zeyn 0.0.8

//! The default UI of the accounts system as a [`Feature`] (the pages of ASP.NET Core Identity's
//! default UI): sign in, registration, password recovery, e-mail confirmation, two factor and
//! recovery code sign in, lockout and access denied, the manage pages (profile, e-mail,
//! password, two factor with a QR code, recovery codes, passkeys, external logins, personal
//! data) and optional administration of users and roles. Built from Zeyn screens and forms; every
//! move between them goes through effects, never a page load.
//!
//! ```ignore
//! App::new("Shop").accounts(accounts).feature(accounts::ui().registration(false).without("account_passkeys").admin(true).build())
//! ```

use super::signin::SESSION;
use super::{
    Accounts, SignInManager, SignInResult, TwoFactorKind, User, UserManager, denied, invalid, scope,
};
use crate::prelude::*;
use crate::render::{Render, escape};
use crate::screen::Component;
use serde::{Deserialize, Serialize};
use serde_json::{Value as Json, json};

/// Permission to see the user administration.
pub const USERS_READ: &str = "accounts.users.read";
/// Permission to lock, unlock and reset users and change their roles.
pub const USERS_WRITE: &str = "accounts.users.write";
/// Permission to create and delete roles.
pub const ROLES_WRITE: &str = "accounts.roles.write";

/// Name of the cookie that carries freshly made recovery codes to the screen that shows them once.
const CODES: &str = "zeyn_account_codes";

/// Builder of the default UI: which screens to serve.
pub struct AccountsUi {
    registration: bool,
    admin: bool,
    off: Vec<&'static str>,
}

/// The default UI with every screen except administration.
pub fn ui() -> AccountsUi {
    AccountsUi {
        registration: true,
        admin: false,
        off: Vec::new(),
    }
}

/// The default UI as a feature: [`ui`] with its defaults.
pub fn feature() -> Feature {
    ui().build()
}

impl AccountsUi {
    /// Shows the registration screen (on by default). Also turn off
    /// `AccountOptions::registration` to close the JSON endpoint.
    pub fn registration(mut self, on: bool) -> Self {
        self.registration = on;
        self
    }

    /// Adds the user and role administration screens, guarded by [`USERS_READ`],
    /// [`USERS_WRITE`] and [`ROLES_WRITE`].
    pub fn admin(mut self, on: bool) -> Self {
        self.admin = on;
        self
    }

    /// Leaves out a screen by name (such as `account_passkeys`), to replace it with the app's own
    /// screen at the same route or to drop it.
    pub fn without(mut self, screen: &'static str) -> Self {
        self.off.push(screen);
        self
    }

    /// The feature.
    pub fn build(self) -> Feature {
        let on = |name: &str| !self.off.contains(&name);
        let mut f = Feature::new("accounts");
        macro_rules! add {
            ($($s:ident),*) => { $( if on(stringify!($s)) { f = f.screen($s); } )* };
        }
        add!(
            account_login,
            account_logout,
            account_forgot_password,
            account_reset_password,
            account_confirm_email,
            account_resend_confirmation
        );
        add!(
            account_check_email,
            account_login_2fa,
            account_login_recovery,
            account_lockout,
            account_access_denied
        );
        add!(
            account_manage,
            account_email,
            account_password,
            account_two_factor,
            account_recovery_codes,
            account_passkeys,
            account_logins,
            account_personal_data
        );
        if self.registration && on("account_register") {
            f = f.screen(account_register);
        }
        #[cfg(feature = "oidc")]
        if on("account_external_login") {
            f = f.screen(account_external_login);
        }
        if self.admin {
            add!(
                account_admin_users,
                account_admin_user_roles,
                account_admin_roles
            );
            f = f.menu(|m| {
                m.group(t!("zeyn.accounts.admin.menu"), Icon::Table)
                    .item(t!("zeyn.accounts.admin.users"), account_admin_users)
                    .item(t!("zeyn.accounts.admin.roles"), account_admin_roles)
            });
        }
        f
    }
}

/// What a sign in step does next: go to `url`, reloading the app frame when the session changed.
#[derive(Clone, Debug, Serialize)]
pub struct Next {
    pub url: String,
    pub frame: bool,
}

fn go(url: String, frame: bool) -> Result<Next> {
    Ok(Next { url, frame })
}

fn path(p: &str) -> String {
    format!("{}{p}", scope::prefix())
}

/// The local path to go to after signing in: `return_to` when it is local, else the start page.
fn back(return_to: &str) -> String {
    crate::auth::safe_return(return_to)
        .map(str::to_string)
        .unwrap_or_else(|| path("/"))
}

fn with_params(p: &str, params: Json) -> String {
    format!("{}?params={}", path(p), super::pct(&params.to_string()))
}

/// Raw markup for parts no component covers (QR code, code lists, links, passkey buttons).
/// Every value in it is escaped by the caller.
struct Markup(Box<dyn Fn(&Render) -> String + Send + Sync>);

impl Component for Markup {
    fn render(&self, out: &mut String, r: &Render) {
        out.push_str(&(self.0)(r));
    }

    fn schema(&self) -> Json {
        json!({ "type": "markup" })
    }
}

fn markup(f: impl Fn(&Render) -> String + Send + Sync + 'static) -> Node {
    Node::new(Markup(Box::new(f)))
}

fn tx(r: &Render, key: &str) -> String {
    r.text(&Text::key(format!("zeyn.accounts.{key}")))
}

/// A link to an app path; `nav.js` loads it in place.
fn link(key: &'static str, to: &'static str) -> Node {
    let href = path(to);
    markup(move |r| format!(r#"<p><a href="{}">{}</a></p>"#, escape(&href), tx(r, key)))
}

/// The signed in user of the request.
async fn me(accounts: &Accounts) -> Result<User> {
    let id = scope::cookie(SESSION)
        .and_then(|v| accounts.sign_in().open_session(&v))
        .map(|s| s.id)
        .ok_or(Error::Forbidden)?;
    accounts
        .users()
        .find_by_id(&id)
        .await?
        .ok_or(Error::Forbidden)
}

/// A screen with the narrow account layout.
fn page(title: &'static str) -> Screen {
    Screen::new(Text::key(format!("zeyn.accounts.{title}")))
}

/// The navigation of the manage screens, with the current one marked.
fn manage_nav(current: &'static str) -> Node {
    const ITEMS: [(&str, &str); 7] = [
        ("manage.profile", "/account/manage"),
        ("manage.email", "/account/manage/email"),
        ("manage.password", "/account/manage/password"),
        ("manage.two_factor", "/account/manage/two-factor"),
        ("manage.passkeys", "/account/manage/passkeys"),
        ("manage.logins", "/account/manage/logins"),
        ("manage.personal_data", "/account/manage/personal-data"),
    ];
    let prefix = scope::prefix();
    markup(move |r| {
        let items: String = ITEMS
            .iter()
            .map(|(key, to)| {
                let mark = if *to == current {
                    r#" aria-current="page""#
                } else {
                    ""
                };
                format!(
                    r#"<li><a href="{}{}"{mark}>{}</a></li>"#,
                    escape(&prefix),
                    to,
                    tx(r, key)
                )
            })
            .collect();
        format!(
            r#"<nav class="z-account-nav" aria-label="{}"><ul>{items}</ul></nav>"#,
            tx(r, "manage.title")
        )
    })
}

/// A notice chosen by a fixed code from the screen's params; unknown codes show nothing, so a link
/// can never put its own text on the page.
fn notice(code: Option<&str>) -> Option<Node> {
    let key = match code? {
        "confirmed" => "notice.confirmed",
        "reset" => "notice.reset",
        "signed_out" => "notice.signed_out",
        "deleted" => "notice.deleted",
        "external" => "error.external",
        "check_email" => "notice.check_email",
        _ => return None,
    };
    Some(Node::new(Alert::info(Text::key(format!(
        "zeyn.accounts.{key}"
    )))))
}

/// Screen params whose fields are all optional, so the screen also opens without any params (a
/// plain link, or a sign in redirect with only `?return_to=`).
macro_rules! optional_params {
    ($(#[$m:meta])* pub struct $name:ident { $($(#[$fm:meta])* pub $f:ident: $t:ty,)* }) => {
        $(#[$m])*
        #[derive(Clone, Debug, Default, Serialize)]
        pub struct $name { $($(#[$fm])* pub $f: $t,)* }

        impl<'de> Deserialize<'de> for $name {
            fn deserialize<D: serde::Deserializer<'de>>(d: D) -> std::result::Result<Self, D::Error> {
                #[derive(Deserialize, Default)]
                #[serde(default)]
                struct Raw { $($f: $t,)* }
                let raw = Option::<Raw>::deserialize(d)?.unwrap_or_default();
                Ok($name { $($f: raw.$f,)* })
            }
        }

        impl crate::screen::Params for $name {}

        impl crate::api::ApiInput for $name {
            fn schema() -> Json {
                json!({ "type": "object", "title": stringify!($name) })
            }

            fn from_json(value: Json) -> Result<Self> {
                if value.is_null() {
                    return Ok(Self::default());
                }
                serde_json::from_value(value).map_err(|_| Error::NotFound)
            }
        }
    };
}

/// Sign in form.
#[model]
pub struct AccountLogin {
    #[rule(required, max_len = 254)]
    pub user_name: String,
    #[rule(required, max_len = 1024)]
    pub password: String,
    pub remember_me: bool,
    pub return_to: String,
}

optional_params! {
/// Where the sign in screen sends the user afterwards, and a notice to show.
pub struct LoginParams {
    pub return_to: Option<String>,
    pub notice: Option<String>,
    pub error: Option<String>,
}
}

/// Signs in with a user name or e-mail and a password; lockout counts failures.
#[action(public, ai = false)]
pub async fn account_sign_in(input: Valid<AccountLogin>, sign_in: SignInManager) -> Result<Next> {
    match sign_in
        .password_sign_in(&input.user_name, &input.password, input.remember_me, true)
        .await?
    {
        SignInResult::Succeeded => go(back(&input.return_to), true),
        SignInResult::RequiresTwoFactor => go(
            with_params(
                "/account/login-2fa",
                json!({ "return_to": input.return_to, "remember": input.remember_me }),
            ),
            false,
        ),
        SignInResult::LockedOut => go(path("/account/lockout"), false),
        SignInResult::NotAllowed => Err(denied("not_allowed")),
        SignInResult::Failed => Err(denied("invalid_login")),
    }
}

fn next_effect(n: &Result<Next>, ui: &mut UiCtx) {
    if let Ok(n) = n {
        ui.effect(Effect::go(&n.url, n.frame));
    }
}

/// A paragraph of catalog text.
fn para(key: &'static str) -> Node {
    markup(move |r| format!("<p>{}</p>", r.text(&Text::key(key))))
}

#[screen(route = "/account/login", public)]
pub async fn account_login(p: LoginParams, accounts: Accounts) -> Result<Screen> {
    let return_to = p.return_to.clone().unwrap_or_default();
    let mut body = Stack::new();
    if let Some(n) = notice(p.notice.as_deref()).or_else(|| notice(p.error.as_deref())) {
        body = body.add(n);
    }
    body = body.add(
        Form::of(AccountLogin {
            return_to: return_to.clone(),
            ..AccountLogin::default()
        })
        .field(AccountLogin::user_name)
        .field(AccountLogin::password)
        .control(AccountLogin::password, Control::Password)
        .field(AccountLogin::remember_me)
        .submit(t!("zeyn.accounts.login.submit"), account_sign_in)
        .on_success(next_effect),
    );
    if accounts.settings().passkeys.enabled && accounts.0.public_url.is_some() {
        let back = back(&return_to);
        body = body.add(markup(move |r| {
            format!(
                r#"<p><button type="button" class="z-button" data-zeyn-passkey="login" data-return="{}" data-failed="{}" data-unsupported="{}">{}</button></p><p class="z-field-error" data-zeyn-passkey-error aria-live="polite"></p>"#,
                escape(&back),
                tx(r, "passkeys.failed"),
                tx(r, "passkeys.unsupported"),
                tx(r, "login.passkey")
            )
        }));
    }
    let providers = accounts.external_names();
    if !providers.is_empty() {
        let prefix = scope::prefix();
        let rt = super::pct(&return_to);
        body = body.add(markup(move |r| {
            let buttons: String = providers
                .iter()
                .map(|p| format!(r#"<li><a class="z-button" href="{}/_zeyn/account/external/{}?return_to={rt}">{} {}</a></li>"#, escape(&prefix), escape(p), tx(r, "login.with"), escape(p)))
                .collect();
            format!(r#"<section aria-labelledby="z-external-title"><h2 id="z-external-title">{}</h2><ul class="z-account-providers">{buttons}</ul></section>"#, tx(r, "login.external"))
        }));
    }
    body = body
        .add(link("login.forgot", "/account/forgot-password"))
        .add(link("login.resend", "/account/resend-confirmation"));
    if accounts.settings().registration {
        body = body.add(link("login.register", "/account/register"));
    }
    Ok(page("login.title").body(body))
}

/// Registration form.
#[model]
pub struct AccountRegister {
    #[rule(required, email, max_len = 254)]
    pub email: String,
    #[rule(required, max_len = 1024)]
    pub password: String,
    #[rule(required, max_len = 1024)]
    pub confirm_password: String,
}

/// Creates an account and sends the confirmation link. The answer is the same when the address
/// already has an account; that address gets a notice instead.
#[action(public, ai = false)]
pub async fn account_sign_up(
    input: Valid<AccountRegister>,
    accounts: Accounts,
    ctx: Ctx,
) -> Result<Next> {
    if input.password != input.confirm_password {
        return Err(invalid("confirm_password", "password_confirm_mismatch"));
    }
    crate::server::accounts::register_user(&ctx, &accounts, &input.email, &input.password).await?;
    go(path("/account/check-email"), false)
}

#[screen(route = "/account/register", public)]
pub fn account_register(_: ()) -> Screen {
    page("register.title").body(
        Stack::new()
            .add(
                Form::of(AccountRegister::default())
                    .field(AccountRegister::email)
                    .field(AccountRegister::password)
                    .control(AccountRegister::password, Control::NewPassword)
                    .field(AccountRegister::confirm_password)
                    .control(AccountRegister::confirm_password, Control::NewPassword)
                    .submit(t!("zeyn.accounts.register.submit"), account_sign_up)
                    .on_success(next_effect),
            )
            .add(link("register.login", "/account/login")),
    )
}

#[screen(route = "/account/check-email", public)]
pub fn account_check_email(_: ()) -> Screen {
    page("check_email.title").body(
        Stack::new()
            .add(Alert::info(t!("zeyn.accounts.check_email.body")))
            .add(link("register.login", "/account/login")),
    )
}

/// E-mail form for password recovery and confirmation links.
#[model]
pub struct AccountEmailOnly {
    #[rule(required, email, max_len = 254)]
    pub email: String,
}

/// Sends a password reset link when the address has a confirmed account; answers the same either way.
#[action(public, ai = false)]
pub async fn account_forgot(
    input: Valid<AccountEmailOnly>,
    accounts: Accounts,
    ctx: Ctx,
) -> Result<Next> {
    crate::server::accounts::forgot_password(&ctx, &accounts, &input.email).await?;
    go(path("/account/check-email"), false)
}

#[screen(route = "/account/forgot-password", public)]
pub fn account_forgot_password(_: ()) -> Screen {
    page("forgot.title").body(
        Stack::new()
            .add(para("zeyn.accounts.forgot.intro"))
            .add(
                Form::of(AccountEmailOnly::default())
                    .field(AccountEmailOnly::email)
                    .submit(t!("zeyn.accounts.forgot.submit"), account_forgot)
                    .on_success(next_effect),
            ),
    )
}

/// Sends the confirmation link again; answers the same either way.
#[action(public, ai = false)]
pub async fn account_resend(
    input: Valid<AccountEmailOnly>,
    accounts: Accounts,
    ctx: Ctx,
) -> Result<Next> {
    crate::server::accounts::resend_confirmation(&ctx, &accounts, &input.email).await?;
    go(path("/account/check-email"), false)
}

#[screen(route = "/account/resend-confirmation", public)]
pub fn account_resend_confirmation(_: ()) -> Screen {
    page("resend.title").body(
        Form::of(AccountEmailOnly::default())
            .field(AccountEmailOnly::email)
            .submit(t!("zeyn.accounts.resend.submit"), account_resend)
            .on_success(next_effect),
    )
}

optional_params! {
/// The link of a reset or confirmation message.
pub struct LinkParams {
    pub user: Option<String>,
    pub code: Option<String>,
    pub email: Option<String>,
}
}

/// New password from a reset link.
#[model]
pub struct AccountReset {
    #[rule(required, max_len = 1024)]
    pub password: String,
    #[rule(required, max_len = 1024)]
    pub confirm_password: String,
    pub user: String,
    pub code: String,
}

/// Sets a new password with a reset link.
#[action(public, ai = false)]
pub async fn account_reset(
    input: Valid<AccountReset>,
    users: UserManager,
    sign_in: SignInManager,
) -> Result<Next> {
    sign_in.throttle_ip().await?;
    if input.password != input.confirm_password {
        return Err(invalid("confirm_password", "password_confirm_mismatch"));
    }
    let Some(mut user) = users.find_by_id(&input.user).await? else {
        return Err(denied("invalid_token"));
    };
    users
        .reset_password(&mut user, &input.code, &input.password)
        .await?;
    go(
        with_params("/account/login", json!({ "notice": "reset" })),
        false,
    )
}

#[screen(route = "/account/reset-password", public)]
pub fn account_reset_password(p: LinkParams) -> Screen {
    let model = AccountReset {
        user: p.user.unwrap_or_default(),
        code: p.code.unwrap_or_default(),
        ..AccountReset::default()
    };
    page("reset.title").body(
        Form::of(model)
            .field(AccountReset::password)
            .control(AccountReset::password, Control::NewPassword)
            .field(AccountReset::confirm_password)
            .control(AccountReset::confirm_password, Control::NewPassword)
            .submit(t!("zeyn.accounts.reset.submit"), account_reset)
            .on_success(next_effect),
    )
}

/// Confirms an e-mail address, or an e-mail change, from the link in the message.
#[screen(route = "/account/confirm-email", public)]
pub async fn account_confirm_email(
    p: LinkParams,
    users: UserManager,
    sign_in: SignInManager,
) -> Result<Screen> {
    sign_in.throttle_ip().await?;
    let found = match &p.user {
        Some(id) => users.find_by_id(id).await?,
        None => None,
    };
    let done = match (found, p.code.as_deref()) {
        (Some(mut user), Some(code)) => match p.email.as_deref() {
            Some(new) => {
                let same = user.email.as_deref() == Some(user.user_name.as_str());
                users
                    .change_email(&mut user, new, code, same)
                    .await
                    .is_ok()
            }
            None => users
                .confirm_email(&mut user, code)
                .await
                .is_ok(),
        },
        _ => false,
    };
    let alert = if done {
        Alert::success(t!("zeyn.accounts.confirm.done"))
    } else {
        Alert::danger(t!("zeyn.accounts.confirm.failed"))
    };
    Ok(page("confirm.title").body(
        Stack::new()
            .add(alert)
            .add(link("register.login", "/account/login")),
    ))
}

optional_params! {
/// Where a two factor step goes afterwards.
pub struct TwoFactorParams {
    pub return_to: Option<String>,
    pub remember: Option<bool>,
}
}

/// A code from an authenticator app, e-mail or text message.
#[model]
pub struct AccountCode {
    #[rule(required, max_len = 16)]
    pub code: String,
    pub remember_machine: bool,
    pub return_to: String,
}

/// Completes a sign in with an authenticator code.
#[action(public, ai = false)]
pub async fn account_verify_code(
    input: Valid<AccountCode>,
    sign_in: SignInManager,
) -> Result<Next> {
    match sign_in
        .two_factor_sign_in(
            TwoFactorKind::Authenticator,
            &input.code,
            input.remember_machine,
        )
        .await?
    {
        SignInResult::Succeeded => go(back(&input.return_to), true),
        SignInResult::LockedOut => go(path("/account/lockout"), false),
        _ => Err(invalid("code", "invalid_code")),
    }
}

/// A code sent by e-mail, a form of its own so the screen has unique field ids.
#[model]
pub struct AccountEmailCode {
    #[rule(required, max_len = 16)]
    pub code: String,
    pub remember_machine: bool,
    pub return_to: String,
}

/// Completes a sign in with a code sent by e-mail.
#[action(public, ai = false)]
pub async fn account_verify_email_code(
    input: Valid<AccountEmailCode>,
    sign_in: SignInManager,
) -> Result<Next> {
    match sign_in
        .two_factor_sign_in(TwoFactorKind::Email, &input.code, input.remember_machine)
        .await?
    {
        SignInResult::Succeeded => go(back(&input.return_to), true),
        SignInResult::LockedOut => go(path("/account/lockout"), false),
        _ => Err(invalid("code", "invalid_code")),
    }
}

/// Sends a sign in code to the user's confirmed e-mail address.
#[action(public, ai = false)]
pub async fn account_send_email_code(_input: (), sign_in: SignInManager, ctx: Ctx) -> Result<()> {
    sign_in
        .send_two_factor_code(&ctx, TwoFactorKind::Email)
        .await
}

#[screen(route = "/account/login-2fa", public)]
pub async fn account_login_2fa(p: TwoFactorParams, sign_in: SignInManager) -> Result<Screen> {
    let Some(user) = sign_in.two_factor_user().await? else {
        return Ok(page("two_factor.title").body(
            Stack::new()
                .add(Alert::warning(t!("zeyn.accounts.error.two_factor_expired")))
                .add(link("register.login", "/account/login")),
        ));
    };
    let kinds = sign_in
        .0
        .users()
        .two_factor_kinds(&user)
        .await?;
    let return_to = p.return_to.unwrap_or_default();
    let model = AccountCode {
        return_to: return_to.clone(),
        ..AccountCode::default()
    };
    let mut body = Stack::new();
    if kinds.contains(&TwoFactorKind::Authenticator) {
        body = body
            .add(para("zeyn.accounts.two_factor.intro"))
            .add(
                Form::of(model.clone())
                    .field(AccountCode::code)
                    .control(AccountCode::code, Control::OneTimeCode)
                    .field(AccountCode::remember_machine)
                    .submit(t!("zeyn.accounts.two_factor.submit"), account_verify_code)
                    .on_success(next_effect),
            );
    }
    if kinds.contains(&TwoFactorKind::Email) {
        body = body
            .add(para("zeyn.accounts.two_factor.email_intro"))
            .add(
                ActionButton::new(
                    t!("zeyn.accounts.two_factor.send_email"),
                    account_send_email_code,
                    (),
                )
                .on_success(|_, ui| ui.toast(t!("zeyn.accounts.two_factor.sent"))),
            )
            .add(
                Form::of(AccountEmailCode {
                    return_to: model.return_to.clone(),
                    ..AccountEmailCode::default()
                })
                .field(AccountEmailCode::code)
                .control(AccountEmailCode::code, Control::OneTimeCode)
                .field(AccountEmailCode::remember_machine)
                .submit(
                    t!("zeyn.accounts.two_factor.submit_email"),
                    account_verify_email_code,
                )
                .on_success(next_effect),
            );
    }
    let recovery = with_params("/account/login-recovery", json!({ "return_to": return_to }));
    body = body.add(markup(move |r| {
        format!(
            r#"<p><a href="{}">{}</a></p>"#,
            escape(&recovery),
            tx(r, "two_factor.use_recovery")
        )
    }));
    Ok(page("two_factor.title").body(body))
}

/// A recovery code.
#[model]
pub struct AccountRecovery {
    #[rule(required, max_len = 32)]
    pub code: String,
    pub return_to: String,
}

/// Completes a sign in with a recovery code, which is used up.
#[action(public, ai = false)]
pub async fn account_use_recovery(
    input: Valid<AccountRecovery>,
    sign_in: SignInManager,
) -> Result<Next> {
    match sign_in
        .recovery_code_sign_in(&input.code)
        .await?
    {
        SignInResult::Succeeded => go(back(&input.return_to), true),
        SignInResult::LockedOut => go(path("/account/lockout"), false),
        _ => Err(invalid("code", "invalid_recovery_code")),
    }
}

#[screen(route = "/account/login-recovery", public)]
pub fn account_login_recovery(p: TwoFactorParams) -> Screen {
    page("recovery.title").body(
        Stack::new()
            .add(para("zeyn.accounts.recovery.intro"))
            .add(
                Form::of(AccountRecovery {
                    return_to: p.return_to.unwrap_or_default(),
                    ..AccountRecovery::default()
                })
                .field(AccountRecovery::code)
                .control(AccountRecovery::code, Control::OneTimeCode)
                .submit(t!("zeyn.accounts.recovery.submit"), account_use_recovery)
                .on_success(next_effect),
            ),
    )
}

#[screen(route = "/account/lockout", public)]
pub fn account_lockout(_: ()) -> Screen {
    page("lockout.title").body(
        Stack::new()
            .add(Alert::danger(t!("zeyn.accounts.lockout.body")))
            .add(link("login.forgot", "/account/forgot-password")),
    )
}

#[screen(route = "/account/access-denied", public)]
pub fn account_access_denied(_: ()) -> Screen {
    page("denied.title").body(Alert::warning(t!("zeyn.accounts.denied.body")))
}

/// Signs out of this browser.
#[action(public, ai = false)]
pub async fn account_sign_out(_input: (), accounts: Accounts) -> Result<Next> {
    let user = me(&accounts).await.ok();
    accounts
        .sign_in()
        .sign_out(user.as_ref().map(|u| u.id.as_str()));
    go(
        with_params("/account/login", json!({ "notice": "signed_out" })),
        true,
    )
}

#[screen(route = "/account/logout", public)]
pub fn account_logout(_: ()) -> Screen {
    page("logout.title").body(
        Stack::new()
            .add(para("zeyn.accounts.logout.body"))
            .add(
                ActionButton::new(t!("zeyn.accounts.logout.submit"), account_sign_out, ())
                    .on_success(next_effect),
            ),
    )
}

/// Profile: the phone number.
#[model]
pub struct AccountProfile {
    #[readonly]
    pub user_name: String,
    #[rule(max_len = 32)]
    pub phone_number: Option<String>,
}

/// Saves the profile. A changed phone number is not confirmed until a code proves it.
#[action(public, ai = false)]
pub async fn account_save_profile(input: Valid<AccountProfile>, accounts: Accounts) -> Result<()> {
    let mut user = me(&accounts).await?;
    let phone = input
        .phone_number
        .clone()
        .map(|p| p.trim().to_string())
        .filter(|p| !p.is_empty());
    if phone != user.phone_number {
        if phone.as_deref().is_some_and(|p| {
            !p.chars()
                .all(|c| c.is_ascii_digit() || " +-()".contains(c))
        }) {
            return Err(invalid("phone_number", "invalid_phone"));
        }
        user.phone_number = phone;
        user.phone_number_confirmed = false;
        accounts
            .users()
            .update(&mut user)
            .await?;
    }
    Ok(())
}

#[screen(route = "/account/manage", public)]
pub async fn account_manage(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    Ok(page("manage.profile").body(
        Stack::new()
            .add(manage_nav("/account/manage"))
            .add(
                Form::of(AccountProfile {
                    user_name: user.user_name.clone(),
                    phone_number: user.phone_number.clone(),
                })
                .field(AccountProfile::user_name)
                .field(AccountProfile::phone_number)
                .submit(t!("zeyn.accounts.save"), account_save_profile)
                .on_success(|_, ui| ui.toast(t!("zeyn.accounts.saved"))),
            ),
    ))
}

/// A new e-mail address.
#[model]
pub struct AccountNewEmail {
    #[rule(required, email, max_len = 254)]
    pub new_email: String,
}

/// Sends a confirmation link to the new address; the address changes when the link is opened.
#[action(public, ai = false)]
pub async fn account_change_email(
    input: Valid<AccountNewEmail>,
    accounts: Accounts,
    ctx: Ctx,
) -> Result<()> {
    let user = me(&accounts).await?;
    accounts.sign_in().throttle_ip().await?;
    if Some(input.new_email.as_str()) == user.email.as_deref() {
        return Err(invalid("new_email", "email_unchanged"));
    }
    crate::server::accounts::send_confirmation(&ctx, &accounts, &user, Some(&input.new_email)).await
}

/// Sends the confirmation link for the current address again.
#[action(public, ai = false)]
pub async fn account_send_verification(_input: (), accounts: Accounts, ctx: Ctx) -> Result<()> {
    let user = me(&accounts).await?;
    accounts.sign_in().throttle_ip().await?;
    crate::server::accounts::send_confirmation(&ctx, &accounts, &user, None).await
}

#[screen(route = "/account/manage/email", public)]
pub async fn account_email(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    let current = user.email.clone().unwrap_or_default();
    let confirmed = user.email_confirmed;
    let mut body = Stack::new()
        .add(manage_nav("/account/manage/email"))
        .add(markup(move |r| {
            let state = if confirmed {
                tx(r, "email.confirmed")
            } else {
                tx(r, "email.unconfirmed")
            };
            format!(
                r#"<p>{} <strong>{}</strong> ({state})</p>"#,
                tx(r, "email.current"),
                escape(&current)
            )
        }));
    if !confirmed {
        body = body.add(
            ActionButton::new(
                t!("zeyn.accounts.email.send_verification"),
                account_send_verification,
                (),
            )
            .on_success(|_, ui| ui.toast(t!("zeyn.accounts.email.sent"))),
        );
    }
    body = body.add(
        Form::of(AccountNewEmail::default())
            .field(AccountNewEmail::new_email)
            .submit(t!("zeyn.accounts.email.change"), account_change_email)
            .on_success(|_, ui| ui.toast(t!("zeyn.accounts.email.sent"))),
    );
    Ok(page("manage.email").body(body))
}

/// Password change.
#[model]
pub struct AccountPassword {
    #[rule(max_len = 1024)]
    pub old_password: String,
    #[rule(required, max_len = 1024)]
    pub new_password: String,
    #[rule(required, max_len = 1024)]
    pub confirm_password: String,
}

/// Changes the password, or sets one for a user without one. Other sessions are signed out by
/// the new security stamp; this one is renewed.
#[action(public, ai = false)]
pub async fn account_change_password(
    input: Valid<AccountPassword>,
    accounts: Accounts,
) -> Result<()> {
    let mut user = me(&accounts).await?;
    accounts.sign_in().throttle_ip().await?;
    if input.new_password != input.confirm_password {
        return Err(invalid("confirm_password", "password_confirm_mismatch"));
    }
    if user.password_hash.is_some() {
        accounts
            .users()
            .change_password(&mut user, &input.old_password, &input.new_password)
            .await?;
    } else {
        accounts
            .users()
            .add_password(&mut user, &input.new_password)
            .await?;
    }
    accounts
        .sign_in()
        .refresh_sign_in(&user)
        .await
}

#[screen(route = "/account/manage/password", public)]
pub async fn account_password(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    let mut form = Form::of(AccountPassword::default());
    if user.password_hash.is_some() {
        form = form
            .field(AccountPassword::old_password)
            .control(AccountPassword::old_password, Control::Password);
    }
    Ok(page("manage.password").body(
        Stack::new()
            .add(manage_nav("/account/manage/password"))
            .add(
                form.field(AccountPassword::new_password)
                    .control(AccountPassword::new_password, Control::NewPassword)
                    .field(AccountPassword::confirm_password)
                    .control(AccountPassword::confirm_password, Control::NewPassword)
                    .submit(t!("zeyn.accounts.password.submit"), account_change_password)
                    .on_success(|_, ui| {
                        ui.toast(t!("zeyn.accounts.password.changed"));
                        ui.effect(Effect::go(&path("/account/manage/password"), false));
                    }),
            ),
    ))
}

#[derive(Serialize, Deserialize)]
struct FreshCodes {
    #[serde(rename = "u")]
    user: String,
    #[serde(rename = "c")]
    codes: Vec<String>,
    #[serde(rename = "e")]
    expires: i64,
}

/// Makes new recovery codes and hands them to the screen that shows them once.
async fn new_codes(accounts: &Accounts, user: &User) -> Result<Next> {
    let codes = accounts
        .users()
        .generate_recovery_codes(user, 10)
        .await?;
    let sealer = accounts
        .0
        .sealer
        .as_ref()
        .ok_or_else(|| Error::Internal("accounts key too short".into()))?;
    let fresh = FreshCodes {
        user: user.id.clone(),
        codes,
        expires: super::now_secs() + 300,
    };
    scope::set_cookie(CODES, Some(&sealer.seal(CODES, &fresh)), Some(300));
    go(path("/account/manage/recovery-codes"), false)
}

/// Turns on two factor sign in with the authenticator app code shown on the screen.
#[action(public, reauth, ai = false)]
pub async fn account_enable_authenticator(
    input: Valid<AccountCode>,
    accounts: Accounts,
) -> Result<Next> {
    let mut user = me(&accounts).await?;
    accounts.sign_in().throttle_ip().await?;
    if !accounts
        .users()
        .verify_authenticator_code(&user, &input.code)
        .await?
    {
        return Err(invalid("code", "invalid_code"));
    }
    accounts
        .users()
        .set_two_factor_enabled(&mut user, true)
        .await?;
    accounts
        .sign_in()
        .refresh_sign_in(&user)
        .await?;
    if accounts
        .users()
        .count_recovery_codes(&user)
        .await?
        == 0
    {
        return new_codes(&accounts, &user).await;
    }
    go(path("/account/manage/two-factor"), false)
}

/// Turns two factor sign in off.
#[action(public, reauth, ai = false)]
pub async fn account_disable_two_factor(_input: (), accounts: Accounts) -> Result<Next> {
    let mut user = me(&accounts).await?;
    accounts
        .users()
        .set_two_factor_enabled(&mut user, false)
        .await?;
    accounts
        .sign_in()
        .refresh_sign_in(&user)
        .await?;
    go(path("/account/manage/two-factor"), false)
}

/// A new authenticator key: two factor is off until the app proves the new key.
#[action(public, reauth, ai = false)]
pub async fn account_reset_authenticator(_input: (), accounts: Accounts) -> Result<Next> {
    let mut user = me(&accounts).await?;
    accounts
        .users()
        .set_two_factor_enabled(&mut user, false)
        .await?;
    accounts
        .users()
        .reset_authenticator_key(&mut user)
        .await?;
    accounts
        .sign_in()
        .refresh_sign_in(&user)
        .await?;
    go(path("/account/manage/two-factor"), false)
}

/// Forgets this browser, so the next sign in asks for the second factor again.
#[action(public, ai = false)]
pub async fn account_forget_browser(_input: (), accounts: Accounts) -> Result<()> {
    me(&accounts).await?;
    accounts
        .sign_in()
        .forget_two_factor_client();
    Ok(())
}

/// Replaces the recovery codes.
#[action(public, reauth, ai = false)]
pub async fn account_new_recovery_codes(_input: (), accounts: Accounts) -> Result<Next> {
    let user = me(&accounts).await?;
    new_codes(&accounts, &user).await
}

#[screen(route = "/account/manage/two-factor", public)]
pub async fn account_two_factor(_: (), accounts: Accounts, ctx: Ctx) -> Result<Screen> {
    let mut user = me(&accounts).await?;
    let users = accounts.users();
    let mut body = Stack::new().add(manage_nav("/account/manage/two-factor"));
    if user.two_factor_enabled {
        let left = users
            .count_recovery_codes(&user)
            .await?;
        body = body
            .add(Alert::success(t!("zeyn.accounts.two_factor.on")))
            .add(markup(move |r| {
                format!(
                    "<p>{}</p>",
                    r.text(
                        &Text::key("zeyn.accounts.two_factor.codes_left")
                            .arg("n", left.to_string())
                    )
                )
            }))
            .add(
                Row::new()
                    .col(
                        ActionButton::new(
                            t!("zeyn.accounts.two_factor.new_codes"),
                            account_new_recovery_codes,
                            (),
                        )
                        .confirm(t!("zeyn.accounts.two_factor.new_codes_confirm"))
                        .on_success(next_effect),
                    )
                    .col(
                        ActionButton::new(
                            t!("zeyn.accounts.two_factor.forget"),
                            account_forget_browser,
                            (),
                        )
                        .on_success(|_, ui| ui.toast(t!("zeyn.accounts.saved"))),
                    )
                    .col(
                        ActionButton::new(
                            t!("zeyn.accounts.two_factor.disable"),
                            account_disable_two_factor,
                            (),
                        )
                        .confirm(t!("zeyn.accounts.two_factor.disable_confirm"))
                        .tone(Tone::Danger)
                        .on_success(next_effect),
                    )
                    .col(
                        ActionButton::new(
                            t!("zeyn.accounts.two_factor.reset_key"),
                            account_reset_authenticator,
                            (),
                        )
                        .confirm(t!("zeyn.accounts.two_factor.reset_key_confirm"))
                        .on_success(next_effect),
                    ),
            );
    } else if !ctx.signed_in_recently() {
        let again = path("/account/login?return_to=%2Faccount%2Fmanage%2Ftwo-factor");
        body = body
            .add(Alert::info(t!("zeyn.accounts.two_factor.reauth")))
            .add(markup(move |r| {
                format!(
                    r#"<p><a href="{}">{}</a></p>"#,
                    escape(&again),
                    tx(r, "two_factor.reauth_link")
                )
            }));
    } else {
        let key = match users.authenticator_key(&user).await? {
            Some(k) => k,
            None => {
                users
                    .reset_authenticator_key(&mut user)
                    .await?
            }
        };
        accounts
            .sign_in()
            .refresh_sign_in(&user)
            .await?;
        let uri = users.authenticator_uri(&user, &key);
        let grouped: Vec<String> = key
            .to_lowercase()
            .as_bytes()
            .chunks(4)
            .map(|c| String::from_utf8_lossy(c).into_owned())
            .collect();
        body = body
            .add(para("zeyn.accounts.two_factor.setup"))
            .add(markup(move |r| {
                format!(
                    r#"<div class="z-account-qr">{}</div><p>{} <code class="z-totp-key">{}</code></p>"#,
                    crate::auth::totp::qr_svg(&uri, &tx(r, "two_factor.qr")).unwrap_or_default(),
                    tx(r, "two_factor.manual"),
                    escape(&grouped.join(" "))
                )
            }))
            .add(
                Form::of(AccountCode::default())
                    .field(AccountCode::code)
                    .control(AccountCode::code, Control::OneTimeCode)
                    .submit(t!("zeyn.accounts.two_factor.enable"), account_enable_authenticator)
                    .on_success(next_effect),
            );
    }
    Ok(page("manage.two_factor").body(body))
}

/// Shows freshly made recovery codes once.
#[screen(route = "/account/manage/recovery-codes", public)]
pub async fn account_recovery_codes(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    let fresh = scope::cookie(CODES)
        .and_then(|v| {
            accounts
                .0
                .sealer
                .as_ref()?
                .open::<FreshCodes>(CODES, &v)
        })
        .filter(|f| f.user == user.id && f.expires > super::now_secs());
    scope::set_cookie(CODES, None, None);
    let mut body = Stack::new().add(manage_nav("/account/manage/two-factor"));
    match fresh {
        Some(f) => {
            body = body
                .add(Alert::warning(t!("zeyn.accounts.codes.keep")))
                .add(markup(move |_| {
                    let items: String = f
                        .codes
                        .iter()
                        .map(|c| format!("<li><code>{}</code></li>", escape(c)))
                        .collect();
                    format!(r#"<ul class="z-totp-codes">{items}</ul>"#)
                }));
        }
        None => body = body.add(Alert::info(t!("zeyn.accounts.codes.gone"))),
    }
    Ok(page("codes.title").body(body.add(link("codes.back", "/account/manage/two-factor"))))
}

/// Removes a passkey by its credential id (base64url).
#[action(public, reauth, ai = false)]
pub async fn account_remove_passkey(id: String, accounts: Accounts) -> Result<Next> {
    let mut user = me(&accounts).await?;
    let raw = crate::auth::b64url_decode(&id).ok_or(Error::NotFound)?;
    accounts
        .users()
        .remove_passkey(&mut user, &raw)
        .await?;
    accounts
        .sign_in()
        .refresh_sign_in(&user)
        .await?;
    go(path("/account/manage/passkeys"), false)
}

#[screen(route = "/account/manage/passkeys", public)]
pub async fn account_passkeys(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    let list = accounts.users().passkeys(&user).await?;
    let mut body = Stack::new()
        .add(manage_nav("/account/manage/passkeys"))
        .add(para("zeyn.accounts.passkeys.intro"));
    if list.is_empty() {
        body = body.add(EmptyState::new(t!("zeyn.accounts.passkeys.none")));
    }
    for p in list {
        let name = p
            .name
            .clone()
            .unwrap_or_else(|| "Passkey".into());
        let created = crate::time::DateTime::from_unix_ms(p.created_at.saturating_mul(1000));
        body = body.add(
            Row::new()
                .col(markup(move |r| {
                    format!(
                        "<p><strong>{}</strong> {}</p>",
                        escape(&name),
                        r.value(
                            &crate::value::Value::DateTime(created),
                            &crate::value::FieldKind::DateTime
                        )
                    )
                }))
                .col(
                    ActionButton::new(
                        t!("zeyn.accounts.passkeys.remove"),
                        account_remove_passkey,
                        crate::auth::b64url(&p.credential_id),
                    )
                    .confirm(t!("zeyn.accounts.passkeys.remove_confirm"))
                    .tone(Tone::Danger)
                    .on_success(next_effect),
                ),
        );
    }
    if accounts.0.public_url.is_some() {
        body = body.add(markup(|r| {
            format!(
                r#"<div class="z-field"><label for="z-passkey-name">{}</label><input id="z-passkey-name" type="text" maxlength="100" data-zeyn-passkey-name></div><p><button type="button" class="z-button z-primary" data-zeyn-passkey="add" data-failed="{}" data-unsupported="{}">{}</button></p><p class="z-field-error" data-zeyn-passkey-error aria-live="polite"></p>"#,
                tx(r, "passkeys.name"),
                tx(r, "passkeys.failed"),
                tx(r, "passkeys.unsupported"),
                tx(r, "passkeys.add")
            )
        }));
    }
    Ok(page("manage.passkeys").body(body))
}

/// An external login of the signed in user.
#[derive(Clone, Debug, Default, Serialize, Deserialize)]
pub struct LoginRef {
    pub provider: String,
    pub key: String,
}

/// Unlinks an external login, unless it is the last way to sign in.
#[action(public, reauth, ai = false)]
pub async fn account_remove_login(login: LoginRef, accounts: Accounts) -> Result<Next> {
    let mut user = me(&accounts).await?;
    accounts
        .users()
        .remove_login(&mut user, &login.provider, &login.key)
        .await?;
    accounts
        .sign_in()
        .refresh_sign_in(&user)
        .await?;
    go(path("/account/manage/logins"), false)
}

#[screen(route = "/account/manage/logins", public)]
pub async fn account_logins(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    let logins = accounts.users().logins(&user).await?;
    let mut body = Stack::new().add(manage_nav("/account/manage/logins"));
    if logins.is_empty() {
        body = body.add(EmptyState::new(t!("zeyn.accounts.logins.none")));
    }
    let linked: Vec<String> = logins
        .iter()
        .map(|l| l.provider.clone())
        .collect();
    for l in logins {
        let label = format!(
            "{} {}",
            l.provider,
            l.display_name
                .clone()
                .unwrap_or_default()
        );
        body = body.add(
            Row::new()
                .col(markup(move |_| format!("<p>{}</p>", escape(&label))))
                .col(
                    ActionButton::new(
                        t!("zeyn.accounts.logins.remove"),
                        account_remove_login,
                        LoginRef {
                            provider: l.provider,
                            key: l.provider_key,
                        },
                    )
                    .confirm(t!("zeyn.accounts.logins.remove_confirm"))
                    .on_success(next_effect),
                ),
        );
    }
    let available: Vec<String> = accounts
        .external_names()
        .into_iter()
        .filter(|p| !linked.contains(p))
        .collect();
    if !available.is_empty() {
        let prefix = scope::prefix();
        body = body.add(markup(move |r| {
            let items: String = available
                .iter()
                .map(|p| format!(r#"<li><a class="z-button" href="{0}/_zeyn/account/external/{1}?link=1&amp;return_to={2}">{3} {1}</a></li>"#, escape(&prefix), escape(p), super::pct(&format!("{prefix}/account/manage/logins")), tx(r, "logins.add")))
                .collect();
            format!(r#"<ul class="z-account-providers">{items}</ul>"#)
        }));
    }
    Ok(page("manage.logins").body(body))
}

/// Confirms deleting the account.
#[model]
pub struct AccountDelete {
    #[rule(max_len = 1024)]
    pub password: String,
}

/// Deletes the account and its data, after the password when the user has one.
#[action(public, ai = false)]
pub async fn account_delete(input: Valid<AccountDelete>, accounts: Accounts) -> Result<Next> {
    let mut user = me(&accounts).await?;
    accounts.sign_in().throttle_ip().await?;
    if user.password_hash.is_some()
        && !accounts
            .users()
            .check_password(&mut user, &input.password)
            .await?
    {
        return Err(invalid("password", "password_mismatch"));
    }
    accounts.users().delete(&user).await?;
    accounts
        .sign_in()
        .sign_out(Some(&user.id));
    go(
        with_params("/account/login", json!({ "notice": "deleted" })),
        true,
    )
}

#[screen(route = "/account/manage/personal-data", public)]
pub async fn account_personal_data(_: (), accounts: Accounts) -> Result<Screen> {
    let user = me(&accounts).await?;
    let download = path("/_zeyn/account/manage/personalData");
    let mut form = Form::of(AccountDelete::default());
    if user.password_hash.is_some() {
        form = form
            .field(AccountDelete::password)
            .control(AccountDelete::password, Control::Password);
    }
    Ok(page("manage.personal_data").body(
        Stack::new()
            .add(manage_nav("/account/manage/personal-data"))
            .add(para("zeyn.accounts.data.intro"))
            .add(markup(move |r| {
                format!(
                    r#"<p><a class="z-button" href="{}" download>{}</a></p>"#,
                    escape(&download),
                    tx(r, "data.download")
                )
            }))
            .add(Alert::danger(t!("zeyn.accounts.data.delete_warning")))
            .add(
                form.submit(t!("zeyn.accounts.data.delete"), account_delete)
                    .on_success(next_effect),
            ),
    ))
}

/// A user as the administration lists it: no hashes, stamps or keys.
#[model]
pub struct AccountUserRow {
    #[readonly]
    pub id: String,
    pub user_name: String,
    pub email: String,
    pub email_confirmed: bool,
    pub two_factor: bool,
    pub locked: bool,
    pub roles: String,
}

/// Users for the administration grid.
#[action(permission = "accounts.users.read", ai = false)]
pub async fn account_admin_list(q: DataQuery, accounts: Accounts) -> Result<Page<AccountUserRow>> {
    let (offset, limit) = match q.page {
        crate::action::PageRequest::Offset { offset, limit } => (offset, limit),
        crate::action::PageRequest::After { limit, .. } => (0, limit),
    };
    let search = q
        .filters
        .iter()
        .find(|f| !f.contains.is_empty())
        .map(|f| f.contains.clone());
    let (users, total) = accounts
        .users()
        .list(search.as_deref(), offset, limit.min(crate::MAX_PAGE_SIZE))
        .await?;
    let mut rows = Vec::with_capacity(users.len());
    for u in users {
        let roles = accounts
            .users()
            .roles(&u)
            .await?
            .join(", ");
        rows.push(AccountUserRow {
            locked: u.is_locked_out(super::now_secs()),
            id: u.id,
            user_name: u.user_name,
            email: u.email.unwrap_or_default(),
            email_confirmed: u.email_confirmed,
            two_factor: u.two_factor_enabled,
            roles,
        });
    }
    Ok(Page::new(rows).total(total))
}

async fn admin_user(accounts: &Accounts, id: &str) -> Result<User> {
    accounts
        .users()
        .find_by_id(id)
        .await?
        .ok_or(Error::NotFound)
}

/// Locks a user out for a hundred years and signs out their sessions.
#[action(permission = "accounts.users.write", audit, ai = false)]
pub async fn account_admin_lock(id: String, accounts: Accounts) -> Result<()> {
    let mut user = admin_user(&accounts, &id).await?;
    user.lockout_enabled = true;
    accounts
        .users()
        .set_lockout_end(&mut user, Some(super::now_secs() + 100 * 365 * 86_400))
        .await?;
    accounts
        .users()
        .update_security_stamp(&mut user)
        .await
}

/// Ends a lockout.
#[action(permission = "accounts.users.write", audit, ai = false)]
pub async fn account_admin_unlock(id: String, accounts: Accounts) -> Result<()> {
    let mut user = admin_user(&accounts, &id).await?;
    user.lockout_enabled = true;
    accounts
        .users()
        .set_lockout_end(&mut user, None)
        .await
}

/// Sends the user a password reset link.
#[action(permission = "accounts.users.write", audit, ai = false)]
pub async fn account_admin_reset(id: String, accounts: Accounts, ctx: Ctx) -> Result<()> {
    let user = admin_user(&accounts, &id).await?;
    let to = user
        .email
        .clone()
        .ok_or_else(|| invalid("email", "invalid_email"))?;
    let code = accounts
        .users()
        .generate_password_reset_token(&user);
    let link = crate::server::accounts::screen_link(
        &accounts,
        "/account/reset-password",
        &json!({ "user": user.id, "code": code }),
    );
    accounts
        .0
        .sender
        .send(&ctx, &to, super::AccountMessage::ResetPassword { link })
        .await
}

#[screen(route = "/account/admin/users", permission = "accounts.users.read")]
pub fn account_admin_users(_: ()) -> Screen {
    page("admin.users").body(
        DataGrid::of(account_admin_list)
            .mode(DataMode::Server)
            .column(AccountUserRow::user_name)
            .filter()
            .column(AccountUserRow::email)
            .column(AccountUserRow::email_confirmed)
            .column(AccountUserRow::two_factor)
            .column(AccountUserRow::locked)
            .column(AccountUserRow::roles)
            .row_action(
                t!("zeyn.accounts.admin.lock"),
                account_admin_lock,
                |u: &AccountUserRow| u.id.clone(),
            )
            .row_action(
                t!("zeyn.accounts.admin.unlock"),
                account_admin_unlock,
                |u: &AccountUserRow| u.id.clone(),
            )
            .row_action(
                t!("zeyn.accounts.admin.reset"),
                account_admin_reset,
                |u: &AccountUserRow| u.id.clone(),
            )
            .on_open(|u| Window::open(account_admin_user_roles, UserParams { id: u.id.clone() })),
    )
}

/// The user an administration window edits.
#[params]
pub struct UserParams {
    pub id: String,
}

/// A user's roles, comma separated.
#[model]
pub struct AccountUserRoles {
    #[readonly]
    pub id: String,
    #[rule(max_len = 2000)]
    pub roles: String,
}

/// Sets a user's roles to the listed ones (which must exist).
#[action(permission = "accounts.users.write", audit, ai = false)]
pub async fn account_admin_save_roles(
    input: Valid<AccountUserRoles>,
    accounts: Accounts,
) -> Result<()> {
    let mut user = admin_user(&accounts, &input.id).await?;
    let wanted: Vec<String> = input
        .roles
        .split(',')
        .map(str::trim)
        .filter(|r| !r.is_empty())
        .map(str::to_string)
        .collect();
    for name in &wanted {
        if !accounts.roles().exists(name).await? {
            return Err(invalid("roles", "unknown_role"));
        }
    }
    let current = accounts.users().roles(&user).await?;
    for r in &current {
        if !wanted
            .iter()
            .any(|w| super::normalize(w) == super::normalize(r))
        {
            accounts
                .users()
                .remove_from_role(&mut user, r)
                .await?;
        }
    }
    for w in &wanted {
        if !current
            .iter()
            .any(|r| super::normalize(w) == super::normalize(r))
        {
            accounts
                .users()
                .add_to_role(&mut user, w)
                .await?;
        }
    }
    Ok(())
}

#[screen(permission = "accounts.users.write")]
pub async fn account_admin_user_roles(p: UserParams, accounts: Accounts) -> Result<Screen> {
    let user = admin_user(&accounts, &p.id).await?;
    let roles = accounts
        .users()
        .roles(&user)
        .await?
        .join(", ");
    Ok(
        Screen::window(Text::Literal(user.user_name.clone().into())).body(
            Form::of(AccountUserRoles { id: user.id, roles })
                .field(AccountUserRoles::roles)
                .submit(t!("zeyn.accounts.save"), account_admin_save_roles)
                .on_success(|_, ui| ui.close_and_refresh()),
        ),
    )
}

/// A role in the administration.
#[model]
pub struct AccountRoleRow {
    #[readonly]
    pub id: String,
    #[rule(required, max_len = 254)]
    pub name: String,
    pub permissions: String,
}

/// Roles for the administration grid.
#[action(permission = "accounts.roles.write", ai = false)]
pub async fn account_admin_role_list(
    q: DataQuery,
    accounts: Accounts,
) -> Result<Page<AccountRoleRow>> {
    let (offset, limit) = match q.page {
        crate::action::PageRequest::Offset { offset, limit } => (offset, limit),
        crate::action::PageRequest::After { limit, .. } => (0, limit),
    };
    let (roles, total) = accounts
        .roles()
        .list(offset, limit)
        .await?;
    let mut rows = Vec::with_capacity(roles.len());
    for r in roles {
        let claims = accounts.roles().claims(&r).await?;
        let permissions = claims
            .into_iter()
            .filter(|c| c.kind == "permission")
            .map(|c| c.value)
            .collect::<Vec<_>>()
            .join(", ");
        rows.push(AccountRoleRow {
            id: r.id,
            name: r.name,
            permissions,
        });
    }
    Ok(Page::new(rows).total(total))
}

/// Creates a role with permission claims (comma separated).
#[action(permission = "accounts.roles.write", audit, ai = false)]
pub async fn account_admin_create_role(
    input: Valid<AccountRoleRow>,
    accounts: Accounts,
) -> Result<()> {
    let role = accounts
        .roles()
        .create(&input.name)
        .await?;
    for p in input
        .permissions
        .split(',')
        .map(str::trim)
        .filter(|p| !p.is_empty())
    {
        accounts
            .roles()
            .add_claim(&role, super::Claim::new("permission", p))
            .await?;
    }
    Ok(())
}

/// Deletes a role; its users lose it.
#[action(permission = "accounts.roles.write", audit, ai = false)]
pub async fn account_admin_delete_role(id: String, accounts: Accounts) -> Result<()> {
    let role = accounts
        .roles()
        .find_by_id(&id)
        .await?
        .ok_or(Error::NotFound)?;
    accounts.roles().delete(&role).await
}

#[screen(route = "/account/admin/roles", permission = "accounts.roles.write")]
pub fn account_admin_roles(_: ()) -> Screen {
    page("admin.roles").body(
        Stack::new()
            .add(
                DataGrid::of(account_admin_role_list)
                    .mode(DataMode::Server)
                    .column(AccountRoleRow::name)
                    .column(AccountRoleRow::permissions)
                    .row_action(
                        t!("zeyn.accounts.admin.delete_role"),
                        account_admin_delete_role,
                        |r: &AccountRoleRow| r.id.clone(),
                    ),
            )
            .add(
                Form::of(AccountRoleRow::default())
                    .field(AccountRoleRow::name)
                    .field(AccountRoleRow::permissions)
                    .submit(
                        t!("zeyn.accounts.admin.create_role"),
                        account_admin_create_role,
                    )
                    .on_success(|_, ui| {
                        ui.effect(Effect::go(&path("/account/admin/roles"), false))
                    }),
            ),
    )
}

/// The account for a first sign in with an external provider.
#[cfg(feature = "oidc")]
#[model]
pub struct AccountExternal {
    #[rule(required, email, max_len = 254)]
    pub email: String,
}

/// Creates an account for the pending external sign in, links the login and signs in. An address
/// that already has an account is refused: sign in there and link the provider from the manage
/// screen, so nobody takes over an account through a provider.
#[cfg(feature = "oidc")]
#[action(public, ai = false)]
pub async fn account_external_create(
    input: Valid<AccountExternal>,
    accounts: Accounts,
) -> Result<Next> {
    use crate::server::accounts::{EXTERNAL_PENDING, External};
    let pending = scope::cookie(EXTERNAL_PENDING)
        .and_then(|v| {
            accounts
                .0
                .sealer
                .as_ref()?
                .open::<External>(EXTERNAL_PENDING, &v)
        })
        .filter(|e| e.expires > super::now_secs());
    let Some(p) = pending else {
        return Err(denied("external_expired"));
    };
    if accounts
        .users()
        .find_by_name_or_email(&input.email)
        .await?
        .is_some()
    {
        return Err(invalid("email", "external_email_taken"));
    }
    let mut user = User::new(&input.email).with_email(&input.email);
    user.email_confirmed = p.verified
        && p.email
            .as_deref()
            .is_some_and(|e| super::normalize(e) == super::normalize(&input.email));
    let mut user = accounts
        .users()
        .create(user, None)
        .await?;
    accounts
        .users()
        .add_login(
            &mut user,
            super::UserLogin {
                provider: p.provider.clone(),
                provider_key: p.key,
                display_name: p.email.clone(),
            },
        )
        .await?;
    scope::set_cookie(EXTERNAL_PENDING, None, None);
    accounts.event(super::AccountEventKind::Registered, Some(&user.id));
    if !accounts.sign_in().can_sign_in(&user) {
        return go(path("/account/check-email"), false);
    }
    accounts
        .sign_in()
        .sign_in(&user, false, &p.provider, false)
        .await?;
    go(back(&p.return_to), true)
}

#[cfg(feature = "oidc")]
#[screen(route = "/account/external-login", public)]
pub fn account_external_login(_: (), accounts: Accounts) -> Screen {
    use crate::server::accounts::{EXTERNAL_PENDING, External};
    let pending = scope::cookie(EXTERNAL_PENDING)
        .and_then(|v| {
            accounts
                .0
                .sealer
                .as_ref()?
                .open::<External>(EXTERNAL_PENDING, &v)
        })
        .filter(|e| e.expires > super::now_secs());
    let Some(p) = pending else {
        return page("external.title").body(
            Stack::new()
                .add(Alert::warning(t!("zeyn.accounts.error.external_expired")))
                .add(link("register.login", "/account/login")),
        );
    };
    let provider = p.provider.clone();
    page("external.title").body(
        Stack::new()
            .add(markup(move |r| {
                format!(
                    "<p>{} <strong>{}</strong></p>",
                    tx(r, "external.intro"),
                    escape(&provider)
                )
            }))
            .add(
                Form::of(AccountExternal {
                    email: p.email.unwrap_or_default(),
                })
                .field(AccountExternal::email)
                .submit(t!("zeyn.accounts.external.submit"), account_external_create)
                .on_success(next_effect),
            ),
    )
}