{% extends "base.html" %}
{% block title %}Session details — {{ site_name }}{% endblock %}
{% block content %}
  <p class="muted" style="margin:0 0 0.5rem;">
    <a href="{% url 'core:app_home' %}">← Spaces</a>
  </p>
  <h1>Session details</h1>
  <p class="muted">
    Identity and authorization diagnostics for refining user, group, role,
    and tenant management. No secrets are shown.
  </p>

  <div class="card">
    <h2 style="margin-top:0;">Identity</h2>
    <dl>
      <dt>Display name</dt><dd>{{ principal.display_name }}</dd>
      <dt>Username</dt><dd>{{ principal.username }}</dd>
      <dt>Email</dt><dd>{{ principal.email|default:"—" }}</dd>
      <dt>Issuer</dt><dd>{{ principal.issuer|default:"—" }}</dd>
      <dt>Subject</dt><dd>{{ principal.subject|default:"—" }}</dd>
      <dt>Principal type</dt><dd>{{ principal.principal_type }}</dd>
    </dl>
  </div>

  <div class="card">
    <h2 style="margin-top:0;">Platform user</h2>
    <dl>
      <dt>user-engine id</dt><dd>{{ principal.user_engine_user_id|default:"—" }}</dd>
      <dt>user-engine source</dt><dd>{{ principal.user_engine_source|default:"—" }}</dd>
    </dl>
  </div>

  <div class="card">
    <h2 style="margin-top:0;">Tenancy, roles &amp; groups</h2>
    <dl>
      <dt>Tenant</dt><dd>{{ principal.tenant_id|default:"—" }}</dd>
      <dt>Roles</dt><dd>{{ principal.roles_display }}</dd>
      <dt>Groups</dt><dd>{{ principal.groups_display }}</dd>
      <dt>Assurance</dt><dd>{{ principal.assurance_display }}</dd>
    </dl>
  </div>

  <div class="card">
    <h2 style="margin-top:0;">Authenticator app</h2>
    <p>
      <a href="https://pink-account.coulomb.social/" rel="noopener noreferrer">Manage authenticator app (optional)</a>
    </p>
    <p class="muted">
      Help for optional setup is on the
      <a href="https://users.coulomb.social/security" rel="noopener noreferrer">NetKingdom security page</a>.
    </p>
  </div>

  <div class="card">
    <h2 style="margin-top:0;">Authorization</h2>
    <dl>
      <dt>Shell check</dt>
      <dd>{% if principal.authz_allow %}allow{% else %}deny{% endif %}</dd>
      <dt>Reason</dt><dd>{{ principal.authz_reason }}</dd>
      <dt>Decision id</dt><dd>{{ principal.authz_decision_id }}</dd>
    </dl>
  </div>
{% endblock %}