{% extends "base.html" %}
{% block title %}Account · SubmitStream{% endblock %}
{% block content %}
<h1>Account</h1>
<p class="muted">{{ user.name }} · {{ user.email }} · role: {{ user.role }}</p>

<div class="card">
  <h3 style="margin-top:0">API tokens</h3>
  <p class="muted">Personal tokens let the <code>submitstream</code> CLI (and Claude) create
    forms and clients on your behalf, without a browser login. Treat a token like a password —
    it acts as you. The management API is reachable only from on the server.</p>

  {% if new_token %}
  <div class="card token-show">
    <strong>New token — copy it now, it won't be shown again:</strong>
    <code>{{ new_token }}</code>
    <p class="muted" style="margin-bottom:0">Save it to <code>~/.config/submitstream/token</code>
      (mode 600) on the server so the CLI can use it.</p>
  </div>
  {% endif %}

  <form method="post" action="/account/tokens">
    <input type="hidden" name="csrf" value="{{ csrf }}">
    <div class="field"><label>Label (e.g. "mosiah CLI")</label><input name="label" placeholder="what's this token for?"></div>
    <button class="btn" type="submit">Generate token</button>
  </form>

  {% if tokens %}
  <table style="margin-top:16px">
    <thead><tr><th>Label</th><th>Created</th><th>Last used</th><th>Status</th><th></th></tr></thead>
    <tbody>
    {% for t in tokens %}
      <tr>
        <td>{{ t['label'] or '(no label)' }}</td>
        <td class="muted">{{ t['created_at'] }}</td>
        <td class="muted">{{ t['last_used_at'] or 'never' }}</td>
        <td>{% if t['revoked'] %}<span class="badge spam">revoked</span>{% else %}<span class="badge sent">active</span>{% endif %}</td>
        <td>{% if not t['revoked'] %}<form method="post" action="/account/tokens/{{ t['id'] }}/revoke" class="inline">
          <input type="hidden" name="csrf" value="{{ csrf }}">
          <button class="linkbtn" type="submit">Revoke</button></form>{% endif %}</td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% endif %}
</div>
{% endblock %}