web permissions2
This commit is contained in:
Priec
140
web/templates/pages/permissions/grants/grants.html
Normal file
140
web/templates/pages/permissions/grants/grants.html
Normal file
@@ -0,0 +1,140 @@
|
||||
{#
|
||||
GET /permissions/grants — crate::pages::permissions::grants::ui::GrantsTemplate
|
||||
|
||||
One matrix per profile: objects down the side, actions across the top. Every
|
||||
button on the page — a single cell, a whole row, a whole profile, everything —
|
||||
posts the same form to /permissions/grants/apply and differs only in the list
|
||||
of object|action pairs it carries. The lists are built in Rust
|
||||
(grants::state), so the page never asks the server to work out what "all"
|
||||
meant.
|
||||
#}
|
||||
{% extends "ui/base.html" %}
|
||||
|
||||
{% block title %}Access{% endblock %}
|
||||
|
||||
{% macro apply(role, mode, pairs, label, style, hint) %}
|
||||
<form hx-post="/permissions/grants/apply" hx-target="#permission-status">
|
||||
<input type="hidden" name="role" value="{{ role }}">
|
||||
<input type="hidden" name="mode" value="{{ mode }}">
|
||||
{% for pair in pairs %}<input type="hidden" name="pair" value="{{ pair }}">{% endfor %}
|
||||
<button type="submit" class="{{ style }}" title="{{ hint }}">{{ label }}</button>
|
||||
</form>
|
||||
{% endmacro %}
|
||||
|
||||
{% block content %}
|
||||
<main>
|
||||
<section class="heading">
|
||||
<div>
|
||||
<p class="eyebrow">Permissions</p>
|
||||
<h1>Access</h1>
|
||||
<p>What a role may do with the data. Everyone holding the role gets exactly this.</p>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{% include "pages/permissions/tabs.html" %}
|
||||
|
||||
{% if page.updated %}<p class="notice">Access updated. It applies to the next request every holder of the role makes.</p>{% endif %}
|
||||
|
||||
{% if page.roles.is_empty() %}
|
||||
<section class="panel">
|
||||
<h2>No role to edit</h2>
|
||||
<p class="hint">There is no role here you outrank. <a href="/permissions/roles">Create one</a> first.</p>
|
||||
</section>
|
||||
{% else %}
|
||||
|
||||
<section class="panel">
|
||||
<h2>Role</h2>
|
||||
<form method="get" action="/permissions/grants" class="form-grid">
|
||||
<label>Editing
|
||||
<select name="role" onchange="this.form.submit()">
|
||||
{% for role in page.roles %}
|
||||
<option value="{{ role.name }}" {% if page.selected(role.name.as_str()) %}selected{% endif %}>{{ role.name }}{% if !role.parent.is_empty() %} → inherits {{ role.parent }}{% endif %}</option>
|
||||
{% endfor %}
|
||||
</select>
|
||||
</label>
|
||||
</form>
|
||||
<p class="hint">
|
||||
{% if !page.selected_parent.is_empty() %}
|
||||
<strong>{{ page.selected_role }}</strong> inherits everything <strong>{{ page.selected_parent }}</strong> has. Inherited access shows below but is changed on the parent.
|
||||
{% else %}
|
||||
<strong>{{ page.selected_role }}</strong> inherits from nothing, so what you see below is all it has.
|
||||
{% endif %}
|
||||
{% if page.selected_is_structural %}
|
||||
This role designs the system and may never write row data, so only the read column is open.
|
||||
{% endif %}
|
||||
</p>
|
||||
|
||||
<h3 class="panel-subhead">Shortcuts</h3>
|
||||
<p class="hint">These grant the wildcard objects, so they keep covering profiles and tables created later.</p>
|
||||
<div class="actions shortcut-row">
|
||||
{% call apply(page.selected_role, "grant", page.everything_read_pairs(), "Read everything", "secondary", "Read on every profile, journal and exchange rate") %}{% endcall %}
|
||||
{% call apply(page.selected_role, "grant", page.everything_pairs(), "Full access to everything", "secondary", "Every action the role may hold, on every profile") %}{% endcall %}
|
||||
{% if page.has_direct() %}
|
||||
{% call apply(page.selected_role, "revoke", page.direct_pairs(), "Remove all access", "danger", "Revoke every grant this role holds directly") %}{% endcall %}
|
||||
{% endif %}
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{% for group in page.groups %}
|
||||
<section class="panel">
|
||||
<h2>{% if group.global %}Everything, everywhere{% else %}Profile: {{ group.title }}{% endif %}<span class="count">{{ group.rows.len() }}</span></h2>
|
||||
<div class="actions shortcut-row">
|
||||
{% if group.has_wildcards() %}
|
||||
{% call apply(page.selected_role, "grant", group.read_pairs(), "Read only", "secondary", "Read on everything in here") %}{% endcall %}
|
||||
{% call apply(page.selected_role, "grant", group.all_pairs(), "Full access", "secondary", "Every action the role may hold, on everything in here") %}{% endcall %}
|
||||
{% endif %}
|
||||
{% if group.has_direct() %}
|
||||
{% call apply(page.selected_role, "revoke", group.direct_pairs(), "Clear", "danger", "Revoke everything this role holds directly in here") %}{% endcall %}
|
||||
{% endif %}
|
||||
</div>
|
||||
|
||||
<div class="table-scroll">
|
||||
<table class="builder-table grant-matrix">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>Object</th>
|
||||
{% for action in page.actions() %}<th>{{ action }}</th>{% endfor %}
|
||||
<th>Row</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody>
|
||||
{% for row in group.rows %}
|
||||
<tr>
|
||||
<td>
|
||||
<span class="object-label">{{ row.label }}</span>
|
||||
{% if !row.note.is_empty() %}<small>{{ row.note }}</small>{% endif %}
|
||||
<code>{{ row.object }}</code>
|
||||
</td>
|
||||
{% for cell in row.cells %}
|
||||
<td class="grant-cell">
|
||||
{% if !cell.allowed %}
|
||||
<span class="cell-closed" title="Not available for this role">·</span>
|
||||
{% else if cell.direct %}
|
||||
{% call apply(page.selected_role, "revoke", row.one_pair(cell.action.as_str()), "✓", "cell-on", "Held directly — click to revoke") %}{% endcall %}
|
||||
{% else if cell.inherited %}
|
||||
<span class="cell-inherited" title="inherited: covered by the parent role or a wider grant">↑</span>
|
||||
{% else %}
|
||||
{% call apply(page.selected_role, "grant", row.one_pair(cell.action.as_str()), "+", "cell-off", "Click to grant") %}{% endcall %}
|
||||
{% endif %}
|
||||
</td>
|
||||
{% endfor %}
|
||||
<td class="grant-cell">
|
||||
<div class="actions">
|
||||
{% call apply(page.selected_role, "grant", row.all_pairs(), "All", "secondary", "Grant every action available on this object") %}{% endcall %}
|
||||
{% if row.has_direct() %}
|
||||
{% call apply(page.selected_role, "revoke", row.direct_pairs(), "None", "danger", "Revoke this object's direct grants") %}{% endcall %}
|
||||
{% endif %}
|
||||
</div>
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
<div id="permission-status" aria-live="polite"></div>
|
||||
</main>
|
||||
{% endblock %}
|
||||
84
web/templates/pages/permissions/roles/roles.html
Normal file
84
web/templates/pages/permissions/roles/roles.html
Normal file
@@ -0,0 +1,84 @@
|
||||
{# GET /permissions/roles — crate::pages::permissions::roles::ui::RolesTemplate #}
|
||||
{% extends "ui/base.html" %}
|
||||
|
||||
{% block title %}Roles{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<main>
|
||||
<section class="heading">
|
||||
<div>
|
||||
<p class="eyebrow">Permissions</p>
|
||||
<h1>Roles</h1>
|
||||
<p>A role is a named set of permissions. People are given roles; roles are given access.</p>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{% include "pages/permissions/tabs.html" %}
|
||||
|
||||
{% if page.updated %}<p class="notice">Roles updated. Signed-in sessions stay valid and pick up the change on their next request.</p>{% endif %}
|
||||
|
||||
<section class="panel">
|
||||
<h2>New role</h2>
|
||||
<p class="hint">
|
||||
Inheriting from another role starts the new one with everything that role has, and keeps it in step
|
||||
as that role changes. Starter access is a shortcut for the two common cases; anything narrower is a
|
||||
few clicks on the Access tab.
|
||||
</p>
|
||||
<form hx-post="/permissions/roles/create" hx-target="#permission-status" class="form-grid">
|
||||
<label>Name<input name="name" required maxlength="50" placeholder="sales"></label>
|
||||
<label>Inherits from
|
||||
<select name="parent">
|
||||
<option value="">Nothing — starts empty</option>
|
||||
{% for parent in page.parents %}<option value="{{ parent }}">{{ parent }}</option>{% endfor %}
|
||||
</select>
|
||||
</label>
|
||||
<label>Starter access
|
||||
<select name="access">
|
||||
<option value="none">None — grant it on the Access tab</option>
|
||||
<option value="read">Read everything</option>
|
||||
<option value="full">Read and write everything</option>
|
||||
</select>
|
||||
</label>
|
||||
<div class="form-actions"><button type="submit">Create role</button></div>
|
||||
</form>
|
||||
</section>
|
||||
|
||||
<section class="panel">
|
||||
<h2>Existing roles<span class="count">{{ page.roles.len() }}</span></h2>
|
||||
<div class="table-scroll">
|
||||
<table class="builder-table">
|
||||
<thead><tr><th>Role</th><th>Kind</th><th>Inherits from</th><th>People</th><th>Access</th><th>Remove</th></tr></thead>
|
||||
<tbody>
|
||||
{% for role in page.roles %}
|
||||
<tr>
|
||||
<td>{{ role.name }}{% if role.built_in %} <span class="tag">built in</span>{% endif %}</td>
|
||||
<td>{{ role.kind }}</td>
|
||||
<td>{% if role.parent.is_empty() %}<span class="hint">—</span>{% else %}{{ role.parent }}{% endif %}</td>
|
||||
<td>{% match role.users %}{% when Some with (count) %}{{ count }}{% when None %}<span class="hint">—</span>{% endmatch %}</td>
|
||||
<td>
|
||||
{% if role.editable %}
|
||||
<a class="link-action" href="/permissions/grants?role={{ role.name }}">Edit access</a>
|
||||
{% else %}
|
||||
<span class="hint">outranks you</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
<td>
|
||||
{% if role.removable() %}
|
||||
<form hx-post="/permissions/roles/remove" hx-target="#permission-status">
|
||||
<input type="hidden" name="role" value="{{ role.name }}">
|
||||
<button type="submit" class="danger">Remove</button>
|
||||
</form>
|
||||
{% else %}
|
||||
<span class="hint">{{ role.keeps_reason() }}</span>
|
||||
{% endif %}
|
||||
</td>
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<div id="permission-status" aria-live="polite"></div>
|
||||
</main>
|
||||
{% endblock %}
|
||||
26
web/templates/pages/permissions/tabs.html
Normal file
26
web/templates/pages/permissions/tabs.html
Normal file
@@ -0,0 +1,26 @@
|
||||
{#
|
||||
The section switcher shared by the three permission pages. Every one of them
|
||||
carries a `page.tabs` (crate::pages::permissions::common::state::Tabs), which
|
||||
says which section is open and which the signed-in role may open at all.
|
||||
|
||||
The three are deliberately separate pages: making a role, handing it to
|
||||
someone, and deciding what it may do are three different decisions, and doing
|
||||
them on one screen was what made the old page hard to read.
|
||||
#}
|
||||
<nav class="tabs" aria-label="permission sections">
|
||||
{% if page.tabs.can_manage_roles %}
|
||||
<a href="/permissions/roles" class="tab {% if page.tabs.is("roles") %}selected{% endif %}" {% if page.tabs.is("roles") %}aria-current="page"{% endif %}>
|
||||
<span>Roles</span><small>Create roles and their inheritance</small>
|
||||
</a>
|
||||
{% endif %}
|
||||
{% if page.tabs.can_manage_users %}
|
||||
<a href="/permissions/users" class="tab {% if page.tabs.is("users") %}selected{% endif %}" {% if page.tabs.is("users") %}aria-current="page"{% endif %}>
|
||||
<span>People</span><small>Give a user a role</small>
|
||||
</a>
|
||||
{% endif %}
|
||||
{% if page.tabs.can_manage_roles %}
|
||||
<a href="/permissions/grants" class="tab {% if page.tabs.is("grants") %}selected{% endif %}" {% if page.tabs.is("grants") %}aria-current="page"{% endif %}>
|
||||
<span>Access</span><small>What a role may do</small>
|
||||
</a>
|
||||
{% endif %}
|
||||
</nav>
|
||||
64
web/templates/pages/permissions/users/users.html
Normal file
64
web/templates/pages/permissions/users/users.html
Normal file
@@ -0,0 +1,64 @@
|
||||
{# GET /permissions/users — crate::pages::permissions::users::ui::UsersTemplate #}
|
||||
{% extends "ui/base.html" %}
|
||||
|
||||
{% block title %}People{% endblock %}
|
||||
|
||||
{% block content %}
|
||||
<main>
|
||||
<section class="heading">
|
||||
<div>
|
||||
<p class="eyebrow">Permissions</p>
|
||||
<h1>People</h1>
|
||||
<p>Give a user a role. What that role may do is decided once, on the Access tab.</p>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
{% include "pages/permissions/tabs.html" %}
|
||||
|
||||
{% if page.updated %}<p class="notice">Updated. The person's next request uses the new role; they do not have to sign in again.</p>{% endif %}
|
||||
|
||||
<section class="panel">
|
||||
<h2>Users<span class="count">{{ page.users.len() }}</span></h2>
|
||||
<p class="hint">
|
||||
You can only change someone whose role you outrank — {{ page.editable_users() }} of {{ page.users.len() }} here.
|
||||
</p>
|
||||
<div class="table-scroll">
|
||||
<table class="builder-table">
|
||||
<thead><tr><th>User</th><th>Email</th><th>Role</th><th>Change role</th><th>Reset password</th></tr></thead>
|
||||
<tbody>
|
||||
{% for user in page.users %}
|
||||
<tr>
|
||||
<td>{{ user.username }}</td>
|
||||
<td>{% if user.email.is_empty() %}<span class="hint">—</span>{% else %}{{ user.email }}{% endif %}</td>
|
||||
<td>{{ user.role }}</td>
|
||||
{% if user.editable %}
|
||||
<td>
|
||||
<form hx-post="/permissions/users/role" hx-target="#permission-status" class="actions">
|
||||
<input type="hidden" name="username" value="{{ user.username }}">
|
||||
<select name="role">
|
||||
{% for role in page.roles %}<option value="{{ role }}" {% if user.role == role.as_str() %}selected{% endif %}>{{ role }}</option>{% endfor %}
|
||||
</select>
|
||||
<button type="submit">Assign</button>
|
||||
</form>
|
||||
</td>
|
||||
<td>
|
||||
<form hx-post="/permissions/users/password" hx-target="#permission-status" class="actions">
|
||||
<input type="hidden" name="username" value="{{ user.username }}">
|
||||
<input name="new_password" type="password" autocomplete="new-password" placeholder="New password" required>
|
||||
<input name="new_password_confirmation" type="password" autocomplete="new-password" placeholder="Confirm" required>
|
||||
<button type="submit">Reset</button>
|
||||
</form>
|
||||
</td>
|
||||
{% else %}
|
||||
<td colspan="2"><span class="hint">outranks you</span></td>
|
||||
{% endif %}
|
||||
</tr>
|
||||
{% endfor %}
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
</section>
|
||||
|
||||
<div id="permission-status" aria-live="polite"></div>
|
||||
</main>
|
||||
{% endblock %}
|
||||
Reference in New Issue
Block a user