{{template "header" .}}
<div class="admin">
  <p class="kicker">Super user</p>
  <h1>Admin</h1>
  <p class="lead">Payments, license keys, and site storage. Members and site managers never see this page. Owner credentials are not printed on login.</p>
  {{if .Error}}<div class="alert">{{.Error}}</div>{{end}}
  {{if .OK}}<div class="ok">{{.OK}}</div>{{end}}

  <section class="admin-card" style="margin:18px 0">
    <h2>Update this app</h2>
    <p class="meta">Now running <b>v{{.Version}}</b>. Cinema: upload a Cinema zip. On-demand / Web: upload the <b>ondemand update</b> zip. Templates, static files, VERSION, and the binary are replaced. Data and your S3 keys stay. The process then restarts.</p>
    <form method="post" action="/admin/update" enctype="multipart/form-data">
      <label>Zip file</label>
      <input type="file" name="zip" accept=".zip">
      <label>Or https URL to a zip</label>
      <input type="url" name="url" placeholder="https://…/deimos-ondemand-1.4.96-update.zip">
      <div class="admin-actions">
        <button class="btn btn-green" type="submit">Install zip & restart</button>
      </div>
    </form>
  </section>

  <section class="admin-card" style="margin:18px 0">
    <h2>Default look</h2>
    <p class="meta">Visitors start on this accent. They can still pick another under Theme. Cinema TVs (cookies often blocked) stay on this until they tap a swatch.</p>
    <form method="post" action="/admin/look">
      <div class="theme-row" style="margin:12px 0">
        <label class="swatch void" title="Green"><input type="radio" name="theme" value="void" {{if eq .SiteTheme "void"}}checked{{end}}></label>
        <label class="swatch sky" title="Sky"><input type="radio" name="theme" value="sky" {{if eq .SiteTheme "sky"}}checked{{end}}></label>
        <label class="swatch violet" title="Violet"><input type="radio" name="theme" value="violet" {{if eq .SiteTheme "violet"}}checked{{end}}></label>
        <label class="swatch amber" title="Amber"><input type="radio" name="theme" value="amber" {{if eq .SiteTheme "amber"}}checked{{end}}></label>
        <label class="swatch rose" title="Rose"><input type="radio" name="theme" value="rose" {{if eq .SiteTheme "rose"}}checked{{end}}></label>
        <label class="swatch aqua" title="Aqua"><input type="radio" name="theme" value="aqua" {{if eq .SiteTheme "aqua"}}checked{{end}}></label>
      </div>
      <div class="admin-actions">
        <button class="btn btn-green" type="submit">Save default look</button>
      </div>
    </form>
  </section>

  <section class="admin-card" style="margin:18px 0">
    <h2>Blender open movies</h2>
    <p class="meta">Adds Blender Studio CC BY films (YouTube embeds). Trailers go in the Trailers category — they are not played before other titles.</p>
    <form method="post" action="/admin/trailers">
      <div class="admin-actions">
        <button class="btn btn-green" type="submit">Load / refresh catalog</button>
      </div>
    </form>
  </section>
  <div class="stat-grid">
    <div class="stat"><b>{{.Stats.Videos}}</b><span>Videos</span></div>
    <div class="stat"><b>{{.Stats.Users}}</b><span>Accounts</span></div>
    <div class="stat"><b>{{.Stats.Live}}</b><span>Live channels</span></div>
    <div class="stat"><b>{{.Stats.Shows}}</b><span>Slideshows</span></div>
    <div class="stat"><b>{{.Stats.Store}}</b><span>Storage</span></div>
    <div class="stat"><b>{{.Stats.Pending}}</b><span>Pending</span></div>
    <div class="stat"><b>{{if .License.Pro}}Pro{{else}}Free{{end}}</b><span>This instance</span></div>
  </div>
  <div class="stat-grid">
    <div class="stat glow"><b>{{.Traffic.HitsDisp}}</b><span>Hits 24h</span></div>
    <div class="stat"><b>{{.Traffic.Humans}}</b><span>People</span></div>
    <div class="stat"><b>{{.Traffic.Bots}}</b><span>Crawlers</span></div>
    <div class="stat"><b>{{.Traffic.Unique}}</b><span>Unique</span></div>
    <div class="stat"><b>{{.Traffic.AvgDisp}}</b><span>Avg response</span></div>
    <div class="stat"><b>{{.Traffic.P95Disp}}</b><span>p95</span></div>
    <div class="stat"><b>{{.Traffic.Errors}}</b><span>HTTP 4xx/5xx</span></div>
    <div class="stat glow"><b>{{.SEO.Score}}</b><span>SEO score</span></div>
    <div class="stat"><b>{{.Vitals.LCP.Disp}}</b><span>LCP p75</span></div>
    <div class="stat"><b>{{.Vitals.INP.Disp}}</b><span>INP p75</span></div>
    <div class="stat"><b>{{.Vitals.CLS.Disp}}</b><span>CLS p75</span></div>
  </div>
  <p><a class="btn btn-green" href="/admin/analytics">Open SEO & performance</a>
     <a class="btn btn-outline" href="/sitemap.xml" target="_blank" rel="noreferrer">Sitemap</a>
     <a class="btn btn-outline" href="/robots.txt" target="_blank" rel="noreferrer">robots.txt</a></p>

  <div class="admin-grid">
    <section class="admin-card">
      <h2>Issue license keys</h2>
      <p class="meta">Capped so this cannot be abused: <b>10 keys per click</b>, <b>25 per 24 hours</b> (override with MINT_DAILY_CAP). TV buyers mint themselves — one key per TV object, max 3 TVs per avatar.</p>
      <form method="post" action="/admin/keys">
        <label>Customer email (or a label for a batch)</label>
        <input type="text" name="customer" required placeholder="buyer@studio.tld">
        <label>Plan</label>
        <select name="plan" id="key-plan">
          <option value="pro">Pro shop yearly — expiry</option>
          <option value="standard">Standard TV — 2999 L$ · 1 year</option>
          <option value="premium">Premium TV — 4999 L$ · 3 years</option>
          <option value="lifetime">Ultimate TV / Unlimited — never expires</option>
        </select>
        <label>Pro expiry date</label>
        <input type="date" name="expires" id="key-exp">
        <p class="meta">Ignored for Unlimited / Ultimate. Standard defaults +1 year, Premium +3 years.</p>
        <label>Internal note</label>
        <input type="text" name="note" placeholder="Stripe #, Coinbase, TV object UUID…">
        <label>How many keys</label>
        <input type="number" name="qty" value="1" min="1" max="10" step="1">
        <div class="admin-actions">
          <button class="btn btn-green" type="submit" name="download" value="1">Generate & download</button>
          <button class="btn btn-outline" type="submit">Save on this server</button>
        </div>
      </form>
      <script>
      (function(){
        var p=document.getElementById('key-plan'), e=document.getElementById('key-exp');
        function t(){ if(e) e.disabled = p && (p.value==='lifetime' || p.value==='ultimate'); }
        if(p) p.addEventListener('change', t); t();
      })();
      </script>
    </section>

    <section class="admin-card">
      <h2>This instance</h2>
      <p class="meta">{{.License.Reason}}</p>
      <p><a class="btn btn-outline" href="/license">Activate a key here</a>
         <a class="btn btn-outline" href="/storage">Storage</a>
         <a class="btn btn-outline" href="/guide">Guide</a></p>
      <h3>Owner-only routes</h3>
      <p class="meta">Anyone else (demo, Pro, register) is sent to sign-in or home. Webhooks stay public so Stripe / PayPal / Coinbase can POST.</p>
      <table class="admin-table">
        <thead><tr><th>Path</th><th>What it does</th></tr></thead>
        <tbody>
          <tr><td><code>/admin</code></td><td>This dashboard</td></tr>
          <tr><td><code>/admin/keys</code></td><td>Mint Pro / Unlimited keys</td></tr>
          <tr><td><code>/admin/keys/file</code></td><td>Download a .key file</td></tr>
          <tr><td><code>/admin/revoke</code></td><td>Cancel a key (refund / abuse)</td></tr>
          <tr><td><code>/admin/delete</code></td><td>Remove a library title</td></tr>
          <tr><td><code>/admin/pay</code></td><td>Save Stripe, PayPal + Coinbase secrets</td></tr>
          <tr><td><code>/admin/stripe-check</code></td><td>Run Stripe health check</td></tr>
          <tr><td><code>/storage</code></td><td>Local / S3 / Storj site storage</td></tr>
        </tbody>
      </table>
      <h3>Accounts</h3>
      <table class="admin-table">
        <thead><tr><th>User</th><th>Name</th><th>Role</th></tr></thead>
        <tbody>
        {{range .Users}}
          <tr><td>{{.Username}}</td><td>{{.Name}}</td><td>{{if eq .Role "super"}}super{{else if eq .Role "admin"}}manager{{else}}member{{end}}</td></tr>
        {{end}}
        </tbody>
      </table>
    </section>
  </div>

  <section class="admin-card" id="stripe">
    <h2>Stripe & payments</h2>
    <p class="meta">Paste your Stripe <b>secret key</b>. The app then opens Stripe Checkout for cards, Apple Pay, Google Pay, Link, and other fiat methods Stripe enables. Payment Links are only a fallback.</p>
    {{if .Health.Checked}}
      {{if .Health.OK}}
        <div class="ok">Stripe daily check {{.Health.Checked}}: platform {{.Health.Platform}} · account {{.Health.Account}}{{if .Health.LiveMode}} (live){{end}}</div>
      {{else}}
        <div class="alert">Stripe daily check {{.Health.Checked}}: {{.Health.Platform}} · {{.Health.Account}}{{if .Health.Error}} — {{.Health.Error}}{{end}}</div>
      {{end}}
      <p class="meta"><a class="btn btn-outline" href="/admin/stripe-check">Check Stripe now</a> Runs automatically once a day.</p>
    {{else}}
      <p class="meta">Daily Stripe check starts with the app. <a href="/admin/stripe-check">Run now</a></p>
    {{end}}
    <ol class="meta" style="line-height:1.6">
      <li>Open <a href="https://dashboard.stripe.com/payment-links" target="_blank" rel="noreferrer">Stripe → Payment links</a></li>
      <li>New link: <b>Deimos Pro monthly</b> — $7 / month, <b>recurring</b>.</li>
      <li>New link: <b>Deimos Pro yearly</b> — $49 / year, <b>recurring</b>.</li>
      <li>New link: <b>Deimos Lifetime</b> — $129 once (not recurring).</li>
      <li>Copy each <code>https://buy.stripe.com/…</code> URL into the boxes and save.</li>
    </ol>
    <form method="post" action="/admin/pay">
      <label>Stripe Payment Link — Pro $7/month (subscription)</label>
      <input type="url" name="stripe_month" value="{{.Pay.StripeMonth}}" placeholder="https://buy.stripe.com/…">
      <label>Stripe Payment Link — Pro $49/year (subscription)</label>
      <input type="url" name="stripe_pro" value="{{.Pay.StripePro}}" placeholder="https://buy.stripe.com/…">
      <label>Stripe Payment Link — Lifetime $129</label>
      <input type="url" name="stripe_life" value="{{.Pay.StripeLife}}" placeholder="https://buy.stripe.com/…">
      <label>Publishable key (optional, pk_live_…)</label>
      <input type="text" name="publishable" value="{{.Pay.Publishable}}" placeholder="pk_live_… or leave blank">
      {{if .Pay.MaskedSecret}}<p class="meta">Secret key on file: {{.Pay.MaskedSecret}}</p>{{end}}
      <label>Secret key (sk_live_… — this turns on hosted Stripe Checkout)</label>
      <input type="password" name="secret" placeholder="sk_live_… leave blank to keep current" autocomplete="off">
      <label class="meta"><input type="checkbox" name="clear_secret" value="1"> Remove saved Stripe secret</label>
      {{if .Pay.MaskedWhsec}}<p class="meta">Webhook secret on file: {{.Pay.MaskedWhsec}}</p>{{end}}
      <label>Stripe webhook signing secret (optional, whsec_…)</label>
      <input type="password" name="stripe_whsec" placeholder="whsec_… leave blank to keep current" autocomplete="off">
      <p class="meta">In Stripe Payment Link → After completion → Redirect to <code>https://YOUR-DOMAIN/pay/thanks?session_id={CHECKOUT_SESSION_ID}</code>
      · Webhook URL: <code>https://YOUR-DOMAIN/pay/stripe</code> events <code>checkout.session.completed</code>, <code>invoice.paid</code>, <code>customer.subscription.deleted</code>.
      Renewal mints a fresh key (32 days for monthly, 1 year for yearly). Cancelled subs revoke the Pro key. Add metadata <code>email</code> on the Stripe product if you want cancel to match the buyer.</p>

      <h3>Coinbase Commerce (crypto)</h3>
      <p class="meta">Best path: paste the <b>Commerce API key</b>. Pay with Coinbase then creates a live charge (BTC, ETH, USDC, …) and sends the buyer back here. Static checkout URLs still work as a fallback.</p>
      {{if .Pay.CoinbaseReady}}
        <div class="ok">Coinbase checkout is on. Test: <a href="/pay?sku=coinbase">Open crypto checkout</a></div>
      {{else}}
        <div class="alert">No Coinbase checkout yet — crypto pay is off until you paste a link.</div>
      {{end}}
      <ol class="meta" style="line-height:1.6">
        <li>Open <a href="https://commerce.coinbase.com/" target="_blank" rel="noreferrer">commerce.coinbase.com</a> and sign in.</li>
        <li>Checkouts → New checkout: <b>Deimos Pro</b> $49.</li>
        <li>Another checkout: <b>Deimos Lifetime</b> $129.</li>
        <li>Copy each <code>https://commerce.coinbase.com/checkout/…</code> URL.</li>
      </ol>
      <label>Coinbase checkout — Pro $49</label>
      <input type="url" name="coinbase_pro" value="{{.Pay.CoinbasePro}}" placeholder="https://commerce.coinbase.com/checkout/…">
      <label>Coinbase checkout — Lifetime $129</label>
      <input type="url" name="coinbase_life" value="{{.Pay.CoinbaseLife}}" placeholder="https://commerce.coinbase.com/checkout/…">
      {{if .Pay.MaskedCoinbase}}<p class="meta">Commerce API key on file: {{.Pay.MaskedCoinbase}}</p>{{end}}
      <label>Commerce API key (required to auto-mint after crypto pay)</label>
      <input type="password" name="coinbase_api" placeholder="leave blank to keep current" autocomplete="off">
      {{if .Pay.MaskedCBHook}}<p class="meta">Webhook shared secret on file: {{.Pay.MaskedCBHook}}</p>{{end}}
      <label>Webhook shared secret (Settings → Show shared secret)</label>
      <input type="password" name="coinbase_whsec" placeholder="leave blank to keep current" autocomplete="off">
      <p class="meta">Webhook URL: <code>https://YOUR-DOMAIN/pay/coinbase</code> · events <code>charge:confirmed</code>, <code>charge:resolved</code>. After pay, Coinbase should return to <code>/pay/thanks?charge=CODE</code> (set as the charge redirect; API charges already do this).</p>
      <label class="meta"><input type="checkbox" name="clear_coinbase_api" value="1"> Remove saved Coinbase API key</label>
      <label>Bitcoin / Lightning URL (optional extra)</label>
      <input type="url" name="btc" value="{{.Pay.BTC}}" placeholder="https://btcpay.yourdomain/…">
      <label>Other crypto URL (optional extra)</label>
      <input type="url" name="crypto" value="{{.Pay.Crypto}}" placeholder="https://…">

      <h3>PayPal</h3>
      <p class="meta">Use the PayPal account you already have. Paste the <b>REST Client ID</b> and <b>Secret</b> from a Live app. Checkout then opens PayPal (balance, cards PayPal has on file). After pay, the key is minted on the thanks page — same as Stripe.</p>
      {{if .Pay.PayPalReady}}
        <div class="ok">PayPal checkout is on. Test: <a href="/pay?sku=paypal">$49/year</a> · <a href="/pay?sku=paypal-month">$7/mo</a> · <a href="/pay?sku=paypal-life">Lifetime $129</a></div>
      {{else}}
        <div class="alert">No PayPal yet — paste Client ID and Secret below.</div>
      {{end}}
      <ol class="meta" style="line-height:1.6">
        <li>Open <a href="https://developer.paypal.com/dashboard/applications/live" target="_blank" rel="noreferrer">developer.paypal.com → Apps & Credentials → Live</a></li>
        <li>Create app named <b>Deimos.TV</b> (or use an existing one). Leave it on Live.</li>
        <li>Copy <b>Client ID</b> and <b>Secret</b> into the boxes. Save.</li>
        <li>Optional webhook: <code>https://YOUR-DOMAIN/pay/paypal</code> · event <code>PAYMENT.CAPTURE.COMPLETED</code>. Return URL is set automatically.</li>
      </ol>
      <label>PayPal Client ID</label>
      <input type="text" name="paypal_client" value="{{.Pay.PayPalClient}}" placeholder="AYxxxxxxxx…" autocomplete="off">
      {{if .Pay.MaskedPayPal}}<p class="meta">Secret on file: {{.Pay.MaskedPayPal}}</p>{{end}}
      <label>PayPal Secret</label>
      <input type="password" name="paypal_secret" placeholder="leave blank to keep current" autocomplete="off">
      <label>PayPal webhook ID (optional, verifies inbound hooks)</label>
      <input type="text" name="paypal_webhook_id" value="{{.Pay.PayPalHookID}}" placeholder="0EX12345AB1234567" autocomplete="off">
      <p class="meta">From the Live webhook you create at developer.paypal.com. Without it, keys still mint only after PayPal confirms the capture over HTTPS.</p>
      <label class="meta"><input type="checkbox" name="paypal_sandbox" value="1" {{if .Pay.PayPalSandbox}}checked{{end}}> Use PayPal sandbox (testing only — buyers will not be charged)</label>
      <label class="meta"><input type="checkbox" name="clear_paypal_secret" value="1"> Remove saved PayPal secret</label>
      <p class="meta">Fallback hosted buttons (optional). Only used if the API credentials are missing.</p>
      <label>PayPal button — $7/month</label>
      <input type="url" name="paypal_month" value="{{.Pay.PayPalMonth}}" placeholder="https://www.paypal.com/ncp/payment/…">
      <label>PayPal button — $49/year</label>
      <input type="url" name="paypal_pro" value="{{.Pay.PayPalPro}}" placeholder="https://www.paypal.com/ncp/payment/…">
      <label>PayPal button — Lifetime $129</label>
      <input type="url" name="paypal_life" value="{{.Pay.PayPalLife}}" placeholder="https://www.paypal.com/ncp/payment/…">
      <p class="meta">Monthly is a $7 PayPal checkout that mints 32 days. Yearly mints 1 year. Lifetime never expires. Buy again to renew. Return URL: <code>/pay/paypal/return</code>.</p>

      <div class="admin-actions">
        <button class="btn btn-green" type="submit">Save payment settings</button>
      </div>
    </form>
  </section>

  <section class="admin-card">
    <h2>Issued keys</h2>
    {{if .Keys}}
    <table class="admin-table">
      <thead><tr><th>Customer</th><th>Plan</th><th>Expires</th><th>File</th></tr></thead>
      <tbody>
      {{range .Keys}}
        <tr>
          <td>{{.Customer}}{{if .Note}}<div class="meta">{{.Note}}</div>{{end}}{{if .Revoked}}<div class="alert" style="margin:6px 0 0">Cancelled: {{.Reason}}</div>{{end}}</td>
          <td>{{.Plan}}</td>
          <td>{{if .Expires}}{{.Expires}}{{else}}lifetime{{end}}</td>
          <td>
            {{if not .Revoked}}
              <a class="btn btn-outline" href="/admin/keys/file?id={{.ID}}">Download</a>
              <form method="post" action="/admin/revoke" style="display:inline" onsubmit="return confirm('Cancel this key? The buyer loses Pro.')">
                <input type="hidden" name="id" value="{{.ID}}">
                <input type="hidden" name="reason" value="refund or abuse">
                <button class="btn btn-outline" type="submit">Cancel key</button>
              </form>
            {{else}}
              <span class="meta">revoked</span>
            {{end}}
          </td>
        </tr>
      {{end}}
      </tbody>
    </table>
    {{else}}
    <p class="meta">No keys minted yet.</p>
    {{end}}
  </section>

  <section class="admin-card">
    <h2>Public requests</h2>
    <p class="meta">Members’ uploads are private until they request public. Approve lists it. Reject keeps it private (does not delete).</p>
    <table class="admin-table">
      <thead><tr><th>Title</th><th>Account</th><th></th></tr></thead>
      <tbody>
      {{range .Videos}}
        {{if eq .Status "pending"}}
        <tr>
          <td><a href="/watch/{{.ID}}">{{.Title}}</a></td>
          <td>{{.Owner}} · {{.Channel}}</td>
          <td>
            <form method="post" action="/admin/review" style="display:inline">
              <input type="hidden" name="id" value="{{.ID}}">
              <button class="btn btn-green" type="submit" name="action" value="approve">Approve</button>
              <button class="btn btn-outline" type="submit" name="action" value="reject" onclick="return confirm('Reject and remove this title?')">Reject</button>
            </form>
          </td>
        </tr>
        {{end}}
      {{end}}
      </tbody>
    </table>
  </section>

  <section class="admin-card">
    <h2>Library</h2>
    <table class="admin-table">
      <thead><tr><th>Title</th><th>Channel</th><th>Views</th><th></th></tr></thead>
      <tbody>
      {{range .Videos}}
        {{if ne .Status "pending"}}
        <tr>
          <td><a href="/watch/{{.ID}}">{{.Title}}</a></td>
          <td>{{.Channel}}</td>
          <td>{{.Views}}</td>
          <td>
            <form method="post" action="/admin/delete" onsubmit="return confirm('Remove this title?')">
              <input type="hidden" name="id" value="{{.ID}}">
              <button class="btn btn-outline" type="submit">Remove</button>
            </form>
          </td>
        </tr>
        {{end}}
      {{end}}
      </tbody>
    </table>
  </section>
</div>
{{template "footer" .}}