{% extends "base.html" %}
{% set active = 'admin' %}
{% block title %}Admin · SD RMM{% endblock %}
{% block content %}

<h1 class="page-title">Admin</h1>

{% if reset_result %}
<section class="card-section" style="border-left:4px solid #d97706;background:#fffbeb">
  <header><h2>Temporary password set</h2></header>
  <p>A one-time password was set for <strong>{{ reset_result.email }}</strong>.
     Give it to them now &mdash; <strong>it won't be shown again</strong>:</p>
  <p><code style="font-size:1.15em;padding:4px 8px">{{ reset_result.password }}</code></p>
  <p class="muted">Their MFA is unchanged (they still need their authenticator).
     Ask them to change this password after logging in.</p>
</section>
{% endif %}

<section class="card-section">
  <header><h2>Organizations</h2></header>
  {% if not orgs %}<p class="muted">No organizations yet.</p>{% else %}
  <table class="datatable">
    <thead><tr><th>Name</th><th>Slug</th><th>Agents</th><th></th></tr></thead>
    <tbody>
    {% for o in orgs %}
      <tr>
        <td><a href="/admin/orgs/{{ o.id }}"><strong>{{ o.name }}</strong></a></td>
        <td><code>{{ o.slug }}</code></td>
        <td>{{ o.agents | length }}</td>
        <td><a class="btn btn-ghost" href="/admin/orgs/{{ o.id }}">Manage</a></td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% endif %}

  <form method="post" action="/admin/orgs" class="form form-inline">
    <input type="text" name="name" placeholder="Organization name" required>
    <input type="text" name="slug" placeholder="slug (optional)">
    <button type="submit" class="btn btn-primary">Create organization</button>
  </form>
</section>

<section class="card-section">
  <header><h2>Users</h2></header>
  {% if not users %}<p class="muted">No users yet.</p>{% else %}
  <table class="datatable">
    <thead><tr><th>Email</th><th>Role</th><th>MFA</th><th>Last login</th><th></th></tr></thead>
    <tbody>
    {% for u in users %}
      <tr>
        <td>{{ u.email }}</td>
        <td>{% if u.is_super_admin %}<span class="pill pill-super">super</span>{% else %}user{% endif %}</td>
        <td>{% if u.totp_enrolled %}<span class="pill pill-ok">on</span>{% else %}<span class="pill pill-bad">off</span>{% endif %}</td>
        <td>{% if u.last_login_at %}{{ u.last_login_at| pt('%Y-%m-%d %H:%M') }}{% else %}<span class="muted">never</span>{% endif %}</td>
        <td>
          <form method="post" action="/admin/users/{{ u.id }}/reset-password" style="margin:0"
                onsubmit="return confirm('Reset password for {{ u.email }}? Their current password stops working immediately.');">
            <button type="submit" class="btn btn-ghost">Reset password</button>
          </form>
        </td>
      </tr>
    {% endfor %}
    </tbody>
  </table>
  {% endif %}

  <form method="post" action="/admin/users" class="form form-inline">
    <input type="email" name="email" placeholder="user@example.com" required>
    <input type="password" name="password" placeholder="temporary password" required>
    <input type="text" name="display_name" placeholder="display name (optional)">
    <label class="inline-check"><input type="checkbox" name="is_super_admin" value="1"> super-admin</label>
    <button type="submit" class="btn btn-primary">Create user</button>
  </form>
</section>

<section class="card-section">
  <header><h2>Remote control console</h2></header>
  <p class="muted">Direct access to the MeshCentral admin console (&ldquo;SD Remote&rdquo;).
     For everyday remote desktop you don&rsquo;t need this &mdash; use the
     <strong>Remote desktop</strong> button on a device&rsquo;s page (no login required).
     This is the full admin console, as a fallback.</p>
  <p>Sign in as <code>sd</code>. The password is stored server-side (root-only)
     and is deliberately not shown here.</p>
  <p><a class="btn btn-primary" href="https://mesh.example.com/" target="_blank" rel="noopener">Open SD Remote console &#8599;</a></p>
</section>

{% endblock %}