{% extends "base.html" %}
{% block title %}{{ _("Settings") }} · Wealth Dashboard{% endblock %}
{% block heading %}{{ _("Settings") }}{% endblock %}
{% block content %}

<nav class="subnav" aria-label="{{ _('Settings chapters') }}">
  {% for key, label in sections %}
  <a class="subnav-link {{ 'active' if key == section }}" href="{{ url_for('settings_page', section=(key if key != 'general' else None)) }}">{{ label }}</a>
  {% endfor %}
</nav>


{% if section == 'general' %}
<div class="card" id="general">
  <h2>{{ _("General") }}</h2>
  <form method="post" class="form">
    <label for="language">{{ _("Language") }}</label>
    <select id="language" name="language">
      {# Each language names itself. Somebody looking for their own
         language is looking for the word they call it by, not for the
         word English calls it by. #}
      <option value="" {{ 'selected' if not cfg.language }}>{{ _("Follow my browser") }}</option>
      {% for code, name in languages.items() %}
      <option value="{{ code }}" {{ 'selected' if cfg.language == code }}>{{ name }}</option>
      {% endfor %}
    </select>
    <p class="sub">{{ _("Changes the language of the app, and with it how numbers and dates are written. It does not touch what your bank sent: a transaction described in German stays in German.") }}</p>

    <label for="base_currency">{{ _("Base currency") }}</label>
    <input id="base_currency" name="base_currency" value="{{ cfg.base_currency }}" maxlength="3">

    <label for="gains_method">{{ _("Realised gains, by") }}</label>
    <select id="gains_method" name="gains_method">
      <option value="fifo" {{ 'selected' if (cfg.gains_method or 'fifo') == 'fifo' }}>{{ _("FIFO — the oldest units are sold first") }}</option>
      <option value="average" {{ 'selected' if cfg.gains_method == 'average' }}>{{ _("Average cost — every unit costs the average paid") }}</option>
    </select>
    <p class="sub">{{ _("Which units a sale sells decides what it made. FIFO is what Germany taxes on and what Portfolio Performance shows; average cost is the French prix moyen pondéré. Switzerland taxes no private capital gain, so a Swiss reader may pick either. Nothing is stored: switching recomputes every figure.") }}</p>

    <label class="check" style="margin-top:10px"><input type="checkbox" name="auto_sync" value="1" {{ 'checked' if cfg.auto_sync }}> {{ _("Sync connected accounts automatically every day") }}</label>
    <label for="sync_time">{{ _("At") }}</label>
    <input id="sync_time" name="sync_time" type="time" value="{{ cfg.sync_time }}" style="width:auto">
    <p class="sub">{{ _("Local time of the machine this runs on. A day that was slept through — the machine was off at that hour — is caught up as soon as it is next awake.") }}</p>

    <label class="check" style="margin-top:10px"><input type="checkbox" name="check_updates" value="1" {{ 'checked' if cfg.check_updates }}> {{ _("Check for a newer version once a day") }}</label>
    <p class="sub">{{ _("Asks PyPI which version is the newest — one small request for a public page, with nothing about you in it. When there is a newer one, the version in the menu gets a dot and says what to do.") }}</p>

    <label for="redirect_url">{{ _("Redirect URL") }}</label>
    <input id="redirect_url" name="redirect_url" value="{{ cfg.redirect_url }}">
    <p class="sub">{{ _("Where your bank sends you back after you authorise. This exact string must also be registered in the Enable Banking Control Panel — if the two differ by so much as a trailing slash, the bank refuses the handover and the error it shows names nothing useful.") }}</p>

    <button type="submit">{{ _("Save") }}</button>
  </form>
</div>

{% endif %}
{% if section == 'banks' %}
<div class="card" id="sync">
  <div class="card-header">
    <h2>{{ _("Bank sync") }}</h2>
    <span class="card-subtitle">{{ _n(connected_links, "{n} account connected", "{n} accounts connected") }}</span>
  </div>
  <p class="sub">
    {% if last_auto_sync %}{{ _f("Last automatic sync: {when}.", when=last_auto_sync[:16].replace('T', ' ')) }}
    {% else %}{{ _("No automatic sync has run yet.") }}{% endif %}
    {% if cfg.auto_sync %}{{ _f("The next one is at {time}.", time=cfg.sync_time) }}{% else %}{{ _("Automatic sync is off.") }}{% endif %}
  </p>
  <form method="post">
    <input type="hidden" name="form" value="sync_all">
    <button type="submit">{{ _("Sync all accounts now") }}</button>
  </form>
</div>

{% endif %}
{% if section == 'market' %}
<div class="card" id="rates">
  <div class="card-header">
    <h2>{{ _("Exchange rates") }}</h2>
    <span class="card-subtitle">{{ _("European Central Bank") }}</span>
  </div>
  <p class="sub">{{ _("The ECB publishes euro reference rates every business day — free, without a key and without an account. They are what converts an amount in another currency into your base currency, and every total built from them names the day they were published.") }}</p>

  {% if rates.as_of %}
  <p>{{ _n(rates.count, "{n} currency, published {date}.",
           "{n} currencies, published {date}.", date=d(rates.as_of)) }}
     {% if rates.weekend %}<span class="sub">{{ _("The ECB does not publish at the weekend, so this is Friday's — which is also the newest rate there is.") }}</span>{% endif %}</p>
  {% else %}
  <div class="flash flash-warn">{{ _("No rates yet, so amounts in another currency are reported beside your totals rather than inside them. Fetching them needs this machine to reach the internet once.") }}</div>
  {% endif %}

  <form method="post">
    <input type="hidden" name="form" value="fx_refresh">
    <button type="submit">{{ _("Update rates now") }}</button>
  </form>
  <p class="sub">{{ _("Also updated on start-up, at most once a day, in the background. Nothing waits on it: a page renders whether or not the rates arrived.") }}</p>
</div>
{% endif %}

{% if section == 'banks' and payslip_mappings %}
<div class="card" id="payslip-mappings">
  <div class="card-header">
    <h2>{{ _("Payslip mappings") }}</h2>
    <span class="card-subtitle">{{ _n(payslip_mappings | length, "{n} payslip layout you mapped yourself", "{n} payslip layouts you mapped yourself") }}</span>
  </div>
  <div class="table-wrap">
    <table class="grid">
      <thead><tr><th>{{ _("Name") }}</th><th>{{ _("Employer") }}</th><th>{{ _("Earner") }}</th><th>{{ _("Lines") }}</th><th>{{ _("Since") }}</th><th></th></tr></thead>
      <tbody>
      {% for m in payslip_mappings %}
        <tr>
          <td>{{ m.name }}</td><td class="sub">{{ m.employer }}</td><td class="sub">{{ m.employee }}</td>
          <td class="sub">{% for b, labels in m.mapping.buckets.items() %}{{ b }} ← {{ labels | join(' + ') }}{% if not loop.last %} · {% endif %}{% endfor %}</td>
          <td class="sub nowrap">{{ d(m.created_at[:10]) }}</td>
          <td class="num"><form method="post" style="display:inline"><input type="hidden" name="form" value="payslip_mapping_delete"><input type="hidden" name="mapping_id" value="{{ m.id }}"><button type="submit" class="btn-ghost">{{ _("Forget") }}</button></form></td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  <p class="sub">{{ _("A sheet naming one of these employers and earners is read through its mapping without asking. Forget one and the next such sheet asks again — the payslips already imported stay.") }}</p>
</div>
{% endif %}
{% if section == 'banks' and csv_mappings %}
<div class="card" id="mappings">
  <div class="card-header">
    <h2>{{ _("CSV mappings") }}</h2>
    <span class="card-subtitle">{{ _n(csv_mappings | length, "{n} file layout you mapped yourself", "{n} file layouts you mapped yourself") }}</span>
  </div>
  <div class="table-wrap">
    <table class="grid">
      <thead><tr><th>{{ _("Name") }}</th><th>{{ _("Columns") }}</th><th>{{ _("Since") }}</th><th></th></tr></thead>
      <tbody>
      {% for m in csv_mappings %}
        <tr>
          <td>{{ m.name }}</td>
          <td class="sub">{% for f, col in m.mapping.items() if f not in ('negate', 'currency_fixed') %}{{ f }} ← {{ col }}{% if not loop.last %} · {% endif %}{% endfor %}</td>
          <td class="sub nowrap">{{ d(m.created_at[:10]) }}</td>
          <td class="num"><form method="post" style="display:inline"><input type="hidden" name="form" value="csv_mapping_delete"><input type="hidden" name="mapping_id" value="{{ m.id }}"><button type="submit" class="btn-ghost">{{ _("Forget") }}</button></form></td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  <p class="sub">{{ _("A file with one of these headers is imported through its mapping without asking. Forget one and the next such file asks again — the rows already imported stay.") }}</p>
</div>
{% endif %}
{% if section == 'market' %}
<div class="card" id="prices">
  <div class="card-header">
    <h2>{{ _("Market prices") }}</h2>
    <span class="card-subtitle">{{ _("Yahoo Finance") }}</span>
  </div>
  <p class="sub">{{ _("Every holding is valued at its last market price — free, without a key — and every total built from prices names their day. A broker export gives an ISIN and a price source wants a ticker, so the ticker is looked up once and kept. Where the lookup fails or picks the wrong exchange, type the ticker Yahoo uses, like IWDA.AS; what you type is never replaced by a lookup.") }}</p>

  {% if securities %}
  <div class="table-wrap">
    <table class="grid">
      <thead><tr><th>{{ _("Security") }}</th><th>{{ _("Ticker") }}</th><th class="num">{{ _("Price") }}</th><th></th></tr></thead>
      <tbody>
      {% for x in securities %}
        <tr>
          <td><a href="{{ url_for('security_page', isin=x.isin) }}">{{ x.name or x.isin }}</a><span class="sub">{{ x.isin }}</span></td>
          <td>
            <form method="post" class="form inline" style="gap:6px">
              <input type="hidden" name="form" value="price_symbol">
              <input type="hidden" name="isin" value="{{ x.isin }}">
              <input name="symbol" value="{{ x.symbol or '' }}" placeholder="IWDA.AS" style="width:120px;padding:5px 8px;font-size:12.5px;font-family:var(--font-mono)" aria-label="{{ _f('Ticker for {name}', name=x.name) }}">
              <button type="submit" class="btn-ghost">{{ _("Save") }}</button>
            </form>
            {% if x.manual %}<span class="sub">{{ _("typed in") }}</span>{% endif %}
          </td>
          <td class="num">
            {% if x.price %}{{ qty(x.price) }} {{ x.currency }}<span class="sub">{{ d(x.as_of) }}</span>
            {% else %}—{% endif %}
          </td>
          <td>{% if x.error %}<span class="sub" style="color:var(--loss)">{{ x.error }}</span>{% endif %}</td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  {% else %}
  <p class="sub">{{ _("Nothing to price yet — holdings appear here once a broker export or a trade typed in by hand has given you one.") }}</p>
  {% endif %}

  <form method="post">
    <input type="hidden" name="form" value="prices_refresh">
    <button type="submit">{{ _("Update prices now") }}</button>
  </form>
  <p class="sub">{{ _("Also updated on start-up and every few hours in the background. A holding no price could be found for is valued at your last trade, and the pages say so.") }}</p>
</div>

{% endif %}
{% if section == 'banks' %}
<div class="card" id="saxo">
  <div class="card-header">
    <h2>Saxo Bank</h2>
    <span class="card-subtitle">
      {% if saxo_state.connected and saxo_state.alive %}{{ _f("connected · client {id}", id=saxo_state.client_id) }}
      {% elif saxo_state.connected %}{{ _("login lapsed") }}
      {% elif saxo_state.configured %}{{ _("credentials saved, nothing connected yet") }}
      {% else %}{{ _("not set up") }}{% endif %}
      {% if saxo_state.environment == 'sim' %} · {{ _("simulation") }}{% endif %}
    </span>
  </div>
  <p class="sub">{{ _("Saxo's OpenAPI is OAuth: you register an application of your own in Saxo's developer portal, paste its AppKey and AppSecret here, and connect an account from its page — Saxo's login, then straight back. The tokens Saxo hands out die within the hour, so the app renews them every five minutes while it runs; if it was down for longer, the account page says so and connecting again is one click.") }}</p>
  <ol class="sub">
    <li>{{ _("At developer.saxo → Apps, create an application: Live (or Simulation, to try it against Saxo's demo account), grant type Authorization Code, and this exact redirect URL:") }}
      <pre class="mcp-cmd">{{ saxo_state.redirect_uri }}</pre>
      {{ _("It is your dashboard's address plus /saxo/callback, taken from the redirect URL above. If Saxo will not accept it, register it anyway and use “Finish by hand” on the account page.") }}</li>
    <li>{{ _("Paste the AppKey and the AppSecret below.") }}</li>
    <li>{{ _("Open a broker account here and press Connect Saxo.") }}</li>
  </ol>
  <form method="post" class="form">
    <input type="hidden" name="form" value="saxo_credentials">
    <label for="saxo_app_key">AppKey</label>
    <input id="saxo_app_key" name="app_key" value="{{ saxo_state.app_key or '' }}" autocomplete="off">
    <label for="saxo_app_secret">AppSecret</label>
    <input id="saxo_app_secret" name="app_secret" type="password" autocomplete="off" placeholder="{{ '••••••••' if saxo_state.configured else '' }}">
    <label for="saxo_env">{{ _("Environment") }}</label>
    <select id="saxo_env" name="environment" style="width:auto">
      <option value="live" {{ 'selected' if saxo_state.environment != 'sim' }}>Live</option>
      <option value="sim" {{ 'selected' if saxo_state.environment == 'sim' }}>{{ _("Simulation") }}</option>
    </select>
    <div><button type="submit">{{ _("Save Saxo credentials") }}</button></div>
  </form>
  {% if saxo_state.configured %}
  <form method="post" style="margin-top:8px">
    <input type="hidden" name="form" value="saxo_forget">
    <button type="submit" class="btn-danger">{{ _("Forget Saxo") }}</button>
  </form>
  {% endif %}
</div>

{% endif %}
{% if section == 'banks' %}
<div class="card" id="kraken">
  <div class="card-header">
    <h2>Kraken</h2>
    <span class="card-subtitle">{% if kraken_state.configured %}{{ _("key saved") }}{% else %}{{ _("not set up") }}{% endif %}</span>
  </div>
  <p class="sub">{{ _("Kraken needs an API key of your own: kraken.com → Settings → API → Add key. Give it only Query Funds, Query Closed Orders & Trades and Query Ledger Entries — nothing that can trade, withdraw or stake. A key that can only read cannot lose you a coin. Paste the key and the private key here; the private key is shown once when the key is created and is kept 0600 beside the bank key.") }}</p>
  <form method="post" class="form">
    <input type="hidden" name="form" value="kraken_credentials">
    <label for="kraken_key">{{ _("API key") }}</label>
    <input id="kraken_key" name="api_key" autocomplete="off">
    <label for="kraken_secret">{{ _("Private key") }}</label>
    <input id="kraken_secret" name="api_secret" type="password" autocomplete="off">
    <div><button type="submit">{{ _("Save and check the key") }}</button></div>
  </form>
  {% if kraken_state.configured %}
  <form method="post" style="margin-top:8px">
    <input type="hidden" name="form" value="kraken_forget">
    <button type="submit" class="btn-danger">{{ _("Forget the Kraken key") }}</button>
  </form>
  {% endif %}
</div>


<div class="card" id="ibkr">
  <div class="card-header">
    <h2>Interactive Brokers</h2>
    <span class="card-subtitle">{% if ibkr_state.configured %}{{ _("token saved") }}{% else %}{{ _("not set up") }}{% endif %}</span>
  </div>
  <p class="sub">{{ _("No login and no app: IBKR's Flex Web Service. In Account Management → Reports → Flex Queries, make an Activity Flex Query with Trades, Cash Transactions, Open Positions and Cash Report ticked, period Last 365 Days, XML; note its id. Under Reports → Settings → Flex Web Service, switch it on and copy the token. The token can only run Flex queries — it cannot see your login, trade or move money. For what lies before the year the query covers, run it once for a custom period and drop the XML on the import page.") }}</p>
  <form method="post" class="form">
    <input type="hidden" name="form" value="ibkr_credentials">
    <label for="ibkr_token">{{ _("Flex Web Service token") }}</label>
    <input id="ibkr_token" name="token" type="password" autocomplete="off">
    <label for="ibkr_query">{{ _("Flex Query id") }}</label>
    <input id="ibkr_query" name="query_id" autocomplete="off" style="width:140px" placeholder="987654">
    <div><button type="submit">{{ _("Save and run the query once") }}</button></div>
  </form>
  {% if ibkr_state.configured %}
  <form method="post" style="margin-top:8px">
    <input type="hidden" name="form" value="ibkr_forget">
    <button type="submit" class="btn-danger">{{ _("Forget the Interactive Brokers token") }}</button>
  </form>
  {% endif %}
</div>

<div class="card" id="trading212">
  <div class="card-header">
    <h2>Trading 212</h2>
    <span class="card-subtitle">{% if t212_state.configured %}{{ _("key saved") }}{% if t212_state.environment == 'demo' %} · {{ _("practice account") }}{% endif %}{% else %}{{ _("not set up") }}{% endif %}</span>
  </div>
  <p class="sub">{{ _("In the Trading 212 app: Settings → API (Beta) → Generate key. Give it only the read scopes — account data, portfolio, history — and paste the key and the secret here; the secret is shown once. Invest and Stocks ISA accounts only. The API allows six history calls a minute, so a first sync of years of orders takes a few minutes; later syncs are quick.") }}</p>
  <form method="post" class="form">
    <input type="hidden" name="form" value="trading212_credentials">
    <label for="t212_key">{{ _("API key") }}</label>
    <input id="t212_key" name="api_key" autocomplete="off">
    <label for="t212_secret">{{ _("API secret") }}</label>
    <input id="t212_secret" name="api_secret" type="password" autocomplete="off">
    <label for="t212_env">{{ _("Account") }}</label>
    <select id="t212_env" name="environment" style="width:auto">
      <option value="live" {{ 'selected' if t212_state.environment != 'demo' }}>{{ _("live") }}</option>
      <option value="demo" {{ 'selected' if t212_state.environment == 'demo' }}>{{ _("practice") }}</option>
    </select>
    <div><button type="submit">{{ _("Save and check the key") }}</button></div>
  </form>
  {% if t212_state.configured %}
  <form method="post" style="margin-top:8px">
    <input type="hidden" name="form" value="trading212_forget">
    <button type="submit" class="btn-danger">{{ _("Forget the Trading 212 key") }}</button>
  </form>
  {% endif %}
</div>

<div class="card" id="traderepublic">
  <div class="card-header">
    <h2>Trade Republic</h2>
    <span class="card-subtitle">{% if tr_state.logged_in %}{{ _("logged in") }}{% elif tr_state.configured %}{{ _("not logged in") }}{% else %}{{ _("not set up") }}{% endif %} · {{ _("unofficial") }}</span>
  </div>
  <p class="sub">{{ _("Trade Republic publishes no API. This uses the interface its own web app uses — phone number, PIN, the app's approval, then the same WebSocket — and it may stop working any day, as it has before; the statement PDFs always read. The phone number and PIN are kept 0600 beside the other keys; a login lasts until Trade Republic ends it, and the account page says when it has to be renewed.") }}</p>
  <form method="post" class="form">
    <input type="hidden" name="form" value="traderepublic_credentials">
    <label for="tr_phone">{{ _("Phone number") }}</label>
    <input id="tr_phone" name="phone" autocomplete="off" placeholder="+49…" style="width:200px">
    <label for="tr_pin">{{ _("PIN") }}</label>
    <input id="tr_pin" name="pin" type="password" inputmode="numeric" autocomplete="off" style="width:100px">
    <div><button type="submit">{{ _("Save") }}</button></div>
  </form>
  {% if tr_state.configured %}
  <p class="sub">{{ _("Then log in from the account page: the app asks to approve, or for a code.") }}</p>
  <form method="post" style="margin-top:8px">
    <input type="hidden" name="form" value="traderepublic_forget">
    <button type="submit" class="btn-danger">{{ _("Forget Trade Republic") }}</button>
  </form>
  {% endif %}
</div>
{% endif %}
{% if section == 'banks' %}
<div class="card" id="archive">
  <div class="card-header">
    <h2>{{ _("Document archive") }}</h2>
    <span class="card-subtitle">{% if archive_state.configured %}Paperless-ngx · {{ archive_state.url }}{% else %}{{ _("not set up") }}{% endif %}</span>
  </div>
  <p class="sub">{{ _("If your statements live in Paperless-ngx, the app can pull them itself. Give it the archive's address and an API token (Paperless → My Profile → the circular arrow makes one), then say on each account's edit page which documents are its — by tag, correspondent or query. Every new document is fetched on the daily sync and run through the same readers an upload gets; each one is remembered, so nothing comes in twice. The archive is read, never written.") }}
  {{ _("The pull is generic, the reading is not: a document becomes transactions only when there is a reader for its layout. One no reader understood is listed below with a link back, not skipped in silence.") }}</p>
  <form method="post" class="form">
    <input type="hidden" name="form" value="archive_save">
    <label for="archive_url">{{ _("Address") }}</label>
    <input id="archive_url" name="archive_url" value="{{ archive_state.url }}" placeholder="http://paperless.lan:8000" autocomplete="off">
    <label for="archive_token">{{ _("API token") }}{% if archive_state.configured %} <span class="sub">{{ _("leave blank to keep the saved one") }}</span>{% endif %}</label>
    <input id="archive_token" name="archive_token" type="password" autocomplete="off">
    <div><button type="submit">{{ _("Save and check") }}</button></div>
  </form>
  {% if archive_state.configured %}
  <div style="display:flex;gap:8px;flex-wrap:wrap;margin-top:12px">
    <form method="post"><input type="hidden" name="form" value="archive_pull"><button type="submit">{{ _("Pull now") }}</button></form>
    {% if archive_state.unread %}
    <form method="post"><input type="hidden" name="form" value="archive_retry"><button type="submit" class="btn-ghost">{{ _("Try the unread ones again") }}</button></form>
    {% endif %}
    <form method="post"><input type="hidden" name="form" value="archive_forget"><button type="submit" class="btn-danger">{{ _("Forget the archive") }}</button></form>
  </div>
  {% if archive_state.last %}
  <p class="sub" style="margin-top:10px">{{ _f("Last pull {when}.", when=archive_state.last.at[:16].replace('T', ' ')) }}</p>
  {% endif %}
  {% if archive_state.filters %}
  <div class="table-wrap" style="margin-top:8px">
    <table class="grid">
      <thead><tr><th>{{ _("Account") }}</th><th>{{ _("Pulls") }}</th><th class="num">{{ _("Read") }}</th><th class="num">{{ _("Not read") }}</th><th class="num">{{ _("Failed") }}</th></tr></thead>
      <tbody>
      {% for f in archive_state.filters %}
        <tr>
          <td><a href="{{ url_for('account_edit', account_id=f.account_id) }}">{{ f.account }}</a></td>
          <td class="sub">{% if f.tags %}{{ _("tags") }} {{ f.tags }}{% endif %}{% if f.correspondent %} · {{ _("from") }} {{ f.correspondent }}{% endif %}{% if f.query %} · “{{ f.query }}”{% endif %}</td>
          <td class="num">{{ f.imported or 0 }}</td><td class="num">{{ f.unread or 0 }}</td><td class="num">{{ f.failed or 0 }}</td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  {% else %}
  <p class="sub" style="margin-top:10px">{{ _("No account pulls anything yet — open an account's edit page and say which documents are its.") }}</p>
  {% endif %}
  {% if archive_state.unread %}
  <h3 style="font-size:13px;margin:16px 0 6px">{{ _("Could not be read") }}</h3>
  <ul class="steps">
    {% for d in archive_state.unread %}
    <li><a href="{{ archive_state.url }}/documents/{{ d.doc_id }}/details" target="_blank" rel="noopener">{{ d.title or d.doc_id }}</a> <span class="sub">{{ d.account }} · {{ d.created }} · {{ d.note }}</span></li>
    {% endfor %}
  </ul>
  {% endif %}
  {% endif %}
</div>

{% endif %}
{% if section == 'market' %}
<div class="card" id="ideas">
  <div class="card-header">
    <h2>{{ _("Share Ideas") }}</h2>
    <span class="card-subtitle">
      {% if ideas.running %}{{ _("refreshing now") }}
      {% elif ideas.last_run %}{{ _f("last refreshed {when}", when=ideas.last_run[:16].replace('T', ' ')) }}
      {% else %}{{ _("never refreshed") }}{% endif %}
    </span>
  </div>
  <p class="sub">{{ _("The four boards under Share Ideas rank a fixed list of shares and ETFs on figures fetched from Yahoo — free, without a key. The cache is refreshed once a day in the background; the first refresh runs a minute after start-up. A refresh is a few hundred requests with a pause between them and takes a few minutes, so it runs on its own and the boards fill in as it goes.") }}</p>
  <p class="sub">
    {{ _f("Shares: {n} cached, {errors} with a fetch error.", n=ideas.shares.n or 0, errors=ideas.shares.errors or 0) }}
    {{ _f("ETFs: {n} cached, {errors} with a fetch error.", n=ideas.etfs.n or 0, errors=ideas.etfs.errors or 0) }}
  </p>
  <p class="sub">{{ _("To screen more names, or to correct an ETF's TER, edit screener_universe.json and screener_etf_universe.json in the data folder; thresholds live in screener.json beside them. All three are read on every page load.") }}</p>
  <form method="post" class="form inline">
    <input type="hidden" name="form" value="ideas_refresh">
    <button type="submit" {{ 'disabled' if ideas.running }}>{{ _("Refresh share ideas now") }}</button>
    <label class="scr-ctl"><input type="checkbox" name="force" value="1"> {{ _("everything, not only what is older than a day") }}</label>
  </form>
</div>

{% endif %}
{% if section == 'assistants' %}
<div class="card" id="mcp">
  <div class="card-header">
    <h2>{{ _("Claude and other assistants (MCP)") }}</h2>
    <span class="card-subtitle">{% if mcp_token %}{{ _("a token exists") }}{% else %}{{ _("off — no token") }}{% endif %}</span>
  </div>
  <p class="sub">{{ _("An assistant that speaks MCP can read this dashboard and do the chores that are slow by hand — categorise the queue and teach the rules, set budgets, type in a transaction, star a share idea, start a sync. It cannot delete an account, change settings, or see your bank credentials. Access is by a token, which stands in for your password: keep it as private, and revoke it here the moment you are unsure.") }}</p>
  {% if mcp_token %}
  <p class="sub">{{ _("For Claude Code on your network, this is the whole setup:") }}</p>
  <pre class="mcp-cmd">claude mcp add --transport http wealth {{ mcp_url }} --header "Authorization: Bearer {{ mcp_token }}"</pre>
  <p class="sub">{{ _("For Claude Desktop, which only speaks to local processes, the mcp-remote bridge carries the same URL and header. This goes into claude_desktop_config.json under mcpServers:") }}</p>
  <pre class="mcp-cmd">"wealth": {
  "command": "npx",
  "args": ["-y", "mcp-remote", "{{ mcp_url }}", "--transport", "http-only",
           "--header", "Authorization: Bearer {{ mcp_token }}"]
}</pre>
  <p class="sub">{{ _("Two things that cost people an afternoon. The URL is the one the browser reaches the dashboard at: behind a reverse proxy that is the https:// address, not the container's http:// one — the address above is what this page was opened at, so it is right if this page was. And --transport http-only matters: without it mcp-remote first tries the older SSE transport, which this endpoint does not speak, and reports a connection failure that is not one.") }}</p>
  {% endif %}
  <form method="post" class="form inline">
    <input type="hidden" name="form" value="mcp_token">
    <button type="submit" name="action" value="new">{% if mcp_token %}{{ _("Replace the token") }}{% else %}{{ _("Create a token") }}{% endif %}</button>
    {% if mcp_token %}<button type="submit" name="action" value="revoke" class="btn-danger">{{ _("Revoke") }}</button>{% endif %}
  </form>
</div>

{% endif %}
{% if section == 'assistants' %}
<div class="card" id="api">
  <div class="card-header"><h2>{{ _("REST API") }}</h2>
    <span class="card-subtitle">{{ _("the same tools over plain HTTP") }}</span></div>
  <p class="sub">{{ _("Every tool the assistant has is also a URL, for a script or an automation that speaks no MCP — the same token, the same answers, one registry. GET lists the tools with their schemas; GET or POST calls one, arguments as query parameters or a JSON body.") }}</p>
  {% if mcp_token %}
  <pre class="mcp-cmd">curl -H "Authorization: Bearer {{ mcp_token }}" {{ api_url }}
curl -H "Authorization: Bearer {{ mcp_token }}" "{{ api_url }}/net_worth"
curl -H "Authorization: Bearer {{ mcp_token }}" "{{ api_url }}/transactions?q=amazon&limit=5"
curl -H "Authorization: Bearer {{ mcp_token }}" -X POST -H "Content-Type: application/json" \
     -d '{"txn_id": 123, "category": "groceries"}' "{{ api_url }}/set_category"</pre>
  {% else %}
  <p class="sub">{{ _("Create a token above and the examples appear here.") }}</p>
  {% endif %}
</div>

<div class="card" id="report">
  <div class="card-header"><h2>{{ _("Weekly e-mail") }}</h2>
    <span class="card-subtitle">{% if report_state.configured and report_state.enabled %}{{ _f("every {day}", day=weekdays[report_state.weekday]) }}{% elif report_state.configured %}{{ _("set up, switched off") }}{% else %}{{ _("not set up") }}{% endif %}</span></div>
  <p class="sub">{{ _("Once a week, a mail with the week: net worth and its change, every broker and crypto account with its value, price move, gain since purchase, holdings, dividends of the last thirty days and the trailing year, and the indices the app tracks. Sent through an SMTP server of yours — Gmail with an app password works — after the daily sync on the day you pick. It is the one thing this app sends anywhere but your bank: to your own mailbox. The password is kept beside the bank key.") }}
  <a href="{{ url_for('report_preview') }}" target="_blank" rel="noopener">{{ _("Preview today's mail") }}</a></p>
  <form method="post" class="form">
    <input type="hidden" name="form" value="report_save">
    <label class="check"><input type="checkbox" name="report_enabled" value="1" {{ 'checked' if report_state.enabled }}> {{ _("Send the weekly e-mail") }}</label>
    <label for="report_weekday">{{ _("On") }}</label>
    <select id="report_weekday" name="report_weekday" style="width:auto">
      {% for name in weekdays %}<option value="{{ loop.index0 }}" {{ 'selected' if report_state.weekday == loop.index0 }}>{{ name }}</option>{% endfor %}
    </select>
    <label for="report_to">{{ _("To") }} <span class="sub">{{ _("several, separated by commas") }}</span></label>
    <input id="report_to" name="report_to" value="{{ report_state.to }}" placeholder="you@example.com">
    <label for="smtp_host">{{ _("SMTP server") }}</label>
    <input id="smtp_host" name="smtp_host" value="{{ report_state.host }}" placeholder="smtp.gmail.com">
    <label for="smtp_port">{{ _("Port") }} <span class="sub">{{ _("587 for STARTTLS, 465 for TLS") }}</span></label>
    <input id="smtp_port" name="smtp_port" value="{{ report_state.port }}" style="width:100px">
    <label for="smtp_user">{{ _("User name") }}</label>
    <input id="smtp_user" name="smtp_user" value="{{ report_state.user }}" autocomplete="off">
    <label for="smtp_password">{{ _("Password") }}{% if report_state.configured %} <span class="sub">{{ _("leave blank to keep the saved one") }}</span>{% endif %}</label>
    <input id="smtp_password" name="smtp_password" type="password" autocomplete="new-password">
    <label for="smtp_from">{{ _("From") }} <span class="sub">{{ _("optional; the user name otherwise") }}</span></label>
    <input id="smtp_from" name="smtp_from" value="{{ report_state.sender }}">
    <div><button type="submit">{{ _("Save") }}</button></div>
  </form>
  {% if report_state.configured %}
  <div style="display:flex;gap:8px;flex-wrap:wrap;margin-top:12px">
    <form method="post"><input type="hidden" name="form" value="report_test"><button type="submit" class="btn-ghost">{{ _("Send a test mail") }}</button></form>
    <form method="post"><input type="hidden" name="form" value="report_send"><button type="submit">{{ _("Send this week's report now") }}</button></form>
    <form method="post"><input type="hidden" name="form" value="report_forget"><button type="submit" class="btn-danger">{{ _("Forget the e-mail settings") }}</button></form>
  </div>
  {% if report_state.last_sent %}<p class="sub" style="margin-top:10px">{{ _f("Last sent {when}.", when=report_state.last_sent[:16].replace('T', ' ')) }}</p>{% endif %}
  {% endif %}
</div>

<div class="card" id="webhooks">
  <div class="card-header"><h2>{{ _("Webhooks") }}</h2>
    <span class="card-subtitle">{{ _n(hooks | length, "{n} receiver", "{n} receivers") }}</span></div>
  <p class="sub">{{ _("A POST to a URL of yours when something happened: a sync ran or failed, a bill is past due. Home Assistant, n8n, a bot, a script. The body is JSON — event, time, data — and the X-Wealth-Signature header is an HMAC-SHA256 of it with the receiver's secret, so it can tell this app from anyone who found the URL. One attempt, five seconds; a receiver that is down misses that event and the list says so.") }}</p>
  <form method="post" class="form inline sec-form">
    <input type="hidden" name="form" value="webhook_add">
    <div><label for="hook_url">URL</label><input id="hook_url" name="url" placeholder="https://…" style="width:320px"></div>
    <div><label>{{ _("Events") }}</label>
      <span>{% for e in hook_events %}<label class="check"><input type="checkbox" name="events" value="{{ e }}" checked> {{ e }}</label>{% endfor %}</span></div>
    <button type="submit">{{ _("Add the webhook") }}</button>
  </form>
  {% if hooks %}
  <div class="table-wrap" style="margin-top:12px">
    <table class="grid">
      <thead><tr><th>URL</th><th>{{ _("Events") }}</th><th>{{ _("Secret") }}</th><th>{{ _("Last") }}</th><th></th></tr></thead>
      <tbody>
      {% for h in hooks %}
        <tr>
          <td class="nowrap">{{ h.url[:60] }}</td>
          <td class="sub">{{ h.events.replace(',', ', ') }}</td>
          <td><code>{{ h.secret }}</code></td>
          <td class="sub nowrap">{% if h.last_at %}{{ h.last_at[:16].replace('T', ' ') }}{% if h.last_error %}<span class="neg"> · {{ h.last_error }}</span>{% endif %}{% else %}—{% endif %}</td>
          <td class="num"><form method="post" style="display:inline"><input type="hidden" name="form" value="webhook_delete"><input type="hidden" name="hook_id" value="{{ h.id }}"><button type="submit" class="btn-ghost">{{ _("Remove") }}</button></form></td>
        </tr>
      {% endfor %}
      </tbody>
    </table>
  </div>
  <form method="post" style="margin-top:10px"><input type="hidden" name="form" value="webhook_test"><button type="submit" class="btn-ghost">{{ _("Send a test event") }}</button></form>
  {% endif %}
</div>
{% endif %}
{% if section == 'people' %}
<div class="card" id="people">
  <div class="card-header">
    <h2>{{ _("People") }}</h2>
    <span class="card-subtitle">{{ _("whose accounts are whose") }}</span>
  </div>
  <p class="sub">{{ _("A birthday is optional; with one, the Forecast page adds a retirement outlook for that person.") }}
  {{ _("Add the people in your household, then tick on each account who it belongs to — one person, or several for a joint account. A switch appears in the header: Everyone shows the whole household, a name shows only that person's accounts on every page. An account ticked for nobody shows under Everyone only. This is a lens, not a lock: anyone who can sign in can flip it.") }}</p>

  {% if people_list %}
  <div class="cat-list">
  {% for p in people_list %}
    <div class="cat-row">
      <form method="post" class="cat-edit">
        <input type="hidden" name="form" value="person_rename">
        <input type="hidden" name="id" value="{{ p.id }}">
        <input name="name" value="{{ p.name }}" maxlength="60" aria-label="{{ _f('Name of {name}', name=p.name) }}">
        <input name="birthday" type="date" value="{{ p.birthday or '' }}" max="{{ today }}" aria-label="{{ _f('Birthday of {name}', name=p.name) }}" title="{{ _('Birthday — what the retirement outlook counts from') }}">
        <button type="submit" class="btn-ghost">{{ _("Save") }}</button>
      </form>
      <span class="sub cat-usage">{{ _n(p.accounts, "{n} account", "{n} accounts") }}</span>
      <form method="post" class="cat-delete" onsubmit="return confirm({{ _f('Remove {name}? Their accounts stay.', name=p.name) | tojson }});">
        <input type="hidden" name="form" value="person_delete">
        <input type="hidden" name="id" value="{{ p.id }}">
        <button class="btn-danger" type="submit">{{ _("Remove") }}</button>
      </form>
    </div>
  {% endfor %}
  </div>
  {% endif %}

  <form method="post" class="form inline cat-new">
    <input type="hidden" name="form" value="person_add">
    <div>
      <label for="new_person">{{ _("New person") }}</label>
      <input id="new_person" name="name" maxlength="60" placeholder="{{ _('Alex') }}">
    </div>
    <button type="submit">{{ _("Add person") }}</button>
  </form>
</div>

{% endif %}
{% if section == 'categories' %}
<div class="card" id="categories">
  <div class="card-header">
    <h2>{{ _("Categories") }}</h2>
    <span class="card-subtitle">{{ _("renaming one keeps every transaction it holds") }}</span>
  </div>
  <p class="sub">{{ _("A category is identified internally by the name it was created with, so renaming or recolouring one never re-files a transaction — the Groceries you already sorted stay sorted whatever you call them. What “counts as” decides is whether Cash Flow and Budget treat the money as spent, or merely as moved: pay for lunch and it is spending, move €500 to your broker and it is not — or as income, which Cash Flow adds up by category, so a salary, a rent coming in and interest each show as their own.") }}</p>

  <div class="cat-list">
  {% for c in catalogue %}
    <div class="cat-row">
      <form method="post" class="cat-edit">
        <input type="hidden" name="form" value="category_edit">
        <input type="hidden" name="slug" value="{{ c.slug }}">
        <input type="color" class="swatch" name="colour" value="{{ c.colour }}"
               aria-label="{{ _f('Colour for {name}', name=c.label) }}">
        <input name="label" value="{{ c.label }}" maxlength="40"
               aria-label="{{ _f('Name of {name}', name=c.label) }}">
        {% if c.group_locked %}
        <span class="sub cat-fixed" title="{{ _('Cash Flow knows this one by name — it is never counted as spending.') }}">{{ _("income") if c.group == 'income' else _("not spending") }}</span>
        {% else %}
        <select name="group" aria-label="{{ _f('What {name} counts as', name=c.label) }}">
          <option value="spending" {{ 'selected' if c.group == 'spending' }}>{{ _("Spending") }}</option>
          <option value="income" {{ 'selected' if c.group == 'income' }}>{{ _("Income") }}</option>
          <option value="non_spending" {{ 'selected' if c.group == 'non_spending' }}>{{ _("Not spending") }}</option>
        </select>
        {% endif %}
        <button type="submit" class="btn-ghost">{{ _("Save") }}</button>
      </form>
      <span class="sub cat-usage">
        {{ _n(c.transactions, "{n} transaction", "{n} transactions") }}{% if c.rules %} · {{ _n(c.rules, "{n} rule", "{n} rules") }}{% endif %}
      </span>
      {% if c.deletable %}
        {% set warning = _n(c.transactions, "Delete this category? {n} transaction moves to Uncategorised.", "Delete this category? {n} transactions move to Uncategorised.") %}
        {% if c.rules %}{% set warning = warning ~ " " ~ _n(c.rules, "{n} rule is deleted with it.", "{n} rules are deleted with it.") %}{% endif %}
        <form method="post" class="cat-delete" onsubmit="return confirm({{ warning | tojson }});">
          <input type="hidden" name="form" value="category_delete">
          <input type="hidden" name="slug" value="{{ c.slug }}">
          <button class="btn-danger" type="submit">{{ _("Delete") }}</button>
        </form>
      {% else %}
        <span class="tag tag-muted" title="{{ _('The app tells spending from moving your own money by this category, so it cannot be removed.') }}">{{ _("needed") }}</span>
      {% endif %}
    </div>
  {% endfor %}
  </div>

  <form method="post" class="form inline cat-new">
    <input type="hidden" name="form" value="category_new">
    <div>
      <label for="new_colour">{{ _("Colour") }}</label>
      <input type="color" class="swatch" id="new_colour" name="colour" value="#5b9dff">
    </div>
    <div>
      <label for="new_label">{{ _("New category") }}</label>
      <input id="new_label" name="label" maxlength="40" placeholder="{{ _('Childcare') }}">
    </div>
    <div>
      <label for="new_group">{{ _("Counts as") }}</label>
      <select id="new_group" name="group">
        <option value="spending">{{ _("Spending") }}</option>
        <option value="income">{{ _("Income") }}</option>
        <option value="non_spending">{{ _("Not spending") }}</option>
      </select>
    </div>
    <button type="submit">{{ _("Add category") }}</button>
  </form>
</div>

{% endif %}
{% if section == 'banks' %}
<div class="card" id="enablebanking">
  <h2>Enable Banking</h2>
  {% if error %}<div class="flash flash-error">{{ error }}</div>{% endif %}
  <p class="sub">{{ _("Your own application, your own key. Nothing here is shared with anyone — the key never leaves this machine and is only used to sign your own requests.") }}</p>

  <ol class="steps">
    {% set cp_link %}<a href="https://enablebanking.com/cp/applications" rel="noreferrer">enablebanking.com/cp/applications</a>{% endset %}
    {% set pem_file %}<code>&lt;application-id&gt;.pem</code>{% endset %}
    <li>
      <strong>{{ _("Create an application") }}</strong>
      {{ _f("at {control_panel}.", control_panel=cp_link) | safe }}
      {{ _("Environment Production — restricted mode is a state of a production app, not a separate environment.") }}
    </li>
    <li>
      <strong>{{ _("Find your Application ID.") }}</strong>
      {{ _f("It is on the application's page in the Control Panel — a UUID like {example}.", example="<code>0f3a…-…-…</code>") | safe }}
      {{ _f("If you chose Generate for the key, it is also the filename of the file your browser downloaded: {file}.", file=pem_file) | safe }}
    </li>
    <li>
      <strong>{{ _("Find your private key.") }}</strong>
      {{ _("Which file depends on the choice you made when creating the application:") }}
      <ul>
        <li><strong>{{ _("You chose “Generate”") }}</strong> ({{ _("the usual case") }}) —
          {{ _f("your browser downloaded {file}.", file=pem_file) | safe }}
          <em>{{ _("That file is the private key.") }}</em>
          {{ _("Open it in a text editor and copy everything, including the BEGIN and END lines. There is nothing to generate yourself.") }}</li>
        <li><strong>{{ _("You provided your own key") }}</strong> —
          {{ _f("then you already ran the commands below and want {file}.", file="<code>enablebanking_private.key</code>") | safe }}</li>
      </ul>
      <p class="sub">{{ _("Do not paste enablebanking_public.pem, or anything you uploaded to Enable Banking. That is the public half; they have it, you need the other one.") }}</p>
    </li>
    <li><strong>{{ _("Paste both below") }}</strong> {{ _("and save. The app checks them immediately against Enable Banking and tells you what it finds.") }}</li>
  </ol>

  <details>
    <summary class="sub">{{ _("Only if you want to supply your own key instead of letting the Control Panel generate one") }}</summary>
    <pre>openssl genrsa -out enablebanking_private.key 4096
openssl rsa -in enablebanking_private.key -pubout -out enablebanking_public.pem</pre>
    <p class="sub">{{ _("Upload enablebanking_public.pem in the Control Panel; paste enablebanking_private.key below.") }}</p>
  </details>

  <p class="sub">{{ _f("The key is stored at {path} with permissions 0600.", path=secrets_dir) }}</p>

  {% if secrets_inside_data %}
  <div class="flash flash-warn">{{ _("Your credentials live inside the data folder, so every backup of that folder carries your bank key with it. Set WD_SECRETS_DIR to a folder outside it if that matters to you.") }}</div>
  {% endif %}

  <form method="post" class="form">
    <input type="hidden" name="form" value="credentials">
    <label for="app_id">{{ _("Application ID") }}</label>
    <input id="app_id" name="app_id" placeholder="00000000-0000-0000-0000-000000000000"
           {% if configured %}placeholder="{{ _('stored — paste again to replace') }}"{% endif %}>
    <label for="private_key">{{ _("Private key (PEM)") }}</label>
    <textarea id="private_key" name="private_key" rows="6"
              placeholder="-----BEGIN PRIVATE KEY-----&#10;...&#10;-----END PRIVATE KEY-----"></textarea>
    <button type="submit">{{ _("Save credentials") }}</button>
  </form>

  {% if configured %}
    {% set test_link %}<a href="{{ url_for('settings_page', section='banks', check=1) }}">{{ _("Test them") }}</a>{% endset %}
    <p class="sub">{{ _f("Credentials are stored. {test} — this makes one live call to Enable Banking.", test=test_link) | safe }}</p>
    {% if check and check.ok %}
      <div class="flash flash-ok">{{ _("Working. Registered redirect URLs:") }}
        {{ (check.application.redirect_urls or [_('none')])|join(', ') }}</div>
    {% elif check %}
      <div class="flash flash-error">{{ check.error }}</div>
    {% endif %}
  {% endif %}
</div>
{% endif %}
{% endblock %}