{% extends "base.html" %}
{% block content %}
<div class="page-heading">
  <div><span class="eyebrow">Certificate operations</span><h1>Certificate inventory</h1><p>Manage this server's authority, certificate lifecycle, and trust relationships.</p></div>
  <span class="pill">One current CA per server</span>
</div>
<div class="grid stats-grid">
  <section class="card stat"><span class="stat-label">Local CA</span><span class="stat-icon">{{ icon('shield') }}</span><strong>{{ 1 if authority else 0 }} / 1</strong><span class="stat-caption"><span class="stat-indicator {{ 'warning' if block_reason or not authority else '' }}"></span>{{ 'Needs attention' if block_reason else ('Authority initialized' if authority else 'Ready to initialize') }}</span></section>
  <section class="card stat"><span class="stat-label">Certificates</span><span class="stat-icon">{{ icon('audit') }}</span><strong>{{ counts['total'] }}</strong><span class="stat-caption">End-entity certificates issued</span></section>
  <section class="card stat"><span class="stat-label">Expiring in 30 days</span><span class="stat-icon">{{ icon('lock') }}</span><strong>{{ counts['expiring'] }}</strong><span class="stat-caption"><span class="stat-indicator {{ 'warning' if counts['expiring'] else 'neutral' }}"></span>{{ 'Plan certificate renewals' if counts['expiring'] else 'No upcoming expirations' }}</span></section>
  <section class="card stat"><span class="stat-label">Revoked / expired</span><span class="stat-icon">{{ icon('grid') }}</span><strong>{{ counts['revoked'] }} / {{ counts['expired'] }}</strong><span class="stat-caption">Certificate lifecycle status</span></section>
</div>
{% include "ca_console.html" %}
{% if can_manage('admin', 'operator') and authority and authority['role'] == 'issuing' %}
<section class="card">
  <div class="section-heading"><div><h2>Issue certificate</h2><p>Signing authority: <strong>{{ authority['name'] }}</strong>. New certificates use this server's current CA.</p></div><span class="pill">End-entity issuance</span></div>
  <form method="post" action="{{ url_for('create_certificate') }}">
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
    <input type="hidden" name="authority_id" value="{{ authority['id'] }}">
    <div class="grid">
      <label>Certificate common name<input name="common_name" required maxlength="64" placeholder="service.corp.example"></label>
      <label>Profile<select name="profile"><option value="server">TLS server</option><option value="client">TLS client</option><option value="dual">TLS server and client</option></select></label>
    </div>
    <label>DNS names and IP addresses<textarea name="subject_alt_names" rows="2" placeholder="service.corp.example, 10.0.0.10"></textarea></label>
    <label>PEM certificate request (CSR)<textarea name="csr_pem" rows="5" placeholder="-----BEGIN CERTIFICATE REQUEST-----"></textarea></label>
    <p class="muted">Use a CSR to keep the certificate's private key on its destination system. Without a CSR, a software key is generated here. CA private keys can never be downloaded.</p>
    <label>Validity in days<input name="validity_days" type="number" min="1" max="{{ max_leaf_days }}" value="{{ [397, max_leaf_days]|min }}" required></label>
    <button type="submit" {% if not issuing_authorities %}disabled{% endif %}>Issue certificate</button>
  </form>
</section>
{% endif %}
<section class="card">
  <div class="section-heading"><div><h2>Issued certificates</h2><p>Search issued certificates, download artifacts, and manage revocation.</p></div><span class="pill">{{ total }} total</span></div>
  <div class="table-toolbar"><form method="get" class="compact" role="search">
    <input name="q" aria-label="Search certificates by common name" value="{{ query }}" placeholder="Search common name" maxlength="255">
    <button class="button-secondary" type="submit">Search</button>
  </form></div>
  {% if certificates %}
  <div class="table-scroll"><table>
    <thead><tr><th>Common name / SANs</th><th>Issuer / profile</th><th>Status / expires</th><th>Actions</th></tr></thead>
    <tbody>{% for certificate in certificates %}<tr>
      <td><span class="mono cell-title">{{ certificate['common_name'] }}</span><br><small class="mono">{{ certificate['subject_alt_names'] }}</small></td>
      <td>{{ certificate['authority_name'] }}<br><small>{{ certificate['profile'] }}</small></td>
      <td>
        {% if certificate['revoked_at'] %}<span class="pill status-revoked">Revoked</span>
        {% elif certificate['not_after'] <= now %}<span class="pill status-expired">Expired</span>
        {% elif certificate['authority_id'] not in active_authority_ids %}<span class="pill status-revoked">Issuer inactive</span>
        {% else %}<span class="pill status-active">Active</span>{% endif %}
        <br><small>{{ certificate['not_after'][:10] }}</small>
      </td>
      <td class="actions">
        <a href="{{ url_for('download_certificate', certificate_id=certificate['id'], artifact='cert') }}">Certificate</a>
        <a href="{{ url_for('download_certificate', certificate_id=certificate['id'], artifact='chain') }}">Chain</a>
        {% if key_download_enabled and certificate['private_key_pem'] %}<a href="{{ url_for('download_certificate', certificate_id=certificate['id'], artifact='key') }}">Key</a>{% endif %}
        {% if can_manage('admin', 'operator') and not certificate['revoked_at'] %}
        <details><summary>Revoke</summary>
          <form method="post" action="{{ url_for('revoke_certificate', certificate_id=certificate['id']) }}">
            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
            <label>Reason<select name="reason">{% for reason in revocation_reasons %}<option value="{{ reason }}">{{ reason|replace('_', ' ') }}</option>{% endfor %}</select></label>
            <p class="muted">Revocation cannot be undone.</p>
            <button class="danger" type="submit">Revoke certificate</button>
          </form>
        </details>{% endif %}
      </td>
    </tr>{% endfor %}</tbody>
  </table></div>
  {% else %}<div class="empty-state">{{ icon('audit') }}<h3>No matching certificates.</h3><p>{{ 'Try another common name to refine your search.' if query else 'Certificates issued by this server will appear here.' }}</p></div>{% endif %}
  <div class="pagination"><p>{{ total }} certificate(s). Page {{ page }}.</p><div class="actions">
    {% if page > 1 %}<a href="{{ url_for('index', q=query, page=page-1) }}">Previous</a>{% endif %}
    {% if page * 50 < total %}<a href="{{ url_for('index', q=query, page=page+1) }}">Next</a>{% endif %}
  </div></div>
</section>
{% endblock %}