{#
  Settings.

  This screen is one request away from being a credential dump, so everything
  on it has been through redact_secrets first. A hidden value keeps its
  placeholder and is styled as hidden: a blank field would read as "nothing is
  set here" and invite someone to overwrite a working credential with an empty
  string.

  Configuration is edited in sections, each an htmx swap over the config API's
  own endpoints, loaded below from /settings/config so the page handler in the
  aggregate router stays untouched by editor work. Stored credentials remain
  CLI-only; the editor says so on itself. The stored-file dump at the bottom
  excludes the keys the editable sections own, so a value never appears twice
  on this screen with one copy stale after a swap.

  The controls this screen also carries - two-factor authentication, API
  tokens and session management - belong to the panel itself and nowhere else.
#}
{% extends "base.html" %}
{% import "_macros.html" as m %}

{% block title %}Settings{% endblock %}

{% block content %}

{{ m.page_head("Settings", "Configuration is edited by section. Secrets are redacted before they leave the server and are changed from the CLI.") }}

<section class="stack--tight">
  <h2 class="stack__title">Two-factor authentication</h2>
  {% include "fragments/totp.html" %}
</section>

<section class="stack--tight">
  <h2 class="stack__title">API tokens</h2>
  {% include "fragments/api_tokens.html" %}
</section>

<section class="stack--tight">
  <h2 class="stack__title">Sessions</h2>
  {% include "fragments/sessions.html" %}
</section>

<div hx-get="/settings/config" hx-trigger="load" hx-swap="outerHTML">
  <span class="visually-hidden">Loading configuration sections…</span>
  <div class="skeleton skeleton--row" aria-hidden="true"></div>
  <div class="skeleton skeleton--row" aria-hidden="true"></div>
</div>

{% if problem %}
  {{ m.problem(problem.fix, problem.output) }}
{% endif %}

{#
  Keys owned by the editable sections above are excluded from the stored-file
  dump: they already render there, and an htmx save would leave this copy
  stale until the next full navigation.
#}
{% set covered_sections = ["ssl", "backup", "web", "notifications"] %}
{% set covered_keys = ["apps_directory", "webserver"] %}
{% set remaining = [] %}
{% for section in sections if section.name not in covered_sections %}
  {% set entries = section.entries | rejectattr("key", "in", covered_keys) | list %}
  {% if entries %}
    {% set _ = remaining.append({"name": section.name, "entries": entries}) %}
  {% endif %}
{% endfor %}

{% if remaining %}
  {% for section in remaining %}
    <section class="stack--tight">
      <h2 class="stack__title">{{ section.name }}</h2>
      <div class="rows">
        <table class="table">
          <tbody>
            {% for entry in section.entries %}
              <tr>
                <th scope="row">{{ entry.key }}</th>
                <td>
                  {%- if entry.redacted %}{{ m.secret(entry.value) }}
                  {%- else %}<span class="mono">{{ entry.value }}</span>{% endif -%}
                </td>
              </tr>
            {% endfor %}
          </tbody>
        </table>
      </div>
    </section>
  {% endfor %}
{% elif not problem %}
  {{ m.empty(
      "Nothing else stored",
      "Beyond the sections above, this machine runs on the built-in defaults. Writing any setting creates the file.",
      command="wasm config set apps.directory /var/www/apps") }}
{% endif %}

{% endblock %}