Milestone 0.2: accounts and access 19bb31ff1f5c

-- Accounts, organisations, roles, tokens, linked identities and the audit

-- log (hub spec §5). Repository content stays in the object stores.

CREATE TABLE accounts (

    id             INTEGER PRIMARY KEY,

    username       TEXT NOT NULL UNIQUE COLLATE NOCASE,

    display_name   TEXT NOT NULL DEFAULT '',

    email          TEXT NOT NULL DEFAULT '',

    email_verified INTEGER NOT NULL DEFAULT 0,

    password_hash  TEXT NOT NULL,

    session_salt   TEXT NOT NULL,

    totp_secret    TEXT,

    recovery_codes TEXT NOT NULL DEFAULT '',

    is_admin       INTEGER NOT NULL DEFAULT 0,

    banned         INTEGER NOT NULL DEFAULT 0,

    created_ms     INTEGER NOT NULL,

    last_seen_ms   INTEGER NOT NULL DEFAULT 0

);

CREATE TABLE organisations (

    id           INTEGER PRIMARY KEY,

    name         TEXT NOT NULL UNIQUE COLLATE NOCASE,

    display_name TEXT NOT NULL DEFAULT '',

    description  TEXT NOT NULL DEFAULT '',

    default_role TEXT NOT NULL DEFAULT 'read' CHECK (default_role IN ('none', 'read', 'triage', 'write', 'maintain', 'admin')),

    created_ms   INTEGER NOT NULL

);

CREATE TABLE org_members (

    org_id     INTEGER NOT NULL REFERENCES organisations(id) ON DELETE CASCADE,

    account_id INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    role       TEXT NOT NULL DEFAULT 'member' CHECK (role IN ('owner', 'member')),

    PRIMARY KEY (org_id, account_id)

);

CREATE TABLE teams (

    id     INTEGER PRIMARY KEY,

    org_id INTEGER NOT NULL REFERENCES organisations(id) ON DELETE CASCADE,

    name   TEXT NOT NULL COLLATE NOCASE,

    UNIQUE (org_id, name)

);

CREATE TABLE team_members (

    team_id    INTEGER NOT NULL REFERENCES teams(id) ON DELETE CASCADE,

    account_id INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    PRIMARY KEY (team_id, account_id)

);

-- A collaborator is an account or a team with a role on one repository.

CREATE TABLE collaborators (

    repo_id    INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,

    account_id INTEGER REFERENCES accounts(id) ON DELETE CASCADE,

    team_id    INTEGER REFERENCES teams(id) ON DELETE CASCADE,

    role       TEXT NOT NULL CHECK (role IN ('read', 'triage', 'write', 'maintain', 'admin')),

    CHECK ((account_id IS NULL) <> (team_id IS NULL))

);

CREATE UNIQUE INDEX collaborators_account ON collaborators (repo_id, account_id) WHERE account_id IS NOT NULL;

CREATE UNIQUE INDEX collaborators_team ON collaborators (repo_id, team_id) WHERE team_id IS NOT NULL;

CREATE TABLE tokens (

    id           INTEGER PRIMARY KEY,

    account_id   INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    name         TEXT NOT NULL,

    hash         TEXT NOT NULL UNIQUE,

    scopes       TEXT NOT NULL,

    repos        TEXT NOT NULL DEFAULT '',

    created_ms   INTEGER NOT NULL,

    expires_ms   INTEGER,

    last_used_ms INTEGER

);

-- Oxygen identities an account has proven it holds.

CREATE TABLE identities (

    key        TEXT PRIMARY KEY,

    account_id INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    name       TEXT NOT NULL,

    email      TEXT NOT NULL,

    object     BLOB NOT NULL,

    linked_ms  INTEGER NOT NULL

);

CREATE TABLE challenges (

    id         INTEGER PRIMARY KEY,

    account_id INTEGER NOT NULL REFERENCES accounts(id) ON DELETE CASCADE,

    bytes      TEXT NOT NULL,

    object     BLOB NOT NULL DEFAULT X'',

    created_ms INTEGER NOT NULL

);

CREATE TABLE invitations (

    code       TEXT PRIMARY KEY,

    created_by INTEGER REFERENCES accounts(id) ON DELETE SET NULL,

    used_by    INTEGER REFERENCES accounts(id) ON DELETE SET NULL,

    created_ms INTEGER NOT NULL

);

CREATE TABLE audit (

    id         INTEGER PRIMARY KEY,

    at_ms      INTEGER NOT NULL,

    actor_id   INTEGER REFERENCES accounts(id) ON DELETE SET NULL,

    actor      TEXT NOT NULL DEFAULT '',

    action     TEXT NOT NULL,

    target     TEXT NOT NULL DEFAULT '',

    detail     TEXT NOT NULL DEFAULT ''

);

CREATE INDEX audit_by_time ON audit (at_ms DESC);

-- Site settings that an administrator changes at run time.

CREATE TABLE settings (

    key   TEXT PRIMARY KEY,

    value TEXT NOT NULL

);

ALTER TABLE pushes ADD COLUMN account_id INTEGER REFERENCES accounts(id) ON DELETE SET NULL;

ALTER TABLE pushes ADD COLUMN pusher TEXT NOT NULL DEFAULT '';

//! Authentication and authorisation (hub spec §5, §15.3): passwords,

//! session cookies, CSRF tokens, TOTP, personal access tokens, roles, and

//! the viewer extractor pages use.

pub mod roles;

pub mod totp;

pub mod viewer;

pub use roles::{Access, Role};

pub use viewer::{Viewer, ViewerAccount};

use argon2::password_hash::{PasswordHash, PasswordHasher, PasswordVerifier, SaltString};

use argon2::Argon2;

use rand::RngCore;

use std::path::Path;

use subtle::ConstantTimeEq;

/// The key that signs cookies and CSRF tokens, kept in `<data>/keys/cookie.key`.

#[derive(Clone)]

pub struct CookieKey([u8; 32]);

impl CookieKey {

    pub fn load_or_create(keys: &Path) -> anyhow::Result<CookieKey> {

        std::fs::create_dir_all(keys)?;

        let path = keys.join("cookie.key");

        if let Ok(bytes) = std::fs::read(&path) {

            if bytes.len() == 32 {

                return Ok(CookieKey(bytes.try_into().unwrap()));

            }

        }

        let mut k = [0u8; 32];

        rand::rngs::OsRng.fill_bytes(&mut k);

        std::fs::write(&path, k)?;

        #[cfg(unix)]

        {

            use std::os::unix::fs::PermissionsExt;

            std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600))?;

        }

        Ok(CookieKey(k))

    }

    /// Keyed BLAKE3 over `message`, as hex.

    pub fn mac(&self, message: &[u8]) -> String {

        hex::encode(blake3::keyed_hash(&self.0, message).as_bytes())

    }

}

/// Constant-time equality of two hex MACs.

pub fn mac_equal(a: &str, b: &str) -> bool {

    a.len() == b.len() && a.as_bytes().ct_eq(b.as_bytes()).into()

}

pub fn hash_password(password: &str) -> anyhow::Result<String> {

    let salt = SaltString::generate(&mut rand::rngs::OsRng);

    Ok(Argon2::default().hash_password(password.as_bytes(), &salt).map_err(|e| anyhow::anyhow!("{e}"))?.to_string())

}

pub fn verify_password(hash: &str, password: &str) -> bool {

    match PasswordHash::new(hash) {

        Ok(parsed) => Argon2::default().verify_password(password.as_bytes(), &parsed).is_ok(),

        Err(_) => false,

    }

}

/// A password policy that is honest rather than theatrical: length only.

pub fn password_ok(password: &str) -> Result<(), &'static str> {

    if password.chars().count() < 10 {

        return Err("a password is at least 10 characters");

    }

    if password.len() > 256 {

        return Err("a password is at most 256 bytes");

    }

    Ok(())

}

pub fn random_hex(bytes: usize) -> String {

    let mut b = vec![0u8; bytes];

    rand::rngs::OsRng.fill_bytes(&mut b);

    hex::encode(b)

}

/// A personal access token: `oxyhub_` plus 32 random bytes as hex. Stored

/// as its BLAKE3 hash.

pub fn new_token() -> (String, String) {

    let secret = format!("oxyhub_{}", random_hex(32));

    (secret.clone(), token_hash(&secret))

}

pub fn token_hash(secret: &str) -> String {

    hex::encode(blake3::hash(secret.as_bytes()).as_bytes())

}

/// The session cookie's value for an account: `username.mac`.

pub fn session_value(key: &CookieKey, username: &str, session_salt: &str) -> String {

    format!("{username}.{}", key.mac(format!("session:{username}:{session_salt}").as_bytes()))

}

/// The CSRF token bound to a session value.

pub fn csrf_token(key: &CookieKey, session_value: &str) -> String {

    key.mac(format!("csrf:{session_value}").as_bytes())

}

pub const SESSION_COOKIE: &str = "oxyhub";

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn passwords_and_tokens() {

        let h = hash_password("correct horse battery").unwrap();

        assert!(verify_password(&h, "correct horse battery"));

        assert!(!verify_password(&h, "wrong"));

        assert!(!verify_password("garbage", "x"));

        assert!(password_ok("short").is_err());

        let (secret, hash) = new_token();

        assert!(secret.starts_with("oxyhub_"));

        assert_eq!(token_hash(&secret), hash);

        assert!(mac_equal("ab", "ab") && !mac_equal("ab", "ac") && !mac_equal("a", "ab"));

    }

    #[test]

    fn cookie_key_persists() {

        let dir = tempfile::tempdir().unwrap();

        let a = CookieKey::load_or_create(dir.path()).unwrap();

        let b = CookieKey::load_or_create(dir.path()).unwrap();

        assert_eq!(a.mac(b"x"), b.mac(b"x"));

        let v = session_value(&a, "andy", "salt");

        assert!(v.starts_with("andy."));

        assert_ne!(csrf_token(&a, &v), csrf_token(&a, "other"));

    }

}

//! Roles on repositories and organisations (hub spec §5.2, §5.5). The hub's

//! roles decide who may reach a repository and attempt a push; the

//! repository's trust policy decides which keys may move which references.

use crate::db::{self, accounts::Account, repos::RepoRow, Pool};

use hub_api::Visibility;

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]

#[repr(u8)]

pub enum Role {

    Read = 1,

    Triage = 2,

    Write = 3,

    Maintain = 4,

    Admin = 5,

}

impl Role {

    pub fn parse(s: &str) -> Option<Role> {

        Some(match s {

            "read" => Role::Read,

            "triage" => Role::Triage,

            "write" => Role::Write,

            "maintain" => Role::Maintain,

            "admin" => Role::Admin,

            _ => return None,

        })

    }

    pub fn as_str(self) -> &'static str {

        match self {

            Role::Read => "read",

            Role::Triage => "triage",

            Role::Write => "write",

            Role::Maintain => "maintain",

            Role::Admin => "admin",

        }

    }

    pub const ALL: [Role; 5] = [Role::Read, Role::Triage, Role::Write, Role::Maintain, Role::Admin];

}

/// What a request wants to do with a repository.

#[derive(Clone, Copy, Debug, PartialEq, Eq)]

pub enum Access {

    Read,

    Write,

    Maintain,

    Admin,

}

impl Access {

    fn needs(self) -> Role {

        match self {

            Access::Read => Role::Read,

            Access::Write => Role::Write,

            Access::Maintain => Role::Maintain,

            Access::Admin => Role::Admin,

        }

    }

}

/// The role `account` (or nobody) holds on `repo`, from ownership,

/// organisation membership, collaborator entries and visibility.

pub async fn role_for(pool: &Pool, account: Option<&Account>, repo: &RepoRow) -> sqlx::Result<Option<Role>> {

    let visibility = repo.visibility();

    let Some(account) = account else {

        return Ok(if visibility == Visibility::Public { Some(Role::Read) } else { None });

    };

    if account.banned {

        return Ok(None);

    }

    if account.is_admin || account.username.eq_ignore_ascii_case(&repo.owner) {

        return Ok(Some(Role::Admin));

    }

    let mut best: Option<Role> = None;

    if let Some(org) = db::accounts::org_by_name(pool, &repo.owner).await? {

        match db::accounts::org_role(pool, org.id, account.id).await?.as_deref() {

            Some("owner") => return Ok(Some(Role::Admin)),

            Some(_) => best = Role::parse(&org.default_role),

            None => {}

        }

    }

    if let Some(r) = db::accounts::collaborator_role(pool, repo.id, account.id).await?.as_deref().and_then(Role::parse) {

        best = Some(best.map_or(r, |b| b.max(r)));

    }

    if best.is_none() && visibility != Visibility::Private {

        best = Some(Role::Read);

    }

    Ok(best)

}

/// Whether `role` permits `access`.

pub fn allows(role: Option<Role>, access: Access) -> bool {

    role.is_some_and(|r| r >= access.needs())

}

/// Whether an account may create repositories under `owner`.

pub async fn may_create_under(pool: &Pool, account: &Account, owner: &str) -> sqlx::Result<bool> {

    if account.banned {

        return Ok(false);

    }

    if account.username.eq_ignore_ascii_case(owner) || account.is_admin {

        return Ok(true);

    }

    match db::accounts::org_by_name(pool, owner).await? {

        Some(org) => Ok(db::accounts::org_role(pool, org.id, account.id).await?.is_some()),

        None => Ok(false),

    }

}

/// Whether an account administers an organisation.

pub async fn is_org_owner(pool: &Pool, account: &Account, org_id: i64) -> sqlx::Result<bool> {

    if account.is_admin {

        return Ok(true);

    }

    Ok(db::accounts::org_role(pool, org_id, account.id).await?.as_deref() == Some("owner"))

}

//! Time-based one-time passwords (RFC 6238, SHA-1, six digits, 30 s) and

//! recovery codes (hub spec §15.3).

use hmac::{Hmac, Mac};

use sha1::Sha1;

pub fn new_secret() -> String {

    let mut b = [0u8; 20];

    rand::RngCore::fill_bytes(&mut rand::rngs::OsRng, &mut b);

    base32::encode(base32::Alphabet::Rfc4648 { padding: false }, &b)

}

fn code_at(secret: &str, counter: u64) -> Option<String> {

    let key = base32::decode(base32::Alphabet::Rfc4648 { padding: false }, secret)?;

    let mut mac = Hmac::<Sha1>::new_from_slice(&key).ok()?;

    mac.update(&counter.to_be_bytes());

    let digest = mac.finalize().into_bytes();

    let offset = (digest[19] & 0x0f) as usize;

    let bin = ((digest[offset] as u32 & 0x7f) << 24)

        | ((digest[offset + 1] as u32) << 16)

        | ((digest[offset + 2] as u32) << 8)

        | digest[offset + 3] as u32;

    Some(format!("{:06}", bin % 1_000_000))

}

/// The current code, for tests and the enrolment check.

pub fn current(secret: &str, now_s: u64) -> Option<String> {

    code_at(secret, now_s / 30)

}

/// Accept the code for this step and its neighbours (one step of drift).

pub fn verify(secret: &str, code: &str, now_s: u64) -> bool {

    let code = code.trim().replace(' ', "");

    let step = now_s / 30;

    [step.wrapping_sub(1), step, step + 1].iter().any(|c| code_at(secret, *c).is_some_and(|x| x == code))

}

/// `otpauth://` URI for authenticator apps.

pub fn uri(site: &str, username: &str, secret: &str) -> String {

    let label = format!("{site}:{username}").replace(' ', "%20");

    format!("otpauth://totp/{label}?secret={secret}&issuer={}&algorithm=SHA1&digits=6&period=30", site.replace(' ', "%20"))

}

/// The provisioning URI as an SVG QR code.

pub fn qr_svg(uri: &str) -> Option<String> {

    let code = qrcode::QrCode::new(uri.as_bytes()).ok()?;

    Some(code.render::<qrcode::render::svg::Color>().min_dimensions(180, 180).quiet_zone(true).build())

}

/// Ten recovery codes; stored as BLAKE3 hashes separated by commas.

pub fn new_recovery_codes() -> (Vec<String>, String) {

    let codes: Vec<String> = (0..10).map(|_| super::random_hex(5)).collect();

    let stored = codes.iter().map(|c| hex::encode(blake3::hash(c.as_bytes()).as_bytes())).collect::<Vec<_>>().join(",");

    (codes, stored)

}

/// Use a recovery code: the remaining stored codes if it matched.

pub fn use_recovery_code(stored: &str, code: &str) -> Option<String> {

    let hash = hex::encode(blake3::hash(code.trim().as_bytes()).as_bytes());

    let all: Vec<&str> = stored.split(',').filter(|s| !s.is_empty()).collect();

    if !all.contains(&hash.as_str()) {

        return None;

    }

    Some(all.into_iter().filter(|h| *h != hash).collect::<Vec<_>>().join(","))

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn rfc_6238_vector() {

        // RFC 6238 appendix B, SHA-1, secret "12345678901234567890", 59 s → 94287082 (8 digits); 6 digits are the last six.

        let secret = base32::encode(base32::Alphabet::Rfc4648 { padding: false }, b"12345678901234567890");

        assert_eq!(current(&secret, 59).unwrap(), "287082");

        assert_eq!(current(&secret, 1111111109).unwrap(), "081804");

        assert!(verify(&secret, "287082", 59));

        assert!(verify(&secret, "287 082", 75), "drift of one step");

        assert!(!verify(&secret, "000000", 59));

    }

    #[test]

    fn recovery_codes() {

        let (codes, stored) = new_recovery_codes();

        assert_eq!(codes.len(), 10);

        let rest = use_recovery_code(&stored, &codes[3]).unwrap();

        assert!(use_recovery_code(&rest, &codes[3]).is_none(), "a code is single use");

        assert!(use_recovery_code(&rest, &codes[4]).is_some());

        assert!(qr_svg(&uri("Oxygenhub", "andy", &new_secret())).unwrap().contains("<svg"));

    }

}

//! Who is asking: the session cookie resolved to an account, as an axum

//! extractor every page handler takes.

use super::{csrf_token, mac_equal, session_value, SESSION_COOKIE};

use crate::db::{self, accounts::Account};

use crate::Shared;

use axum::extract::FromRequestParts;

use axum::http::request::Parts;

use axum::http::{header, HeaderMap};

use std::convert::Infallible;

#[derive(Clone, Debug)]

pub struct ViewerAccount {

    pub account: Account,

    /// The cookie value, which CSRF tokens are bound to.

    pub session: String,

    pub csrf: String,

}

/// The signed-in account, if any. Never fails: anonymous is a valid viewer.

#[derive(Clone, Debug, Default)]

pub struct Viewer(pub Option<ViewerAccount>);

impl Viewer {

    pub fn account(&self) -> Option<&Account> {

        self.0.as_ref().map(|v| &v.account)

    }

    pub fn signed_in(&self) -> bool {

        self.0.is_some()

    }

    pub fn is_admin(&self) -> bool {

        self.account().is_some_and(|a| a.is_admin)

    }

    pub fn csrf(&self) -> &str {

        self.0.as_ref().map(|v| v.csrf.as_str()).unwrap_or("")

    }

    /// Whether a submitted CSRF token belongs to this session.

    pub fn csrf_ok(&self, token: &str) -> bool {

        self.0.as_ref().is_some_and(|v| mac_equal(&v.csrf, token))

    }

}

/// The value of a named cookie in the request.

pub fn cookie(headers: &HeaderMap, name: &str) -> Option<String> {

    headers.get_all(header::COOKIE).iter().filter_map(|v| v.to_str().ok()).flat_map(|line| line.split(';')).find_map(|kv| {

        let (k, v) = kv.trim().split_once('=')?;

        (k == name).then(|| v.trim().to_string())

    })

}

/// Resolve a session cookie value to its account.

pub async fn resolve(app: &Shared, value: &str) -> Option<ViewerAccount> {

    let (username, mac) = value.rsplit_once('.')?;

    let account = db::accounts::account_by_name(&app.db, username).await.ok()??;

    if account.banned {

        return None;

    }

    let expected = session_value(&app.cookie_key, &account.username, &account.session_salt);

    let (_, expected_mac) = expected.rsplit_once('.')?;

    if !mac_equal(expected_mac, mac) {

        return None;

    }

    let csrf = csrf_token(&app.cookie_key, &expected);

    Some(ViewerAccount { account, session: expected, csrf })

}

impl FromRequestParts<Shared> for Viewer {

    type Rejection = Infallible;

    async fn from_request_parts(parts: &mut Parts, app: &Shared) -> Result<Viewer, Infallible> {

        let Some(value) = cookie(&parts.headers, SESSION_COOKIE) else { return Ok(Viewer(None)) };

        let viewer = resolve(app, &value).await;

        if let Some(v) = &viewer {

            let pool = app.db.clone();

            let id = v.account.id;

            tokio::spawn(async move {

                let _ = db::accounts::touch_seen(&pool, id).await;

            });

        }

        Ok(Viewer(viewer))

    }

}

//! Accounts, organisations, teams, collaborators, identities, tokens,

//! invitations, settings and the audit log (hub spec §5).

use super::{now_ms, Pool};

use sqlx::FromRow;

#[derive(Clone, Debug, FromRow)]

pub struct Account {

    pub id: i64,

    pub username: String,

    pub display_name: String,

    pub email: String,

    pub email_verified: bool,

    pub password_hash: String,

    pub session_salt: String,

    pub totp_secret: Option<String>,

    pub recovery_codes: String,

    pub is_admin: bool,

    pub banned: bool,

    pub created_ms: i64,

    pub last_seen_ms: i64,

}

impl Account {

    pub fn name(&self) -> &str {

        if self.display_name.is_empty() {

            &self.username

        } else {

            &self.display_name

        }

    }

    pub fn totp_enabled(&self) -> bool {

        self.totp_secret.is_some()

    }

}

#[derive(Clone, Debug, FromRow)]

pub struct Organisation {

    pub id: i64,

    pub name: String,

    pub display_name: String,

    pub description: String,

    pub default_role: String,

    pub created_ms: i64,

}

#[derive(Clone, Debug, FromRow)]

pub struct Team {

    pub id: i64,

    pub org_id: i64,

    pub name: String,

}

#[derive(Clone, Debug, FromRow)]

pub struct Token {

    pub id: i64,

    pub account_id: i64,

    pub name: String,

    pub hash: String,

    pub scopes: String,

    pub repos: String,

    pub created_ms: i64,

    pub expires_ms: Option<i64>,

    pub last_used_ms: Option<i64>,

}

impl Token {

    pub fn scope_list(&self) -> Vec<&str> {

        self.scopes.split(',').filter(|s| !s.is_empty()).collect()

    }

    pub fn has_scope(&self, scope: &str) -> bool {

        self.scope_list().contains(&scope)

    }

    /// Whether the token may touch `owner/name`: every repository when the

    /// list is empty.

    pub fn covers(&self, slug: &str) -> bool {

        self.repos.is_empty() || self.repos.split(',').any(|r| r.trim().eq_ignore_ascii_case(slug))

    }

    pub fn expired(&self, now: i64) -> bool {

        self.expires_ms.is_some_and(|e| e < now)

    }

}

#[derive(Clone, Debug, FromRow)]

pub struct LinkedIdentity {

    pub key: String,

    pub account_id: i64,

    pub name: String,

    pub email: String,

    pub object: Vec<u8>,

    pub linked_ms: i64,

}

#[derive(Clone, Debug, FromRow)]

pub struct AuditRow {

    pub id: i64,

    pub at_ms: i64,

    pub actor: String,

    pub action: String,

    pub target: String,

    pub detail: String,

}

// ---------------------------------------------------------------- accounts

pub async fn account_by_name(pool: &Pool, username: &str) -> sqlx::Result<Option<Account>> {

    sqlx::query_as("SELECT * FROM accounts WHERE username = ?").bind(username).fetch_optional(pool).await

}

pub async fn account_by_id(pool: &Pool, id: i64) -> sqlx::Result<Option<Account>> {

    sqlx::query_as("SELECT * FROM accounts WHERE id = ?").bind(id).fetch_optional(pool).await

}

pub async fn accounts(pool: &Pool) -> sqlx::Result<Vec<Account>> {

    sqlx::query_as("SELECT * FROM accounts ORDER BY username").fetch_all(pool).await

}

pub async fn account_count(pool: &Pool) -> sqlx::Result<i64> {

    sqlx::query_scalar("SELECT COUNT(*) FROM accounts").fetch_one(pool).await

}

pub async fn create_account(

    pool: &Pool,

    username: &str,

    email: &str,

    password_hash: &str,

    session_salt: &str,

    is_admin: bool,

) -> sqlx::Result<Account> {

    sqlx::query_as(

        "INSERT INTO accounts (username, email, password_hash, session_salt, is_admin, created_ms) VALUES (?, ?, ?, ?, ?, ?) RETURNING *",

    )

    .bind(username)

    .bind(email)

    .bind(password_hash)

    .bind(session_salt)

    .bind(is_admin)

    .bind(now_ms())

    .fetch_one(pool)

    .await

}

pub async fn set_profile(pool: &Pool, id: i64, display_name: &str, email: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET display_name = ?, email = ? WHERE id = ?")

        .bind(display_name)

        .bind(email)

        .bind(id)

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn set_password(pool: &Pool, id: i64, password_hash: &str, session_salt: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET password_hash = ?, session_salt = ? WHERE id = ?")

        .bind(password_hash)

        .bind(session_salt)

        .bind(id)

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn set_session_salt(pool: &Pool, id: i64, session_salt: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET session_salt = ? WHERE id = ?").bind(session_salt).bind(id).execute(pool).await?;

    Ok(())

}

pub async fn set_totp(pool: &Pool, id: i64, secret: Option<&str>, recovery_codes: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET totp_secret = ?, recovery_codes = ? WHERE id = ?")

        .bind(secret)

        .bind(recovery_codes)

        .bind(id)

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn set_admin(pool: &Pool, id: i64, is_admin: bool) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET is_admin = ? WHERE id = ?").bind(is_admin).bind(id).execute(pool).await?;

    Ok(())

}

pub async fn set_banned(pool: &Pool, id: i64, banned: bool) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET banned = ? WHERE id = ?").bind(banned).bind(id).execute(pool).await?;

    Ok(())

}

pub async fn touch_seen(pool: &Pool, id: i64) -> sqlx::Result<()> {

    sqlx::query("UPDATE accounts SET last_seen_ms = ? WHERE id = ?").bind(now_ms()).bind(id).execute(pool).await?;

    Ok(())

}

// ----------------------------------------------------------- organisations

pub async fn org_by_name(pool: &Pool, name: &str) -> sqlx::Result<Option<Organisation>> {

    sqlx::query_as("SELECT * FROM organisations WHERE name = ?").bind(name).fetch_optional(pool).await

}

pub async fn orgs(pool: &Pool) -> sqlx::Result<Vec<Organisation>> {

    sqlx::query_as("SELECT * FROM organisations ORDER BY name").fetch_all(pool).await

}

pub async fn orgs_of(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<(Organisation, String)>> {

    let rows: Vec<(i64, String, String, String, String, i64, String)> = sqlx::query_as(

        "SELECT o.id, o.name, o.display_name, o.description, o.default_role, o.created_ms, m.role FROM organisations o JOIN org_members m ON m.org_id = o.id WHERE m.account_id = ? ORDER BY o.name",

    )

    .bind(account_id)

    .fetch_all(pool)

    .await?;

    Ok(rows

        .into_iter()

        .map(|(id, name, display_name, description, default_role, created_ms, role)| {

            (Organisation { id, name, display_name, description, default_role, created_ms }, role)

        })

        .collect())

}

pub async fn create_org(pool: &Pool, name: &str, display_name: &str, owner: i64) -> sqlx::Result<Organisation> {

    let mut tx = pool.begin().await?;

    let org: Organisation = sqlx::query_as("INSERT INTO organisations (name, display_name, created_ms) VALUES (?, ?, ?) RETURNING *")

        .bind(name)

        .bind(display_name)

        .bind(now_ms())

        .fetch_one(&mut *tx)

        .await?;

    sqlx::query("INSERT INTO org_members (org_id, account_id, role) VALUES (?, ?, 'owner')")

        .bind(org.id)

        .bind(owner)

        .execute(&mut *tx)

        .await?;

    tx.commit().await?;

    Ok(org)

}

pub async fn set_org(pool: &Pool, id: i64, display_name: &str, description: &str, default_role: &str) -> sqlx::Result<()> {

    sqlx::query("UPDATE organisations SET display_name = ?, description = ?, default_role = ? WHERE id = ?")

        .bind(display_name)

        .bind(description)

        .bind(default_role)

        .bind(id)

        .execute(pool)

        .await?;

    Ok(())

}

/// `(account, role)` for every member.

pub async fn org_members(pool: &Pool, org_id: i64) -> sqlx::Result<Vec<(Account, String)>> {

    let rows: Vec<(i64, String)> =

        sqlx::query_as("SELECT account_id, role FROM org_members WHERE org_id = ?").bind(org_id).fetch_all(pool).await?;

    let mut out = Vec::new();

    for (id, role) in rows {

        if let Some(a) = account_by_id(pool, id).await? {

            out.push((a, role));

        }

    }

    out.sort_by(|a, b| a.0.username.cmp(&b.0.username));

    Ok(out)

}

pub async fn org_role(pool: &Pool, org_id: i64, account_id: i64) -> sqlx::Result<Option<String>> {

    sqlx::query_scalar("SELECT role FROM org_members WHERE org_id = ? AND account_id = ?")

        .bind(org_id)

        .bind(account_id)

        .fetch_optional(pool)

        .await

}

pub async fn set_org_member(pool: &Pool, org_id: i64, account_id: i64, role: &str) -> sqlx::Result<()> {

    sqlx::query("INSERT INTO org_members (org_id, account_id, role) VALUES (?, ?, ?) ON CONFLICT (org_id, account_id) DO UPDATE SET role = excluded.role")

        .bind(org_id)

        .bind(account_id)

        .bind(role)

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn remove_org_member(pool: &Pool, org_id: i64, account_id: i64) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM org_members WHERE org_id = ? AND account_id = ?").bind(org_id).bind(account_id).execute(pool).await?;

    Ok(())

}

pub async fn teams(pool: &Pool, org_id: i64) -> sqlx::Result<Vec<Team>> {

    sqlx::query_as("SELECT * FROM teams WHERE org_id = ? ORDER BY name").bind(org_id).fetch_all(pool).await

}

pub async fn team_by_name(pool: &Pool, org_id: i64, name: &str) -> sqlx::Result<Option<Team>> {

    sqlx::query_as("SELECT * FROM teams WHERE org_id = ? AND name = ?").bind(org_id).bind(name).fetch_optional(pool).await

}

pub async fn create_team(pool: &Pool, org_id: i64, name: &str) -> sqlx::Result<Team> {

    sqlx::query_as("INSERT INTO teams (org_id, name) VALUES (?, ?) RETURNING *").bind(org_id).bind(name).fetch_one(pool).await

}

pub async fn delete_team(pool: &Pool, id: i64) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM teams WHERE id = ?").bind(id).execute(pool).await?;

    Ok(())

}

pub async fn team_members(pool: &Pool, team_id: i64) -> sqlx::Result<Vec<Account>> {

    sqlx::query_as("SELECT a.* FROM accounts a JOIN team_members t ON t.account_id = a.id WHERE t.team_id = ? ORDER BY a.username")

        .bind(team_id)

        .fetch_all(pool)

        .await

}

pub async fn add_team_member(pool: &Pool, team_id: i64, account_id: i64) -> sqlx::Result<()> {

    sqlx::query("INSERT OR IGNORE INTO team_members (team_id, account_id) VALUES (?, ?)")

        .bind(team_id)

        .bind(account_id)

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn remove_team_member(pool: &Pool, team_id: i64, account_id: i64) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM team_members WHERE team_id = ? AND account_id = ?").bind(team_id).bind(account_id).execute(pool).await?;

    Ok(())

}

// ----------------------------------------------------------- collaborators

#[derive(Clone, Debug)]

pub struct Collaborator {

    pub account: Option<Account>,

    pub team: Option<Team>,

    pub role: String,

}

pub async fn collaborators(pool: &Pool, repo_id: i64) -> sqlx::Result<Vec<Collaborator>> {

    let rows: Vec<(Option<i64>, Option<i64>, String)> =

        sqlx::query_as("SELECT account_id, team_id, role FROM collaborators WHERE repo_id = ?").bind(repo_id).fetch_all(pool).await?;

    let mut out = Vec::new();

    for (account_id, team_id, role) in rows {

        let account = match account_id {

            Some(id) => account_by_id(pool, id).await?,

            None => None,

        };

        let team = match team_id {

            Some(id) => sqlx::query_as("SELECT * FROM teams WHERE id = ?").bind(id).fetch_optional(pool).await?,

            None => None,

        };

        out.push(Collaborator { account, team, role });

    }

    Ok(out)

}

pub async fn set_collaborator(pool: &Pool, repo_id: i64, account_id: Option<i64>, team_id: Option<i64>, role: &str) -> sqlx::Result<()> {

    if let Some(a) = account_id {

        sqlx::query("INSERT INTO collaborators (repo_id, account_id, role) VALUES (?, ?, ?) ON CONFLICT (repo_id, account_id) WHERE account_id IS NOT NULL DO UPDATE SET role = excluded.role")

            .bind(repo_id)

            .bind(a)

            .bind(role)

            .execute(pool)

            .await?;

    } else if let Some(t) = team_id {

        sqlx::query("INSERT INTO collaborators (repo_id, team_id, role) VALUES (?, ?, ?) ON CONFLICT (repo_id, team_id) WHERE team_id IS NOT NULL DO UPDATE SET role = excluded.role")

            .bind(repo_id)

            .bind(t)

            .bind(role)

            .execute(pool)

            .await?;

    }

    Ok(())

}

pub async fn remove_collaborator(pool: &Pool, repo_id: i64, account_id: Option<i64>, team_id: Option<i64>) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM collaborators WHERE repo_id = ? AND ((account_id IS NOT NULL AND account_id = ?) OR (team_id IS NOT NULL AND team_id = ?))")

        .bind(repo_id)

        .bind(account_id)

        .bind(team_id)

        .execute(pool)

        .await?;

    Ok(())

}

/// The direct or team role an account holds on a repository, the highest.

pub async fn collaborator_role(pool: &Pool, repo_id: i64, account_id: i64) -> sqlx::Result<Option<String>> {

    let rows: Vec<String> = sqlx::query_scalar(

        "SELECT role FROM collaborators WHERE repo_id = ? AND (account_id = ? OR team_id IN (SELECT team_id FROM team_members WHERE account_id = ?))",

    )

    .bind(repo_id)

    .bind(account_id)

    .bind(account_id)

    .fetch_all(pool)

    .await?;

    Ok(rows.into_iter().max_by_key(|r| crate::auth::Role::parse(r).map(|r| r as u8).unwrap_or(0)))

}

// ------------------------------------------------------------------ tokens

pub async fn tokens_of(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<Token>> {

    sqlx::query_as("SELECT * FROM tokens WHERE account_id = ? ORDER BY created_ms DESC").bind(account_id).fetch_all(pool).await

}

pub async fn token_by_hash(pool: &Pool, hash: &str) -> sqlx::Result<Option<Token>> {

    sqlx::query_as("SELECT * FROM tokens WHERE hash = ?").bind(hash).fetch_optional(pool).await

}

pub async fn create_token(

    pool: &Pool,

    account_id: i64,

    name: &str,

    hash: &str,

    scopes: &str,

    repos: &str,

    expires_ms: Option<i64>,

) -> sqlx::Result<Token> {

    sqlx::query_as(

        "INSERT INTO tokens (account_id, name, hash, scopes, repos, created_ms, expires_ms) VALUES (?, ?, ?, ?, ?, ?, ?) RETURNING *",

    )

    .bind(account_id)

    .bind(name)

    .bind(hash)

    .bind(scopes)

    .bind(repos)

    .bind(now_ms())

    .bind(expires_ms)

    .fetch_one(pool)

    .await

}

pub async fn delete_token(pool: &Pool, account_id: i64, id: i64) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM tokens WHERE id = ? AND account_id = ?").bind(id).bind(account_id).execute(pool).await?;

    Ok(())

}

pub async fn touch_token(pool: &Pool, id: i64) -> sqlx::Result<()> {

    sqlx::query("UPDATE tokens SET last_used_ms = ? WHERE id = ?").bind(now_ms()).bind(id).execute(pool).await?;

    Ok(())

}

// -------------------------------------------------------------- identities

pub async fn identities_of(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<LinkedIdentity>> {

    sqlx::query_as("SELECT * FROM identities WHERE account_id = ? ORDER BY linked_ms DESC").bind(account_id).fetch_all(pool).await

}

pub async fn identity_by_key(pool: &Pool, key: &str) -> sqlx::Result<Option<LinkedIdentity>> {

    sqlx::query_as("SELECT * FROM identities WHERE key = ?").bind(key).fetch_optional(pool).await

}

/// Every linked key with its account's username, for attribution.

pub async fn identity_accounts(pool: &Pool) -> sqlx::Result<Vec<(String, String)>> {

    sqlx::query_as("SELECT i.key, a.username FROM identities i JOIN accounts a ON a.id = i.account_id").fetch_all(pool).await

}

pub async fn link_identity(pool: &Pool, account_id: i64, key: &str, name: &str, email: &str, object: &[u8]) -> sqlx::Result<()> {

    sqlx::query("INSERT INTO identities (key, account_id, name, email, object, linked_ms) VALUES (?, ?, ?, ?, ?, ?)")

        .bind(key)

        .bind(account_id)

        .bind(name)

        .bind(email)

        .bind(object)

        .bind(now_ms())

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn unlink_identity(pool: &Pool, account_id: i64, key: &str) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM identities WHERE key = ? AND account_id = ?").bind(key).bind(account_id).execute(pool).await?;

    Ok(())

}

pub async fn create_challenge(pool: &Pool, account_id: i64, bytes_hex: &str) -> sqlx::Result<i64> {

    sqlx::query("DELETE FROM challenges WHERE created_ms < ?").bind(now_ms() - 10 * 60 * 1000).execute(pool).await?;

    let id: i64 = sqlx::query_scalar("INSERT INTO challenges (account_id, bytes, created_ms) VALUES (?, ?, ?) RETURNING id")

        .bind(account_id)

        .bind(bytes_hex)

        .bind(now_ms())

        .fetch_one(pool)

        .await?;

    Ok(id)

}

/// Take (and delete) a pending challenge of this account.

pub async fn take_challenge(pool: &Pool, account_id: i64, id: i64) -> sqlx::Result<Option<String>> {

    let bytes: Option<String> = sqlx::query_scalar("SELECT bytes FROM challenges WHERE id = ? AND account_id = ? AND created_ms >= ?")

        .bind(id)

        .bind(account_id)

        .bind(now_ms() - 10 * 60 * 1000)

        .fetch_optional(pool)

        .await?;

    sqlx::query("DELETE FROM challenges WHERE id = ?").bind(id).execute(pool).await?;

    Ok(bytes)

}

// ------------------------------------------------------------- invitations

pub async fn create_invitation(pool: &Pool, code: &str, created_by: Option<i64>) -> sqlx::Result<()> {

    sqlx::query("INSERT INTO invitations (code, created_by, created_ms) VALUES (?, ?, ?)")

        .bind(code)

        .bind(created_by)

        .bind(now_ms())

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn invitation_unused(pool: &Pool, code: &str) -> sqlx::Result<bool> {

    let n: i64 =

        sqlx::query_scalar("SELECT COUNT(*) FROM invitations WHERE code = ? AND used_by IS NULL").bind(code).fetch_one(pool).await?;

    Ok(n > 0)

}

pub async fn use_invitation(pool: &Pool, code: &str, account_id: i64) -> sqlx::Result<()> {

    sqlx::query("UPDATE invitations SET used_by = ? WHERE code = ?").bind(account_id).bind(code).execute(pool).await?;

    Ok(())

}

pub async fn invitations(pool: &Pool) -> sqlx::Result<Vec<(String, Option<i64>, i64)>> {

    sqlx::query_as("SELECT code, used_by, created_ms FROM invitations ORDER BY created_ms DESC").fetch_all(pool).await

}

// ---------------------------------------------------------------- settings

pub async fn setting(pool: &Pool, key: &str) -> sqlx::Result<Option<String>> {

    sqlx::query_scalar("SELECT value FROM settings WHERE key = ?").bind(key).fetch_optional(pool).await

}

pub async fn set_setting(pool: &Pool, key: &str, value: &str) -> sqlx::Result<()> {

    sqlx::query("INSERT INTO settings (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value")

        .bind(key)

        .bind(value)

        .execute(pool)

        .await?;

    Ok(())

}

// ------------------------------------------------------------------- audit

pub async fn audit(pool: &Pool, actor: Option<&Account>, action: &str, target: &str, detail: &str) -> sqlx::Result<()> {

    sqlx::query("INSERT INTO audit (at_ms, actor_id, actor, action, target, detail) VALUES (?, ?, ?, ?, ?, ?)")

        .bind(now_ms())

        .bind(actor.map(|a| a.id))

        .bind(actor.map(|a| a.username.as_str()).unwrap_or(""))

        .bind(action)

        .bind(target)

        .bind(detail)

        .execute(pool)

        .await?;

    Ok(())

}

pub async fn audit_rows(pool: &Pool, limit: i64) -> sqlx::Result<Vec<AuditRow>> {

    sqlx::query_as("SELECT id, at_ms, actor, action, target, detail FROM audit ORDER BY at_ms DESC, id DESC LIMIT ?")

        .bind(limit)

        .fetch_all(pool)

        .await

}

/// The repositories an account can see beyond the public ones: its own,

/// its organisations', and those it collaborates on.

pub async fn visible_repo_ids(pool: &Pool, account_id: i64) -> sqlx::Result<Vec<i64>> {

    sqlx::query_scalar(

        "SELECT r.id FROM repositories r WHERE r.owner IN (SELECT username FROM accounts WHERE id = ?) \

         OR r.owner IN (SELECT o.name FROM organisations o JOIN org_members m ON m.org_id = o.id WHERE m.account_id = ?) \

         OR r.id IN (SELECT repo_id FROM collaborators WHERE account_id = ? OR team_id IN (SELECT team_id FROM team_members WHERE account_id = ?))",

    )

    .bind(account_id)

    .bind(account_id)

    .bind(account_id)

    .bind(account_id)

    .fetch_all(pool)

    .await

}

//! Site administration (hub spec §6.3 `/admin/*`): accounts, registration

//! mode and invitations, the audit log.

use super::settings::csrf;

use super::{filters, Error, Page, Shell};

use crate::auth::{self, Viewer};

use crate::db::accounts;

use crate::Shared;

use askama::Template;

use axum::extract::{Form, State};

use serde::Deserialize;

#[derive(Template)]

#[template(path = "admin.html")]

pub struct AdminPage {

    shell: Shell,

    accounts: Vec<accounts::Account>,

    orgs: Vec<accounts::Organisation>,

    mode: String,

    invitations: Vec<(String, Option<i64>, i64)>,

    audit: Vec<accounts::AuditRow>,

    repos: usize,

    notice: Option<String>,

}

fn require_admin(viewer: &Viewer, shell: &Shell) -> Result<accounts::Account, Error> {

    match viewer.account() {

        Some(a) if a.is_admin => Ok(a.clone()),

        _ => Err(Error::not_found(shell.clone())),

    }

}

async fn admin_page(app: &Shared, shell: Shell, notice: Option<String>) -> Result<Page<AdminPage>, Error> {

    let e = |e| Error::from_db(shell.clone(), e);

    let accounts_list = accounts::accounts(&app.db).await.map_err(e)?;

    let orgs = accounts::orgs(&app.db).await.map_err(e)?;

    let mode = super::session::registration_mode(app).await;

    let invitations = accounts::invitations(&app.db).await.map_err(e)?;

    let audit = accounts::audit_rows(&app.db, 100).await.map_err(e)?;

    let repos = crate::db::repos::list(&app.db).await.map_err(e)?.len();

    Ok(Page(AdminPage { shell, accounts: accounts_list, orgs, mode, invitations, audit, repos, notice }))

}

pub async fn index(State(app): State<Shared>, viewer: Viewer) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    require_admin(&viewer, &shell)?;

    admin_page(&app, shell, None).await

}

#[derive(Deserialize)]

pub struct ModeForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    mode: String,

}

pub async fn set_mode(State(app): State<Shared>, viewer: Viewer, Form(f): Form<ModeForm>) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    let me = require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    if !matches!(f.mode.as_str(), "open" | "invite" | "closed") {

        return Err(Error::bad(shell, "mode is open, invite or closed"));

    }

    accounts::set_setting(&app.db, "registration_mode", &f.mode).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me), "admin.registration", &f.mode, "").await.ok();

    admin_page(&app, shell, Some(format!("Registration is {}.", f.mode))).await

}

pub async fn invite(State(app): State<Shared>, viewer: Viewer, Form(f): Form<super::session::CsrfForm>) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    let me = require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf, &shell)?;

    let code = auth::random_hex(12);

    accounts::create_invitation(&app.db, &code, Some(me.id)).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me), "admin.invite", &code, "").await.ok();

    admin_page(&app, shell, Some(format!("Invitation created: {}/register?invite={code}", app.config.base_url()))).await

}

#[derive(Deserialize)]

pub struct AccountForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    username: String,

    action: String,

}

pub async fn account(State(app): State<Shared>, viewer: Viewer, Form(f): Form<AccountForm>) -> Result<Page<AdminPage>, Error> {

    let shell = Shell::new(&app, "/admin", &viewer);

    let me = require_admin(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let Some(target) = accounts::account_by_name(&app.db, f.username.trim()).await.map_err(|e| Error::from_db(shell.clone(), e))? else {

        return admin_page(&app, shell, Some("No such account.".into())).await;

    };

    if target.id == me.id && matches!(f.action.as_str(), "ban" | "demote") {

        return admin_page(&app, shell, Some("Not on yourself.".into())).await;

    }

    let e = |e| Error::from_db(shell.clone(), e);

    match f.action.as_str() {

        "ban" => accounts::set_banned(&app.db, target.id, true).await.map_err(e)?,

        "unban" => accounts::set_banned(&app.db, target.id, false).await.map_err(e)?,

        "promote" => accounts::set_admin(&app.db, target.id, true).await.map_err(e)?,

        "demote" => accounts::set_admin(&app.db, target.id, false).await.map_err(e)?,

        _ => return Err(Error::bad(shell, "unknown action")),

    }

    accounts::audit(&app.db, Some(&me), &format!("admin.account.{}", f.action), &target.username, "").await.ok();

    admin_page(&app, shell, Some(format!("{}: {}.", target.username, f.action))).await

}

//! Organisations and teams (hub spec §5.2).

use super::settings::{csrf, require};

use super::{Error, Page, Shell};

use crate::auth::{roles, Viewer};

use crate::db::accounts;

use crate::Shared;

use askama::Template;

use axum::extract::{Form, Path, State};

use axum::response::{IntoResponse, Redirect, Response};

use serde::Deserialize;

#[derive(Template)]

#[template(path = "org_new.html")]

pub struct OrgNewPage {

    shell: Shell,

    error: Option<String>,

}

pub async fn new_form(State(app): State<Shared>, viewer: Viewer) -> Result<Page<OrgNewPage>, Error> {

    let shell = Shell::new(&app, "/orgs/new", &viewer);

    require(&viewer, &shell)?;

    Ok(Page(OrgNewPage { shell, error: None }))

}

#[derive(Deserialize)]

pub struct OrgNewForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    name: String,

    display_name: String,

}

pub async fn create(State(app): State<Shared>, viewer: Viewer, Form(f): Form<OrgNewForm>) -> Result<Response, Error> {

    let shell = Shell::new(&app, "/orgs/new", &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let name = f.name.trim().to_string();

    if !crate::repos::names::valid_owner(&name) {

        return Ok(Page(OrgNewPage {

            shell,

            error: Some("An organisation name is letters, digits, dots, dashes and underscores.".into()),

        })

        .into_response());

    }

    let taken = accounts::account_by_name(&app.db, &name).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_some()

        || accounts::org_by_name(&app.db, &name).await.map_err(|e| Error::from_db(shell.clone(), e))?.is_some();

    if taken {

        return Ok(Page(OrgNewPage { shell, error: Some("That name is taken.".into()) }).into_response());

    }

    let org =

        accounts::create_org(&app.db, &name, f.display_name.trim(), me.account.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    accounts::audit(&app.db, Some(&me.account), "org.created", &org.name, "").await.ok();

    Ok(Redirect::to(&format!("/orgs/{}/settings", org.name)).into_response())

}

#[derive(Template)]

#[template(path = "org_settings.html")]

pub struct OrgSettingsPage {

    shell: Shell,

    org: accounts::Organisation,

    members: Vec<(accounts::Account, String)>,