{% extends "base.html" %}
{% block title %}Users — JMRI{% endblock %}
{% block content %}

{% if notice %}
  <div class="card" style="border-color: var(--warn, #f0c674)">
    <strong>{{ notice }}</strong>
  </div>
{% endif %}

{% if new_token %}
  <div class="card" style="border-color: var(--warn, #f0c674)">
    <p><strong>New API token for {{ new_token_user }}:</strong></p>
    <pre class="mono">{{ new_token }}</pre>
    <p class="small muted">Copy this to your throttle / mobile client now — it
       won't be shown again. The previous token stopped working immediately.</p>
  </div>
{% endif %}

{# ---- Self-service panel — always visible when logged in ---- #}
{% if request.state.user %}
<div class="card">
  <h2>Your account</h2>
  <p class="muted">Signed in as
     <code class="mono">{{ request.state.user.username }}</code>
     · role <code class="mono">{{ request.state.role.value }}</code>.</p>

  <form method="post" action="/users/self/change-password" class="row">
    <input type="hidden" name="_csrf" value="{{ csrf_token }}" />
    <label style="display:block; flex:1">Change your password
      <input type="password" name="new_password" required minlength="6"
             autocomplete="new-password"
             style="display:block; width:100%; box-sizing:border-box;" />
    </label>
    <button type="submit">Change password</button>
  </form>

  <form method="post" action="/users/self/regenerate-token"
        style="margin-top: 0.75rem;"
        onsubmit="return confirm('Regenerate your API token? Existing throttle sessions using the current token will stop working immediately.')">
    <input type="hidden" name="_csrf" value="{{ csrf_token }}" />
    <button type="submit">Regenerate my API token</button>
  </form>
</div>
{% endif %}

{# ---- Admin-only user list + CRUD ---- #}
{% if is_admin %}
<div class="card">
  <h2>Users</h2>
  <table>
    <thead>
      <tr>
        <th>Username</th>
        <th>Role</th>
        <th>Has token</th>
        <th>Actions</th>
      </tr>
    </thead>
    <tbody>
      {% for u in users %}
      <tr>
        <td>
          {% if u.self %}<strong>{{ u.username }}</strong> <span class="muted">(you)</span>
          {% else %}{{ u.username }}
          {% endif %}
        </td>
        <td>
          {% if not u.self %}
          <form method="post" action="/users/{{ u.username }}/set-role"
                style="display:inline">
            <input type="hidden" name="_csrf" value="{{ csrf_token }}" />
            <select name="role" onchange="this.form.submit()">
              {% for r in ['viewer','operator','admin'] %}
                <option value="{{ r }}" {% if u.role == r %}selected{% endif %}>{{ r }}</option>
              {% endfor %}
            </select>
          </form>
          {% else %}
            <code class="mono">{{ u.role }}</code>
          {% endif %}
        </td>
        <td>{{ 'yes' if u.has_token else 'no' }}</td>
        <td>
          <form method="post" action="/users/{{ u.username }}/regenerate-token"
                style="display:inline"
                onsubmit="return confirm('Regenerate {{ u.username }}\'s API token? Their existing throttle sessions will stop working immediately.')">
            <input type="hidden" name="_csrf" value="{{ csrf_token }}" />
            <button type="submit" class="small">regen token</button>
          </form>
          {% if not u.self %}
          <form method="post" action="/users/{{ u.username }}/delete"
                style="display:inline"
                onsubmit="return confirm('Delete user {{ u.username }}? This cannot be undone.')">
            <input type="hidden" name="_csrf" value="{{ csrf_token }}" />
            <button type="submit" class="small danger">delete</button>
          </form>
          {% endif %}
        </td>
      </tr>
      {% endfor %}
    </tbody>
  </table>
</div>

<div class="card">
  <h3>Create new user</h3>
  <form method="post" action="/users/create">
    <input type="hidden" name="_csrf" value="{{ csrf_token }}" />
    <label style="display: block;">Username
      <input type="text" name="username" required
             pattern="[A-Za-z0-9._-]+"
             style="display: block; width: 100%; box-sizing: border-box;" />
    </label>
    <label style="display: block; margin-top: 0.5rem;">Password
      <input type="password" name="password" required minlength="6"
             autocomplete="new-password"
             style="display: block; width: 100%; box-sizing: border-box;" />
    </label>
    <label style="display: block; margin-top: 0.5rem;">Role
      <select name="role" style="display: block; width: 100%;">
        <option value="viewer">viewer</option>
        <option value="operator" selected>operator</option>
        <option value="admin">admin</option>
      </select>
    </label>
    <button type="submit" style="margin-top: 1rem;">Create user</button>
  </form>
</div>
{% endif %}

{% endblock %}