{%- import 'ui/broker/_fmt.html' as fmt -%}
<h3>Security &amp; credentials</h3>
{{ fmt.flash(message, tone) }}
{%- if o %}
<div class="kv">
  <div class="k">Signing</div><div>HMAC-SHA256 over the raw body / envelope bytes</div>
  <div class="k">API key</div><div>bearer key, stored hashed (shown once when minted)</div>
  {%- if manage %}
  <div class="k">Secret</div>
  <div class="codebox" style="margin:0"><code class="secret mono" data-real="{{ o.secret }}">************</code>
    <button class="btn btn-sm btn-ghost" onclick="var c=this.parentElement.querySelector('.secret'); c.textContent = c.textContent.charAt(0)==='*' ? c.dataset.real : '************'">reveal</button>
    <button class="btn btn-sm btn-ghost" onclick="navigator.clipboard.writeText(this.parentElement.querySelector('.secret').dataset.real)">copy</button>
  </div>
  {%- else %}
  <div class="k">Secret</div><div class="dim">visible to a superadmin or the application itself</div>
  {%- endif %}
  <div class="k">Last rotated</div><div>{{ o.rotated_at|ago if o.rotated_at else 'never' }}</div>
</div>
{%- if manage %}
<div class="drawer-actions" style="margin-bottom:0">
  <button class="btn btn-danger btn-sm" data-app="{{ o.name }}" onclick="if(confirm('Rotate the secret for '+this.dataset.app+'? The app must start signing with the new secret immediately.')){var f=new FormData();f.append('application',this.dataset.app);dj.send('/dash/apps/rotate',{method:'POST',target:'#app-security',body:f})}">Rotate secret</button>
</div>
{%- endif %}
{%- endif %}