{{define "content"}}
<div class="row">
  <div class="col-md-12">
    <h2>Agent tokens</h2>
    <p>
      The credential an agent presents as
      <code>Authorization: Bearer &lt;token&gt;</code> to propose over the REST
      and MCP write planes. Only the stored hash lives in the database, so a
      token is shown exactly once — when it is minted.
    </p>

    {{if .Data.Minted}}
    <div class="alert alert-success">
      <p>
        <strong>{{.Data.MintedName}}</strong> minted. Copy it now &mdash; this is
        the only time it is shown.
      </p>
      <pre class="mb-0"><code>{{.Data.Minted}}</code></pre>
    </div>
    {{end}}

    <form method="POST" action="/tokens" class="form-inline mb-4">
      <div class="form-group">
        <label class="sr-only" for="name">Name</label>
        <input class="form-control" type="text" id="name" name="name"
               placeholder="which agent holds it" autocomplete="off" required>
      </div>
      <button class="btn btn-primary" type="submit">Mint token</button>
    </form>

    {{if .Data.Tokens}}
    <table class="table">
      <thead>
        <tr><th>Name</th><th>Created</th><th>State</th><th></th></tr>
      </thead>
      <tbody>
        {{range .Data.Tokens}}
        <tr>
          <td>{{.Name}}</td>
          <td class="text-muted"><code>{{.Created}}</code></td>
          <td>
            {{if .Active}}
            <span class="badge badge-success">active</span>
            {{else}}
            <span class="badge badge-danger">revoked</span>
            <small class="text-muted"><code>{{.Revoked}}</code></small>
            {{end}}
          </td>
          <td>
            {{if .Active}}
            <form method="POST" action="/tokens/{{.ID}}/revoke">
              <button type="submit" class="btn btn-sm btn-outline-danger">Revoke</button>
            </form>
            {{end}}
          </td>
        </tr>
        {{end}}
      </tbody>
    </table>
    {{else}}
    <p class="text-muted">
      No tokens yet. Without one the agent write plane refuses every caller as
      anonymous, so nothing can propose.
    </p>
    {{end}}
  </div>
</div>
{{end}}