{#
  Account and sessions page (spec section 10.2).

  Context:
    user                AuthUser              -- email, display_name, roles
    sessions            Sequence[SessionSummary]
    logout_url          str  -- POST target, default "logout"
    logout_all_url      str  -- POST target, default "logout-all"
    revoke_session_url  str  -- POST target for one session; the row posts the
                               session id in a hidden `session_id` field. The
                               revoke column is omitted when this is absent.
    show_logout_all     bool -- mirrors features.logout_all_enabled; the
                               "sign out everywhere" form renders unless this
                               is passed and falsy
    error               str  -- optional banner
    notice              str  -- optional confirmation banner

  Nothing here renders a token: SessionSummary carries no credential material.
#}
{% extends "base.html" %}

{% block page_title %}{{ title }} · Account{% endblock %}

{% block card_class %}fa-card fa-card--wide{% endblock %}

{% block heading %}Your account{% endblock %}

{% block subheading %}{% endblock %}

{% block content %}
  {% if error %}
    <p class="fa-alert" role="alert">{{ error }}</p>
  {% endif %}
  {% if notice %}
    <p class="fa-notice" role="status">{{ notice }}</p>
  {% endif %}

  <dl class="fa-details">
    <dt>Email</dt>
    <dd>{{ user.email }}</dd>
    <dt>Display name</dt>
    <dd>{{ user.display_name or "Not set" }}</dd>
    <dt>Roles</dt>
    <dd>
      {% if user.roles %}
        <ul class="fa-badges">
          {% for role in user.roles %}
            <li class="fa-badge">{{ role }}</li>
          {% endfor %}
        </ul>
      {% else %}
        None
      {% endif %}
    </dd>
  </dl>

  <h2 class="fa-section-title" id="sessions-heading">Active sessions</h2>
  {% if sessions %}
    <div class="fa-table-wrap">
      <table class="fa-table" aria-labelledby="sessions-heading">
        <thead>
          <tr>
            <th scope="col">Device</th>
            <th scope="col">Signed in</th>
            <th scope="col">Last used</th>
            {% if revoke_session_url %}
              <th scope="col"><span class="fa-visually-hidden">Actions</span></th>
            {% endif %}
          </tr>
        </thead>
        <tbody>
          {% for session in sessions %}
            <tr{% if session.is_current %} class="fa-row--current"{% endif %}>
              <td>
                {{ session.user_agent_label or "Unknown device" }}
                {% if session.is_current %}
                  <span class="fa-badge fa-badge--current">This device</span>
                {% endif %}
              </td>
              <td><time datetime="{{ session.created_at.isoformat() }}">{{ session.created_at | fa_datetime }}</time></td>
              <td><time datetime="{{ session.last_used_at.isoformat() }}">{{ session.last_used_at | fa_datetime }}</time></td>
              {% if revoke_session_url %}
                <td class="fa-cell--action">
                  {% if session.is_current %}
                    <span class="fa-muted">Current</span>
                  {% else %}
                    <form class="fa-inline-form" method="post" action="{{ revoke_session_url }}">
                      <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
                      <input type="hidden" name="session_id" value="{{ session.id }}">
                      <button class="fa-button fa-button--quiet" type="submit">
                        Revoke<span class="fa-visually-hidden"> the session on
                        {{ session.user_agent_label or "an unknown device" }}</span>
                      </button>
                    </form>
                  {% endif %}
                </td>
              {% endif %}
            </tr>
          {% endfor %}
        </tbody>
      </table>
    </div>
  {% else %}
    <p class="fa-muted">No active sessions.</p>
  {% endif %}

  <div class="fa-actions">
    <form class="fa-inline-form" method="post" action="{{ logout_url or 'logout' }}">
      <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
      <button class="fa-button" type="submit">Sign out</button>
    </form>
    {% if show_logout_all is not defined or show_logout_all %}
      <form class="fa-inline-form" method="post" action="{{ logout_all_url or 'logout-all' }}">
        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
        <button class="fa-button fa-button--danger" type="submit">Sign out everywhere</button>
      </form>
    {% endif %}
  </div>
{% endblock %}