31 lines
1.7 KiB
Plaintext
31 lines
1.7 KiB
Plaintext
<%#
|
|
Admin OAuth2 client register form body (todo §6), captured into the shell content slot. Config:
|
|
form { action, csrfToken, submitLabel, cancelHref, nameField, scopeField (field.ejs configs),
|
|
redirectUris: string (newline-separated), public: bool, firstParty: bool }
|
|
error? string shown when a write was rejected
|
|
%><%
|
|
const form = locals.form;
|
|
-%>
|
|
<div class="form-page">
|
|
<% if (locals.error) { -%>
|
|
<%- include("alert", { text: locals.error, tone: "neg" }) %>
|
|
<% } -%>
|
|
<form class="form-card" method="post" action="<%= form.action %>">
|
|
<input type="hidden" name="_csrf" value="<%= form.csrfToken %>">
|
|
<%- include("field", form.nameField) %>
|
|
<div class="field">
|
|
<label for="redirectUris">Redirect URIs</label>
|
|
<textarea class="input" id="redirectUris" name="redirectUris" rows="3" placeholder="https://app.example.com/callback"><%= form.redirectUris %></textarea>
|
|
<span class="field-hint">One per line — where the app is sent back after sign-in.</span>
|
|
</div>
|
|
<%- include("field", form.scopeField) %>
|
|
<label class="check"><input type="checkbox" name="public"<% if (form.public) { %> checked<% } %>> Public client (SPA / native app, PKCE — no secret)</label>
|
|
<span class="field-hint">Browser and mobile apps can't keep a secret — choose Public. Server-side apps that can store one — leave it Confidential.</span>
|
|
<label class="check"><input type="checkbox" name="firstParty"<% if (form.firstParty) { %> checked<% } %>> First-party (auto-grant consent — skip the consent screen)</label>
|
|
<div class="form-actions">
|
|
<a class="btn" href="<%= form.cancelHref %>">Cancel</a>
|
|
<button class="btn btn-primary" type="submit"><%= form.submitLabel %></button>
|
|
</div>
|
|
</form>
|
|
</div>
|