{% extends "base.html" %}
{% from "components/ui.html" import breadcrumb, card, csrf_field with context %}
{% from "components/grants.html" import grant_editor, role_checks %}
{% block title %}New user · {{ APP_NAME }}{% endblock %}
{% block heading %}New user{% endblock %}
{% block subheading %}{{ breadcrumb([("Users", "/ui/users"), ("New user", None)]) }}{% endblock %}
{% block content %}
<form method="post" action="/ui/users">
  {{ csrf_field() }}
  {% call card("User", meta="A user acts with its roles and grants. It signs in to the UI with a password, and to the API with a token.") %}
    <div class="form-grid">
      <div class="field">
        <label for="f-name">Name</label>
        <input id="f-name" name="name" value="{{ typed.name if typed else '' }}" required autofocus placeholder="e.g. claude-desktop" />
      </div>
      <div class="field">
        {% set to_ui = typed and typed.signs_in_to == "ui" %}
        <span class="label">Signs in to</span>
        <label class="check"><input type="radio" name="signs_in_to" value="api"{% if not to_ui %} checked{% endif %} /> the API only, with tokens</label>
        <label class="check"><input type="radio" name="signs_in_to" value="ui"{% if to_ui %} checked{% endif %} /> the UI and the API</label>
        {% if can_set_password %}<label class="check"><input type="checkbox" name="one_time" value="1"{% if not typed or typed.one_time %} checked{% endif %} /> with the UI: make a one-time password, shown once, changed at the first sign-in</label>{% endif %}
      </div>
    </div>
    {% if role_choices %}{{ role_checks(role_choices, typed.roles if typed else []) }}{% endif %}
  {% endcall %}
  {% call card("Grants", meta="You can hand out only rights you hold yourself.") %}
    {{ grant_editor(rows, account_choices, groups, group_ops) }}
  {% endcall %}
  <div class="form-actions">
    <button class="primary" type="submit">Create</button>
    <a class="btn" href="/ui/users">Cancel</a>
  </div>
</form>
{% endblock %}