{% extends "base.html" %}
{% import "_macros.html" as m %}
{% block title %}API tokens — rosbackup-ng{% endblock %}
{% block page_title %}Security · API tokens{% endblock %}
{% block content %}
<div class="card">
  <h2>Create token</h2>
  <p class="muted">Bearer tokens for the <span class="mono">/api/v1</span> automation API and the
    Prometheus <span class="mono">/metrics</span> scrape. A <strong>read-only</strong> token may
    only read (GET) and scrape metrics; a <strong>full</strong> token can also start runs and edit
    schedules. The token is shown once, in a pop-up, right after you generate it.</p>
  <form class="filters" hx-post="/ui/security/tokens" hx-target="#tokens-result" hx-swap="innerHTML">
    <input type="hidden" name="csrf_token" value="{{ request.state.session.csrf_token }}">
    <input type="text" name="name" placeholder="Token name (e.g. prometheus, ci-runner)" required>
    <select name="scope">
      <option value="full">Full access</option>
      <option value="readonly">Read-only</option>
    </select>
    <select name="expiry">
      <option value="never">No expiry</option>
      <option value="1d">Expires in 1 day</option>
      <option value="1w">Expires in 1 week</option>
      <option value="1mo">Expires in 1 month</option>
      <option value="3mo">Expires in 3 months</option>
      <option value="6mo">Expires in 6 months</option>
      <option value="1y">Expires in 1 year</option>
    </select>
    <button type="submit" class="btn primary">Generate token</button>
  </form>
</div>

<div class="card">
  <h2>Tokens</h2>
  <div id="tokens-result">
    {% include "_security_tokens_table.html" %}
  </div>
</div>
{% endblock %}