{% extends '../layout/admin.html' %}

{% block html_title %}{{ t('Security settings') }} · {% endblock %}

{% block content_header %}
<div class="header-wrap">
  <header id="page-header">
    <h1 class="title" id="">{{ t('Security settings') }}</h1>
  </header>
</div>
{% endblock %}

{% block content_main %}
<div class="content-main admin-security">
  <div class="row">
    <div class="col-md-3">
      {% include './widget/menu.html' with {current: 'security'} %}
    </div>
    <div class="col-md-9">

      {% set smessage = req.flash('successMessage') %}
      {% if smessage.length %}
      <div class="alert alert-success">
        {% for e in smessage %}
          {{ e }}<br>
        {% endfor %}
      </div>
      {% endif %}

      {% set emessage = req.flash('errorMessage') %}
      {% if emessage.length %}
      <div class="alert alert-danger">
        {% for e in emessage %}
        {{ e }}<br>
        {% endfor %}
      </div>
      {% endif %}

      <form action="/_api/admin/security/general" method="post" class="form-horizontal" id="generalSetting" role="form">
        <fieldset>
        <legend class="alert-anchor">{{ t('security_setting.Security settings') }}</legend>

          <div class="form-group">
            <label for="settingForm[security:registrationMode]" class="col-xs-3 control-label">{{ t('Basic authentication') }}</label>
            <div class="col-xs-3">
              <label for="">ID</label>
              <input class="form-control" type="text" name="settingForm[security:basicName]"   value="{{ settingForm['security:basicName']|default('') }}">
            </div>
            <div class="col-xs-3">
              <label for="">{{ t('Password') }}</label>
              <input class="form-control" type="text" name="settingForm[security:basicSecret]" value="{{ settingForm['security:basicSecret']|default('') }}">
            </div>
            <div class="col-xs-offset-3 col-xs-9">
              <p class="help-block">
                {{ t("security_setting.common_authentication") }}<br>
                {{ t("security_setting.without_encryption") }}<br>
              </p>
            </div>
          </div>

          <div class="form-group">
            <label for="settingForm[security:restrictGuestMode]" class="col-xs-3 control-label">{{ t('Guest users access') }}</label>
            <div class="col-xs-6">
              <select class="form-control selectpicker" name="settingForm[security:restrictGuestMode]" value="{{ settingForm['security:restrictGuestMode'] }}">
                {% for modeValue, modeLabel in consts.restrictGuestMode %}
                <option value="{{ modeValue }}" {% if modeValue == settingForm['security:restrictGuestMode'] %}selected{% endif %} >{{ modeLabel }}</option>
                {% endfor %}
              </select>
            </div>
          </div>

          <div class="form-group">
            <label for="settingForm[security:registrationMode]" class="col-xs-3 control-label">{{ t('Register limitation') }}</label>
            <div class="col-xs-6">
              <select class="form-control selectpicker" name="settingForm[security:registrationMode]" value="{{ settingForm['security:registrationMode'] }}">
                {% for modeValue, modeLabel in consts.registrationMode %}
                <option value="{{ modeValue }}" {% if modeValue == settingForm['security:registrationMode'] %}selected{% endif %} >{{ modeLabel }}</option>
                {% endfor %}
              </select>
              <p class="help-block">{{ t('The contents entered here will be shown in the header etc') }}</p>
            </div>
          </div>

          <div class="form-group">
            <label for="settingForm[security:registrationWhiteList]" class="col-xs-3 control-label">{{ t('The whitelist of registration permission E-mail address') }}</label>
            <div class="col-xs-8">
              <textarea class="form-control" type="textarea" name="settingForm[security:registrationWhiteList]" placeholder="例: @crowi.wiki">{{ settingForm['security:registrationWhiteList']|join('&#13')|raw }}</textarea>
              <p class="help-block">{{ t("security_setting.restrict_emails") }}{{ t("security_setting.for_instance") }}<code>@crowi.wiki</code>{{ t("security_setting.only_those") }}<br>
              {{ t("security_setting.insert_single") }}</p>
            </div>
          </div>

          <div class="form-group">
            <div class="col-xs-offset-3 col-xs-6">
              <input type="hidden" name="_csrf" value="{{ csrf() }}">
              <button type="submit" class="btn btn-primary">{{ t('Update') }}</button>
            </div>
          </div>

        </fieldset>
      </form>

      <form action="/_api/admin/security/mechanism" method="post" class="form-horizontal m-t-30" id="mechanismSetting" role="form">
        <fieldset>
          <legend class="alert-anchor">{{ t('Selecting authentication mechanism') }}</legend>
          <p class="alert alert-info"><b>NOTE: </b>Restarting the server is needed if you switch the auth mechanism.</p>
          <div class="form-group">
            <div class="col-xs-6">
              <h4>
                <input type="radio" name="settingForm[security:isEnabledPassport]" value="false"
                    {% if !settingForm['security:isEnabledPassport'] %}checked="checked"{% endif %}>
                Official Crowi authentication mechanism
              </h4>
              <ul>
                <li>Username, E-mail and Password authentication</li>
                <li>Google OAuth2 authentication</li>
              </ul>
            </div>
            <div class="col-xs-6">
              <h4>
                <input type="radio" name="settingForm[security:isEnabledPassport]" value="true"
                    {% if true === settingForm['security:isEnabledPassport'] %}checked="checked"{% endif %}>
                <a href="http://passportjs.org/">
                  <img src="/images/admin/security/passport-logo.svg" class="passport-logo"> Passport
                </a> authentication mechanism <small class="text-success">(Recommended)</small>
              </h4>
              <ul>
                <li>Username, E-mail and Password authentication</li>
                <li>LDAP authentication</li>
                <li class="text-muted">(TBD) <del>Google OAuth2 authentication</del></li>
                <li class="text-muted">(TBD) <del>Facebook OAuth2 authentication</del></li>
                <li class="text-muted">(TBD) <del>Twitter OAuth authentication</del></li>
                <li class="text-muted">(TBD) <del>Github OAuth2 authentication</del></li>
              </ul>
            </div>
          </div>

          <div class="form-group">
            <div class="col-xs-offset-5 col-xs-6">
              <input type="hidden" name="_csrf" value="{{ csrf() }}">
              <button type="submit" class="btn btn-primary">{{ t('Update') }}</button>
            </div>
          </div>
        </fieldset>
      </form>


      <div class="auth-mechanism-configurations m-t-10">

        <legend>{{ t('security_setting.Authentication mechanism settings') }}</legend>

        {% set isOfficialConfigurationVisible = !isEnabledPassport() %}
        <div class="official-crowi-auth-settings" {% if !isOfficialConfigurationVisible %}style="display: none;"{% endif %}>
          {% set isRestartingServerNeeded = isPassportLocalStrategySetup() %}
          <p class="alert alert-warning"
              {% if !isRestartingServerNeeded %}style="display: none;"{% endif %}>
            <b>
              <i class="icon-exclamation" aria-hidden="true"></i>
              Restarting the server is needed.
            </b>
            The server is running with Passport authentication mechanism.
          </p>

          <form action="/_api/admin/security/google" method="post" class="form-horizontal" id="googleSetting" role="form"
              {% if isRestartingServerNeeded %}style="opacity: 0.4;"{% endif %}>

            <fieldset>
              <h4>Google 設定</h4>
              <p class="well alert-anchor">
                Google Cloud Platform の <a href="https://console.cloud.google.com/apis/credentials">API Manager</a>
                から OAuth2 Client ID を作成すると、Google アカウントにコネクトして登録やログインが可能になります。
              </p>

              <ol class="help-block">
                <li><a href="https://console.cloud.google.com/apis/credentials">API Manager</a> へアクセス</li>
                <li>プロジェクトを作成していない場合は作成してください</li>
                <li>「認証情報を作成」-> OAuthクライアントID</li>
                <ol>
                  <li>「ウェブアプリケーション」を選択</li>
                  <li>承認済みのリダイレクトURLに、 <code>https://${crowi.host}/google/callback</code> を入力<br>
                  (<code>${crowi.host}</code>は環境に合わせて変更してください)</li>
                </ol>
              </ol>

              <div class="form-group">
                <label for="settingForm[google:clientId]" class="col-xs-3 control-label">Client ID</label>
                <div class="col-xs-6">
                  <input class="form-control" type="text" name="settingForm[google:clientId]" value="{{ settingForm['google:clientId'] }}">
                </div>
              </div>

              <div class="form-group">
                <label for="settingForm[google:clientSecret]" class="col-xs-3 control-label">Client Secret</label>
                <div class="col-xs-6">
                  <input class="form-control" type="text" name="settingForm[google:clientSecret]" value="{{ settingForm['google:clientSecret'] }}">
                </div>
              </div>

              <div class="form-group">
                <div class="col-xs-offset-3 col-xs-6">
                  <input type="hidden" name="_csrf" value="{{ csrf() }}">
                  <button type="submit" class="btn btn-primary">{{ t('Update') }}</button>
                </div>
              </div>

            </fieldset>
          </form>
        </div>

        {#
         # passport settings nav
         #}
        {% set isPassportConfigurationVisible = settingForm['security:isEnabledPassport'] %}
        <div class="passport-settings" {% if !isPassportConfigurationVisible %}style="display: none;"{% endif %}>

          {% set isRestartingServerNeeded = !isPassportLocalStrategySetup() %}
          <p class="alert alert-warning"
              {% if !isRestartingServerNeeded %}style="display: none;"{% endif %}>
            <b>
              <i class="icon-exclamation" aria-hidden="true"></i>
              Restarting the server is needed.
            </b>
            The server is running with Official Crowi authentication mechanism.
          </p>
          <ul class="nav nav-tabs" role="tablist" {% if isRestartingServerNeeded %}style="opacity: 0.4;"{% endif %}>
            <li class="active">
              <a href="#passport-ldap" data-toggle="tab" role="tab"><i class="icon-organization"></i> LDAP</a>
            </li>
            <li>
              <a href="#passport-google-oauth" data-toggle="tab" role="tab"><i class="icon-social-google"></i> Google OAuth</a>
            </li>
            <li>
              <a href="#passport-facebook" data-toggle="tab" role="tab"><i class="icon-social-facebook"></i> Facebook</a>
            </li>
            <li>
              <a href="#passport-twitter" data-toggle="tab" role="tab"><i class="icon-social-twitter"></i> Twitter</a>
            </li>
            <li>
              <a href="#passport-github" data-toggle="tab" role="tab"><i class="icon-social-github"></i> Github</a>
            </li>
          </ul>

          <div class="tab-content p-t-10" {% if isRestartingServerNeeded %}style="opacity: 0.4;"{% endif %}>
            <div id="passport-ldap" class="tab-pane active" role="tabpanel" >
              {% include './widget/passport/ldap.html' with { settingForm: settingForm } %}
            </div>

            <div id="passport-google-oauth" class="tab-pane" role="tabpanel">
              {% include './widget/passport/google-oauth.html' %}
            </div>

            <div id="passport-facebook" class="tab-pane" role="tabpanel">
              {% include './widget/passport/facebook.html' %}
            </div>

            <div id="passport-twitter" class="tab-pane" role="tabpanel">
              {% include './widget/passport/twitter.html' %}
            </div>

            <div id="passport-github" class="tab-pane" role="tabpanel">
              {% include './widget/passport/github.html' %}
            </div>

          </div><!-- /.tab-content -->
        </div>

      </div><!-- /.auth-mechanism-configurations -->

    </div>
  </div>

  <script>
    $('#generalSetting, #googleSetting, #mechanismSetting').each(function() {
      $(this).submit(function()
      {
        function showMessage(formId, msg, status) {
          $('#' + formId + ' > .alert').remove();

          if (!status) {
            status = 'success';
          }
          var $message = $('<p class="alert"></p>');
          $message.addClass('alert-' + status);
          $message.html(msg.replace('\n', '<br>'));
          $message.insertAfter('#' + formId + ' .alert-anchor');

          if (status == 'success') {
            setTimeout(function()
            {
              $message.fadeOut({
                complete: function() {
                  $message.remove();
                }
              });
            }, 5000);
          }
        }

        var $form = $(this);
        var $id = $form.attr('id');
        var $button = $('button', this);
        $button.attr('disabled', 'disabled');
        var jqxhr = $.post($form.attr('action'), $form.serialize(), function(data)
          {
            if (data.status) {
              showMessage($id, '更新しました');
            } else {
              showMessage($id, data.message, 'danger');
            }
          })
          .fail(function() {
            showMessage($id, 'エラーが発生しました', 'danger');
          })
          .always(function() {
            $button.prop('disabled', false);
        });
        return false;
      });
    });

    // switch display according to on / off of radio buttons
    $('input[name="settingForm[security:isEnabledPassport]"]:radio').change(function() {
      const isEnabledPassport = ($(this).val() === "true");

      if (isEnabledPassport) {
        $('.official-crowi-auth-settings').hide(400);
        $('.passport-settings').show(400);
      }
      else {
        $('.official-crowi-auth-settings').show(400);
        $('.passport-settings').hide(400);
      }
    });
  </script>
</div>
{% endblock content_main %}

{% block content_footer %}
{% endblock content_footer %}