{{define "approvals.html"}} Privatae — approvals {{if not .TrayView}}{{end}}

Waiting for you

What is waiting on your answer: asked of this machine, or by a Host.

{{if not .TrayView}}{{template "nav" "approvals"}}{{end}}
{{template "approvals" .}}
{{end}} {{define "approvals"}} {{if .Flash}}
{{.Flash}}
{{end}} {{if .TrayError}}
{{.TrayError}}
{{end}} {{/* The ids this list was drawn with. The news poll sends them and is told only whether the set has changed since; the list itself stays still. */}}
{{if .DeviceApprovals}}

Waiting for your approval

{{range .DeviceApprovals}}
For {{.Server}} {{.Short}}
{{range .Lines}}

{{.}}

{{end}}
{{if $.Limited}}

Approving signs with this device's key, which is the administrator's: {{$.Admin "ui"}}

{{else}}
{{if .NeedsCode}}{{end}}
{{end}}
{{if .Plan}}

Asked {{.At}}. Approving signs this ship plan with this device's key: each of {{.Server}} runs only its own steps of it, once, within its time. {{if .NeedsCode}}It runs root work, so it needs your code.{{end}} Your host cannot sign it.

{{else}}

Asked {{.At}}. Approving signs it with this device's key: it may run once, on {{.Server}} only, within the hour. Your host cannot sign it.

{{end}}
{{end}} {{if and (gt .NoCodeApprovals 1) (not .Limited)}} {{/* "All" means all SHOWN: the form carries the ids drawn above and nothing else, so an ask that lands after this was drawn is left waiting. A plan that runs root work is never in it: it needs the code, one at a time. */}}
{{range .DeviceApprovals}}{{if not .NeedsCode}}{{end}}{{end}}
{{end}} {{end}} {{if .MachineAsks}}

Asked of this machine

{{range .MachineAsks}}
Request {{.Short}}

{{.Text}}

Asked {{.At}}. Approving takes your code; anything that can drive your browser can click Approve.

{{end}} {{end}} {{if .Approvals}}

Waiting for your code on this machine

{{template "stepup-approvals" .}} {{end}} {{if and (not .DeviceApprovals) (not .Approvals) (not .MachineAsks)}}

Nothing is waiting for your approval.

{{if .TrayView}}

When your Host asks for something on this machine, it shows here and this window asks for a code from the authenticator app enrolled when this machine's bastion was set up.

{{else if and (not .IsDevice) .Pairings}}

This machine is not your approval device, so asks from your hosts are not answered here. Run privatae-bastion device-init on the machine you want to approve from.

{{end}} {{end}}

Checked {{.CheckedAt}}.

{{end}} {{define "approvals-news"}} {{if or .Arrived .Left}}
{{if .Arrived}}{{.Arrived}} new request{{if gt .Arrived 1}}s{{end}} arrived{{end}}{{if and .Arrived .Left}}, and {{end}}{{if .Left}}{{.Left}} {{if gt .Left 1}}were{{else}}was{{end}} answered elsewhere or lapsed{{end}}.
{{end}} {{end}}