{{/* 註冊新應用程式頁（僅 admin，獨立於管理列表頁）。以 layout.html（側邊
     導覽欄版面）為根模板組合渲染：本檔僅定義區塊，不應單獨解析執行；
     並引用 secretpanel.html 的一次性成果面板。導覽覆寫同管理列表頁
     （「應用程式管理」標記 aria-current）。註冊成功時於 POST 回應直接
     顯示成果（明文 client secret 僅此一次，故不採 PRG）；驗證失敗重繪
     時保留輸入（含核取方塊）。 */}}
{{define "title"}}註冊新應用程式 - alterminal{{end}}

{{define "navitems"}}
<li>
  <a href="/login"
    class="flex items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium text-neutral-600 hover:bg-neutral-100 dark:text-neutral-300 dark:hover:bg-neutral-700/60">
    <svg class="size-5 shrink-0" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
      <path stroke-linecap="round" stroke-linejoin="round" d="M15.75 6a3.75 3.75 0 1 1-7.5 0 3.75 3.75 0 0 1 7.5 0ZM4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.933 17.933 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632Z"/>
    </svg>
    帳號資訊
  </a>
</li>
<li>
  <a href="/admin/keys"
    class="flex items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium text-neutral-600 hover:bg-neutral-100 dark:text-neutral-300 dark:hover:bg-neutral-700/60">
    <svg class="size-5 shrink-0" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
      <path stroke-linecap="round" stroke-linejoin="round" d="M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25Z"/>
    </svg>
    金鑰管理
  </a>
</li>
<li>
  <a href="/admin/applications" aria-current="page"
    class="flex items-center gap-3 rounded-lg bg-brand/10 px-3 py-2 text-sm font-medium text-brand dark:bg-brand/25 dark:text-blue-200">
    <svg class="size-5 shrink-0" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
      <path stroke-linecap="round" stroke-linejoin="round" d="M21 7.5l-9-5.25L3 7.5m18 0l-9 5.25m9-5.25v9l-9 5.25M3 7.5l9 5.25M3 7.5v9l9 5.25m0-9v9"/>
    </svg>
    應用程式管理
  </a>
</li>
{{end}}

{{define "content"}}
<section class="rounded-xl bg-white p-8 shadow-lg dark:bg-neutral-800 dark:shadow-black/40">
  <div class="mb-6 flex flex-wrap items-center justify-between gap-3">
    <div>
      <h1 class="mb-1 text-xl font-semibold">註冊新應用程式</h1>
      <p class="text-sm text-neutral-500 dark:text-neutral-400">接入 OIDC 的應用程式（Relying Party）註冊</p>
    </div>
    <a href="/admin/applications"
      class="flex items-center gap-2 rounded-lg border border-neutral-300 px-4 py-2.5 text-sm font-semibold hover:bg-neutral-100 dark:border-neutral-600 dark:hover:bg-neutral-700">
      <svg class="size-4" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" aria-hidden="true">
        <path stroke-linecap="round" stroke-linejoin="round" d="M10.5 19.5 3 12m0 0 7.5-7.5M3 12h18"/>
      </svg>
      返回列表
    </a>
  </div>
  {{if .Error}}<p class="mb-4 rounded-lg bg-red-500/10 px-3 py-2.5 text-sm text-red-600 dark:text-red-400" role="alert">{{.Error}}</p>{{end}}
  {{if .Secret}}{{template "secretpanel" .Secret}}{{end}}

  <form method="post" action="/admin/applications/new" class="space-y-4">
    <input type="hidden" name="csrf_token" value="{{.CSRF}}">
    <div>
      <label for="app-name" class="mb-1 block text-sm font-medium">名稱</label>
      <input id="app-name" name="name" type="text" required maxlength="255" value="{{.Form.Name}}"
        class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm dark:border-neutral-600 dark:bg-neutral-900">
    </div>
    <div>
      <label for="app-type" class="mb-1 block text-sm font-medium">類型</label>
      <select id="app-type" name="type"
        class="w-full rounded-lg border border-neutral-300 px-3 py-2 text-sm dark:border-neutral-600 dark:bg-neutral-900">
        <option value="confidential" {{if eq .Form.Type "confidential"}}selected{{end}}>機密式 confidential（後端應用，發配 client secret）</option>
        <option value="public" {{if eq .Form.Type "public"}}selected{{end}}>公開式 public（SPA／行動應用，無 secret，須用 PKCE）</option>
      </select>
    </div>
    <div>
      <label for="app-redirect-uris" class="mb-1 block text-sm font-medium">Redirect URI（每行一個）</label>
      <textarea id="app-redirect-uris" name="redirect_uris" rows="3"
        class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">{{.Form.RedirectURIs}}</textarea>
      <p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">須為絕對 URI；http 僅允許 localhost／127.0.0.1／::1，其餘請使用 https；原生應用可用自訂 scheme（如 com.example.app:/cb）。</p>
    </div>
    <div>
      <label for="app-post-logout-uris" class="mb-1 block text-sm font-medium">登出後返回 URI（每行一個，選填）</label>
      <textarea id="app-post-logout-uris" name="post_logout_redirect_uris" rows="2"
        class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">{{.Form.PostLogoutRedirectURIs}}</textarea>
      <p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">RP-Initiated Logout 的 post_logout_redirect_uri 白名單（精確比對，格式規則同 redirect URI）；留空表示不接受登出後重導回應用程式。</p>
    </div>
    <fieldset>
      <legend class="mb-1 text-sm font-medium">允許的 grant type</legend>
      <div class="space-y-1.5 text-sm">
        <label class="flex items-center gap-2"><input type="checkbox" name="grant_types" value="authorization_code" class="size-4" {{if .Form.GrantAuthCode}}checked{{end}}> authorization_code（授權碼流程）</label>
        <label class="flex items-center gap-2"><input type="checkbox" name="grant_types" value="refresh_token" class="size-4" {{if .Form.GrantRefresh}}checked{{end}}> refresh_token（Refresh Token）</label>
        <label class="flex items-center gap-2"><input type="checkbox" name="grant_types" value="client_credentials" class="size-4" {{if .Form.GrantClientCred}}checked{{end}}> client_credentials（機器對機器，僅機密式）</label>
      </div>
      <p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">全不勾選時預設 authorization_code。</p>
    </fieldset>
    <div>
      <label for="app-scope" class="mb-1 block text-sm font-medium">Scope</label>
      <input id="app-scope" name="scope" type="text" value="{{.Form.Scope}}" placeholder="openid profile email"
        class="w-full rounded-lg border border-neutral-300 px-3 py-2 font-mono text-xs dark:border-neutral-600 dark:bg-neutral-900">
      <p class="mt-1 text-xs text-neutral-500 dark:text-neutral-400">空格分隔，可用：openid、profile、email、offline_access；留空使用預設 openid profile email（offline_access 須勾選 refresh_token）。</p>
    </div>
    <button type="submit"
      class="rounded-lg bg-brand px-4 py-2.5 text-sm font-semibold text-white hover:bg-brand-strong">註冊應用程式</button>
  </form>
</section>
{{end}}