{% extends "base.html" %}
{% block title %}Admin · SubmitStream{% endblock %}
{% block content %}
<h1>Admin</h1>
{% if error %}<p class="err-msg">{{ error }}</p>{% endif %}
{% if new_link %}
<div class="card" style="border-color:var(--accent)">
  <strong>Access granted.</strong>
  {% if invited %}We emailed them a "Sign in with BW" link.{% else %}<em>No email sent</em> — send them this sign-in link yourself:{% endif %}
  They sign in at <code>{{ new_link }}</code> with their BW account.
  <p class="muted" style="margin-bottom:0">If they don't have a BW account yet, create one with
  <code>srv-gw id-user-create --name … --email …</code> (owner only).</p>
</div>
{% endif %}

<div class="card">
  <h3 style="margin-top:0">Create form</h3>
  <form method="post" action="/admin/forms">
    <input type="hidden" name="csrf" value="{{ csrf }}">
    <div class="field"><label>Form name</label><input name="name" required placeholder="Wine Establishment Inquiry"></div>
    <div class="field"><label>Notification recipients (comma-separated emails)</label><input name="notify_recipients" placeholder="owner@example.com"></div>
    <div class="field"><label>Owning client (for dashboard access)</label>
      <select name="client_id">
        <option value="">— none / admin only —</option>
        {% for c in clients %}{% if c['role'] == 'client' %}<option value="{{ c['id'] }}">{{ c['name'] }} ({{ c['email'] }})</option>{% endif %}{% endfor %}
      </select>
    </div>
    <div class="field"><label>Success redirect URL (optional)</label><input name="redirect_url" placeholder="https://site.com/thank-you"></div>
    <button class="btn" type="submit">Create form</button>
  </form>
</div>

<div class="card">
  <h3 style="margin-top:0">Create user</h3>
  <form method="post" action="/admin/users">
    <input type="hidden" name="csrf" value="{{ csrf }}">
    <div class="form-row" style="display:flex;gap:12px">
      <div class="field" style="flex:1"><label>Name</label><input name="name" required></div>
      <div class="field" style="flex:1"><label>Email</label><input type="email" name="email" required></div>
      <div class="field"><label>Role</label>
        <select name="role">
          <option value="client">client — sees only granted forms</option>
          <option value="manager">manager — can create forms + grant clients</option>
        </select>
      </div>
    </div>
    <label style="display:block;margin:6px 0 12px">
      <input type="checkbox" name="send_invite" checked>
      Email them a "Sign in with BW" link now (uncheck to send it yourself)
    </label>
    <button class="btn" type="submit">Create user</button>
  </form>
</div>

<div class="card" style="padding:0">
  <table>
    <thead><tr><th>Form</th><th>Key</th><th>Created by</th><th>Recipients</th><th>Active</th></tr></thead>
    <tbody>
    {% for f in forms %}
      <tr>
        <td><a href="/forms/{{ f['id'] }}/entries">{{ f['name'] }}</a> ·
            <a href="/forms/{{ f['id'] }}/settings" class="muted">settings</a></td>
        <td><code>{{ f['public_key'] }}</code></td>
        <td>{{ f['client_name'] or '—' }}</td>
        <td class="muted">{{ f['notify_recipients'] or '(none)' }}</td>
        <td>{% if f['active'] %}✓{% else %}✗{% endif %}</td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
</div>

<div class="card" style="padding:0">
  <table>
    <thead><tr><th>User</th><th>Email</th><th>Role</th><th>Last login</th><th></th></tr></thead>
    <tbody>
    {% for c in clients %}
      <tr>
        <td>{{ c['name'] }}</td>
        <td>{{ c['email'] }}</td>
        <td><span class="badge {{ 'sent' if c['role']=='admin' else ('new' if c['role']=='manager' else 'read') }}">{{ c['role'] }}</span></td>
        <td class="muted">{{ c['last_login_at'] or 'never' }}</td>
        <td>
          {% if c['role'] != 'admin' %}
          <form method="post" action="/admin/clients/{{ c['id'] }}/relink" class="inline">
            <input type="hidden" name="csrf" value="{{ csrf }}">
            <button class="linkbtn" type="submit">New invite link</button></form> ·
          <form method="post" action="/admin/users/{{ c['id'] }}/delete" class="inline"
                onsubmit="return confirm('Delete user {{ c['email'] }}? Their form grants are removed; forms they created are kept.');">
            <input type="hidden" name="csrf" value="{{ csrf }}">
            <button class="linkbtn" type="submit" style="color:var(--err)">Delete</button></form>
          {% endif %}
        </td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
</div>
{% endblock %}