{% extends "base.html" %}
{% import "assistants_panel.html" as ai %}
{% import "variables_panel.html" as va %}
{% import "secrets_panel.html" as se %}
{% block title %}Administration{% endblock %}
{% block content %}
<div class="head"><h1>Administration <small>{{ accounts.len() }} accounts · {{ orgs.len() }} organisations · {{ repos }} repositories</small></h1></div>
<div class="sectioned">
<nav class="section-nav" aria-label="Sections">
  <a href="#accounts">Accounts</a>
  <a href="#registration">Registration</a>
  <a href="#organisations">Organisations</a>
  <a href="#signin">Sign in with</a>
  <a href="#mail">Mail</a>
  <a href="#security">Security contact</a>
  <a href="#variables">Variables</a>
  <a href="#secrets">Secrets</a>
  <a href="#assistants">AI assistants</a>
  <a href="#audit">Audit log</a>
  <a href="/admin/runners">Runners ↗</a>
  <a href="/admin/runners/images">Images ↗</a>
  <a href="/admin/diffusion">Diffusion ↗</a>
  <a href="/admin/backups">Backups ↗</a>
  <a href="/admin/storage">Storage and maintenance ↗</a>
</nav>
<div class="sections">
{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}
<section class="panel" id="accounts">
  <h2>Accounts</h2>
  <div class="table"><table class="small"><tr><th>Username</th><th>Email</th><th>Flags</th><th>Last seen</th><th></th></tr>
  {% for a in accounts %}
  <tr><td><a href="/{{ a.username }}">{{ a.username }}</a></td><td>{{ a.email }}{% if !a.email.is_empty() %} <span class="small mute" title="{% if a.email_verified %}verified{% else %}not verified{% endif %}">{% if a.email_verified %}✔{% else %}○{% endif %}</span>{% endif %}</td><td>{% if a.is_admin %}<span class="tag">admin</span>{% endif %}{% if a.banned %} <span class="tag bad">banned</span>{% endif %}{% if a.disabled %} <span class="tag warn">disabled</span>{% endif %}{% if a.totp_enabled() %} <span class="tag">2fa</span>{% endif %}</td>
  <td>{% if a.last_seen_ms > 0 %}<time title="{{ a.last_seen_ms|when_i }}">{{ a.last_seen_ms|ago_i }}</time>{% else %}<span class="mute">never</span>{% endif %}</td>
  <td><form class="tiny" method="post" action="/admin/account"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="username" value="{{ a.username }}">
    {% if a.banned %}<button name="action" value="unban">unban</button>{% else %}<button name="action" value="ban">ban</button>{% endif %}
    {% if a.is_admin %}<button name="action" value="demote">demote</button>{% else %}<button name="action" value="promote">make admin</button>{% endif %}
    {% if a.disabled %}<button name="action" value="enable">enable</button>{% else %}<button name="action" value="disable" title="Refuse sign-in, sessions, tokens and pushes until enabled again">disable</button>{% endif %}
    {% if !a.blocked() %}<button name="action" value="reset_link" title="A one-time password reset link to hand over">reset link</button>{% endif %}</form>
    <details class="tiny delete-account"><summary>delete</summary><form class="tiny" method="post" action="/admin/account"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="username" value="{{ a.username }}">
    <label class="small">Deleting removes the account, its tokens, keys and memberships for good; what it wrote stays under its name, which stays retired. Type <strong>{{ a.username }}</strong> to confirm:
    <input name="confirm" autocomplete="off" required></label> <button class="danger" name="action" value="delete">delete {{ a.username }}</button></form></details></td></tr>
  {% endfor %}
  </table></div>
</section>
<section class="panel" id="registration">
  <h2>Registration and invitations</h2>
  <form class="card" method="post" action="/admin/registration">
    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
    <label for="regmode">Who may register</label>
    <select id="regmode" name="mode">{% for m in ["open", "invite", "closed"] %}<option value="{{ m }}"{% if mode.as_str() == *m %} selected{% endif %}>{{ m }}</option>{% endfor %}</select>
    <button type="submit">SET</button>
  </form>
  <form class="card" method="post" action="/admin/invite"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit">NEW INVITATION</button></form>
  {% if !invitations.is_empty() %}<ul class="plain small">{% for (code, used, at) in invitations %}<li><code>{{ code }}</code> {% if used.is_some() %}<span class="mute">used</span>{% else %}<a href="/register?invite={{ code }}">link</a>{% endif %} · {{ at|ago_i }}</li>{% endfor %}</ul>{% endif %}
</section>
<section class="panel" id="organisations">
  <h2>Organisations</h2>
  {% if orgs.is_empty() %}<p class="mute small">None yet.</p>{% else %}<ul class="plain">{% for o in orgs %}<li><img class="avatar xs" src="/avatar/{{ o.name }}" alt=""> <a href="/{{ o.name }}">{{ o.name }}</a> · <a class="small" href="/orgs/{{ o.name }}/settings">settings</a></li>{% endfor %}</ul>{% endif %}
</section>
<section class="panel" id="signin">
  <h2>Sign in with</h2>
  <p class="small mute">A first sign-in links the account with the same verified email, or makes an account when registration is open. Secrets are kept sealed.</p>
  {% for p in providers %}
  <form class="card" method="post" action="/admin/signin">
    <input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="provider" value="{{ p.id }}">
    <h3>{{ p.name }} {% if p.enabled && p.has_secret && !p.client_id.is_empty() %}<span class="tag head">on</span>{% else %}<span class="tag dim">off</span>{% endif %}</h3>
    <label for="cid-{{ p.id }}">Client id</label><input type="text" id="cid-{{ p.id }}" name="client_id" value="{{ p.client_id }}" autocomplete="off">
    <label for="sec-{{ p.id }}">Client secret</label><input type="password" id="sec-{{ p.id }}" name="secret" placeholder="{% if p.has_secret %}unchanged{% else %}none{% endif %}" autocomplete="new-password">
    {% if let Some(d) = p.default_base %}<label for="base-{{ p.id }}">{{ p.name }} address</label><input type="url" id="base-{{ p.id }}" name="base" value="{{ p.base }}" placeholder="{{ d }}" autocomplete="off">
    <p class="small mute">Empty for {{ d }}; or a self-managed {{ p.name }}, like https://gitlab.example.org. Register the hub there as an application with the scopes <code>openid profile email</code>.</p>{% endif %}
    <div class="choice"><label><input type="checkbox" name="enabled" value="1"{% if p.enabled %} checked{% endif %}> on</label></div>
    <p class="small mute">Callback URL to register with {{ p.name }}: <code>{{ p.callback }}</code></p>
    <button type="submit">SAVE</button>
  </form>
  {% endfor %}
</section>
<section class="panel" id="mail">
  <h2>Mail</h2>
  <form class="card mail-panel" method="post" action="/admin/mail">
    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
    <label for="mailservice">Service</label>
    <select id="mailservice" name="service" data-mail-service>{% for (v, label) in mail_services() %}<option value="{{ v }}"{% if mail.service == *v %} selected{% endif %}>{{ label }}</option>{% endfor %}</select>
    <p class="small mute" data-for="resend">Resend sends through <code>smtp.resend.com</code>; the login is <code>resend</code> and the password your API key. Verify your domain in Resend first.</p>
    <p class="small mute" data-for="ses">Amazon SES: the region your identity is verified in, and the SMTP credentials from SES › SMTP settings (not an AWS access key).</p>
    <p class="small mute" data-for="mailgun">Mailgun: <code>us</code> or <code>eu</code>, and the domain's SMTP login and password.</p>
    <div data-for="ses mailgun"><label for="mailregion">Region</label><input type="text" id="mailregion" name="region" value="{{ mail.region }}" placeholder="eu-west-2 for SES; us or eu for Mailgun"></div>
    <div data-for="smtp"><label for="mailhost">Server</label><input type="text" id="mailhost" name="host" value="{{ mail.host }}" placeholder="mail.example.org">
      <label for="mailport">Port</label><input type="text" id="mailport" name="port" value="{{ mail.port }}" placeholder="587">
      <label for="mailsecurity">Security</label><select id="mailsecurity" name="security"><option value="starttls"{% if mail.security == "starttls" %} selected{% endif %}>STARTTLS (usually port 587)</option><option value="tls"{% if mail.security == "tls" %} selected{% endif %}>TLS from the start (usually port 465)</option><option value="none"{% if mail.security == "none" %} selected{% endif %}>None (a relay on this machine)</option></select></div>
    <div data-for="ses mailgun smtp"><label for="mailuser">User name</label><input type="text" id="mailuser" name="user" value="{% if mail.service != "resend" %}{{ mail.user }}{% endif %}" autocomplete="off"></div>
    <div data-for="resend ses mailgun smtp"><label for="mailsecret">{% if mail.service == "resend" %}API key{% else %}Password or API key{% endif %}</label><input type="password" id="mailsecret" name="secret" value="" autocomplete="new-password" placeholder="{% if mail.has_secret %}saved: leave empty to keep it{% else %}{% endif %}"></div>
    <div data-for="url"><label for="smtp">SMTP URL</label><input type="text" id="smtp" name="smtp" value="{{ mail_smtp }}" placeholder="smtps://user:password@mail.example.org:465"></div>
    <div data-for="resend ses mailgun smtp url"><label for="mailfrom">From</label><input type="text" id="mailfrom" name="from" value="{{ mail_from }}" placeholder="OxygenHub &lt;noreply@example.org&gt;"></div>
    <button type="submit">SAVE</button>
  </form>
  <form class="card" method="post" action="/admin/mail/test"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit"{% if !mail_enabled || my_email.is_empty() %} disabled{% endif %}>SEND A TEST{% if !my_email.is_empty() %} TO {{ my_email }}{% endif %}</button></form>
  <p class="small mute">{% if mail_enabled %}Mail is on: verification and reset links go by email.{% else %}Mail is off: verification and reset links are issued by hand.{% endif %} Off turns it off. Passwords and keys stay on the server and are never shown again. Every service is SMTP underneath, so any provider works: <code>smtps://USER:PASSWORD@HOST:465</code> for TLS from the start, or <code>smtp://USER:PASSWORD@HOST:587</code>, which the hub sends with STARTTLS required (add <code>?tls=opportunistic</code> or <code>?tls=none</code> to say otherwise; a relay on this machine needs none).</p>
</section>
<section class="panel" id="security">
  <h2>Security contact</h2>
  <form class="card" method="post" action="/admin/security">
    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
    <label for="seccontact">Contact</label><input type="text" id="seccontact" name="contact" value="{{ security_contact }}" placeholder="security@example.org or https://example.org/report" autocomplete="off">
    <label for="secpolicy">Policy page</label><input type="url" id="secpolicy" name="policy" value="{{ security_policy }}" placeholder="https://example.org/security-policy (optional)" autocomplete="off">
    <label for="secemail">Reporting address, shown on <a href="/security-contact">/security-contact</a></label><input type="email" id="secemail" name="email" value="{{ security_email }}" placeholder="security@example.org" autocomplete="off">
    <label for="secpage">That page's text (Markdown; empty for the text below)</label><textarea id="secpage" name="page" rows="8" placeholder="{{ security_default }}">{{ security_page }}</textarea>
    <button type="submit">SAVE</button>
  </form>
  <p class="small mute">{% if security_contact.is_empty() %}No contact yet, so there is no <code>security.txt</code>.{% else %}Published at <a href="/.well-known/security.txt">/.well-known/security.txt</a>.{% endif %} Researchers look there (RFC 9116) for where to report a vulnerability in this hub. Its expiry date renews itself.</p>
</section>
{% call va::panel("/admin", variables, shell.csrf, "Every repository's jobs get these, unless an organisation or repository sets the same name.") %}
{% call se::panel("/admin", secrets, shell.csrf, "Every repository's jobs may use these, unless an organisation or repository sets the same name.") %}
{% call ai::panel("/admin", assistants, shell.csrf, "Every repository on the site may ask these, unless an organisation or repository turns one off.") %}
<section class="panel" id="audit">
  <h2>Audit log</h2>
  <div class="table"><table class="small"><tr><th>When</th><th>Who</th><th>Action</th><th>Target</th><th>Detail</th></tr>
  {% for r in audit %}<tr><td><time title="{{ r.at_ms|when_i }}">{{ r.at_ms|ago_i }}</time></td><td>{{ r.actor }}</td><td><code>{{ r.action }}</code></td><td>{{ r.target }}</td><td class="mute">{{ r.detail }}</td></tr>{% endfor %}
  </table></div>
  <p class="pager small"><a href="/admin#audit">newest</a>{% if let Some(o) = audit_older %} <a class="go small" href="/admin?audit_before={{ o }}#audit">older</a>{% endif %}</p>
</section>
</div>
</div>
{% endblock %}