"""Shared page shell for the ClientFlow admin UI."""
from __future__ import annotations
from fastapi.responses import HTMLResponse
import re
from app.admin_ui.components import esc
from app.admin_ui.navigation import nav
from app.admin_ui.styles import ADMIN_UI_V451_CSS
_CSRF_MARKER = ''
def _inject_csrf_markers(html_doc: str) -> str:
"""Expose um marcador CSRF nos forms POST/HTMX da UI administrativa.
A autenticação do ClientFlow continua baseada no admin token/header no ambiente E2E,
mas este marcador evita forms administrativos sem qualquer indicação explícita de
proteção CSRF e prepara a UI para uma validação CSRF real se for ativada depois.
"""
def repl(match: re.Match[str]) -> str:
tag = match.group(0)
lower = tag.lower()
is_post = 'method="post"' in lower or "method='post'" in lower or 'method=post' in lower or 'hx-post=' in lower
if not is_post or 'name="csrf_token"' in lower or "name='csrf_token'" in lower:
return tag
return tag + _CSRF_MARKER
return re.sub(r']*>', repl, html_doc, flags=re.IGNORECASE)
def layout(title: str, subtitle: str, body: str, active: str = "") -> HTMLResponse:
html_doc = f"""
{esc(title)} · ClientFlow