<h1>Git accounts</h1>

<% if (msg) { %><div class="flash"><%= msg %></div><% } %>
<% if (err) { %><div class="flash err"><%= err %></div><% } %>

<div class="card">
  <h2>Connect with one click</h2>
  <div class="actions">
    <% if (oauthGithub) { %>
      <a class="btn primary" href="/auth/github/start">🐙 Connect GitHub</a>
    <% } else { %>
      <span class="muted">GitHub: OAuth app not configured<%= user.role === 'admin' ? ' — add the Client ID below' : ' — ask an admin' %></span>
    <% } %>
    <% if (oauthGitlab) { %>
      <a class="btn primary" href="/auth/gitlab/start">🦊 Connect GitLab</a>
    <% } else { %>
      <span class="muted">GitLab: OAuth app not configured<%= user.role === 'admin' ? ' — add the Application ID below' : ' — ask an admin' %></span>
    <% } %>
  </div>
  <div class="hint">Opens the provider, you authorize, and the access token is written back automatically. Manual token entry below still works.</div>
</div>

<div class="card">
  <% if (!accounts.length) { %>
    <div class="muted">No git accounts connected yet — add one below to browse repositories when creating projects.</div>
  <% } else { %>
  <table>
    <thead><tr><th>Provider</th><th>Label</th><th>API</th><th>Added</th><th></th></tr></thead>
    <tbody>
      <% accounts.forEach(function (a) { %>
        <tr>
          <td><span class="chip <%= a.provider === 'github' ? 'live' : 'queued' %>"><%= a.provider %></span></td>
          <td><strong><%= a.label %></strong> <span class="chip queued"><%= a.auth_type === 'oauth' ? 'oauth' : 'token' %></span></td>
          <td class="muted"><%= a.api_base || 'default' %></td>
          <td class="muted"><%= h.fmtTime(a.created_at) %></td>
          <td>
            <% if (a.provider === 'github' && a.auth_type === 'oauth' && oauthGithub) { %>
              <a class="btn small" href="/auth/github/start?reconnect=<%= a.id %>">Reconnect</a>
            <% } %>
            <form class="inline" method="post" action="/settings/git/<%= a.id %>/delete" onsubmit="return confirm('Remove account <%= a.label %>? Projects keep working; only browsing/auto-setup stops.')">
              <button class="btn small danger" type="submit">Remove</button>
            </form>
          </td>
        </tr>
      <% }) %>
    </tbody>
  </table>
  <% } %>
</div>

<div class="card">
  <h2>Add account</h2>
  <form method="post" action="/settings/git">
    <label for="ga-provider">Provider</label>
    <select id="ga-provider" name="provider" onchange="document.getElementById('ga-apibase-row').style.display = this.value === 'gitlab' ? '' : 'none'">
      <option value="github">GitHub</option>
      <option value="gitlab">GitLab</option>
    </select>
    <label for="ga-label">Label</label>
    <input id="ga-label" type="text" name="label" placeholder="e.g. younex1 (GitHub)" required>
    <label for="ga-token">Personal access token</label>
    <input id="ga-token" type="password" name="token" required autocomplete="off">
    <div class="hint">
      GitHub: classic PAT with <code>repo</code> + <code>admin:repo_hook</code> scopes.
      GitLab: PAT with <code>api</code> scope. The token is verified before saving and stored on this server only.
    </div>
    <div id="ga-apibase-row" style="display:none">
      <label for="ga-apibase">API base <span class="muted">(only for self-hosted GitLab, e.g. https://git.example.com/api/v4)</span></label>
      <input id="ga-apibase" type="text" name="api_base" placeholder="leave empty for gitlab.com">
    </div>
    <div style="margin-top:12px"><button class="btn primary" type="submit">Verify &amp; save</button></div>
  </form>
</div>

<% if (user.role === 'admin') { %>
<div class="card">
  <h2>OAuth provider apps <span class="muted">(admin — enables the Connect buttons for all users)</span></h2>
  <form method="post" action="/settings/git/apps">
    <input type="hidden" name="provider" value="github">
    <label>GitHub Client ID <span class="muted">(OAuth App — github.com → Settings → Developer settings → OAuth Apps; callback URL: <code>https://deploy.younex.de/auth/github/callback</code>)</span></label>
    <div class="copyrow">
      <input type="text" name="client_id" value="<%= oauthGithub ? oauthGithub.client_id : '' %>" placeholder="Iv1.… / Ov23li…" style="flex:1">
      <button class="btn small" type="submit">Save</button>
      <% if (oauthGithub) { %><button class="btn small danger" type="submit" name="action" value="delete">Remove</button><% } %>
    </div>
    <label style="margin-top:8px">GitHub Client Secret <span class="muted">(recommended — enables the pure redirect flow: click Connect → authorize → done. Without it the code-entry Device Flow is used)</span></label>
    <input type="password" name="client_secret" value="<%= oauthGithub && oauthGithub.client_secret ? oauthGithub.client_secret : '' %>" placeholder="client secret (optional)" autocomplete="off">
  </form>
  <form method="post" action="/settings/git/apps" style="margin-top:14px">
    <input type="hidden" name="provider" value="gitlab">
    <label>GitLab Application ID <span class="muted">(gitlab.com → Preferences → Applications: redirect URI <code>https://deploy.younex.de/auth/gitlab/callback</code>, scope <code>api</code>, NOT confidential)</span></label>
    <div class="copyrow">
      <input type="text" name="client_id" value="<%= oauthGitlab ? oauthGitlab.client_id : '' %>" placeholder="application id" style="flex:1">
      <button class="btn small" type="submit">Save</button>
      <% if (oauthGitlab) { %><button class="btn small danger" type="submit" name="action" value="delete">Remove</button><% } %>
    </div>
    <label style="margin-top:8px">GitLab base URL <span class="muted">(only self-hosted, e.g. https://git.example.com)</span></label>
    <input type="text" name="api_base" value="<%= oauthGitlab && oauthGitlab.api_base ? oauthGitlab.api_base : '' %>" placeholder="leave empty for gitlab.com">
  </form>
</div>
<% } %>
