{% extends "base.html" %}

{% import "assistants_panel.html" as ai %}

{% import "variables_panel.html" as va %}

{% import "secrets_panel.html" as se %}

{% block title %}Administration{% endblock %}

{% block content %}

<div class="head"><h1>Administration <small>{{ accounts.len() }} accounts · {{ orgs.len() }} organisations · {{ repos }} repositories</small></h1></div>

<div class="sectioned">

<nav class="section-nav" aria-label="Sections">

  <a href="#accounts">Accounts</a>

  <a href="#registration">Registration</a>

  <a href="#organisations">Organisations</a>

  <a href="#signin">Sign in with</a>

  <a href="#mail">Mail</a>

  <a href="#security">Security contact</a>

  <a href="#variables">Variables</a>

  <a href="#secrets">Secrets</a>

  <a href="#assistants">AI assistants</a>

  <a href="#audit">Audit log</a>

  <a href="/admin/runners">Runners ↗</a>

  <a href="/admin/runners/images">Images ↗</a>

  <a href="/admin/diffusion">Diffusion ↗</a>

  <a href="/admin/backups">Backups ↗</a>

  <a href="/admin/storage">Storage and maintenance ↗</a>

</nav>

<div class="sections">

{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}

<section class="panel" id="accounts">

  <h2>Accounts</h2>

  <div class="table"><table class="small"><tr><th>Username</th><th>Email</th><th>Flags</th><th>Last seen</th><th></th></tr>

  {% for a in accounts %}

  <tr><td><a href="/{{ a.username }}">{{ a.username }}</a></td><td>{{ a.email }}{% if !a.email.is_empty() %} <span class="small mute" title="{% if a.email_verified %}verified{% else %}not verified{% endif %}">{% if a.email_verified %}✔{% else %}○{% endif %}</span>{% endif %}</td><td>{% if a.is_admin %}<span class="tag">admin</span>{% endif %}{% if a.banned %} <span class="tag bad">banned</span>{% endif %}{% if a.disabled %} <span class="tag warn">disabled</span>{% endif %}{% if a.totp_enabled() %} <span class="tag">2fa</span>{% endif %}</td>

  <td>{% if a.last_seen_ms > 0 %}<time title="{{ a.last_seen_ms|when_i }}">{{ a.last_seen_ms|ago_i }}</time>{% else %}<span class="mute">never</span>{% endif %}</td>

  <td><form class="tiny" method="post" action="/admin/account"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="username" value="{{ a.username }}">

    {% if a.banned %}<button name="action" value="unban">unban</button>{% else %}<button name="action" value="ban">ban</button>{% endif %}

    {% if a.is_admin %}<button name="action" value="demote">demote</button>{% else %}<button name="action" value="promote">make admin</button>{% endif %}

    {% if a.disabled %}<button name="action" value="enable">enable</button>{% else %}<button name="action" value="disable" title="Refuse sign-in, sessions, tokens and pushes until enabled again">disable</button>{% endif %}

    {% if !a.blocked() %}<button name="action" value="reset_link" title="A one-time password reset link to hand over">reset link</button>{% endif %}</form>

    <details class="tiny delete-account"><summary>delete</summary><form class="tiny" method="post" action="/admin/account"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="username" value="{{ a.username }}">

    <label class="small">Deleting removes the account, its tokens, keys and memberships for good; what it wrote stays under its name, which stays retired. Type <strong>{{ a.username }}</strong> to confirm:

    <input name="confirm" autocomplete="off" required></label> <button class="danger" name="action" value="delete">delete {{ a.username }}</button></form></details></td></tr>

  {% endfor %}

  </table></div>

</section>

<section class="panel" id="registration">

  <h2>Registration and invitations</h2>

  <form class="card" method="post" action="/admin/registration">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <label for="regmode">Who may register</label>

    <select id="regmode" name="mode">{% for m in ["open", "invite", "closed"] %}<option value="{{ m }}"{% if mode.as_str() == *m %} selected{% endif %}>{{ m }}</option>{% endfor %}</select>

    <button type="submit">SET</button>

  </form>

  <form class="card" method="post" action="/admin/invite"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit">NEW INVITATION</button></form>

  {% if !invitations.is_empty() %}<ul class="plain small">{% for (code, used, at) in invitations %}<li><code>{{ code }}</code> {% if used.is_some() %}<span class="mute">used</span>{% else %}<a href="/register?invite={{ code }}">link</a>{% endif %} · {{ at|ago_i }}</li>{% endfor %}</ul>{% endif %}

</section>

<section class="panel" id="organisations">

  <h2>Organisations</h2>

  {% if orgs.is_empty() %}<p class="mute small">None yet.</p>{% else %}<ul class="plain">{% for o in orgs %}<li><img class="avatar xs" src="/avatar/{{ o.name }}" alt=""> <a href="/{{ o.name }}">{{ o.name }}</a> · <a class="small" href="/orgs/{{ o.name }}/settings">settings</a></li>{% endfor %}</ul>{% endif %}

</section>

<section class="panel" id="signin">

  <h2>Sign in with</h2>

  <p class="small mute">A first sign-in links the account with the same verified email, or makes an account when registration is open. Secrets are kept sealed.</p>

  {% for p in providers %}

  <form class="card" method="post" action="/admin/signin">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}"><input type="hidden" name="provider" value="{{ p.id }}">

    <h3>{{ p.name }} {% if p.enabled && p.has_secret && !p.client_id.is_empty() %}<span class="tag head">on</span>{% else %}<span class="tag dim">off</span>{% endif %}</h3>

    <label for="cid-{{ p.id }}">Client id</label><input type="text" id="cid-{{ p.id }}" name="client_id" value="{{ p.client_id }}" autocomplete="off">

    <label for="sec-{{ p.id }}">Client secret</label><input type="password" id="sec-{{ p.id }}" name="secret" placeholder="{% if p.has_secret %}unchanged{% else %}none{% endif %}" autocomplete="new-password">

    {% if let Some(d) = p.default_base %}<label for="base-{{ p.id }}">{{ p.name }} address</label><input type="url" id="base-{{ p.id }}" name="base" value="{{ p.base }}" placeholder="{{ d }}" autocomplete="off">

    <p class="small mute">Empty for {{ d }}; or a self-managed {{ p.name }}, like https://gitlab.example.org. Register the hub there as an application with the scopes <code>openid profile email</code>.</p>{% endif %}

    <div class="choice"><label><input type="checkbox" name="enabled" value="1"{% if p.enabled %} checked{% endif %}> on</label></div>

    <p class="small mute">Callback URL to register with {{ p.name }}: <code>{{ p.callback }}</code></p>

    <button type="submit">SAVE</button>

  </form>

  {% endfor %}

</section>

<section class="panel" id="mail">

  <h2>Mail</h2>

  <form class="card" method="post" action="/admin/mail">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <label for="smtp">SMTP URL</label>

    <input type="text" id="smtp" name="smtp" value="{{ mail_smtp }}" placeholder="smtps://user:[email protected]:465">

    <label for="mailfrom">From</label>

    <input type="text" id="mailfrom" name="from" value="{{ mail_from }}" placeholder="OxygenHub &lt;[email protected]&gt;">

    <button type="submit">SAVE</button>

  </form>

  <form class="card" method="post" action="/admin/mail/test"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit"{% if !mail_enabled || my_email.is_empty() %} disabled{% endif %}>SEND A TEST{% if !my_email.is_empty() %} TO {{ my_email }}{% endif %}</button></form>

  <p class="small mute">{% if mail_enabled %}Mail is on: verification and reset links go by email.{% else %}Mail is off: verification and reset links are issued by hand.{% endif %} An empty URL turns it off. The password stays on the server and is shown masked.</p>

</section>

<section class="panel" id="security">

  <h2>Security contact</h2>

  <form class="card" method="post" action="/admin/security">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <label for="seccontact">Contact</label><input type="text" id="seccontact" name="contact" value="{{ security_contact }}" placeholder="[email protected] or https://example.org/report" autocomplete="off">

    <label for="secpolicy">Policy page</label><input type="url" id="secpolicy" name="policy" value="{{ security_policy }}" placeholder="https://example.org/security-policy (optional)" autocomplete="off">

    <button type="submit">SAVE</button>

  </form>

  <p class="small mute">{% if security_contact.is_empty() %}No contact yet, so there is no <code>security.txt</code>.{% else %}Published at <a href="/.well-known/security.txt">/.well-known/security.txt</a>.{% endif %} Researchers look there (RFC 9116) for where to report a vulnerability in this hub. Its expiry date renews itself.</p>

</section>

{% call va::panel("/admin", variables, shell.csrf, "Every repository's jobs get these, unless an organisation or repository sets the same name.") %}

{% call se::panel("/admin", secrets, shell.csrf, "Every repository's jobs may use these, unless an organisation or repository sets the same name.") %}

{% call ai::panel("/admin", assistants, shell.csrf, "Every repository on the site may ask these, unless an organisation or repository turns one off.") %}

<section class="panel" id="audit">

  <h2>Audit log</h2>

  <div class="table"><table class="small"><tr><th>When</th><th>Who</th><th>Action</th><th>Target</th><th>Detail</th></tr>

  {% for r in audit %}<tr><td><time title="{{ r.at_ms|when_i }}">{{ r.at_ms|ago_i }}</time></td><td>{{ r.actor }}</td><td><code>{{ r.action }}</code></td><td>{{ r.target }}</td><td class="mute">{{ r.detail }}</td></tr>{% endfor %}

  </table></div>

  <p class="pager small"><a href="/admin#audit">newest</a>{% if let Some(o) = audit_older %} <a class="go small" href="/admin?audit_before={{ o }}#audit">older</a>{% endif %}</p>

</section>

</div>

</div>

{% endblock %}