{{define "account_settings"}}{{template "top" .}}
{{if .Flash}}<p class="banner">{{.Flash}}</p>{{end}}
{{if .FlashErr}}<p class="banner error">{{.FlashErr}}</p>{{end}}
<div class="pagehead">
  <p class="eyebrow">Account · {{.Account.Name}}</p>
  <h1>Account settings</h1>
  <p class="lede">The account itself — what it's called, and how it ends.</p>
</div>
<h2>Identity</h2>
<div class="tablewrap">
<table>
  <tr><th>Name</th><th>ID</th><th>Your role</th></tr>
  <tr><td>{{.Account.Name}}</td><td><code>{{.Account.Sqid}}</code></td><td>{{.Role}}</td></tr>
</table>
</div>
{{with .AccountStore}}
<h2>Object storage</h2>
{{if .Unavailable}}<p>Object storage applications are unavailable on this deployment.</p>
{{else}}
<p>{{.State}}</p>
{{if eq .State "Approved"}}<p>Run <code>carlos store create --app &lt;app&gt;</code> to provision a store when this deployment has a backend. Usage is metered.</p>{{end}}
{{if eq .State "Pending"}}<p>Waiting for a deployment operator.</p>{{end}}
{{if eq .State "Declined"}}<p>An account owner may apply again.</p>{{end}}
{{if and $.IsOwner .CanApply}}
<form method="post" action="{{$.Base}}/store/apply">
  <input type="hidden" name="csrf" value="{{$.CSRF}}">
  <label>What will you use storage for? (optional) <input type="text" name="note"></label>
  <button type="submit">Apply for object storage</button>
</form>
{{end}}
{{end}}
{{if .Events}}
<h3>Storage activity</h3>
<div class="tablewrap"><table>
<tr><th>When</th><th>What</th></tr>
{{range .Events}}<tr><td>{{fmtTime .CreatedAt}}</td><td>{{.Detail}}</td></tr>{{end}}
</table></div>
{{end}}
{{end}}
{{if .IsOwner}}
<h2>Service credentials</h2>
<p class="small">Credentials a SERVER holds — a CI runner, a router, a job — not a person. Each one
  is bound to this account, carries exactly one role, and never expires: revoking is the control,
  and it works from here.</p>
{{/* The once-only secret block. The two "Reloading this page" sentences below
     are a CONTROL, not decoration (C47): this response is a 200 rather than a
     redirect, because a redirect would have to carry the plaintext somewhere
     the next request could read it — and the price of that choice is that a
     reload re-posts. Saying so, next to the secret, is what makes the trade
     honest. Both sentences are pinned by
     TestTheFreshSecretAppearsOnceAndOnlyInItsOwnResponse in svcpage_test.go;
     if you are deleting one as redundant copy, read svcpage.go's package
     comment first. */}}
{{with .ServiceSecret}}
<div class="banner">
  {{if .Rotated}}
  {{if .ScopeKnown}}
  <p><strong>New secret for {{.Name}} — role {{.Role}}, over {{.Scope}}:</strong></p>
  {{else}}
  <p><strong>New secret for {{.Name}}:</strong></p>
  {{end}}
  {{else}}
  {{if .Rungs}}<p><strong>Minted {{.Name}}: role {{.Role}}, over {{.Scope}}, rungs {{.Rungs}}:</strong></p>{{else if .Commands}}<p><strong>Minted {{.Name}}: role {{.Role}}, over {{.Scope}}, commands {{.Commands}}:</strong></p>{{else}}<p><strong>Minted {{.Name}} — role {{.Role}}, over {{.Scope}}:</strong></p>{{end}}
  {{end}}
  <p><code>CARLOS_SERVICE_TOKEN={{.Token}}</code></p>
  <p class="small">Shown once. Only its hash is stored — a lost secret means rotate, not another
    look at this page.</p>
  {{if and .Rotated (not .ScopeKnown)}}
  <p class="small">This credential's role and scope could not be read back just now, so they are
    not shown. Only the secret changed — the credential is otherwise exactly what it was.</p>
  {{end}}
  {{if .Rotated}}
  <p class="small"><strong>Reloading this page rotates again</strong> and retires the secret
    above. Copy it before you reload — if you lose it, rotate once more and redistribute; nothing
    is destroyed, but this secret will not come back.</p>
  {{else}}
  <p class="small"><strong>Reloading this page</strong> tries to mint {{.Name}} a second time and
    is refused, because the name is taken. The credential above keeps working — but this screen is
    the only place its secret is ever shown, and a reload loses it.</p>
  {{end}}
  <p class="small">If you were just asked for your passkey, this page's address is the
    confirmation step rather than the form: reloading it re-runs a confirmation that has already
    been used, so it reports that the action has expired and changes nothing either way.</p>
  <p class="small">Deliver it: <code>{{.DeliverCommand}}</code></p>
  {{if .Rotated}}
  <p class="small">ROTATION IS NOT REVOCATION: this refuses the credential's NEXT call with the
    OLD secret, but does not stop work already in flight — a credential that may be COMPROMISED
    needs Revoke, not another rotate.</p>
  {{end}}
  {{if .Doors}}
  <p class="small">{{if .App}}It may (bound to app {{.App}} ONLY, despite the wildcards below):{{else}}It may:{{end}}</p>
  <ul class="small">
    {{range .Doors}}<li><code>{{.}}</code></li>{{end}}
  </ul>
  {{end}}
</div>
{{end}}
{{if .ServicesUnknown}}
<p class="small">This account's credentials could not be read just now, so none are listed. That is
  not the same as there being none — reload before concluding anything.</p>
{{else if .Services}}
<div class="tablewrap">
<table>
  <tr>
    <th>Name</th><th>Role</th><th>Scope</th><th>Rungs</th><th>Commands</th><th>Label</th>
    <th>Secret since</th><th>Last used</th><th>Minted by</th><th></th>
  </tr>
  {{range .Services}}
  <tr>
    <td>{{if .Name}}{{.Name}}{{else}}<span class="small">(unnamed)</span>{{end}}</td>
    <td>{{.Role}}</td>
    <td>{{if .App}}app {{.App}}{{else}}account-wide{{end}}</td>
    <td>{{emptyOrDash .RungList}}</td>
    <td>{{emptyOrDash .CommandList}}</td>
    <td>{{emptyOrDash .Label}}</td>
    <td>{{if .RotatedAt.IsZero}}—{{else}}{{fmtTime .RotatedAt}}{{end}}</td>
    <td>{{if .LastUsed.IsZero}}—{{else}}{{fmtTime .LastUsed}}{{end}}</td>
    <td>{{emptyOrDash .Address}}</td>
    <td>
      {{if .Name}}
      <form method="post" action="{{$.Base}}/services/rotate">
        <input type="hidden" name="csrf" value="{{$.CSRF}}">
        <input type="hidden" name="name" value="{{.Name}}">
        <button class="linkish" type="submit">Rotate</button>
      </form>
      {{end}}
      <form method="post" action="{{$.Base}}/services/revoke">
        <input type="hidden" name="csrf" value="{{$.CSRF}}">
        <input type="hidden" name="handle" value="{{.Handle}}">
        <button class="linkish danger" type="submit">Revoke</button>
      </form>
    </td>
  </tr>
  {{end}}
</table>
</div>
<p class="small">Revoking is immediate and needs nothing but this page: the credential's next call
  fails, whatever secret it holds. Rotating replaces the secret and keeps everything else — the
  name, the role, the scope, the history — so a credential that may be compromised needs Revoke,
  not Rotate. A row with no name is an older app token; its listing id is its handle, and its
  label is what it was minted as.</p>
{{else}}
<p class="small">No service credentials in this account.</p>
{{end}}
<h3>Mint a credential</h3>
<form class="signin" method="post" action="{{.Base}}/services/new">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <input type="text" name="name" placeholder="name, e.g. ci-runner">
  <select name="role">
    {{range .ServiceRoles}}<option value="{{.}}">{{.}}</option>{{end}}
  </select>
  <select name="app">
    <option value="">the whole account</option>
    {{range .ServiceApps}}<option value="{{.}}">app {{.}}</option>{{end}}
  </select>
  <span class="small">Rungs, for a deploy credential:</span>
  {{range .ServiceRungs}}<label class="small"><input type="checkbox" name="rungs" value="{{.}}"> {{.}}</label>{{end}}
  <label class="small">Commands, for a run credential:
    <input type="text" name="commands" placeholder="import classic, import sync"></label>
  <button type="submit">Mint credential</button>
</form>
<p class="small">The secret is shown once, on the next screen, and is never recoverable from here.
  Minting and rotating both ask for your passkey; revoking does not, so it stays one step in an
  emergency.</p>
<h2>Errors</h2>
{{if .ErrLevelUnread}}
<p class="small">This account&rsquo;s Errors log level could not be read just now, so it is not
shown and cannot be changed from here. Reload before concluding anything.</p>
{{else}}
<form class="signin" method="post" action="{{.Base}}/errors/level">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label>Log lines counted as errors:
    <select name="level">
      <option value="error"{{if eq .ErrLevelSetting.LogLevel "error"}} selected{{end}}>error and above</option>
      <option value="warn"{{if eq .ErrLevelSetting.LogLevel "warn"}} selected{{end}}>warn and above</option>
    </select>
  </label>
  <button type="submit">Save</button>
</form>
<p class="small">Currently {{.ErrLevelSetting.LogLevel}}, from the {{.ErrLevelSetting.LogLevelFrom}}
&mdash; the level for every app without its own setting, which an app&rsquo;s own Settings tab
overrides. Widening one look to warn is always available on an app&rsquo;s Errors tab and changes
nothing here.</p>
{{end}}

<h2>Analytics</h2>
{{if .AnalyticsUnread}}
<p class="small">This account&rsquo;s analytics setting could not be read just now. Reload before
concluding anything.</p>
{{else}}
<form class="signin" method="post" action="{{.Base}}/analytics/setting">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <label>Count page views at the edge:
    <select name="count">
      <option value="off"{{if eq .AnalyticsSetting.Count "off"}} selected{{end}}>off</option>
      <option value="edge"{{if eq .AnalyticsSetting.Count "edge"}} selected{{end}}>on (edge)</option>
    </select>
  </label>
  <button type="submit">Save</button>
</form>
<p class="small">Currently {{.AnalyticsSetting.Count}}, from the {{.AnalyticsSetting.CountFrom}}
&mdash; for every app without its own setting, which an app&rsquo;s own Settings tab overrides.</p>
{{end}}
<p class="small">When on, the edge counts HTML page views and daily visitors as it serves them: no
JavaScript, no cookie, no stored IP. A visitor is a salted hash that changes every day and cannot be
joined across days. Whether that needs consent where your visitors are is your call, which is why it
is off until you turn it on.</p>

<h2>Delete this account</h2>
{{if .HasApps}}
<p class="small">This account has apps, so it can't be deleted. Delete or move the apps first;
  an account with nothing in it can be retired from this page.</p>
{{else}}
<p class="small">An account with no apps can be retired. Type <strong>{{.Account.Name}}</strong> to
  confirm, then confirm with your passkey. Members and pending invitations go with it; nothing
  outside this account is touched.</p>
<form class="signin" method="post" action="{{.Base}}/delete">
  <input type="hidden" name="csrf" value="{{.CSRF}}">
  <input type="text" name="confirm" placeholder="{{.Account.Name}}">
  <button type="submit">Delete account</button>
</form>
{{end}}
{{end}}
{{template "bottom" .}}{{end}}