add /knots/{domain} pages

appview/db/db.go

···
 		where domain = ?;
 		`, domain)
 
-	if err != nil {
-		return err
-	}
-
-	return nil
+	return err
 }

appview/pages/knot.html

···
+{{define "title"}}knot{{end}}
+
+{{define "content"}}
+    <a href="/">back to timeline</a>
+    <a href="/knots">back to all knots</a>
+    <h1>{{.Registration.Domain}}</h1>
+    <p>
+      <code>
+        opened by: {{.Registration.ByDid}}
+        {{ if $.IsOwner }}
+        (you)
+        {{ end }}
+      </code><br>
+      <code>on: {{.Registration.Created}}</code><br>
+      {{ if .Registration.Registered }}
+      <code>registered on: {{.Registration.Registered}}</code>
+      {{ else }}
+      <code>pending registration</code>
+      <button hx-post="/knots/{{.Domain}}/init">initialize</button>
+      {{ end }}
+    </p>
+
+    {{ if .Registration.Registered }}
+    <h3> members </h3>
+    {{ range $.Members }}
+    <ol>
+      <li>{{.}}</li>
+    </ol>
+    {{ else }}
+    <p>no members</p>
+    {{ end }}
+    {{ end }}
+
+    {{ if $.IsOwner }}
+    <a href="/knots/{{.Registration.Domain}}/member">add member</a>
+    {{ end }}
+{{end}}

appview/pages/knots.html

···
         <button type="domain">generate key</button>
     </form>
 
-    <h3>existing registrations</h3>
-    <ul id="registrations">
+    <h3>my knots</h3>
+    <ul id="my-knots">
+        {{range .Registrations}}
+        {{ if .Registered }}
+            <li>
+                <p>domain: <a href="/knots/{{.Domain}}">{{.Domain}}</a></p><br>
+                <code>opened by: {{.ByDid}}</code><br>
+                <code>on: {{.Created}}</code><br>
+                <code>registered on: {{.Registered}}</code>
+            </li>
+        {{ end }}
+        {{else}}
+            <p>you don't have any knots yet</p>
+        {{end}}
+    </ul>
+    <h3>pending registrations</h3>
+    <ul id="pending-registrations">
         {{range .Registrations}}
+        {{ if not .Registered }}
             <li>
                 <code>domain: {{.Domain}}</code><br>
                 <code>opened by: {{.ByDid}}</code><br>
                 <code>on: {{.Created}}</code><br>
-                {{if .Registered}}
-                <code>registered on: {{.Registered}}</code>
-                {{else}}
                 <code>pending registration</code>
-                <button hx-post="/knots/init/{{.Domain}}">initialize</button>
-                {{end}}
+                <button hx-post="/knots/{{.Domain}}/init">initialize</button>
             </li>
+        {{ end }}
         {{else}}
             <p>no registrations yet</p>
         {{end}}

appview/pages/pages.go

···
 func Knots(w io.Writer, p KnotsParams) error {
 	return parse("knots.html").Execute(w, p)
 }
+
+type KnotParams struct {
+	User         *auth.User
+	Registration *db.Registration
+	Members      []string
+	IsOwner      bool
+}
+
+func Knot(w io.Writer, p KnotParams) error {
+	return parse("knot.html").Execute(w, p)
+}

appview/state/middleware.go

···
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
 	"github.com/bluesky-social/indigo/xrpc"
+	"github.com/go-chi/chi/v5"
 	"github.com/sotangled/tangled/appview"
 	"github.com/sotangled/tangled/appview/auth"
 )
···
 		})
 	}
 }
+
+func RoleMiddleware(s *State, group string) Middleware {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			// requires auth also
+			actor := s.auth.GetUser(r)
+			if actor == nil {
+				// we need a logged in user
+				log.Printf("not logged in, redirecting")
+				http.Error(w, "Forbiden", http.StatusUnauthorized)
+				return
+			}
+			domain := chi.URLParam(r, "domain")
+			if domain == "" {
+				http.Error(w, "malformed url", http.StatusBadRequest)
+				return
+			}
+
+			ok, err := s.enforcer.E.HasGroupingPolicy(actor.Did, group, domain)
+			if err != nil || !ok {
+				// we need a logged in user
+				log.Printf("%s does not have perms of a %s in domain %s", actor.Did, group, domain)
+				http.Error(w, "Forbiden", http.StatusUnauthorized)
+				return
+			}
+
+			next.ServeHTTP(w, r)
+		})
+	}
+}

appview/state/state.go

···
 	"fmt"
 	"log"
 	"net/http"
+	"strings"
 	"time"
 
 	comatproto "github.com/bluesky-social/indigo/api/atproto"
···
 	w.Write([]byte("check success"))
 }
 
+func (s *State) KnotServerInfo(w http.ResponseWriter, r *http.Request) {
+	domain := chi.URLParam(r, "domain")
+	if domain == "" {
+		http.Error(w, "malformed url", http.StatusBadRequest)
+		return
+	}
+
+	user := s.auth.GetUser(r)
+	reg, err := s.db.RegistrationByDomain(domain)
+	if err != nil {
+		w.Write([]byte("failed to pull up registration info"))
+		return
+	}
+
+	var members []string
+	if reg.Registered != nil {
+		members, err = s.enforcer.E.GetUsersForRole("server:member", domain)
+		if err != nil {
+			w.Write([]byte("failed to fetch member list"))
+			return
+		}
+	}
+
+	ok, err := s.enforcer.E.HasGroupingPolicy(user.Did, "server:owner", domain)
+	isOwner := err == nil && ok
+
+	p := pages.KnotParams{
+		User:         user,
+		Registration: reg,
+		Members:      members,
+		IsOwner:      isOwner,
+	}
+
+	pages.Knot(w, p)
+}
+
 // get knots registered by this user
 func (s *State) Knots(w http.ResponseWriter, r *http.Request) {
 	// for now, this is just pubkeys
···
 	})
 }
 
+// list members of domain, requires auth and requires owner status
+func (s *State) ListMembers(w http.ResponseWriter, r *http.Request) {
+	domain := chi.URLParam(r, "domain")
+	if domain == "" {
+		http.Error(w, "malformed url", http.StatusBadRequest)
+		return
+	}
+
+	// list all members for this domain
+	memberDids, err := s.enforcer.E.GetUsersForRole("server:member", domain)
+	if err != nil {
+		w.Write([]byte("failed to fetch member list"))
+		return
+	}
+
+	w.Write([]byte(strings.Join(memberDids, "\n")))
+	return
+}
+
+// add member to domain, requires auth and requires invite access
+func (s *State) AddMember(w http.ResponseWriter, r *http.Request) {
+	domain := chi.URLParam(r, "domain")
+	if domain == "" {
+		http.Error(w, "malformed url", http.StatusBadRequest)
+		return
+	}
+
+	memberDid := r.FormValue("member")
+	if memberDid == "" {
+		http.Error(w, "malformed form", http.StatusBadRequest)
+		return
+	}
+
+	// TODO: validate member did?
+	memberIdent, err := auth.ResolveIdent(r.Context(), memberDid)
+	if err != nil {
+		w.Write([]byte("failed to resolve member did to a handle"))
+		return
+	}
+
+	log.Printf("adding %s to %s\n", memberIdent.Handle.String(), domain)
+
+	err = s.enforcer.AddMember(domain, memberDid)
+	if err != nil {
+		w.Write([]byte(fmt.Sprint("failed to add member: ", err)))
+		return
+	}
+
+	w.Write([]byte(fmt.Sprint("added member: ", memberIdent.Handle.String())))
+}
+
+// list members of domain, requires auth and requires owner status
+func (s *State) RemoveMember(w http.ResponseWriter, r *http.Request) {
+}
+
 func buildPingRequest(url, secret string) (*http.Request, error) {
 	pingRequest, err := http.NewRequest("GET", url, nil)
 	if err != nil {
···
 	r.Route("/knots", func(r chi.Router) {
 		r.Use(AuthMiddleware(s))
 		r.Get("/", s.Knots)
-		r.Post("/init/{domain}", s.InitKnotServer)
 		r.Post("/key", s.RegistrationKey)
+
+		r.Route("/{domain}", func(r chi.Router) {
+			r.Get("/", s.KnotServerInfo)
+			r.Post("/init", s.InitKnotServer)
+			r.Route("/member", func(r chi.Router) {
+				r.Use(RoleMiddleware(s, "server:owner"))
+				r.Get("/", s.ListMembers)
+				r.Put("/", s.AddMember)
+				r.Delete("/", s.RemoveMember)
+			})
+		})
 	})
 
 	r.Group(func(r chi.Router) {