{% extends "artifacts/settings_base.html" %}

{% block settings_content %}
  <h2>Users</h2>

  {% if created_token %}
    <p><strong>API token for {{ created_user.username }}</strong> — shown once, copy it now:</p>
    <p><code class="token-value">{{ created_token.key }}</code></p>
  {% endif %}

  <h3>Add User</h3>
  <p>New users are regular accounts by default — they can log in and use their own token, but cannot reach Django admin unless you grant admin access below.</p>
  <form method="post">
    {% csrf_token %}
    <p><label>Username<br><input type="text" name="username" required autocomplete="off"></label></p>
    <p><label>Password<br><input type="password" name="password" required autocomplete="new-password"></label></p>
    <p><label><input type="checkbox" name="is_superuser"> Grant admin access</label></p>
    <button type="submit">Create User</button>
  </form>

  <h3>Existing Users</h3>
  <ul class="storage-facts">
    {% for user in users %}
      <li>
        {{ user.username }}{% if user == request.user %} (you){% endif %}
        {% if user.is_superuser %} &mdash; admin{% endif %}
        {% if not user.is_active %} &mdash; disabled{% endif %}
      </li>
    {% endfor %}
  </ul>
{% endblock %}