bazaar-compute-node 0.2.1rc7__tar.gz → 0.2.1rc8__tar.gz

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bazaar-compute-node
-Version: 0.2.1rc7
+Version: 0.2.1rc8
 Summary: Runtime-agnostic computer node daemon for agents and channels.
 License-Expression: AGPL-3.0-only
 License-File: LICENSE

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc7"
+version = "0.2.1rc8"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "bazaar-compute-node"
-version = "0.2.1rc7"
+version = "0.2.1rc8"
 description = "Runtime-agnostic computer node daemon for agents and channels."
 readme = "README.md"
 license = "AGPL-3.0-only"

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/contrib/sqlite/storage.py

@@ -15,7 +15,7 @@ from uuid import uuid7
 import aiosqlite
 
 from ...clock import now_ms
-from ...permissions import Permission
+from ...permissions import SHARE_POINTS, Permission
 from ...protocol import Event
 from ...secrets import derive, hash_secret, new_secret, verify_secret
 from ...storage import (
@@ -514,7 +514,7 @@ class SqliteStorage(IStorage):
     async def allowed_targets(
         self, account_id: str, kind: str, point: Permission
     ) -> set[str]:
-        """Ownership and the union of role grants, including explicit computer-to-agent grants."""
+        """Ownership and grants explicitly attached to this resource kind."""
         account = await self.get_account(account_id)
         if account is None:
             return set()
@@ -537,26 +537,15 @@ class SqliteStorage(IStorage):
                 (account_id, f"{kind}_owner"),
             ) as rows:
                 targets = {row["target_id"] async for row in rows}
+            if point not in SHARE_POINTS[kind]:
+                return targets
             async with db.execute(
-                "SELECT kind,target_id,ext FROM relations WHERE subject_id IN (SELECT role_id FROM account_roles WHERE account_id=?) AND kind IN (?,?)",
-                (account_id, f"{kind}_share_role", "computer_share_role"),
+                "SELECT target_id,ext FROM relations WHERE subject_id IN (SELECT role_id FROM account_roles WHERE account_id=?) AND kind=?",
+                (account_id, f"{kind}_share_role"),
             ) as rows:
-                grants = await rows.fetchall()
-            computers = set()
-            for grant in grants:
-                if point not in json.loads(grant["ext"])["permissions"]:
-                    continue
-                if grant["kind"] == f"{kind}_share_role":
-                    targets.add(grant["target_id"])
-                elif kind == "agent":
-                    computers.add(grant["target_id"])
-            if computers:
-                async with db.execute(
-                    "SELECT target_id,ext FROM relations WHERE kind='agent_owner'"
-                ) as rows:
-                    async for row in rows:
-                        if json.loads(row["ext"])["computer_id"] in computers:
-                            targets.add(row["target_id"])
+                async for row in rows:
+                    if point in json.loads(row["ext"])["permissions"]:
+                        targets.add(row["target_id"])
             return targets
 
     # ---- accounts --------------------------------------------------------

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/fleet.py

@@ -219,7 +219,7 @@ async def _views(
     visible = await access.visible("agent", [agent.id for agent in agents_of(views)])
     computer_actions = {
         point: await access.targets("computer", point)
-        for point in SHARE_POINTS["computer"]
+        for point in (*SHARE_POINTS["computer"], Permission.COMPUTERS_SHARE)
     }
     agent_actions = {
         point: await access.targets("agent", point) for point in SHARE_POINTS["agent"]

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/pages/computers.py

@@ -19,6 +19,7 @@ from ..protocol import MAX_NAME_CHARS
 from ..refs import Refs, expanded
 from ..rendering import Renderer
 from ..storage import IStorage
+from .shares import SharePages
 
 
 class ComputerPages:
@@ -71,6 +72,15 @@ class ComputerPages:
         self, request: Request, page: Fleet, selected: ComputerView | None, *, view: str
     ) -> Response:
         await self.refs.load(_named(page.computers, selected))
+        context = {}
+        if (
+            selected is not None
+            and request.query_params.get("tab") == "sharing"
+            and Permission.COMPUTERS_SHARE in selected.actions
+        ):
+            context = await SharePages(self._storage, self._render, self.refs).context(
+                request, "computer", selected.computer.id
+            )
         return self._render.page(
             request,
             "computers",
@@ -83,6 +93,7 @@ class ComputerPages:
             else str(self.refs.ref(selected.computer.id)),
             enrolment=None,
             view=view,
+            **context,
         )
 
     @allowed(Permission.COMPUTERS_VIEW)
@@ -127,7 +138,17 @@ class ComputerPages:
         selected = await self._selected(request)
         if selected is None:
             return HTMLResponse("", status_code=404)
-        return self._render.fragment(request, "computer_detail.html", selected=selected)
+        context = {}
+        if (
+            request.query_params.get("tab") == "sharing"
+            and Permission.COMPUTERS_SHARE in selected.actions
+        ):
+            context = await SharePages(self._storage, self._render, self.refs).context(
+                request, "computer", selected.computer.id
+            )
+        return self._render.fragment(
+            request, "computer_detail.html", selected=selected, **context
+        )
 
     @expanded("computer_id")
     @allowed(Permission.COMPUTERS_VIEW, "computer")

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/pages/profile.py

@@ -352,9 +352,9 @@ class ProfilePages:
         """What one tab shows."""
 
         if tab == "sharing":
-            return await SharePages(
-                self._storage, self._render, self.refs
-            ).agent_context(request)
+            return await SharePages(self._storage, self._render, self.refs).context(
+                request, "agent", request.path_params["agent_id"]
+            )
         if tab == "config":
             agents, reply = await asyncio.gather(
                 held(

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/pages/shares.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 from typing import Any
 
-from pydantic import BaseModel, Field, ValidationError
+from pydantic import BaseModel, ValidationError
 from starlette.requests import Request
 from starlette.responses import HTMLResponse, Response
 
@@ -15,11 +15,6 @@ from ..rendering import Renderer
 from ..storage import IStorage
 
 
-class ShareForm(BaseModel):
-    role: str
-    permissions: list[Permission] = Field(default_factory=list)
-
-
 class ShareChanges(BaseModel):
     grants: dict[str, frozenset[Permission]]
 
@@ -46,7 +41,10 @@ class SharePages:
         target_id = request.path_params["agent_id"]
         if not await access.can_share("agent", target_id):
             return HTMLResponse("", status_code=404)
-        context = await self.agent_context(request)
+        return await self._handle(request, "agent", target_id)
+
+    async def _handle(self, request: Request, kind: str, target_id: str) -> Response:
+        context = await self.context(request, kind, target_id)
         error = None
         if request.method == "POST":
             form = await request.form()
@@ -64,92 +62,46 @@ class SharePages:
                 else:
                     try:
                         await self._storage.save_role_shares(
-                            "agent", target_id, values.grants, points
+                            kind, target_id, values.grants, points
                         )
                     except LookupError:
                         error = "shares.invalid"
                     else:
-                        context = await self.agent_context(request)
+                        context = await self.context(request, kind, target_id)
         context["error"] = error
-        return self._render.fragment(request, "agent_profile_sharing.html", **context)
+        return self._render.fragment(request, "shares.html", **context)
 
-    async def agent_context(self, request: Request) -> dict[str, Any]:
+    async def context(
+        self, request: Request, kind: str, target_id: str
+    ) -> dict[str, Any]:
         access = Access.of(request)
-        target_id = request.path_params["agent_id"]
         points = [
             point
-            for point in SHARE_POINTS["agent"]
-            if await access.can("agent", target_id, point)
+            for point in SHARE_POINTS[kind]
+            if await access.can(kind, target_id, point)
         ]
         roles = await self._storage.list_roles()
-        shares = await self._storage.list_role_shares("agent", target_id)
+        shares = await self._storage.list_role_shares(kind, target_id)
         grants = {
             share.role_id: sorted(share.permissions & set(points)) for share in shares
         }
+        key = self.refs.ref(target_id)
+        url = (
+            f"/computers/{key}/shares"
+            if kind == "computer"
+            else f"/agents/{self.refs.ref(request.path_params['computer_id'])}/{key}/shares"
+        )
         return {
             "points": points,
+            "share_kind": kind,
+            "share_id": f"computer-sharing-{key}"
+            if kind == "computer"
+            else "agent-sharing",
             "share_data": {
                 "roles": [{"id": role.id, "name": role.name} for role in roles],
                 "grants": grants,
+                "default": f"{kind}s.view",
             },
-            "share_url": f"/agents/{self.refs.ref(request.path_params['computer_id'])}/{self.refs.ref(target_id)}/shares",
+            "share_url": url,
             "error": None,
         }
-
-    async def _handle(self, request: Request, kind: str, target_id: str) -> Response:
-        access = Access.of(request)
-        roles = await self._storage.list_roles()
-        points = [
-            point
-            for point in SHARE_POINTS[kind]
-            if await access.can(kind, target_id, point)
-        ]
-        error = None
-        saved = False
-        selected = request.query_params.get("role")
-        if request.method == "POST":
-            form = await request.form()
-            try:
-                values = ShareForm.model_validate(
-                    {
-                        "role": form.get("role"),
-                        "permissions": form.getlist("permissions"),
-                    }
-                )
-            except ValidationError:
-                error = "shares.invalid"
-            else:
-                selected = values.role
-                if selected not in {role.id for role in roles} or not set(
-                    values.permissions
-                ) <= set(points):
-                    error = "shares.invalid"
-                else:
-                    try:
-                        await self._storage.save_role_shares(
-                            kind,
-                            target_id,
-                            {selected: frozenset(values.permissions)},
-                            frozenset(points),
-                        )
-                    except LookupError:
-                        error = "shares.invalid"
-                    else:
-                        saved = True
-        if selected is None and roles:
-            selected = roles[0].id
-        if selected is not None and selected not in {role.id for role in roles}:
-            return HTMLResponse("", status_code=404)
-        shares = await self._storage.list_role_shares(kind, target_id)
-        return self._render.fragment(
-            request,
-            "shares.html",
-            kind=kind,
-            roles=roles,
-            selected=selected,
-            points=points,
-            grants={share.role_id: share.permissions for share in shares},
-            url=request.url.path,
-            error=error,
-            saved=saved,
-        )

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/permissions.py

@@ -74,16 +74,16 @@ POLL_HANDLERS = MappingProxyType(
 
 SHARE_POINTS = MappingProxyType(
     {
-        "computer": tuple(
-            point
-            for point in Permission
-            if point.module in ("computers", "agents")
-            and point != Permission.COMPUTERS_CREATE
+        "computer": (
+            Permission.COMPUTERS_VIEW,
+            Permission.AGENTS_CREATE,
+            Permission.COMPUTERS_DELETE,
         ),
-        "agent": tuple(
-            point
-            for point in Permission
-            if point.module == "agents" and point != Permission.AGENTS_CREATE
+        "agent": (
+            Permission.AGENTS_VIEW,
+            Permission.AGENTS_UPDATE,
+            Permission.AGENTS_DELETE,
+            Permission.AGENTS_APPROVE,
         ),
     }
 )

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/resources/locales/en.toml

@@ -436,3 +436,5 @@
 
 "error.403.title" = "Access denied"
 "error.403.text" = "Your account does not have permission to access this page. Choose an available module from the navigation."
+
+"computers.overview" = "Overview"

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/resources/locales/zh-CN.toml

@@ -436,3 +436,5 @@
 
 "error.403.title" = "无权限访问"
 "error.403.text" = "你的账号没有访问此页面的权限，请通过导航进入可访问的模块。"
+
+"computers.overview" = "概览"

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/resources/static/app.css

@@ -742,9 +742,6 @@ a:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outlin
 
 
 .config > fieldset { border: 0; margin: 0; padding: 0; min-width: 0; }
-#sharing .sheet { padding: 16px; overflow-y: auto; }
-#sharing .sheet h3 { padding: 0 0 10px; }
-#sharing .sheet .foot { padding: 12px 0 0; }
 
 .role-default { display: flex; align-items: baseline; flex-wrap: wrap; gap: 8px 12px; margin: 12px 0 20px 82px; color: var(--muted); font-size: .9em; }
 
@@ -785,8 +782,8 @@ a:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outlin
 
 .login-identity small { color: var(--muted); font-size: 12px; }
 
-/* Role sharing is edited as one batch in the agent's own tab. */
-.agent-sharing { max-width: 980px; }
+/* Role sharing is edited as one batch in each resource's sharing tab. */
+.role-sharing { max-width: 980px; }
 .share-permissions { margin: 0; padding: 0; border: 0; }
 .share-permissions legend { margin-bottom: 14px; padding: 0; color: var(--fg); font-weight: 600; }
 .share-hint, .share-summary, .share-empty { color: var(--muted); font-size: 12px; }
@@ -796,7 +793,7 @@ a:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outlin
 .share-list-head { height: 58px; display: flex; align-items: center; gap: 12px; padding: 14px; background: var(--float); border-bottom: 1px solid var(--line); font-weight: 600; }
 .share-search { display: block; width: calc(100% - 24px); margin: 12px; border: 1px solid var(--edge); border-radius: var(--r-sm); background: var(--input); color: var(--fg); padding: 7px 9px; font: inherit; }
 .share-search:focus { outline: none; border-color: var(--accent); }
-.agent-sharing .btn:disabled { opacity: .4; cursor: default; }
+.role-sharing .btn:disabled { opacity: .4; cursor: default; }
 .share-select-all { margin: 0 14px 10px; color: var(--muted); }
 .share-rows { height: 220px; overflow: auto; }
 .share-role { display: flex; align-items: center; gap: 10px; padding: 12px 14px; cursor: pointer; }

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/resources/static/components.js

@@ -128,7 +128,7 @@ document.addEventListener('alpine:init', () => {
       this.original = data.grants;
       this.grants = structuredClone(data.grants);
       this.labels = Object.fromEntries([...this.$el.querySelectorAll('[data-point]')].map(el => [el.dataset.point, el.textContent]));
-      this.permissions = Object.keys(this.labels).filter(point => point === 'agents.view');
+      this.permissions = Object.keys(this.labels).filter(point => point === data.default);
       this.leaveHandler = event => {
         if (!this.dirty || this.saving || !(event.target instanceof Element)) return;
         const navigation = event.target.closest('a[href], .tab[hx-get]');

bazaar_compute_node-0.2.1rc8/src/bazaar_compute_server/resources/templates/agent_profile_sharing.html

@@ -0,0 +1 @@
+{% include "shares.html" %}

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/resources/templates/computer_detail.html

@@ -1,10 +1,20 @@
 {% import "components.html" as c with context %}
-<div id="computer-view" hx-get="/computers/{{ ref(selected.computer.id) }}/detail" hx-trigger="poll-refresh, agents-changed from:body" x-poll data-poll='{{ poll("computer", selected)|tojson }}' x-data="computerState" data-computer='{{ poll("computer-state", selected)|tojson }}' hx-swap="outerMorph">
+{% set sharing = share_data is defined %}
+{% set base = "/computers/" ~ ref(selected.computer.id) %}
+<div id="computer-view" hx-get="/computers/{{ ref(selected.computer.id) }}/detail{% if sharing %}?tab=sharing{% endif %}" hx-trigger="poll-refresh, agents-changed from:body" x-poll data-poll='{{ poll("computer", selected)|tojson }}' x-data="computerState" data-computer='{{ poll("computer-state", selected)|tojson }}' hx-swap="outerMorph">
 {% call c.column_header(selected.computer.name, back="/computers") %}
   <span class="sub">{% if selected.system in c.os_icons %}<span class="os" title="{{ t.text("system." ~ selected.system) if t.has("system." ~ selected.system) else selected.system }}">{{ c.icon(c.os_icons[selected.system]) }}</span>{% endif %}<span x-show="queued" x-text='{{ t.text("computers.queue", {"queued": "{queued}"})|tojson }}.replace("{queued}", queued)'></span></span>
-  {% if permissions.COMPUTERS_SHARE in selected.actions %}<button class="btn" type="button" hx-get="/computers/{{ ref(selected.computer.id) }}/shares" x-bind="opener" hx-target="#sharing" hx-swap="outerHTML">{{ t.text("shares.computer") }}</button>{% endif %}
 {% endcall %}
+{% if permissions.COMPUTERS_SHARE in selected.actions %}
+<div class="switch text">
+  <button class="tab{% if not sharing %} on{% endif %}" type="button" hx-get="{{ base }}" hx-target="#main" hx-swap="innerHTML" hx-push-url="true">{{ t.text("computers.overview") }}</button>
+  <button class="tab{% if sharing %} on{% endif %}" type="button" hx-get="{{ base }}?tab=sharing" hx-target="#main" hx-swap="innerHTML" hx-push-url="true">{{ t.text("profile_tab.sharing") }}</button>
+</div>
+{% endif %}
 <div class="body">
+{% if sharing %}
+  {% include "shares.html" %}
+{% else %}
   {# the commands that connect a computer just added, shown this once at the
      top of its page; the pane's refresh has no token to show, so the box
      keeps what it holds. the boxes marked to be skipped are named by their
@@ -29,5 +39,6 @@
     <p class="st">{{ t.text("computers.remove_hint") }}</p>
     <button class="btn danger" hx-get="/computers/{{ ref(selected.computer.id) }}/remove" hx-target="#remove-{{ ref(selected.computer.id) }}" hx-swap="outerHTML">{{ c.icon("trash-2") }} {{ t.text("computers.remove") }}</button>
   </div>{% endif %}
+{% endif %}
 </div>
 </div>

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/resources/templates/agent_profile_sharing.html → bazaar_compute_node-0.2.1rc8/src/bazaar_compute_server/resources/templates/shares.html

@@ -1,10 +1,10 @@
 {% import "components.html" as c with context %}
-<div id="agent-sharing" class="agent-sharing" x-data="roleSharing" data-sharing='{{ share_data|tojson }}' data-leave="{{ t.text('shares.leave') }}" @beforeunload.window="if (dirty) { $event.preventDefault(); $event.returnValue = ''; }">
-  <form hx-post="{{ share_url }}" hx-target="#agent-sharing" hx-swap="outerHTML" @submit="saving = true" @htmx:finally:request="saving = false">
+<div id="{{ share_id }}" class="role-sharing"{% if share_kind == "computer" %} hx-morph-skip{% endif %} x-data="roleSharing" data-sharing='{{ share_data|tojson }}' data-leave="{{ t.text('shares.leave') }}" @beforeunload.window="if (dirty) { $event.preventDefault(); $event.returnValue = ''; }">
+  <form hx-post="{{ share_url }}" hx-target="#{{ share_id }}" hx-swap="outerHTML" @submit="saving = true" @htmx:finally:request="saving = false">
     <input type="hidden" name="changes" :value="JSON.stringify({grants: changes})">
     {% if error %}<p class="err" role="alert">{{ t.text(error) }}</p>{% endif %}
     <fieldset class="permission-group share-permissions"><legend>{{ t.text("shares.permissions") }}</legend>
-      {% for point in points %}<label class="check"><input type="checkbox" x-model="permissions" value="{{ point }}"><span>{{ t.text("shares.action." ~ point.value.split('.')[1]) }}</span></label>{% endfor %}
+      {% for point in points %}<label class="check"><input type="checkbox" x-model="permissions" value="{{ point }}"><span>{{ t.text(point if share_kind == "computer" else "shares.action." ~ point.value.split('.')[1]) }}</span></label>{% endfor %}
     </fieldset>
     <p class="share-hint">{{ t.text("shares.transfer_hint") }}</p>
     <div class="share-transfer">
@@ -33,5 +33,5 @@
     </div>
     <div class="share-footer"><span class="share-hint" x-show="dirty" x-cloak>{{ t.text("shares.unsaved") }}</span><div class="share-buttons"><button class="btn" type="button" @click="reset()" :disabled="!dirty || saving">{{ t.text("computers.cancel") }}</button><button class="btn p" type="submit" :disabled="!dirty || saving">{{ t.text("manage.save") }}</button></div></div>
   </form>
-  <div hidden data-labels>{% for point in points %}<span data-point="{{ point }}">{{ t.text("shares.action." ~ point.value.split('.')[1]) }}</span>{% endfor %}</div>
+  <div hidden data-labels>{% for point in points %}<span data-point="{{ point }}">{{ t.text(point if share_kind == "computer" else "shares.action." ~ point.value.split('.')[1]) }}</span>{% endfor %}</div>
 </div>

{bazaar_compute_node-0.2.1rc7 → bazaar_compute_node-0.2.1rc8}/src/bazaar_compute_server/resources/templates/shell.html

@@ -20,7 +20,6 @@
 <body data-build="{{ build }}" x-data="application" x-bind="connection" hx-swap:inherited="innerMorph" hx-headers:inherited='js:{"X-Timezone": Intl.DateTimeFormat().resolvedOptions().timeZone, "X-Build": "{{ build }}"}'>
 <div class="app">
   {% include "rail.html" %}
-  <div id="sharing" hidden></div>
   <div id="main" class="main" :aria-busy="pending.size > 0" x-show="!unreachable">{% include content %}</div>
   {% include "unreachable.html" %}
 </div>

bazaar_compute_node-0.2.1rc7/src/bazaar_compute_server/resources/templates/shares.html

@@ -1,19 +0,0 @@
-{% import "components.html" as c with context %}
-<div class="veil" id="sharing" x-data="dialog(true)" x-bind="dialog" x-cloak @click.self="open = false">
-  <div class="sheet" role="dialog" aria-modal="true" aria-labelledby="sharing-title" x-trap.inert.noscroll="open" tabindex="-1">
-    <h3 id="sharing-title">{{ t.text("shares." ~ kind) }}</h3>
-    <p>{{ t.text("shares.hint") }}</p>
-    {% if error %}<p class="err" role="alert">{{ t.text(error) }}</p>{% endif %}
-    {% if saved %}<p role="status">{{ t.text("shares.saved") }}</p>{% endif %}
-    {% if roles %}
-    <form hx-post="{{ url }}" hx-target="#sharing" hx-swap="outerHTML">
-      <div class="field"><label for="share-role">{{ t.text("shares.role") }}</label><span class="select"><select id="share-role" name="role" hx-get="{{ url }}" hx-trigger="change" hx-target="#sharing" hx-swap="outerHTML">{% for role in roles %}<option value="{{ role.id }}"{% if role.id == selected %} selected{% endif %}>{{ role.name }}{% if role.id in grants %} · {{ t.text("shares.granted") }}{% endif %}</option>{% endfor %}</select>{{ c.icon("chevron-down") }}</span></div>
-      <fieldset class="permission-group"><legend>{{ t.text("roles.permissions") }}</legend>
-        {% for point in points %}<label class="check"><input type="checkbox" name="permissions" value="{{ point }}"{% if point in grants.get(selected, ()) %} checked{% endif %}><span>{{ t.text(point) }}</span></label>{% endfor %}
-      </fieldset>
-      <p>{{ t.text("shares.revoke_hint") }}</p>
-      <div class="foot"><button class="btn" type="button" @click="open = false">{{ t.text("computers.cancel") }}</button><button class="btn p" type="submit">{{ t.text("manage.save") }}</button></div>
-    </form>
-    {% else %}<p>{{ t.text("accounts.no_roles") }}</p><button class="btn" type="button" @click="open = false">{{ t.text("computers.cancel") }}</button>{% endif %}
-  </div>
-</div>