todo.sr.ht/todosrht/templates/tracker-access.html

{% extends "settings.html" %}
{% block title %}
<title>Configure {{tracker.owner}}/{{tracker.name}} &mdash; {{ cfg("sr.ht", "site-name") }}</title>
{% endblock %}
{% macro perm_checkbox(type, perms, name) %}
{% if type.name not in ["none", "all"] %}
<div class="form-check form-check-inline">
  <label class="form-check-label" title="{{access_help_map[type]}}">
  {% if type %}
    <input
      class="form-check-input"
      type="checkbox"
      name="perm_{{ name }}_{{ type.name }}"
      value="{{type.value}}"
      {{ "checked" if type in perms }}> {{type.name}}
  {% else %}
    <input
      class="form-check-input"
      type="checkbox"
      name="perm_{{ name }}_{{ type.name }}"
      value="{{type.value}}"
      {{ "checked" if perms == 0 }}> {{type.name}}
  {% endif %}
  </label>
</div>
{% endif %}
{% endmacro %}
{% block content %}
<div class="row">
  <div class="col-md-7">
    <form method="POST">
      {{csrf_token()}}
      <div class="form-group {{valid.cls("tracker_any_access")}}">
        <p>
          These permissions allow you to control what kinds of users are able
          to do what sorts of activities on your tracker.
        </p>
        <div class="event-list">
          <div class="event">
            <h4>Anonymous Permissions</h4>
            <p>
              Permissions granted to anyone who visits this tracker, logged
              in or otherwise.
            </p>
            {% for a in access_type_list %}
            {{ perm_checkbox(a, tracker.default_anonymous_perms, "anon") }}
            {% endfor %}
            {{ valid.summary("tracker_anon_access") }}
          </div>
          <div class="event">
            <h4>User Permissions</h4>
            <p>
              Permissions granted to any logged-in {{cfg("sr.ht",
              "site-name")}} user.
            </p>
            {% for a in access_type_list %}
            {{ perm_checkbox(a, tracker.default_user_perms, "user") }}
            {% endfor %}
            {{ valid.summary("tracker_user_access") }}
          </div>
          <div class="event">
            <h4>Submitter Permissions</h4>
            <p>
              Permissions granted to the ticket submitter on the tickets they
              submit.
            </p>
            {% for a in access_type_list %}
            {{ perm_checkbox(a, tracker.default_submitter_perms, "submit") }}
            {% endfor %}
            {{ valid.summary("tracker_submit_access") }}
          </div>
          {# TODO: once we link git accounts
          <div class="event">
            <h4>Committer Permissions</h4>
            {% for a in access_type_list %}
            {{ perm_checkbox(a, tracker.default_committer_perms, "commit") }}
            {% endfor %}
            {{ valid.summary("tracker_commit_access") }}
          </div>
          #}
        </div>
      </div>
      {{ valid.summary() }}
      <span class="pull-right">
        <button type="submit" class="btn btn-primary">
          Save {{icon("caret-right")}}
        </button>
      </span>
    </form>

    <div class="clearfix"></div>

    <h4>User permissions</h4>

    <p>Here you may override permissions for specific users.</p>

    {% if tracker.user_accesses %}
    <table class="table">
      <tbody>
        {% for user_access in tracker.user_accesses %}
        <tr>
          <td>{{ user_access.user }}</td>
          <td>
            {% if user_access.permissions.name in ["all", "none"] %}
              {{ user_access.permissions.name }}
            {% else %}
            {% for type in access_type_list
               if type and type in user_access.permissions %}
               {{ type.name }}{% if not loop.last %},{% endif %}
            {% endfor %}
            {% endif %}
          </td>
          <td>{{ user_access.created|date }}</td>
          <td>
            <form
              action="{{ url_for(".settings_user_access_delete_POST",
                  owner=tracker.owner.canonical_name,
                  name=tracker.name,
                  user_id=user_access.user_id) }}"
              method="POST"
              style="margin: 0"
            >
              {{ csrf_token() }}
              <button type="submit" class="btn btn-link btn-block">
                (remove)
              </button>
            </form>
          </td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
    {% endif %}

    <form
      method="POST"
      class="form-horizontal"
      action="{{ url_for(".settings_user_access_create_POST",
          owner=tracker.owner.canonical_name,
          name=tracker.name) }}"
    >
      {{ csrf_token() }}

      <div class="event-list">
        <div class="event">
          <h4>Add user permissions</h4>

          <div class="form-group" style="margin-top: 1rem">
            <label for="username">User</label>
            <input
              type="text"
              class="form-control {{valid.cls("username")}}"
              id="username"
              name="username"
              placeholder="~{{ current_user.username }}"
              value="{{username or ""}}"
            />
            {{ valid.summary("username") }}
          </div>

          <p>Permissions</p>

          <div class="form-group">
            {% for a in access_type_list %}
            {{ perm_checkbox(a, TicketAccess.all, "user_access") }}
            {% endfor %}
            {{ valid.summary("user_access") }}
          </div>
        </div>
      </div>

      <span class="pull-right">
        <button type="submit" class="btn btn-primary">
          Add {{icon("caret-right")}}
        </button>
      </span>
    </form>
  </div>
</div>
{% endblock %}