<!DOCTYPE html>
<html lang="en">
<head>
	<meta charset="utf-8" />
	<title>Igor Capabilities</title>
	<style>
	table, th, td {
		border: 1px solid black;
		border-collapse: collapse;
	}
	</style>
</head>
<body>

	{% if action == 'list' or not action %}
		<h1>Igor Capabilities</h1>

		{% if not igor.internal.accessControl('hasCapabilitySupport') %}
			<p>This Igor runs without capability support. It is unlikely you see anything interesting here.</p>
		{% endif %}
	
		{% if igor.app.getSessionItem('user', None) %}
			<p>
				You are logged in as {{igor.app.getSessionItem('user')}}.
				{% if cid == None %}
					Here is the list of all capabilities assigned to your user identity.
				{% else %}
					Here is the information on capability {{cid}}.
				{% endif %}
			</p>
		{% else %}
			<p>
				You are not logged in.
				{% if cid == None %}
					Here is the set of default capabilities you have access to.
				{% else %}
					Here is the information on capability {{cid}}.
				{% endif %}
			</p>
		{% endif %}
		
		<table style="width:100%">
			<tr>
				<th>ID</th>
				<th>Object</th>
				<th>GET<br>PUT<br>POST<br>DELETE</th>
				<th>Parent</th>
				<th>Children</th>
				<th>OP</th>
				<th>...</th>
			</tr>
		
			{% set capList = igor.internal.accessControl(subcommand='getTokenDescription', token=token, tokenId=cid) %}
			{% for cap in capList %}
				{% set cid = cap.pop('cid', '') %}
				{% set comment = cap.pop('comment', '') %}
				{% set childIDs = cap.pop('child', []) %}
				{% set childIDs = [childIDs] if type(childIDs) != type([]) else childIDs %}
				<tr>
					<td>{{cid}}
					{% if comment %}
						<br><i>({{comment}}</i>)
					{% endif %}
					</td>
					<td>{{cap.pop('obj', '')}}</td>
					<td align="center">
						{{cap.pop('get', '-')}}<br>
						{{cap.pop('put', '-')}}<br>
						{{cap.pop('post', '-')}}<br>
						{{cap.pop('delete', '-')}}
					</td>
					<td>{{cap.pop('parent', '')}}</td>
					<td>
						{% for c in childIDs %}
							<a href="/capabilities.html?action=list&cid={{c}}">{{c}}</a>
							<a href="/capabilities.html?action=revoke&cid={{cid}}&childCid={{c}}">(revoke)</a>
							<br>
						{% endfor %}
					</td>
					<td>
						{% if cap.pop('owner', '') %}
							<a href="/capabilities.html?action=transfer&cid={{cid}}">transfer</a>
						{% endif %}
						{% set delegate = cap.pop('delegate', '') %}
						{% if delegate %}
							<br>
							<a href="/capabilities.html?action=delegate&cid={{cid}}">delegate</a>
							{% if delegate == 'external' %}
								<i>(ext)</i>
							{% endif %}
							<br>
							<a href="/capabilities.html?action=export&cid={{cid}}">export</a>
						{% endif %}
						{% if 'iss' in cap and 'aud' in cap %}
							<br>
							<a href="/internal/accessControl/externalRepresentation?tokenId={{cid}}">external repr</a>
						{% endif %}
					</td>
					<td>
						{% for k,v in cap.items() %}
							{{k}}={{v}}<br>
						{% endfor %}
					</td>
				</tr>
			{% endfor %}
		</table>
		<hr>
		<p><a href="/capabilities.html?action=listKeys">View shared key listing</a></p>
	{% elif action == "delegate" %}
		<h1>Delegate capability {{cid}}</h1>
		
		{% set cap = igor.internal.accessControl(subcommand='getTokenDescription', token=token, tokenId=cid)[0] %}
		
		<form action="/internal/accessControl/newToken">
			<input name="returnTo" type="hidden" value="/capabilities.html">
			<table>
				<tr>
					<th>Field</th>
					<th>New</th>
					<th>Old</th>
				</tr>
				<input name="tokenId" type="hidden" value="{{cid}}">
				<tr>
					<td>Owner</td>
					<td><input name="newOwner" type="text" value="/data/identities/EDIT"></td>
					<td>...</td>
				</tr>
				<tr>
					<td>Path</td>
					<td><input name="newPath" type="text" value="{{cap.get('obj','')}}"></td>
					<td>{{cap.get('obj','')}}</td>
				</tr>
				<tr>
					<td>Can Delegate</td>
					<td>
						{% if cap.get('delegate') %}
							<input name="delegate" type="checkbox" value="true" checked>
						{% endif %}
					</td>
					<td>{{'yes' if cap.get('delegate') else 'no'}}</td>
				</tr>			
				{% for right in ['get', 'put', 'post', 'delete'] %}
					<tr>
						<td>{{right}}</td>
						{% set disabled = '' if cap.get(right, None) else ' disabled' %}
						<td>
							<select name="{{right}}" {{disabled}}>
								{% set selected = ' selected' if not cap.get(right) else '' %}
								<option value="" {{selected}}>No access</option>
								{% set selected = ' selected' if cap.get(right) == 'self' else '' %}
								<option value="self" {{selected}}>self</option>
								{% set selected = ' selected' if cap.get(right) == 'descendant-or-self' else '' %}
								<option value="descendant-or-self" {{selected}}>descendant-or-self</option>
								{% set selected = ' selected' if cap.get(right) == 'descendant' else '' %}
								<option value="descendant" {{selected}}>descendant</option>
								{% set selected = ' selected' if cap.get(right) == 'child' else '' %}
								<option value="child" {{selected}}>child</option>
							</select>
						</td>
						<td>{{cap.get(right, 'no access')}}</td>
					</tr>
				{% endfor %}
				<tr>
					<td>Comment</td>
					<td><input name="comment" type="text"></td>
					<td>{{cap.get('comment', '')}}</td>
				</tr>
				<tr>
					<td></td>
					<td><input type="submit" value="Delegate"></td>
					<td></td>
				</tr>
			</table>
		</form>
		
		<hr>
	{% elif action == "create" %}
		<p>Cannot do yet. Should create {{repr(kwargs)}}.</p>
		<form action="/internal/accessControl/newToken">
			<input name="returnTo" type="hidden" value="{{kwargs.get('returnTo', '/capabilities.html')}}">
			<table>
				<tr>
					<th>Field</th>
					<th>Value</th>
				</tr>
				<tr>
					<td>Delegate from</td>
					<td>
						<select name="tokenId">
							{% for cid in kwargs.get('parentList', '').split('/') %}
								<option value="{{cid}}">{{cid}}</option>
							{% endfor %}
						</select>
					</td>
				</tr>
				<tr>
					<td>New owner</td>
					<td><input name="newOwner" type="text" value="{{kwargs.get('newOwner','')}}"></td>
				</tr>
				<tr>
					<td>Path</td>
					<td><input name="newPath" type="text" value="{{kwargs.get('obj','')}}"></td>
				</tr>
				{% if 'aud' in kwargs %}
					<tr>
						<td>Audience</td>
						<td><input name="aud" type="text" value="{{kwargs.get('aud', '')}}"></td>
					</tr>
				{% endif %}
				<tr>
					<td>Can Delegate</td>
					<td>
						{% if kwargs.get('delegate') %}
							<input name="delegate" type="checkbox" value="true" checked>
						{% endif %}
					</td>
				</tr>			
				{% for right in ['get', 'put', 'post', 'delete'] %}
					<tr>
						<td>{{right}}</td>
						{% set rightValue = kwargs.get(right, '') %}
						<td>
							<select name="{{right}}">
								{% set selected = ' selected' if not rightValue else '' %}
								<option value="" {{selected}}>No access</option>
								{% set selected = ' selected' if rightValue == 'self' else '' %}
								<option value="self" {{selected}}>self</option>
								{% set selected = ' selected' if rightValue == 'descendant-or-self' else '' %}
								<option value="descendant-or-self" {{selected}}>descendant-or-self</option>
								{% set selected = ' selected' if rightValue == 'descendant' else '' %}
								<option value="descendant" {{selected}}>descendant</option>
								{% set selected = ' selected' if rightValue == 'child' else '' %}
								<option value="child" {{selected}}>child</option>
							</select>
						</td>
					</tr>
				{% endfor %}
				<tr>
					<td>Comment</td>
					<td><input name="comment" type="text"></td>
				</tr>
				<tr>
					<td></td>
					<td><input type="submit" value="Delegate"></td>
					<td></td>
				</tr>
			</table>
		</form>		

		<hr>
	{% elif action == "transfer" %}
		<h1>Delegate capability {{cid}}</h1>
		
		{% set cap = igor.internal.accessControl(subcommand='getTokenDescription', token=token, tokenId=cid)[0] %}
		
		<form action="/internal/accessControl/passToken">
			<input name="returnTo" type="hidden" value="/capabilities.html">
			<table>
				<tr>
					<th>Field</th>
					<th>New</th>
					<th>Old</th>
				</tr>
				<input name="tokenId" type="hidden" value="{{cid}}">
				<tr>
					<td>Owner</td>
					<td><input name="newOwner" type="text" value="/data/identities/EDIT"></td>
					<td>...</td>
				</tr>
				<tr>
					<td>Path</td>
					<td>{{cap['obj']}}</td>
					<td>{{cap['obj']}}</td>
				</tr>				
				{% for right in ['get', 'put', 'post', 'delete'] %}
					<tr>
						<td>{{right}}</td>
						<td>{{cap.get(right, 'no access')}}</td>
						<td>{{cap.get(right, 'no access')}}</td>
					</tr>
				{% endfor %}
				<tr>
					<td>Comment</td>
					<td>{{cap.get('comment', '')}}</td>
					<td>{{cap.get('comment', '')}}</td>
				</tr>
				<tr>
					<td></td>
					<td><input type="submit" value="Transfer"></td>
					<td></td>
				</tr>
			</table>
		</form>

		<hr>
	{% elif action == "export" %}
		<h1>Export capability {{cid}}</h1>
		
		{% set cap = igor.internal.accessControl(subcommand='getTokenDescription', token=token, tokenId=cid)[0] %}
		{% set _ = cap.pop('owner', None) %}
		{% set _ = cap.pop('parent', None) %}
		{% set _ = cap.pop('delegate', None) %}
		
		<form action="/internal/accessControl/exportToken">
			<input name="returnTo" type="hidden" value="/capabilities.html">
			<table>
				<tr>
					<th>Field</th>
					<th>Value</th>
				</tr>
				<input name="tokenId" type="hidden" value="{{cap.pop('cid')}}">
				<tr>
					<td>Audience</td>
					<td><input name="aud" value="{{cap.pop('aud','')}}" readonly></td>
				</tr>
				<tr>
					<td>Object</td>
					<td>{{cap.pop('obj')}}</td>
				</tr>

				{% for right in ['get', 'put', 'post', 'delete'] %}
					{% set rvalue = cap.pop(right, None) %}
					<tr>
						<td>{{right}}</td>
						{% set disabled = '' if rvalue else ' disabled' %}
						<td>
							<select name="{{right}}" {{disabled}}>
								{% set selected = ' selected' if not rvalue else '' %}
								<option value="" {{selected}}>No access</option>
								{% set selected = ' selected' if rvalue == 'self' else '' %}
								<option value="self" {{selected}}>self</option>
								{% set selected = ' selected' if rvalue == 'descendant-or-self' else '' %}
								<option value="descendant-or-self" {{selected}}>descendant-or-self</option>
								{% set selected = ' selected' if rvalue == 'descendant' else '' %}
								<option value="descendant" {{selected}}>descendant</option>
								{% set selected = ' selected' if rvalue == 'child' else '' %}
								<option value="child" {{selected}}>child</option>
							</select>
						</td>
					</tr>
				{% endfor %}
				<tr>
					<td>Subject</td>
					<td>
						{% set subjectList = igor.internal.accessControl(subcommand='getSubjectList') %}
						{% if subjectList %}
							<select name="subject">
							<option value="">- (also use for Igor)</option>
							{% for sub in subjectList %}
								<option value="{{sub}}">{{sub}}</option>
							{% endfor %}
							</select>
						{% else %}
							<input name="subject" type="text" value="">
						{% endif %}
					</td>
				</tr>
				<tr>
					<td>Lifetime (seconds)</td>
					<td><input name="lifetime" type="text" value=""></td>
				</tr>
				{% for k,v in cap.items() %}
					<tr>
						<td>{{k}}</td>
						<td><input name="{{k}}" value="{{v}}" readonly></td>
					</tr>
				{% endfor %}
				<tr>
					<td>Comment</td>
					<td><input name="comment" value="{{cap.get('comment', '')}}" type="text"></td>
				</tr>
				<tr>
					<td colspan="2"><input type="submit" value="Export"></td>
				</tr>
			</table>
		</form>

		<hr>
	{% elif action == "revoke" %}
		<h1>Revoke capability {{childCid}}</h1>
		
		{% set cap = igor.internal.accessControl(subcommand='getTokenDescription', token=token, tokenId=childCid)[0] %}
		
		<form action="/internal/accessControl/revokeToken">
			<input name="returnTo" type="hidden" value="/capabilities.html">
			<table>
				<tr>
					<th>Field</th>
					<th>Value</th>
				</tr>
				<input name="parentId" type="hidden" value="{{cid}}">
				<input name="tokenId" type="hidden" value="{{childCid}}">
				<tr>
					<td>ID</td>
					<td>{{childCid}}</td>
				</tr>				
				<tr>
					<td>Parent</td>
					<td>{{cid}}</td>
				</tr>				
				{% for right in ['get', 'put', 'post', 'delete'] %}
					<tr>
						<td>{{right}}</td>
						<td>{{cap.pop(right, 'no access')}}</td>
					</tr>
				{% endfor %}
				<tr>
					<td>Comment</td>
					<td>{{cap.pop('comment', '')}}</td>
				</tr>
				<tr>
					<td>Children</td>
					<td>
						{% set  childIDs = cap.pop('child', []) %}
						{% set childIDs = [childIDs] if type(childIDs) != [] else childIDs %}
						{% for gcid in childIDs %}
							{{gcid}}
							<br>
						{% endfor %}
					</td>
				</tr>
				{% for k, v in cap.items() %}
					<tr>
						<td>{{k}}</td>
						<td>{{v}}</td>
					</tr>
				{% endfor %}
				<tr>
					<td></td>
					<td><input type="submit" value="Revoke"></td>
				</tr>
			</table>
		</form>
		
		<hr>
	{% elif action == "listKeys" %}
		<h1>Shared secret keys issued by this Igor</h1>
		
		{% set keys = igor.internal.accessControl(subcommand='getKeyList', token=token) %}
		<table>
			<tr>
				<th>Issuer</th>
				<th>Subject</th>
				<th>Audience</th>
				<th>...</th>
				<th>Action:</th>
			</tr>
			{% for key in keys %}
				{% set iss = key.pop('iss') %}
				{% set sub = key.pop('sub', '') %}
				{% set aud = key.pop('aud', '') %}
				<tr>
					<td>{{iss}}</td>
					<td>{{sub}}</td>
					<td>{{aud}}</td>
					<td>
						{% for k, v in key.items() %}
							{{k}}={{v}}
						{% endfor %}
					</td>
					<td><a href="capabilities.html?action=deleteKey&iss={{iss}}&sub={{sub}}&aud={{aud}}">delete</a></td>
				</tr>
			{% endfor %}
		</table>

		<hr>
		<p><a href="/capabilities.html?action=addKey">Add a new secret key</a></p>
		<p><a href="/capabilities.html?action=listKeys">Return to secret key listing</a></p>
	{% elif action == "addKey" %}
		<h1>Issue new shared key</h1>

		<p>Createing a secret key here will return the verbatim secret key, this will be done <b>only once</b>, after that the secret
		key is, well, secret... Copy the key to your subject or audience device and clear your browser history.</p>
		
		<form action="/internal/accessControl/createSharedKey">
			Audience (agent trusting the key, empty for Igor):<input type="url" name="aud"><br>
			Subject (agent carrying the key, empty for Igor):<input ltype="url" name="sub"><br>
			<input type="submit" value="Create">
		</form>		

		<hr>
		<p><a href="/capabilities.html?action=listKeys">Return to secret key listing</a></p>
	{% elif action == "deleteKey" %}
		<h1>Delete old shared key</h1>
		
		<form action="/internal/accessControl/deleteSharedKey">
			<input name="returnTo" type="hidden" value="/capabilities.html?action=listKeys">
			<input type="hidden" name="iss" value="{{kwargs.get('iss', '')}}">
			<input type="hidden" name="aud" value="{{kwargs.get('aud', '')}}">
			<input type="hidden" name="sub" value="{{kwargs.get('sub', '')}}">
			<table>
				<tr>
					<th>Item</>
					<th>Value</>
				</tr>
				{% for k, v in kwargs.items() %}
					<tr>
						<td>{{k}}</td>
						<td>{{v}}</td>
					</tr>
				{% endfor %}
				<tr>
					<td colspan="2"><input type="submit" value="Delete"></td>
				</tr>
			</table>
		</form>

		<hr>
		<p><a href="/capabilities.html?action=listKeys">Return to secret key listing</a></p>
	{% endif %}
	{% if action != 'list' or cid != None %}
		<p><a href="/capabilities.html">Return to capability listing</a></p>
	{% endif %}

	<p><a href="/">Return to Igor homepage</a></p>
	{% if 'returnTo' in kwargs %}
		<p><a href="{{kwargs['returnTo']}}">Return to {{kwargs['returnTo']}}.</a></p>
	{% endif %}
</body>
</html>
