{% extends "base.html" %}
{% block title %}{{ form['name'] }} settings · SubmitStream{% endblock %}
{% block content %}
<p class="muted"><a href="/dashboard">← Dashboard</a></p>
<h1>{{ form['name'] }} — settings</h1>
{% if saved %}<p class="ok-msg">Saved.</p>{% endif %}
{% if error %}<p class="err-msg">{{ error }}</p>{% endif %}
<form method="post" action="/forms/{{ form['id'] }}/settings">
  <input type="hidden" name="csrf" value="{{ csrf }}">
  <div class="card">
    <div class="field"><label>Form name</label><input name="name" value="{{ form['name'] }}" required></div>
    <div class="field">
      <label>Notification recipients (comma-separated emails) — who gets notified</label>
      <input name="notify_recipients" value="{{ form['notify_recipients'] }}" placeholder="owner@example.com, sales@example.com">
    </div>
    <div class="field">
      <label>Reply-To field — which submitted field holds the sender's email</label>
      <input name="reply_to_field" value="{{ form['reply_to_field'] }}">
    </div>
    <div class="field">
      <label>Success redirect URL (used for plain no-JS form posts)</label>
      <input name="redirect_url" value="{{ form['redirect_url'] }}" placeholder="https://yoursite.com/thank-you">
    </div>
  </div>

  <div class="card">
    <h3 style="margin-top:0">Spam &amp; security</h3>
    <div class="field">
      <label>Allowed origins — comma-separated. Just add the <strong>root domain</strong>
        (<code>client.com</code>) and it covers the apex, <code>www</code>, and any subdomain.
        Use <code>https://exact.host.com</code> only if you want to pin one exact origin.
        Empty = learn mode (accept any, log origin). Tip: keep <code>demoing.info</code> for
        testing and add the client's root domain at go-live.</label>
      <input name="allowed_origins" value="{{ form['allowed_origins'] }}">
    </div>
    <div class="field"><label>Honeypot field name</label><input name="honeypot_field" value="{{ form['honeypot_field'] }}"></div>
    <div class="field"><label>Minimum seconds before submit (JS embed only)</label><input type="number" name="min_submit_seconds" value="{{ form['min_submit_seconds'] }}"></div>
    <div class="field"><label>Rate limit (submissions per IP per hour)</label><input type="number" name="rate_limit_per_hour" value="{{ form['rate_limit_per_hour'] }}"></div>
    <label><input type="checkbox" name="active" {% if form['active'] %}checked{% endif %}> Form active</label>
  </div>

  <div class="card">
    <h3 style="margin-top:0">Auto-response to submitter (optional)</h3>
    <label><input type="checkbox" name="autoresponse_enabled" {% if form['autoresponse_enabled'] %}checked{% endif %}> Send a confirmation email back to the submitter</label>
    <div class="field" style="margin-top:10px"><label>Subject</label><input name="autoresponse_subject" value="{{ form['autoresponse_subject'] }}" placeholder="Thanks — we got your message"></div>
    <div class="field"><label>Body</label><textarea name="autoresponse_body" rows="4">{{ form['autoresponse_body'] }}</textarea></div>
  </div>

  <div class="card">
    <h3 style="margin-top:0">Sender</h3>
    {% if user.is_admin %}
      <div class="field">
        <label>From address (blank = default <code>{{ app_base_url }}</code> sender). Domain must be Resend-verified.</label>
        <input name="from_address" value="{{ form['from_address'] or '' }}" placeholder="Client Name &lt;forms@clientdomain.com&gt;">
      </div>
    {% else %}
      <p class="muted">Sender domain is managed by your administrator.</p>
    {% endif %}
  </div>

  <button class="btn" type="submit">Save settings</button>
</form>

<div class="card">
  <h3 style="margin-top:0">Who can view these entries</h3>
  <p class="muted">Grant client logins access to this form's entries. Adding an email that
    has no account yet creates one and emails them an invite to set a password.</p>
  {% if grantees %}
  <table>
    <tbody>
    {% for g in grantees %}
      <tr>
        <td>{{ g['name'] }} <span class="muted">({{ g['email'] }})</span> <span class="badge read">{{ g['role'] }}</span></td>
        <td style="text-align:right"><form method="post" action="/forms/{{ form['id'] }}/revoke" class="inline">
          <input type="hidden" name="csrf" value="{{ csrf }}">
          <input type="hidden" name="client_id" value="{{ g['id'] }}">
          <button class="linkbtn" type="submit">Revoke</button></form></td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% else %}<p class="muted">No client logins have access yet.</p>{% endif %}
  <form method="post" action="/forms/{{ form['id'] }}/grant" style="margin-top:12px">
    <input type="hidden" name="csrf" value="{{ csrf }}">
    <div class="form-row" style="display:flex;gap:12px;align-items:flex-end">
      <div class="field" style="flex:1;margin-bottom:0"><label>Grant access to email</label>
        <input type="email" name="email" placeholder="client@example.com" required></div>
      <label style="white-space:nowrap"><input type="checkbox" name="invite" checked> send invite</label>
      <button class="btn" type="submit">Grant</button>
    </div>
  </form>
</div>

<div class="card" style="border-color:var(--err)">
  <h3 style="margin-top:0;color:var(--err)">Danger zone</h3>
  <p class="muted">Deleting a form permanently removes it and <strong>all its entries,
    notifications, and logs</strong>. This cannot be undone.</p>
  <form method="post" action="/forms/{{ form['id'] }}/delete"
        onsubmit="return confirm('Delete “{{ form['name'] }}” and ALL its entries? This cannot be undone.');">
    <input type="hidden" name="csrf" value="{{ csrf }}">
    <button class="btn" type="submit" style="background:var(--err)">Delete this form</button>
  </form>
</div>
{% endblock %}