{% extends "base.html" %}
{% block title %}{{ t('login.title') }} – {{ t('app.title') }}{% endblock %}
{% block content %}
<div class="row justify-content-center">
    <div class="col-md-5">
        <div class="card">
            <div class="card-body">
                <h5 class="card-title mb-3">{{ t('login.title') }}</h5>
                <form method="post" novalidate>
                    {{ form.hidden_tag() }}
                    <div class="mb-3">
                        <label class="form-label" for="{{ form.username.id }}">{{ t('login.username') }}</label>
                        {{ form.username(class="form-control", autocomplete="username", autofocus=True) }}
                    </div>
                    <div class="mb-3">
                        <label class="form-label" for="{{ form.password.id }}">{{ t('login.password') }}</label>
                        {{ form.password(class="form-control", autocomplete="current-password") }}
                    </div>
                    <button type="submit" class="btn btn-primary w-100">{{ t('login.submit') }}</button>
                </form>
                {% if zitadel_enabled %}
                <div class="text-center text-muted small my-3">{{ t('login.or') }}</div>
                {# Bewusst ein Link, kein Formular: Chrome prueft form-action auch
                   gegen das Redirect-Ziel und wuerde den Login lautlos blocken,
                   sobald eine CSP dazukommt. #}
                <a href="{{ url_for('login_zitadel') }}" class="btn btn-outline-primary w-100">
                    {{ t('login.zitadel') }}
                </a>
                {% endif %}
            </div>
        </div>
    </div>
</div>
{% endblock %}