{# Shared modern header — used by base.html and dashboard.html.
   Styles live in app/web/static/style-custom.css under the .app-* prefix. #}
{% if session.user %}
<header class="app-header">
    <div class="app-header-left">
        <a class="app-header-logo" href="/" aria-label="Home">
            {% if config.LOGO_SVG %}{{ config.LOGO_SVG | safe }}{% else %}{{ config.INSTANCE_NAME or 'Data Analyst Portal' }}{% endif %}
        </a>
        <span class="app-header-subtitle">{{ config.INSTANCE_SUBTITLE or 'Data Analyst Portal' }}</span>
    </div>
    <div class="app-header-right">
        {% set _path = request.url.path %}
        <a class="app-nav-link {% if _path == '/dashboard' or _path == '/' %}is-active{% endif %}" href="/dashboard">Dashboard</a>
        <a class="app-nav-link {% if _path.startswith('/install') %}is-active{% endif %}" href="/install">Install CLI</a>
        {% if session.user.is_admin %}
        <a class="app-nav-link {% if _path.startswith('/admin/tokens') %}is-active{% endif %}" href="/admin/tokens">All tokens</a>
        <a class="app-nav-link {% if _path.startswith('/admin/marketplaces') %}is-active{% endif %}" href="/admin/marketplaces">Marketplaces</a>
        {% set _admin_active = _path.startswith('/admin/users') or _path.startswith('/admin/groups') or _path.startswith('/admin/access') or _path.startswith('/admin/server-config') %}
        <div class="app-nav-menu" id="adminNavMenu">
            <button type="button"
                    class="app-nav-link app-nav-menu-trigger {% if _admin_active %}is-active{% endif %}"
                    id="adminNavTrigger"
                    aria-haspopup="menu" aria-expanded="false" aria-controls="adminNavPanel">
                Admin
                <svg class="app-nav-menu-chevron" width="10" height="10" viewBox="0 0 12 12" aria-hidden="true">
                    <path d="M2 4l4 4 4-4" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
                </svg>
            </button>
            <div class="app-nav-menu-panel" id="adminNavPanel" role="menu" hidden>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/users') %}is-active{% endif %}" role="menuitem" href="/admin/users">Users</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/groups') %}is-active{% endif %}" role="menuitem" href="/admin/groups">Groups</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/access') %}is-active{% endif %}" role="menuitem" href="/admin/access">Resource access</a>
                <a class="app-nav-menu-item {% if _path.startswith('/admin/server-config') %}is-active{% endif %}" role="menuitem" href="/admin/server-config">Server config</a>
            </div>
        </div>
        {% endif %}

        <div class="app-user-menu" id="userMenu">
            <button type="button" class="app-user-menu-trigger" id="userMenuTrigger"
                    aria-haspopup="menu" aria-expanded="false" aria-controls="userMenuPanel">
                {% if session.user.picture %}
                <img src="{{ session.user.picture }}" alt="" class="app-avatar-img">
                {% else %}
                <span class="app-avatar">{{ (session.user.name or session.user.email)[:2] | upper }}</span>
                {% endif %}
                <svg class="app-user-menu-chevron" width="12" height="12" viewBox="0 0 12 12" aria-hidden="true">
                    <path d="M2 4l4 4 4-4" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
                </svg>
            </button>
            <div class="app-user-menu-panel" id="userMenuPanel" role="menu" hidden>
                <div class="app-user-menu-header">
                    <div class="app-user-menu-email">{{ session.user.email }}</div>
                    {% if session.user.is_admin %}
                    <div class="app-user-menu-role">Admin</div>
                    {% endif %}
                </div>
                <a class="app-user-menu-item {% if _path.startswith('/profile') %}is-active{% endif %}" role="menuitem" href="/profile">Profile</a>
                <a class="app-user-menu-item {% if _path == '/tokens' %}is-active{% endif %}" role="menuitem" href="/tokens">My tokens</a>
                {% if config.DEBUG_AUTH_ENABLED %}
                <a class="app-user-menu-item {% if _path.startswith('/me/debug') %}is-active{% endif %}" role="menuitem" href="/me/debug">Auth debug</a>
                {% endif %}
                <a class="app-user-menu-item" role="menuitem" href="{{ url_for('auth.logout') }}">Logout</a>
            </div>
        </div>
    </div>
</header>
<script>
// Generic toggle pattern — used by both the user menu and the Admin nav dropdown.
function _wireDropdown(triggerId, panelId) {
    var trigger = document.getElementById(triggerId);
    var panel = document.getElementById(panelId);
    if (!trigger || !panel) return;
    function setOpen(open) {
        trigger.setAttribute('aria-expanded', open ? 'true' : 'false');
        if (open) { panel.removeAttribute('hidden'); }
        else { panel.setAttribute('hidden', ''); }
    }
    trigger.addEventListener('click', function(e) {
        e.stopPropagation();
        setOpen(trigger.getAttribute('aria-expanded') !== 'true');
    });
    document.addEventListener('click', function(e) {
        if (!panel.contains(e.target) && e.target !== trigger) setOpen(false);
    });
    document.addEventListener('keydown', function(e) {
        if (e.key === 'Escape') { setOpen(false); trigger.focus(); }
    });
}
_wireDropdown('userMenuTrigger', 'userMenuPanel');
_wireDropdown('adminNavTrigger', 'adminNavPanel');
</script>
{% endif %}