{% extends "base.html" %}
{% block title %}Sign in — Agent Firewall{% endblock %}
{% block content %}
<section class="login-card">
  <h1>Approver sign in</h1>
  <p class="muted">Approve or reject high-risk agent tool calls.</p>
  {% if error %}
  <div class="alert">{{ error }}</div>
  {% endif %}
  {% if auth_mode != "local" %}
  <div class="alert">Auth mode is <code>{{ auth_mode }}</code>. Use your parent app identity / passthrough header.</div>
  {% else %}
  <form method="post" action="/login" class="stack">
    <label>Username
      <input name="username" required autocomplete="username" />
    </label>
    <label>Password
      <input name="password" type="password" required autocomplete="current-password" />
    </label>
    <button class="btn primary" type="submit">Sign in</button>
  </form>
  <p class="hint">Demo users come from <code>firewall.yaml</code> (e.g. admin / admin123).</p>
  {% endif %}
</section>
{% endblock %}