{% extends 'layouts/base.html' %}
{% block subtitle %}<p class="text-secondary">These accounts grant WebGUI access only. Both roles can read all AIM customers and prepare selections; administrators can also manage WebGUI accounts.</p>{% endblock %}
{% block content %}
<section class="card mb-4"><div class="card-header"><h2 class="h5 mb-0">Local accounts</h2><span class="text-secondary small">{{ users|length }} accounts</span></div><div class="table-responsive"><table class="table align-middle"><thead><tr><th>Account</th><th>Role</th><th>Status</th><th>Actions</th></tr></thead><tbody>
{% for u in users %}<tr><td class="entity-name">{{ u.username }}</td><td>{{ u.role }}</td><td><span class="badge {{ 'badge-success' if u.enabled else 'badge-neutral' }}">{{ 'Enabled' if u.enabled else 'Disabled' }}</span>{% if u.must_change_password %}<span class="badge badge-warning">Password change required</span>{% endif %}</td><td><form action="/users/{{ u.username|urlencode }}" method="post" class="d-flex flex-wrap gap-2"><input type="hidden" name="_csrf" value="{{ csrf }}"><button class="btn btn-sm btn-outline-secondary" name="action" value="{{ 'disable' if u.enabled else 'enable' }}">{{ 'Disable' if u.enabled else 'Enable' }}</button><button class="btn btn-sm btn-outline-secondary" name="action" value="{{ 'demote' if u.role == 'admin' else 'promote' }}">{{ 'Make viewer' if u.role == 'admin' else 'Make admin' }}</button><button class="btn btn-sm btn-outline-secondary" name="action" value="revoke">Revoke sessions</button></form><details class="mt-2"><summary class="small">Reset password</summary><form action="/users/{{ u.username|urlencode }}" method="post" class="reset-form mt-2"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="reset-password"><label class="form-label" for="reset-{{ u.id }}">New temporary password</label><input class="form-control mb-2" id="reset-{{ u.id }}" type="password" name="password" minlength="15" maxlength="128" autocomplete="new-password" required><label class="form-label" for="reset-confirm-{{ u.id }}">Confirm temporary password</label><input class="form-control mb-2" id="reset-confirm-{{ u.id }}" type="password" name="confirm" minlength="15" maxlength="128" autocomplete="new-password" required><button type="submit" class="btn btn-sm btn-outline-primary">Reset &amp; revoke sessions</button></form></details></td></tr>{% endfor %}
</tbody></table></div></section>
<section class="card"><div class="card-header"><h2 class="h5 mb-0">Add account</h2></div><div class="card-body p-4"><form action="/users" method="post" class="row g-3"><input type="hidden" name="_csrf" value="{{ csrf }}"><div class="col-md-6"><label class="form-label" for="new-user">Username</label><input class="form-control" id="new-user" name="username" minlength="3" maxlength="64" autocomplete="off" required></div><div class="col-md-6"><label class="form-label" for="role">Role</label><select class="form-select" name="role" id="role"><option value="viewer">Viewer</option><option value="admin">Administrator</option></select></div><div class="col-md-6"><label class="form-label" for="temporary">Temporary password</label><input class="form-control" id="temporary" type="password" name="password" minlength="15" maxlength="128" autocomplete="new-password" required></div><div class="col-md-6"><label class="form-label" for="confirm">Confirm temporary password</label><input class="form-control" id="confirm" type="password" name="confirm" minlength="15" maxlength="128" autocomplete="new-password" required></div><div class="col-12"><p class="form-text">Password change is mandatory at first login. Accounts are disabled rather than deleted. The last enabled administrator is protected.</p><button type="submit" class="btn btn-primary">Create account</button></div></form></div></section>
<section class="card mt-4"><div class="card-body p-4"><h2 class="h4">Scoped execution grants</h2><p class="text-secondary">Viewer accounts can become operators for explicit customer/playbook pairs. Reading remains controller-wide. Only administrators approve jobs; an administrator cannot approve their own request.</p>
<form action="/permissions" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><div id="grant-fields">{% include 'partials/grant_fields.html' %}</div></form>
<ul class="event-list">{% for g in grants %}<li>{{ g.username }} / {{ g.customer }} / {{ g.playbook }}<form action="/permissions" method="post"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="user_id" value="{{ g.user_id }}"><input type="hidden" name="customer" value="{{ g.customer }}"><input type="hidden" name="playbook" value="{{ g.playbook }}"><button class="btn btn-sm btn-outline-secondary" name="action" value="revoke">Revoke</button></form></li>{% else %}<li>No scoped grants. Administrators remain subject to the controller allowlist and approval policy.</li>{% endfor %}</ul></div></section>{% endblock %}