{% extends "base.html" %}

{% block title %}{% if client %}Edit Client{% else %}Create Client{% endif %} - NanoIDP{% endblock %}

{% block content %}
<nav aria-label="breadcrumb" class="mb-4">
    <ol class="breadcrumb">
        <li class="breadcrumb-item"><a href="{{ url_for('ui.clients') }}">OAuth Clients</a></li>
        <li class="breadcrumb-item active">{% if client %}Edit {{ client.client_id }}{% else %}Create Client{% endif %}</li>
    </ol>
</nav>

<div class="d-flex justify-content-between align-items-center mb-4">
    <h2>
        <i class="bi bi-{% if client %}pencil{% else %}plus-lg{% endif %} me-2"></i>
        {% if client %}Edit OAuth Client{% else %}Create OAuth Client{% endif %}
    </h2>
</div>

<div class="row">
    <div class="col-md-8">
        <form method="post" class="needs-validation" novalidate>
            <input type="hidden" name="expected_revision" value="{{ revision }}">
            <div class="card">
                <div class="card-body">
                    <div class="mb-3">
                        <label for="client_id" class="form-label">Client ID <span class="text-danger">*</span></label>
                        <input type="text" class="form-control" id="client_id" name="client_id"
                               value="{{ client.client_id if client else '' }}"
                               {% if client %}readonly{% endif %} required
                               pattern="[a-zA-Z0-9_-]+" title="Only letters, numbers, underscores and hyphens">
                        <div class="form-text">Unique identifier for the OAuth client</div>
                    </div>

                    <div class="mb-3">
                        <label for="token_endpoint_auth_method" class="form-label">Token Endpoint Auth Method</label>
                        <select class="form-select" id="token_endpoint_auth_method" name="token_endpoint_auth_method"
                                onchange="authMethodChanged()">
                            {% set current_method = client.token_endpoint_auth_method if client else 'client_secret_basic' %}
                            <option value="client_secret_basic" {% if current_method == 'client_secret_basic' %}selected{% endif %}>client_secret_basic (confidential)</option>
                            <option value="client_secret_post" {% if current_method == 'client_secret_post' %}selected{% endif %}>client_secret_post (confidential)</option>
                            <option value="none" {% if current_method == 'none' %}selected{% endif %}>none (public: CLI, SPA, MCP client)</option>
                        </select>
                        <div class="form-text">
                            A public client ("none") has no secret, must use PKCE with S256 on /authorize,
                            cannot use the client_credentials grant, and always gets refresh token rotation.
                        </div>
                    </div>

                    <div class="mb-3">
                        <label for="client_secret" class="form-label">
                            Client Secret {% if not client %}<span class="text-danger" id="client_secret_required_marker">*</span>{% endif %}
                        </label>
                        <div class="input-group">
                            <input type="text" class="form-control" id="client_secret" name="client_secret"
                                   value="{{ generated_secret if generated_secret else '' }}"
                                   {% if not client %}required{% endif %}>
                            {% if not client %}
                            <button type="button" class="btn btn-outline-secondary" onclick="generateSecret()">
                                <i class="bi bi-arrow-clockwise"></i> Generate
                            </button>
                            {% endif %}
                        </div>
                        {% if client %}
                        <div class="form-text">Leave empty to keep current secret</div>
                        {% else %}
                        <div class="form-text">A random secret has been generated. You can change it if needed.</div>
                        {% endif %}
                    </div>

                    <div class="mb-3">
                        <label for="description" class="form-label">Description</label>
                        <input type="text" class="form-control" id="description" name="description"
                               value="{{ client.description if client else '' }}"
                               placeholder="e.g., Frontend application client">
                    </div>

                    <div class="mb-3">
                        <label for="additional_audiences" class="form-label">Additional Audiences</label>
                        <textarea class="form-control" id="additional_audiences" name="additional_audiences"
                                  rows="3" placeholder="One audience per line, e.g.&#10;https://api.example.com&#10;urn:service:billing">{{ client.additional_audiences | join('\n') if client else '' }}</textarea>
                        <div class="form-text">
                            Extra audiences added to the ID Token <code>aud</code> alongside the client_id.
                            When more than one distinct audience results, <code>aud</code> becomes an array and an <code>azp</code> claim is emitted.
                        </div>
                    </div>

                    <div class="mb-3">
                        <label for="redirect_uris" class="form-label">Registered Redirect URIs</label>
                        <textarea class="form-control" id="redirect_uris" name="redirect_uris"
                                  rows="3" placeholder="One URI per line, e.g.&#10;http://localhost:3000/callback">{{ client.redirect_uris | join('\n') if client else '' }}</textarea>
                        <div class="form-text">
                            When set, <code>/authorize</code> only accepts a <code>redirect_uri</code> that matches one of these exactly
                            (RFC 6749 §3.1.2.3, OAuth 2.1 §4.1.1). Leave empty to accept any syntactically valid URI (dev default).
                        </div>
                    </div>

                    <div class="mb-3">
                        <label for="allowed_scopes" class="form-label">Allowed Scopes</label>
                        <textarea class="form-control" id="allowed_scopes" name="allowed_scopes"
                                  rows="3" placeholder="One scope per line, e.g.&#10;openid&#10;profile">{{ client.allowed_scopes | join('\n') if client else '' }}</textarea>
                        <div class="form-text">
                            When set, a requested <code>scope</code> outside this list is <code>invalid_scope</code>
                            at <code>/authorize</code> and <code>/token</code> (RFC 6749 §4.1.2.1/§5.2). Leave empty to
                            allow any scope in the global vocabulary (<code>oauth.scopes_supported</code>, dev default).
                        </div>
                    </div>

                    <div class="mb-3">
                        <label for="allowed_resources" class="form-label">Allowed Resources</label>
                        <textarea class="form-control" id="allowed_resources" name="allowed_resources"
                                  rows="3" placeholder="One resource URI per line, e.g.&#10;https://mcp.example/server">{{ client.allowed_resources | join('\n') if client else '' }}</textarea>
                        <div class="form-text">
                            RFC 8707 (#187). When set, a <code>resource</code> requested at
                            <code>/authorize</code> or <code>/token</code> outside this list is
                            <code>invalid_target</code>. Leave empty to allow any valid resource
                            (an absolute URI without a fragment). The access token
                            <code>aud</code> is bound to the requested resource.
                        </div>
                    </div>

                    <hr class="my-4">
                    <h6 class="mb-3">
                        <i class="bi bi-palette me-2"></i>Login Page Branding (Optional)
                        {% if client %}
                        <a href="{{ url_for('oauth.authorize', response_type='code', client_id=client.client_id, redirect_uri=client.redirect_uris[0] if client.redirect_uris else 'http://localhost:3000/callback') }}"
                           target="_blank" rel="noopener" class="ms-2" title="Preview login page in a new tab">
                            <i class="bi bi-box-arrow-up-right"></i>
                        </a>
                        {% endif %}
                    </h6>

                    <div class="mb-3">
                        <div class="form-check mb-1">
                            <input type="checkbox" class="form-check-input color-enable-toggle" id="enable_background_color"
                                   data-target="background_color"
                                   {% if client and client.background_color %}checked{% endif %}>
                            <label class="form-check-label" for="enable_background_color">Custom background color</label>
                        </div>
                        <input type="color" class="form-control form-control-color" id="background_color" name="background_color"
                               value="{{ client.background_color if client and client.background_color else '#1a1a2e' }}"
                               title="Color behind the login card"
                               {% if not (client and client.background_color) %}disabled{% endif %}>
                        <div class="form-text">Color behind the login dialog</div>
                    </div>

                    <div class="mb-3">
                        <div class="form-check mb-1">
                            <input type="checkbox" class="form-check-input color-enable-toggle" id="enable_header_color"
                                   data-target="header_color"
                                   {% if client and client.header_color %}checked{% endif %}>
                            <label class="form-check-label" for="enable_header_color">Custom header color</label>
                        </div>
                        <input type="color" class="form-control form-control-color" id="header_color" name="header_color"
                               value="{{ client.header_color if client and client.header_color else '#0d6efd' }}"
                               title="Color for the header band"
                               {% if not (client and client.header_color) %}disabled{% endif %}>
                        <div class="form-text">Color for the card header band</div>
                    </div>

                    <div class="mb-3">
                        <div class="form-check mb-1">
                            <input type="checkbox" class="form-check-input color-enable-toggle" id="enable_footer_color"
                                   data-target="footer_color"
                                   {% if client and client.footer_color %}checked{% endif %}>
                            <label class="form-check-label" for="enable_footer_color">Custom footer color</label>
                        </div>
                        <input type="color" class="form-control form-control-color" id="footer_color" name="footer_color"
                               value="{{ client.footer_color if client and client.footer_color else '#ffffff' }}"
                               title="Color for the footer band"
                               {% if not (client and client.footer_color) %}disabled{% endif %}>
                        <div class="form-text">Color for the card footer band</div>
                    </div>

                    <div class="mb-3 form-check">
                        <input type="checkbox" class="form-check-input" id="show_client_id" name="show_client_id"
                               {% if not client or client.show_client_id %}checked{% endif %}>
                        <label class="form-check-label" for="show_client_id">Show Client ID on login page</label>
                    </div>

                    <div class="mb-3 form-check">
                        <input type="checkbox" class="form-check-input" id="show_description" name="show_description"
                               {% if client and client.show_description %}checked{% endif %}>
                        <label class="form-check-label" for="show_description">Show description on login page</label>
                    </div>

                    <div class="mb-3">
                        <label for="layout" class="form-label">Login Page Layout</label>
                        <select class="form-select" id="layout" name="layout">
                            {% set current_layout = client.layout if client else 'vertical' %}
                            <option value="vertical" {% if current_layout == 'vertical' %}selected{% endif %}>Vertical (single column)</option>
                            <option value="horizontal" {% if current_layout == 'horizontal' %}selected{% endif %}>Horizontal (client info beside the form)</option>
                        </select>
                        <div class="form-text">
                            Horizontal places the client info and the login form side by side; it collapses
                            back to a single column on narrow screens.
                        </div>
                    </div>

                    <div class="alert alert-info" role="alert">
                        <i class="bi bi-info-circle me-2"></i>
                        <strong>Logo:</strong> To add a client logo to the login page, place an image file at
                        <code>{{ logos_dir }}/<em>{{ 'client-id' if not client else client.client_id }}</em>.{svg,png,jpg,webp}</code>
                        on the server - no configuration needed.
                    </div>
                </div>
            </div>

            <div class="d-flex justify-content-between mt-4">
                <a href="{{ url_for('ui.clients') }}" class="btn btn-outline-secondary">
                    <i class="bi bi-arrow-left me-2"></i>Cancel
                </a>
                <button type="submit" class="btn btn-primary">
                    <i class="bi bi-check-lg me-2"></i>{% if client %}Save Changes{% else %}Create Client{% endif %}
                </button>
            </div>
        </form>
    </div>

    <div class="col-md-4">
        <div class="card bg-light">
            <div class="card-body">
                <h6><i class="bi bi-info-circle me-2"></i>About OAuth Clients</h6>
                <p class="small mb-2">OAuth clients are used to authenticate applications requesting tokens from the IdP.</p>
                <ul class="small mb-0">
                    <li>Store secrets securely</li>
                    <li>Use unique client IDs</li>
                    <li>Rotate secrets periodically</li>
                </ul>
            </div>
        </div>
    </div>
</div>
{% endblock %}

{% block extra_js %}
<script>
function authMethodChanged() {
    // A public client ("none", #188) has no secret: lift the HTML-side
    // requirement so the form can submit with the field empty. The server
    // re-validates either way.
    const isPublic = document.getElementById('token_endpoint_auth_method').value === 'none';
    const secretInput = document.getElementById('client_secret');
    if (secretInput.hasAttribute('data-was-required') || secretInput.required) {
        secretInput.setAttribute('data-was-required', '1');
        secretInput.required = !isPublic;
    }
    const marker = document.getElementById('client_secret_required_marker');
    if (marker) marker.hidden = isPublic;
}
document.addEventListener('DOMContentLoaded', authMethodChanged);

function generateSecret() {
    const array = new Uint8Array(32);
    crypto.getRandomValues(array);
    const secret = btoa(String.fromCharCode.apply(null, array))
        .replace(/\+/g, '-')
        .replace(/\//g, '_')
        .replace(/=/g, '');
    document.getElementById('client_secret').value = secret;
}

// Color pickers always submit a value, so a disabled input (unchecked toggle)
// is the only way to keep an untouched color field unset (#150).
document.querySelectorAll('.color-enable-toggle').forEach(function(toggle) {
    var target = document.getElementById(toggle.dataset.target);
    toggle.addEventListener('change', function() {
        target.disabled = !toggle.checked;
    });
});

// Form validation
(function() {
    'use strict';
    var forms = document.querySelectorAll('.needs-validation');
    Array.prototype.slice.call(forms).forEach(function(form) {
        form.addEventListener('submit', function(event) {
            if (!form.checkValidity()) {
                event.preventDefault();
                event.stopPropagation();
            }
            form.classList.add('was-validated');
        }, false);
    });
})();
</script>
{% endblock %}