{% extends "admin/change_form.html" %}
{% load loginas_javascript %}

{% block extrahead %}
  {{ block.super }}

  <style nonce="{{ request.csp_nonce }}">
    .loginas-disabled {
        opacity: 0.5;
        cursor: not-allowed;
    }
    #loginas-confirm:hover {
        background: var(--secondary, #205067);
        color: #fff;
    }
  </style>

  <script nonce="{{ request.csp_nonce }}">
    document.addEventListener("DOMContentLoaded", () => {
        document.getElementById("send_verification_email_button")?.addEventListener("click", (event) => {
            // prevent anchor tag from navigating
            event.preventDefault();
            if (window.confirm("Send verification email?"))
                document.getElementById("send_verification").submit();
        });

        document.getElementById("revoke_sessions_button")?.addEventListener("click", (event) => {
            // prevent anchor tag from navigating
            event.preventDefault();
            if (window.confirm("Revoke all sessions? This will log out the user from all devices."))
                document.getElementById("revoke_sessions").submit();
        });

        document.getElementById("send_2fa_reset_email_button")?.addEventListener("click", (event) => {
            // prevent anchor tag from navigating
            event.preventDefault();
            if (window.confirm("Send 2FA reset email? This will allow the user to disable their 2FA settings."))
                document.getElementById("send_2fa_reset").submit();
        });

        // Django's ReadOnlyPasswordHashWidget renders a native "Reset password" button linking to
        // ../password/ (which we don't support). Repurpose it to email the user a reset link instead.
        document.querySelector(".field-password a.button")?.addEventListener("click", (event) => {
            // prevent anchor tag from navigating to ../password/
            event.preventDefault();
            if (window.confirm("Send password reset email? This will let the user set a new password."))
                document.getElementById("send_password_reset").submit();
        });

        // Add read-only toggle to loginas modal
        const reasonField = document.getElementById("loginas-reason");
        if (reasonField) {
            const ticketParam = new URLSearchParams(window.location.search).get('ticket');

            // Pre-fill reason field when modal opens (after loginas clears it)
            if (ticketParam) {
                document.getElementById("loginas-link")?.addEventListener("click", () => {
                    setTimeout(() => {
                        reasonField.value = `For ticket ${ticketParam}`;
                    }, 0);
                });
            }

            const div = document.createElement("div");
            div.style.marginTop = "10px";
            div.innerHTML = '<label><input type="checkbox" id="loginas-read-only" checked> Read-only mode (recommended)</label>';
            reasonField.after(div);

            document.getElementById("loginas-read-only").addEventListener("change", (e) => {
                document.getElementById("loginas-read-only-input").value = e.target.checked;
            });
        }
    });
  </script>
{% endblock %}

{% block object-tools-items %}
    {{ block.super }}
    {% if original.allow_impersonation == False %}
        <li><a id="loginas-link" href="#" class="loginas-disabled" title="Disallowed by user">Log in as user</a></li>
    {% else %}
        <li><a id="loginas-link" href="#">Log in as user</a></li>
    {% endif %}
{% endblock %}

{% block content %}
    {{ block.super }}

    <form method="POST" id="send_verification">
        {% csrf_token %}
        <input type="hidden" name="send_verification" value="1" />
    </form>

    <form method="POST" id="revoke_sessions">
        {% csrf_token %}
        <input type="hidden" name="revoke_sessions" value="1" />
    </form>

    <form method="POST" id="send_2fa_reset">
        {% csrf_token %}
        <input type="hidden" name="send_2fa_reset" value="1" />
    </form>

    <form method="POST" id="send_password_reset">
        {% csrf_token %}
        <input type="hidden" name="send_password_reset" value="1" />
    </form>

{% endblock %}

{% block footer %}
    {{ block.super }}

    {% if original.allow_impersonation != False %}
        <form method="POST" id="loginas-form" action="{% url 'loginas-user-login' object_id %}" style="display: none">
            {% csrf_token %}
            <input type="hidden" name="reason" id="loginas-reason-input" value="">
            <input type="hidden" name="read_only" id="loginas-read-only-input" value="true">
        </form>

        {% modal %}
        {% javascript %}
    {% endif %}
{% endblock %}