{# settings/users.html — Settings › Users (#5336): every account, active ones
   first. A row opens the account's page. #}
{% extends "base.html" %}
{% from "_macros.html" import crumbs, page_header, status_badge %}
{% from "settings/_tabs.html" import settings_tabs %}
{% block title %}Settings — Users — Steward{% endblock %}
{% block section_tabs %}{{ settings_tabs("users") }}{% endblock %}
{% block breadcrumb %}{{ crumbs([("Settings", "/settings/"), ("Users", "")]) }}{% endblock %}
{% block content %}
{% call page_header("Users") %}<a href="/settings/users/new" class="btn">Add user</a>{% endcall %}

<p class="page-verdict">
  {{ users|length }} account{{ 's' if users|length != 1 }}
  · {{ admins }} active admin{{ 's' if admins != 1 }}
  {%- if disabled %} · <span class="tone-muted">{{ disabled }} disabled</span>{% endif %}
</p>

<div class="card-flush">
<table class="table">
  <thead><tr><th>User</th><th>Signs in with</th><th>Role</th><th>Emailed</th><th>Last sign-in</th><th class="num">AI tokens</th></tr></thead>
  <tbody>
  {% for u in users %}
  <tr class="row-link{% if not u.is_active %} row-off{% endif %}">
    <td class="cell-name">
      <a class="row-target" href="/settings/users/{{ u.id }}">{{ u.username }}</a>
      {%- if u.id == session.user_id %} <span class="tone-dim">(you)</span>{% endif %}
      <div class="cell-sub">{{ u.email }}</div>
    </td>
    <td>{{ sources.get(u.auth_source, u.auth_source) }}</td>
    <td>{{ u.role.value|capitalize }}{% if not u.is_active %} {{ status_badge("inactive", "Disabled") }}{% endif %}</td>
    <td>{% if u.id not in reachable %}<span class="tone-warn" title="{{ u.email }} isn't an address mail can reach">no address</span>
        {%- elif gets[u.id] %}{{ gets[u.id]|join(", ") }}{% else %}—{% endif %}</td>
    <td class="nowrap">{% if last.get(u.id) %}{{ last[u.id]|ago }}{% else %}—{% endif %}</td>
    <td class="num">{{ tokens.get(u.id, 0) or "—" }}</td>
  </tr>
  {% endfor %}
  </tbody>
</table>
</div>
<p class="field-hint">Accounts that sign in with LDAP or single sign-on are added at their first sign-in, with the role their provider's groups give them (Settings › <a href="/settings/auth/">Authentication</a>).</p>
{% endblock %}