{% macro panel(base, s, csrf, what) %}

<section class="panel" id="secrets">

  <h2>Secrets</h2>

  <p class="small mute">{{ what }} A job gets only the secrets its pipeline declares, as <code>secret "name" { mount-path "/run/secrets/name" }</code>, written there as a file before it starts; never in the environment, and masked in its log. Values are kept sealed and never shown again.</p>

  {% if !s.inherited.is_empty() %}

  <h3>Inherited</h3>

  <div class="table"><table>

  <tr><th>Name</th><th>Set</th><th>From</th></tr>

  {% for i in s.inherited %}<tr{% if i.overridden %} class="mute"{% endif %}><td><code>{{ i.secret.name }}</code></td><td class="small">{{ i.secret.updated_ms|ago_i }}</td><td class="small">{{ i.from }}{% if i.overridden %} · <span title="A level below sets the same name">overridden</span>{% endif %}</td></tr>{% endfor %}

  </table></div>

  {% endif %}

  {% if s.own.is_empty() %}<p class="mute small">{% if s.inherited.is_empty() %}None.{% else %}None of its own.{% endif %}</p>{% else %}

  <div class="table"><table>

  <tr><th>Name</th><th>Set</th><th></th></tr>

  {% for o in s.own %}<tr><td><code>{{ o.secret.name }}</code></td><td class="small">{{ o.secret.updated_ms|ago_i }}</td>

  <td><form class="tiny" method="post" action="{{ base }}/secrets"><input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="name" value="{{ o.secret.name }}"><button name="action" value="delete" class="danger-btn">remove</button></form></td></tr>{% endfor %}

  </table></div>{% endif %}

  <form class="card" method="post" action="{{ base }}/secrets">

    <input type="hidden" name="_csrf" value="{{ csrf }}"><input type="hidden" name="action" value="set">

    <h3>Set a secret</h3>

    <label for="sname">Name</label><input type="text" id="sname" name="name" placeholder="deploy-token" required autocomplete="off">

    <label for="svalue">Value</label><textarea id="svalue" name="value" rows="2" autocomplete="off"></textarea>

    <p class="small mute">An existing name takes the new value; a name set above is overridden here.</p>

    <button type="submit">SET</button>

  </form>

</section>

{% endmacro %}