HBAC details page enhancement

The HBAC details page has been enhanced to support Undo and Reset operations.
The functionality is implemented in the base widget class so the behavior
will be more consistent across widgets. A <span> tag now used to define the
field boundary in the HTML doc. The tag contains the visual representation
of the field which include the input tag and optionally the undo link.

The Update method on HBAC details page has been modified so that it executes
several operations using a batch command. The operations being executed
depends on the changes made to the fields. These operations may include:
 - removing access time if access time is changed to any time
 - removing memberships if member category is changed to all
 - modifying rule attributes if description or rule type is changed
 - enabling/disabling the rule if rule status is changed

The behavior of the Add & Remove buttons also has been changed such that
it adjust the category attribute properly in addition to adding the
memberships using batch command. For example, if category is initially
set to all, adding a new member will also change the category to empty.

The ipa_command have been modified to store the on_success and on_error
handlers as properties. When the command is executed as a part of batch
operation, the result of each command will be passed to the appropriate
handler.

The unit tests and test data have been updated as well.

1 files changed, 554 insertions, 225 deletions

diff --git a/install/static/hbac.js b/install/static/hbac.js
index 7a08db38..eb02bf73 100755
--- a/install/static/hbac.js
+++ b/install/static/hbac.js
@@ -71,12 +71,14 @@ function ipa_hbac_add_dialog(spec) {
 
         that.add_field(ipa_text_widget({
             'name': 'cn',
-            'label': 'Rule Name'
+            'label': 'Rule Name',
+            'undo': false
         }));
 
         that.add_field(ipa_text_widget({
             'name': 'accessruletype',
-            'label': 'Rule type (allow/deny)'
+            'label': 'Rule type (allow/deny)',
+            'undo': false
         }));
     };
 
@@ -102,12 +104,6 @@ function ipa_hbac_search_facet(spec) {
         that.create_column({name:'servicecategory', label:'Via Service'});
         that.create_column({name:'sourcehostcategory', label:'From'});
 
-        that.create_column({
-            name: 'quick_links',
-            label: 'Quick Links',
-            setup: ipa_hbac_quick_links
-        });
-
         that.superior_init();
     };
 
@@ -133,31 +129,29 @@ function ipa_hbac_search_facet(spec) {
             'label': 'Cull Disabled Rules'
         }));
 */
-        var right_buttons = $('<li/>', {
-            'style': 'float: right;'
-        }).appendTo($('.action-panel ul'));
+        var ul = $('.action-panel ul');
 
-        right_buttons.append(ipa_button({
-            'label': 'HBAC Services',
+        $('<li/>', {
+            title: 'hbacsvc',
+            text: 'HBAC Services',
             'click': function() {
                 var state = {};
                 state['entity'] = 'hbacsvc';
                 nav_push_state(state);
                 return false;
             }
-        }));
+        }).appendTo(ul);
 
-        right_buttons.append(ipa_button({
-            'label': 'HBAC Service Groups',
+        $('<li/>', {
+            title: 'hbacsvcgroup',
+            text: 'HBAC Service Groups',
             'click': function() {
                 var state = {};
                 state['entity'] = 'hbacsvcgroup';
                 nav_push_state(state);
                 return false;
             }
-        }));
-
-        container.append('<br/><br/>');
+        }).appendTo(ul);
 
         that.superior_create(container);
     };
@@ -165,45 +159,6 @@ function ipa_hbac_search_facet(spec) {
     return that;
 }
 
-function ipa_hbac_quick_links(container, name, value, record) {
-
-    var column = this;
-    var facet = column.facet;
-
-    var pkey = IPA.metadata[column.entity_name].primary_key;
-    var pkey_value = record[pkey];
-
-    var span = $('span[name='+name+']', container);
-
-    $('<a/>', {
-        'href': '#details',
-        'title': 'Details',
-        'text': 'Details',
-        'click': function() {
-            var state = {};
-            state[column.entity_name+'-facet'] = 'details';
-            state[column.entity_name+'-pkey'] = pkey_value;
-            nav_push_state(state);
-            return false;
-        }
-    }).appendTo(span);
-
-    span.append(' | ');
-
-    $('<a/>', {
-        'href': '#test-rule',
-        'title': 'Test Rule',
-        'text': 'Test Rule',
-        'click': function() {
-            var state = {};
-            state[column.entity_name+'-facet'] = 'test-rule';
-            state[column.entity_name+'-pkey'] = pkey_value;
-            nav_push_state(state);
-            return false;
-        }
-    }).appendTo(span);
-}
-
 function ipa_hbac_details_facet(spec) {
 
     spec = spec || {};
@@ -233,7 +188,7 @@ function ipa_hbac_details_facet(spec) {
             that.add_section(section);
         }
 
-        section.create_text({ 'name': 'cn', 'label': 'Name' });
+        section.create_text({ 'name': 'cn', 'label': 'Name', 'read_only': true });
         section.create_radio({ 'name': 'accessruletype', 'label': 'Rule Type' });
         section.create_textarea({ 'name': 'description', 'label': 'Description' });
         section.create_radio({ 'name': 'ipaenabledflag', 'label': 'Enabled' });
@@ -263,15 +218,15 @@ function ipa_hbac_details_facet(spec) {
             that.add_section(section);
         }
 
-        section.create_radio({ name: 'usercategory', label: 'User category' });
+        var category = section.create_radio({ name: 'usercategory', label: 'User category' });
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberuser_user',
-            'name': 'memberuser_user', 'label': 'Users',
+            'name': 'memberuser_user', 'label': 'Users', 'category': category,
             'other_entity': 'user', 'add_method': 'add_user', 'delete_method': 'remove_user'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberuser_group',
-            'name': 'memberuser_group', 'label': 'Groups',
+            'name': 'memberuser_group', 'label': 'Groups', 'category': category,
             'other_entity': 'group', 'add_method': 'add_user', 'delete_method': 'remove_user'
         }));
 
@@ -300,15 +255,15 @@ function ipa_hbac_details_facet(spec) {
             that.add_section(section);
         }
 
-        section.create_radio({ 'name': 'hostcategory', 'label': 'Host category' });
+        category = section.create_radio({ 'name': 'hostcategory', 'label': 'Host category' });
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberhost_host',
-            'name': 'memberhost_host', 'label': 'Hosts',
+            'name': 'memberhost_host', 'label': 'Hosts', 'category': category,
             'other_entity': 'host', 'add_method': 'add_host', 'delete_method': 'remove_host'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberhost_hostgroup',
-            'name': 'memberhost_hostgroup', 'label': 'Host Groups',
+            'name': 'memberhost_hostgroup', 'label': 'Host Groups', 'category': category,
             'other_entity': 'hostgroup', 'add_method': 'add_host', 'delete_method': 'remove_host'
         }));
 
@@ -337,15 +292,15 @@ function ipa_hbac_details_facet(spec) {
             that.add_section(section);
         }
 
-        section.create_radio({ 'name': 'servicecategory', 'label': 'Service category' });
+        category = section.create_radio({ 'name': 'servicecategory', 'label': 'Service category' });
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberservice_hbacsvc',
-            'name': 'memberservice_hbacsvc', 'label': 'Services',
+            'name': 'memberservice_hbacsvc', 'label': 'Services', 'category': category,
             'other_entity': 'hbacsvc', 'add_method': 'add_service', 'delete_method': 'remove_service'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-memberservice_hbacsvcgroup',
-            'name': 'memberservice_hbacsvcgroup', 'label': 'Service Groups',
+            'name': 'memberservice_hbacsvcgroup', 'label': 'Service Groups', 'category': category,
             'other_entity': 'hbacsvcgroup', 'add_method': 'add_service', 'delete_method': 'remove_service'
         }));
 
@@ -374,15 +329,15 @@ function ipa_hbac_details_facet(spec) {
             that.add_section(section);
         }
 
-        section.create_radio({ 'name': 'sourcehostcategory', 'label': 'Source host category' });
+        category = section.create_radio({ 'name': 'sourcehostcategory', 'label': 'Source host category' });
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-sourcehost_host',
-            'name': 'sourcehost_host', 'label': 'Host',
+            'name': 'sourcehost_host', 'label': 'Host', 'category': category,
             'other_entity': 'host', 'add_method': 'add_sourcehost', 'delete_method': 'remove_sourcehost'
         }));
         section.add_field(ipa_hbac_association_widget({
             'id': that.entity_name+'-sourcehost_hostgroup',
-            'name': 'sourcehost_hostgroup', 'label': 'Host Groups',
+            'name': 'sourcehost_hostgroup', 'label': 'Host Groups', 'category': category,
             'other_entity': 'hostgroup', 'add_method': 'add_sourcehost', 'delete_method': 'remove_sourcehost'
         }));
 
@@ -394,30 +349,233 @@ function ipa_hbac_details_facet(spec) {
             });
 
         } else {
+            section = that.create_section({
+                'name': 'accesstime',
+                'label': 'When'
+            });
+/*
             section = ipa_hbac_details_tables_section({
                 'name': 'accesstime',
                 'label': 'When',
                 'text': 'Rule applies when access is being requested at:',
-                'field_name': 'accesstime',
-                'options': [
-                    { 'value': 'all', 'label': 'Any Time' },
-                    { 'value': '', 'label': 'Specified Times' }
-                ],
+                'field_name': 'accesstimecategory',
                 'tables': [
                     { 'field_name': 'accesstime' }
                 ]
             });
             that.add_section(section);
+*/
         }
 
         section.add_field(ipa_hbac_accesstime_widget({
-            'id': that.entity_name+'-accesstime',
-            'name': 'accesstime', 'label': 'Access Time'
+            'id': 'accesstime',
+            'name': 'accesstime', 'label': 'Access Time',
+            'text': 'Rule applies when access is being requested at:',
+            'options': [
+                { 'value': 'all', 'label': 'Any Time' },
+                { 'value': '', 'label': 'Specified Times' }
+            ]
         }));
 
         that.superior_init();
     };
 
+    that.update = function(container) {
+
+        var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
+
+        var modify_operation = {
+            'execute': false,
+            'command': ipa_command({
+                'method': that.entity_name+'_mod',
+                'args': [pkey],
+                'options': {'all': true, 'rights': true}
+            })
+        };
+
+        var remove_accesstime = {
+            'template': ipa_command({
+                'method': that.entity_name+'_remove_accesstime',
+                'args': [pkey],
+                'options': {'all': true, 'rights': true}
+            }),
+            'commands': []
+        };
+
+        var member_category = {
+            'usercategory': 'memberuser',
+            'hostcategory': 'memberhost',
+            'servicecategory': 'memberservice',
+            'sourcehostcategory': 'sourcehost'
+        };
+
+        var remove_members = {
+            'memberuser': {
+                'category_changed': false,
+                'has_values': false,
+                'command': ipa_command({
+                    'method': that.entity_name+'_remove_user',
+                    'args': [pkey],
+                    'options': {'all': true, 'rights': true}
+                })
+            },
+            'memberhost': {
+                'category_changed': false,
+                'has_values': false,
+                'command': ipa_command({
+                    'method': that.entity_name+'_remove_host',
+                    'args': [pkey],
+                    'options': {'all': true, 'rights': true}
+                })
+            },
+            'memberservice': {
+                'category_changed': false,
+                'has_values': false,
+                'command': ipa_command({
+                    'method': that.entity_name+'_remove_service',
+                    'args': [pkey],
+                    'options': {'all': true, 'rights': true}
+                })
+            },
+            'sourcehost': {
+                'category_changed': false,
+                'has_values': false,
+                'command': ipa_command({
+                    'method': that.entity_name+'_remove_sourcehost',
+                    'args': [pkey],
+                    'options': {'all': true, 'rights': true}
+                })
+            }
+        };
+
+        var enable_operation = {
+            'execute': false,
+            'command': ipa_command({
+                'method': that.entity_name+'_enable',
+                'args': [pkey],
+                'options': {'all': true, 'rights': true}
+            })
+        };
+
+        for (var i=0; i<that.sections.length; i++) {
+            var section = that.sections[i];
+
+            var div = $('#'+that.entity_name+'-'+that.name+'-'+section.name, container);
+
+            for (var j=0; j<section.fields.length; j++) {
+                var field = section.fields[j];
+
+                var span = $('span[name='+field.name+']', div).first();
+                var values = field.save(span);
+
+                var param_info = ipa_get_param_info(that.entity_name, field.name);
+
+                // skip primary key
+                if (param_info && param_info['primary_key']) continue;
+
+                var p = field.name.indexOf('_');
+                if (p >= 0) {
+                    // prepare command to remove members if needed
+                    var attribute = field.name.substring(0, p);
+                    var other_entity = field.name.substring(p+1);
+
+                    if (values.length) {
+                        remove_members[attribute].command.set_option(other_entity, values.join(','));
+                        remove_members[attribute].has_values = true;
+                    }
+                    continue;
+                }
+
+                // skip unchanged field
+                if (!field.is_dirty(span)) continue;
+
+                // check enable/disable
+                if (field.name == 'ipaenabledflag') {
+                    if (values[0] == 'FALSE') enable_operation.command.method = that.entity_name+'_disable';
+                    enable_operation.execute = true;
+                    continue;
+                }
+
+                if (field.name == 'accesstime') {
+                    // if accesstime is dirty, it means 'Any Time' is selected,
+                    // so existing values have to be removed
+                    for (var k=0; k<field.values.length; k++) {
+                        var command = ipa_command(remove_accesstime.template);
+                        command.set_option(field.name, field.values[k]);
+                        remove_accesstime.commands.push(command);
+                    }
+                    continue;
+                }
+
+                // use setattr/addattr if param_info not available
+                if (!param_info) {
+                    for (var k=0; k<values.length; k++) {
+                        modify_operation.set_option(
+                            k == 0 ? 'setattr' : 'addattr',
+                            field.name+'='+values[k]
+                        );
+                        modify_operation.execute = true;
+                    }
+                    continue;
+                }
+
+                var attribute = member_category[field.name];
+                if (attribute) {
+                    // if category is dirty, it means 'Any *' is selected,
+                    // so existing values have to be removed
+                    remove_members[attribute].category_changed = true;
+
+                    // fall through to trigger modify operation
+                }
+
+                // set modify options
+                if (values.length == 1) {
+                    modify_operation.command.set_option(field.name, values[0]);
+                } else {
+                    modify_operation.command.set_option(field.name, values);
+                }
+                modify_operation.execute = true;
+            }
+        }
+
+        var batch = ipa_batch_command({
+            'on_success': function success_handler(data, text_status, xhr) {
+                that.load(container);
+            },
+            'on_error': function(xhr, text_status, error_thrown) {
+                that.load(container);
+            }
+        });
+
+        for (var attribute in remove_members) {
+            if (remove_members[attribute].has_values &&
+                remove_members[attribute].category_changed) {
+                batch.add_command(remove_members[attribute].command);
+            }
+        }
+
+        batch.add_commands(remove_accesstime.commands);
+
+        if (modify_operation.execute) batch.add_command(modify_operation.command);
+        if (enable_operation.execute) batch.add_command(enable_operation.command);
+
+        if (!batch.args.length) {
+            that.load(container);
+            return;
+        }
+
+        //alert(JSON.stringify(batch.to_json()));
+
+        batch.execute();
+    };
+
+    that.reset = function() {
+        for (var i=0; i<that.sections.length; i++) {
+            var section = that.sections[i];
+            section.reset();
+        }
+    };
+
     return that;
 }
 
@@ -443,11 +601,22 @@ function ipa_hbac_details_general_section(spec){
 
         td = $('<td/>').appendTo(tr);
 
+        var span = $('<span/>', { 'name': 'cn' }).appendTo(td);
+
         $('<input/>', {
             'type': 'text',
             'name': 'cn',
             'size': 30
-        }).appendTo(td);
+        }).appendTo(span);
+
+        span.append(' ');
+
+        $('<span/>', {
+            'name': 'undo',
+            'class': 'ui-state-highlight ui-corner-all',
+            'style': 'display: none;',
+            'html': 'undo'
+        }).appendTo(span);
 
         td = $('<td/>', {
             'style': 'text-align: right;'
@@ -455,21 +624,32 @@ function ipa_hbac_details_general_section(spec){
 
         td.append('Rule type:');
 
+        span = $('<span/>', { 'name': 'accessruletype' }).appendTo(td);
+
         $('<input/>', {
             'type': 'radio',
             'name': 'accessruletype',
             'value': 'allow'
-        }).appendTo(td);
+        }).appendTo(span);
 
-        td.append('Allow');
+        span.append('Allow');
 
         $('<input/>', {
             'type': 'radio',
             'name': 'accessruletype',
             'value': 'deny'
-        }).appendTo(td);
+        }).appendTo(span);
+
+        span.append('Deny');
 
-        td.append('Deny');
+        span.append(' ');
+
+        $('<span/>', {
+            'name': 'undo',
+            'class': 'ui-state-highlight ui-corner-all',
+            'style': 'display: none;',
+            'html': 'undo'
+        }).appendTo(span);
 
         tr = $('<tr/>', {
         }).appendTo(table);
@@ -483,11 +663,22 @@ function ipa_hbac_details_general_section(spec){
             'colspan': 2
         }).appendTo(tr);
 
+        span = $('<span/>', { 'name': 'description' }).appendTo(td);
+
         $('<textarea/>', {
             'name': 'description',
             'rows': 5,
             'style': 'width: 100%'
-        }).appendTo(td);
+        }).appendTo(span);
+
+        span.append(' ');
+
+        $('<span/>', {
+            'name': 'undo',
+            'class': 'ui-state-highlight ui-corner-all',
+            'style': 'display: none;',
+            'html': 'undo'
+        }).appendTo(span);
 
         tr = $('<tr/>', {
         }).appendTo(table);
@@ -501,21 +692,32 @@ function ipa_hbac_details_general_section(spec){
             'colspan': 2
         }).appendTo(tr);
 
+        span = $('<span/>', { 'name': 'ipaenabledflag' }).appendTo(td);
+
         $('<input/>', {
             'type': 'radio',
             'name': 'ipaenabledflag',
             'value': 'TRUE'
-        }).appendTo(td);
+        }).appendTo(span);
 
-        td.append('Active');
+        span.append('Active');
 
         $('<input/>', {
             'type': 'radio',
             'name': 'ipaenabledflag',
             'value': 'FALSE'
-        }).appendTo(td);
+        }).appendTo(span);
+
+        span.append('Inactive');
 
-        td.append('Inactive');
+        span.append(' ');
+
+        $('<span/>', {
+            'name': 'undo',
+            'class': 'ui-state-highlight ui-corner-all',
+            'style': 'display: none;',
+            'html': 'undo'
+        }).appendTo(span);
     };
 
     return that;
@@ -529,8 +731,8 @@ function ipa_hbac_details_tables_section(spec){
 
     that.text = spec.text;
     that.field_name = spec.field_name;
-    that.options = spec.options;
-    that.tables = spec.tables;
+    that.options = spec.options || [];
+    that.tables = spec.tables || [];
     that.columns = spec.columns;
 
     that.superior_setup = that.superior('setup');
@@ -541,6 +743,8 @@ function ipa_hbac_details_tables_section(spec){
 
         container.append(that.text);
 
+        var span = $('<span/>', { 'name': that.field_name }).appendTo(container);
+
         for (var i=0; i<that.options.length; i++) {
             var option = that.options[i];
 
@@ -548,25 +752,29 @@ function ipa_hbac_details_tables_section(spec){
                 'type': 'radio',
                 'name': that.field_name,
                 'value': option.value
-            }).appendTo(container);
+            }).appendTo(span);
 
-            container.append(option.label);
+            span.append(option.label);
         }
 
-        container.append('<br/>');
+        span.append(' ');
+
+        $('<span/>', {
+            'name': 'undo',
+            'class': 'ui-state-highlight ui-corner-all',
+            'style': 'display: none;',
+            'html': 'undo'
+        }).appendTo(span);
+
+        span.append('<br/>');
 
         for (var i=0; i<that.tables.length; i++) {
             var table = that.tables[i];
 
-            $('<div/>', {
-                'id': that.entity_name+'-'+table.field_name
-            }).appendTo(container);
-        }
+            var table_span = $('<span/>', { 'name': table.field_name }).appendTo(span);
 
-        var fields = that.fields;
-        for (var i = 0; i < fields.length; ++i) {
-            var field = fields[i];
-            field.create(container);
+            var field = that.get_field(table.field_name);
+            field.create(table_span);
         }
     };
 
@@ -580,13 +788,13 @@ function ipa_hbac_association_widget(spec) {
     var that = ipa_table_widget(spec);
 
     that.other_entity = spec.other_entity;
+    that.category = spec.category;
 
     that.add_method = spec.add_method;
     that.delete_method = spec.delete_method;
 
     that.superior_init = that.superior('init');
     that.superior_create = that.superior('create');
-    that.superior_setup = that.superior('setup');
 
     that.init = function() {
         // create a column if none defined
@@ -605,9 +813,7 @@ function ipa_hbac_association_widget(spec) {
 
         that.superior_create(container);
 
-        var div = $('#'+that.id, container);
-
-        var buttons = $('span[name=buttons]', div);
+        var buttons = $('span[name=buttons]', container);
 
         $('<input/>', {
             'type': 'button',
@@ -624,7 +830,21 @@ function ipa_hbac_association_widget(spec) {
 
     that.setup = function(container) {
 
-        that.superior_setup(container);
+        that.table_setup(container);
+
+        var button = $('input[name=remove]', that.table);
+        button.replaceWith(ipa_button({
+            'label': button.val(),
+            'icon': 'ui-icon-trash',
+            'click': function() { that.remove(that.container); }
+        }));
+
+        button = $('input[name=add]', that.table);
+        button.replaceWith(ipa_button({
+            'label': button.val(),
+            'icon': 'ui-icon-plus',
+            'click': function() { that.add(that.container) }
+        }));
 
         var entity = IPA.get_entity(that.entity_name);
         var association = entity.get_association(that.other_entity);
@@ -636,6 +856,23 @@ function ipa_hbac_association_widget(spec) {
         }
     };
 
+    that.load = function(container, result) {
+
+        that.values = result[that.name] || [];
+        that.hide_undo(that.container);
+        that.set_values(that.container, that.values);
+    };
+
+    that.set_values = function(container, values) {
+
+        that.tbody.empty();
+        for (var i=0; values && i<values.length; i++) {
+            var record = {};
+            record[that.name] = values[i];
+            that.add_row(that.container, record);
+        }
+    };
+
     that.add = function(container) {
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
@@ -646,29 +883,55 @@ function ipa_hbac_association_widget(spec) {
             'title': title,
             'entity_name': that.entity_name,
             'pkey': pkey,
-            'other_entity': that.other_entity,
-            'associator': that.associator,
-            'method': that.add_method,
-            'on_success': function() {
-                that.refresh(container);
-                dialog.close();
-            },
-            'on_error': function() {
-                that.refresh(container);
-                dialog.close();
-            }
+            'other_entity': that.other_entity
         });
 
+        dialog.add = function() {
+
+            var values = dialog.get_selected_values();
+
+            var batch = ipa_batch_command({
+                'on_success': function() {
+                    that.refresh(that.container);
+                    dialog.close();
+                },
+                'on_error': function() {
+                    that.refresh(that.container);
+                    dialog.close();
+                }
+            });
+
+            var command = ipa_command({
+                'method': that.entity_name+'_mod',
+                'args': [pkey],
+                'options': {'all': true, 'rights': true},
+                'on_success': function() {
+                    that.category.load(container, ['']);
+                }
+            });
+            command.set_option(that.category.name, '');
+            batch.add_command(command);
+
+            command = ipa_command({
+                'method': that.entity_name+'_'+that.add_method,
+                'args': [pkey]
+            });
+            command.set_option(that.other_entity, values.join(','));
+            batch.add_command(command);
+
+            batch.execute();
+        };
+
         dialog.init();
 
-        dialog.open(container);
+        dialog.open(that.container);
     };
 
     that.remove = function(container) {
 
-        var values = that.get_selected_values();
+        var selected_values = that.get_selected_values();
 
-        if (!values.length) {
+        if (!selected_values.length) {
             alert('Select '+that.label+' to be removed.');
             return;
         }
@@ -682,59 +945,51 @@ function ipa_hbac_association_widget(spec) {
             'entity_name': that.entity_name,
             'pkey': pkey,
             'other_entity': that.other_entity,
-            'values': values,
-            'associator': that.associator,
-            'method': that.delete_method,
-            'on_success': function() {
-                that.refresh(container);
-                dialog.close();
-            },
-            'on_error': function() {
-                that.refresh(container);
-                dialog.close();
-            }
+            'values': selected_values
         });
 
+        dialog.remove = function() {
+
+            var command = ipa_command({
+                'method': that.entity_name+'_'+that.delete_method,
+                'args': [pkey],
+                'on_success': function() {
+                    that.refresh(that.container);
+                    dialog.close();
+                },
+                'on_error': function() {
+                    that.refresh(that.container);
+                    dialog.close();
+                }
+            });
+
+            command.set_option(that.other_entity, selected_values.join(','));
+
+            command.execute();
+        };
+
         dialog.init();
 
-        dialog.open(container);
+        dialog.open(that.container);
     };
 
     that.refresh = function(container) {
 
         function on_success(data, text_status, xhr) {
-
-            that.tbody.empty();
-
-            var column_name = that.columns[0].name;
-            var values = data.result.result[column_name];
-            //TODO, this is masking an error where the wrong
-            //direction association is presented upon page reload.
-            //if the values is unset, it is because
-            //form.associationColumns[0] doesn't exist in the results
-            if (!values) return;
-
-            for (var i = 0; i<values.length; i++){
-                var record = that.get_record(data.result.result, i);
-                that.add_row(container, record);
-            }
+            that.load(that.container, data.result.result);
         }
 
         function on_error(xhr, text_status, error_thrown) {
-            var div = $('#'+that.id, container).empty();
-            div.append('<p>Error: '+error_thrown.name+'</p>');
-            div.append('<p>'+error_thrown.title+'</p>');
-            div.append('<p>'+error_thrown.message+'</p>');
+            var summary = $('span[name=summary]', that.tfoot).empty();
+            summary.append('<p>Error: '+error_thrown.name+'</p>');
+            summary.append('<p>'+error_thrown.title+'</p>');
+            summary.append('<p>'+error_thrown.message+'</p>');
         }
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
         ipa_cmd('show', [pkey], {'rights': true}, on_success, on_error, that.entity_name);
     };
 
-    that.save = function(container) {
-        return [];
-    };
-
     return that;
 }
 
@@ -742,21 +997,27 @@ function ipa_hbac_accesstime_widget(spec) {
 
     spec = spec || {};
 
-    var that = ipa_table_widget(spec);
+    var that = ipa_widget(spec);
+
+    that.text = spec.text;
+    that.options = spec.options || [];
 
     that.superior_init = that.superior('init');
     that.superior_create = that.superior('create');
     that.superior_setup = that.superior('setup');
 
     that.init = function() {
-        // create a column if none defined
-        if (!that.columns.length) {
-            that.create_column({
-                'name': that.name,
-                'label': that.label,
-                'primary_key': true
-            });
-        }
+
+        that.table = ipa_table_widget({
+            'id': 'accesstime-table',
+            'name': 'table', 'label': that.label
+        });
+
+        that.table.create_column({
+            'name': that.name,
+            'label': that.label,
+            'primary_key': true
+        });
 
         that.superior_init();
     };
@@ -765,9 +1026,38 @@ function ipa_hbac_accesstime_widget(spec) {
 
         that.superior_create(container);
 
-        var div = $('#'+that.id);
+        var span = $('<span/>', { 'name': 'text' }).appendTo(container);
+
+        span.append(that.text);
+
+        for (var i=0; i<that.options.length; i++) {
+            var option = that.options[i];
+
+            $('<input/>', {
+                'type': 'radio',
+                'name': that.name,
+                'value': option.value
+            }).appendTo(container);
+
+            container.append(option.label);
+        }
+
+        container.append(' ');
 
-        var buttons = $('span[name=buttons]', div);
+        $('<span/>', {
+            'name': 'undo',
+            'class': 'ui-state-highlight ui-corner-all',
+            'style': 'display: none;',
+            'html': 'undo'
+        }).appendTo(container);
+
+        container.append('<br/>');
+
+        span = $('<span/>', { 'name': 'table' }).appendTo(container);
+
+        that.table.create(span);
+
+        var buttons = $('span[name=buttons]', span);
 
         $('<input/>', {
             'type': 'button',
@@ -782,23 +1072,70 @@ function ipa_hbac_accesstime_widget(spec) {
         }).appendTo(buttons);
     };
 
-    that.load = function(container, result) {
-        var values = result[that.name] || '';
-        if (values) {
-            $('input[name="'+that.name+'"][value=""]', container).attr('checked', 'checked');
+    that.setup = function(container) {
+
+        that.widget_setup(container);
+
+        var span = $('span[name="table"]', that.container);
+        that.table.setup(span);
+
+        var button = $('input[name=remove]', span);
+        button.replaceWith(ipa_button({
+            'label': button.val(),
+            'icon': 'ui-icon-trash',
+            'click': function() { that.remove(that.container); }
+        }));
+
+        button = $('input[name=add]', span);
+        button.replaceWith(ipa_button({
+            'label': button.val(),
+            'icon': 'ui-icon-plus',
+            'click': function() { that.add(that.container) }
+        }));
+
+        var input = $('input[name="'+that.name+'"]', that.container);
+        input.change(function() {
+            that.show_undo(that.container);
+        });
+
+        var undo = that.get_undo(that.container);
+        undo.click(function() {
+            that.reset(that.container);
+        });
+    };
+
+    that.save = function(container) {
+        var value = $('input[name="'+that.name+'"]:checked', that.container).val();
+        if (value == '') {
+            return that.table.save(that.container);
         } else {
-            $('input[name="'+that.name+'"][value="all"]', container).attr('checked', 'checked');
+            return [];
         }
+    };
 
-        that.tbody.empty();
-        for (var i=0; i<values.length; i++) {
-            var tr = that.row.clone();
-            $('input[name="select"]', tr).val(values[i]);
-            $('span[name="'+that.name+'"]', tr).html(values[i]);
-            tr.appendTo(that.tbody);
+    that.load = function(container, result) {
+
+        that.values = result[that.name] || [];
+        that.set_values(that.container, that.values);
+        that.hide_undo(that.container);
+    };
+
+    that.set_values = function(container, values) {
+
+        that.set_radio_value(that.container, values && values.length ? '' : 'all');
+
+        that.table.tbody.empty();
+        for (var i=0; values && i<values.length; i++) {
+            var record = {};
+            record[that.name] = values[i];
+            that.table.add_row(that.container, record);
         }
     };
 
+    that.set_radio_value = function(container, value) {
+        $('input[name="'+that.name+'"][value="'+value+'"]', that.container).get(0).checked = true;
+    };
+
     that.add = function(container) {
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
@@ -824,11 +1161,14 @@ function ipa_hbac_accesstime_widget(spec) {
             td.append(that.label+': ');
 
             td = $('<td/>').appendTo(tr);
+
+            var span = $('<span/>', { 'name': that.name }).appendTo(td);
+
             $('<input/>', {
                 'type': 'text',
                 'name': that.name,
                 'size': 40
-            }).appendTo(td);
+            }).appendTo(span);
 
             tr = $('<tr/>').appendTo(table);
 
@@ -852,26 +1192,26 @@ function ipa_hbac_accesstime_widget(spec) {
             var value = field.save(dialog.container)[0];
 
             var command = ipa_command({
-                'method': that.entity_name+'_add_'+that.name
-            });
-            command.add_arg(pkey);
-            command.set_option(that.name, value);
-
-            command.execute(
-                function() {
-                    that.refresh(container);
+                'method': that.entity_name+'_add_'+that.name,
+                'args': [pkey],
+                'on_success': function() {
+                    that.refresh(that.container);
                     if (on_success) on_success();
                 },
-                function() {
-                    that.refresh(container);
+                'on_error': function() {
+                    that.refresh(that.container);
                     if (on_error) on_error();
                 }
-            );
+            });
+
+            command.set_option(that.name, value);
+
+            command.execute();
         }
 
         dialog.add_button('Add', function() {
             add(
-                function() { dialog.clear(container); }
+                function() { dialog.clear(dialog.container); }
             );
         });
 
@@ -888,12 +1228,12 @@ function ipa_hbac_accesstime_widget(spec) {
 
         dialog.init();
 
-        dialog.open(container);
+        dialog.open(that.container);
     };
 
     that.remove = function(container) {
 
-        var values = that.get_selected_values();
+        var values = that.table.get_selected_values();
 
         if (!values.length) {
             alert('Select '+that.label+' to be removed.');
@@ -909,64 +1249,53 @@ function ipa_hbac_accesstime_widget(spec) {
         });
 
         dialog.remove = function() {
-            var batch = ipa_batch_command();
+
+            var batch = ipa_batch_command({
+                'on_success': function() {
+                    that.refresh(that.container);
+                    dialog.close();
+                },
+                'on_error': function() {
+                    that.refresh(that.container);
+                    dialog.close();
+                }
+            });
 
             for (var i=0; i<values.length; i++) {
                 var command = ipa_command({
-                    'method': that.entity_name+'_remove_'+that.name
+                    'method': that.entity_name+'_remove_'+that.name,
+                    'args': [pkey]
                 });
-                command.add_arg(pkey);
+
                 command.set_option(that.name, values[i]);
+
                 batch.add_command(command);
             }
 
-            batch.execute(
-                function() {
-                    that.refresh(container);
-                    dialog.close();
-                },
-                function() {
-                    that.refresh(container);
-                    dialog.close();
-                }
-            );
+            batch.execute();
         };
 
         dialog.init();
 
-        dialog.open(container);
+        dialog.open(that.container);
     };
 
     that.refresh = function(container) {
 
         function on_success(data, text_status, xhr) {
-
-            that.tbody.empty();
-
-            var column_name = that.columns[0].name;
-            var values = data.result.result[column_name];
-            if (!values) return;
-
-            for (var i = 0; i<values.length; i++){
-                var record = that.get_record(data.result.result, i);
-                that.add_row(container, record);
-            }
+            that.load(that.container, data.result.result);
         }
 
         function on_error(xhr, text_status, error_thrown) {
-            var div = $('#'+that.id, container).empty();
-            div.append('<p>Error: '+error_thrown.name+'</p>');
-            div.append('<p>'+error_thrown.title+'</p>');
-            div.append('<p>'+error_thrown.message+'</p>');
+            var summary = $('span[name=summary]', that.table.tfoot).empty();
+            summary.append('<p>Error: '+error_thrown.name+'</p>');
+            summary.append('<p>'+error_thrown.title+'</p>');
+            summary.append('<p>'+error_thrown.message+'</p>');
         }
 
         var pkey = $.bbq.getState(that.entity_name + '-pkey', true) || '';
         ipa_cmd('show', [pkey], {'rights': true}, on_success, on_error, that.entity_name);
     };
 
-    that.save = function(container) {
-        return [];
-    };
-
     return that;
 }