feat: bulk unban via checkboxes

Adds per-row checkboxes, a select-all toggle, a live "N selected" counter,
and an /unban-bulk endpoint that DELETEs each chosen decision id. Single-row
Unban buttons still work via hx-vals so they don't accidentally submit the
bulk form.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

app/app.py

@@ -122,6 +122,25 @@ def unban():
     return list_decisions()
 
 
+@app.post("/unban-bulk")
+def unban_bulk():
+    ids = [i for i in request.form.getlist("id") if i.isdigit()]
+    if not ids:
+        return list_decisions()
+    deleted = 0
+    errors = []
+    for did in ids:
+        r = _machine("DELETE", f"/v1/decisions/{did}")
+        if r.status_code in (200, 204):
+            deleted += 1
+        else:
+            errors.append(f"{did}:{r.status_code}")
+    log.info("unban-bulk by=%s count=%d errors=%s", caller_ip(), deleted, errors)
+    if errors:
+        return f"deleted {deleted}/{len(ids)}; errors: {', '.join(errors[:5])}", 502
+    return list_decisions()
+
+
 @app.post("/unban-me")
 def unban_me():
     ip = caller_ip()

app/templates/_decisions.html

@@ -2,13 +2,23 @@
   <p class="err">{{ error }}</p>
 {% endif %}
 {% if decisions %}
+  <form hx-post="/unban-bulk" hx-target="#decisions" hx-swap="innerHTML"
+        hx-confirm="Unban all selected decisions?" id="bulk-form">
+    <div class="row" style="margin: .5rem 0;">
+      <button class="danger" type="submit">Unban selected</button>
+      <span class="pill"><span id="sel-count">0</span> selected of {{ decisions|length }}</span>
+    </div>
     <table>
       <thead>
-      <tr><th>ID</th><th>IP / value</th><th>Scope</th><th>Type</th><th>Reason</th><th>Until</th><th>Origin</th><th></th></tr>
+        <tr>
+          <th><input type="checkbox" id="sel-all" onclick="document.querySelectorAll('#bulk-form .sel').forEach(c=>{c.checked=this.checked});updateCount()"></th>
+          <th>ID</th><th>IP / value</th><th>Scope</th><th>Type</th><th>Reason</th><th>Until</th><th>Origin</th><th></th>
+        </tr>
       </thead>
       <tbody>
       {% for d in decisions %}
         <tr>
+          <td><input type="checkbox" class="sel" name="id" value="{{ d.id }}" onclick="updateCount()"></td>
           <td><code>{{ d.id }}</code></td>
           <td><code>{{ d.value }}</code></td>
           <td>{{ d.scope }}</td>
@@ -17,15 +27,26 @@
           <td>{{ d.until }}</td>
           <td>{{ d.origin }}</td>
           <td>
-          <form hx-post="/unban" hx-target="#decisions" hx-swap="innerHTML" hx-confirm="Delete decision {{ d.id }} for {{ d.value }}?">
-            <input type="hidden" name="id" value="{{ d.id }}">
-            <button class="danger" type="submit">Unban</button>
-          </form>
+            <button class="danger" type="button"
+                    hx-post="/unban" hx-target="#decisions" hx-swap="innerHTML"
+                    hx-vals='{"id": "{{ d.id }}"}'
+                    hx-confirm="Delete decision {{ d.id }} for {{ d.value }}?">Unban</button>
           </td>
         </tr>
       {% endfor %}
       </tbody>
     </table>
+  </form>
+  <script>
+    function updateCount(){
+      const n = document.querySelectorAll('#bulk-form .sel:checked').length;
+      const total = document.querySelectorAll('#bulk-form .sel').length;
+      document.getElementById('sel-count').textContent = n;
+      const all = document.getElementById('sel-all');
+      if (all) all.checked = (n === total && total > 0);
+    }
+    updateCount();
+  </script>
 {% else %}
   {% if not error %}<p>No active decisions.</p>{% endif %}
 {% endif %}