{% extends "base.html" %}
{% block title %}Users · auth-ingress{% endblock %}
{% block content %}
<div class="page-header"><div><p class="eyebrow">Administration</p><h1>Users</h1><p class="muted">Control access-list membership, credential lifecycle, and administrator scope.</p></div></div>
{% if error %}<div class="alert" role="alert" tabindex="-1">{{ error }}</div>{% endif %}
{% if message %}<div class="notice" role="status" tabindex="-1">{{ message }}</div>{% endif %}
{% if summary %}<section class="summary-grid" aria-label="User management summary">{% for item in summary %}<article class="metric-card metric-{{ item.status }}"><span class="metric-label">{{ item.label }}</span><span class="metric-value">{{ item.value }}</span><p class="metric-hint">{{ item.hint }}</p></article>{% endfor %}</section>{% endif %}
{% if temporary_password %}<section class="panel confirmation" role="status" tabindex="-1"><h2>Temporary password</h2><p>Copy this password now and give it to the user. It is shown only once, and the user must change it after signing in.</p><div class="secret-row"><code class="secret-display" id="temporary-password">{{ temporary_password }}</code><button type="button" class="secondary" data-copy-target="temporary-password" aria-describedby="temporary-password-copy-status">Copy temporary password</button><span id="temporary-password-copy-status" class="copy-status" role="status" aria-live="polite"></span></div></section><script>document.querySelectorAll("[data-copy-target]").forEach((button)=>button.addEventListener("click",async()=>{const target=document.getElementById(button.dataset.copyTarget);const status=button.parentElement.querySelector(".copy-status");try{await navigator.clipboard.writeText(target.textContent);status.textContent="Copied";}catch{status.textContent="Select and copy manually";}}));</script>{% endif %}
{% set create_state = form_state if form_state.applies_to('user_create') else none %}
<section class="panel"><h2>Create user</h2><p class="muted">If validation fails, safe entered values stay in the form. One-time credentials are only shown after successful creation.</p><form method="post" action="/admin/users/preview" class="form-grid"><input type="hidden" name="csrf" value="{{ csrf_token }}"><label>Email<input type="email" name="email" value="{{ create_state.value('email') if create_state else '' }}" required>{% if create_state and create_state.error_text('email') %}<span class="field-error">{{ create_state.error_text('email') }}</span>{% endif %}</label><label>Display name<input name="display_name" value="{{ create_state.value('display_name') if create_state else '' }}" required>{% if create_state and create_state.error_text('display_name') %}<span class="field-error">{{ create_state.error_text('display_name') }}</span>{% endif %}</label><label>Status{% set create_status = create_state.value('status', 'active') if create_state else 'active' %}<select name="status"><option value="active" {% if create_status == 'active' %}selected{% endif %}>active</option><option value="disabled" {% if create_status == 'disabled' %}selected{% endif %}>disabled</option></select>{% if create_state and create_state.error_text('status') %}<span class="field-error">{{ create_state.error_text('status') }}</span>{% endif %}</label><label class="check"><input type="checkbox" name="is_admin" value="true" {% if create_state and create_state.checked('is_admin') %}checked{% endif %}> Administrator</label><fieldset class="wide"><legend>Initial groups</legend>{% for group in groups %}<label class="check"><input type="checkbox" name="group_ids" value="{{ group.id }}" {% if create_state and create_state.is_selected('group_ids', group.id) %}checked{% endif %}>{{ group.name }}{% if group.status == 'deactivated' %} (deactivated){% endif %}</label>{% endfor %}{% if create_state and create_state.error_text('group_ids') %}<span class="field-error">{{ create_state.error_text('group_ids') }}</span>{% endif %}</fieldset><button type="submit">Preview new user</button></form></section>
{% if create_preview %}<section class="panel confirmation"><h2>Preview user creation</h2><p>{{ create_preview.email }} · {{ create_preview.display_name }} · {{ create_preview.status }}</p><form method="post" action="/admin/users/confirm"><input type="hidden" name="csrf" value="{{ csrf_token }}"><input type="hidden" name="email" value="{{ create_preview.email }}"><input type="hidden" name="display_name" value="{{ create_preview.display_name }}"><input type="hidden" name="status" value="{{ create_preview.status }}">{% if create_preview.is_admin %}<input type="hidden" name="is_admin" value="true">{% endif %}{% for group_id in create_preview.group_ids %}<input type="hidden" name="group_ids" value="{{ group_id }}">{% endfor %}<button type="submit">Confirm user creation</button></form></section>{% endif %}
<section class="panel"><form method="get" action="/admin/users" class="form-grid"><label class="wide">Search<input name="q" value="{{ filters.q or '' }}" placeholder="Email or display name"></label><label>Status<select name="status"><option value="">All</option><option value="active" {% if filters.status == 'active' %}selected{% endif %}>Active</option><option value="disabled" {% if filters.status == 'disabled' %}selected{% endif %}>Disabled</option></select></label><label>Administrator<select name="admin"><option value="">All</option><option value="true" {% if filters.admin == 'true' %}selected{% endif %}>Yes</option><option value="false" {% if filters.admin == 'false' %}selected{% endif %}>No</option></select></label><label>Group<select name="group"><option value="">All</option>{% for group in groups %}<option value="{{ group.id }}" {% if filters.group == group.id|string %}selected{% endif %}>{{ group.name }}{% if group.status == 'deactivated' %} (deactivated){% endif %}</option>{% endfor %}</select></label><button type="submit">Filter users</button></form></section>
{% if users %}<div class="table-wrap scroll-region"><table><thead><tr><th>Email</th><th>Name</th><th>Status</th><th>Admin</th><th>Groups</th><th></th></tr></thead><tbody>{% for managed in users %}<tr><td>{{ managed.email }}</td><td>{{ managed.display_name }}</td><td><span class="status status-{{ managed.status }}">{{ managed.status }}</span></td><td>{{ 'Yes' if managed.is_admin else 'No' }}</td><td>{{ managed.memberships|map(attribute='group.name')|join(', ') or 'None' }}</td><td><a href="/admin/users/{{ managed.id }}">Manage</a></td></tr>{% endfor %}</tbody></table></div>{% else %}<section class="empty"><h2>No users found</h2><p>Adjust the filters or create a user.</p></section>{% endif %}
{% endblock %}