{{define "secrets.html"}}{{template "top" .}}
<h1>CI secrets — <a href="/{{.Repo}}">{{.Repo}}</a></h1>

{{if not .Enabled}}
<div class="flash err">Secrets are disabled — set <code>GITMOTE_CI_SECRET_KEY_V1</code> (base64 of 32 bytes) to enable encryption.</div>
{{end}}

{{if .Names}}
<table>
  <thead><tr><th>Name</th><th></th></tr></thead>
  <tbody>
  {{range .Names}}
    <tr>
      <td>{{.}}</td>
      <td>
        <form class="inline" method="post" action="/{{$.Repo}}/secrets/delete">
          <input type="hidden" name="name" value="{{.}}">
          <button type="submit">Delete</button>
        </form>
      </td>
    </tr>
  {{end}}
  </tbody>
</table>
{{else}}
<p>No secrets on {{.Repo}}.</p>
{{end}}

{{if .Enabled}}
<fieldset>
  <legend>Set secret on {{.Repo}}</legend>
  <p>Values are write-only — they are encrypted at rest and never shown again. Setting an existing name overwrites it.</p>
  <form method="post" action="/{{.Repo}}/secrets" autocomplete="off">
    <label>Name <input type="text" name="name" pattern="[A-Za-z_][A-Za-z0-9_]*" required></label>
    <label>Value <input type="password" name="value" autocomplete="new-password" required></label>
    <button type="submit">Save</button>
  </form>
</fieldset>
{{end}}
{{template "bottom" .}}{{end}}