{% extends "base.html" %}
{% block title %}{{ t('users.title') }} – {{ t('app.title') }}{% endblock %}
{% block content %}
<div class="row g-4">
    <div class="col-lg-7">
        <div class="card">
            <div class="card-body">
                <h5 class="card-title mb-3">{{ t('users.title') }}</h5>
                <table class="table table-sm align-middle">
                    <thead>
                        <tr>
                            <th scope="col">{{ t('users.username') }}</th>
                            <th scope="col">{{ t('users.source') }}</th>
                            <th scope="col">{{ t('users.status') }}</th>
                            <th scope="col" class="text-end">{{ t('users.actions') }}</th>
                        </tr>
                    </thead>
                    <tbody>
                        {% for u in users %}
                        <tr{{ ' class=text-muted'|safe if not u.is_active }}>
                            <td>
                                {{ u.username }}
                                {% if u.is_admin %}<span class="badge bg-secondary ms-1">{{ t('users.is_admin') }}</span>{% endif %}
                                {% if u.email %}<div class="small text-muted">{{ u.email }}</div>{% endif %}
                            </td>
                            <td>
                                <span class="badge {{ 'bg-info text-dark' if u.source == 'zitadel' else 'bg-light text-dark border' }}">
                                    {{ t('users.source.zitadel') if u.source == 'zitadel' else t('users.source.local') }}
                                </span>
                            </td>
                            <td>{{ t('users.active') if u.is_active else t('users.inactive') }}</td>
                            {# Der letzte Admin und das eigene Konto lassen sich serverseitig
                               ohnehin nicht ändern — Buttons hier gar nicht erst anbieten. #}
                            {% set is_self = u.id == current_user.id %}
                            {% set is_last_admin = u.is_admin and admin_count <= 1 %}
                            <td class="text-end">
                                <div class="d-inline-flex gap-1">
                                    {% if not is_last_admin %}
                                    <form method="post" action="{{ url_for('user_admin', user_id=u.id) }}">
                                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                        <button class="btn btn-sm btn-outline-secondary" type="submit">
                                            {{ t('users.admin.revoke') if u.is_admin else t('users.admin.grant') }}
                                        </button>
                                    </form>
                                    {% endif %}
                                    {% if not is_self and not (u.is_active and is_last_admin) %}
                                    <form method="post" action="{{ url_for('user_toggle', user_id=u.id) }}">
                                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                        <button class="btn btn-sm btn-outline-secondary" type="submit">
                                            {{ t('users.deactivate') if u.is_active else t('users.activate') }}
                                        </button>
                                    </form>
                                    {% endif %}
                                    {% if not is_self and not is_last_admin %}
                                    <form method="post" action="{{ url_for('user_delete', user_id=u.id) }}">
                                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                        <button class="btn btn-sm btn-outline-danger" type="submit">{{ t('users.delete') }}</button>
                                    </form>
                                    {% endif %}
                                </div>
                                {% if u.source == 'local' %}
                                <form method="post" action="{{ url_for('user_password', user_id=u.id) }}"
                                      class="d-flex gap-1 justify-content-end mt-1">
                                    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
                                    <label class="visually-hidden" for="pw-{{ u.id }}">
                                        {{ t('users.password.new') }} – {{ u.username }}
                                    </label>
                                    <input type="password" class="form-control form-control-sm" size="18"
                                           id="pw-{{ u.id }}" name="password" placeholder="{{ t('users.password.new') }}"
                                           autocomplete="new-password">
                                    <button class="btn btn-sm btn-outline-secondary" type="submit">{{ t('users.password.submit') }}</button>
                                </form>
                                {% endif %}
                            </td>
                        </tr>
                        {% endfor %}
                    </tbody>
                </table>
                {% if zitadel_enabled %}
                <p class="text-muted small mb-0">{{ t('users.zitadel.hint') }}</p>
                {% endif %}
            </div>
        </div>
    </div>
    <div class="col-lg-5">
        <div class="card">
            <div class="card-body">
                <h5 class="card-title mb-3">{{ t('users.create') }}</h5>
                <form method="post" novalidate>
                    {{ form.hidden_tag() }}
                    <div class="mb-3">
                        <label class="form-label" for="{{ form.username.id }}">{{ t('users.username') }}</label>
                        {{ form.username(class="form-control", autocomplete="off") }}
                        <div class="form-text">{{ t('users.username.hint') }}</div>
                    </div>
                    <div class="mb-3">
                        <label class="form-label" for="{{ form.password.id }}">{{ t('users.password') }}</label>
                        {{ form.password(class="form-control", autocomplete="new-password") }}
                        <div class="form-text">{{ t('users.password.hint') }}</div>
                    </div>
                    <div class="form-check mb-3">
                        {{ form.is_admin(class="form-check-input") }}
                        <label class="form-check-label" for="{{ form.is_admin.id }}">{{ t('users.is_admin') }}</label>
                        <div class="form-text">{{ t('users.is_admin.hint') }}</div>
                    </div>
                    <button type="submit" class="btn btn-primary">{{ t('users.create.submit') }}</button>
                </form>
            </div>
        </div>
    </div>
</div>
{% endblock %}