{% extends "base.html" %}
{% block content %}
<a class="back-link" href="{{ url_for('index') }}">← Back to dashboard</a>
<div class="page-heading"><div><span class="eyebrow">Authority details</span><h1>{{ authority['name'] }}</h1><p>This server's certificate authority and public trust artifacts.</p></div><span class="pill pill-dot {{ 'status-active' if active else 'status-revoked' }}">{{ 'Active' if active else 'Inactive' }}</span></div>
<section class="card">
  <div class="section-heading"><h2>Authority identity</h2><span class="pill">{{ authority['role'] }}</span></div>
  {% if authority['revoked_at'] %}<p>Revoked {{ authority['revoked_at'] }}: {{ authority['revocation_reason']|replace('_', ' ') }}</p><p>This CA is archived. Its certificates, revocation data and audit history are retained. <a href="{{ url_for('index') }}">Manage or initialize the current CA</a>.</p>{% endif %}
  {% if block_reason %}<p class="notice notice-warning">{{ block_reason }}</p>{% endif %}
  <p>This local CA's private key is not available for download.</p>
  <div class="table-scroll"><table class="detail-table">
    <tbody>
      <tr><th>Subject</th><td class="mono">{{ authority['common_name'] }}</td></tr>
      <tr><th>Serial</th><td class="mono">{{ authority['serial_number'] }}</td></tr>
      <tr><th>Parent</th><td>{{ 'Self-signed root' if authority['role'] == 'root' else 'External parent (public chain only)' }}</td></tr>
      <tr><th>Valid from</th><td>{{ authority['not_before'] }}</td></tr>
      <tr><th>Valid to</th><td>{{ authority['not_after'] }}</td></tr>
      <tr>
        <th>Downloads</th>
        <td class="actions">
          {% if authority['state'] == 'active' %}
          <a href="{{ url_for('download_authority', authority_id=authority['id'], artifact='cert') }}">certificate</a>
          <a href="{{ url_for('download_authority', authority_id=authority['id'], artifact='chain') }}">full chain</a>
          <a href="{{ url_for('download_crl', authority_id=authority['id']) }}">revocation list (CRL)</a>
          {% else %}<a href="{{ url_for('download_authority', authority_id=authority['id'], artifact='csr') }}">CSR</a>{% endif %}
        </td>
      </tr>
    </tbody>
  </table></div>
  {% if can_manage('admin') and not authority['revoked_at'] %}
  <details><summary>Revoke this authority</summary>
    <p>Disabling this local CA stops its issuance. Request revocation on its parent server and distribute the updated CRL. This cannot be undone.</p>
    <p>After revocation, you can initialize a new CA on this server. This CA and its history remain archived.</p>
    {% if authority['role'] != 'root' %}<p>The external parent must revoke this CA certificate; disabling this server cannot update a remote CRL.</p>{% else %}<p>This root must also be removed from relying-party trust stores. Disabling it here cannot revoke external trust.</p>{% endif %}
    <form method="post" action="{{ url_for('revoke_authority', authority_id=authority['id']) }}">
      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
      <label>Reason<select name="reason">{% for reason in revocation_reasons %}<option value="{{ reason }}">{{ reason|replace('_', ' ') }}</option>{% endfor %}</select></label>
      <button type="submit" class="danger">Revoke authority</button>
    </form>
  </details>
  {% endif %}
</section>

<div class="grid" style="margin-top:1rem;">
  <section class="card">
    <h3>Subordinate certificates (remote CAs)</h3>
    {% if child_authorities %}
      <ul class="detail-list">
        {% for child in child_authorities %}
          <li><a href="{{ url_for('download_subordinate', subordinate_id=child['id'], artifact='cert') }}">{{ child['common_name'] }}</a> · {{ child['role'] }}</li>
        {% endfor %}
      </ul>
    {% else %}
      <p class="muted">No subordinate CAs yet.</p>
    {% endif %}
  </section>
  <section class="card">
    <h3>Issued certificates</h3>
    {% if issued_certificates %}
      <ul>
        {% for certificate in issued_certificates %}
          <li>
            <span class="mono">{{ certificate['common_name'] }}</span>
            · <a href="{{ url_for('download_certificate', certificate_id=certificate['id'], artifact='chain') }}">download chain</a>
          </li>
        {% endfor %}
      </ul>
    {% else %}
      <p class="muted">No certificates issued from this authority yet.</p>
    {% endif %}
  </section>
</div>
{% if can_manage('admin') and authority['revoked_at'] %}
<section class="card" id="delete-authority" style="margin-top:1rem;">
  <div class="section-heading"><div><span class="eyebrow">Permanent deletion</span><h2>Delete revoked authority</h2></div></div>
  <p class="notice notice-danger">This permanently deletes <strong>{{ authority['name'] }}</strong> and its associated data from this installation. This cannot be undone.</p>
  <ul>
    <li>{{ deletion_counts['certificates'] }} issued end-entity certificates and their locally stored private keys</li>
    <li>{{ deletion_counts['issued_authorities'] }} issued subordinate CA certificates</li>
    <li>{{ deletion_counts['ca_requests'] }} CA signing requests</li>
    <li>The CA certificate, CSR, imported chains and parent CRLs, local signing key, and generated CRLs</li>
    <li>Archived provider credentials and publication settings for this CA</li>
  </ul>
  <p>The CA's local certificate and CRL download URLs will stop working. Its display name becomes available for a new CA. Audit records remain.</p>
  <p>Keys managed by PKCS#11 (including SoftHSM) or Azure Key Vault and files already uploaded to a publication server are not deleted automatically.</p>
  <form method="post" action="{{ url_for('delete_authority', authority_id=authority['id']) }}">
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
    <label>Type the CA display name to confirm: <strong>{{ authority['name'] }}</strong><input name="confirmation_name" required maxlength="100" autocomplete="off" spellcheck="false"></label>
    <button type="submit" class="danger">Permanently delete CA and associated data</button>
  </form>
</section>
{% endif %}
{% endblock %}