{% extends "layout.html" %}

{% block title %}ssh / gpg keys — kitgit{% endblock %}

{% block content %}
<section class="kg-section">
  <span class="kg-kicker">settings</span>
  <h1 class="kg-title">SSH &amp; GPG keys</h1>
  <nav class="kg-tabs" aria-label="Settings">
    <a href="/settings/profile">profile</a>
    <a href="/settings/account">account</a>
    <a href="/settings/mfa">mfa</a>
    <a href="/settings/keys" aria-current="page">ssh / gpg</a>
  </nav>
  {% if let Some(err) = error %}
    <div class="kg-flash">{{ err }}</div>
  {% endif %}

  <span class="kg-kicker" style="margin-top:1.5rem">SSH keys</span>
  <p class="kg-muted">Authentication keys let you push/pull over SSH. Signing keys verify signed commits on kitgit (Verified badge).</p>
  {% if !keys.is_empty() %}
    <ul class="kg-list">
      {% for key in keys %}
      <li class="kg-key-row">
        <span>
          <strong>{{ key.name }}</strong>
          <span class="kg-meta">{{ key.fingerprint }}</span>
          <span class="kg-badge">{{ key.usage_label() }}</span>
        </span>
        <span class="kg-key-row__actions">
          <form method="post" action="/settings/keys/{{ key.id }}/usage" class="kg-inline-form">
            <label class="kg-sr-only" for="usage-{{ key.id }}">usage</label>
            <select id="usage-{{ key.id }}" name="key_usage" onchange="this.form.submit()">
              <option value="authentication"{% if key.key_usage == "authentication" %} selected{% endif %}>Authentication</option>
              <option value="signing"{% if key.key_usage == "signing" %} selected{% endif %}>Signing</option>
              <option value="both"{% if key.key_usage == "both" %} selected{% endif %}>Authentication &amp; Signing</option>
            </select>
          </form>
          <form method="post" action="/settings/keys/{{ key.id }}/delete">
            <button class="kg-btn kg-btn--danger-ghost" type="submit">delete</button>
          </form>
        </span>
      </li>
      {% endfor %}
    </ul>
  {% else %}
    <p class="kg-muted">No SSH keys yet.</p>
  {% endif %}

  <h2 class="kg-title" style="margin-top:2rem">Add SSH key</h2>
  <form class="kg-form" method="post" action="/settings/keys">
    <label>
      name
      <input type="text" name="name" required />
    </label>
    <label>
      usage
      <select name="key_usage">
        <option value="authentication" selected>Authentication</option>
        <option value="signing">Signing</option>
        <option value="both">Authentication &amp; Signing</option>
      </select>
    </label>
    <label>
      public key
      <textarea name="public_key" rows="4" required placeholder="ssh-ed25519 AAAA…"></textarea>
    </label>
    <div class="kg-actions">
      <button class="kg-btn" type="submit">add</button>
    </div>
  </form>

  <div class="kg-signing-hint">
    <strong>Sign commits with SSH</strong>
    <p class="kg-muted" style="margin:0.35rem 0 0">Add the public key above with usage <em>Signing</em> or <em>Authentication &amp; Signing</em>, then configure git locally. Author email must match a verified email on your account.</p>
    <pre>git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true</pre>
  </div>

  <span class="kg-kicker" style="margin-top:2.5rem">GPG keys</span>
  <p class="kg-muted">Used for commit verification. Vigilant mode flags unsigned commits on your profile.</p>
  {% if !gpg_keys.is_empty() %}
    <ul class="kg-list">
      {% for key in gpg_keys %}
      <li>
        <span>
          <strong>{{ key.name }}</strong>
          <span class="kg-meta">{{ key.fingerprint }}</span>
        </span>
        <form method="post" action="/settings/gpg/{{ key.id }}/delete">
          <button class="kg-btn kg-btn--danger-ghost" type="submit">delete</button>
        </form>
      </li>
      {% endfor %}
    </ul>
  {% else %}
    <p class="kg-muted">No GPG keys yet.</p>
  {% endif %}

  <h2 class="kg-title" style="margin-top:2rem">Add GPG key</h2>
  <form class="kg-form" method="post" action="/settings/gpg">
    <label>
      name
      <input type="text" name="name" required value="gpg" />
    </label>
    <label>
      public key
      <textarea name="public_key" rows="6" required placeholder="-----BEGIN PGP PUBLIC KEY BLOCK-----"></textarea>
    </label>
    <div class="kg-actions">
      <button class="kg-btn" type="submit">add</button>
    </div>
  </form>

  <div class="kg-signing-hint">
    <strong>Sign commits with GPG</strong>
    <p class="kg-muted" style="margin:0.35rem 0 0">Paste your public key above, then point git at the key id. Author email must match a verified email on your account.</p>
    <pre>git config --global user.signingkey YOUR_KEY_ID
git config --global commit.gpgsign true</pre>
  </div>
</section>
{% endblock %}