@inherits LayoutComponentBase
@using ZB.MOM.WW.Secrets.Ui

@* Thin layout: delegates the side-rail chassis (hamburger, brand, responsive
   collapse) to the shared ZB.MOM.WW.Theme <ThemeShell>. The nav is reproduced
   with the kit's NavRailSection / NavRailItem; section expand-state persistence
   is owned by the kit's <details> + ThemeScripts (no JS interop here). *@
<ThemeShell Product="MXAccess Gateway" Accent="#2f5fd0">
    <Nav>
        <NavRailItem Href="/" Text="Dashboard" Match="NavLinkMatch.All" />
        <NavRailSection Title="Runtime" Key="runtime">
            <NavRailItem Href="/sessions" Text="Sessions" />
            <NavRailItem Href="/workers" Text="Workers" />
            <NavRailItem Href="/events" Text="Events" />
            <NavRailItem Href="/alarms" Text="Alarms" />
        </NavRailSection>
        <NavRailSection Title="Galaxy" Key="galaxy">
            <NavRailItem Href="/galaxy" Text="Repository" />
            <NavRailItem Href="/browse" Text="Browse" />
        </NavRailSection>
        <NavRailSection Title="Admin" Key="admin">
            <NavRailItem Href="/apikeys" Text="API Keys" />
            @* Gated on the SAME policy the mounted /admin/secrets page enforces, not on a role
               literal, so nav visibility cannot drift from page access. In this host the two are
               equivalent — GatewayOptionsValidator constrains Dashboard:GroupToRole values to
               Administrator or Viewer, so the shared library's other manage-granting roles
               (secrets-manager, secrets-reveal) are unreachable here — but the policy form stays
               correct if that ever relaxes. Deliberately NOT applied to the API Keys item above:
               that page renders read-only for Viewers, so hiding its link would remove legitimate
               read access, whereas the secrets page denies a Viewer outright and its link would be
               a dead end. *@
            <AuthorizeView Policy="@SecretsAuthorization.ManagePolicy">
                <Authorized>
                    <NavRailItem Href="/admin/secrets" Text="Secrets" />
                </Authorized>
            </AuthorizeView>
            <NavRailItem Href="/settings" Text="Settings" />
        </NavRailSection>
    </Nav>
    <RailFooter>
        <AuthorizeView>
            <Authorized Context="authState">
                <span class="rail-user">@authState.User.Identity?.Name</span>
                <form method="post" action="/logout" data-enhance="false">
                    <AntiforgeryToken />
                    <button class="rail-btn" type="submit">Sign Out</button>
                </form>
            </Authorized>
            <NotAuthorized>
                <a class="rail-btn" href="/login">Sign In</a>
            </NotAuthorized>
        </AuthorizeView>
    </RailFooter>
    <ChildContent>@Body</ChildContent>
</ThemeShell>
