{% extends "config/base.html" %}
{% import "site_shell/_macros.html" as ui %}

{% block title %}API Tokens - Pychestrate Configuration{% endblock %}

{% block content %}
{% set form = form_data or {} %}
<div class="page-header">
    <h1>API Tokens &amp; Service Accounts</h1>
    <p>
        Service accounts are non-human identities for CI and automation: they have
        no password, get roles like any user (on the
        <a href="{{ url_for('config.user_list') }}">Users</a> page), and
        authenticate with API tokens. Every token acts with its account's
        permissions and never more. Manage your own tokens under
        <a href="{{ url_for('config.account_api_tokens') }}">Account &rsaquo; API tokens</a>.
    </p>
</div>

{% include "config/tokens/_minted.html" %}

{{ ui.error_summary(errors, error_labels) }}

<h2>Service accounts</h2>

{% if can_create_service_accounts %}
<div class="card narrow mb">
    <h3 class="card-header">Create a service account</h3>
    <form method="post" action="{{ url_for('config.service_account_create') }}">
        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
        <div class="form-group">
            <label for="login_name">Login name *</label>
            <input type="text" id="login_name" name="login_name" class="form-control" required
                   pattern="[a-z0-9][a-z0-9._\-]{1,62}" title="2 to 63 lower-case letters, digits, dots, underscores or hyphens." placeholder="e.g. ci-nightly"
                   value="{{ form.get('login_name', '') if not issue_for else '' }}"{{ ui.invalid_attrs(errors, "login_name", "login_name-help") }}>
            {{ ui.field_error(errors, "login_name") }}
            <p class="form-text" id="login_name-help">2-63 lower-case letters, digits, '.', '_' or '—'.</p>
        </div>
        <div class="form-group">
            <label for="display_name">Display name</label>
            <input type="text" id="display_name" name="display_name" class="form-control"
                   maxlength="256" placeholder="e.g. Nightly CI" value="{{ form.get('display_name', '') if not issue_for else '' }}"{{ ui.invalid_attrs(errors, "display_name") }}>
            {{ ui.field_error(errors, "display_name") }}
        </div>
        <button type="submit" class="btn btn-primary">{{ ui.icon("add") }} Create service account</button>
    </form>
</div>
{% endif %}

<div class="table-scroll mb" tabindex="0"><table class="data-table">
    <caption class="visually-hidden">Service accounts</caption>
    <thead>
        <tr>
            <th scope="col">Login name</th>
            <th scope="col">Display name</th>
            <th scope="col">Status</th>
            <th scope="col">Active tokens</th>
            <th scope="col">Created</th>
            <th scope="col">Actions</th>
        </tr>
    </thead>
    <tbody>
        {% for account in service_accounts %}
        {% set uid = account.user_id | string %}
        {% set mine = issue_for == uid %}
        {% set chosen_days = ((form.get('expires_in_days') if mine else '') or default_lifetime_days) | string %}
        <tr>
            <td class="mono">{{ account.login_name }}</td>
            <td>{{ account.display_name }}</td>
            <td>{{ ui.status_badge(account.status) }}</td>
            <td>{{ account.active_token_count }}</td>
            <td>{{ account.created_at | format_datetime }}</td>
            <td>
                {% if can_manage_tokens and account.status == 'ACTIVE' %}
                <details class="pyc-run-details"{% if mine %} open{% endif %}>
                    <summary class="btn btn-sm btn-secondary">{{ ui.icon("add") }} Issue token</summary>
                    <form action="{{ url_for('config.service_account_token_create', user_id=account.user_id) }}"
                          method="post" class="pyc-run-form">
                        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                        <label for="sa-token-name-{{ uid }}">Token name</label>
                        <input type="text" id="sa-token-name-{{ uid }}" name="name"
                               class="form-control" required maxlength="128" placeholder="e.g. nightly pipeline"
                               value="{{ form.get('name', '') if mine else '' }}"{{ ui.invalid_attrs(errors, "sa-token-name-" ~ uid) }}>
                        {{ ui.field_error(errors, "sa-token-name-" ~ uid) }}
                        <label for="sa-token-expires-{{ uid }}">Expires after</label>
                        <select id="sa-token-expires-{{ uid }}" name="expires_in_days" class="form-control"{{ ui.invalid_attrs(errors, "sa-token-expires-" ~ uid) }}>
                            {% for days in lifetime_choices %}
                            <option value="{{ days }}" {% if days | string == chosen_days %}selected{% endif %}>{{ days }} days</option>
                            {% endfor %}
                        </select>
                        {{ ui.field_error(errors, "sa-token-expires-" ~ uid) }}
                        <label for="sa-token-scope-{{ uid }}">Access</label>
                        <select id="sa-token-scope-{{ uid }}" name="scope" class="form-control"{{ ui.invalid_attrs(errors, "sa-token-scope-" ~ uid) }}>
                            <option value="read-write" {% if not (mine and form.get('scope') == 'read-only') %}selected{% endif %}>Read and write</option>
                            <option value="read-only" {% if mine and form.get('scope') == 'read-only' %}selected{% endif %}>Read only</option>
                        </select>
                        {{ ui.field_error(errors, "sa-token-scope-" ~ uid) }}
                        <button type="submit" class="btn btn-sm btn-primary">Issue token</button>
                    </form>
                </details>
                {% else %}
                <span class="muted">&mdash;</span>
                {% endif %}
            </td>
        </tr>
        {% else %}
        {{ ui.empty_state("No service accounts yet", hint="Create one for each CI system or script that calls the API.", colspan=6) }}
        {% endfor %}
    </tbody>
</table></div>

<h2>All tokens</h2>

<div class="table-scroll" tabindex="0"><table class="data-table">
    <caption class="visually-hidden">Every API token</caption>
    <thead>
        <tr>
            <th scope="col">Account</th>
            <th scope="col">Name</th>
            <th scope="col">Token</th>
            <th scope="col">Access</th>
            <th scope="col">Status</th>
            <th scope="col">Last used</th>
            <th scope="col">Expires</th>
            <th scope="col">Actions</th>
        </tr>
    </thead>
    <tbody>
        {% for token in tokens %}
        <tr>
            <td>
                {{ token.login_name }}
                {% if token.is_service_account %}<span class="badge badge-info">service account</span>{% endif %}
            </td>
            <td>{{ token.name }}</td>
            <td class="mono">{{ token.token_hint }}&hellip;</td>
            <td>{{ token.scope }}</td>
            <td>{{ ui.status_badge(token.status) }}</td>
            <td>{% if token.last_used_at %}{{ token.last_used_at | format_datetime }}{% else %}never{% endif %}</td>
            <td>{{ token.expires_at | format_datetime }}</td>
            <td>
                {% if can_manage_tokens and token.status == 'active' %}
                <form action="{{ url_for('config.admin_api_token_revoke', token_id=token.token_id) }}"
                      method="post" data-confirm="Revoke token '{{ token.name }}' of {{ token.login_name }}?">
                    <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                    <button type="submit" class="btn btn-sm btn-quiet-danger">Revoke</button>
                </form>
                {% else %}
                <span class="muted">&mdash;</span>
                {% endif %}
            </td>
        </tr>
        {% else %}
        {{ ui.empty_state("No API tokens have been issued", colspan=8) }}
        {% endfor %}
    </tbody>
</table></div>

<p class="muted mt">{% set token_count = tokens | length %}{% set account_count = service_accounts | length %}Total: {{ token_count }} token{{ '' if token_count == 1 else 's' }}, {{ account_count }} service account{{ '' if account_count == 1 else 's' }}</p>
{% endblock %}