{% extends "base.html" %}
{% block title %}Users — MartinhalApprovalFlow{% endblock %}
{% block content %}
<h1>Users</h1>
<p class="sub">Create accounts and choose which workflows each user can send requests to. Admins can use every workflow. Users fill in their own details (name, unit, e-mail, MFA) on their Configure profile page; you can disable MFA here if someone loses their device.</p>

<div class="card">
  <h2 style="margin-top:0">Add a user</h2>
  <form method="post">
    <input type="hidden" name="action" value="create">
    <div class="grid2">
      <div><label>Username</label><input type="text" name="username" required></div>
      <div><label>Password</label><input type="password" name="password" required></div>
      <div><label>Email <small>(used as requester address and for outcome notices)</small></label>
        <input type="email" name="email"></div>
    </div>
    <label class="check"><input type="checkbox" name="is_admin"> Administrator</label>
    <button type="submit">Create user</button>
  </form>
</div>

{% for u in users %}
<div class="card">
  <div class="rowline">
    <b>{{ u.username }}</b>
    {% if u.first_name or u.last_name %}<span class="muted">{{ u.first_name }} {{ u.last_name }}</span>{% endif %}
    {% if u.unit_location %}<span class="chip">{{ u.unit_location }}</span>{% endif %}
    {% if u.is_admin %}<span class="chip">admin</span>{% endif %}
    {% if u.mfa_secret %}<span class="chip">MFA on</span>{% endif %}
    {% if u.email %}<span class="mono muted">{{ u.email }}</span>{% endif %}
    <span style="flex:1"></span>
    {% if u.mfa_secret %}
    <form method="post" class="inline" onsubmit="return confirm('Disable MFA for {{ u.username }}? They can re-enable it from their Configure profile page.')">
      <input type="hidden" name="action" value="mfa_off">
      <input type="hidden" name="user_id" value="{{ u.id }}">
      <button class="btn ghost small">Disable MFA</button>
    </form>
    {% endif %}
    {% if u.id != session['user_id'] %}
    <form method="post" class="inline" onsubmit="return confirm('Delete {{ u.username }}?')">
      <input type="hidden" name="action" value="delete">
      <input type="hidden" name="user_id" value="{{ u.id }}">
      <button class="btn ghost small">Delete</button>
    </form>
    {% endif %}
  </div>

  {% if not u.is_admin %}
  <form method="post">
    <input type="hidden" name="action" value="access">
    <input type="hidden" name="user_id" value="{{ u.id }}">
    <label>Workflow access</label>
    {% for w in workflows %}
      <label class="check" style="margin-top:.3rem">
        <input type="checkbox" name="workflow_ids" value="{{ w.id }}"
          {% if w.id in access.get(u.id, ()) %}checked{% endif %}> {{ w.name }}
      </label>
    {% else %}
      <span class="muted">No workflows exist yet.</span>
    {% endfor %}
    {% if workflows %}<button class="small" type="submit">Save access</button>{% endif %}
  </form>
  {% endif %}

  <details>
    <summary>Reset password</summary>
    <form method="post" class="rowline" style="margin-top:.5rem">
      <input type="hidden" name="action" value="password">
      <input type="hidden" name="user_id" value="{{ u.id }}">
      <input type="password" name="password" placeholder="New password" required style="max-width:240px">
      <button class="small" type="submit">Set password</button>
    </form>
  </details>
</div>
{% endfor %}
{% endblock %}