{% macro panel(base, s, csrf, what) %}
<section class="panel" id="secrets">
  <h2>Secrets</h2>
  <p class="small mute">{{ what }} A job gets only the secrets its pipeline declares, as <code>secret "name" { mount-path "/run/secrets/name" }</code>, written there as a file before it starts; never in the environment, and masked in its log. Values are kept sealed and never shown again.</p>
  {% if !s.inherited.is_empty() %}
  <h3>Inherited</h3>
  <div class="table"><table>
  <tr><th>Name</th><th>Set</th><th>From</th></tr>
  {% for i in s.inherited %}<tr{% if i.overridden %} class="mute"{% endif %}><td><code>{{ i.secret.name }}</code></td><td class="small">{{ i.secret.updated_ms|ago_i }}</td><td class="small">{{ i.from }}{% if i.overridden %} · <span title="A level below sets the same name">overridden</span>{% endif %}</td></tr>{% endfor %}
  </table></div>
  {% endif %}
  {% if s.own.is_empty() %}<p class="mute small">{% if s.inherited.is_empty() %}None.{% else %}None of its own.{% endif %}</p>{% else %}
  <div class="table"><table>
  <tr><th>Name</th><th>Set</th><th></th></tr>
  {% for o in s.own %}<tr><td><code>{{ o.secret.name }}</code></td><td class="small">{{ o.secret.updated_ms|ago_i }}</td>
  <td><form class="tiny" method="post" action="{{ base }}/secrets"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="name" value="{{ o.secret.name }}"><button name="action" value="delete" class="danger-btn">remove</button></form></td></tr>{% endfor %}
  </table></div>{% endif %}
  <form class="card" method="post" action="{{ base }}/secrets">
    <input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="set">
    <h3>Set a secret</h3>
    <label for="sname">Name</label><input type="text" id="sname" name="name" placeholder="deploy-token" required autocomplete="off">
    <label for="svalue">Value</label><textarea id="svalue" name="value" rows="2" autocomplete="off"></textarea>
    <p class="small mute">An existing name takes the new value; a name set above is overridden here.</p>
    <button type="submit">SET</button>
  </form>
</section>
{% endmacro %}