></script>
+    <script src="/static/load.js"></script>
+
+    <script>
+        const [partyId, isReadOnly] = getPartyId();
+        const table = $("#users");
+        const addButton = $("#add-btn");
+        const removeButton = $("#remove-btn");
+
+        const addUserDialog = $("#add-user-dialog");
+
+        const usernameInput = $("#username");
+        const passwordInput = $("#password");
+        const permissionInput = $("#permission");
+
+        function addUser() {
+            $.ajax({
+                url: `/api/v1/party/${partyId}/users`,
+                data: JSON.stringify({
+                    partyId: partyId,
+                    username: usernameInput.val(),
+                    password: passwordInput.val(),
+                    permission: permissionInput.val(),
+                }),
+                type: "POST",
+                contentType: "application/json",
+                success: _ => { reload(); },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+            addUserDialog.modal("hide");
+            return true; // action expects boolean result
+        }
+
+        function hideControls() {
+            addButton.attr("hidden", isReadOnly);
+            removeButton.attr("hidden", isReadOnly);
+        }
+
+        function reload() {
+            table.bootstrapTable("showLoading");
+            $.ajax({
+                url: `/api/v1/party/${partyId}/users`,
+                type: "GET",
+                dataType: "json",
+                success: response => {
+                    table.bootstrapTable("load", response);
+                    table.bootstrapTable("uncheckAll");
+                    table.bootstrapTable("hideLoading");
+                },
+                error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+            });
+        }
+
+        function removeUsers() {
+            const users = table.bootstrapTable("getSelections");
+            users.map(user => {
+                $.ajax({
+                    url: `/api/v1/party/${partyId}/users/${user.username}`,
+                    type: "DELETE",
+                    success: _ => { reload(); },
+                    error: (jqXHR, _, errorThrown) => { requestAlert(jqXHR, errorThrown); },
+                });
+            });
+        }
+
+        $(() => {
+            setupFormClear(addUserDialog);
+            setupRemoveButton(table, removeButton);
+
+            loadVersion();
+            loadHeader(partyId);
+            loadTypes("/api/v1/types/permissions", permissionInput);
+
+            hideControls();
+
+            table.bootstrapTable({});
+            reload();
+        });
+    </script>
+
+</body>
+</html>

src/main/resources/logback-application.xml

@@ -0,0 +1,27 @@
+<included>
+
+    <appender name="application-base" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <encoder>
+            <pattern>[%-5level %d{yyyy-MM-dd HH:mm:ss.SSS}] [%thread] [%logger{50}]: %msg%n</pattern>
+        </encoder>
+
+        <file>application.log</file>
+
+        <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+            <minIndex>1</minIndex>
+            <maxIndex>20</maxIndex>
+            <fileNamePattern>application.log.%i.gz</fileNamePattern>
+        </rollingPolicy>
+
+        <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+            <maxFileSize>100MB</maxFileSize>
+        </triggeringPolicy>
+    </appender>
+
+    <appender name="application" class="ch.qos.logback.classic.AsyncAppender">
+        <appender-ref ref="application-base"/>
+        <queueSize>50000</queueSize>
+        <neverBlock>true</neverBlock>
+    </appender>
+
+</included>

src/main/resources/logback-http.xml

@@ -0,0 +1,27 @@
+<included>
+
+    <appender name="http-base" class="ch.qos.logback.core.rolling.RollingFileAppender">
+        <encoder>
+            <pattern>%msg%n</pattern>
+        </encoder>
+
+        <file>http.log</file>
+
+        <rollingPolicy class="ch.qos.logback.core.rolling.FixedWindowRollingPolicy">
+            <minIndex>1</minIndex>
+            <maxIndex>20</maxIndex>
+            <fileNamePattern>http.log.%i.gz</fileNamePattern>
+        </rollingPolicy>
+
+        <triggeringPolicy class="ch.qos.logback.core.rolling.SizeBasedTriggeringPolicy">
+            <maxFileSize>100MB</maxFileSize>
+        </triggeringPolicy>
+    </appender>
+
+    <appender name="http" class="ch.qos.logback.classic.AsyncAppender">
+        <appender-ref ref="http-base"/>
+        <queueSize>50000</queueSize>
+        <neverBlock>true</neverBlock>
+    </appender>
+
+</included>

src/main/resources/logback.xml

@@ -0,0 +1,17 @@
+<configuration>
+
+    <include resource="logback-application.xml" />
+    <include resource="logback-http.xml" />
+
+    <root level="DEBUG">
+        <appender-ref ref="application" />
+    </root>
+
+    <logger name="http" level="DEBUG" additivity="false">
+        <appender-ref ref="http" />
+    </logger>
+    <logger name="org.flywaydb.core.internal" level="INFO" />
+    <logger name="com.zaxxer.hikari.pool" level="INFO" />
+    <logger name="io.swagger" level="INFO" />
+
+</configuration>

src/main/resources/reference.conf

@@ -0,0 +1,71 @@
+me.arcanis.ffxivbis {
+
+    bis-provider {
+        include "item_data.json"
+
+        # xivapi base url, string, required
+        xivapi-url = "https://xivapi.com"
+        # xivapi developer key, string, optional
+        #xivapi-key = "abcdef"
+    }
+
+    database {
+        # database section. Section must be declared inside
+        # for more detailed section descriptions refer to slick documentation
+        mode = "sqlite"
+
+        sqlite {
+            driverClassName = "org.sqlite.JDBC"
+            jdbcUrl = "jdbc:sqlite:ffxivbis.db"
+            #username = "user"
+            #password = "password"
+        }
+
+        postgresql {
+            driverClassName = "org.postgresql.Driver"
+            jdbcUrl = "jdbc:postgresql://localhost/ffxivbis"
+            #username = "ffxivbis"
+            #password = "ffxivbis"
+        }
+    }
+
+    settings {
+        # counters of Player class which will be called to sort players for loot priority
+        # list of strings, required
+        priority = [
+            "isRequired", "lootCountBiS", "priority", "lootCount", "lootCountTotal"
+        ]
+        # general request timeout, duratin, required
+        request-timeout = 10s
+        # party in-memory storage lifetime
+        cache-timeout = 1m
+    }
+
+    web {
+        # address to bind, string, required
+        host = "127.0.0.1"
+        # port to bind, int, required
+        port = 8000
+        # hostname to use in docs, if not set host:port will be used
+        #hostname = "127.0.0.1:8000"
+        # enable head requests for GET requests
+        enable-head-requests = yes
+        schemes = ["http"]
+
+        authorization-cache {
+            # maximum amount of cached logins
+            cache-size = 1024
+            # ttl of cached logins
+            cache-timeout = 1m
+        }
+    }
+
+    default-dispatcher {
+        type = Dispatcher
+        executor = "thread-pool-executor"
+        thread-pool-executor {
+            fixed-pool-size = 16
+        }
+        throughput = 1
+    }
+}

src/main/resources/static/load.js

@@ -0,0 +1,64 @@
+function loadHeader(partyId) {
+    const title = $("#navbar-title");
+
+    // because I don't know how to handle relative url if current does not end with slash
+    title.attr("href", `/party/${partyId}`);
+    $("#navbar-bis").attr("href", `/party/${partyId}/bis`);
+    $("#navbar-loot").attr("href", `/party/${partyId}/loot`);
+    $("#navbar-users").attr("href", `/party/${partyId}/users`);
+
+    $.ajax({
+        url: `/api/v1/party/${partyId}/description`,
+        type: "GET",
+        dataType: "json",
+        success: function (resp) {
+            title.text(safe(resp.partyAlias || partyId));
+        },
+        error: function (jqXHR, _, errorThrown) { requestAlert(jqXHR, errorThrown); },
+    });
+}
+
+function loadTypes(url, selector) {
+    $.ajax({
+        url: url,
+        type: "GET",
+        dataType: "json",
+        success: function (data) {
+            const options = data.map(function (name) {
+                const option = document.createElement("option");
+                option.value = name;
+                option.innerText = name;
+                return option;
+            });
+            selector.empty().append(options);
+        },
+        error: function (jqXHR, _, errorThrown) { requestAlert(jqXHR, errorThrown); },
+    });
+}
+
+function loadVersion() {
+    $.ajax({
+        url: "/api/v1/status",
+        type: "GET",
+        dataType: "json",
+        success: function (data) { $("#sources-link").text(`ffxivbis ${data.version}`); },
+        error: function (jqXHR, _, errorThrown) { requestAlert(jqXHR, errorThrown); },
+    });
+}
+
+function setupFormClear(dialog, reset) {
+    dialog.on("hide.bs.modal", function () {
+        $(this).find("form").trigger("reset");
+        $(this).find("table").bootstrapTable("removeAll");
+        if (reset) {
+            reset();
+        }
+    });
+}
+
+function setupRemoveButton(table, removeButton) {
+    table.on("check.bs.table uncheck.bs.table check-all.bs.table uncheck-all.bs.table",
+        function () {
+            removeButton.prop("disabled", !table.bootstrapTable("getSelections").length);
+        });
+}

src/main/resources/static/utils.js

@@ -0,0 +1,44 @@
+function createAlert(message, placeholder) {
+    const wrapper = document.createElement('div');
+    wrapper.innerHTML = `<div class="alert alert-danger alert-dismissible" role="alert">${safe(message)}<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button></div>`;
+    placeholder.append(wrapper);
+}
+
+function formatPlayerId(obj) {
+    return `${obj.nick} (${obj.job})`;
+}
+
+function getCurrentOption(select) {
+    return select.find(":selected")[0];
+}
+
+function getPartyId() {
+    const request = new XMLHttpRequest();
+    request.open("HEAD", document.location, false);
+    request.send(null);
+
+    // tuple lol
+    return [
+        request.getResponseHeader("X-Party-Id"),
+        request.getResponseHeader("X-User-Permission") === "get",
+    ]
+}
+
+function requestAlert(jqXHR, errorThrown) {
+    let message;
+    try {
+        message = $.parseJSON(jqXHR.responseText).message;
+    } catch (_) {
+        message = errorThrown;
+    }
+    const alert = $("#alert-placeholder");
+    createAlert(`Error during request: ${message}`, alert);
+}
+
+function safe(string) {
+    return String(string)
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}

src/main/resources/swagger-info/description.md

@@ -0,0 +1,26 @@
+REST json API description to interact with FFXIV Best-in-slot service.
+
+# Basic workflow
+
+* Create party using `PUT /api/v1/party` endpoint. It consumes username and password of administrator (which can't be restored). As the result it returns unique id of created party.
+* Create new users which have access to this party. Note that user belongs to specific party id and in scope of the specified party it must be unique.
+* Add players with their best in slot sets (probably by using ariyala links).
+* Add loot items if any.
+* By using `PUT /api/v1/party/{partyId}/loot` API find players which are better for the specified loot.
+* Add new loot item to the selected player.
+
+# Limitations
+
+No limitations for the API so far.
+
+# Authentication
+
+For the most party utils service requires user to be authenticated. User permission can be one of `get`, `post` or `admin`.
+
+* `admin` permission means that the user is allowed to do anything, especially this permission is required to be able to add or modify users.
+* `post` permission is required to deal with the most POST API endpoints, but to be precise only endpoints which modifies party content require this permission.
+* `get` permission is required to have access to party.
+
+`admin` permission includes any other permissions, `post` allows to perform get requests.
+
+<security-definitions />

src/main/scala/me/arcanis/ffxivbis/Application.scala

@@ -0,0 +1,72 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis
+
+import akka.actor.typed.scaladsl.{AbstractBehavior, ActorContext, Behaviors}
+import akka.actor.typed.{Behavior, PostStop, Signal}
+import akka.http.scaladsl.Http
+import akka.http.scaladsl.server.Route
+import akka.stream.Materializer
+import com.typesafe.scalalogging.StrictLogging
+import me.arcanis.ffxivbis.http.RootEndpoint
+import me.arcanis.ffxivbis.service.PartyService
+import me.arcanis.ffxivbis.service.bis.BisProvider
+import me.arcanis.ffxivbis.service.database.{Database, Migration}
+
+import scala.concurrent.ExecutionContext
+import scala.jdk.CollectionConverters._
+import scala.util.{Failure, Success}
+
+class Application(context: ActorContext[Nothing]) extends AbstractBehavior[Nothing](context) with StrictLogging {
+
+  logger.info("root supervisor started")
+  startApplication()
+
+  override def onMessage(msg: Nothing): Behavior[Nothing] = Behaviors.unhandled
+
+  override def onSignal: PartialFunction[Signal, Behavior[Nothing]] = { case PostStop =>
+    logger.info("root supervisor stopped")
+    Behaviors.same
+  }
+
+  private def startApplication(): Unit = {
+    val config = context.system.settings.config
+    val host = config.getString("me.arcanis.ffxivbis.web.host")
+    val port = config.getInt("me.arcanis.ffxivbis.web.port")
+
+    implicit val executionContext: ExecutionContext = context.system.executionContext
+    implicit val materializer: Materializer = Materializer(context)
+
+    Migration(config) match {
+      case Success(result) if result.success =>
+        val bisProvider = context.spawn(BisProvider(), "bis-provider")
+        val storage = context.spawn(Database(), "storage")
+        val party = context.spawn(PartyService(storage), "party")
+        val http = new RootEndpoint(context.system, party, bisProvider)
+
+        val flow = Route.toFlow(http.routes)(context.system)
+        Http(context.system).newServerAt(host, port).bindFlow(flow)
+
+      case Success(result) =>
+        logger.error(s"migration completed with error, executed ${result.migrationsExecuted}")
+        result.migrations.asScala.foreach(o => logger.info(s"=> ${o.description} (${o.executionTime})"))
+        context.system.terminate()
+
+      case Failure(exception) =>
+        logger.error("exception during migration", exception)
+        context.system.terminate()
+    }
+  }
+}
+
+object Application {
+
+  def apply(): Behavior[Nothing] =
+    Behaviors.setup[Nothing](context => new Application(context))
+}

src/main/scala/me/arcanis/ffxivbis/Configuration.scala

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis
+
+import com.typesafe.config.{Config, ConfigFactory, ConfigValueFactory}
+
+object Configuration {
+
+  def load(): Config = {
+    val root = ConfigFactory.load()
+    root
+      .withValue(
+        "akka.http.server.transparent-head-requests",
+        ConfigValueFactory.fromAnyRef(root.getBoolean("me.arcanis.ffxivbis.web.enable-head-requests"))
+      )
+  }
+}

src/main/scala/me/arcanis/ffxivbis/ffxivbis.scala

@@ -0,0 +1,16 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis
+
+import akka.actor.typed.ActorSystem
+
+object ffxivbis extends App {
+
+  ActorSystem[Nothing](Application(), "ffxivbis", Configuration.load())
+}

src/main/scala/me/arcanis/ffxivbis/http/Authorization.scala

@@ -0,0 +1,52 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http
+
+import akka.http.scaladsl.model.headers._
+import akka.http.scaladsl.server.AuthenticationFailedRejection._
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import me.arcanis.ffxivbis.models.{Permission, User}
+
+import scala.concurrent.{ExecutionContext, Future}
+
+// idea comes from https://synkre.com/bcrypt-for-akka-http-password-encryption/
+trait Authorization {
+
+  def auth: AuthorizationProvider
+
+  def authenticateBasicBCrypt[T](realm: String, authenticate: (String, String) => Future[Option[T]]): Directive1[T] = {
+    def challenge = HttpChallenges.basic(realm)
+
+    extractCredentials.flatMap {
+      case Some(BasicHttpCredentials(username, password)) =>
+        onSuccess(authenticate(username, password)).flatMap {
+          case Some(client) => provide(client)
+          case None => reject(AuthenticationFailedRejection(CredentialsRejected, challenge))
+        }
+      case _ => reject(AuthenticationFailedRejection(CredentialsMissing, challenge))
+    }
+  }
+
+  def authAdmin(partyId: String)(username: String, password: String)(implicit
+    executionContext: ExecutionContext
+  ): Future[Option[User]] =
+    auth.authenticator(Permission.admin, partyId)(username, password)
+
+  def authGet(partyId: String)(username: String, password: String)(implicit
+    executionContext: ExecutionContext
+  ): Future[Option[User]] =
+    auth.authenticator(Permission.get, partyId)(username, password)
+
+  def authPost(partyId: String)(username: String, password: String)(implicit
+    executionContext: ExecutionContext
+  ): Future[Option[User]] =
+    auth.authenticator(Permission.post, partyId)(username, password)
+
+}

src/main/scala/me/arcanis/ffxivbis/http/AuthorizationProvider.scala

@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http
+
+import akka.actor.typed.scaladsl.AskPattern.Askable
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.util.Timeout
+import com.google.common.cache.{CacheBuilder, CacheLoader, LoadingCache}
+import com.typesafe.config.Config
+import me.arcanis.ffxivbis.messages.DatabaseMessage.GetUser
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.{Permission, User}
+
+import java.util.concurrent.TimeUnit
+import scala.concurrent.{ExecutionContext, Future}
+
+trait AuthorizationProvider {
+
+  def get(partyId: String, username: String): Future[Option[User]]
+
+  def authenticator[T](scope: Permission.Value, partyId: String)(username: String, password: String)(implicit
+    executionContext: ExecutionContext,
+    extractor: User => T
+  ): Future[Option[T]] =
+    get(partyId, username).map {
+      case Some(user) if user.verify(password) && user.verityScope(scope) => Some(extractor(user))
+      case _ => None
+    }
+}
+
+object AuthorizationProvider {
+
+  def apply(config: Config, storage: ActorRef[Message])(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): AuthorizationProvider =
+    new AuthorizationProvider {
+      private val cacheSize = config.getInt("me.arcanis.ffxivbis.web.authorization-cache.cache-size")
+      private val cacheTimeout =
+        config.getDuration("me.arcanis.ffxivbis.web.authorization-cache.cache-timeout", TimeUnit.MILLISECONDS)
+
+      private val cache: LoadingCache[(String, String), Future[Option[User]]] = CacheBuilder
+        .newBuilder()
+        .expireAfterWrite(cacheTimeout, TimeUnit.MILLISECONDS)
+        .maximumSize(cacheSize)
+        .build(
+          new CacheLoader[(String, String), Future[Option[User]]] {
+            override def load(key: (String, String)): Future[Option[User]] = {
+              val (partyId, username) = key
+              storage.ask(GetUser(partyId, username, _))(timeout, scheduler)
+            }
+          }
+        )
+
+      override def get(partyId: String, username: String): Future[Option[User]] =
+        cache.get((partyId, username))
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/HttpLog.scala

@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http
+
+import akka.http.scaladsl.model.headers.{`User-Agent`, Authorization, BasicHttpCredentials, Referer}
+import akka.http.scaladsl.server.Directive0
+import akka.http.scaladsl.server.Directives.{extractClientIP, extractRequestContext, mapResponse, optionalHeaderValueByType}
+import com.typesafe.scalalogging.Logger
+
+import java.time.format.DateTimeFormatter
+import java.time.{Instant, ZoneId}
+import java.util.Locale
+
+trait HttpLog {
+
+  private val httpLogger = Logger("http")
+
+  def withHttpLog: Directive0 =
+    extractRequestContext.flatMap { context =>
+      val request = s"${context.request.method.name()} ${context.request.uri.path}"
+
+      extractClientIP.flatMap { maybeRemoteAddr =>
+        val remoteAddr = maybeRemoteAddr.toIP.getOrElse("-")
+
+        optionalHeaderValueByType(Referer).flatMap { maybeReferer =>
+          val referer = maybeReferer.map(_.uri).getOrElse("-")
+
+          optionalHeaderValueByType(`User-Agent`).flatMap { maybeUserAgent =>
+            val userAgent = maybeUserAgent.map(_.products.map(_.toString()).mkString(" ")).getOrElse("-")
+
+            optionalHeaderValueByType(Authorization).flatMap { maybeAuth =>
+              val remoteUser = maybeAuth
+                .map(_.credentials)
+                .collect { case BasicHttpCredentials(username, _) =>
+                  username
+                }
+                .getOrElse("-")
+
+              val start = Instant.now.toEpochMilli
+              val timeLocal = HttpLog.httpLogDatetimeFormatter.format(Instant.now)
+
+              mapResponse { response =>
+                val time = (Instant.now.toEpochMilli - start) / 1000.0
+
+                val status = response.status.intValue()
+                val bytesSent = response.entity.getContentLengthOption.getAsLong
+
+                httpLogger.debug(
+                  s"""$remoteAddr - $remoteUser [$timeLocal] "$request" $status $bytesSent "$referer" "$userAgent" $time"""
+                )
+                response
+              }
+            }
+          }
+        }
+      }
+    }
+
+}
+
+object HttpLog {
+
+  val httpLogDatetimeFormatter: DateTimeFormatter =
+    DateTimeFormatter
+      .ofPattern("dd/MMM/uuuu:HH:mm:ss xx")
+      .withLocale(Locale.UK)
+      .withZone(ZoneId.systemDefault())
+}

src/main/scala/me/arcanis/ffxivbis/http/RootEndpoint.scala

@@ -0,0 +1,63 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http
+
+import akka.actor.typed.{ActorRef, ActorSystem, Scheduler}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import akka.util.Timeout
+import ch.megard.akka.http.cors.scaladsl.CorsDirectives.cors
+import com.typesafe.scalalogging.StrictLogging
+import me.arcanis.ffxivbis.http.api.v1.RootApiV1Endpoint
+import me.arcanis.ffxivbis.http.view.RootView
+import me.arcanis.ffxivbis.messages.{BiSProviderMessage, Message}
+
+class RootEndpoint(system: ActorSystem[Nothing], storage: ActorRef[Message], provider: ActorRef[BiSProviderMessage])
+  extends StrictLogging
+  with HttpLog {
+  import me.arcanis.ffxivbis.utils.Implicits._
+
+  private val config = system.settings.config
+
+  implicit val scheduler: Scheduler = system.scheduler
+  implicit val timeout: Timeout = config.getTimeout("me.arcanis.ffxivbis.settings.request-timeout")
+
+  private val auth = AuthorizationProvider(config, storage)
+
+  private val rootApiV1Endpoint = new RootApiV1Endpoint(storage, auth, provider, config)
+  private val rootView = new RootView(auth)
+  private val swagger = new Swagger(config)
+
+  def routes: Route =
+    withHttpLog {
+      ignoreTrailingSlash {
+        cors() {
+          apiRoutes ~ htmlRoutes ~ swagger.routes ~ swaggerUIRoutes
+        }
+      }
+    }
+
+  private def apiRoutes: Route =
+    pathPrefix("api") {
+      pathPrefix(Segment) {
+        case "v1" => rootApiV1Endpoint.routes
+        case _ => reject
+      }
+    }
+
+  private def htmlRoutes: Route =
+    pathPrefix("static") {
+      getFromResourceDirectory("static")
+    } ~ rootView.routes
+
+  private def swaggerUIRoutes: Route =
+    path("api-docs") {
+      getFromResource("html/api.html")
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/Swagger.scala

@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http
+
+import com.github.swagger.akka.SwaggerHttpService
+import com.github.swagger.akka.model.{Info, License}
+import com.typesafe.config.Config
+import io.swagger.v3.oas.models.security.SecurityScheme
+
+import scala.io.Source
+import scala.jdk.CollectionConverters._
+
+class Swagger(config: Config) extends SwaggerHttpService {
+
+  override val apiClasses: Set[Class[_]] = Set(
+    classOf[api.v1.BiSEndpoint],
+    classOf[api.v1.LootEndpoint],
+    classOf[api.v1.PartyEndpoint],
+    classOf[api.v1.PlayerEndpoint],
+    classOf[api.v1.StatusEndpoint],
+    classOf[api.v1.TypesEndpoint],
+    classOf[api.v1.UserEndpoint]
+  )
+
+  override val info: Info = Info(
+    description = Source.fromResource("swagger-info/description.md").mkString,
+    version = getClass.getPackage.getImplementationVersion,
+    title = "FFXIV static loot tracker",
+    license = Some(License("BSD", "https://raw.githubusercontent.com/arcan1s/ffxivbis/master/LICENSE"))
+  )
+
+  override val host: String =
+    if (config.hasPath("me.arcanis.ffxivbis.web.hostname")) config.getString("me.arcanis.ffxivbis.web.hostname")
+    else s"${config.getString("me.arcanis.ffxivbis.web.host")}:${config.getInt("me.arcanis.ffxivbis.web.port")}"
+
+  override val schemes: List[String] = config.getStringList("me.arcanis.ffxivbis.web.schemes").asScala.toList
+
+  private val basicAuth = new SecurityScheme()
+    .description("basic http auth")
+    .`type`(SecurityScheme.Type.HTTP)
+    .in(SecurityScheme.In.HEADER)
+    .scheme("basic")
+  override val securitySchemes: Map[String, SecurityScheme] = Map("basic" -> basicAuth)
+
+  override val unwantedDefinitions: Seq[String] =
+    Seq("Function1", "Function1RequestContextFutureRouteResult", "SeqLootModel", "SeqPieceModel")
+}

src/main/scala/me/arcanis/ffxivbis/http/ValidatorHelper.scala

@@ -0,0 +1,16 @@
+package me.arcanis.ffxivbis.http
+
+import scala.collection.immutable.HashSet
+
+trait ValidatorHelper {
+
+  def isValidString(string: String): Boolean = string.nonEmpty && string.forall(isValidSymbol)
+
+  def isValidSymbol(char: Char): Boolean =
+    char.isLetterOrDigit || ValidatorHelper.VALID_CHARACTERS.contains(char)
+}
+
+object ValidatorHelper {
+
+  final val VALID_CHARACTERS = HashSet.from("!@#$%^&*()-_=+;:',./? ")
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/BiSEndpoint.scala

@@ -0,0 +1,234 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.http.scaladsl.model.{HttpEntity, StatusCodes}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import akka.util.Timeout
+import io.swagger.v3.oas.annotations.enums.ParameterIn
+import io.swagger.v3.oas.annotations.media.{ArraySchema, Content, Schema}
+import io.swagger.v3.oas.annotations.parameters.RequestBody
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import io.swagger.v3.oas.annotations.security.SecurityRequirement
+import io.swagger.v3.oas.annotations.{Operation, Parameter}
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+import me.arcanis.ffxivbis.http.helpers.BiSHelper
+import me.arcanis.ffxivbis.http.{Authorization, AuthorizationProvider}
+import me.arcanis.ffxivbis.messages.{BiSProviderMessage, Message}
+import me.arcanis.ffxivbis.models.PlayerId
+
+import scala.util.{Failure, Success}
+
+@Path("/api/v1")
+class BiSEndpoint(
+  override val storage: ActorRef[Message],
+  override val provider: ActorRef[BiSProviderMessage],
+  override val auth: AuthorizationProvider
+)(implicit
+  timeout: Timeout,
+  scheduler: Scheduler
+) extends BiSHelper
+  with Authorization
+  with JsonSupport {
+
+  def routes: Route = createBiS ~ getBiS ~ modifyBiS
+
+  @PUT
+  @Path("party/{partyId}/bis")
+  @Consumes(value = Array("application/json"))
+  @Operation(
+    summary = "create best in slot",
+    description = "Create the best in slot set",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "player best in slot description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[PlayerBiSLinkModel])))
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "201", description = "Best in slot set has been created"),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("post"))),
+    tags = Array("best in slot"),
+  )
+  def createBiS: Route =
+    path("party" / Segment / "bis") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authPost(partyId)) { _ =>
+          put {
+            entity(as[PlayerBiSLinkModel]) { bisLink =>
+              val playerId = bisLink.playerId.withPartyId(partyId)
+              onSuccess(putBiS(playerId, bisLink.link)) {
+                complete(StatusCodes.Created, HttpEntity.Empty)
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @GET
+  @Path("party/{partyId}/bis")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get best in slot",
+    description = "Return the best in slot items",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+      new Parameter(
+        name = "nick",
+        in = ParameterIn.QUERY,
+        description = "player nick name to filter",
+        example = "Siuan Sanche"
+      ),
+      new Parameter(name = "job", in = ParameterIn.QUERY, description = "player job to filter", example = "DNC"),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Best in slot",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[PlayerModel]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("best in slot"),
+  )
+  def getBiS: Route =
+    path("party" / Segment / "bis") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { _ =>
+          get {
+            parameters("nick".as[String].?, "job".as[String].?) { (maybeNick, maybeJob) =>
+              val playerId = PlayerId(partyId, maybeNick, maybeJob)
+              onSuccess(bis(partyId, playerId)) { response =>
+                complete(response.map(PlayerModel.fromPlayer))
+              }
+            }
+          }
+        }
+
+      }
+    }
+
+  @POST
+  @Path("party/{partyId}/bis")
+  @Consumes(value = Array("application/json"))
+  @Operation(
+    summary = "modify best in slot",
+    description = "Add or remove an item from the best in slot",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "action and piece description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[PieceActionModel])))
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "202", description = "Best in slot set has been modified"),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("post"))),
+    tags = Array("best in slot"),
+  )
+  def modifyBiS: Route =
+    path("party" / Segment / "bis") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authPost(partyId)) { _ =>
+          post {
+            entity(as[PieceActionModel]) { action =>
+              val playerId = action.playerId.withPartyId(partyId)
+              onSuccess(doModifyBiS(action.action, playerId, action.piece.toPiece)) {
+                complete(StatusCodes.Accepted, HttpEntity.Empty)
+              }
+            }
+          }
+
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/HttpHandler.scala

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.http.scaladsl.model._
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import ch.megard.akka.http.cors.scaladsl.CorsDirectives.corsRejectionHandler
+import com.typesafe.scalalogging.StrictLogging
+import me.arcanis.ffxivbis.http.api.v1.json._
+import spray.json._
+
+import scala.util.control.NonFatal
+
+trait HttpHandler extends StrictLogging { this: JsonSupport =>
+
+  def exceptionHandler: ExceptionHandler = ExceptionHandler {
+    case exception: IllegalArgumentException =>
+      complete(StatusCodes.BadRequest, ErrorModel(exception.getMessage))
+
+    case NonFatal(other) =>
+      logger.error("exception during request completion", other)
+      complete(StatusCodes.InternalServerError, ErrorModel("unknown server error"))
+  }
+
+  def rejectionHandler: RejectionHandler =
+    RejectionHandler
+      .newBuilder()
+      .handleAll[MethodRejection] { rejections =>
+        val (methods, names) = rejections.map(r => r.supported -> r.supported.name).unzip
+
+        respondWithHeader(headers.Allow(methods)) {
+          options {
+            complete(StatusCodes.OK, HttpEntity.Empty)
+          } ~
+            complete(
+              StatusCodes.MethodNotAllowed,
+              s"HTTP method not allowed, supported methods: ${names.mkString(", ")}"
+            )
+        }
+      }
+      .result()
+      .withFallback(corsRejectionHandler)
+      .seal
+      .mapRejectionResponse {
+        case response @ HttpResponse(_, _, entity: HttpEntity.Strict, _) if entity.data.nonEmpty =>
+          val message = ErrorModel(entity.data.utf8String).toJson
+          response.withEntity(HttpEntity(ContentTypes.`application/json`, message.compactPrint))
+        case other => other
+      }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/LootEndpoint.scala

@@ -0,0 +1,237 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.http.scaladsl.model.{HttpEntity, StatusCodes}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import akka.util.Timeout
+import io.swagger.v3.oas.annotations.enums.ParameterIn
+import io.swagger.v3.oas.annotations.media.{ArraySchema, Content, Schema}
+import io.swagger.v3.oas.annotations.parameters.RequestBody
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import io.swagger.v3.oas.annotations.security.SecurityRequirement
+import io.swagger.v3.oas.annotations.{Operation, Parameter}
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+import me.arcanis.ffxivbis.http.helpers.LootHelper
+import me.arcanis.ffxivbis.http.{Authorization, AuthorizationProvider}
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.PlayerId
+
+import scala.util.{Failure, Success}
+
+@Path("/api/v1")
+class LootEndpoint(override val storage: ActorRef[Message], override val auth: AuthorizationProvider)(implicit
+  timeout: Timeout,
+  scheduler: Scheduler
+) extends LootHelper
+  with Authorization
+  with JsonSupport
+  with HttpHandler {
+
+  def routes: Route = getLoot ~ modifyLoot ~ suggestLoot
+
+  @GET
+  @Path("party/{partyId}/loot")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get loot list",
+    description = "Return the looted items",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+      new Parameter(
+        name = "nick",
+        in = ParameterIn.QUERY,
+        description = "player nick name to filter",
+        example = "Siuan Sanche"
+      ),
+      new Parameter(name = "job", in = ParameterIn.QUERY, description = "player job to filter", example = "DNC"),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Loot list",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[PlayerModel]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("loot"),
+  )
+  def getLoot: Route =
+    path("party" / Segment / "loot") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { _ =>
+          get {
+            parameters("nick".as[String].?, "job".as[String].?) { (maybeNick, maybeJob) =>
+              val playerId = PlayerId(partyId, maybeNick, maybeJob)
+              onSuccess(loot(partyId, playerId)) { response =>
+                complete(response.map(PlayerModel.fromPlayer))
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @POST
+  @Consumes(value = Array("application/json"))
+  @Path("party/{partyId}/loot")
+  @Operation(
+    summary = "modify loot list",
+    description = "Add or remove an item from the loot list",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "action and piece description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[PieceActionModel])))
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "202", description = "Loot list has been modified"),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("post"))),
+    tags = Array("loot"),
+  )
+  def modifyLoot: Route =
+    path("party" / Segment / "loot") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authPost(partyId)) { _ =>
+          post {
+            entity(as[PieceActionModel]) { action =>
+              val playerId = action.playerId.withPartyId(partyId)
+              onSuccess(doModifyLoot(action.action, playerId, action.piece.toPiece, action.isFreeLoot)) {
+                complete(StatusCodes.Accepted, HttpEntity.Empty)
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @PUT
+  @Path("party/{partyId}/loot")
+  @Consumes(value = Array("application/json"))
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "suggest loot",
+    description = "Suggest loot piece to party",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "piece description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[PieceModel])))
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Players with counters ordered by priority to get this item",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[PlayerIdWithCountersModel])),
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("loot"),
+  )
+  def suggestLoot: Route =
+    path("party" / Segment / "loot") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { _ =>
+          put {
+            entity(as[PieceModel]) { piece =>
+              onSuccess(suggestPiece(partyId, piece.toPiece)) { response =>
+                complete(response.map(PlayerIdWithCountersModel.fromPlayerId))
+              }
+            }
+          }
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/PartyEndpoint.scala

@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.http.scaladsl.model.{HttpEntity, StatusCodes}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import akka.util.Timeout
+import io.swagger.v3.oas.annotations.enums.ParameterIn
+import io.swagger.v3.oas.annotations.media.{Content, Schema}
+import io.swagger.v3.oas.annotations.parameters.RequestBody
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import io.swagger.v3.oas.annotations.security.SecurityRequirement
+import io.swagger.v3.oas.annotations.{Operation, Parameter}
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+import me.arcanis.ffxivbis.http.helpers.PlayerHelper
+import me.arcanis.ffxivbis.http.{Authorization, AuthorizationProvider}
+import me.arcanis.ffxivbis.messages.{BiSProviderMessage, Message}
+
+import scala.util.{Failure, Success}
+
+@Path("/api/v1")
+class PartyEndpoint(
+  override val storage: ActorRef[Message],
+  override val provider: ActorRef[BiSProviderMessage],
+  override val auth: AuthorizationProvider
+)(implicit
+  timeout: Timeout,
+  scheduler: Scheduler
+) extends PlayerHelper
+  with Authorization
+  with JsonSupport
+  with HttpHandler {
+
+  def routes: Route = getPartyDescription ~ modifyPartyDescription
+
+  @GET
+  @Path("party/{partyId}/description")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get party description",
+    description = "Return the party description",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Party description",
+        content = Array(new Content(schema = new Schema(implementation = classOf[PartyDescriptionModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("party"),
+  )
+  def getPartyDescription: Route =
+    path("party" / Segment / "description") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { _ =>
+          get {
+            onSuccess(getPartyDescription(partyId)) { response =>
+              complete(PartyDescriptionModel.fromDescription(response))
+            }
+          }
+        }
+      }
+    }
+
+  @POST
+  @Consumes(value = Array("application/json"))
+  @Path("party/{partyId}/description")
+  @Operation(
+    summary = "modify party description",
+    description = "Edit party description",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "new party description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[PartyDescriptionModel])))
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "202", description = "Party description has been modified"),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("post"))),
+    tags = Array("party"),
+  )
+  def modifyPartyDescription: Route =
+    path("party" / Segment / "description") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authPost(partyId)) { _ =>
+          post {
+            entity(as[PartyDescriptionModel]) { partyDescription =>
+              val description = partyDescription.copy(partyId = partyId)
+              onSuccess(updateDescription(description.toDescription)) {
+                complete(StatusCodes.Accepted, HttpEntity.Empty)
+              }
+            }
+          }
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/PlayerEndpoint.scala

@@ -0,0 +1,238 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.http.scaladsl.model.{HttpEntity, StatusCodes}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import akka.util.Timeout
+import io.swagger.v3.oas.annotations.enums.ParameterIn
+import io.swagger.v3.oas.annotations.media.{ArraySchema, Content, Schema}
+import io.swagger.v3.oas.annotations.parameters.RequestBody
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import io.swagger.v3.oas.annotations.security.SecurityRequirement
+import io.swagger.v3.oas.annotations.{Operation, Parameter}
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+import me.arcanis.ffxivbis.http.helpers.PlayerHelper
+import me.arcanis.ffxivbis.http.{Authorization, AuthorizationProvider}
+import me.arcanis.ffxivbis.messages.{BiSProviderMessage, Message}
+import me.arcanis.ffxivbis.models.PlayerId
+
+import scala.util.{Failure, Success}
+
+@Path("/api/v1")
+class PlayerEndpoint(
+  override val storage: ActorRef[Message],
+  override val provider: ActorRef[BiSProviderMessage],
+  override val auth: AuthorizationProvider
+)(implicit
+  timeout: Timeout,
+  scheduler: Scheduler
+) extends PlayerHelper
+  with Authorization
+  with JsonSupport
+  with HttpHandler {
+
+  def routes: Route = getParty ~ getPartyStats ~ modifyParty
+
+  @GET
+  @Path("party/{partyId}")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get party",
+    description = "Return the players who belong to the party",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+      new Parameter(
+        name = "nick",
+        in = ParameterIn.QUERY,
+        description = "player nick name to filter",
+        example = "Siuan Sanche"
+      ),
+      new Parameter(name = "job", in = ParameterIn.QUERY, description = "player job to filter", example = "DNC"),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Players list",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[PlayerModel])),
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("party"),
+  )
+  def getParty: Route =
+    path("party" / Segment) { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { _ =>
+          get {
+            parameters("nick".as[String].?, "job".as[String].?) { (maybeNick, maybeJob) =>
+              val playerId = PlayerId(partyId, maybeNick, maybeJob)
+              onSuccess(getPlayers(partyId, playerId)) { response =>
+                complete(response.map(PlayerModel.fromPlayer))
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @GET
+  @Path("party/{partyId}/stats")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get party statistics",
+    description = "Return the party statistics",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+      new Parameter(
+        name = "nick",
+        in = ParameterIn.QUERY,
+        description = "player nick name to filter",
+        example = "Siuan Sanche"
+      ),
+      new Parameter(name = "job", in = ParameterIn.QUERY, description = "player job to filter", example = "DNC"),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Party loot statistics",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[PlayerIdWithCountersModel])),
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("party"),
+  )
+  def getPartyStats: Route =
+    path("party" / Segment / "stats") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { _ =>
+          get {
+            parameters("nick".as[String].?, "job".as[String].?) { (maybeNick, maybeJob) =>
+              val playerId = PlayerId(partyId, maybeNick, maybeJob)
+              onSuccess(getPlayers(partyId, playerId)) { response =>
+                complete(response.map(player => PlayerIdWithCountersModel.fromPlayerId(player.withCounters(None))))
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @POST
+  @Path("party/{partyId}")
+  @Consumes(value = Array("application/json"))
+  @Operation(
+    summary = "modify party",
+    description = "Add or remove a player from party list",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "player description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[PlayerActionModel])))
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "202", description = "Party has been modified"),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("post"))),
+    tags = Array("party"),
+  )
+  def modifyParty: Route =
+    path("party" / Segment) { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authPost(partyId)) { _ =>
+          post {
+            entity(as[PlayerActionModel]) { action =>
+              val player = action.playerId.toPlayer.copy(partyId = partyId)
+              onSuccess(doModifyPlayer(action.action, player)) {
+                complete(StatusCodes.Accepted, HttpEntity.Empty)
+              }
+            }
+          }
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/RootApiV1Endpoint.scala

@@ -0,0 +1,46 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server.Route
+import akka.util.Timeout
+import com.typesafe.config.Config
+import me.arcanis.ffxivbis.http.AuthorizationProvider
+import me.arcanis.ffxivbis.http.api.v1.json.JsonSupport
+import me.arcanis.ffxivbis.messages.{BiSProviderMessage, Message}
+
+class RootApiV1Endpoint(
+  storage: ActorRef[Message],
+  auth: AuthorizationProvider,
+  provider: ActorRef[BiSProviderMessage],
+  config: Config
+)(implicit
+  timeout: Timeout,
+  scheduler: Scheduler
+) extends JsonSupport
+  with HttpHandler {
+
+  private val biSEndpoint = new BiSEndpoint(storage, provider, auth)
+  private val lootEndpoint = new LootEndpoint(storage, auth)
+  private val partyEndpoint = new PartyEndpoint(storage, provider, auth)
+  private val playerEndpoint = new PlayerEndpoint(storage, provider, auth)
+  private val statusEndpoint = new StatusEndpoint
+  private val typesEndpoint = new TypesEndpoint(config)
+  private val userEndpoint = new UserEndpoint(storage, auth)
+
+  def routes: Route =
+    handleExceptions(exceptionHandler) {
+      handleRejections(rejectionHandler) {
+        biSEndpoint.routes ~ lootEndpoint.routes ~ partyEndpoint.routes ~ playerEndpoint.routes ~
+          statusEndpoint.routes ~ typesEndpoint.routes ~ userEndpoint.routes
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/StatusEndpoint.scala

@@ -0,0 +1,54 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.media.{Content, Schema}
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+
+@Path("/api/v1")
+class StatusEndpoint extends JsonSupport {
+
+  def routes: Route = getServerStatus
+
+  @GET
+  @Path("status")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "server status",
+    description = "Returns the server status descriptor",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Service status descriptor",
+        content = Array(new Content(schema = new Schema(implementation = classOf[StatusModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("status"),
+  )
+  def getServerStatus: Route =
+    path("status") {
+      get {
+        complete {
+          StatusModel(
+            version = Option(getClass.getPackage.getImplementationVersion),
+          )
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/TypesEndpoint.scala

@@ -0,0 +1,211 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import com.typesafe.config.Config
+import io.swagger.v3.oas.annotations.Operation
+import io.swagger.v3.oas.annotations.media.{ArraySchema, Content, Schema}
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+import me.arcanis.ffxivbis.models._
+
+@Path("/api/v1")
+class TypesEndpoint(config: Config) extends JsonSupport {
+
+  def routes: Route = getAllJobs ~ getJobs ~ getPermissions ~ getPieces ~ getPieceTypes ~ getPriority
+
+  @GET
+  @Path("types/jobs/all")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "full jobs list",
+    description = "Returns the available jobs including any job",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "List of available jobs with AnyJob",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[String]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("types"),
+  )
+  def getAllJobs: Route =
+    path("types" / "jobs" / "all") {
+      get {
+        complete(Job.availableWithAnyJob.map(_.toString))
+      }
+    }
+
+  @GET
+  @Path("types/jobs")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "jobs list",
+    description = "Returns the available jobs",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "List of available jobs",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[String]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("types"),
+  )
+  def getJobs: Route =
+    path("types" / "jobs") {
+      get {
+        complete(Job.available.map(_.toString))
+      }
+    }
+
+  @GET
+  @Path("types/permissions")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "permissions list",
+    description = "Returns the available permissions",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "List of available permissions",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[String]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("types"),
+  )
+  def getPermissions: Route =
+    path("types" / "permissions") {
+      get {
+        complete(Permission.values.toSeq.sorted.map(_.toString))
+      }
+    }
+
+  @GET
+  @Path("types/pieces")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "pieces list",
+    description = "Returns the available pieces",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "List of available pieces",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[String]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("types"),
+  )
+  def getPieces: Route =
+    path("types" / "pieces") {
+      get {
+        complete(Piece.available)
+      }
+    }
+
+  @GET
+  @Path("types/pieces/types")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "piece types list",
+    description = "Returns the available piece types",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "List of available piece types",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[String]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("types"),
+  )
+  def getPieceTypes: Route =
+    path("types" / "pieces" / "types") {
+      get {
+        complete(PieceType.available.map(_.toString))
+      }
+    }
+
+  @GET
+  @Path("types/priority")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "priority list",
+    description = "Returns the current priority list",
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Priority order",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[String]))
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("types"),
+  )
+  def getPriority: Route =
+    path("types" / "priority") {
+      get {
+        complete(Party.getRules(config))
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/UserEndpoint.scala

@@ -0,0 +1,306 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1
+
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.http.scaladsl.model.{HttpEntity, StatusCodes}
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server._
+import akka.util.Timeout
+import io.swagger.v3.oas.annotations.enums.ParameterIn
+import io.swagger.v3.oas.annotations.media.{ArraySchema, Content, Schema}
+import io.swagger.v3.oas.annotations.parameters.RequestBody
+import io.swagger.v3.oas.annotations.responses.ApiResponse
+import io.swagger.v3.oas.annotations.security.SecurityRequirement
+import io.swagger.v3.oas.annotations.{Operation, Parameter}
+import jakarta.ws.rs._
+import me.arcanis.ffxivbis.http.api.v1.json._
+import me.arcanis.ffxivbis.http.helpers.UserHelper
+import me.arcanis.ffxivbis.http.{Authorization, AuthorizationProvider}
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.Permission
+
+import scala.util.{Failure, Success}
+
+@Path("/api/v1")
+class UserEndpoint(override val storage: ActorRef[Message], override val auth: AuthorizationProvider)(implicit
+  timeout: Timeout,
+  scheduler: Scheduler
+) extends UserHelper
+  with Authorization
+  with JsonSupport {
+
+  def routes: Route = createParty ~ createUser ~ deleteUser ~ getUsers ~ getUsersCurrent
+
+  @POST
+  @Path("party")
+  @Consumes(value = Array("application/json"))
+  @Operation(
+    summary = "create new party",
+    description = "Create new party with specified ID",
+    requestBody = new RequestBody(
+      description = "party administrator description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[UserModel])))
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Party has been created",
+        content = Array(new Content(schema = new Schema(implementation = classOf[PartyIdModel])))
+      ),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "406",
+        description = "Party with the specified ID already exists",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    tags = Array("party"),
+  )
+  def createParty: Route =
+    path("party") {
+      extractExecutionContext { implicit executionContext =>
+        post {
+          entity(as[UserModel]) { user =>
+            onSuccess(newPartyId) { partyId =>
+              val admin = user.toUser.copy(partyId = partyId, permission = Permission.admin)
+              onSuccess(addUser(admin, isHashedPassword = false)) {
+                complete(PartyIdModel(partyId))
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @POST
+  @Path("party/{partyId}/users")
+  @Consumes(value = Array("application/json"))
+  @Operation(
+    summary = "create new user",
+    description = "Add an user to the specified party",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    requestBody = new RequestBody(
+      description = "user description",
+      required = true,
+      content = Array(new Content(schema = new Schema(implementation = classOf[UserModel])))
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "201", description = "User has been created"),
+      new ApiResponse(
+        responseCode = "400",
+        description = "Invalid parameters were supplied",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("admin"))),
+    tags = Array("users"),
+  )
+  def createUser: Route =
+    path("party" / Segment / "users") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authAdmin(partyId)) { _ =>
+          post {
+            entity(as[UserModel]) { user =>
+              val withPartyId = user.toUser.copy(partyId = partyId)
+              onSuccess(addUser(withPartyId, isHashedPassword = false)) {
+                complete(StatusCodes.Accepted, HttpEntity.Empty)
+              }
+            }
+          }
+        }
+      }
+    }
+
+  @DELETE
+  @Path("party/{partyId}/users/{username}")
+  @Operation(
+    summary = "remove user",
+    description = "Remove an user from the specified party",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+      new Parameter(name = "username", in = ParameterIn.PATH, description = "username to remove", example = "siuan"),
+    ),
+    responses = Array(
+      new ApiResponse(responseCode = "202", description = "User has been removed"),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("admin"))),
+    tags = Array("users"),
+  )
+  def deleteUser: Route =
+    path("party" / Segment / "users" / Segment) { (partyId, username) =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authAdmin(partyId)) { _ =>
+          delete {
+            onSuccess(removeUser(partyId, username)) {
+              complete(StatusCodes.Accepted, HttpEntity.Empty)
+            }
+          }
+        }
+      }
+    }
+
+  @GET
+  @Path("party/{partyId}/users")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get users",
+    description = "Return the list of users belong to party",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "Users list",
+        content = Array(
+          new Content(
+            array = new ArraySchema(schema = new Schema(implementation = classOf[UserModel])),
+          )
+        )
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("get"))),
+    tags = Array("users"),
+  )
+  def getUsers: Route =
+    path("party" / Segment / "users") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authAdmin(partyId)) { _ =>
+          get {
+            onSuccess(users(partyId)) { response =>
+              complete(response.map(UserModel.fromUser))
+            }
+          }
+        }
+      }
+    }
+
+  @GET
+  @Path("party/{partyId}/users/current")
+  @Produces(value = Array("application/json"))
+  @Operation(
+    summary = "get current user",
+    description = "Return the current user descriptor",
+    parameters = Array(
+      new Parameter(
+        name = "partyId",
+        in = ParameterIn.PATH,
+        description = "unique party ID",
+        example = "o3KicHQPW5b0JcOm5yI3"
+      ),
+    ),
+    responses = Array(
+      new ApiResponse(
+        responseCode = "200",
+        description = "User descriptor",
+        content = Array(new Content(schema = new Schema(implementation = classOf[UserModel])))
+      ),
+      new ApiResponse(
+        responseCode = "401",
+        description = "Supplied authorization is invalid",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "403",
+        description = "Access is forbidden",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+      new ApiResponse(
+        responseCode = "500",
+        description = "Internal server error",
+        content = Array(new Content(schema = new Schema(implementation = classOf[ErrorModel])))
+      ),
+    ),
+    security = Array(new SecurityRequirement(name = "basic", scopes = Array("admin"))),
+    tags = Array("users"),
+  )
+  def getUsersCurrent: Route =
+    path("party" / Segment / "users" / "current") { partyId =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { user =>
+          get {
+            complete(UserModel.fromUser(user))
+          }
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/ApiAction.scala

@@ -0,0 +1,14 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+object ApiAction extends Enumeration {
+
+  val add, remove = Value
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/ErrorModel.scala

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+case class ErrorModel(@Schema(description = "error message", required = true) message: String)

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/JsonSupport.scala

@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import akka.http.scaladsl.marshallers.sprayjson.SprayJsonSupport
+import me.arcanis.ffxivbis.models.Permission
+import spray.json._
+
+import java.time.Instant
+
+trait JsonSupport extends SprayJsonSupport with DefaultJsonProtocol {
+
+  private def enumFormat[E <: Enumeration](enumeration: E): RootJsonFormat[E#Value] =
+    new RootJsonFormat[E#Value] {
+      override def write(obj: E#Value): JsValue = obj.toString.toJson
+      override def read(json: JsValue): E#Value = json match {
+        case JsNumber(value) => enumeration(value.toInt)
+        case JsString(name) => enumeration.withName(name)
+        case other => deserializationError(s"String or number expected, got $other")
+      }
+    }
+
+  implicit val instantFormat: RootJsonFormat[Instant] = new RootJsonFormat[Instant] {
+    override def write(obj: Instant): JsValue = obj.toString.toJson
+    override def read(json: JsValue): Instant = json match {
+      case JsNumber(value) => Instant.ofEpochMilli(value.toLongExact)
+      case JsString(value) => Instant.parse(value)
+      case other => deserializationError(s"String or number expected, got $other")
+    }
+  }
+
+  implicit val actionFormat: RootJsonFormat[ApiAction.Value] = enumFormat(ApiAction)
+  implicit val permissionFormat: RootJsonFormat[Permission.Value] = enumFormat(Permission)
+
+  implicit val errorFormat: RootJsonFormat[ErrorModel] = jsonFormat1(ErrorModel.apply)
+  implicit val partyIdFormat: RootJsonFormat[PartyIdModel] = jsonFormat1(PartyIdModel.apply)
+  implicit val pieceFormat: RootJsonFormat[PieceModel] = jsonFormat3(PieceModel.apply)
+  implicit val lootFormat: RootJsonFormat[LootModel] = jsonFormat3(LootModel.apply)
+  implicit val partyDescriptionFormat: RootJsonFormat[PartyDescriptionModel] = jsonFormat2(
+    PartyDescriptionModel.apply
+  )
+  implicit val playerFormat: RootJsonFormat[PlayerModel] = jsonFormat9(PlayerModel.apply)
+  implicit val playerActionFormat: RootJsonFormat[PlayerActionModel] = jsonFormat2(PlayerActionModel.apply)
+  implicit val playerIdFormat: RootJsonFormat[PlayerIdModel] = jsonFormat3(PlayerIdModel.apply)
+  implicit val pieceActionFormat: RootJsonFormat[PieceActionModel] = jsonFormat4(PieceActionModel.apply)
+  implicit val playerBiSLinkFormat: RootJsonFormat[PlayerBiSLinkModel] = jsonFormat2(PlayerBiSLinkModel.apply)
+  implicit val playerIdWithCountersFormat: RootJsonFormat[PlayerIdWithCountersModel] =
+    jsonFormat9(PlayerIdWithCountersModel.apply)
+  implicit val statusFormat: RootJsonFormat[StatusModel] = jsonFormat1(StatusModel.apply)
+  implicit val userFormat: RootJsonFormat[UserModel] = jsonFormat4(UserModel.apply)
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/LootModel.scala

@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.Loot
+
+import java.time.Instant
+
+case class LootModel(
+  @Schema(description = "looted piece", required = true) piece: PieceModel,
+  @Schema(description = "loot timestamp", required = true) timestamp: Instant,
+  @Schema(description = "is loot free for all", required = true) isFreeLoot: Boolean
+) {
+
+  def toLoot: Loot = Loot(-1, piece.toPiece, timestamp, isFreeLoot)
+}
+
+object LootModel {
+
+  def fromLoot(loot: Loot): LootModel =
+    LootModel(PieceModel.fromPiece(loot.piece), loot.timestamp, loot.isFreeLoot)
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PartyDescriptionModel.scala

@@ -0,0 +1,28 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.PartyDescription
+
+case class PartyDescriptionModel(
+  @Schema(description = "party id", required = true, example = "o3KicHQPW5b0JcOm5yI3") partyId: String,
+  @Schema(description = "party name") partyAlias: Option[String]
+) extends Validator {
+
+  require(partyAlias.forall(isValidString), stringMatchError("Party alias"))
+
+  def toDescription: PartyDescription = PartyDescription(partyId, partyAlias)
+}
+
+object PartyDescriptionModel {
+
+  def fromDescription(description: PartyDescription): PartyDescriptionModel =
+    PartyDescriptionModel(description.partyId, description.partyAlias)
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PartyIdModel.scala

@@ -0,0 +1,15 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+case class PartyIdModel(
+  @Schema(description = "party id", required = true, example = "o3KicHQPW5b0JcOm5yI3") partyId: String
+)

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PieceActionModel.scala

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+case class PieceActionModel(
+  @Schema(
+    description = "action to perform",
+    required = true,
+    `type` = "string",
+    allowableValues = Array("add", "remove")
+  ) action: ApiAction.Value,
+  @Schema(description = "piece description", required = true) piece: PieceModel,
+  @Schema(description = "player description", required = true) playerId: PlayerIdModel,
+  @Schema(description = "is piece free to roll or not", `type` = "boolean") isFreeLoot: Option[Boolean]
+)

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PieceModel.scala

@@ -0,0 +1,27 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.{Job, Piece, PieceType}
+
+case class PieceModel(
+  @Schema(description = "piece type", required = true, example = "Savage") pieceType: String,
+  @Schema(description = "job name to which piece belong or AnyJob", required = true, example = "DNC") job: String,
+  @Schema(description = "piece name", required = true, example = "body") piece: String
+) {
+
+  def toPiece: Piece = Piece(piece, PieceType.withName(pieceType), Job.withName(job))
+}
+
+object PieceModel {
+
+  def fromPiece(piece: Piece): PieceModel =
+    PieceModel(piece.pieceType.toString, piece.job.toString, piece.piece)
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PlayerActionModel.scala

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+case class PlayerActionModel(
+  @Schema(
+    description = "action to perform",
+    required = true,
+    `type` = "string",
+    allowableValues = Array("add", "remove"),
+    example = "add"
+  ) action: ApiAction.Value,
+  @Schema(description = "player description", required = true) playerId: PlayerModel
+)

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PlayerBiSLinkModel.scala

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+case class PlayerBiSLinkModel(
+  @Schema(
+    description = "link to player best in slot",
+    required = true,
+    example = "https://ffxiv.ariyala.com/19V5R"
+  ) link: String,
+  @Schema(description = "player description", required = true) playerId: PlayerIdModel
+) extends Validator {
+
+  require(isValidString(link), stringMatchError("BiS link"))
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PlayerIdModel.scala

@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.{Job, PlayerId}
+
+case class PlayerIdModel(
+  @Schema(description = "unique party ID. Required in responses", example = "o3KicHQPW5b0JcOm5yI3") partyId: Option[
+    String
+  ],
+  @Schema(description = "job name", required = true, example = "DNC") job: String,
+  @Schema(description = "player nick name", required = true, example = "Siuan Sanche") nick: String
+) extends Validator {
+
+  require(isValidString(nick), stringMatchError("Player name"))
+
+  def withPartyId(partyId: String): PlayerId =
+    PlayerId(partyId, Job.withName(job), nick)
+}
+
+object PlayerIdModel {
+
+  def fromPlayerId(playerId: PlayerId): PlayerIdModel =
+    PlayerIdModel(Some(playerId.partyId), playerId.job.toString, playerId.nick)
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PlayerIdWithCountersModel.scala

@@ -0,0 +1,40 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.PlayerIdWithCounters
+
+case class PlayerIdWithCountersModel(
+  @Schema(description = "unique party ID", required = true, example = "o3KicHQPW5b0JcOm5yI3") partyId: String,
+  @Schema(description = "job name", required = true, example = "DNC") job: String,
+  @Schema(description = "player nick name", required = true, example = "Siuan Sanche") nick: String,
+  @Schema(description = "is piece required by player or not", required = true) isRequired: Boolean,
+  @Schema(description = "player loot priority", required = true) priority: Int,
+  @Schema(description = "count of savage pieces in best in slot", required = true) bisCountTotal: Int,
+  @Schema(description = "count of looted pieces of this type", required = true) lootCount: Int,
+  @Schema(description = "count of looted pieces which are parts of best in slot", required = true) lootCountBiS: Int,
+  @Schema(description = "total count of looted pieces", required = true) lootCountTotal: Int
+)
+
+object PlayerIdWithCountersModel {
+
+  def fromPlayerId(playerIdWithCounters: PlayerIdWithCounters): PlayerIdWithCountersModel =
+    PlayerIdWithCountersModel(
+      playerIdWithCounters.partyId,
+      playerIdWithCounters.job.toString,
+      playerIdWithCounters.nick,
+      playerIdWithCounters.isRequired,
+      playerIdWithCounters.priority,
+      playerIdWithCounters.bisCountTotal,
+      playerIdWithCounters.lootCount,
+      playerIdWithCounters.lootCountBiS,
+      playerIdWithCounters.lootCountTotal
+    )
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/PlayerModel.scala

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.{BiS, Job, Player}
+
+case class PlayerModel(
+  @Schema(description = "unique party ID", required = true, example = "o3KicHQPW5b0JcOm5yI3") partyId: String,
+  @Schema(description = "job name", required = true, example = "DNC") job: String,
+  @Schema(description = "player nick name", required = true, example = "Siuan Sanche") nick: String,
+  @Schema(description = "pieces in best in slot") bis: Option[Seq[PieceModel]],
+  @Schema(description = "looted pieces") loot: Option[Seq[LootModel]],
+  @Schema(description = "link to best in slot", example = "https://ffxiv.ariyala.com/19V5R") link: Option[String],
+  @Schema(description = "player loot priority", `type` = "number") priority: Option[Int],
+  @Schema(
+    description = "count of looted pieces which are parts of best in slot",
+    `type` = "number"
+  ) lootCountBiS: Option[Int],
+  @Schema(description = "total count of looted pieces", `type` = "number") lootCountTotal: Option[Int],
+) extends Validator {
+
+  require(isValidString(nick), stringMatchError("Player name"))
+  require(link.forall(isValidString), stringMatchError("BiS link"))
+
+  def toPlayer: Player =
+    Player(
+      -1,
+      partyId,
+      Job.withName(job),
+      nick,
+      BiS(bis.getOrElse(Seq.empty).map(_.toPiece)),
+      loot.getOrElse(Seq.empty).map(_.toLoot),
+      link,
+      priority.getOrElse(0)
+    )
+}
+
+object PlayerModel {
+
+  def fromPlayer(player: Player): PlayerModel =
+    PlayerModel(
+      player.partyId,
+      player.job.toString,
+      player.nick,
+      Some(player.bis.pieces.map(PieceModel.fromPiece)),
+      Some(player.loot.map(LootModel.fromLoot)),
+      player.link,
+      Some(player.priority),
+      Some(player.lootCountBiS),
+      Some(player.lootCountTotal),
+    )
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/StatusModel.scala

@@ -0,0 +1,13 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+
+case class StatusModel(@Schema(description = "server version") version: Option[String])

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/UserModel.scala

@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import io.swagger.v3.oas.annotations.media.Schema
+import me.arcanis.ffxivbis.models.{Permission, User}
+
+case class UserModel(
+  @Schema(description = "unique party ID", required = true, example = "o3KicHQPW5b0JcOm5yI3") partyId: String,
+  @Schema(description = "username to login to party", required = true, example = "siuan") username: String,
+  @Schema(description = "password to login to party, required for user editing", example = "pa55w0rd") password: Option[
+    String
+  ],
+  @Schema(
+    description = "user permission",
+    defaultValue = "get",
+    `type` = "string",
+    allowableValues = Array("get", "post", "admin")
+  ) permission: Option[Permission.Value] = None
+) extends Validator {
+
+  require(isValidString(username), stringMatchError("Username"))
+  require(password.forall(_.nonEmpty), "Password must not be empty")
+
+  def toUser: User =
+    password.fold(throw new IllegalArgumentException("Password must noot be empty"))(
+      User(partyId, username, _, permission.getOrElse(Permission.get))
+    )
+}
+
+object UserModel {
+
+  def fromUser(user: User): UserModel =
+    UserModel(user.partyId, user.username, None, Some(user.permission))
+}

src/main/scala/me/arcanis/ffxivbis/http/api/v1/json/Validator.scala

@@ -0,0 +1,9 @@
+package me.arcanis.ffxivbis.http.api.v1.json
+
+import me.arcanis.ffxivbis.http.ValidatorHelper
+
+trait Validator extends ValidatorHelper {
+
+  def stringMatchError(what: String): String =
+    s"$what must contain only letters or digits or one of (${ValidatorHelper.VALID_CHARACTERS.mkString(", ")})"
+}

src/main/scala/me/arcanis/ffxivbis/http/helpers/BiSHelper.scala

@@ -0,0 +1,61 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.helpers
+
+import akka.actor.typed.scaladsl.AskPattern.Askable
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.util.Timeout
+import me.arcanis.ffxivbis.http.api.v1.json.ApiAction
+import me.arcanis.ffxivbis.messages.DatabaseMessage._
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.{Piece, Player, PlayerId}
+
+import scala.concurrent.{ExecutionContext, Future}
+
+trait BiSHelper extends BisProviderHelper {
+
+  def storage: ActorRef[Message]
+
+  def addPieceBiS(playerId: PlayerId, piece: Piece)(implicit timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage.ask(AddPieceToBis(playerId, piece.withJob(playerId.job), _))
+
+  def bis(partyId: String, playerId: Option[PlayerId])(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Seq[Player]] =
+    storage.ask(GetBiS(partyId, playerId, _))
+
+  def doModifyBiS(action: ApiAction.Value, playerId: PlayerId, piece: Piece)(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Unit] =
+    action match {
+      case ApiAction.add => addPieceBiS(playerId, piece)
+      case ApiAction.remove => removePieceBiS(playerId, piece)
+    }
+
+  def putBiS(playerId: PlayerId, link: String)(implicit
+    executionContext: ExecutionContext,
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Unit] =
+    storage
+      .ask(RemovePiecesFromBiS(playerId, _))
+      .flatMap { _ =>
+        downloadBiS(link, playerId.job)
+          .flatMap { bis =>
+            Future.traverse(bis.pieces)(addPieceBiS(playerId, _))
+          }
+      }
+      .flatMap(_ => storage.ask(UpdateBiSLink(playerId, link, _)))
+
+  def removePieceBiS(playerId: PlayerId, piece: Piece)(implicit timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage.ask(RemovePieceFromBiS(playerId, piece, _))
+
+}

src/main/scala/me/arcanis/ffxivbis/http/helpers/BisProviderHelper.scala

@@ -0,0 +1,26 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.helpers
+
+import akka.actor.typed.scaladsl.AskPattern.Askable
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.util.Timeout
+import me.arcanis.ffxivbis.messages.BiSProviderMessage
+import me.arcanis.ffxivbis.messages.BiSProviderMessage._
+import me.arcanis.ffxivbis.models.{BiS, Job}
+
+import scala.concurrent.Future
+
+trait BisProviderHelper {
+
+  def provider: ActorRef[BiSProviderMessage]
+
+  def downloadBiS(link: String, job: Job)(implicit timeout: Timeout, scheduler: Scheduler): Future[BiS] =
+    provider.ask(DownloadBiS(link, job, _))
+}

src/main/scala/me/arcanis/ffxivbis/http/helpers/LootHelper.scala

@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.helpers
+
+import akka.actor.typed.scaladsl.AskPattern.Askable
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.util.Timeout
+import me.arcanis.ffxivbis.http.api.v1.json.ApiAction
+import me.arcanis.ffxivbis.messages.DatabaseMessage._
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.{Piece, Player, PlayerId, PlayerIdWithCounters}
+
+import scala.concurrent.{ExecutionContext, Future}
+
+trait LootHelper {
+
+  def storage: ActorRef[Message]
+
+  def addPieceLoot(playerId: PlayerId, piece: Piece, isFreeLoot: Boolean)(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Unit] =
+    storage.ask(AddPieceTo(playerId, piece, isFreeLoot, _))
+
+  def doModifyLoot(action: ApiAction.Value, playerId: PlayerId, piece: Piece, maybeFree: Option[Boolean])(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Unit] =
+    (action, maybeFree) match {
+      case (ApiAction.add, Some(isFreeLoot)) => addPieceLoot(playerId, piece, isFreeLoot)
+      case (ApiAction.remove, Some(isFreeLoot)) => removePieceLoot(playerId, piece, isFreeLoot)
+      case _ => throw new IllegalArgumentException("Loot modification must always contain `isFreeLoot` field")
+    }
+
+  def loot(partyId: String, playerId: Option[PlayerId])(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Seq[Player]] =
+    storage.ask(GetLoot(partyId, playerId, _))
+
+  def removePieceLoot(playerId: PlayerId, piece: Piece, isFreeLoot: Boolean)(implicit
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Unit] =
+    storage.ask(RemovePieceFrom(playerId, piece, isFreeLoot, _))
+
+  def suggestPiece(partyId: String, piece: Piece)(implicit
+    executionContext: ExecutionContext,
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Seq[PlayerIdWithCounters]] =
+    storage.ask(SuggestLoot(partyId, piece, _)).map(_.result)
+}

src/main/scala/me/arcanis/ffxivbis/http/helpers/PlayerHelper.scala

@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.helpers
+
+import akka.actor.typed.scaladsl.AskPattern.Askable
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.util.Timeout
+import me.arcanis.ffxivbis.http.api.v1.json.ApiAction
+import me.arcanis.ffxivbis.messages.DatabaseMessage._
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.{PartyDescription, Player, PlayerId}
+
+import scala.concurrent.{ExecutionContext, Future}
+
+trait PlayerHelper extends BisProviderHelper {
+
+  def storage: ActorRef[Message]
+
+  def addPlayer(
+    player: Player
+  )(implicit executionContext: ExecutionContext, timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage
+      .ask(ref => AddPlayer(player, ref))
+      .map { _ =>
+        player.link.map(_.trim).filter(_.nonEmpty) match {
+          case Some(link) =>
+            downloadBiS(link, player.job)
+              .map { bis =>
+                bis.pieces.map(piece => storage.ask(AddPieceToBis(player.playerId, piece, _)))
+              }
+              .flatMap(_ => storage.ask(UpdateBiSLink(player.playerId, link, _)))
+          case None => Future.successful(())
+        }
+      }
+      .flatten
+
+  def doModifyPlayer(action: ApiAction.Value, player: Player)(implicit
+    executionContext: ExecutionContext,
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Unit] =
+    action match {
+      case ApiAction.add => addPlayer(player)
+      case ApiAction.remove => removePlayer(player.playerId)
+    }
+
+  def getPartyDescription(partyId: String)(implicit timeout: Timeout, scheduler: Scheduler): Future[PartyDescription] =
+    storage.ask(GetPartyDescription(partyId, _))
+
+  def getPlayers(partyId: String, maybePlayerId: Option[PlayerId])(implicit
+    executionContext: ExecutionContext,
+    timeout: Timeout,
+    scheduler: Scheduler
+  ): Future[Seq[Player]] =
+    maybePlayerId match {
+      case Some(playerId) =>
+        storage.ask(GetPlayer(playerId, _)).map(_.toSeq)
+      case None =>
+        storage.ask(GetParty(partyId, _)).map(_.players.values.toSeq)
+    }
+
+  def removePlayer(playerId: PlayerId)(implicit timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage.ask(RemovePlayer(playerId, _))
+
+  def updateDescription(
+    partyDescription: PartyDescription
+  )(implicit executionContext: ExecutionContext, timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage.ask(UpdateParty(partyDescription, _))
+}

src/main/scala/me/arcanis/ffxivbis/http/helpers/UserHelper.scala

@@ -0,0 +1,39 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.helpers
+
+import akka.actor.typed.scaladsl.AskPattern.Askable
+import akka.actor.typed.{ActorRef, Scheduler}
+import akka.util.Timeout
+import me.arcanis.ffxivbis.messages.ControlMessage.GetNewPartyId
+import me.arcanis.ffxivbis.messages.DatabaseMessage._
+import me.arcanis.ffxivbis.messages.Message
+import me.arcanis.ffxivbis.models.User
+
+import scala.concurrent.Future
+
+trait UserHelper {
+
+  def storage: ActorRef[Message]
+
+  def addUser(user: User, isHashedPassword: Boolean)(implicit timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage.ask(AddUser(user, isHashedPassword, _))
+
+  def newPartyId(implicit timeout: Timeout, scheduler: Scheduler): Future[String] =
+    storage.ask(GetNewPartyId)
+
+  def user(partyId: String, username: String)(implicit timeout: Timeout, scheduler: Scheduler): Future[Option[User]] =
+    storage.ask(GetUser(partyId, username, _))
+
+  def users(partyId: String)(implicit timeout: Timeout, scheduler: Scheduler): Future[Seq[User]] =
+    storage.ask(GetUsers(partyId, _))
+
+  def removeUser(partyId: String, username: String)(implicit timeout: Timeout, scheduler: Scheduler): Future[Unit] =
+    storage.ask(DeleteUser(partyId, username, _))
+}

src/main/scala/me/arcanis/ffxivbis/http/view/RootView.scala

@@ -0,0 +1,80 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.http.view
+
+import akka.http.scaladsl.model.headers.RawHeader
+import akka.http.scaladsl.server.Directives._
+import akka.http.scaladsl.server.Route
+import me.arcanis.ffxivbis.http.{Authorization, AuthorizationProvider}
+
+class RootView(override val auth: AuthorizationProvider) extends Authorization {
+
+  def routes: Route = getBiS ~ getIndex ~ getLoot ~ getParty ~ getUsers
+
+  def getBiS: Route =
+    path("party" / Segment / "bis") { partyId: String =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { user =>
+          respondWithHeaders(
+            RawHeader("X-Party-Id", partyId),
+            RawHeader("X-User-Permission", user.permission.toString)
+          ) {
+            getFromResource("html/bis.html")
+          }
+        }
+      }
+    }
+
+  def getIndex: Route =
+    pathEndOrSingleSlash {
+      getFromResource("html/index.html")
+    }
+
+  def getLoot: Route =
+    path("party" / Segment / "loot") { partyId: String =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { user =>
+          respondWithHeaders(
+            RawHeader("X-Party-Id", partyId),
+            RawHeader("X-User-Permission", user.permission.toString)
+          ) {
+            getFromResource("html/loot.html")
+          }
+        }
+      }
+    }
+
+  def getParty: Route =
+    path("party" / Segment) { partyId: String =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authGet(partyId)) { user =>
+          respondWithHeaders(
+            RawHeader("X-Party-Id", partyId),
+            RawHeader("X-User-Permission", user.permission.toString)
+          ) {
+            getFromResource("html/party.html")
+          }
+        }
+      }
+    }
+
+  def getUsers: Route =
+    path("party" / Segment / "users") { partyId: String =>
+      extractExecutionContext { implicit executionContext =>
+        authenticateBasicBCrypt(s"party $partyId", authAdmin(partyId)) { user =>
+          respondWithHeaders(
+            RawHeader("X-Party-Id", partyId),
+            RawHeader("X-User-Permission", user.permission.toString)
+          ) {
+            getFromResource("html/users.html")
+          }
+        }
+      }
+    }
+}

src/main/scala/me/arcanis/ffxivbis/messages/BiSProviderMessage.scala

@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.messages
+
+import akka.actor.typed.ActorRef
+import me.arcanis.ffxivbis.models.{BiS, Job}
+
+sealed trait BiSProviderMessage
+
+object BiSProviderMessage {
+
+  case class DownloadBiS(link: String, job: Job, replyTo: ActorRef[BiS]) extends BiSProviderMessage {
+
+    require(link.nonEmpty && link.trim == link, "Link must be not empty and contain no spaces")
+  }
+}

src/main/scala/me/arcanis/ffxivbis/messages/ControlMessage.scala

@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.messages
+
+import akka.actor.typed.ActorRef
+import me.arcanis.ffxivbis.models.Party
+
+sealed trait ControlMessage extends Message
+
+object ControlMessage {
+
+  case class ForgetParty(partyId: String) extends ControlMessage
+
+  case class GetNewPartyId(replyTo: ActorRef[String]) extends ControlMessage
+
+  case class StoreParty(partyId: String, party: Party) extends ControlMessage
+}

src/main/scala/me/arcanis/ffxivbis/messages/DatabaseMessage.scala

@@ -0,0 +1,131 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.messages
+
+import akka.actor.typed.ActorRef
+import me.arcanis.ffxivbis.models._
+import me.arcanis.ffxivbis.service.LootSelector
+
+sealed trait DatabaseMessage extends Message {
+
+  def partyId: String
+
+  def isReadOnly: Boolean
+}
+
+object DatabaseMessage {
+
+  // bis handler
+  trait BisDatabaseMessage extends DatabaseMessage
+
+  case class AddPieceToBis(playerId: PlayerId, piece: Piece, replyTo: ActorRef[Unit]) extends BisDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class GetBiS(partyId: String, playerId: Option[PlayerId], replyTo: ActorRef[Seq[Player]])
+    extends BisDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class RemovePieceFromBiS(playerId: PlayerId, piece: Piece, replyTo: ActorRef[Unit]) extends BisDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class RemovePiecesFromBiS(playerId: PlayerId, replyTo: ActorRef[Unit]) extends BisDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  // loot handler
+  trait LootDatabaseMessage extends DatabaseMessage
+
+  case class AddPieceTo(playerId: PlayerId, piece: Piece, isFreeLoot: Boolean, replyTo: ActorRef[Unit])
+    extends LootDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class GetLoot(partyId: String, playerId: Option[PlayerId], replyTo: ActorRef[Seq[Player]])
+    extends LootDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class RemovePieceFrom(playerId: PlayerId, piece: Piece, isFreeLoot: Boolean, replyTo: ActorRef[Unit])
+    extends LootDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class SuggestLoot(partyId: String, piece: Piece, replyTo: ActorRef[LootSelector.LootSelectorResult])
+    extends LootDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  // party handler
+  trait PartyDatabaseMessage extends DatabaseMessage
+
+  case class AddPlayer(player: Player, replyTo: ActorRef[Unit]) extends PartyDatabaseMessage {
+    override val partyId: String = player.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class GetParty(partyId: String, replyTo: ActorRef[Party]) extends PartyDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class GetPartyDescription(partyId: String, replyTo: ActorRef[PartyDescription]) extends PartyDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class GetPlayer(playerId: PlayerId, replyTo: ActorRef[Option[Player]]) extends PartyDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = true
+  }
+
+  case class RemovePlayer(playerId: PlayerId, replyTo: ActorRef[Unit]) extends PartyDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class UpdateBiSLink(playerId: PlayerId, link: String, actorRef: ActorRef[Unit]) extends PartyDatabaseMessage {
+    override val partyId: String = playerId.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class UpdateParty(partyDescription: PartyDescription, replyTo: ActorRef[Unit]) extends PartyDatabaseMessage {
+    override val partyId: String = partyDescription.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  // user handler
+  trait UserDatabaseMessage extends DatabaseMessage
+
+  case class AddUser(user: User, isHashedPassword: Boolean, replyTo: ActorRef[Unit]) extends UserDatabaseMessage {
+    override val partyId: String = user.partyId
+    override val isReadOnly: Boolean = false
+  }
+
+  case class DeleteUser(partyId: String, username: String, replyTo: ActorRef[Unit]) extends UserDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class Exists(partyId: String, replyTo: ActorRef[Boolean]) extends UserDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class GetUser(partyId: String, username: String, replyTo: ActorRef[Option[User]]) extends UserDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+
+  case class GetUsers(partyId: String, replyTo: ActorRef[Seq[User]]) extends UserDatabaseMessage {
+    override val isReadOnly: Boolean = true
+  }
+}

src/main/scala/me/arcanis/ffxivbis/messages/Message.scala

@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.messages
+
+import akka.actor.typed.Behavior
+
+trait Message
+
+object Message {
+
+  type Handler = PartialFunction[Message, Behavior[Message]]
+}

src/main/scala/me/arcanis/ffxivbis/models/BiS.scala

@@ -0,0 +1,47 @@
+/*
+ * Copyright (c) 2019-2022 Evgeniy Alekseev.
+ *
+ * This file is part of ffxivbis
+ * (see https://github.com/arcan1s/ffxivbis).
+ *
+ * License: 3-clause BSD, see https://opensource.org/licenses/BSD-3-Clause
+ */
+package me.arcanis.ffxivbis.models
+
+case class BiS(pieces: Seq[Piece]) {
+
+  def hasPiece(piece: Piece): Boolean = piece match {
+    case upgrade: Piece.PieceUpgrade => upgrades.contains(upgrade)
+    case _ => pieces.contains(piece)
+  }
+
+  def upgrades: Map[Piece.PieceUpgrade, Int] =
+    pieces
+      .groupBy(_.upgrade)
+      .foldLeft(Map.empty[Piece.PieceUpgrade, Int]) {
+        case (acc, (Some(k), v)) => acc + (k -> v.size)
+        case (acc, _) => acc
+      }
+      .withDefaultValue(0)
+
+  def withPiece(piece: Piece): BiS = copy(pieces :+ piece)
+
+  def withoutPiece(piece: Piece): BiS = copy(pieces.filterNot(_.strictEqual(piece)))
+
+  override def equals(obj: Any): Boolean = {
+    def comparePieces(left: Seq[Piece], right: Seq[Piece]): Boolean =
+      left.groupBy(identity).view.mapValues(_.size).forall { case (key, count) =>
+        right.count(_.strictEqual(key)) == count
+      }
+
+    obj match {
+      case left: BiS => comparePieces(left.pieces, pieces)
+      case _ => false
+    }
+  }
+}
+
+object BiS {
+
+  val empty: BiS = BiS(Seq.empty)
+}