{% extends "admin/_layout.html" %}
{% from "_macros.html" import icon, model_avatar %}
{% set section = "groups" %}

{% block title %}Groups & permissions - LLeMbas{% endblock %}
{% block heading %}Groups & permissions{% endblock %}

{% block admin_content %}
<p class="admin-lede">
  Permissions are a <strong>union</strong>: everyone starts with the baseline
  below, and each group they belong to can add more. A group never takes
  something away, so being in a second group can only widen what someone can do.
  Administrators bypass all of it.
</p>

{% if saved %}
<div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>{{ saved }}</span></div>
{% endif %}

<section class="card">
  <h2 class="card__title">Baseline permissions</h2>
  <p class="text-sm muted" style="margin-bottom: var(--sp-4)">
    What every signed-in user can do before any group is considered. Turn
    something off here and grant it through a group to make it opt-in.
  </p>

  <form method="post" action="/admin/permissions/defaults">
    {% for section_name, defs in permission_groups.items() %}
    <div class="field">
      <span class="field__label">{{ section_name }}</span>
      {% for definition in defs %}
      <label class="checkbox perm-row">
        <input type="checkbox" name="permission" value="{{ definition.key }}"
               {{ 'checked' if baseline[definition.key] }}>
        <span>
          <strong>{{ definition.label }}</strong>
          <span class="perm-row__desc">{{ definition.description }}</span>
        </span>
      </label>
      {% endfor %}
    </div>
    {% endfor %}
    <div class="btn-row"><button class="btn btn--primary" type="submit">Save baseline</button></div>
  </form>
</section>

<h2 class="admin-section-title">
  Groups <span class="badge">{{ groups|length }}</span>
</h2>

<section class="card">
  <form method="post" action="/admin/groups" class="btn-row">
    <input class="input" name="name" placeholder="New group name" required
           aria-label="New group name">
    <button class="btn btn--primary" type="submit">
      {{ icon("plus", "icon--sm") }} Create group
    </button>
  </form>
</section>

{% if not groups %}
<div class="empty" style="padding: var(--sp-8) 0">
  {{ icon("users", "empty__mark") }}
  <p class="empty__text">
    No groups yet. Create one to grant extra permissions, or to restrict a model
    to a subset of users.
  </p>
</div>
{% endif %}

{% for group in groups %}
<section class="card">
  <form method="post" action="/admin/groups/{{ group.id }}">
    <div class="card__header">
      <strong>{{ group.name }}</strong>
      <span class="text-xs faint">
        {{ group.users|length }} member{{ '' if group.users|length == 1 else 's' }},
        {{ group.models|length }} model{{ '' if group.models|length == 1 else 's' }}
      </span>
    </div>

    <div class="field">
      <label class="field__label" for="gn-{{ group.id }}">Name</label>
      <input class="input" id="gn-{{ group.id }}" name="name" value="{{ group.name }}" required>
    </div>

    <div class="field">
      <label class="field__label" for="gd-{{ group.id }}">Description</label>
      <input class="input" id="gd-{{ group.id }}" name="description"
             value="{{ group.description }}" placeholder="What is this group for?">
    </div>

    <div class="field">
      <span class="field__label">Grants</span>
      <p class="field__hint" style="margin-bottom: var(--sp-2)">
        Anything already in the baseline stays on regardless — these only add.
      </p>
      {% for section_name, defs in permission_groups.items() %}
        {% for definition in defs %}
        <label class="checkbox perm-row">
          <input type="checkbox" name="permission" value="{{ definition.key }}"
                 {{ 'checked' if (group.permissions_json or {}).get(definition.key) }}>
          <span>
            <strong>{{ definition.label }}</strong>
            <span class="perm-row__desc">
              {{ definition.description }}
              {% if baseline[definition.key] %}<em>(already in the baseline)</em>{% endif %}
            </span>
          </span>
        </label>
        {% endfor %}
      {% endfor %}
    </div>

    <div class="field">
      <span class="field__label">Members</span>
      {% if users %}
      <div class="checkbox-row">
        {% for account in users %}
        <label class="checkbox">
          <input type="checkbox" name="user_ids" value="{{ account.id }}"
                 {{ 'checked' if account in group.users }}>
          <span>{{ account.name }}</span>
        </label>
        {% endfor %}
      </div>
      {% else %}
      <p class="field__hint">No users yet.</p>
      {% endif %}
    </div>

    <div class="field">
      <span class="field__label">Model access</span>
      <p class="field__hint" style="margin-bottom: var(--sp-2)">
        Models marked “available to everyone” are reachable regardless. These
        grant access to the restricted ones.
      </p>
      {% if models %}
      <div class="checkbox-row">
        {% for model in models %}
        <label class="checkbox {{ 'is-muted' if model.public }}">
          <input type="checkbox" name="model_ids" value="{{ model.id }}"
                 {{ 'checked' if model in group.models }}>
          <span>{{ model.label }}{% if model.public %} <em>(public)</em>{% endif %}</span>
        </label>
        {% endfor %}
      </div>
      {% else %}
      <p class="field__hint">No models yet.</p>
      {% endif %}
    </div>

    <div class="btn-row">
      <button class="btn btn--primary" type="submit">Save {{ group.name }}</button>
    </div>
  </form>

  <div class="card__footer">
    <span class="text-xs faint">Deleting a group leaves its members alone.</span>
    <form method="post" action="/admin/groups/{{ group.id }}/delete"
          data-confirm="Delete the group “{{ group.name }}”? Its members keep their accounts."
          data-confirm-title="Delete group">
      <button class="btn btn--sm btn--danger" type="submit">
        {{ icon("trash", "icon--sm") }} Delete
      </button>
    </form>
  </div>
</section>
{% endfor %}
{% endblock %}