{{define "error.html"}}
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width,initial-scale=1">
  <title>{{.StatusCode}} {{.Title}}</title>
  {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}
  <script>
    (() => {
      const retryKey = "hermes.oauth.callback-recovery";
      const retryWindowMs = 60_000;
      let shouldRetry = false;
      try {
        const previous = Number(window.sessionStorage.getItem(retryKey) || "0");
        const now = Date.now();
        shouldRetry = !previous || now - previous > retryWindowMs;
        if (shouldRetry) window.sessionStorage.setItem(retryKey, String(now));
      } catch {
        // Storage-disabled browsers keep the manual recovery link below.
      }
      if (shouldRetry) {
        window.setTimeout(() => {
          window.location.replace("{{.ProxyPrefix}}/start?rd=/");
        }, 350);
      } else {
        window.addEventListener("DOMContentLoaded", () => {
          const detail = document.getElementById("recovery-detail");
          if (detail) {
            detail.textContent =
              "Automatic recovery paused to avoid a sign-in loop. Continue once to start a fresh login.";
          }
        });
      }
    })();
  </script>
  {{end}}
  <style>
    body{margin:0;min-height:100vh;display:grid;place-items:center;background:#f5f5f5;color:#333;font:16px/1.5 system-ui,sans-serif}
    main{width:min(560px,calc(100% - 40px));box-sizing:border-box;padding:36px;border:1px solid #ddd;border-radius:14px;background:#fff;text-align:center;box-shadow:0 12px 45px #0002}
    h1{font-size:3rem;margin:.2rem}.detail{color:#666}a{display:inline-block;margin-top:18px;padding:10px 16px;border-radius:8px;background:#00bfa5;color:#fff;text-decoration:none}
  </style>
</head>
<body>
  <main>
    {{if or (eq .StatusCode 500) (eq .Message "Login Failed: Unable to find a valid CSRF token. Please try again.")}}
    <h1>Signing you back in…</h1>
    <p id="recovery-detail" class="detail">The previous one-time login callback expired or was already used. Hermes is starting one fresh sign-in automatically.</p>
    <a href="{{.ProxyPrefix}}/start?rd=/">Continue now</a>
    {{else}}
    <h1>{{.StatusCode}} {{.Title}}</h1>
    {{if .Message}}<p class="detail">{{.Message}}</p>{{end}}
    <a href="{{.ProxyPrefix}}/start?rd=/">Sign in again</a>
    {{end}}
  </main>
</body>
</html>
{{end}}
