{% extends "layouts/workspace_settings.html" %}
{% block title %}Webhook secret · DemandTrail Messaging{% endblock %}
{% block page_header %}
  <h1 class="page-title mb-4">{% if created %}{{ connection.display_name }} is connected{% else %}New webhook secret{% endif %}</h1>
{% endblock %}

{% block content %}
  {% comment %}
  The one and only render of this value. It is not in the session, not in a
  message, and not fetchable again — losing it means rotating, which is the
  trade the encrypted column exists to make (SECURITY-BASELINE §5). See the
  docstring on apps/channels/views.py for why this page is not a redirect.
  {% endcomment %}
  <p><strong>Copy this secret now. It is not shown again.</strong></p>
  <p><code>{{ secret }}</code></p>

  <h2>Where it goes</h2>
  {% comment %}
  Three different answers, because the operator's next step differs. A platform
  that holds its own secret over an API (Telegram's setWebhook) has already been
  told; one that does not needs the value pasted into its console; and a push
  that failed leaves the channel down until it is rotated again.
  {% endcomment %}
  {% if pushed %}
    <p>
      {{ label }} has already been given this secret, and is delivering to:<br />
      <code>{{ webhook_url }}</code>
    </p>
    <p class="muted">There is nothing else to do. The copy above is for your records.</p>
  {% elif pushed is False %}
    <div class="alert-error">
      <p>
        <strong>{{ label }} could not be given the new secret.</strong>
        This channel will reject every delivery until it is.
      </p>
      <p>Rotate again to retry. If it keeps failing, disconnect and reconnect the channel.</p>
    </div>
  {% else %}
    <p>
      Configure the platform to deliver events to:<br />
      <code>{{ webhook_url }}</code>
    </p>
  {% endif %}
  <p class="muted">
    Deliveries that do not carry a valid signature for this secret are rejected,
    and a source that keeps failing is temporarily blocked.
  </p>

  {% if not adapter_ready %}
    <p class="muted">
      The {{ label }} adapter ships with {{ connect_flow_issue }}. Until then this
      channel holds its configuration but does not send or receive.
    </p>
  {% endif %}

  <p><a href="{% url 'channels:list' workspace_id=request.workspace.id %}">Done</a></p>
{% endblock %}