%# BEGIN BPS TAGGED BLOCK {{{
%#
%# COPYRIGHT:
%#
%# This software is Copyright (c) 1996-2026 Best Practical Solutions, LLC
%#                                          <sales@bestpractical.com>
%#
%# (Except where explicitly superseded by other copyright notices)
%#
%#
%# LICENSE:
%#
%# This work is made available to you under the terms of Version 2 of
%# the GNU General Public License. A copy of that license should have
%# been provided with this software, but in any event can be snarfed
%# from www.gnu.org.
%#
%# This work is distributed in the hope that it will be useful, but
%# WITHOUT ANY WARRANTY; without even the implied warranty of
%# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
%# General Public License for more details.
%#
%# You should have received a copy of the GNU General Public License
%# along with this program; if not, write to the Free Software
%# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
%# 02110-1301 or visit their web page on the internet at
%# http://www.gnu.org/licenses/old-licenses/gpl-2.0.html.
%#
%#
%# CONTRIBUTION SUBMISSION POLICY:
%#
%# (The following paragraph is not intended to limit the rights granted
%# to you to modify and distribute this software under the terms of
%# the GNU General Public License and is only of importance to you if
%# you choose to contribute your changes and enhancements to the
%# community by submitting them to Best Practical Solutions, LLC.)
%#
%# By intentionally submitting any modifications, corrections or
%# derivatives to this work, or any other work intended for use with
%# Request Tracker, to Best Practical Solutions, LLC, you confirm that
%# you are the copyright holder for those contributions and you grant
%# Best Practical Solutions,  LLC a nonexclusive, worldwide, irrevocable,
%# royalty-free, perpetual, license to use, copy, create derivative
%# works based on those contributions, and sublicense and distribute
%# those contributions and any derivatives thereof.
%#
%# END BPS TAGGED BLOCK }}}
<& /Admin/Elements/Header, Title => $title &>
<& /Elements/Tabs &>
<& /Elements/ListActions, actions => \@results &>

<form action="<% RT->Config->Get('WebPath') %>/Admin/Groups/PasswordPolicy.html" method="post" class="mx-auto max-width-lg">
  <input type="hidden" name="id" value="<% $Group->Id %>" />

  <&| /Widgets/TitleBox, title => $has_group_policy ? loc('Enforced Password Policy') : loc('Password Policy'), content_class => 'mx-auto width-md' &>

% if ( $has_group_policy ) {
    <div class="alert alert-success mt-3"><&|/l&>This group has a custom password policy.</&></div>
% } else {
    <div class="alert alert-info mt-3"><&|/l&>This group has no custom password policy. Members follow policies from any other groups they belong to, or the global Password Policy configuration if none apply.</&></div>
% }

    <&| /Elements/LabeledValue, Label => '' &>
      <&|/l&>Minimum password length</&>:
      <input type="number" class="form-control d-inline-block password-policy-min-length" name="MinLength" value="<% $has_group_policy ? $policy->{MinLength} // 0 : '' %>" min="0" placeholder="<% loc('Not set') %>" />
      <span class="text-muted">(<&|/l&>set to 0 for no minimum</&>)</span>
    </&>

    <&| /Elements/LabeledValue, Label => '' &>
      <div class="form-check">
        <input type="checkbox" class="form-check-input" id="RequireUpper" name="RequireUpper" value="1" <% $policy->{RequireUpper} ? 'checked="checked"' : ''|n %> />
        <label class="form-check-label" for="RequireUpper"><&|/l&>At least one uppercase letter (A-Z)</&></label>
      </div>
    </&>

    <&| /Elements/LabeledValue, Label => '' &>
      <div class="form-check">
        <input type="checkbox" class="form-check-input" id="RequireLower" name="RequireLower" value="1" <% $policy->{RequireLower} ? 'checked="checked"' : ''|n %> />
        <label class="form-check-label" for="RequireLower"><&|/l&>At least one lowercase letter (a-z)</&></label>
      </div>
    </&>

    <&| /Elements/LabeledValue, Label => '' &>
      <div class="form-check">
        <input type="checkbox" class="form-check-input" id="RequireDigit" name="RequireDigit" value="1" <% $policy->{RequireDigit} ? 'checked="checked"' : ''|n %> />
        <label class="form-check-label" for="RequireDigit"><&|/l&>At least one digit (0-9)</&></label>
      </div>
    </&>

    <&| /Elements/LabeledValue, Label => '' &>
      <div class="form-check">
        <input type="checkbox" class="form-check-input" id="RequireSymbol" name="RequireSymbol" value="1" <% $policy->{RequireSymbol} ? 'checked="checked"' : ''|n %> />
        <label class="form-check-label" for="RequireSymbol"><&|/l&>At least one non-alphanumeric character</&></label>
      </div>
    </&>

    <&| /Elements/LabeledValue, Label => '' &>
      <div class="form-check">
        <input type="checkbox" class="form-check-input" id="NoUsername" name="NoUsername" value="1" <% $policy->{NoUsername} ? 'checked="checked"' : ''|n %> />
        <label class="form-check-label" for="NoUsername"><&|/l&>Password must not contain the user's username</&></label>
      </div>
    </&>

    <& /Elements/Submit, Name => 'UpdatePasswordPolicy', Label => loc('Save Changes'), FullWidth => 1 &>

% if ( $has_group_policy ) {
    <& /Elements/Submit, Name => 'Reset', Label => loc('Clear Group Settings'), FullWidth => 1 &>
% }
  </&>
</form>

<%init>
my @results;

my $Group = RT::Group->new( $session{'CurrentUser'} );
$Group->Load($id);

Abort( loc('Could not load group') ) unless $Group->Id;
Abort( loc('Permission Denied') )   unless $Group->CurrentUserHasRight('AdminGroup');
Abort( loc('Password policies can only be set on user-defined groups') ) unless $Group->Domain eq 'UserDefined';

if ( $ARGS{UpdatePasswordPolicy} ) {
    # An untouched form on a group without a policy must not create an empty
    # policy, which would replace the global one for its members.
    if (   !$Group->PasswordPolicy
        && ( $ARGS{MinLength} // '' ) eq ''
        && !grep { $ARGS{$_} } qw(RequireUpper RequireLower RequireDigit RequireSymbol NoUsername) )
    {
        push @results, loc('Nothing changed');
    }
    else {
        my ( $ok, $msg ) = $Group->SetPasswordPolicy(
            MinLength     => $ARGS{MinLength} || 0,
            RequireUpper  => $ARGS{RequireUpper} ? 1 : 0,
            RequireLower  => $ARGS{RequireLower} ? 1 : 0,
            RequireDigit  => $ARGS{RequireDigit} ? 1 : 0,
            RequireSymbol => $ARGS{RequireSymbol} ? 1 : 0,
            NoUsername    => $ARGS{NoUsername} ? 1 : 0,
        );
        push @results, $msg;
    }
}
elsif ( $ARGS{Reset} ) {
    my ( $ok, $msg ) = $Group->ResetPasswordPolicy();
    push @results, $msg;
}

my $has_group_policy = $Group->PasswordPolicy ? 1 : 0;
my $policy = $Group->PasswordPolicy // {};
my $title = loc( 'Password Policy for [_1]', $Group->Name );
</%init>

<%args>
$id => undef
</%args>