{% extends "base.html" %}

{% block title %}OAuth Clients - NanoIDP{% endblock %}

{% block content %}
<div class="d-flex justify-content-between align-items-center mb-4">
    <h2><i class="bi bi-app me-2"></i>OAuth Clients</h2>
    <a href="{{ url_for('ui.client_create') }}" class="btn btn-primary">
        <i class="bi bi-plus-lg me-2"></i>New Client
    </a>
</div>

<div class="card">
    <div class="card-body p-0">
        <div class="table-responsive">
            <table class="table table-hover mb-0">
                <thead class="table-light">
                    <tr>
                        <th>Client ID</th>
                        <th>Description</th>
                        <th>Secret (masked)</th>
                        <th>Actions</th>
                    </tr>
                </thead>
                <tbody>
                    {% for entry in clients %}
                    {% set client = entry.client %}
                    <tr>
                        <td>
                            <code>{{ client.client_id }}</code>
                            {% if entry.origin == 'runtime' %}
                            <span class="badge bg-warning text-dark ms-2" title="Created through /api/runtime; not in settings.yaml">runtime</span>
                            {% elif entry.origin == 'cimd' %}
                            <span class="badge bg-info text-dark ms-2" title="Learned from the metadata document this client publishes; cached, not in settings.yaml">cimd</span>
                            {% endif %}
                        </td>
                        <td>{{ client.description or '-' }}</td>
                        <td>
                            {% if client.is_public %}
                            <span class="badge bg-secondary">public (none)</span>
                            {% elif client.client_secret %}
                            {# A fixed mask, never a part of the secret and never its
                               length: this page is a read, and management_secret
                               gates mutations only. #}
                            <span class="text-muted" title="A secret is set. It is never shown here.">&bull;&bull;&bull;&bull;&bull;&bull;&bull;&bull;</span>
                            {% else %}
                            <span class="text-muted">-</span>
                            {% endif %}
                        </td>
                        <td>
                            {% if entry.origin == 'runtime' %}
                            <span class="text-muted small">managed through /api/runtime</span>
                            {% elif entry.origin == 'cimd' %}
                            <form action="{{ url_for('ui.client_forget') }}" method="post" class="d-inline">
                                <input type="hidden" name="client_id" value="{{ client.client_id }}">
                                <button type="submit" class="btn btn-outline-secondary btn-sm" title="Forget the cached document, so the next authorization request fetches it again">
                                    <i class="bi bi-x-circle"></i> Forget
                                </button>
                            </form>
                            {% elif entry.origin == 'declared' %}
                            <div class="btn-group btn-group-sm">
                                <a href="{{ url_for('ui.client_edit', client_id=client.client_id) }}" class="btn btn-outline-primary">
                                    <i class="bi bi-pencil"></i>
                                </a>
                                {% if not client.is_public %}
                                <form action="{{ url_for('ui.client_regenerate_secret', client_id=client.client_id) }}" method="post" class="d-inline">
                                    <input type="hidden" name="expected_revision" value="{{ revision }}">
                                    <button type="submit" class="btn btn-outline-warning" title="Regenerate Secret" onclick="return confirm('Regenerate secret for {{ client.client_id }}? The old secret will stop working.')">
                                        <i class="bi bi-arrow-clockwise"></i>
                                    </button>
                                </form>
                                {% endif %}
                                <form action="{{ url_for('ui.client_delete', client_id=client.client_id) }}" method="post" class="d-inline">
                                    <input type="hidden" name="expected_revision" value="{{ revision }}">
                                    <button type="submit" class="btn btn-outline-danger" onclick="return confirm('Delete client {{ client.client_id }}?')">
                                        <i class="bi bi-trash"></i>
                                    </button>
                                </form>
                            </div>
                            {% endif %}
                        </td>
                    </tr>
                    {% else %}
                    <tr>
                        <td colspan="4" class="text-center text-muted py-4">
                            <i class="bi bi-inbox fs-1 d-block mb-2"></i>
                            No OAuth clients configured
                        </td>
                    </tr>
                    {% endfor %}
                </tbody>
            </table>
        </div>
    </div>
</div>

<!-- Usage Info -->
<div class="card mt-4">
    <div class="card-header">
        <i class="bi bi-terminal me-2"></i>Usage Example
    </div>
    <div class="card-body">
        <p class="mb-2">Request a token using client credentials:</p>
        <pre class="bg-dark text-light p-3 rounded"><code>curl -X POST '{{ request.url_root }}token' \
  -u 'CLIENT_ID:CLIENT_SECRET' \
  -d 'grant_type=password&username=USER&password=PASS'</code></pre>
    </div>
</div>
{% endblock %}