{% extends "base.html" %}
{% block title %}{{ user.username }} — MQTT Ingester{% endblock %}
{% block content %}
<h1>{{ user.username }} <span class="tag">{{ user.role }}</span></h1>
{% if user.disabled_at %}<p class="banner">User is disabled.</p>{% endif %}

<section>
  <h2>Groups</h2>
  <form method="post" action="/users/{{ user.id }}/groups" class="stack">
    <input type="hidden" name="csrf_token" value="{{ identity.csrf_token }}">
    <fieldset>
      {% for g in all_groups %}
      <label class="check">
        <input type="checkbox" name="group_ids" value="{{ g.id }}"
               {% if g.id in member_of | map(attribute='id') | list %}checked{% endif %}>
        {{ g.name }}
      </label>
      {% else %}
      <p class="hint">No groups exist yet — create one under Groups.</p>
      {% endfor %}
    </fieldset>
    <button type="submit">Save groups</button>
  </form>
</section>

<section>
  <h2>Personal access rules</h2>
  <p class="hint">Glob patterns matched against the full tag name. <code>*</code> matches any sequence (including <code>.</code>). Deny wins over allow. Personal rules combine with group rules; use a personal deny to override a group allow, and vice versa.</p>
  <table>
    <thead><tr><th>Kind</th><th>Pattern</th><th></th></tr></thead>
    <tbody>
    {% for r in rules %}
    <tr>
      <td><span class="tag {{ r.kind }}">{{ r.kind }}</span></td>
      <td><code>{{ r.pattern }}</code></td>
      <td>
        <form method="post" action="/users/{{ user.id }}/rules/{{ r.id }}/delete">
          <input type="hidden" name="csrf_token" value="{{ identity.csrf_token }}">
          <button type="submit" class="link danger">remove</button>
        </form>
      </td>
    </tr>
    {% endfor %}
    </tbody>
  </table>
  <form method="post" action="/users/{{ user.id }}/rules" class="inline-form">
    <input type="hidden" name="csrf_token" value="{{ identity.csrf_token }}">
    <select name="kind">
      <option value="allow">allow</option>
      <option value="deny">deny</option>
    </select>
    <input type="text" name="pattern" placeholder="e.g. 11001.*_Value" required>
    <button type="submit">Add rule</button>
  </form>
</section>

<section>
  <h2>Set new password</h2>
  <form method="post" action="/users/{{ user.id }}/password" class="stack">
    <input type="hidden" name="csrf_token" value="{{ identity.csrf_token }}">
    <label>Password <input type="password" name="password" required minlength="8"></label>
    <button type="submit">Set password</button>
  </form>
  <p class="hint">The user must change it at next login.</p>
</section>
{% endblock %}