{% extends "tesm_core/base.html" %}
{% from "tesm_core/macros.html" import field, textarea_field, pill, search_box, modal,
        empty_state, alert %}

{% macro credential_form(entry=None) %}
  <div class="form-grid">
    {{ field('name', 'Name', value=entry.name if entry else '', required=True,
             hint_text='Frei wählbar, z. B. "Switch-Admin" oder "Linux-Wartung".') }}
    {{ field('username', 'Benutzer', value=entry.username if entry else '', autocomplete='off') }}
    {{ field('secret', 'Passwort' ~ (' (leer lassen = unverändert)' if entry else ''),
             type='password', autocomplete='new-password',
             required=False if entry else True) }}
    <label class="field">
      <span class="field__label">Kategorie</span>
      <select class="select" name="category">
        {% for value, label in categories %}
          <option value="{{ value }}" {% if entry and entry.category == value %}selected{% endif %}>{{ label }}</option>
        {% endfor %}
      </select>
    </label>
    {{ textarea_field('description', 'Beschreibung', value=entry.description if entry else '',
                      rows=2, extra_class='field--full') }}
  </div>
{% endmacro %}

{% block page_title %}Zugangsdaten{% endblock %}
{% block page_sub %}{{ credentials | length }} Einträge &middot; verschlüsselt mit AES-256-GCM{% endblock %}

{% block topbar_extra %}
  {{ search_box('credentials-table', 'Name, Benutzer ...') }}
  {% if current_user.has('credentials.create') %}
    <button class="btn btn--primary btn--sm" type="button" data-dialog-open="credential-new">
      {{ icon('plus', size=15) }} Anlegen
    </button>
  {% endif %}
{% endblock %}

{% block content %}
{{ alert('Passwörter liegen AES-256-GCM-verschlüsselt und an ihren Verwendungszweck gebunden.
Sie im Klartext zu sehen braucht ein eigenes Recht, eine frische Passwortbestätigung und wird
protokolliert. Die Kategorie setzen Sie ausdrücklich -- sie wird bewusst nicht geraten, weil
davon abhängt, welche Geräte auf der Wartungsseite erscheinen.', 'info') }}

<section class="card">
  <div class="table-wrap">
    <table class="table" id="credentials-table" data-behavior="sortable">
      <thead>
        <tr>
          <th class="sortable">Name</th>
          <th class="sortable">Benutzer</th>
          <th class="sortable">Kategorie</th>
          <th class="sortable numeric">Verwendet von</th>
          <th>Passwort</th>
          <th class="actions">Aktion</th>
        </tr>
      </thead>
      <tbody>
        {% for entry in credentials %}
          <tr data-filter-text="{{ entry.name }} {{ entry.username }} {{ entry.category }} {{ entry.description }}">
            <td>
              <div class="fw-600">{{ entry.name }}</div>
              {% if entry.description %}<div class="fs-xs faint">{{ entry.description }}</div>{% endif %}
            </td>
            <td class="mono fs-sm">{{ entry.username or '&ndash;' | safe }}</td>
            <td class="fs-sm">{{ dict(categories).get(entry.category, entry.category) }}</td>
            <td class="numeric">{{ entry.in_use }}</td>
            <td>
              {% if entry.has_secret %}{{ pill('gesetzt', 'online') }}
              {% else %}{{ pill('fehlt', 'warning') }}{% endif %}
            </td>
            <td class="actions">
              {% if current_user.has('credentials.secrets') and entry.has_secret %}
                <form method="post" action="{{ url_for('credentials.reveal', credential_id=entry.id) }}"
                      style="display:inline" data-no-guard>
                  <input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
                  <button class="btn btn--sm btn--ghost" type="submit" aria-label="Klartext anzeigen"
                          data-confirm="Passwort von {{ entry.name }} im Klartext anzeigen? Dieser Zugriff wird protokolliert."
                          data-confirm-title="Klartext anzeigen" data-confirm-ok="Anzeigen"
                          data-confirm-style="primary">{{ icon('eye', size=15) }}</button>
                </form>
              {% endif %}
              {% if current_user.has('credentials.edit') %}
                <button class="btn btn--sm btn--ghost" type="button"
                        data-dialog-open="credential-edit-{{ entry.id }}" aria-label="Bearbeiten">
                  {{ icon('pencil', size=15) }}
                </button>
              {% endif %}
              {% if current_user.has('credentials.delete') %}
                <form method="post" action="{{ url_for('credentials.delete', credential_id=entry.id) }}"
                      style="display:inline" data-no-guard>
                  <input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
                  <button class="btn btn--sm btn--ghost danger-text" type="submit" aria-label="Löschen"
                          {% if entry.in_use %}disabled title="Wird noch von {{ entry.in_use }} Einträgen verwendet"{% endif %}
                          data-confirm="{{ entry.name }} in den Papierkorb verschieben?"
                          data-confirm-title="Zugangsdaten löschen" data-confirm-ok="Löschen">
                    {{ icon('trash', size=15) }}</button>
                </form>
              {% endif %}
            </td>
          </tr>
        {% endfor %}
      </tbody>
    </table>
  </div>
  {% if not credentials %}
    {{ empty_state('Keine Zugangsdaten', 'Legen Sie den ersten Eintrag an.', 'key') }}
  {% endif %}
</section>
{% endblock %}

{% block dialogs %}
{% if current_user.has('credentials.create') %}
  {% call modal('credential-new', 'Zugangsdaten anlegen') %}
    <form method="post" action="{{ url_for('credentials.create') }}">
      <input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
      <div class="modal__body">{{ credential_form() }}</div>
      <div class="modal__footer">
        <button class="btn" type="button" data-dialog-close>Abbrechen</button>
        <button class="btn btn--primary" type="submit">Anlegen</button>
      </div>
    </form>
  {% endcall %}
{% endif %}
{% if current_user.has('credentials.edit') %}
  {% for entry in credentials %}
    {% call modal('credential-edit-' ~ entry.id, entry.name) %}
      <form method="post" action="{{ url_for('credentials.update', credential_id=entry.id) }}">
        <input type="hidden" name="{{ csrf_field_name }}" value="{{ csrf_token() }}">
        <div class="modal__body">{{ credential_form(entry) }}</div>
        <div class="modal__footer">
          <button class="btn" type="button" data-dialog-close>Abbrechen</button>
          <button class="btn btn--primary" type="submit">Speichern</button>
        </div>
      </form>
    {% endcall %}
  {% endfor %}
{% endif %}
{% endblock %}