{% extends "base.html" %}
{% from "components/ui.html" import action, anywhere_tag, breadcrumb, card, csrf_field, danger_card, empty, fact, facts, new_row, related, rights_tags, secret_card with context %}
{% from "components/audit.html" import activity_rows %}
{% from "components/grants.html" import grant_editor, grants_of, role_checks, role_tags, sending_of, service_editor, service_of %}
{% block title %}{{ user.name }} · {{ APP_NAME }}{% endblock %}
{% block heading %}{{ user.name }}{% endblock %}
{% block subheading %}{{ breadcrumb([("Users", "/ui/users"), (user.name, None)]) }}{% endblock %}
{% block content %}
{% if new_token %}
{% call secret_card("New token", new_token) %}Copy it now. Only its hash is kept. It cannot be shown again.{% endcall %}
{% endif %}
{% if new_password %}
{% call secret_card("One-time password", new_password) %}Pass it to {{ user.name }} over a safe channel. It must be changed at the first sign-in.{% endcall %}
{% endif %}

{% set state %}{% if is_me %}<span class="tag accent">you</span> {% endif %}{% if not user.ui_sign_in %}<span class="tag">API only</span> {% endif %}{% if user.disabled %}<span class="tag bad">disabled</span>{% else %}<span class="tag ok">active</span>{% endif %}{% endset %}
{% call facts("User", tags=state) %}
  {% call fact("Roles") %}{{ role_tags(user.roles) }}{% endcall %}
  {% call fact("Service rights") %}{{ service_of(user.service) }}{% endcall %}
  {% call fact("Grants") %}{{ grants_of(user.grants, names) }}{% endcall %}
  {% call fact("Sign-in to the UI") %}{% if not user.ui_sign_in %}off: an API user, tokens only{% elif sign_in.must_change %}with a password set for it, to change at the next sign-in{% elif sign_in.has_password %}with a password{% else %}not possible: no password yet{% endif %}{% endcall %}
  {{ fact("Last sign-in", sign_in.last_sign_in_at | when) }}
  {{ fact("Id", user.id, cls="mono") }}
{% endcall %}

{% call card("Effective rights", meta="The rights of the user and of its roles together" ~ (". They apply once the user is enabled again" if user.disabled else "") ~ ".", tight=True) %}
  {% if effective.accounts %}
  <div class="table-scroll">
    <table>
      <thead><tr><th>Account</th><th>May</th><th>Sending</th></tr></thead>
      <tbody>
        {% for row in effective.accounts %}
        <tr>
          <td class="name">{{ row.email }}{% for warning in row.warnings %}<span class="sub">{{ anywhere_tag() }}</span>{% endfor %}</td>
          <td>{{ rights_tags(row.groups, row.operations) }}</td>
          <td>{{ sending_of(row.sending) }}</td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
  {% else %}
  <p class="empty">No rights on any account you can see.</p>
  {% endif %}
  {% if effective.groups or effective.operations %}
  <div class="body">
    <dl class="facts">
      <dt>Of the service</dt>
      <dd>{{ rights_tags(effective.groups, effective.operations) }}</dd>
    </dl>
  </div>
  {% endif %}
{% endcall %}

{% if can_list_tokens %}
{% call related("Tokens", count=tokens | length, meta="for the API and the MCP server") %}
  <div class="body tight">
    {% if tokens %}
    <div class="table-scroll">
      <table>
        <thead><tr><th>Name</th><th>Created</th><th>Expires</th><th>Last used</th><th>State</th><th></th></tr></thead>
        <tbody>
          {% for token, state in tokens %}
          <tr>
            <td class="name">{{ token.name }}<span class="sub mono">{{ token.id[:16] }}…</span></td>
            <td>{{ token.created_at | when }}</td>
            <td>{{ token.expires_at | when }}</td>
            <td>{{ token.last_used_at | when }}</td>
            <td>{% if state == "active" %}<span class="tag ok">active</span>{% else %}<span class="tag">{{ state }}</span>{% endif %}</td>
            <td class="actions">
              {% if can_revoke and state == "active" %}{{ action("/ui/users/" ~ user.id ~ "/tokens/" ~ token.id ~ "/revoke", "Revoke", confirm="Revoke the token " ~ token.name ~ "? Whoever uses it is locked out at once.", cls="small danger") }}{% endif %}
            </td>
          </tr>
          {% endfor %}
        </tbody>
      </table>
    </div>
    {% else %}{{ empty("No token yet.") }}{% endif %}
  </div>
  {% if can_create_token %}
  {% call new_row("New token", open=not tokens or typed_token) %}
    <form class="toolbar" method="post" action="/ui/users/{{ user.id }}/tokens">
      {{ csrf_field() }}
      <input class="grow" name="name" value="{{ typed_token.name if typed_token else '' }}" required placeholder="What the token is for, e.g. laptop" aria-label="Token name" />
      <input name="days" value="{{ typed_token.days if typed_token else '' }}" inputmode="numeric" placeholder="days valid (empty: no expiry)" aria-label="Days valid" />
      <button class="primary" type="submit">Create token</button>
    </form>
  {% endcall %}
  {% endif %}
{% endcall %}
{% endif %}

{% if activity is not none %}
{% call related("Recent activity", meta="what this user did, newest first") %}
  <div class="body tight">
    {% if activity %}{{ activity_rows(activity, outcomes, False, who=False) }}{% else %}{{ empty("Nothing in the audit.") }}{% endif %}
  </div>
  <div class="body"><a href="/ui/audit?user={{ user.id }}">All its activity</a> · <a href="/ui/audit?record={{ user.id }}">What was done to it</a></div>
{% endcall %}
{% endif %}

{% if can_update %}
<form method="post" action="/ui/users/{{ user.id }}">
  {{ csrf_field() }}
  {% call card("Change", meta="You can hand out only rights you hold yourself.") %}
    <div class="form-grid">
      <div class="field">
        <label for="f-name">Name</label>
        <input id="f-name" name="name" value="{{ typed.name if typed else user.name }}" required />
      </div>
      {% if not is_me %}
      <div class="field">
        <span class="label">Access</span>
        <input type="hidden" name="ui_sign_in_shown" value="1" />
        <label class="check"><input type="checkbox" name="ui_sign_in" value="1"{% if (typed.ui_sign_in if typed else user.ui_sign_in) %} checked{% endif %} /> may sign in to the UI. Off: its password is deleted, its tokens keep working</label>
        <label class="check"><input type="checkbox" name="disabled" value="1"{% if (typed.disabled if typed else user.disabled) %} checked{% endif %} /> disabled: it cannot sign in, its tokens are refused</label>
      </div>
      {% endif %}
    </div>
    {% if role_choices %}{{ role_checks(role_choices, typed.roles if typed else user.roles) }}{% endif %}
    <details class="fold"{% if typed %} open{% endif %}>
      <summary>Service rights</summary>
      {{ service_editor(service, service_names, service_ops) }}
    </details>
    <details class="fold"{% if typed %} open{% endif %}>
      <summary>Grants</summary>
      {{ grant_editor(rows, account_choices, groups, group_ops) }}
    </details>
    <div class="form-actions"><button class="primary" type="submit">Save</button></div>
  {% endcall %}
</form>
{% endif %}

{% if is_me %}
{% call card("Password") %}
  <p><a href="/ui/password">Change your password</a></p>
{% endcall %}
{% elif can_set_password and user.ui_sign_in %}
{% call card("Password", meta="Whoever sets a password can sign in as that user.") %}
  <form class="toolbar" method="post" action="/ui/users/{{ user.id }}/one-time">
    {{ csrf_field() }}
    <button type="submit">Make a one-time password</button>
    <span class="muted">The service makes one and shows it once.</span>
  </form>
  <div class="fold">
  <form method="post" action="/ui/users/{{ user.id }}/password">
    {{ csrf_field() }}
    <input type="hidden" name="name" value="{{ user.name }}" autocomplete="off" />
    <div class="form-grid">
      <div class="field">
        <label for="f-new">New password</label>
        <input id="f-new" name="new_password" type="password" autocomplete="new-password" minlength="15" maxlength="256" required />
      </div>
      <div class="field">
        <label for="f-repeat">New password again</label>
        <input id="f-repeat" name="repeat_password" type="password" autocomplete="new-password" minlength="15" maxlength="256" required />
      </div>
    </div>
    <span class="hint">{{ user.name }} must change it at the next sign-in.</span>
    <div class="form-actions"><button class="primary" type="submit">Set password</button></div>
  </form>
  </div>
{% endcall %}
{% endif %}

{% if can_delete %}
{{ danger_card("Delete", "Deletes the user and all its tokens. What it sent stays in the send audit.", "/ui/users/" ~ user.id ~ "/delete", "Delete user", "Delete " ~ user.name ~ " and its tokens?") }}
{% endif %}
{% endblock %}