@layout('theme::layouts/main')

@section('title')API tokens@endsection

@section('breadcrumb')
<a href="/settings/profile">Settings</a> &raquo; <span>API tokens</span>
@endsection

@section('content')
<div class="page-header">
    <h2>API tokens</h2>
</div>

@include('theme::partials/settings-nav', ['settingsTab' => 'tokens'])

@notempty($notice ?? null)
<div class="alert alert-success">{{ $notice }}</div>
@endnotempty

@notempty($problem ?? null)
<div class="alert alert-error">{{ $problem }}</div>
@endnotempty

@notempty($created ?? null)
{#
    The one and only time this is readable. Only the hash is stored, so
    saying so here is the difference between somebody copying it now and
    coming back puzzled later.
#}
<div class="token-reveal">
    <strong>Copy this now — it will not be shown again.</strong>
    <p>Only a hash of it is stored, so there is no way to look it up later. If you lose it, make another.</p>
    <div class="token-value">
        <code id="new-token">{{ $created }}</code>
        <button type="button" class="btn btn-primary" data-copy="new-token">Copy</button>
    </div>
</div>
@endnotempty

<div class="card">
    <h3 class="card-title">Create a token</h3>
    <form method="POST" action="/settings/api" class="token-form">
        @csrf

        <div class="form-group">
            <label for="name">What is it for?</label>
            <input type="text" id="name" name="name" class="form-input" maxlength="100"
                   placeholder="Deploy script" required>
            <div class="form-hint">A name only you see, so you can tell your tokens apart.</div>
        </div>

        <div class="form-group">
            <label>What may it do?</label>
            <div class="token-abilities">
                @each ($abilities as $key => $description)
                <label class="token-ability">
                    <input type="checkbox" name="abilities[]" value="{{ $key }}"
                           @if($key === 'read')checked @endif>
                    <span>
                        <code>{{ $key }}</code>
                        <span class="token-ability-note">{{ $description }}</span>
                    </span>
                </label>
                @endeach
            </div>
            <div class="form-hint">
                A token can never do more than you can. Ticking <code>admin</code> does not
                make you one — it only stops the token reaching admin endpoints if you
                leave it unticked.
            </div>
        </div>

        <div class="form-group">
            <label for="expires_days">Expires</label>
            <select id="expires_days" name="expires_days" class="form-select input-md">
                <option value="0">Never</option>
                <option value="30">In 30 days</option>
                <option value="90">In 90 days</option>
                <option value="365">In a year</option>
            </select>
        </div>

        <button type="submit" class="btn btn-primary">Create token</button>
    </form>
</div>

<div class="card">
    <h3 class="card-title">Your tokens</h3>

    @empty($tokens)
    <p class="token-empty">You have not made any yet.</p>
    @endempty

    @notempty($tokens)
    <div class="token-list">
        @each ($tokens as $token)
        <div class="token-row @notempty($token['revoked_at'])is-revoked@endnotempty">
            <div class="token-row-main">
                <div class="token-name">
                    {{ $token['name'] }}
                    @notempty($token['revoked_at'])
                    <span class="badge">Revoked</span>
                    @endnotempty
                </div>
                <div class="token-meta">
                    <code>{{ $token['prefix'] }}…</code>
                    &middot; {{ implode(', ', $token['abilities']) }}
                    &middot;
                    @notempty($token['last_used_at'])
                    last used {{ \Convoro\Engine\Support\Presence::ago($token['last_used_at']) }}
                    @endnotempty
                    @empty($token['last_used_at'])
                    never used
                    @endempty
                    @notempty($token['expires_at'])
                    &middot; expires {{ date('M j, Y', strtotime($token['expires_at'])) }}
                    @endnotempty
                </div>
            </div>

            @empty($token['revoked_at'])
            <form method="POST" action="/settings/api/{{ $token['id'] }}/revoke"
                  onsubmit="return confirm('Revoke “{{ $token['name'] }}”? Anything using it stops working immediately.')">
                @csrf
                <button type="submit" class="btn btn-outline btn-sm">Revoke</button>
            </form>
            @endempty
        </div>
        @endeach
    </div>
    @endnotempty
</div>

<p class="token-docs">
    Send a token as <code>Authorization: Bearer &lt;token&gt;</code>. The API ignores your
    browser session entirely, so being signed in here makes no difference to it.
</p>
@endsection

@section('scripts')
<script src="@asset('/assets/js/copy-token.js')"></script>
@endsection