{% extends "base.html" %}
{% block title %}Users{% endblock %}
{% block content %}
<div class="section-head">
  <div>
    <span class="section-tag">// section 03 › users & permissions</span>
    <h1>Users</h1>
    <p class="lead">Manage accounts, roles, MFA, and lockouts.</p>
  </div>
  <a href="{{ url_for('backoffice.user_new') }}" class="btn btn-primary">+ New user</a>
</div>

<table class="table">
  <thead>
    <tr>
      <th>Username</th><th>Email</th><th>Role</th><th>MFA</th><th>Status</th><th>Last login</th><th class="actions">Actions</th>
    </tr>
  </thead>
  <tbody>
    {% for u in users %}
    <tr>
      <td><strong>{{ u.username }}</strong>{% if u.id == current_user.id %} <span class="dim mono" style="font-size: .72rem;">(you)</span>{% endif %}</td>
      <td class="mono dim" style="font-size: .85rem;">{{ u.email }}</td>
      <td><span class="role-badge role-{{ u.role }}">{{ u.role }}</span></td>
      <td>
        <span class="status-badge {{ 'status-active' if u.mfa_enabled else 'status-inactive' }}">
          <span class="led"></span>{{ 'on' if u.mfa_enabled else 'off' }}
        </span>
      </td>
      <td>
        {% if u.is_locked %}
          <span class="status-badge" style="color: var(--danger);"><span class="led" style="background: var(--danger);"></span>locked</span>
        {% else %}
          <span class="status-badge {{ 'status-active' if u.is_active else 'status-inactive' }}"><span class="led"></span>{{ 'active' if u.is_active else 'disabled' }}</span>
        {% endif %}
      </td>
      <td class="mono dim" style="font-size: .82rem;">
        {% if u.last_login_at %}{{ u.last_login_at.strftime('%Y-%m-%d %H:%M') }}{% else %}never{% endif %}
      </td>
      <td class="actions">
        <a href="{{ url_for('backoffice.user_edit', user_id=u.id) }}" class="btn btn-ghost btn-sm">Edit</a>
        {% if u.mfa_enabled %}
          <form method="post" action="{{ url_for('backoffice.user_reset_mfa', user_id=u.id) }}" class="inline-form" data-confirm="Reset MFA for {{ u.username }}?">
            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
            <button class="btn btn-ghost btn-sm" type="submit">Reset MFA</button>
          </form>
        {% endif %}
        {% if u.is_locked %}
          <form method="post" action="{{ url_for('backoffice.user_unlock', user_id=u.id) }}" class="inline-form">
            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
            <button class="btn btn-ghost btn-sm" type="submit">Unlock</button>
          </form>
        {% endif %}
        {% if u.id != current_user.id %}
          <form method="post" action="{{ url_for('backoffice.user_delete', user_id=u.id) }}" class="inline-form" data-confirm="Permanently delete user '{{ u.username }}'?">
            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
            <button class="btn btn-danger btn-sm" type="submit">Delete</button>
          </form>
        {% endif %}
      </td>
    </tr>
    {% endfor %}
  </tbody>
</table>
{% endblock %}