{% extends "base.html" %}
{% block title %}Workspace security{% endblock %}
{% block content %}
<h1>Workspace security</h1>
<p class="sub">Policies that apply to every member of {{ ws.email }}'s workspace. <a href="/app/settings">Back to settings</a> · <a href="/app/team">Team</a></p>
{% if not enabled %}
<div class="flash info">Workspace-wide policies (required 2FA, SAML/OIDC single sign-on) are part of the <b>Enterprise</b> plan. You're on {{ plan.name }}. <a href="/app/billing">See plans</a>. Your own account can still use <a href="/app/settings/2fa">two-factor authentication</a>.</div>
{% endif %}
<div class="grid g2" style="align-items:start">
<div>
  <div class="panel" style="margin-bottom:16px">
    <h2>Require two-factor authentication {% if ws.require_2fa %}<span class="pill ok">on</span>{% else %}<span class="pill">off</span>{% endif %}</h2>
    <p class="small muted">When on, every member (you included) must set up an authenticator app before they can use the workspace. Members without it are sent to the setup page on their next page load.</p>
    <form method="post" action="/app/settings/security">
      <input type="hidden" name="csrf" value="{{ csrf }}"><input type="hidden" name="action" value="policy">
      <div class="row" style="display:flex;align-items:center;gap:12px"><label class="switch" style="margin:0"><input type="checkbox" name="require_2fa" value="1" {% if ws.require_2fa %}checked{% endif %} {% if not enabled %}disabled{% endif %}><span></span></label><span>Every member must use 2FA</span></div>
      {% if not ws.totp_enabled_at %}<p class="small muted">You need to <a href="/app/settings/2fa">enable 2FA on your own account</a> before you can require it.</p>{% endif %}
      <button class="btn" {% if not enabled %}disabled{% endif %}>Save policy</button>
    </form>
    <dl class="kv" style="margin-top:16px"><dt>Members</dt><dd>{{ members_total }}</dd><dt>Without 2FA</dt><dd>{% if members_without_2fa %}{{ members_without_2fa|length }}: <span class="small muted">{{ members_without_2fa|join(', ') }}</span>{% else %}none{% endif %}</dd></dl>
  </div>
</div>
<div>
  <div class="panel">
    <h2>Single sign-on (OIDC) {% if sso_ready %}<span class="pill ok">configured</span>{% if cfg.enforce %} <span class="pill warn">enforced</span>{% endif %}{% endif %}</h2>
    <p class="small muted">Works with Microsoft Entra ID, Okta, Google Workspace, Auth0, Keycloak and any OpenID Connect provider. Register a web app there with this redirect URI, then paste its issuer URL, client id and secret here.</p>
    <div class="row"><label>Redirect URI to register</label><div class="copy" style="display:flex;gap:8px"><input type="text" class="mono" value="{{ redirect_uri }}" readonly onclick="this.select()"><button type="button" class="btn sm" onclick="navigator.clipboard&&navigator.clipboard.writeText('{{ redirect_uri }}');this.textContent='Copied'">Copy</button></div></div>
    <form method="post" action="/app/settings/security">
      <input type="hidden" name="csrf" value="{{ csrf }}"><input type="hidden" name="action" value="sso">
      <div class="row"><label>Issuer URL</label><input type="url" name="issuer" value="{{ cfg.issuer or '' }}" placeholder="https://login.microsoftonline.com/<tenant-id>/v2.0" required {% if not enabled %}disabled{% endif %}>
        <div class="small dim" style="margin-top:4px">Examples: <code class="k">https://login.microsoftonline.com/&lt;tenant&gt;/v2.0</code> · <code class="k">https://&lt;org&gt;.okta.com</code> · <code class="k">https://accounts.google.com</code> · <code class="k">https://&lt;tenant&gt;.auth0.com/</code>. We read <code class="k">/.well-known/openid-configuration</code> when you save.</div></div>
      <div class="grid g2">
        <div class="row"><label>Client id</label><input type="text" name="client_id" value="{{ cfg.client_id or '' }}" required {% if not enabled %}disabled{% endif %}></div>
        <div class="row"><label>Client secret</label><input type="password" name="client_secret" autocomplete="new-password" placeholder="{% if has_secret %}•••••••• (unchanged){% else %}required{% endif %}" {% if not has_secret %}required{% endif %} {% if not enabled %}disabled{% endif %}></div>
      </div>
      <div class="grid g2">
        <div class="row"><label>Email domain</label><input type="text" name="domain" value="{{ cfg.domain or '' }}" placeholder="acme.com" required {% if not enabled %}disabled{% endif %}><div class="small dim" style="margin-top:4px">People with this email domain sign in through your provider and auto-join this workspace.</div></div>
        <div class="row"><label>Role for auto-joined users</label><select name="default_role" {% if not enabled %}disabled{% endif %}>{% for r in roles %}<option value="{{ r }}" {% if (cfg.default_role or 'member') == r %}selected{% endif %}>{{ r }}{% if r == 'member' %} · can edit monitors and pages{% else %} · read-only{% endif %}</option>{% endfor %}</select></div>
      </div>
      <div class="row" style="display:flex;align-items:center;gap:12px"><label class="switch" style="margin:0"><input type="checkbox" name="enforce" value="1" {% if cfg.enforce %}checked{% endif %} {% if not enabled %}disabled{% endif %}><span></span></label><span>Enforce SSO: block password and Google sign-in for @{{ cfg.domain or 'your domain' }} (you stay exempt, so you can't lock yourself out)</span></div>
      <div class="actions" style="display:flex;gap:8px;flex-wrap:wrap;align-items:center">
        <button class="btn primary" {% if not enabled %}disabled{% endif %}>{% if sso_ready %}Update SSO{% else %}Save and verify{% endif %}</button>
        {% if sso_ready %}<a class="btn sm" href="/sso/start?email={{ ws.email }}" target="_blank" rel="noopener">Test sign-in</a>{% endif %}
      </div>
    </form>
    {% if sso_ready %}
    <dl class="kv" style="margin-top:16px"><dt>Provider</dt><dd class="small">{{ cfg.endpoints.issuer }}</dd><dt>Configured</dt><dd class="small">{{ cfg.configured_at[:10] }}</dd><dt>Login link</dt><dd class="small"><code class="k">{{ base_url }}/sso/start</code></dd></dl>
    <form method="post" action="/app/settings/security" style="margin-top:12px" onsubmit="return confirm('Remove SSO? Members created by SSO will need a password reset to log in.')"><input type="hidden" name="csrf" value="{{ csrf }}"><input type="hidden" name="action" value="sso_remove"><button class="btn sm danger">Remove SSO</button></form>
    {% endif %}
  </div>
</div>
</div>
{% endblock %}