{% extends base_template|default:"bastion/base.html" %}
{% load i18n %}

{% comment %}
  The opposite policy to login_failed.html, and deliberately so.

  Identity is already proven here, so there is no account to enumerate and no
  reason to be vague. Being vague at this point is the single most common
  usability failure in enterprise SSO: the person is told "access denied" and
  has no idea which account they used, which group they are missing, or who to
  ask. All three are on this page.

  Deployments that consider group names sensitive can substitute a generic
  phrase, but the specific version is the default, because the generic one is
  unusable.

  Sign-out is a POST. Django's LogoutView is POST-only, so an <a href> to it is
  a dead link.

  base_template is resolved per request by bastion.pages: admin/base_site.html
  where the admin is installed and routed, bastion/base.html otherwise. The
  admin-only blocks below are no-ops under the fallback base, because Django
  ignores a child block with no matching parent block.
{% endcomment %}

{% block title %}{% translate "Access denied" %}{% if site_title %} | {{ site_title }}{% endif %}{% endblock %}

{% block content_title %}<h1 tabindex="-1">{% translate "You are signed in, but you do not have access" %}</h1>{% endblock %}

{% block breadcrumbs %}{% endblock %}
{% block nav-breadcrumbs %}{% endblock %}
{% block usertools %}{% endblock %}
{% block nav-global %}{% endblock %}
{% block nav-sidebar %}{% endblock %}

{% block content %}
  <p>
    {% blocktranslate trimmed %}
      Your sign-in worked. This account does not have permission to use this
      site.
    {% endblocktranslate %}
  </p>

  <dl>
    <dt>{% translate "You signed in as" %}</dt>
    <dd><code>{{ identity }}</code></dd>

    {% if missing_mfa %}
      <dt>{% translate "What is missing" %}</dt>
      <dd>{% translate "A second factor. This sign-in used one." %}</dd>
    {% elif required_groups %}
      <dt>{% translate "Access requires membership of" %}</dt>
      <dd>
        {% for group in required_groups %}
          <code>{{ group }}</code>{% if not forloop.last %}, {% endif %}
        {% endfor %}
      </dd>
    {% endif %}

    <dt>{% translate "Reference" %}</dt>
    <dd><code>{{ reference }}</code></dd>
  </dl>

  <h2>{% translate "What to do next" %}</h2>
  <p>
    {% if missing_mfa %}
      {# The group is not the problem here, and saying it is sends the person to
         a service desk that will add them to one and change nothing. #}
      {% blocktranslate trimmed %}
        Sign out and sign in again using your second factor. If you have not
        set one up, your IT service desk can enrol you. Include the reference
        so they can find this sign-in.
      {% endblocktranslate %}
    {% elif required_groups %}
      {% blocktranslate trimmed %}
        Ask your IT service desk to add this account to the group listed
        above. Include the reference so they can find this sign-in.
      {% endblocktranslate %}
    {% else %}
      {% blocktranslate trimmed %}
        Ask your IT service desk to grant this account access. Include the
        reference so they can find this sign-in.
      {% endblocktranslate %}
    {% endif %}
  </p>

  {% if not missing_mfa %}
    <p>
      {% blocktranslate trimmed %}
        If you have a different work account that should have access, sign out
        and try that one.
      {% endblocktranslate %}
    </p>
  {% endif %}

  {% if logout_url %}
    <form method="post" action="{{ logout_url }}">
      {% csrf_token %}
      <button type="submit" class="button">{% translate "Sign out" %}</button>
    </form>
  {% endif %}
{% endblock %}