{{define "settings"}}{{template "top" .}}
{{if .Flash}}<p class="banner">{{.Flash}}</p>{{end}}
{{if .FlashErr}}<p class="banner error">{{.FlashErr}}</p>{{end}}
<div class="pagehead">
  <p class="eyebrow">{{.Address}}</p>
  <h1>Your settings</h1>
  <p class="lede">Yours across every account — not any one account's.</p>
</div>
<h2>Command-line access</h2>
<p class="small">Every terminal that can act as {{.Address}}.</p>
{{if .Tokens}}
<div class="tablewrap">
<table>
  <tr><th>Terminal</th><th>From</th><th>Signed in</th><th>Last used</th><th>Expires</th><th></th></tr>
  {{range .Tokens}}
  <tr>
    <td>{{if .IsService}}{{.Name}} <span class="small">(service credential{{if .App}} · {{.App}}{{end}})</span>{{else}}{{emptyOrDash .Label}}{{if .IsApp}} <span class="small">(app token{{if .App}} · {{.App}}{{end}})</span>{{end}}{{end}}</td>
    <td>{{emptyOrDash .RemoteAddr}}</td>
    <td>{{fmtTime .CreatedAt}}</td>
    <td>{{if .LastUsed.IsZero}}—{{else}}{{fmtTime .LastUsed}}{{end}}</td>
    <td>{{if .NeverExpires}}Never{{else}}{{fmtTime .ExpiresAt}}{{end}}</td>
    <td>
      {{if .IsService}}
      {{$sqid := index $.ServiceAccounts .AccountID}}
      {{if $sqid}}<span class="small">lives on account <a href="/a/{{$sqid}}/settings">{{$sqid}}</a> — manage there</span>
      {{else}}<span class="small">managed on its own account</span>{{end}}
      {{else}}
      <form method="post" action="/auth/cli/tokens/revoke">
        <input type="hidden" name="csrf" value="{{$.CSRF}}">
        <input type="hidden" name="id" value="{{.ID}}">
        <button class="linkish danger" type="submit">Revoke</button>
      </form>
      {{end}}
    </td>
  </tr>
  {{end}}
</table>
</div>
<p class="small">Revoking is immediate: that terminal's next command fails and
it has to log in again. Terminal tokens expire on their own after {{.Days}}
days; an app token never expires — it is a credential you minted for an app,
and revoking it here is how it is rotated. A SERVICE credential is listed here
because you minted it, but it belongs to its account and is rotated and
revoked from that account's settings page, not this one. The name and the
address are what the machine asking told us — if a row here is not a terminal
you recognise, revoke it.</p>
{{else}}
<p>No terminals are signed in as you.</p>
<pre><code>carlos auth login --console {{.Console}}</code></pre>
<p class="small">Run that on the machine you want to deploy from. It prints a
code; you approve it here.</p>
{{end}}
{{template "bottom" .}}{{end}}