{{define "content"}}
{{$viewer := .Content.Viewer}}
{{$grantable := .Content.Grantable}}
<h1>Members</h1>

<table>
<thead><tr><th>Member</th><th>Role</th><th>Status</th><th>Actions</th></tr></thead>
<tbody>
{{range .Content.Members}}
<tr>
<td>{{.Email}}{{if .Name}} ({{.Name}}){{end}}</td>
<td>{{.Role.Title}}</td>
<td>{{if .Active}}Active{{else}}Removed{{end}}</td>
<td>
{{if mayActOn $viewer .}}
{{/* The role selector is built from Grantable, never from the three
     role constants. An Admin may grant only Member — idear refuses a
     grant that is not strictly below the granter's own rank — so a
     selector offering Admin to an Admin would 403 on every submit,
     and one offering Owner would 403 for everybody including the
     Owner. Hiding a control is never the enforcement; the store
     refuses either way. */}}
{{if $grantable}}
<form method="post" action="/members/{{.ID}}/role">
<select name="role" aria-label="Role">
{{range $grantable}}<option value="{{.}}">{{.Title}}</option>{{end}}
</select>
<button type="submit">Set role</button>
</form>
{{end}}
{{if .Active}}
<form method="post" action="/members/{{.ID}}/remove"><button type="submit">Remove</button></form>
{{else}}
<form method="post" action="/members/{{.ID}}/restore"><button type="submit">Restore</button></form>
{{end}}
{{end}}
</td>
</tr>
{{end}}
</tbody>
</table>

{{if $grantable}}
<h2>Invite someone</h2>
<form method="post" action="/members/invitations">
<label>Email <input type="email" name="email" required></label>
<select name="role" aria-label="Role">
{{range $grantable}}<option value="{{.}}">{{.Title}}</option>{{end}}
</select>
<button type="submit">Invite</button>
</form>
{{end}}

{{with .Content.Invitations}}
<h2>Pending invitations</h2>
<ul>
{{range .}}
<li>{{.Email}} — {{.Role.Title}}
<form method="post" action="/members/invitations/{{.ID}}/revoke"><button type="submit">Revoke</button></form>
</li>
{{end}}
</ul>
{{end}}

{{if .Content.IsOwner}}
<h2>Transfer ownership</h2>
{{/* The only path to Owner. idear demotes the outgoing Owner and
     promotes the incoming one in one transaction, so the instance is
     never left with two Owners or none — and role=owner is refused on
     every other route, for every actor. */}}
<form method="post" action="/members/transfer">
<select name="member" aria-label="New owner">
{{range .Content.Members}}{{if and .Active (ne .ID $viewer.ID)}}<option value="{{.ID}}">{{.Email}}</option>{{end}}{{end}}
</select>
<button type="submit">Transfer ownership</button>
</form>
{{end}}
{{end}}