{% extends "config/base.html" %}
{% import "site_shell/_macros.html" as ui %}

{% block title %}Enrollment Tokens - Pychestrate Configuration{% endblock %}

{% block content %}
<div class="page-header">
    <h1>Client Enrollment Tokens</h1>
    <p>Mint, list, and revoke client enrollment bootstrap tokens</p>
</div>

{% if minted is defined and minted %}
<div class="card" style="max-width: 45rem; margin-bottom: 1.5rem; border-color: var(--pyc-color-on-success-surface); background: var(--pyc-color-success-surface);">
    <div class="card-header" style="border-color: var(--pyc-color-on-success-surface);">
        Token {{ ui.truncate_id(minted.token_id, 8) }} minted for pod "{{ minted.pod_name }}" in project "{{ minted.project_label }}"
    </div>
    <p class="strong text-danger mb-sm">
        Shown once &mdash; save it now. The secret cannot be retrieved again.
    </p>
    {% for warning in minted.warnings | default([]) %}
    <p class="text-danger small" data-role="mint-warning">{{ warning }}</p>
    {% endfor %}
    <p class="muted small">Enrollment token secret:</p>
    <pre class="command-box" id="mint-secret" data-role="mint-secret">{{ minted.secret }}</pre>
    <p class="mb-sm"><button type="button" class="btn btn-sm btn-secondary" data-copy-from="#mint-secret" data-role="copy-secret">{{ ui.icon("content_copy") }} Copy secret</button></p>
    <p class="muted small">
        Next steps &mdash; on the client machine, enroll and then start the runtime:
    </p>
    <pre class="command-box" id="mint-commands" data-role="mint-commands">{{ minted.enroll_command }}
{{ minted.run_command }}</pre>
    <p class="mb-sm"><button type="button" class="btn btn-sm btn-secondary" data-copy-from="#mint-commands" data-role="copy-commands">{{ ui.icon("content_copy") }} Copy commands</button></p>
    <p class="muted small">
        Do not reload this page: it would send the form again. If you do, no second token is made.
    </p>
    <p class="muted small">
        Setting up a new machine? The
        <a href="https://github.com/code-craft-ai-company/pychestrate-client/blob/main/userguide/01-00-quickstart.rst" target="_blank" rel="noopener">pod guide</a>
        covers installing the client, running it as a service, upgrading it, and what its errors mean.
    </p>
</div>
{% endif %}

<div class="card narrow mb">
    <h2 class="card-header">Mint New Token</h2>
    <form method="post"
          action="{{ url_for('config.enrollment_token_mint') }}">
        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">

        <div class="form-group">
            <label for="project_id">Project *</label>
            {% if project_choices %}
            <select id="project_id" name="project_id" class="form-control" required{{ ui.invalid_attrs(errors, 'project_id', 'project_id-help') }}>
                <option value="">Choose a project&hellip;</option>
                {% for group in project_choice_groups %}
                <optgroup label="{{ group.label }}">
                    {% for choice in group.choices %}
                    <option value="{{ choice.value }}" {% if mint_form.project_id == choice.value %}selected{% endif %}>{{ choice.label }}{% if group.show_detail %} ({{ choice.detail }}){% endif %}</option>
                    {% endfor %}
                </optgroup>
                {% endfor %}
            </select>
            {{ ui.field_error(errors, 'project_id') }}
            <p id="project_id-help" class="form-text">The project whose jobs the enrolled client will run.</p>
            {% else %}
            <p class="muted small" id="project_id-empty">
                There are no projects yet. <a href="{{ url_for('projects.project_create') }}">Create a project</a>
                first, then come back to mint a token for it.
            </p>
            {% endif %}
        </div>

        <div class="form-group">
            <label for="pod_name">Pod label *</label>
            <input type="text" id="pod_name" name="pod_name"
                   class="form-control" required maxlength="128"
                   value="{{ mint_form.pod_name }}"{{ ui.invalid_attrs(errors, 'pod_name', 'pod_name-help') }}>
            {{ ui.field_error(errors, 'pod_name') }}
            <p id="pod_name-help" class="form-text">
                The label the client enrolls under &mdash; the value it
                passes as <code>--name</code>. The token only enrolls a
                client with this label.
            </p>
        </div>

        <div class="form-group">
            <label for="ttl_seconds">Expiry (TTL seconds)</label>
            <input type="number" id="ttl_seconds" name="ttl_seconds"
                   class="form-control" min="1"
                   value="{{ mint_form.ttl_seconds }}"
                   placeholder="{{ default_ttl_seconds }}" aria-describedby="ttl_seconds-help">
            <p id="ttl_seconds-help" class="form-text">
                Optional. Blank defaults to {{ default_ttl_seconds }}
                seconds.
            </p>
        </div>

        <div class="form-group">
            <label>
                <input type="checkbox" name="one_shot" value="1" {% if mint_form.one_shot %}checked{% endif %}>
                One-shot (consumed on first redemption)
            </label>
        </div>

        <button type="submit" class="btn btn-primary"{% if not project_choices %} disabled{% endif %}>
            {{ ui.icon("add") }} Mint Token
        </button>
    </form>
</div>

<div class="table-scroll" tabindex="0"><table class="data-table">
    <thead>
        <tr>
            <th scope="col">Token ID</th>
            <th scope="col">Project</th>
            <th scope="col">Pod label</th>
            <th scope="col">Status</th>
            <th scope="col">Issued</th>
            <th scope="col">Expires</th>
            <th scope="col">Actions</th>
        </tr>
    </thead>
    <tbody>
        {% for token in tokens %}
        <tr>
            <td>{{ ui.truncate_id(token.token_id, 8) }}</td>
            <td class="min-name">{% if token.project_id in project_labels %}{{ project_labels[token.project_id] }}{% else %}{{ ui.truncate_id(token.project_id) }}{% endif %}</td>
            <td>{{ token.pod_name }}</td>
            <td>
                {{ ui.status_badge(token.status) }}
                {% if token.redeemed_by_client_id %}
                <div class="muted small" data-role="redeemed-by">by client <a href="/clients">{{ ui.truncate_id(token.redeemed_by_client_id, 8) }}</a>{% if token.redeemed_at %} on {{ token.redeemed_at | local_datetime(false, '—') }}{% endif %}</div>
                {% endif %}
            </td>
            <td class="nowrap">{{ token.issued_at | local_datetime(false, '—') }}</td>
            <td class="nowrap">{{ token.expires_at | local_datetime(false, '—') }}</td>
            <td>
                {% if token.status.value == 'PENDING' %}
                <form action="{{ url_for('config.enrollment_token_revoke', token_id=token.token_id) }}"
                      method="post" data-confirm="Revoke this token?">
                    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                    <button type="submit" class="btn btn-sm btn-quiet-danger">
                        Revoke
                    </button>
                </form>
                {% else %}
                <span class="muted">-</span>
                {% endif %}
            </td>
        </tr>
        {% else %}
        {{ ui.empty_state("No enrollment tokens found", colspan=7) }}
        {% endfor %}
    </tbody>
</table></div>

<p class="muted mt">
    {% set token_count = tokens | length %}Total: {{ token_count }} token{{ '' if token_count == 1 else 's' }}
</p>
{% include "site_shell/_local_times.html" %}
{% include "site_shell/_copy_buttons.html" %}
{% endblock %}