{% extends "base.html" %}
{% block title %}Security settings · NEXXVU{% endblock %}
{% block content %}
<div class="page-heading"><div><p class="eyebrow">Settings</p><h1>Security</h1><p class="muted">Change your password and control which network addresses may reach this Portal.</p></div><a class="button button-secondary button-compact" href="/settings">All settings</a></div>
<div class="settings-workspace">
  {% include "_settings_navigation.html" %}
  <section class="settings-main" aria-labelledby="password-settings-title">
    <h2 id="password-settings-title">Change password</h2>
    <p class="field-help">Changing your password signs out every other session of your account.</p>
    {% if password_saved %}<div class="alert alert-success" role="status">Password changed. Other sessions were signed out.</div>{% endif %}
    {% if password_error %}<div class="alert alert-danger" role="alert">{{ password_error }}</div>{% endif %}
    <form class="panel settings-form form-stack" method="post" action="/settings/security/password">
      <input type="hidden" name="csrf_token" value="{{ session.csrf_token }}">
      <label class="field"><span>Current password</span><input type="password" name="current_password" required maxlength="256" autocomplete="current-password"></label>
      <label class="field"><span>New password</span><input type="password" name="new_password" required minlength="{{ minimum_length }}" maxlength="256" autocomplete="new-password" aria-describedby="new-password-help"></label>
      <p class="field-help" id="new-password-help">Use at least {{ minimum_length }} characters. Combine uppercase and lowercase letters, numbers and symbols.</p>
      <label class="field"><span>Confirm new password</span><input type="password" name="confirmation" required maxlength="256" autocomplete="new-password"></label>
      <div class="form-actions"><button class="button button-primary" type="submit">Change password</button></div>
    </form>

    <h2 id="allowlist-settings-title">Login IP allowlist</h2>
    <p class="field-help">Only these addresses may reach the sign-in page, setup and every signed-in page. Leave the list empty to allow all addresses. Enter one IPv4 or IPv6 address or CIDR range per line, up to {{ allowlist_maximum }} entries.</p>
    <p class="field-help">Your current address: <strong>{{ client_address or "unknown" }}</strong>. A list that excludes it cannot be saved. If you are locked out, a host administrator can run <code>nexxvu-portal recovery clear-allowlist</code> on the server.</p>
    {% if allowlist_saved %}<div class="alert alert-success" role="status">Login IP allowlist saved.</div>{% endif %}
    {% if allowlist_error %}<div class="alert alert-danger" role="alert">{{ allowlist_error }}</div>{% endif %}
    <form class="panel settings-form form-stack" method="post" action="/settings/security/allowlist">
      <input type="hidden" name="csrf_token" value="{{ session.csrf_token }}">
      <label class="field"><span>Allowed addresses</span><textarea name="login_allowlist" rows="6" spellcheck="false" autocomplete="off">{{ allowlist_text }}</textarea></label>
      <div class="form-actions"><button class="button button-primary" type="submit">Save allowlist</button><a class="button button-secondary" href="/settings">Cancel</a></div>
    </form>
  </section>
</div>
{% endblock %}