{% extends "base.html" %}
{% block title %}Verwaltung{% endblock %}
{% block content %}
<div class="stack stack-sm">
  <h1>Verwaltung</h1>
  <a class="text-sm" href="{{ url_for('help_topic', topic='admins') }}">Hilfe: Tenants, Projekte, Keys, Personen</a>
  <p class="text-muted">{% if a.access.is_platform %}Tenants, Projekte und Keys aller Tenants.{% else %}Projekte und Keys deines Tenants.{% endif %}</p>
</div>

{% if new_key %}
<div class="alert alert-warning" role="alert">
  <div class="alert-content stack stack-sm">
    <p class="alert-title">Key „{{ new_key.row.name }}“ angelegt — jetzt kopieren</p>
    <p>Der Key wird nur dieses eine Mal angezeigt. Hugin speichert nur einen Hash davon.</p>
    <div class="cluster">
      <code class="hugin-umbruch" id="new-key">{{ new_key.key }}</code>
      <button class="btn btn-secondary btn-sm" type="button" data-copy="new-key">Kopieren</button>
    </div>
  </div>
</div>
{% endif %}

{% if a.access.is_platform %}
<div class="card">
  <div class="card-header"><h2 class="text-lg">Tenants</h2></div>
  <div class="card-body stack">
    <div class="cluster">
      {% for x in tenants %}<a class="btn btn-sm {{ 'btn-primary' if t and x.slug == t.slug else 'btn-secondary' }}" href="{{ url_for('manage') }}?tenant={{ x.slug }}">{{ x.slug }}{% if x.locked_since %} (gesperrt){% endif %}</a>{% endfor %}
    </div>
    {% if t %}
    <form method="post" action="{{ url_for('lock_tenant', slug=t.slug) }}" class="cluster">
      <input type="hidden" name="_csrf" value="{{ a.csrf }}">
      {% if t.locked_since %}
      <span class="badge badge-danger">{{ t.slug }} gesperrt seit {{ t.locked_since.strftime('%d.%m.%Y') }}</span>
      <button class="btn btn-secondary btn-sm" type="submit" name="action" value="unlock">Entsperren</button>
      {% else %}
      <button class="btn btn-ghost btn-sm" type="submit" name="action" value="lock"
              data-confirm="Tenant {{ t.slug }} sperren? Alle Sitzungen und Keys des Tenants verlieren sofort den Zugriff.">Tenant {{ t.slug }} sperren</button>
      {% endif %}
    </form>
    {% endif %}
    <form method="post" action="{{ url_for('create_tenant') }}" class="form-row">
      <input type="hidden" name="_csrf" value="{{ a.csrf }}">
      <input name="slug" placeholder="slug, z. B. vertrieb" required pattern="[a-z0-9]+(-[a-z0-9]+)*" aria-label="Slug">
      <input name="name" placeholder="Name" aria-label="Name">
      <button class="btn btn-secondary" type="submit">Tenant anlegen</button>
    </form>
  </div>
</div>
{% endif %}

{% if t %}
<div class="grid grid-2">
  <div class="card">
    <div class="card-header"><h2 class="text-lg">Projekte in {{ t.slug }}</h2></div>
    <div class="card-body stack">
      {% if projects %}
      <ul>{% for p in projects %}<li><code>{{ p.slug }}</code> {{ p.name }}</li>{% endfor %}</ul>
      {% else %}<p class="text-muted">Noch keine Projekte.</p>{% endif %}
      <form method="post" action="{{ url_for('create_project', slug=t.slug) }}" class="form-row">
        <input type="hidden" name="_csrf" value="{{ a.csrf }}">
        <input name="project_slug" placeholder="slug, z. B. shop" required pattern="[a-z0-9]+(-[a-z0-9]+)*" aria-label="Slug">
        <input name="name" placeholder="Name" aria-label="Name">
        <button class="btn btn-secondary" type="submit">Projekt anlegen</button>
      </form>
    </div>
  </div>

  <div class="card">
    <div class="card-header"><h2 class="text-lg">Neuer Key</h2></div>
    <div class="card-body">
      <form method="post" action="{{ url_for('create_key', slug=t.slug) }}" class="stack">
        <input type="hidden" name="_csrf" value="{{ a.csrf }}">
        <div class="form-row">
          <div class="form-group">
            <label for="key-kind">Art</label>
            <select id="key-kind" name="kind" data-switch>
              <option value="project">Projekt-Key (hk_)</option>
              <option value="integration">Integrations-Key (hi_)</option>
              {% if a.access.is_platform %}<option value="tenant">Tenant-Key (ht_)</option>{% endif %}
            </select>
          </div>
          <div class="form-group" data-when="key-kind:project">
            <label for="key-project">Projekt</label>
            <select id="key-project" name="project" required>
              <option value="">–</option>
              {% for p in projects %}<option value="{{ p.slug }}">{{ p.slug }}</option>{% endfor %}
            </select>
          </div>
        </div>
        <div class="form-group" data-when="key-kind:integration">
          <label for="key-projects">Nur für diese Projekte</label>
          <select id="key-projects" name="projects" multiple size="{{ [projects | length, 4] | min if projects else 1 }}">
            {% for p in projects %}<option value="{{ p.slug }}">{{ p.slug }}</option>{% endfor %}
          </select>
          <p class="form-hint">Nichts ausgewählt: alle Projekte des Tenants.</p>
        </div>
        <div class="form-group">
          <label for="key-name">Name</label>
          <input id="key-name" name="name" required placeholder="z. B. CI shop-api oder Anna (Autorin)">
        </div>
        <fieldset>
          <legend>Rollen (lesen haben alle)</legend>
          <div class="cluster">
          {% for role in roles %}
            {% if a.access.is_platform or role not in ('pub_author', 'pub_reviewer', 'tenant_admin') %}
            <label class="cluster" title="{{ ROLE_HINTS.get(role, '') }}"><input type="checkbox" name="roles" value="{{ role }}"> {{ role | label }}</label>
            {% endif %}
          {% endfor %}
          </div>
        </fieldset>
        <button class="btn btn-primary" type="submit">Key anlegen</button>
      </form>
    </div>
  </div>
</div>

<div class="card">
  <div class="card-header"><h2 class="text-lg">Pflichtpakete in {{ t.slug }}</h2></div>
  <div class="card-body stack">
    <p class="text-sm text-muted">Pflichtpakete kommen bei jedem <code>hugin sync</code> in jedes Repo des Tenants, auch ohne Eintrag in <code>.hugin.yaml</code>, und lassen sich nicht abbestellen. Für wenige Dinge, die überall gelten müssen. <a href="{{ url_for('help_topic', topic='admins') }}">Hilfe</a></p>
    {% if mandatory %}
    <div class="table-wrap"><table class="table-compact">
      <thead><tr><th>Paket</th><th>Gilt für</th><th>Seit</th><th></th></tr></thead>
      <tbody>{% for x in mandatory %}
        <tr>
          <td><a href="{{ url_for('package', package_id=x.package) }}"><code>{{ x.package }}</code></a></td>
          <td>{{ 'alle Tenants' if x.for_all else t.slug }}</td>
          <td class="text-sm">{{ x.set_at.strftime('%d.%m.%Y') }}</td>
          <td>{% if a.access.is_platform or not x.for_all %}
            <form method="post" action="{{ url_for('remove_mandatory', slug=t.slug, package=x.package) }}"
                  data-confirm="{{ x.package }} ist dann keine Pflicht mehr und kommt nur noch in Repos, die es abonnieren.">
              <input type="hidden" name="_csrf" value="{{ a.csrf }}">
              <input type="hidden" name="scope" value="{{ 'all' if x.for_all else 'tenant' }}">
              <button class="btn btn-ghost btn-xs" type="submit">Keine Pflicht mehr</button>
            </form>{% endif %}</td>
        </tr>
      {% endfor %}</tbody>
    </table></div>
    {% else %}<p class="text-muted">Keine Pflichtpakete.</p>{% endif %}
    {% if candidates %}
    <form method="post" action="{{ url_for('set_mandatory', slug=t.slug) }}" class="form-row">
      <input type="hidden" name="_csrf" value="{{ a.csrf }}">
      <select name="package" aria-label="Paket">{% for p in candidates %}<option>{{ p }}</option>{% endfor %}</select>
      {% if a.access.is_platform %}
      <select name="scope" aria-label="Gilt für">
        <option value="tenant">nur in {{ t.slug }}</option>
        <option value="all">in allen Tenants</option>
      </select>
      {% endif %}
      <button class="btn btn-secondary" type="submit">Als Pflicht setzen</button>
    </form>
    {% endif %}
  </div>
</div>

<div class="card">
  <div class="card-header"><h2 class="text-lg">Personen in {{ t.slug }}</h2></div>
  <div class="card-body stack">
    <p class="text-sm text-muted">Autoren und Prüfer als Personen mit persönlichem Key (hp_…, 180 Tage). Nur so sind vier Augen nachweisbar; Pakete mit Skripten oder Rechten gehen nur damit.</p>
    {% if people %}
    <div class="table-wrap"><table class="table-compact">
      <thead><tr><th>Name</th><th>Mail</th><th>Projekt</th><th>Rollen</th><th>Key läuft ab</th><th></th></tr></thead>
      <tbody>{% for x in people %}
        {% set aktiv = x.keys | selectattr('revoked_since', 'none') | list %}
        <tr>
          <td>{{ x.person.name }}</td><td class="text-sm">{{ x.person.mail }}</td><td>{{ x.project or '–' }}</td>
          <td class="text-sm">{{ x.roles | map('label') | join(', ') or '–' }}</td>
          <td class="text-sm">{{ aktiv[-1].expires_at.strftime('%d.%m.%Y') if aktiv else '–' }}</td>
          <td>{% if x.person.locked_since %}<span class="badge badge-default">gesperrt</span>{% else %}
            <div class="cluster">
              <form method="post" action="{{ url_for('person_key', slug=t.slug, person_id=x.person.id) }}">
                <input type="hidden" name="_csrf" value="{{ a.csrf }}"><button class="btn btn-ghost btn-xs" type="submit">Neuer Key</button></form>
              <form method="post" action="{{ url_for('lock_person', slug=t.slug, person_id=x.person.id) }}"
                    data-confirm="{{ x.person.name }} sperren? Alle Keys der Person verlieren sofort den Zugriff. Entsperren geht hier nicht.">
                <input type="hidden" name="_csrf" value="{{ a.csrf }}"><button class="btn btn-ghost btn-xs" type="submit">Sperren</button></form>
            </div>{% endif %}</td>
        </tr>
      {% endfor %}</tbody>
    </table></div>
    {% endif %}
    <details>
      <summary>Person anlegen</summary>
      <form method="post" action="{{ url_for('create_person', slug=t.slug) }}" class="stack">
        <input type="hidden" name="_csrf" value="{{ a.csrf }}">
        <div class="form-row">
          <div class="form-group"><label for="p-name">Name</label><input id="p-name" name="name" required></div>
          <div class="form-group"><label for="p-mail">Mail</label><input id="p-mail" name="mail" type="email" required></div>
          <div class="form-group"><label for="p-project">Projekt (für Autoren)</label>
            <select id="p-project" name="project"><option value="">–</option>{% for p in projects %}<option value="{{ p.slug }}">{{ p.slug }}</option>{% endfor %}</select></div>
        </div>
        <div class="cluster">
        {% for role in roles %}
          {% if a.access.is_platform or role not in ('pub_author', 'pub_reviewer', 'tenant_admin') %}
          <label class="cluster" title="{{ ROLE_HINTS.get(role, '') }}"><input type="checkbox" name="roles" value="{{ role }}"> {{ role | label }}</label>
          {% endif %}
        {% endfor %}
        </div>
        <button class="btn btn-primary" type="submit">Person anlegen und Key erzeugen</button>
      </form>
    </details>
  </div>
</div>

<div class="card">
  <div class="card-header"><h2 class="text-lg">Keys in {{ t.slug }}</h2></div>
  <div class="table-wrap">
    <table class="table-compact">
      <thead><tr><th>Name</th><th>Art</th><th>Projekt</th><th>Rollen</th><th>Präfix</th><th>Zuletzt genutzt</th><th></th></tr></thead>
      <tbody>
      {% for k in keys %}
        <tr>
          <td>{{ k.name }}</td>
          <td>{{ k.kind | label }}</td>
          <td>{% if k.kind == 'integration' %}{% for pid in k.projects %}{{ project_names.get(pid, '?') }}{% if not loop.last %}, {% endif %}{% else %}alle{% endfor %}{% else %}{{ project_names.get(k.project_id, '–') }}{% endif %}</td>
          <td class="text-sm">{{ k.roles | map('label') | join(', ') or '–' }}</td>
          <td><code>{{ k.prefix }}…</code></td>
          <td class="text-sm">{{ k.last_used | when if k.last_used else 'nie' }}</td>
          <td>
          {% if k.revoked_since %}<span class="badge badge-default">widerrufen</span>
          {% elif a.access.is_platform or k.kind != 'tenant' %}
            <form method="post" action="{{ url_for('revoke_key', slug=t.slug, key_id=k.id) }}"
                  data-confirm="Key „{{ k.name }}“ widerrufen? Was ihn nutzt (CI, Repos, MCP), verliert sofort den Zugriff.">
              <input type="hidden" name="_csrf" value="{{ a.csrf }}">
              <button class="btn btn-ghost btn-xs" type="submit">Widerrufen</button>
            </form>
          {% endif %}
          </td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
</div>
{% endif %}
{% endblock %}