{% from 'components.html' import feedback %}
{% from 'components/icons.html' import user_icon, team_icon %}
{# Access management tab: one list of dataset access and inline grant/revoke actions. #}
{% macro export_access(dataset, teams, users, entries, current_csrf, error=none, selected_subject='', concept=false, version_id=none, change_owner_url=none, grant_teams=none, grant_users=none, policy='admin_grants', may_manage=true) -%}
{% set return_to = {'concept': 1 if concept else none, 'version_id': version_id or none} %}
{% set fallback = url_for('dataset_detail', key=dataset.key, concept=true if concept else none, version_id=version_id, tab='access-management', _anchor='access-management') %}
{% set grant_teams = teams if grant_teams is none else grant_teams %}
{% set grant_users = users if grant_users is none else grant_users %}
{% set emails = {} %}{% for user in users %}{% set _ = emails.update({user.id: user.email}) %}{% endfor %}
    <div class='access-management' data-export-access>
      <p class='visually-hidden' data-panel-status tabindex='-1' hidden></p>
      <section aria-labelledby='access-overview-heading'>
        <h3 id='access-overview-heading'>Who has access</h3>
        {% if policy != 'everyone' and may_manage and not entries %}<p class='help-text access-empty-help'>Only the owning team has access. Add a user or team below to give them export access.</p>{% endif %}
        {% if policy == 'everyone' %}<p class='help-text'>All active users can export this dataset and use the API.</p>{% elif not may_manage %}<p class='help-text'>Administrators manage access to this dataset.</p>{% endif %}
        {{ feedback(error, id='governance-error', focus=true) }}
        <div class='access-table-frame'>
        <div class='table-scroll access-table' role='region' aria-label='Dataset access' tabindex='0'>
          <table>
            <caption class='visually-hidden'>Dataset access</caption>
            <thead><tr><th scope='col'>Name</th><th scope='col'>Type</th><th scope='col'>Access</th><th scope='col'><span class='visually-hidden'>Actions</span></th></tr></thead>
            <tbody>
              <tr class='access-owner-row'>
                <td><div class='access-subject'>{{ team_icon() }}<span class='access-subject-name'>{{ dataset.owner_team_name }}</span></div></td>
                <td class='access-owner-type'><span class='badge'>Team</span> <span class='badge badge-identifier'>Owning team</span></td>
                <td><ul class='access-rights' aria-label='View, edit, publish and export'><li><span class='badge badge-subtle'>View</span></li><li><span class='badge badge-subtle'>Edit</span></li><li><span class='badge badge-subtle'>Publish</span></li><li><span class='badge badge-subtle'>Export</span></li></ul></td>
                <td>{% if change_owner_url %}<a class='access-owner-action' href='{{ change_owner_url }}'>Change owning team</a>{% endif %}</td>
              </tr>
              {% if policy != 'everyone' %}{% for entry, display_name in entries %}
                {% set is_team = entry.subject_type == 'team' %}
                <tr data-access-entry>
                  <td><div class='access-subject'>{{ team_icon() if is_team else user_icon() }}<span class='access-subject-name'>{{ display_name }}{% if not is_team and emails.get(entry.subject_id) %}<span class='access-subject-detail'>{{ emails[entry.subject_id] }}</span>{% endif %}</span></div></td>
                  <td><span class='badge'>{{ 'Team' if is_team else 'User' }}</span></td>
                  <td><ul class='access-rights' aria-label='View and export'><li><span class='badge badge-subtle'>View</span></li><li><span class='badge badge-subtle'>Export</span></li></ul></td>
                  <td>
                    {% if may_manage %}<form {{ non_login_form_attrs() }} method='post' action='{{ url_for("revoke_dataset_export_access", key=dataset.key, access_id=entry.id, **return_to) }}' data-confirm='{{ "Team " if is_team else "" }}{{ display_name }} loses export access to this dataset.' data-confirm-title='Remove export access' data-confirm-action='Remove' data-inline-refresh='{{ fallback }}' data-panel-success='Export access removed.' data-panel-success-focus='selection'>
                      <input type='hidden' name='csrf_token' value='{{ current_csrf }}'>
                      <button class='button button-secondary button-table-action button-remove' type='submit' tabindex='0' aria-label='Remove export access for {{ "Team " if is_team else "" }}{{ display_name }}'>Remove</button>
                    </form>{% endif %}
                  </td>
                </tr>
              {% endfor %}{% endif %}
            </tbody>
          </table>
        </div>
        {% if may_manage %}<div class='access-grant-row'>
          <form {{ non_login_form_attrs() }} class='form' novalidate method='post' action='{{ url_for("dataset_export_access", key=dataset.key, **return_to) }}' data-requires-selection data-inline-refresh='{{ fallback }}' data-panel-success='Export access granted.' data-panel-success-focus='selection'>
            <input type='hidden' name='csrf_token' value='{{ current_csrf }}'>
            <div class='form-field'>
              <label class='visually-hidden' for='export-subject'>User or team</label>
              <div class='inline-form-action'>
                <select id='export-subject' name='subject' autocomplete='off' {{ non_login_field_attrs() }} data-select data-noun='users and teams' required{% if error %} aria-describedby='export-subject-error' aria-invalid='true'{% endif %}>
                  <option value=''>Select a user or team</option>
                  <optgroup label='Users'>{% for user in grant_users %}<option value='user:{{ user.id }}'{% if selected_subject == 'user:' ~ user.id %} selected{% endif %}>{{ user.display_name }} ({{ user.email }})</option>{% endfor %}</optgroup>
                  <optgroup label='Teams'>{% for team in grant_teams %}<option value='team:{{ team.id }}'{% if selected_subject == 'team:' ~ team.id %} selected{% endif %}>{{ team.name }}</option>{% endfor %}</optgroup>
                </select>
                <button class='button button-primary' type='submit' tabindex='0'>Grant export access</button>
              </div>
              {% if error %}<p class='error-text' id='export-subject-error'>{{ error }}</p>{% endif %}
            </div>
          </form>
        </div>{% endif %}
        </div>
      </section>
    </div>
{%- endmacro %}