{% extends "base.html" %}
{% block title %}Users · IP TM Manager{% endblock %}
{% block body %}
<h1>Users</h1>
<p class="sub">Manage who can access the system. Admins can change everything; viewers can browse and search only.</p>
<div class="panel">
  <h2>Add User</h2>
  <form method="post" action="{{ url_for('new_user') }}">
    <div class="row">
      <div class="field"><label>Username</label><input name="username" required></div>
      <div class="field"><label>Password</label><input name="password" type="password" required></div>
      <div class="field"><label>Role</label>
        <select name="role"><option value="viewer">Viewer</option><option value="admin">Admin</option></select></div>
      <div class="field" style="display:flex;align-items:flex-end"><button class="btn">Add</button></div>
    </div>
  </form>
</div>
<div class="panel">
  <h2>All Users</h2>
  <table>
    <tr><th>Username</th><th>Role</th><th>Status</th><th>Last login</th><th></th></tr>
    {% for u in users %}
    <tr>
      <td>{{ u.username }}{% if current_user and u.id == current_user.id %} <span class="muted">(you)</span>{% endif %}</td>
      <td><span class="pill {{ 'complete' if u.role=='admin' else 'open' }}">{{ u.role }}</span></td>
      <td><span class="pill {{ 'ok' if u.active else 'flag' }}">{{ 'active' if u.active else 'disabled' }}</span></td>
      <td class="mono muted">{{ u.last_login.strftime('%Y-%m-%d %H:%M') if u.last_login else '—' }}</td>
      <td>{% if not (current_user and u.id == current_user.id) %}
        <form method="post" action="{{ url_for('toggle_user', user_id=u.id) }}">
          <button class="btn ghost sm">{{ 'Disable' if u.active else 'Enable' }}</button></form>{% endif %}</td>
    </tr>
    {% endfor %}
  </table>
</div>
{% endblock %}