{% extends 'base.html' %}{% block heading %}User Administration{% endblock %}{% block content %}<div class="two-col"><form class="panel" method="post" action="{{url_for('add_user')}}"><input type="hidden" name="csrf_token" value="{{csrf_token()}}"><span class="kicker">ADD USER</span><label>Username<input name="username" required></label><label>Temporary password<input name="password" type="password" minlength="10" required></label><label>Role<select name="role"><option value="user">User</option><option value="admin">Admin</option></select></label><button class="primary">Add user</button><p class="small">New users must change their temporary password after first login.</p></form><div class="panel"><span class="kicker">SECURITY MODEL</span><p>Passwords are stored as salted hashes. Admins can create users, reset passwords and deactivate accounts. The initial administrator is securely bootstrapped from server-side environment credentials. Passwords are never stored in plaintext.</p></div></div><section class="panel"><table><thead><tr><th>User</th><th>Role</th><th>Status</th><th>Password</th><th>Actions</th></tr></thead><tbody>{% for u in users %}<tr><td>{{u.username}}</td><td>{{u.role}}</td><td>{{'Active' if u.active else 'Removed'}}</td><td>{{'Must change' if u.must_change_password else 'Set'}}</td><td><form class="inline" method="post" action="{{url_for('reset_user',uid=u.id)}}"><input type="hidden" name="csrf_token" value="{{csrf_token()}}"><label class="sr-only" for="reset-password-{{u.id}}">New temporary password for {{u.username}}</label><input id="reset-password-{{u.id}}" name="password" type="password" minlength="10" placeholder="New temporary password" aria-label="New temporary password for {{u.username}}" required><button class="ghost">Reset</button></form>{% if u.active %}<form class="inline" method="post" action="{{url_for('delete_user',uid=u.id)}}"><input type="hidden" name="csrf_token" value="{{csrf_token()}}"><button class="danger-btn">Remove</button></form>{% endif %}</td></tr>{% endfor %}</tbody></table></section>{% endblock %}