<h1>Admin Users</h1>

<% if (forbidden) { %>
  <div class="alert alert-danger">Your role (<%= adminUser.role %>) does not have permission to manage admin-console accounts. This page is visible to super_admin only.</div>
<% } else { %>

  <% if (error) { %><div class="alert alert-danger"><%= error %></div><% } %>

  <div class="card">
    <table>
      <thead><tr><th>Email</th><th>Name</th><th>Role</th><th>Status</th><th>MFA</th><th>Last login</th><th></th></tr></thead>
      <tbody>
        <% for (const u of adminUsers) { %>
        <tr>
          <td><%= u.email %></td>
          <td><%= u.first_name %> <%= u.last_name %></td>
          <td><span class="role-badge"><%= u.role %></span></td>
          <td><span class="badge <%= u.is_active ? 'badge-ok' : 'badge-danger' %>"><%= u.is_active ? 'Active' : 'Inactive' %></span></td>
          <td><span class="badge <%= u.mfa_enabled ? 'badge-ok' : 'badge-danger' %>"><%= u.mfa_enabled ? 'Enrolled' : 'Not enrolled' %></span></td>
          <td><%= u.last_login_at ? new Date(u.last_login_at).toLocaleString() : 'Never' %></td>
          <td>
            <% if (u.id !== adminUser.id) { %>
            <form method="post" action="/admin-users/<%= u.id %>" style="display:inline">
              <input type="hidden" name="isActive" value="<%= u.is_active ? 'false' : 'true' %>">
              <button class="link-btn" type="submit"><%= u.is_active ? 'Deactivate' : 'Activate' %></button>
            </form>
            <% if (u.mfa_enabled) { %>
            <form method="post" action="/admin-users/<%= u.id %>/reset-mfa" style="display:inline" onsubmit="return confirm('Reset MFA for <%= u.email %>? They will be signed out everywhere and must re-enroll on next login.')">
              <button class="link-btn" type="submit">Reset MFA</button>
            </form>
            <% } %>
            <% } %>
          </td>
        </tr>
        <% } %>
        <% if (!adminUsers.length) { %><tr><td colspan="7" style="color:var(--muted)">No admin accounts yet.</td></tr><% } %>
      </tbody>
    </table>
  </div>

  <div class="card" style="max-width:420px">
    <h2 style="font-size:15px;margin-top:0">New admin account</h2>
    <p style="font-size:12px;color:var(--muted)">Creating an account requires a fresh re-auth if your session is more than 15 minutes old — you'll be asked to sign in again if so.</p>
    <form method="post" action="/admin-users">
      <label>Email</label>
      <input type="email" name="email" required>
      <label>First name</label>
      <input type="text" name="firstName" required>
      <label>Last name</label>
      <input type="text" name="lastName" required>
      <label>Role</label>
      <select name="role" required>
        <% for (const r of roles) { %><option value="<%= r.name %>"><%= r.name %></option><% } %>
      </select>
      <label>Initial password (min 12 chars)</label>
      <input type="password" name="password" minlength="12" required>
      <button class="btn" type="submit" style="width:100%;margin-top:20px">Create account</button>
    </form>
  </div>

<% } %>
