{% extends "base.html" %}
{% from "_macros.html" import no_data with context %}
{% block title %}Ownership{% endblock %}
{% block content %}
<h1>Ownership</h1>
<p class="muted">Who manages each resource of the active account, first match wins:
  <b>CloudFormation</b> stack &gt; <b>IaC tag</b>
  (<span class="mono">{{ own.project_key or 'no project / repo tag key set' }}</span>) &gt;
  <b>Terraform</b> state ({{ 'enabled' if own.tf_enabled else 'optional, off' }}) &gt;
  <b>CloudTrail</b> creator ({{ 'enabled' if own.cloudtrail else 'optional, off' }}) &gt; <b>unmanaged</b>.
  Tag keys, CI role patterns and the optional sources are set in
  <a href="{{ url_for('settings_page') }}#ownership">Settings → Ownership</a>.</p>

{% if report is none %}
  {{ no_data() }}
{% else %}
  <p class="muted">Snapshot from {{ snap.taken_at | localtime }} ({{ snap.region }}): {{ report.total }} resource(s) —
    the collected VPCs, subnets, security groups, load balancers, functions, endpoints, ECS services, instances and
    NAT gateways plus every resource <span class="mono">tag:GetResources</span> and the CloudFormation stacks returned.
    Default VPCs, their subnets and <span class="mono">default</span> security groups are not counted.</p>
  {% for w in own_warnings %}<div class="flash warn">{{ w }}</div>{% endfor %}
  {% if own.cloudtrail %}
  <p class="muted small">CloudTrail lookups cover the last {{ cloudtrail_days }} days of event history only
    (at most {{ cloudtrail_max }} unowned resources per Refresh): resources created earlier stay unmanaged.</p>
  {% endif %}

  <h2>By source</h2>
  <table class="own-counts">
    <thead><tr><th>Source</th><th>Resources</th></tr></thead>
    <tbody>
    {% for c in report.counts %}
      <tr{% if (c.source == 'terraform' and not own.tf_enabled) or (c.source.startswith('cloudtrail') and not own.cloudtrail) %} class="muted"{% endif %}>
        <td>{{ c.label }}{% if c.source == 'terraform' and not own.tf_enabled %} <span class="small">(enrichment off)</span>{% endif %}
          {% if c.source.startswith('cloudtrail') and not own.cloudtrail %} <span class="small">(lookup off)</span>{% endif %}</td>
        <td>{{ c.count }}</td>
      </tr>
    {% endfor %}
    </tbody>
  </table>

  <h2>Unmanaged <span class="badge">{{ report.unmanaged | length }}</span></h2>
  <p class="muted small">No CloudFormation stack, no <span class="mono">{{ own.project_key or 'project / repo' }}</span> tag{% if own.tf_enabled %}, in no Terraform root{% endif %}{% if own.cloudtrail %} and no creator found in CloudTrail{% endif %}.</p>
  <table class="own-unmanaged">
    <thead><tr><th>Type</th><th>Resource</th></tr></thead>
    <tbody>
    {% for r in report.unmanaged %}
      <tr><td>{{ r.label }}</td><td class="mono">{{ r.resource_id }}</td></tr>
    {% else %}
      <tr><td colspan="2" class="muted">None.</td></tr>
    {% endfor %}
    </tbody>
  </table>

  <h2>Tag gaps <span class="badge">{{ report.tag_gaps | length }}</span></h2>
  {% if report.gap_keys %}
  <p class="muted small">Resources missing the configured
    {% for k in report.gap_keys %}<span class="mono">{{ k }}</span>{{ ' / ' if not loop.last }}{% endfor %} tag.</p>
  <table class="own-gaps">
    <thead><tr><th>Type</th><th>Resource</th><th>Missing</th><th>Owner</th></tr></thead>
    <tbody>
    {% for r in report.tag_gaps %}
      <tr><td>{{ r.label }}</td><td class="mono">{{ r.resource_id }}</td>
        <td class="mono small">{{ r.missing | join(', ') }}</td><td class="small">{{ r.owner }}</td></tr>
    {% else %}
      <tr><td colspan="4" class="muted">None.</td></tr>
    {% endfor %}
    </tbody>
  </table>
  {% else %}
  <p class="muted">No environment or project / repo tag key is configured.</p>
  {% endif %}
{% endif %}

<details class="card" id="terraform" {{ 'open' if own.tf_enabled }}>
  <summary><b>Terraform (optional enrichment)</b> —
    {% if own.tf_enabled %}<span class="badge ok">enabled</span>{% else %}<span class="badge">off</span>{% endif %}</summary>
  <form method="post" action="{{ url_for('ownership_terraform_toggle') }}" class="row">
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    <input type="hidden" name="enabled" value="{{ '0' if own.tf_enabled else '1' }}">
    <p class="muted" style="margin: 0">Terraform state is an optional ownership source, after CloudFormation and IaC tags.
      {% if own.tf_enabled %}Mapped repos are re-synced with every Refresh.{% else %}While off, Terraform roots are not used
      for ownership and Refresh does not sync repos; drift below is still available.{% endif %}</p>
    <button type="submit" class="secondary">{{ 'Disable' if own.tf_enabled else 'Enable' }} Terraform enrichment</button>
  </form>

<div class="row" style="justify-content: space-between">
  <h2>Terraform roots of this account</h2>
  <form method="post" action="{{ url_for('terraform_sync') }}" data-job="tfsync">
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    <input type="hidden" name="next" value="{{ url_for('ownership_page') }}#terraform">
    <button type="submit">Sync all repos</button>
  </form>
</div>
<p class="muted">Sync status of the Terraform repo roots mapped to the active account, and drift between
  them and the latest snapshot. Repos and their account mapping are managed in
  <a href="{{ url_for('settings_page') }}#tfrepos">Settings</a>.</p>

<table class="tf-status">
  <thead><tr><th>Root</th><th>Environment</th><th>Repository</th><th>Status</th><th>Resource ids</th><th>Synced</th></tr></thead>
  <tbody>
  {% for e in envs %}
    <tr{% if not e.present %} class="muted"{% endif %}>
      <td><b>{{ e.root_label }}</b></td>
      <td class="mono">{{ e.env }}</td>
      <td class="mono small"><a href="{{ url_for('settings_tfrepo', repo_id=e.repo_id) }}">{{ e.repo_path }}</a></td>
      <td>{% if e.status %}<span class="badge {{ 'ok' if e.status == 'ok' else 'warn' if e.status == 'no state' else 'err' }}">{{ e.status }}</span>
        {% if e.status_detail %}<span class="muted small">{{ e.status_detail }}</span>{% endif %}
        {% if e.status == wrong_account %}<div class="small">Left out of drift.
          {% if e.suggest_label %}Map it to <b>{{ e.suggest_label }}</b> instead:
            <a href="{{ url_for('settings_tfrepo', repo_id=e.repo_id) }}">review the mapping</a>.
          {% else %}No IPLens account resolves to AWS <span class="mono">{{ e.state_account }}</span> yet:
            <a href="{{ url_for('account_new') }}">add it</a> or <a href="{{ url_for('settings_tfrepo', repo_id=e.repo_id) }}">change the mapping</a>.{% endif %}</div>{% endif %}
        {% else %}<span class="muted">not synced yet</span>{% endif %}</td>
      <td>{{ e.resources }}</td>
      <td>{{ e.synced_at | localtime }}</td>
    </tr>
  {% else %}
    <tr><td colspan="6" class="muted">No Terraform repo roots are mapped to this account.</td></tr>
  {% endfor %}
  </tbody>
</table>

<h2>Drift</h2>
{% if drift is none %}
  <p class="muted">No snapshot of this account yet — Refresh on the Discovery page first.</p>
{% elif not any_roots %}
  <p class="muted">No Terraform roots are loaded, so drift cannot be computed.</p>
{% else %}
  <p class="muted">Compared with the snapshot from {{ snap.taken_at | localtime }} ({{ snap.region }}).
    Default VPCs, their subnets and <span class="mono">default</span> security groups are not counted.
    {% if drift.skipped_kinds %}Not compared (none in the snapshot, e.g. a missing permission):
      {{ drift.skipped_kinds | join(', ') }}.{% endif %}</p>
  {% if drift.skipped_roots %}
  <p class="muted small">Roots skipped for "in Terraform, not in AWS":
    {% for s in drift.skipped_roots %}<span class="mono">{{ s.root }}</span> ({{ s.reason }}){{ ', ' if not loop.last }}{% endfor %}</p>
  {% endif %}
  {% if drift.wrong_account %}
  <div class="flash warn">{{ drift.wrong_account | length }} root(s) hold resources of another AWS account and are
    excluded from both drift lists:
    {% for w in drift.wrong_account %}<span class="mono">{{ w.root_label }} [{{ w.env }}]</span> (state in
      <span class="mono">{{ w.state_account or '?' }}</span>{% if w.suggest_label %}; suggested account: <b>{{ w.suggest_label }}</b>{% endif %}){{ ', ' if not loop.last }}{% endfor %}.
  </div>
  {% endif %}

  <h3>In AWS, not in Terraform <span class="badge">{{ drift.not_in_terraform | length }}</span></h3>
  <p class="muted small">Resources of the snapshot that no loaded Terraform root manages.</p>
  <table class="tf-drift">
    <thead><tr><th>Type</th><th>Resource</th><th></th></tr></thead>
    <tbody>
    {% for r in drift.not_in_terraform %}
      <tr><td>{{ r.label }}</td><td class="mono">{{ r.resource_id }}</td>
        <td>{{ mark_button('resource', r.resource_id) }}</td></tr>
    {% else %}
      <tr><td colspan="3" class="muted">None.</td></tr>
    {% endfor %}
    </tbody>
  </table>

  <h3>In Terraform, not in AWS <span class="badge">{{ drift.not_in_aws | length }}</span></h3>
  <p class="muted small">Resources of the repo roots mapped to this account that the snapshot does not contain
    ({{ drift.roots | length }} root(s) compared).</p>
  <table class="tf-drift">
    <thead><tr><th>Root</th><th>Address</th><th>Type</th><th>Resource</th><th></th></tr></thead>
    <tbody>
    {% for r in drift.not_in_aws %}
      <tr><td class="mono small">{{ r.root }}</td><td class="mono small">{{ r.address }}</td>
        <td class="mono small">{{ r.type }}</td><td class="mono">{{ r.resource_id }}</td>
        <td>{{ mark_button('resource', r.resource_id) }}</td></tr>
    {% else %}
      <tr><td colspan="5" class="muted">None.</td></tr>
    {% endfor %}
    </tbody>
  </table>
{% endif %}

<section class="card" id="managed-elsewhere">
  <h2 style="margin-top: 0">Managed elsewhere {% if drift %}<span class="badge">{{ drift.managed_elsewhere | length }} excluded</span>{% endif %}</h2>
  <p class="muted">Resources managed outside these Terraform roots (another team's stack, a landing zone,
    the console) can be marked here by resource type (e.g. every VPC, subnet or VPC endpoint), resource id or
    tag; matching resources are left out of both drift lists and the counts above.</p>
  <table class="tf-markers">
    <thead><tr><th>Marker</th><th>Applies to</th><th>Note</th><th></th></tr></thead>
    <tbody>
    {% for m in markers %}
      <tr><td>{{ marker_kinds[m.kind] }}: <span class="mono">{{ m.label }}</span></td>
        <td>{{ 'every account' if m.account_ref is none else 'this account' }}</td>
        <td class="small">{{ m.note }}</td>
        <td><form class="inline" method="post" action="{{ url_for('terraform_marker_delete', marker_id=m.id) }}">
          <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
          <button type="submit" class="secondary">Remove</button></form></td></tr>
    {% else %}
      <tr><td colspan="4" class="muted">No markers.</td></tr>
    {% endfor %}
    </tbody>
  </table>
  {% if active_account %}
  <form method="post" action="{{ url_for('terraform_marker_add') }}" class="row" autocomplete="off">
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    <div><label for="marker-kind">Mark by</label>
      <select id="marker-kind" name="kind">
        {% for k, label in marker_kinds.items() %}<option value="{{ k }}">{{ label }}</option>{% endfor %}
      </select></div>
    <div><label for="marker-type">Resource type</label>
      <select id="marker-type" name="value_type">
        {% for k, label in marker_types %}<option value="{{ k }}">{{ label }}</option>{% endfor %}
      </select></div>
    <div><label for="marker-value">…or resource id / tag</label>
      <input id="marker-value" name="value" size="28" class="mono" placeholder="vpc-0example / team=network"></div>
    <div><label for="marker-scope">Applies to</label>
      <select id="marker-scope" name="scope"><option value="account">this account</option><option value="all">every account</option></select></div>
    <div><label for="marker-note">Note</label>
      <input id="marker-note" name="note" size="20" maxlength="200" placeholder="e.g. network team"></div>
    <div><button type="submit">Add marker</button></div>
  </form>
  {% endif %}
  {% if drift and drift.managed_elsewhere %}
  <details>
    <summary>{{ drift.managed_elsewhere | length }} resource(s) excluded from drift</summary>
    <table class="tf-drift">
      <thead><tr><th>Drift list</th><th>Type</th><th>Resource</th><th>Marker</th></tr></thead>
      <tbody>
      {% for r in drift.managed_elsewhere %}
        <tr><td>{{ 'in AWS, not in Terraform' if r.side == 'aws' else 'in Terraform (' ~ r.root ~ '), not in AWS' }}</td>
          <td>{{ r.label }}</td><td class="mono">{{ r.resource_id }}</td><td class="small">{{ r.marker }}</td></tr>
      {% endfor %}
      </tbody>
    </table>
  </details>
  {% endif %}
</section>
</details>
{% endblock %}

{% macro mark_button(kind, value) -%}
  <form class="inline" method="post" action="{{ url_for('terraform_marker_add') }}">
    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
    <input type="hidden" name="kind" value="{{ kind }}">
    <input type="hidden" name="value_{{ kind }}" value="{{ value }}">
    <button type="submit" class="secondary small" title="Leave this resource out of drift">managed elsewhere</button>
  </form>
{%- endmacro %}