Auth levels are now read from a special config file. Both display and operations are now checked for auth level.

9 files changed, 321 insertions, 111 deletions

diff --git a/captain/config.f90 b/captain/config.f90
index 509c489..2d67adf 100644
--- a/captain/config.f90
+++ b/captain/config.f90
@@ -71,6 +71,24 @@ implicit none
     character(*), parameter::SALT_VARIABLE = "security-salt"
     character(1024)::app_salt
     
+    character(*), parameter::PERMISSIONS_FILE_VARIABLE = "permissions_file"
+    character(1024)::perm_filename
+    
+    integer, parameter::MAX_PERMISSIONS = 16
+    
+    type::permissions
+        character(len=40), dimension(MAX_PERMISSIONS)::k
+        integer, dimension(MAX_PERMISSIONS)::v
+        
+        contains
+        
+        procedure :: load => load_permissions
+        procedure :: get => get_permission
+        
+    end type permissions
+    
+    type(permissions)::global_permissions
+    
 contains
     
     subroutine get_variable(str, v)
@@ -162,6 +180,9 @@ contains
         
         else if(cvariable == SALT_VARIABLE) then
             app_salt = trim(cvalue)
+            
+        else if(cvariable == PERMISSIONS_FILE_VARIABLE) then
+            perm_filename = trim(cvalue)
         
         end if
         
@@ -174,6 +195,7 @@ contains
         integer::unit_number, istatus
         character(1024)::line, cvalue
         character(64)::cvariable
+        integer::i
         
         open(newunit=unit_number, file=trim(filename), status='old', &
              action="read", iostat=istatus)
@@ -195,6 +217,16 @@ contains
              
         close(unit_number)
         
+        if(len_trim(perm_filename) > 0) then
+            if(perm_filename(1:1) /= "/") then
+                i = index(filename, "/", back=.true.)
+                if(i > 1) then
+                    perm_filename = filename(1:i)//trim(perm_filename)
+                end if
+            end if
+            call global_permissions%load(perm_filename)
+        end if
+        
     end subroutine load_configuration
     
     subroutine template_filepath(x, res)
@@ -207,5 +239,65 @@ contains
         call combine_paths(template_directory, x, res)
         
     end subroutine template_filepath
+
+    subroutine load_permissions(self, filename)
+    implicit none
+    
+        class(permissions), intent(out)::self
+        character(*), intent(in)::filename
+        
+        integer::unit_number, istatus
+        character(1024)::line, cvalue
+        character(64)::cvariable
+        integer::i
+        
+        self%k = " "
+        
+        open(newunit=unit_number, file=trim(filename), status='old', &
+             action="read", iostat=istatus)
+        
+        i = 1
+             
+        read(unit_number, '(A)', iostat=istatus) line
+        do while(istatus == 0 .and. i <= MAX_PERMISSIONS)
+            
+            if(len_trim(line) > 0 .and. line(1:1) /= '#') then
+            
+                call get_variable(line, cvariable)
+                call get_value(line, cvalue)
+
+                self%k(i) = cvariable
+                read(cvalue, *, iostat=istatus) self%v(i)
+                
+                i = i + 1
+            end if
+            
+            read(unit_number, '(A)', iostat=istatus) line
+        end do
+        
+        close(unit_number)
+        
+    end subroutine load_permissions
+    
+    pure function get_permission(self, key)
+    use auth_levels, only: AUTH_ADMIN_USER
+    implicit none
+    
+        class(permissions), intent(in)::self
+        character(len=*), intent(in)::key
+        integer::get_permission
+        
+        integer::i
+        
+        get_permission = AUTH_ADMIN_USER
+        
+        do i = 1, MAX_PERMISSIONS
+            if(trim(self%k(i)) == trim(key)) then
+                get_permission = self%v(i)
+                exit
+            end if
+        end do
+        
+    end function get_permission
     
 end module config
diff --git a/captain/db.f90 b/captain/db.f90
index 97c397a..44bc473 100644
--- a/captain/db.f90
+++ b/captain/db.f90
@@ -1541,6 +1541,7 @@ contains
     end function get_user_auth_db
     
     function get_session_auth_db(session)
+    use auth_levels, only: AUTH_NONE
     implicit none
         
         character(len=*), intent(in)::session
@@ -1548,7 +1549,7 @@ contains
     
         type(sqlite3_stmt)::stmt
         
-        get_session_auth_db = -1
+        get_session_auth_db = AUTH_NONE
         
         if(stmt%prepare(db, "SELECT level FROM session_auth WHERE session=? LIMIT 1") == SQLITE_OK) then
             if(stmt%bind_text(1, session) == SQLITE_OK) then
diff --git a/captain/example/levitating-permissions.conf b/captain/example/levitating-permissions.conf
new file mode 100644
index 0000000..a487872
--- /dev/null
+++ b/captain/example/levitating-permissions.conf
@@ -0,0 +1,14 @@
+
+access-releases = 0
+access-logs = 0
+
+add-players = 10
+modify-players = 5
+
+scan-instructions = 10
+launch-job = 5
+assign-instructions = 5
+view-raw-instructions = 0
+
+add-groups = 5
+modify-groups = 5
diff --git a/captain/example/levitating.conf b/captain/example/levitating.conf
index c1c22e1..06b89ed 100644
--- a/captain/example/levitating.conf
+++ b/captain/example/levitating.conf
@@ -1,9 +1,9 @@
 
-template-directory = /home/jeff/Workspace/levitating/captain/templates
+template-directory = /home/jeff/workspace/levitating/captain/templates
 
-database = /home/jeff/Workspace/levitating/captain/example/store.db
+database = /home/jeff/workspace/levitating/captain/example/store.db
 
-log-filename = /home/jeff/Workspace/levitating/captain/example/log/levitating.log
+log-filename = /home/jeff/workspace/levitating/captain/example/log/levitating.log
 
 log-level = 10
 
@@ -11,22 +11,25 @@ project = misc-build
 
 description = A builder for stuff
 
-public-cert = /home/jeff/Workspace/levitating/captain/example/pub.crt
+public-cert = /home/jeff/workspace/levitating/captain/example/pub.crt
 
-private-cert = /home/jeff/Workspace/levitating/captain/example/priv.key
+private-cert = /home/jeff/workspace/levitating/captain/example/priv.key
 
-uploads-directory = /home/jeff/Workspace/levitating/captain/example/uploads
+uploads-directory = /home/jeff/workspace/levitating/captain/example/uploads
 
-results-directory = /home/jeff/Workspace/levitating/captain/example/results
+results-directory = /home/jeff/workspace/levitating/captain/example/results
 
-static-directory = /home/jeff/Workspace/levitating/captain/example/static
+static-directory = /home/jeff/workspace/levitating/captain/example/static
 
-script-directory = /home/jeff/Workspace/levitating/captain/sql
+script-directory = /home/jeff/workspace/levitating/captain/sql
 
-instructions-directory = /home/jeff/Workspace/levitating/captain/example/instructions
+instructions-directory = /home/jeff/workspace/levitating/captain/example/instructions
 
-release-directory = /home/jeff/Workspace/levitating/captain/example/releases
+release-directory = /home/jeff/workspace/levitating/captain/example/releases
 
 temp-directory = /tmp/levitating
 
-security-salt = aBcD____
\ No newline at end of file
+security-salt = aBcD____
+
+# Must be absolute path or relative to this file
+permissions_file = levitating-permissions.conf
diff --git a/captain/http.f90 b/captain/http.f90
index 9e2fca5..8449ba2 100644
--- a/captain/http.f90
+++ b/captain/http.f90
@@ -27,6 +27,7 @@ implicit none
     integer, parameter::HTTP_CODE_NOTFOUND = 404
     integer, parameter::HTTP_CODE_FAILURE  = 500
     integer, parameter::HTTP_CODE_REDIRECT = 302
+    integer, parameter::HTTP_CODE_UNAUTHORIZED = 401
     
 contains
 
diff --git a/captain/levitating-captain.prj b/captain/levitating-captain.prj
index 4af03c5..f949fb2 100644
--- a/captain/levitating-captain.prj
+++ b/captain/levitating-captain.prj
@@ -49,6 +49,9 @@
           }],
         "Name":"+example",
         "Files":[{
+            "filename":"example/levitating-permissions.conf",
+            "enabled":"1"
+          },{
             "filename":"example/levitating.conf",
             "enabled":"1"
           }]
diff --git a/captain/requtils.f90 b/captain/requtils.f90
index 41eacc6..620170a 100644
--- a/captain/requtils.f90
+++ b/captain/requtils.f90
@@ -71,6 +71,24 @@ contains
         end if
         
     end function notfound_code
+    
+    pure function notpermitted_code(req)
+    use http, only: HTTP_UNAUTHORIZED => HTTP_CODE_UNAUTHORIZED
+    use server_response, only: request, GEMINI_UNAUTHORIZED => GEMINI_CODE_BAD_REQUEST
+    implicit none
+    
+        class(request), intent(in)::req
+        integer::notpermitted_code
+    
+        if(req%protocol == 'gemini') then
+            ! You might think we'd use Gemini certificates, but fuck certificates...
+            ! Just fail with a bad request.
+            notpermitted_code = GEMINI_UNAUTHORIZED
+        else
+            notpermitted_code = HTTP_UNAUTHORIZED 
+        end if
+        
+    end function notpermitted_code
 
     subroutine basic_mimetype(actual_filename, mimetype) 
     use utilities, only: get_one_line_output_shell_command
@@ -239,19 +257,30 @@ contains
         call req%path_component(1, category)
         call req%path_starting_with_component(2, filename)
         
-        resp%body_filename => get_special_full_filename(trim(category), trim(filename))
-    
-        inquire(file=resp%body_filename, exist=exists)
-        if(.not. exists) then
-        
-            resp%code = notfound_code(req)
-            call write_log("File did not exist: "//resp%body_filename, LOG_NORMAL)
+        if((req%auth_level < global_permissions%get("view-raw-instructions") .and. trim(category) == "instructions") .or. &
+           (req%auth_level < global_permissions%get("access-releases") .and. trim(category) == "releases")  .or. &
+           (req%auth_level < global_permissions%get("access-logs") .and. trim(category) == "results")) &
+        then
             
+            resp%code = notpermitted_code(req)
+        
         else
+        
+            resp%body_filename => get_special_full_filename(trim(category), trim(filename))
+    
+            inquire(file=resp%body_filename, exist=exists)
+            if(.not. exists) then
             
-            resp%code = success_code(req)
-            call basic_mimetype(resp%body_filename, resp%body_mimetype)
+                resp%code = notfound_code(req)
+                call write_log("File did not exist: "//resp%body_filename, LOG_NORMAL)
+                
+            else
+                
+                resp%code = success_code(req)
+                call basic_mimetype(resp%body_filename, resp%body_mimetype)
 
+            end if
+            
         end if
     
     end function request_static
@@ -652,6 +681,7 @@ contains
     use captain_db
     use server_response
     use remote_launch
+    use config, only: global_permissions
     implicit none
     
         type(request), intent(in)::req
@@ -668,15 +698,15 @@ contains
         command = req%query_string(1:i-1)
         argument = req%query_string(i+1:len_trim(req%query_string))
         
-        if(trim(command) == "launch") then
+        if(trim(command) == "launch" .and. req%auth_level >= global_permissions%get("launch-job")) then
             call launch_instructions_on_player(instruction_name, argument)
             
-        else if(trim(command) == "assign") then
+        else if(trim(command) == "assign" .and. req%auth_level >= global_permissions%get("assign-instructions")) then
             i = get_instruction_id(trim(instruction_name))
             j = get_player_id(trim(argument))
             call add_player_for_instruction(i, j)
             
-        else if(trim(command) == "remove") then
+        else if(trim(command) == "remove" .and. req%auth_level >= global_permissions%get("assign-instructions")) then
             i = get_instruction_id(trim(instruction_name))
             j = get_player_id(trim(argument))
             call remove_player_for_instruction(i, j)
diff --git a/captain/response.f90 b/captain/response.f90
index 34c537c..e172cc1 100644
--- a/captain/response.f90
+++ b/captain/response.f90
@@ -73,6 +73,8 @@ implicit none
         character(len=:), pointer::token => null()
         character(len=4)::method = "GET"
         
+        integer::auth_level
+        
         type(query)::q
         type(cookies)::c
     
@@ -111,6 +113,8 @@ contains
     subroutine request_init(self, str, server_explicit, protocol_explicit, method, cookiestring)
     use logging
     use utilities, only: toupper
+    use captain_db, only: get_session_auth_db
+    use auth_levels, only: AUTH_NONE
     implicit none
     
         class(request) :: self
@@ -222,6 +226,14 @@ contains
             if(.not.associated(self%token) .and. associated(self%c%get_value("token"))) then
                 self%token => self%c%get_value("token")
             end if
+        else
+            call self%c%init()
+        end if
+        
+        if(associated(self%token)) then
+            self%auth_level = get_session_auth_db(self%token)
+        else
+            self%auth_level = AUTH_NONE
         end if
     
     end subroutine request_init
diff --git a/captain/web.f90 b/captain/web.f90
index b990c1a..9d8fc3c 100644
--- a/captain/web.f90
+++ b/captain/web.f90
@@ -70,6 +70,17 @@ contains
     
     end function request_is_authenticated
     
+    subroutine echo_error_stdout(error_code)
+    implicit none
+    
+        integer, intent(in)::error_code
+    
+        Print *, "<html><head><title>Falling...</title></head><body><p>An Error Occurred:"
+        Print *, error_code
+        Print *, "</p></body></html>"
+        
+    end subroutine echo_error_stdout
+    
     subroutine handle_basic_template_components(req, page)
     use server_response
     use page_template
@@ -151,6 +162,7 @@ contains
     use captain_db
     use server_response
     use request_utils, only: get_player_status_utf8, render_jobs_links, generate_simple_pager
+    use config, only: global_permissions
     implicit none
     
         type(request)::req
@@ -219,14 +231,17 @@ contains
 
         res = "<h2>"//trim(instruction_name)//"</h2>"
         
-        one_link => html_link(trim(instruction_name)//".json", &
-                             "View Raw")
-        res = trim(res)//nl//"<p><em>"//one_link//"</em></p>"
-        deallocate(one_link)
+        if(req%auth_level >= global_permissions%get("view-raw-instructions")) then
+            one_link => html_link(trim(instruction_name)//".json", &
+                                 "View Raw")
+            res = trim(res)//nl//"<p><em>"//one_link//"</em></p>"
+            deallocate(one_link)
+        end if
         
         if(n_players == 0) then
             res = trim(res)//nl//"<p>No players currently can run these instructions</p>"
-        else
+            
+        else if(req%auth_level >= global_permissions%get("launch-job")) then
             res = trim(res)//nl//"<h3>Launch Now</h3>"//nl//"<ul>"
             
             do i = 1, n_players
@@ -260,39 +275,41 @@ contains
             
         end if
         
-        all_players => get_player_names()
-        if(associated(all_players)) then
-            res = trim(res)//nl//"<h3>Assign</h3>"//nl//"<p>Assign a player to these instructions</p>"//nl//"<ul>"
-            do i = 1, size(all_players)
-                if(n_players > 0) then
-                    j = get_player_id(all_players(i))
-                    if(any(j == players)) then
-                        cycle
+        if(req%auth_level >= global_permissions%get("assign-instructions")) then
+            all_players => get_player_names()
+            if(associated(all_players)) then
+                res = trim(res)//nl//"<h3>Assign</h3>"//nl//"<p>Assign a player to these instructions</p>"//nl//"<ul>"
+                do i = 1, size(all_players)
+                    if(n_players > 0) then
+                        j = get_player_id(all_players(i))
+                        if(any(j == players)) then
+                            cycle
+                        end if
                     end if
-                end if
-                
-                one_link => html_link(req%page//"?assign="//trim(all_players(i)), &
-                                      trim(all_players(i)))
-                
-                res = trim(res)//nl//"<li>"//one_link//"</li>"
-                deallocate(one_link)
-            end do
-            res = trim(res)//nl//"</ul>"
-            deallocate(all_players)
-        end if
-        
-        if(n_players > 0) then
-             res = trim(res)//nl//"<h3>Remove</h3>"//nl//"<p>Remove a player from these instructions</p>"//nl//"<ul>"
-             do i = 1, n_players
-                call get_player_name(players(i), player_name)
-                
-                one_link => html_link(req%page//"?remove="//trim(player_name), &
-                                      trim(player_name))
-                                      
-                res = trim(res)//nl//"<li>"//one_link//"</li>"
-                deallocate(one_link)
-            end do
-            res = trim(res)//nl//"</ul>"
+                    
+                    one_link => html_link(req%page//"?assign="//trim(all_players(i)), &
+                                          trim(all_players(i)))
+                    
+                    res = trim(res)//nl//"<li>"//one_link//"</li>"
+                    deallocate(one_link)
+                end do
+                res = trim(res)//nl//"</ul>"
+                deallocate(all_players)
+            end if
+            
+            if(n_players > 0) then
+                 res = trim(res)//nl//"<h3>Remove</h3>"//nl//"<p>Remove a player from these instructions</p>"//nl//"<ul>"
+                 do i = 1, n_players
+                    call get_player_name(players(i), player_name)
+                    
+                    one_link => html_link(req%page//"?remove="//trim(player_name), &
+                                          trim(player_name))
+                                          
+                    res = trim(res)//nl//"<li>"//one_link//"</li>"
+                    deallocate(one_link)
+                end do
+                res = trim(res)//nl//"</ul>"
+            end if
         end if
         
     end function generate_one_instuction_html
@@ -300,6 +317,7 @@ contains
     function generate_instructions_html(req) result(res)
     use captain_db
     use server_response, only:request
+    use config, only: global_permissions
     implicit none
     
         type(request)::req
@@ -340,17 +358,20 @@ contains
         
         end if
         
-        res = trim(res)//new_line(' ')//"<h2>Management</h2>"
-        
-        scanlink => html_link(req%page//"?scan", "Scan for instructions now")
-        res = trim(res)//new_line(' ')//"<p>"//scanlink//"</p>"
-        deallocate(scanlink)
+        if(req%auth_level >= global_permissions%get("scan-instructions")) then
+            res = trim(res)//new_line(' ')//"<h2>Management</h2>"
+            
+            scanlink => html_link(req%page//"?scan", "Scan for instructions now")
+            res = trim(res)//new_line(' ')//"<p>"//scanlink//"</p>"
+            deallocate(scanlink)
+        end if
     
     end function generate_instructions_html
     
     function generate_groups_html(req) result(res)
     use captain_db
     use server_response, only:request
+    use config, only: global_permissions
     implicit none
     
         type(request)::req
@@ -389,11 +410,13 @@ contains
         
         end if
         
-        res = trim(res)//new_line(' ')//"<h2>Management</h2>"
-        
-        res = trim(res)//new_line(' ')// &
-        '<form action="groups/add.html" method="POST"><label for="name">Name:</label>'// &
-        '<input name="name" id="name" /><input type="submit" value="Add"/></form>'
+        if(req%auth_level >= global_permissions%get("add-groups")) then
+            res = trim(res)//new_line(' ')//"<h2>Management</h2>"
+            
+            res = trim(res)//new_line(' ')// &
+            '<form action="groups/add.html" method="POST"><label for="name">Name:</label>'// &
+            '<input name="name" id="name" /><input type="submit" value="Add"/></form>'
+        end if
     
     end function generate_groups_html
     
@@ -404,6 +427,7 @@ contains
     use query_utilities
     use logging
     use remote_launch, only: launch_group
+    use config, only: global_permissions
     implicit none
     
         type(request)::req
@@ -437,7 +461,7 @@ contains
             call q%init(req%query_string)
             qreq => q%get_value("add")
             
-            if(associated(qreq)) then
+            if(associated(qreq) .and. req%auth_level >= global_permissions%get("add-groups")) then
                 
                 call write_log("ADD: "//trim(qreq))
                 
@@ -454,7 +478,7 @@ contains
             
                 qreq => q%get_value("delete")
             
-                if(associated(qreq)) then
+                if(associated(qreq) .and. req%auth_level >= global_permissions%get("modify-groups")) then
             
                     i = index(qreq, ',')
                     player_name = qreq(i+1:len(qreq))
@@ -465,12 +489,12 @@ contains
                     
                     call remove_entry_from_group_db(id, i, j)
 
-                else if(trim(req%query_string) == "launch") then
+                else if(trim(req%query_string) == "launch" .and. req%auth_level >= global_permissions%get("launch-job")) then
                 
                     call launch_group(id)
                     write(launch_msg, '(I4, 1X, A13)') get_group_entries_count_db(id), "jobs launched"
                     
-                else if(trim(req%query_string) == "destroy") then
+                else if(trim(req%query_string) == "destroy" .and. req%auth_level >= global_permissions%get("modify-groups")) then
                 
                     call delete_group_db(id)
                     
@@ -511,15 +535,22 @@ contains
             
                 one_link => html_link("../instructions/"//trim(instruction_name)//".html", trim(instruction_name))
                 play_link => html_link("../players/"//trim(player_name)//".html", trim(player_name))
-                delete_link => html_link(trim(group_name)//".html?delete="// &
-                                         trim(instruction_name)//","//trim(player_name), &
-                                         "<em>Remove</em>")
                 
-                res = trim(res)//new_line(' ')//"<li>"//one_link//" on "//play_link//" - "//delete_link//"</li>"
+                
+                res = trim(res)//new_line(' ')//"<li>"//one_link//" on "//play_link
+                
+                if(req%auth_level >= global_permissions%get("modify-groups")) then
+                    delete_link => html_link(trim(group_name)//".html?delete="// &
+                                             trim(instruction_name)//","//trim(player_name), &
+                                             "<em>Remove</em>")
+                    res = trim(res)//" - "//delete_link
+                    deallocate(delete_link)
+                end if
+                
+                res = trim(res)//"</li>"
             
                 deallocate(one_link)
                 deallocate(play_link)
-                deallocate(delete_link)
             
             end do
             
@@ -527,7 +558,7 @@ contains
             
         end if
         
-        if(n_instructions_total > 0) then
+        if(n_instructions_total > 0 .and. req%auth_level >= global_permissions%get("modify-groups")) then
         
             res = trim(res)//new_line(' ')//"<h3>Add Instructions</h3>"
             
@@ -559,16 +590,22 @@ contains
             end if
         end if
         
-        res = trim(res)//new_line(' ')//'<h3>Destroy This Group</h3>'//new_line(' ')// &
-              '<p><a href="'//req%page//'?destroy">&#x1f4a3; Destroy</a></p>'//new_line(' ')// &
-              '<p><em>This operation will not destroy any instructions</em></p>'
+        if(req%auth_level >= global_permissions%get("modify-groups")) then
+            res = trim(res)//new_line(' ')//'<h3>Destroy This Group</h3>'//new_line(' ')// &
+                  '<p><a href="'//req%page//'?destroy">&#x1f4a3; Destroy</a></p>'//new_line(' ')// &
+                  '<p><em>This operation will not destroy any instructions</em></p>'
+        end if
         
     end function generate_one_group_html
 
-    function generate_players_html() result(res)
+    function generate_players_html(req) result(res)
     use captain_db
     use request_utils, only: get_status_utf8
+    use server_response, only: request
+    use config, only: global_permissions
     implicit none
+        
+        type(request), intent(in)::req
     
         character(len=:), pointer::res
         character(len=PLAYER_NAME_LENGTH), dimension(:), pointer::players
@@ -619,9 +656,11 @@ contains
             deallocate(players)
         end if
         
-        res = trim(res)//new_line(' ')//"<h2>Management</h2>"// &
-        new_line(' ')//'<form action="players/add.html" method="POST"><label for="name">Name:</label>'// &
-        '<input name="name" id="name" /><input type="submit" value="Add"/></form>'
+        if(req%auth_level >= global_permissions%get("add-players")) then
+            res = trim(res)//new_line(' ')//"<h2>Management</h2>"// &
+            new_line(' ')//'<form action="players/add.html" method="POST"><label for="name">Name:</label>'// &
+            '<input name="name" id="name" /><input type="submit" value="Add"/></form>'
+        end if
         
     end function generate_players_html
 
@@ -629,6 +668,7 @@ contains
     use captain_db
     use server_response
     use request_utils
+    use config, only: global_permissions
     implicit none
 
         type(request), intent(in)::req
@@ -683,24 +723,26 @@ contains
             res = trim(res)//"<p>None Yet</p>"
         end if
         
-        ! Token assignment
-        res = trim(res)//new_line(' ')//"<h3>Security</h3>"//new_line(' ')//"<p>"
-        
-        if(player_has_token_db(trim(player_name))) then
-            res = trim(res)//"Player currently has a token assigned."
-        else
-            res = trim(res)//"<em>Player is insecure!  Please assign a token!</em>"
+        if(req%auth_level >= global_permissions%get("modify-players")) then
+            ! Token assignment
+            res = trim(res)//new_line(' ')//"<h3>Security</h3>"//new_line(' ')//"<p>"
+            
+            if(player_has_token_db(trim(player_name))) then
+                res = trim(res)//"Player currently has a token assigned."
+            else
+                res = trim(res)//"<em>Player is insecure!  Please assign a token!</em>"
+            end if
+            
+            res = trim(res)//"</p>"
+            
+            res = trim(res)//new_line(' ')// &
+                  '<form action="assign_token.html" method="POST">'//new_line(' ')// &
+                  '<label for="token">Token:</label>'// &
+                  '<input name="token" id="token" />'//new_line(' ')// &
+                  '<input type="hidden" name="player" id="player" value="'//trim(player_name)//'"/>'//new_line(' ')// &
+                  '<input type="submit" value="Set"/></form>'
         end if
         
-        res = trim(res)//"</p>"
-        
-        res = trim(res)//new_line(' ')// &
-              '<form action="assign_token.html" method="POST">'//new_line(' ')// &
-              '<label for="token">Token:</label>'// &
-              '<input name="token" id="token" />'//new_line(' ')// &
-              '<input type="hidden" name="player" id="player" value="'//trim(player_name)//'"/>'//new_line(' ')// &
-              '<input type="submit" value="Set"/></form>'
-    
     end function generate_one_player_html
 
     function generate_one_job_html(req) result(res)
@@ -827,6 +869,17 @@ contains
         
         res => null()
         
+        ! Auth check
+        if(req%auth_level < global_permissions%get("access-releases")) then
+            allocate(character(len=64)::res)
+            if(req%auth_level == 0) then
+                res = "Login required."
+            else
+                res = "Unacceptable permissions"
+            end if
+            return
+        end if
+        
         ! Easy safety check - no relative paths
         if(index(local_path, '..') > 0) then
             allocate(character(len=64)::res)
@@ -1045,7 +1098,7 @@ contains
         else if(trim(req%location) == "/players.html") then
         
             call page%assign('title', 'Players')
-            contents => generate_players_html()
+            contents => generate_players_html(req)
             call page%assign('contents', contents)
             
         else if(req%location(1:9) == '/players/') then
@@ -1155,7 +1208,7 @@ contains
     use captain_db, only: add_player_db, add_group_db, update_player_token_db, create_user_session_db, &
                           validate_user_db
     use page_template
-    use config, only: template_filepath
+    use config, only: template_filepath, global_permissions
     use logging
     use server_response, only:request, response
     use http, only: HTTP_CODE_FAILURE, HTTP_CODE_SUCCESS
@@ -1187,12 +1240,12 @@ contains
                 call req%path_component(2, second)
                 
                 ! Add a player
-                if(trim(second) == "add.html") then
+                if(trim(second) == "add.html" .and. req%auth_level >= global_permissions%get("add-players")) then
                 
                     call add_player_db(posted%get_value("name"))
                     call page%assign('destination', 'players.html')
     
-                else if(trim(second) == "assign_token.html") then
+                else if(trim(second) == "assign_token.html" .and. req%auth_level >= global_permissions%get("modify-players")) then
                 
                     call update_player_token_db(posted%get_value("player"), posted%get_value("token"))
                     call page%assign('destination', "players/"//posted%get_value("player")//".html")
@@ -1204,7 +1257,7 @@ contains
                 call req%path_component(2, second)
                 
                 ! Add a group
-                if(trim(second) == "add.html") then
+                if(trim(second) == "add.html" .and. req%auth_level >= global_permissions%get("add-groups")) then
                 
                     call add_group_db(posted%get_value("name"))
                     call page%assign('destination', 'groups.html')
@@ -1293,8 +1346,9 @@ contains
                 end if
                 call echo_file_stdout(resp%body_filename)
                 
-            case(HTTP_CODE_FAILURE)
+            case default
                 call write_log("Failure reported for location: "//trim(req%location), LOG_NORMAL)
+                call echo_error_stdout(resp%code)
             ! Need some more...
             
         end select