{% extends "base.html" %}
{% import "webhooks_panel.html" as w %}
{% import "assistants_panel.html" as ai %}
{% import "variables_panel.html" as va %}
{% import "secrets_panel.html" as se %}
{% import "repo_tabs.html" as m %}
{% block title %}Settings · {{ repo.owner }}/{{ repo.name }}{% endblock %}
{% block bodyattrs %} data-repo="{{ repo.url }}"{% endblock %}
{% block tabs %}{% call m::tabs(repo, "settings") %}{% endblock %}
{% block content %}
<div class="head"><h1>Settings <small>{{ repo.owner }}/{{ repo.name }}</small></h1></div>
{% if let Some(n) = notice %}<p class="note">{{ n }}</p>{% endif %}
{% if let Some(e) = error %}<p class="error">{{ e }}</p>{% endif %}
<div class="sectioned">
<nav class="section-nav" aria-label="Sections">
  <a href="#general">General</a>
  <a href="#landing">Landing requirements</a>
  <a href="#git-mirror">Git mirror</a>
  <a href="#checks">Required checks</a>
  <a href="#flow">OxygenFlow</a>
  <a href="#coverage">Coverage</a>
  {% if role == crate::auth::Role::Admin %}<a href="#webhooks">Webhooks</a>
  <a href="#variables">Variables</a>
  <a href="#secrets">Secrets</a>
  <a href="#assistants">AI assistants</a>
  {% if storage.is_some() %}<a href="#storage">Storage</a>{% endif %}
  <a href="#collaborators">Collaborators</a>
  <a href="#advanced">Advanced</a>{% endif %}
</nav>
<div class="sections">
<form class="card wide" id="general" method="post" action="{{ repo.url }}/settings">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>General</h2>
  <label for="description">Description</label><input type="text" id="description" name="description" value="{{ row.description }}">
  <label for="topics">Topics</label><input type="text" id="topics" name="topics" value="{{ row.topics }}" placeholder="rust version-control retro">
  <p class="small mute">Separated by spaces or commas; letters, digits and dashes. People find repositories by them under Explore.</p>
  <label for="default_bookmark">Default bookmark</label><input type="text" id="default_bookmark" name="default_bookmark" value="{{ row.default_bookmark }}">
  <label>Visibility{% if role != crate::auth::Role::Admin %} <span class="mute">(admins only)</span>{% endif %}</label>
  <div class="choice">
    <label><input type="radio" name="visibility" value="public"{% if row.visibility == "public" %} checked{% endif %}> public</label>
    <label><input type="radio" name="visibility" value="internal"{% if row.visibility == "internal" %} checked{% endif %}> internal</label>
    <label><input type="radio" name="visibility" value="private"{% if row.visibility == "private" %} checked{% endif %}> private</label>
  </div>
  <button type="submit">SAVE</button>
</form>
<form class="card wide" id="landing" method="post" action="{{ repo.url }}/settings/requirements">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>Landing requirements</h2>
  <label for="required_approvals">Sealed approvals required</label><input type="number" id="required_approvals" name="required_approvals" min="0" value="{{ requirements.required_approvals }}">
  <div class="choice">
    <label><input type="checkbox" name="require_owners" value="1"{% if requirements.require_owners %} checked{% endif %}> code owners from <code>.oxyowners</code> must approve</label>
    <label><input type="checkbox" name="allow_conflicts" value="1"{% if requirements.allow_conflicts %} checked{% endif %}> allow landing with conflicts</label>
  </div>
  <button type="submit">SAVE</button>
</form>
<form class="card wide" id="git-mirror" method="post" action="{{ repo.url }}/settings/mirror">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>Git mirror</h2>
  <div class="choice"><label><input type="checkbox" name="enabled" value="1"{% if row.git_mirror %} checked{% endif %}> keep a read-only Git mirror of <strong>{{ row.default_bookmark }}</strong></label></div>
  <p class="small mute">For tools that only speak Git (CI runners, IDEs): <code>git clone {{ shell.base_url }}{{ repo.url }}.git</code>. Private repositories take a personal access token as the password. Pushing to the mirror is refused.{% if row.git_mirror && !row.git_mirror_state.is_empty() %} Last exported state <code>{{ row.git_mirror_state|short }}</code>.{% endif %}</p>
  <button type="submit">SAVE</button>
</form>
<form class="card wide" id="checks" method="post" action="{{ repo.url }}/settings/checks">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>Required checks</h2>
  <label for="required_checks">Check names that must pass on a proposal's projected state (comma-separated)</label><input type="text" id="required_checks" name="required_checks" value="{{ required_checks }}" placeholder="build, test">
  <p class="small mute">Any token with <code>checks:write</code> reports checks with <code>POST {{ shell.base_url }}/api/v1/repos/{{ repo.owner }}/{{ repo.name }}/checks</code>.</p>
  <button type="submit">SAVE</button>
</form>
<form class="card wide" id="flow" method="post" action="{{ repo.url }}/settings/flow">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>OxygenFlow</h2>
  <p>Pushes to this repository {% if flow_enabled %}<strong>start runs</strong>{% else %}<strong>do not start runs</strong>{% endif %} of its <code>.flow/pipeline.kdl</code>.</p>
  {% if site_admin %}
  <div class="choice">
    <label><input type="radio" name="flow" value="on"{% if row.flow == "on" %} checked{% endif %}> on</label>
    <label><input type="radio" name="flow" value="off"{% if row.flow == "off" %} checked{% endif %}> off</label>
    <label><input type="radio" name="flow" value="default"{% if row.flow.is_empty() %} checked{% endif %}> site default ({% if flow_default %}on{% else %}off{% endif %}, from <code>[flow] repos</code> in <code>hub.toml</code>)</label>
  </div>
  <p class="small mute">Runs use the site's runners, so only site administrators change this. It takes effect at the next push.</p>
  <button type="submit">SAVE</button>
  {% else %}
  <p class="small mute">A site administrator turns OxygenFlow on or off here.</p>
  {% endif %}
</form>
<form class="card wide" id="diffusion" method="post" action="{{ repo.url }}/settings/diffusion">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>Diffusion</h2>
  <p>When a repository this one pins as a subrepo moves on, Diffusion opens a proposal here that moves the pin, tested by this repository's own pipeline, with the upstream's changes listed. By default it never lands anything by itself.</p>
  <div class="choice">
    <label><input type="radio" name="diffusion" value="green"{% if row.diffusion == "green" %} checked{% endif %}> when the upstream's checks pass</label>
    <label><input type="radio" name="diffusion" value="any"{% if row.diffusion == "any" %} checked{% endif %}> on every upstream move</label>
    <label><input type="radio" name="diffusion" value="off"{% if row.diffusion == "off" %} checked{% endif %}> off</label>
    <label><input type="radio" name="diffusion" value="default"{% if row.diffusion.is_empty() %} checked{% endif %}> site default ({{ diffusion_site }}, from <code>[diffusion] follow</code> in <code>hub.toml</code>)</label>
  </div>
  <h3>Landing</h3>
  <div class="choice">
    <label><input type="radio" name="land" value="propose"{% if row.diffusion_land != "auto" %} checked{% endif %}> propose only: a person lands each bump</label>
    <label><input type="radio" name="land" value="auto"{% if row.diffusion_land == "auto" %} checked{% endif %}> land by itself when both halves are green: the upstream state it pins passed its own checks and this repository's run on the bump passed</label>
  </div>
  <p class="small mute">An untested (amber) upstream always waits for a person. A landing by Diffusion still needs this repository's required checks and approvals, and a trust policy that lets the hub's key move the bookmark; otherwise the bump waits, and its timeline says why.</p>
  <p class="small mute">A subrepo's <code>.oxymodules</code> entry overrides this with <code>follow = green</code>, <code>any</code> or <code>off</code>; <code>land = auto</code> or <code>propose</code> overrides the landing, <code>target</code> names the bookmark to move (else the one this repository's proposals land on) and <code>watch</code> lists paths whose upstream changes are flagged.</p>
  <button type="submit">SAVE</button>
</form>
{% if role == crate::auth::Role::Admin %}
<form class="card wide" id="coverage" method="post" action="{{ repo.url }}/settings/coverage">
  <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
  <h2>Coverage</h2>
  <p class="small mute">A job's <code>coverage</code> artifact (LCOV) gives each run a <code>coverage</code> check, measured against <strong>{{ row.default_bookmark }}</strong>. Without rules it only reports; with them it fails when they are broken, and a required check named <code>coverage</code> then holds a proposal back.</p>
  <div class="row">
    <div><label for="cov_min">Fail below this percentage</label><input type="number" id="cov_min" name="min" min="0" max="100" step="0.1" value="{% if let Some(m) = coverage.min %}{{ m }}{% endif %}" placeholder="e.g. 80"></div>
    <div><label for="cov_drop">Fail when it falls by more than (points)</label><input type="number" id="cov_drop" name="max_drop" min="0" max="100" step="0.1" value="{% if let Some(m) = coverage.max_drop %}{{ m }}{% endif %}" placeholder="e.g. 0.5"></div>
  </div>
  <button type="submit">SAVE</button>
</form>
<section class="panel" id="runners">
  <h2>Runners</h2>
  <p class="small">The OxygenFlow runners that may take this repository's jobs: the site's, {{ row.owner }}'s, and this repository's own.</p>
  {% if let Some(t) = runner_token %}<p class="note">Register a runner for this repository with:</p><pre class="snippet">flow runner register {{ shell.base_url }} --token {{ t }} --name NAME</pre>{% endif %}
  {% if runners.is_empty() %}<p class="mute small">None yet: runs wait until a runner that serves this repository is added.</p>{% else %}
  <div class="table"><table>
  <tr><th>Runner</th><th>Status</th><th>Serves</th><th>Machine</th><th></th></tr>
  {% for (r, serves, own) in runners %}<tr><td><strong>{{ r.name }}</strong></td><td><span class="runner-status st-{{ r.status() }}">{{ r.status() }}</span></td><td class="small">{{ serves }}</td><td class="small">{% if r.arch.is_empty() %}<span class="mute">unknown</span>{% else %}{{ r.arch }} · {{ r.os }}{% endif %}</td>
  <td>{% if *own %}<form class="tiny" method="post" action="{{ repo.url }}/settings/runners/{{ r.id }}/remove" onsubmit="return confirm('Remove {{ r.name }}? Its credential stops working.')"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button class="danger-btn">remove</button></form>{% endif %}</td></tr>{% endfor %}
  </table></div>{% endif %}
  <form method="post" action="{{ repo.url }}/settings/runners/token"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button type="submit">Add a runner for this repository</button></form>
</section>
{% call w::panel(repo.url ~ "/settings", hooks, shell.csrf, "Each delivery is signed with the secret (X-Oxyhub-Signature) and retried with backoff for a day.") %}
{% call va::panel(repo.url ~ "/settings", variables, shell.csrf, "This repository's jobs get these, beside the ones the site and its owner set.") %}
{% call se::panel(repo.url ~ "/settings", secrets, shell.csrf, "This repository's jobs may use these, beside the ones the site and its owner set.") %}
{% call ai::panel(repo.url ~ "/settings", assistants, shell.csrf, "This repository may ask these, beside the ones the site and its owner provide.") %}
{% if role == crate::auth::Role::Admin %}{% if let Some(st) = storage %}<section class="panel" id="storage">
  <h2>Storage</h2>
  <p>This repository's data lives in <code>{{ st.url }}</code>, your bucket. This server keeps a cache and the credentials, sealed.</p>
  <dl class="facts">
    <dt>Since</dt><dd><time title="{{ st.created_ms|when_i }}">{{ st.created_ms|ago_i }}</time></dd>
    <dt>Last check</dt><dd>{% if let Some(t) = st.checked_ms %}<time title="{{ t|when_i }}">{{ t|ago_i }}</time>: {{ st.check_result }}{% else %}<span class="mute">never</span>{% endif %}</dd>
  </dl>
  <form class="inline" method="post" action="{{ repo.url }}/settings/storage">
    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
    <input type="hidden" name="action" value="check">
    <button type="submit" title="Write, read, list and delete under a probe prefix of the bucket, and compare-and-swap a record">CHECK THE BUCKET</button>
  </form>
  <details>
    <summary>Replace the credentials</summary>
    <form class="card" method="post" action="{{ repo.url }}/settings/storage">
      <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
      <input type="hidden" name="action" value="credentials">
      <p class="small mute">The new credentials must pass the check before they replace the old ones. Fill the fields for your provider.</p>
      {% if st.url.starts_with("s3://") %}<div class="row">
        <div><label for="sak">Access key ID</label><input type="text" id="sak" name="access_key_id" autocomplete="off" required></div>
        <div><label for="ssk">Secret access key</label><input type="password" id="ssk" name="secret_access_key" autocomplete="new-password" required></div>
      </div>{% else if st.url.starts_with("gs://") %}<label for="ssa">Service account key</label><textarea id="ssa" name="service_account_key" rows="3" required spellcheck="false"></textarea>{% else %}<div class="row">
        <div><label for="stn">Tenant ID</label><input type="text" id="stn" name="tenant_id" autocomplete="off" required></div>
        <div><label for="sci">Client ID</label><input type="text" id="sci" name="client_id" autocomplete="off" required></div>
        <div><label for="scs">Client secret</label><input type="password" id="scs" name="client_secret" autocomplete="new-password" required></div>
      </div>{% endif %}
      <button type="submit">SAVE</button>
    </form>
  </details>
</section>{% endif %}{% endif %}
<section class="panel" id="collaborators">
  <h2>Collaborators</h2>
  {% if collaborators.is_empty() %}<p class="mute small">Nobody beyond the owner{% if !teams.is_empty() %} and the organisation's members{% endif %}.</p>{% else %}
  <table class="small">
  {% for c in collaborators %}
  <tr><td>{% if let Some(a) = c.account %}<a href="/{{ a.username }}">{{ a.username }}</a>{% else if let Some(t) = c.team %}team {{ t.name }}{% endif %}</td><td>{{ c.role }}</td>
  <td><form class="tiny" method="post" action="{{ repo.url }}/settings/collaborators"><input type="hidden" name="_csrf" value="{{ shell.csrf }}">{% if let Some(a) = c.account %}<input type="hidden" name="username" value="{{ a.username }}">{% else if let Some(t) = c.team %}<input type="hidden" name="team" value="{{ t.name }}">{% endif %}<button name="remove" value="1">remove</button></form></td></tr>
  {% endfor %}
  </table>{% endif %}
  <form class="card" method="post" action="{{ repo.url }}/settings/collaborators">
    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
    <div class="row">
      <div><label for="username">Account</label><input type="text" id="username" name="username"></div>
      {% if !teams.is_empty() %}<div><label for="team">or team</label><select id="team" name="team"><option value="">—</option>{% for t in teams %}<option value="{{ t.name }}">{{ t.name }}</option>{% endfor %}</select></div>{% endif %}
      <div><label for="role">Role</label><select id="role" name="role"><option value="read">read</option><option value="triage">triage</option><option value="write" selected>write</option><option value="maintain">maintain</option><option value="admin">admin</option></select></div>
    </div>
    <button type="submit">ADD</button>
  </form>
</section>
<section class="panel danger-zone" id="advanced">
  <h2>Advanced</h2>
  <p class="small mute">Settings that change what this repository is. Each asks you to confirm; none can be undone from here except archiving.</p>
  <div class="danger-row">
    <div><strong>Transfer ownership</strong><p class="small mute">Move this repository to a user or an organisation you may create repositories under. Its address changes to <code>/OWNER/{{ repo.name }}</code>; the old address redirects, and <code>oxy</code> remotes keep working.</p></div>
    <details class="danger-act"><summary class="danger-btn">Transfer</summary>
      <form class="card" method="post" action="{{ repo.url }}/settings/transfer">
        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
        <label for="towner">New owner</label><input type="text" id="towner" name="owner" placeholder="an organisation or a user" required>
        <label for="tconfirm">Type <code>{{ repo.owner }}/{{ repo.name }}</code> to confirm</label><input type="text" id="tconfirm" name="confirm" required autocomplete="off">
        <button type="submit">TRANSFER</button>
      </form>
    </details>
  </div>
  <div class="danger-row">
    <div><strong>{% if row.archived %}Bring this repository back{% else %}Archive this repository{% endif %}</strong><p class="small mute">{% if row.archived %}It is archived: read-only for everyone, shown with a badge.{% if !row.archived_reason.is_empty() %} Reason: {{ row.archived_reason }}{% endif %}{% else %}Read-only for everyone, including you: no pushes, edits, issues, proposals or comments, until an admin brings it back. Say why, for whoever finds it later.{% endif %}</p></div>
    <details class="danger-act"><summary class="danger-btn">{% if row.archived %}Unarchive{% else %}Archive{% endif %}</summary>
      <form class="card" method="post" action="{{ repo.url }}/settings/archive">
        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
        {% if row.archived %}<input type="hidden" name="action" value="unarchive"><button type="submit">BRING IT BACK</button>{% else %}<input type="hidden" name="action" value="archive">
        <label for="areason">Reason (optional)</label><textarea id="areason" name="reason" rows="2" maxlength="500" placeholder="Superseded by …"></textarea>
        <button type="submit">ARCHIVE</button>{% endif %}
      </form>
    </details>
  </div>
  <div class="danger-row">
    <div><strong>Delete wiki data</strong><p class="small mute">{% if repo.wiki %}The wiki's repository moves to the trash with its history; a new first page starts a fresh one.{% else %}This repository has no wiki.{% endif %}</p></div>
    {% if repo.wiki %}<details class="danger-act"><summary class="danger-btn">Delete wiki data</summary>
      <form class="card" method="post" action="{{ repo.url }}/settings/wiki/delete">
        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
        <label for="wconfirm">Type <code>{{ repo.owner }}/{{ repo.name }}</code> to confirm</label><input type="text" id="wconfirm" name="confirm" required autocomplete="off">
        <button type="submit">DELETE WIKI DATA</button>
      </form>
    </details>{% else %}<button class="danger-btn" type="button" disabled>Delete wiki data</button>{% endif %}
  </div>
  <div class="danger-row">
    <div><strong>Delete this repository</strong><p class="small mute">The repository moves to the trash and is removed after the retention period.</p></div>
    <details class="danger-act"><summary class="danger-btn">Delete</summary>
      <form class="card" method="post" action="{{ repo.url }}/settings/delete">
        <input type="hidden" name="_csrf" value="{{ shell.csrf }}">
        <label for="dconfirm">Type <code>{{ repo.owner }}/{{ repo.name }}</code> to confirm</label><input type="text" id="dconfirm" name="confirm" required autocomplete="off">
        <button type="submit">DELETE</button>
      </form>
    </details>
  </div>
</section>
{% endif %}
</div>
</div>
{% endblock %}