{{define "partials/auth_password_section.html"}}
<div id="auth-password-section" class="settings-sub"{{if .OOB}} hx-swap-oob="true"{{end}}>
  <h4>Password</h4>
  <p class="field-hint">
    {{if .AuthEnabled}}Password authentication is currently <strong>enabled</strong>.{{else}}Password authentication is currently <strong>disabled</strong>.{{end}}
  </p>
  <form hx-post="/settings/auth/password" hx-target="#flash-auth" hx-swap="innerHTML">
    <input type="hidden" name="_csrf" value="{{.CSRFToken}}">
    {{/* Browser-required username for password-manager autofill and the
         AT pipeline; monbooru is single-user so the value is fixed. */}}
    <input type="text" name="username" value="operator" autocomplete="username" hidden>
    {{if .AuthEnabled}}
    <div class="field">
      <label>Current password</label>
      <input type="password" name="current_password" autocomplete="current-password">
    </div>
    {{end}}
    <div class="field">
      <label>New password</label>
      <input type="password" name="new_password" autocomplete="new-password" required>
    </div>
    <button type="submit">Set password</button>
  </form>
  {{if .AuthEnabled}}
  <hr class="settings-subseparator">
  <form hx-post="/settings/auth/remove-password" hx-target="#flash-auth" hx-swap="innerHTML"
        hx-confirm="Remove password? Anyone will be able to access without logging in."
        data-confirm-ok="Remove">
    <input type="hidden" name="_csrf" value="{{.CSRFToken}}">
    <div class="field">
      <label>Current password</label>
      <input type="password" name="current_password" autocomplete="current-password">
    </div>
    <button type="submit" class="btn-danger" style="margin-top:8px">Remove password</button>
  </form>
  {{end}}
</div>
{{end}}