{% extends "base.html" %}
{% from "components/ui.html" import action, ago, anywhere_tag, breadcrumb, card, csrf_field, danger_card, empty, fact, facts, icon, related, rights_tags, row_form, secret_card, tabs, tick, tick_all with context %}
{% from "components/audit.html" import activity_rows %}
{% from "components/grants.html" import grant_editor, grants_of, role_checks, role_tags, sending_of, service_editor, service_of %}
{% block title %}{{ user.name }} · {{ APP_NAME }}{% endblock %}
{% block heading %}{{ user.name }}{% endblock %}
{% block subheading %}{{ breadcrumb([("Users", "/ui/users"), (user.name, None)]) }}{% endblock %}
{% block content %}
{% if new_token %}
{% call secret_card("New token", new_token) %}Copy it now. Only its hash is kept. It cannot be shown again.{% endcall %}
{% endif %}
{% if new_password %}
{% call secret_card("One-time password", new_password) %}Pass it to {{ user.name }} over a safe channel. It must be changed at the first sign-in.{% endcall %}
{% endif %}

{% set state %}{% if is_me %}<span class="tag accent">you</span> {% endif %}{% if not user.ui_sign_in %}<span class="tag">API only</span> {% endif %}{% if user.disabled %}<span class="tag bad">disabled</span>{% else %}<span class="tag ok">active</span>{% endif %}{% endset %}
{{ tabs(tabs_shown, tab, "/ui/users/" ~ user.id) }}

{% if tab == "rights" %}

{% call facts("User", tags=state) %}
  {% call fact("Roles") %}{{ role_tags(user.roles) }}{% endcall %}
  {% call fact("Service rights") %}{{ service_of(user.service) }}{% endcall %}
  {% call fact("Grants") %}{{ grants_of(user.grants, names) }}{% endcall %}
  {{ fact("Id", user.id, cls="mono") }}
{% endcall %}

{% call card("Effective rights", meta="The rights of the user and of its roles together" ~ (". They apply once the user is enabled again" if user.disabled else "") ~ ".", tight=True) %}
  {% if effective.accounts %}
  <div class="table-scroll">
    <table>
      <thead><tr><th>Account</th><th>May</th><th>Sending</th></tr></thead>
      <tbody>
        {% for row in effective.accounts %}
        <tr>
          <td class="name">{{ row.email }}{% for warning in row.warnings %}<span class="sub">{{ anywhere_tag() }}</span>{% endfor %}</td>
          <td>{{ rights_tags(row.groups, row.operations) }}</td>
          <td>{{ sending_of(row.sending) }}</td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
  {% else %}
  <p class="empty">No rights on any account you can see.</p>
  {% endif %}
  {% if effective.groups or effective.operations %}
  <div class="body">
    <dl class="facts">
      <dt>Of the service</dt>
      <dd>{{ rights_tags(effective.groups, effective.operations) }}</dd>
    </dl>
  </div>
  {% endif %}
{% endcall %}

{% if can_update %}
<form method="post" action="/ui/users/{{ user.id }}">
  {{ csrf_field() }}
  {% call card("Change", meta="You can hand out only rights you hold yourself.") %}
    <div class="form-grid">
      <div class="field">
        <label for="f-name">Name</label>
        <input id="f-name" name="name" value="{{ typed.name if typed else user.name }}" required />
      </div>
      {% if not is_me %}
      <div class="field">
        <span class="label">Access</span>
        <input type="hidden" name="ui_sign_in_shown" value="1" />
        <label class="check"><input type="checkbox" name="ui_sign_in" value="1"{% if (typed.ui_sign_in if typed else user.ui_sign_in) %} checked{% endif %} /> may sign in to the UI. Off: its password is deleted, its tokens keep working</label>
        <label class="check"><input type="checkbox" name="disabled" value="1"{% if (typed.disabled if typed else user.disabled) %} checked{% endif %} /> disabled: it cannot sign in, its tokens are refused</label>
      </div>
      {% endif %}
    </div>
    {% if role_choices %}{{ role_checks(role_choices, typed.roles if typed else user.roles) }}{% endif %}
    <details class="fold"{% if typed %} open{% endif %}>
      <summary>Service rights</summary>
      {{ service_editor(service, service_names, service_ops) }}
    </details>
    <details class="fold"{% if typed %} open{% endif %}>
      <summary>Grants</summary>
      {{ grant_editor(rows, account_choices, groups, group_ops, open=typed) }}
    </details>
    <div class="form-actions"><button class="primary" type="submit">{{ icon("check-lg") }} Save</button></div>
  {% endcall %}
</form>
{% endif %}

{% elif tab == "access" %}
{% call facts("Sign-in", tags=state) %}
  {% call fact("To the UI") %}{% if not user.ui_sign_in %}off: an API user, tokens only{% elif sign_in.must_change %}with a password set for it, to change at the next sign-in{% elif sign_in.has_password %}with a password{% else %}not possible: no password yet{% endif %}{% if is_me and user.ui_sign_in %} · <a href="/ui/password">Change your password</a>{% endif %}{% endcall %}
  {% if user.ui_sign_in %}{% call fact("Second factor") %}{% if sign_in.second_factor %}<span class="tag ok">on</span> a code of an authenticator app after the password{% else %}off{% endif %}{% if is_me %} · <a href="/ui/second-factor">{% if sign_in.second_factor %}Your devices{% else %}Set up a second factor{% endif %}</a>{% endif %}{% endcall %}{% endif %}
  {{ fact("Last sign-in", sign_in.last_sign_in_at | when) }}
{% endcall %}

{% if not is_me and can_set_password and user.ui_sign_in %}
{% call card("Password", meta="Whoever sets a password can sign in as that user.") %}
  <form class="toolbar" method="post" action="/ui/users/{{ user.id }}/one-time">
    {{ csrf_field() }}
    <button type="submit">Make a one-time password</button>
    <span class="muted">The service makes one and shows it once.</span>
  </form>
  <div class="fold">
  <form method="post" action="/ui/users/{{ user.id }}/password">
    {{ csrf_field() }}
    <input type="hidden" name="name" value="{{ user.name }}" autocomplete="off" />
    <div class="form-grid">
      <div class="field">
        <label for="f-new">New password</label>
        <input id="f-new" name="new_password" type="password" autocomplete="new-password" minlength="15" maxlength="256" required />
      </div>
      <div class="field">
        <label for="f-repeat">New password again</label>
        <input id="f-repeat" name="repeat_password" type="password" autocomplete="new-password" minlength="15" maxlength="256" required />
      </div>
    </div>
    <span class="hint">{{ user.name }} must change it at the next sign-in.</span>
    <div class="form-actions"><button class="primary" type="submit">Set password</button></div>
  </form>
  </div>
{% endcall %}
{% endif %}

{% if not is_me and factor and factor.totp %}
{% call related("Second factor", count=factor.totp | length, meta="authenticator apps (TOTP), " ~ factor.recovery_codes_left ~ " recovery codes left. Only " ~ user.name ~ " adds one.") %}
  <div class="body tight">
    <div class="table-scroll">
      <table>
        <thead><tr><th>Authenticator app</th><th>Added</th><th>Last used</th><th class="actions"><span class="sr">Actions</span></th></tr></thead>
        <tbody>
          {% for device in factor.totp %}
          <tr>
            <td class="name">{{ device.name }}</td>
            <td>{{ ago(device.created_at) }}</td>
            <td>{{ ago(device.last_used_at) }}</td>
            <td class="actions">
              {% if can_remove_device %}{{ action("/ui/users/" ~ user.id ~ "/second-factor/totp/" ~ device.id ~ "/remove", "Remove", confirm="Remove the device " ~ device.name ~ " of " ~ user.name ~ "? Its codes work no more. The user's sessions end.", cls="small danger", icon="trash", alone=True, name="Remove " ~ device.name) }}{% endif %}
            </td>
          </tr>
          {% endfor %}
        </tbody>
      </table>
    </div>
  </div>
  {% if can_remove_factor %}
  <div class="body toolbar">
    <span class="muted grow">Removing every device lets {{ user.name }} sign in with the password alone, e.g. after every device is lost. Its sessions end.</span>
    {{ action("/ui/users/" ~ user.id ~ "/second-factor/remove", "Remove every device", confirm="Remove every device of the second factor of " ~ user.name ~ "? It signs in with the password alone then.", cls="danger", icon="trash") }}
  </div>
  {% endif %}
{% endcall %}
{% endif %}

{% if can_list_tokens %}
{% set active = tokens | selectattr(1, "equalto", "active") | list %}
{% set batch = can_revoke and active | length > 1 %}
{% call related("Tokens", count=tokens | length, meta="for the API and the MCP server", add=("New token" if can_create_token else None), add_form="new-token", add_open=not tokens or typed_token) %}
  {% if batch %}
  <form class="batch-bar" id="tokens-batch" method="post" action="/ui/users/{{ user.id }}/tokens/revoke" data-confirm="Revoke the ticked tokens? Whoever uses them is locked out at once." data-confirm-label="Revoke" data-confirm-danger>
    {{ csrf_field() }}
    <span class="label">Ticked tokens</span>
    <button class="small danger" type="submit">{{ icon("slash-circle") }} Revoke</button>
  </form>
  {% endif %}
  <div class="body tight">
    <div class="table-scroll">
      <table>
        <thead><tr>{% if batch %}<th class="tick">{{ tick_all("tokens-batch", "token") }}</th>{% endif %}<th>Name</th><th>Created</th><th>Expires</th><th>Last used</th><th>State</th><th class="actions"><span class="sr">Actions</span></th></tr></thead>
        <tbody>
          {% set columns = 7 if batch else 6 %}
          {% if can_create_token %}
          {% call row_form("new-token", columns, open=not tokens or typed_token) %}
            <form class="toolbar" method="post" action="/ui/users/{{ user.id }}/tokens">
              {{ csrf_field() }}
              <div class="field grow">
                <label for="f-token-name">What it is for</label>
                <input id="f-token-name" name="name" value="{{ typed_token.name if typed_token else '' }}" required placeholder="e.g. laptop" />
              </div>
              <div class="field">
                <label for="f-token-days">Days valid</label>
                <input id="f-token-days" name="days" value="{{ typed_token.days if typed_token else '' }}" inputmode="numeric" placeholder="empty: no expiry" />
              </div>
              <div class="form-actions"><button class="primary" type="submit">{{ icon("check-lg") }} Create token</button>{% if tokens %}<button type="button" data-close>Cancel</button>{% endif %}</div>
            </form>
          {% endcall %}
          {% endif %}
          {% for token, state in tokens %}
          <tr>
            {% if batch %}<td class="tick">{% if state == "active" %}{{ tick("tokens-batch", "token", token.id, "Tick " ~ token.name) }}{% endif %}</td>{% endif %}
            <td class="name">{{ token.name }}<span class="sub mono">{{ token.id[:16] }}…</span></td>
            <td>{{ ago(token.created_at) }}</td>
            <td>{{ token.expires_at | when }}</td>
            <td>{{ ago(token.last_used_at) }}</td>
            <td>{% if state == "active" %}<span class="tag ok">active</span>{% else %}<span class="tag">{{ state }}</span>{% endif %}</td>
            <td class="actions">
              {% if can_revoke and state == "active" %}{{ action("/ui/users/" ~ user.id ~ "/tokens/" ~ token.id ~ "/revoke", "Revoke", confirm="Revoke the token " ~ token.name ~ "? Whoever uses it is locked out at once.", cls="small danger", icon="slash-circle", alone=True, name="Revoke " ~ token.name) }}{% endif %}
            </td>
          </tr>
          {% endfor %}
        </tbody>
      </table>
    </div>
    {% if not tokens %}{{ empty("No token yet.") }}{% endif %}
  </div>
{% endcall %}
{% endif %}

{% elif tab == "activity" %}
{% if activity is not none %}
{% call related("Recent activity", meta="what this user did, newest first") %}
  <div class="body tight">
    {% if activity %}{{ activity_rows(activity, outcomes, False, who=False) }}{% else %}{{ empty("Nothing in the audit.") }}{% endif %}
  </div>
  <div class="body"><a href="/ui/audit?user={{ user.id }}">All its activity</a> · <a href="/ui/audit?record={{ user.id }}">What was done to it</a></div>
{% endcall %}
{% endif %}

{% endif %}

{% if can_delete %}
{{ danger_card("Delete", "Deletes the user and all its tokens. What it sent stays in the send audit.", "/ui/users/" ~ user.id ~ "/delete", "Delete user", "Delete " ~ user.name ~ " and its tokens?") }}
{% endif %}
{% endblock %}