{# Namespaced under `notes/` so that two installed apps can both ship an
   index.html without colliding. Extends `base.html`, which resolves to the
   site's chrome if it has any and to podpack's default if it has not -- the
   plugin never has to know which. #}
{% extends "base.html" %}
{% block content %}
{% if welcome %}
<blockquote>{{ welcome }}</blockquote>
{% endif %}
<h2>Notes</h2>
{# The browser's way in. `hidden_tag()` is what carries the CSRF token, and is
   the reason this is a flask-wtf form rather than markup written out by hand --
   podpack installs no site-wide CSRFProtect, so a bare <form> posting to a
   cookie-authenticated route would take one from any origin that asked. #}
<form method="post" action="{{ url_for('notes.index') }}">
  {{ form.hidden_tag() }}
  <p>{{ form.text(rows=3, cols=60, placeholder="Write a note") }}</p>
  {# Every field's errors and not just the textarea's. A missing or expired
     CSRF token is an error on `csrf_token`, so rendering `text.errors` alone
     brought the page back silently unchanged with nothing said -- which is what
     the test asserting the message caught. #}
  {% for _field, errors in form.errors.items() %}
  {% for error in errors %}<p><small>{{ error }}</small></p>{% endfor %}
  {% endfor %}
  <p>{{ form.submit() }}</p>
</form>
{% if notes %}
<ul>
  {% for note in notes %}
  <li>{{ note.text }} <small>({{ note.created.strftime("%Y-%m-%d %H:%M") }})</small></li>
  {% endfor %}
</ul>
{% else %}
<p>You have no notes yet.</p>
{% endif %}
<p><small>These are yours alone. Post one with
<code>curl -X POST -H 'Content-Type: application/json' -H "Authentication-Token: $TOKEN" -d '{"text":"hello"}' /notes/</code>
&mdash; flask-security issues <code>$TOKEN</code> in reply to a JSON POST to <code>/login?include_auth_token</code>.</small></p>
{% endblock %}