Device sign-in: a clear done page after approving or denying 4da8b828a822

## Unreleased

- **The issue page's sidebar, laid out as GitHub's (#82).** Assignees, Labels and Milestone each show what is set under their heading (avatars, coloured label pills) with a gear opening a menu: a filterable checklist (people who can be assigned, with avatars; labels with their colour and description; a milestone) that applies in one go. "Assign yourself" when nobody is assigned. Close, Not planned, Lock and Pin are quiet rows with icons at the foot, evenly spaced, and the comment box is as wide as the conversation.

- **Disable and delete accounts (#81).** Administration offers Disable and Enable beside Ban: a disabled account is refused like a banned one (sign-in, sessions, tokens, pushes), and signing in says "Your account has been disabled. Contact the hub's administrator." Delete removes an account for good after its username is typed again: its tokens, keys and memberships go, what it wrote stays under its name, and the name stays retired so nobody can take it over. It is refused, naming them, while the account owns repositories or is the only owner of an organisation; nobody disables or deletes themselves or the last admin who can sign in. A deleted account's proposal reviews now stay, as its comments do.

    code: String,

    /// The pending request the code names, with each scope it asked for.

    pending: Option<(accounts::DeviceCode, Vec<(&'static str, &'static str)>)>,

    error: Option<String>,

}

/// A code still waiting for an answer.

async fn pending(app: &Shared, code: &str) -> Result<Option<accounts::DeviceCode>, sqlx::Error> {

    Ok(accounts::device_by_user_code(&app.db, code).await?.filter(|d| d.account_id.is_none() && !d.denied && d.expires_ms >= db::now_ms()))

}

    let pending = d.map(|d| {

        let asked: Vec<(&'static str, &'static str)> = SCOPES.iter().filter(|(k, _)| d.scope_list().contains(k)).copied().collect();

        (d, asked)

                return Ok(page(shell, code, None, None, Some("That code was answered or expired meanwhile.".into())));

            }

            accounts::audit(&app.db, Some(&me.account), "device.approved", &d.client, &chosen.join(",")).await.ok();

            Ok(page(shell, String::new(), None, Some(done), None))

        }

        "deny" => {

            accounts::deny_device(&app.db, d.id).await.map_err(|e| Error::from_db(shell.clone(), e))?;

            accounts::audit(&app.db, Some(&me.account), "device.denied", &d.client, "").await.ok();

        }

        // Looking a typed code up.

        _ => Ok(page(shell, code, Some(d), None, None)),

    let r =

        call(app, "POST", "/device", None, Some(&andy), None, Some(&format!("_csrf={csrf}&code={user}&action=approve&scopes=user%3Aread")))

            .await;

    // The next poll gets a token with what was allowed, once.

    let (st, v) = api(app, "POST", "/api/v1/device/token", None, Some(&poll)).await;

{% block title %}Sign in a device{% endblock %}

{% block content %}

<div class="head"><h1>Sign in a device <small>an app asked to use your account</small></h1></div>

{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}

<form class="card wide" method="post" action="/device">

  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

  <input type="hidden" name="code" value="{{ d.user_code }}">

button.side-action span { width: 16px; text-align: center; color: var(--mute); }

button.side-action:hover { color: var(--acc); }

button.side-action:focus-visible { outline: 2px solid var(--acc); outline-offset: 2px; }