ghglance/internal/web/templates/form.html

{{define "form"}}
<form class="gen" method="post" action="/auth/start">
  <div class="field">
    <label for="user">GitHub username</label>
    <input id="user" name="user" type="text" required maxlength="39"
      pattern="[A-Za-z0-9]+(-[A-Za-z0-9]+)*" title="Letters, digits and single hyphens"
      autocomplete="off" autocapitalize="none" spellcheck="false"
      placeholder="octocat" value="{{.Form.User}}">
  </div>

  <details class="options">
    <summary>Options</summary>
    <div class="options-grid">
      <div class="field">
        <label for="tz">Timezone</label>
        <input id="tz" name="tz" type="text" maxlength="64" value="{{.Form.TZ}}"
          {{if not .Meta}}data-autotz{{end}} aria-describedby="tz-hint" spellcheck="false">
        <p class="hint" id="tz-hint">IANA name such as Asia/Saigon. Buckets commit hours on the productive-time cards.</p>
      </div>

      <div class="field">
        <label for="start_of_week">Week starts on</label>
        <select id="start_of_week" name="start_of_week">
          <option value="sunday"{{if eq .Form.StartOfWeek "sunday"}} selected{{end}}>Sunday</option>
          <option value="monday"{{if eq .Form.StartOfWeek "monday"}} selected{{end}}>Monday</option>
          <option value="tuesday"{{if eq .Form.StartOfWeek "tuesday"}} selected{{end}}>Tuesday</option>
          <option value="wednesday"{{if eq .Form.StartOfWeek "wednesday"}} selected{{end}}>Wednesday</option>
          <option value="thursday"{{if eq .Form.StartOfWeek "thursday"}} selected{{end}}>Thursday</option>
          <option value="friday"{{if eq .Form.StartOfWeek "friday"}} selected{{end}}>Friday</option>
          <option value="saturday"{{if eq .Form.StartOfWeek "saturday"}} selected{{end}}>Saturday</option>
        </select>
      </div>

      <div class="field">
        <label for="commits_per_repo">Commits sampled per repo</label>
        <input id="commits_per_repo" name="commits_per_repo" type="number" min="0" max="5000" step="1"
          value="{{.Form.CommitsPerRepo}}" aria-describedby="cpr-hint">
        <p class="hint" id="cpr-hint">0 samples every commit.</p>
      </div>

      <fieldset class="checks">
        <legend>Repositories</legend>
        <label><input type="checkbox" name="include_forks" value="1"{{if .Form.IncludeForks}} checked{{end}}> Include forks</label>
        <label><input type="checkbox" name="include_private" value="1"{{if .Form.IncludePrivate}} checked{{end}}> Include private repos</label>
        <label><input type="checkbox" name="include_org_repos" value="1"{{if .Form.IncludeOrgRepos}} checked{{end}}> Include org repos you administer</label>
        <p class="hint">Private and org repos are only counted when you sign in, or paste a token, as the username's own account.
          <strong>The resulting cards are visible on this site to anyone with the page link</strong>, including totals drawn from private repos.</p>
      </fieldset>
    </div>
  </details>

  <div class="signin">
    <button type="submit" class="primary" aria-describedby="oauth-scopes">Sign in with GitHub &amp; {{if .Meta}}regenerate{{else}}generate{{end}}</button>
    <p class="hint" id="oauth-scopes" data-oauth-scopes aria-live="polite">
      GitHub asks for <code>read:user</code>, plus <code>repo</code> when private repos are ticked
      (GitHub has no read-only private scope) and <code>read:org</code> when org repos are ticked too.
      The token is used for this one generation, then revoked: never stored, never logged.
    </p>
    <p class="hint">Tick private repos only when the username is your own GitHub account: a sign-in with private access as another account is refused.
      Signed in as another account, you get public data only.</p>
  </div>

  <details class="own-token">
    <summary>Or use your own token</summary>
    <div class="field">
      <label for="token">Your GitHub token</label>
      <input id="token" name="token" type="password" autocomplete="off" spellcheck="false"
        maxlength="255" aria-describedby="token-hint">
      <p class="token-create">
        <a class="button" href="https://github.com/settings/tokens/new?scopes=repo,read:user&amp;description=ghglance"
          target="_blank" rel="noopener noreferrer">Create a token on GitHub</a>
        <span class="hint">Opens a classic token with the <code>repo</code> and <code>read:user</code> scopes already ticked. Pick a short expiration, generate it, and paste it here.</span>
      </p>
      <p class="hint" id="token-hint">
        Used for this one generation only: never stored, never logged, and not revoked, so it stays yours to delete on GitHub.
        A token here is used instead of signing in, whichever button you press.
        With a token for the username's own account, private repos count when ticked and the regenerate wait is skipped;
        a token for another account renders public data only and is refused if it can read private repos.
        <strong>The resulting cards are visible on this site to anyone with the page link.</strong>
      </p>
    </div>
    <button type="submit">{{if .Meta}}Regenerate{{else}}Generate{{end}} with this token</button>
  </details>
</form>
{{end}}