---
include:
  - nav.yml
---
metadata:
  title: Manage users
  sessions are unique: True
  required privileges:
    - admin
    - al_manage_users
  temporary session: True
---
modules:
  - .aldashboard
  - .create_package
---
mandatory: True
id: interview order
code: |
  chosen_user
  if user_task == 'reset_password':
    do_update_password
  elif user_task == 'elevate_permissions':
    do_update_privileges
  elif user_task == 'download_playground':
    do_download_playground
  ending_screen    
---
code: |
  user_lookup = {}
  for user in get_users_and_name():
    user_lookup[user[0]] = user[3]
---
id: select user
question: |
  Manage users
subquestion: |
  % if not user_has_privilege(["admin"]):
  **Note**: make sure the role `al_manage_users` any of the the following desired [permissions](https://docassemble.org/docs/config.html#permissions)
  in the global configuration:

  ```
  permissions:
    al_manage_users:
      - access_user_info
      - edit_user_active_status
      - edit_user_password
      - delete_user
      - edit_sessions
      - access_sessions
      - access_privileges 
      - edit_user_privileges
  ```
  % endif
fields:
  - User: chosen_user
    datatype: integer
    input type: combobox
    code: |
      [{user[0]: f"{user[1]} {user[2]} {user[3]}"} for user in get_users_and_name()]
    exclude:
      - "2"
    # User ID 2 is the "cron" user and should not be managed here        
  - What do you want to do?: user_task
    datatype: radio
    choices:
      - Reset password: reset_password
      - Download playground files: download_playground
      - Change user permissions: elevate_permissions      
  - New password: new_user_password
    datatype: password
    show if:
      variable: user_task
      is: reset_password
    validate: valid_password      
  - Verify new password: new_user_password_2
    datatype: password
    show if:
      variable: user_task
      is: reset_password
    validate: valid_password      
  - New permissions: new_permission_level
    datatype: multiselect
    code: |
      manage_privileges('list')
    exclude: |
      'cron'
    show if:
      variable: user_task
      is: elevate_permissions
    help: |
      The user's permissions will be completely reset to match the new
      list of permissions. Use "ctrl" to select multiple.
validation code: |
  if user_task == 'reset_password' and new_user_password != new_user_password_2:
    validation_error("The passwords do not match", field="new_user_password_2")
---
code: |
  set_user_info(user_id=chosen_user, password=new_user_password)
  do_update_password = True
---
code: |
  set_user_info(user_id=chosen_user, privileges=new_permission_level.true_values().elements )
  do_update_privileges = True
---
id: download playground
question: |
  Playground download for ${ user_lookup[chosen_user] }
subquestion: |
  % for project in get_list_of_projects(chosen_user) + ['default']:
  [${project}]( ${ create_user_playground_zip(chosen_user, space_to_underscore(user_lookup[chosen_user]), project).url_for() })
  % endfor
event: do_download_playground
---
code: |
  def valid_password(pword):
    if not re.match(r"^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)[a-zA-Z\d!@#$%^&*()_+\-=\[\]{};:\'\"\\|,.<>\/?]{6,}$", pword):
      validation_error(word("Password must have at least 6 characters with one lowercase letter, one uppercase letter and one number"))
    return True      
---
event: ending_screen
question: |
  Task is done
subquestion: |
  % if user_task == 'elevate_permissions':
  `${ new_permission_level.true_values().elements }`
  % endif
buttons:
  - Restart: restart
  