{% extends "base.html" %}
{% block title %}{{ _("Register · Local SQL Agent") }}{% endblock %}
{% block content %}
<div class="auth-wrap">
  <div class="card auth-card">
    <h1>{{ _("Add user") }}</h1>
    <p class="muted">{{ _("Create an account for a new user of the Local SQL Agent.") }}</p>
    <form method="post" action="{{ url_for('register') }}">
      <!-- Enforced server-side (webapp/app.py's before_request _check_csrf):
           this is the endpoint that creates accounts, so a token-less POST
           is rejected with 400 rather than silently accepted (finding 17b). -->
      <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
      <label for="username">{{ _("Username") }}</label>
      <input id="username" name="username" type="text" autocomplete="username" required autofocus>

      <label for="password">{{ _("Password") }}</label>
      <input id="password" name="password" type="password" autocomplete="new-password" required>

      <label for="confirm">{{ _("Confirm password") }}</label>
      <input id="confirm" name="confirm" type="password" autocomplete="new-password" required>

      <button class="btn btn-primary btn-block" type="submit">{{ _("Create account") }}</button>
    </form>
  </div>
</div>
{% endblock %}