{{define "access"}}{{template "header" .}}

{{if not .OAuthOn}}
<div class="alert alert-warning">
  <i class="fa-solid fa-triangle-exclamation me-1"></i>
  Google OAuth is not configured, so these sign-in rules are inactive. Set
  <code>MT_GOOGLE_CLIENT_ID</code>/<code>MT_GOOGLE_CLIENT_SECRET</code> to enable them.
  HTTP basic auth (<code>MT_ADMIN_USER</code>) always bypasses this policy.
</div>
{{end}}

<!-- Sign-in policy -->
<form method="POST" action="/admin/access" class="card card-body shadow-sm mb-4">
  <input type="hidden" name="csrf" value="{{csrf}}">
  <h2 class="h5 mb-3"><i class="fa-solid fa-shield-halved me-2"></i>Sign-in policy</h2>

  <fieldset class="mb-3">
    <legend class="fs-6 text-body-secondary">New sign-ins</legend>
    <div class="form-check">
      <input class="form-check-input" type="radio" name="signup_mode" id="mode-open" value="open" {{if eq .SignupMode "open"}}checked{{end}}>
      <label class="form-check-label" for="mode-open">
        <strong>Open</strong> — anyone in an allowed domain can sign in and is added automatically.
      </label>
    </div>
    <div class="form-check">
      <input class="form-check-input" type="radio" name="signup_mode" id="mode-approval" value="approval" {{if eq .SignupMode "approval"}}checked{{end}}>
      <label class="form-check-label" for="mode-approval">
        <strong>Approval required</strong> — domain sign-ins are queued as pending until an admin approves them.
      </label>
    </div>
    <div class="form-check">
      <input class="form-check-input" type="radio" name="signup_mode" id="mode-allowlist" value="allowlist" {{if eq .SignupMode "allowlist"}}checked{{end}}>
      <label class="form-check-label" for="mode-allowlist">
        <strong>Allow-list only (closed)</strong> — only emails you add below may sign in. New accounts are rejected.
      </label>
    </div>
  </fieldset>

  <div class="mb-3">
    <label class="form-label" for="domains">Allowed domains</label>
    <input class="form-control" id="domains" name="domains" value="{{.Domains}}"
           placeholder="mokoconsulting.tech, clientco.com">
    <div class="form-text">Comma- or space-separated. Leave blank to allow any domain (not recommended). Applies in every mode.</div>
  </div>

  <div><button class="btn btn-mk" type="submit"><i class="fa-solid fa-floppy-disk me-1"></i>Save policy</button></div>
</form>

<!-- Pending approvals -->
{{if .Pending}}
<div class="card card-body shadow-sm mb-4">
  <h2 class="h5 mb-3"><i class="fa-solid fa-hourglass-half me-2"></i>Pending requests <span class="badge text-bg-warning">{{len .Pending}}</span></h2>
  <div class="table-responsive">
    <table class="table table-hover align-middle mb-0">
      <thead><tr><th>Email</th><th>Requested</th><th class="text-end">Actions</th></tr></thead>
      <tbody>
      {{range .Pending}}
        <tr>
          <td>{{.Email}}</td>
          <td class="text-body-secondary">{{.Created.Format "2006-01-02 15:04"}}</td>
          <td class="text-end">
            <form method="POST" action="/admin/access/user/approve" class="d-inline">
              <input type="hidden" name="csrf" value="{{csrf}}"><input type="hidden" name="email" value="{{.Email}}">
              <button class="btn btn-sm btn-success" type="submit"><i class="fa-solid fa-check me-1"></i>Approve</button>
            </form>
            <form method="POST" action="/admin/access/user/remove" class="d-inline"
                  onsubmit="return confirm('Reject and remove {{.Email}}?');">
              <input type="hidden" name="csrf" value="{{csrf}}"><input type="hidden" name="email" value="{{.Email}}">
              <button class="btn btn-sm btn-outline-danger" type="submit"><i class="fa-solid fa-xmark me-1"></i>Reject</button>
            </form>
          </td>
        </tr>
      {{end}}
      </tbody>
    </table>
  </div>
</div>
{{end}}

<!-- Allow-list -->
<div class="card card-body shadow-sm mb-4">
  <h2 class="h5 mb-3"><i class="fa-solid fa-users me-2"></i>Allowed users</h2>

  <form method="POST" action="/admin/access/user/add" class="row g-2 align-items-end mb-3">
    <input type="hidden" name="csrf" value="{{csrf}}">
    <div class="col-sm-8 col-md-6">
      <label class="form-label" for="email">Add an approved email</label>
      <input class="form-control" id="email" name="email" type="email" placeholder="person@mokoconsulting.tech" required>
    </div>
    <div class="col-auto"><button class="btn btn-mk" type="submit"><i class="fa-solid fa-plus me-1"></i>Add</button></div>
  </form>

  <div class="table-responsive">
    <table class="table table-hover align-middle">
      <thead><tr><th>Email</th><th>Status</th><th>Added by</th><th>Last login</th><th class="text-end"></th></tr></thead>
      <tbody>
      {{range .Active}}
        <tr>
          <td>{{.Email}}</td>
          <td>
            {{if eq .Status "approved"}}<span class="badge text-bg-success">approved</span>
            {{else if eq .Status "blocked"}}<span class="badge text-bg-danger">blocked</span>
            {{else}}<span class="badge text-bg-secondary">{{.Status}}</span>{{end}}
          </td>
          <td class="text-body-secondary small">{{.AddedBy}}</td>
          <td class="text-body-secondary small">{{if .LastLogin.IsZero}}&mdash;{{else}}{{.LastLogin.Format "2006-01-02 15:04"}}{{end}}</td>
          <td class="text-end">
            {{if eq .Status "blocked"}}
            <form method="POST" action="/admin/access/user/approve" class="d-inline">
              <input type="hidden" name="csrf" value="{{csrf}}"><input type="hidden" name="email" value="{{.Email}}">
              <button class="btn btn-sm btn-outline-success" type="submit"><i class="fa-solid fa-unlock me-1"></i>Unblock</button>
            </form>
            {{else}}
            <form method="POST" action="/admin/access/user/block" class="d-inline">
              <input type="hidden" name="csrf" value="{{csrf}}"><input type="hidden" name="email" value="{{.Email}}">
              <button class="btn btn-sm btn-outline-warning" type="submit"><i class="fa-solid fa-ban me-1"></i>Block</button>
            </form>
            {{end}}
            <form method="POST" action="/admin/access/user/remove" class="d-inline"
                  onsubmit="return confirm('Remove {{.Email}} from the allow-list?');">
              <input type="hidden" name="csrf" value="{{csrf}}"><input type="hidden" name="email" value="{{.Email}}">
              <button class="btn btn-sm btn-outline-danger" type="submit"><i class="fa-solid fa-trash me-1"></i>Remove</button>
            </form>
          </td>
        </tr>
      {{else}}
        <tr><td colspan="5" class="text-body-secondary">No users yet. In <strong>open</strong> mode they appear here after first sign-in.</td></tr>
      {{end}}
      </tbody>
    </table>
  </div>
</div>

{{template "footer" .}}{{end}}