{% extends "base.html" %}
{% block title %}Allow access · Docmost MCP{% endblock %}
{% block body %}
<h1>Allow {{ client_name }} to use Docmost as you?</h1>
<p>The app will act in Docmost as <strong>{{ member.email }}</strong>, with your Docmost rights.</p>
<p class="muted">After you decide, you are sent back to <code>{{ redirect_host }}</code>. Continue only if you started this from that app.</p>
<form method="post" action="/oauth/consent">
  <input type="hidden" name="csrf" value="{{ csrf }}">
  <input type="hidden" name="request" value="{{ request_id }}">
  <fieldset>
    <legend>Access</legend>
    <label class="check"><input type="checkbox" checked disabled> read: read pages, comments and search</label>
    {% if "write" in requested %}<label class="check"><input type="checkbox" name="scope" value="write"> write: create and edit pages and comments</label>{% endif %}
    {% if "delete" in requested %}<label class="check"><input type="checkbox" name="scope" value="delete"> delete: move pages to Trash and restore them</label>{% endif %}
  </fieldset>
  <p class="muted">Page content can contain instructions aimed at the AI. Grant write and delete only to apps you trust. You can revoke access on your <a href="/account">account page</a>.</p>
  <div class="row">
    <button type="submit" name="action" value="approve">Allow</button>
    <button class="link" type="submit" name="action" value="deny">Deny</button>
  </div>
</form>
{% endblock %}