<!--!  Copyright (C) 2006-2014 Edgewall Software

  This software is licensed as described in the file COPYING, which
  you should have received as part of this distribution. The terms
  are also available at http://trac.edgewall.com/license.html.

  This software consists of voluntary contributions made by many
  individuals. For the exact contribution history, see the revision
  history and logs, available at http://trac.edgewall.org/.
-->
<!DOCTYPE html
    PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:xi="http://www.w3.org/2001/XInclude"
      xmlns:py="http://genshi.edgewall.org/"
      xmlns:i18n="http://genshi.edgewall.org/i18n">
  <xi:include href="admin.html" />
  <head>
    <title>Permissions</title>
  </head>

  <body>
    <h2>Manage Permissions and Groups</h2>

    <py:if test="'PERMISSION_GRANT' in perm('admin', 'general/perm')">
      <form id="addperm" class="addnew" method="post" action="">
        <fieldset>
          <legend>Grant Permission:</legend>
          <div class="field">
            <label>Subject: <input id="gp_subject" type="text" name="subject" /></label>
          </div>
          <div class="field">
            <label>Action:
              <select id="action" name="action"
                      py:with="allowed_actions = [a for a in actions if a in perm]">
                <option py:for="action in sorted(allowed_actions)">$action</option>
              </select>
            </label>
          </div>
          <div class="buttons">
            <input type="submit" name="add" class="trac-disable-on-submit" value="${_('Add')}" />
          </div>
          <p class="help">
            Grant permission for an action to a subject, which can be either a user
            or a group.
          </p>
        </fieldset>
      </form>

      <form id="addsubj" class="addnew" method="post" action="">
        <fieldset>
          <legend>Add Subject to Group:</legend>
          <div class="field">
            <label>Subject: <input id="sg_subject" type="text" name="subject"/></label>
          </div>
          <div class="field">
            <label>Group: <input id="sg_group" type="text" name="group" /></label>
          </div>
          <div class="buttons">
            <input type="submit" name="add" class="trac-disable-on-submit" value="${_('Add')}"/>
          </div>
          <p class="help">
            Add a user or group to an existing permission group.
          </p>
        </fieldset>
      </form>
    </py:if>

    <form id="revokeform" method="post" action="" py:with="can_revoke = 'PERMISSION_REVOKE' in perm('admin', 'general/perm')">
      <h3>Permissions</h3>
      <table class="listing" id="permlist">
        <thead>
          <tr><th>Subject</th><th>Action</th></tr>
        </thead>
        <tbody>
          <tr py:for="idx, (subject, perm_group) in enumerate(groupby(sorted(perms), key=lambda p: p[0]))"
              class="${'odd' if idx % 2 else 'even'}">
            <td>$subject</td>
            <td>
              <label py:for="subject, action in perm_group"
                     py:with="invalid = action not in actions; has_perm = action in perm">
                <!--! base64 makes it safe to use ':' as separator when passing
                      both subject and action as one query parameter -->
                <input py:if="can_revoke" type="checkbox" name="sel"
                       title="${_('You don\'t have permission to revoke this action')
                                if not has_perm else None}"
                       value="${'%s:%s' % (unicode_to_base64(subject),
                                           unicode_to_base64(action))}"
                       disabled="${'disabled' if not has_perm else None}" />
                <span class="${classes(missing=invalid)}"
                      title="${_('%(action)s is no longer defined', action=action) if invalid else action}">${action}</span>
              </label>
            </td>
          </tr>
          <tr py:if="not perms"><td colspan="2">No permissions</td></tr>
        </tbody>
      </table>

      <h3>Group Membership</h3>
      <table class="listing" id="grouplist">
        <thead>
          <tr><th>Group</th><th>Subject</th></tr>
        </thead>
        <tbody>
          <tr py:for="idx, (group, subj_group) in enumerate(groupby(sorted(groups, key=lambda p: p[1]),
                                                                    key=lambda p: p[1]))"
              class="${'odd' if idx % 2 else 'even'}">
            <td>$group</td>
            <td>
              <label py:for="subject, action in sorted(subj_group)">
                <!--! base64 makes it safe to use ':' as separator when passing
                      both subject and action as one query parameter -->
                <input py:if="can_revoke" type="checkbox" name="sel"
                       value="${'%s:%s' % (unicode_to_base64(subject),
                                           unicode_to_base64(action))}"/> $subject
              </label>
            </td>
          </tr>
          <tr py:if="not groups"><td colspan="2">No group memberships</td></tr>
        </tbody>
      </table>
      <div class="buttons" py:if="can_revoke">
        <input type="submit" name="remove" value="${_('Remove selected items')}" />
      </div>
    </form>

    <p class="help" i18n:msg="">
      Note that <em>Subject</em> or <em>Group</em> names can't be all upper-case,
      as that is reserved for permission names.
    </p>
  </body>

</html>
