{#
  The keys programs authenticate with, and what this installation demands of a caller.

  Keys only. People — who is a member, in what role, whether they are enabled — are the people
  page's (`users.html`), because a key and a membership are minted, owned and revoked
  differently, and one page carrying both would blur which control does what.
#}{% extends layout %}
{% import "macros.html" as m %}
{% block content %}

<section class="panel">
  <h2>This request</h2>
  <dl class="facts">
    <dt>Authentication mode</dt><dd>{{ auth_mode }}</dd>
    <dt>Authenticated</dt><dd>{{ 'yes' if authenticated else 'no' }}</dd>
    <dt>Role</dt><dd>{{ role }}</dd>
    <dt>Credential</dt><dd>{{ credential or '—' }}</dd>
    <dt>Key</dt><dd>{{ key_name or '—' }} {% if key_id %}<code>{{ key_id }}</code>{% endif %}</dd>
    <dt>Workspace</dt><dd>{{ workspace }}</dd>
  </dl>
  {% if auth_mode == 'none' %}
  <p class="muted">
    With <code>security.auth.mode = none</code> there is no credential to check and the caller
    is whoever is sitting at this machine — the same authority the command line has. That is
    only tolerable because a non-loopback bind with authentication off is refused twice: once
    before a socket exists, and once before an application does.
  </p>
  {% endif %}
</section>

<section class="panel">
  <h2>Keys</h2>
  <p class="muted">
    Records, never secrets. Only a digest is stored, so a lost key is reissued rather than
    recovered — the one copy of a secret is in the response that minted it.
  </p>
  <form class="filters" data-create-key>
    <label for="key-name">Name</label>
    <input id="key-name" name="name" required autocomplete="off">
    <label for="key-role">Role</label>
    <select id="key-role" name="role">
      <option value="viewer">viewer</option>
      <option value="member" selected>member</option>
      <option value="admin">admin</option>
    </select>
    <label for="key-days">Expires in (days)</label>
    <input id="key-days" name="expires_days" type="number" min="1" max="3650" inputmode="numeric">
    <label for="key-rate-limit">Rate limit (requests/minute)</label>
    <input id="key-rate-limit" name="rate_limit" type="number" min="1" inputmode="numeric">
    <label for="key-allowed-ips">Allowed IPs (comma-separated CIDRs)</label>
    <input id="key-allowed-ips" name="allowed_ips" autocomplete="off" placeholder="anywhere">
    <button type="submit">Mint</button>
  </form>
  <p class="secret" data-secret hidden></p>
  <p class="muted" data-key-status role="status" aria-live="polite"></p>

  {% if panels.api_keys.ok %}
    {% if panels.api_keys.data.keys %}
    <table>
      <thead><tr><th>Name</th><th>Prefix</th><th>Role</th><th>Owner</th><th>Allowed IPs</th><th>Rate limit</th><th>Created</th><th>Expires</th><th>State</th><th></th></tr></thead>
      <tbody>
        {% for key in panels.api_keys.data.keys %}
        <tr>
          <td>{{ key.name }}</td>
          <td><code>{{ key.prefix }}</code></td>
          <td>{{ key.role }}</td>
          <td>{{ key.user_id or 'installation' }}</td>
          <td>{{ key.allowed_ips | join(', ') if key.allowed_ips else 'anywhere' }}</td>
          <td>{{ key.rate_limit if key.rate_limit is not none else 'default' }}</td>
          <td>{{ key.created_at }}</td>
          <td>{{ key.expires_at or 'never' }}</td>
          <td>{{ 'revoked' if key.revoked else 'live' }}</td>
          <td class="actions">
            {% if not key.revoked %}
            <button type="button" class="ghost danger" data-revoke="{{ key.id }}">Revoke</button>
            {% endif %}
          </td>
        </tr>
        {% endfor %}
      </tbody>
    </table>
    {% else %}{{ m.empty('No keys have been minted.') }}{% endif %}
  {% else %}{{ m.failed(panels.api_keys) }}{% endif %}
</section>

<section class="panel">
  <h2>Identity providers</h2>
  {% if panels.providers.ok %}
  <p>Mode <strong>{{ panels.providers.data.mode }}</strong>, {{ panels.providers.data.count }} configured.</p>
  {% if panels.providers.data.providers %}
  <ul class="list">{% for name in panels.providers.data.providers %}<li>{{ name }}</li>{% endfor %}</ul>
  <p class="muted">
    People sign in at <a href="/ui/login">the sign-in page</a> and are administered on
    <a href="/ui/users">the people page</a>.
  </p>
  {% endif %}
  {% if panels.providers.data.detail %}<p class="muted">{{ panels.providers.data.detail }}</p>{% endif %}
  {% else %}{{ m.failed(panels.providers) }}{% endif %}
</section>
{% endblock %}