<%
  /*
   * The two per-user admin actions, shared by every screen that lists users
   * from `etas`: clear that one user's picked_number, and block / unblock
   * that one user.
   *
   * Locals: user (needs id, name, picked_number, blocked), returnTo (the page
   * a non-JS form post redirects back to) and buttonClass (sizing, so a card
   * and a table row can style the same markup differently).
   *
   * Both forms carry data-ajax so app.js posts them over fetch and repaints in
   * place; without JavaScript they post normally and the server redirects back
   * to `returnTo`.
   */
  const actionLabel = user.name ? user.name : 'this user';
  const hasPicked = user.picked_number !== null && user.picked_number !== undefined
    && String(user.picked_number) !== '';
%>
<form method="POST" action="/approvals/<%= user.id %>/clear-picked-number"
      data-ajax="clear-picked"
      data-confirm
      data-confirm-title="Clear picked number"
      data-confirm-body="This will clear the picked number of <%= actionLabel %>."
      data-confirm-note="Only the picked_number column of that one row is set to NULL — the user is not deleted and nothing else about them changes. As with the bulk reset, the ticket numbers they held are released and archived."
      data-confirm-accept="Yes, clear it">
  <input type="hidden" name="_csrf" value="<%= csrfToken %>" />
  <input type="hidden" name="_return" value="<%= returnTo %>" />
  <button type="submit" class="btn <%= buttonClass %> btn--warn"
          data-clear-picked
          <%= hasPicked ? '' : 'disabled' %>>Clear Number</button>
</form>
<form method="POST" action="/approvals/<%= user.id %>/<%= user.blocked ? 'unblock' : 'block' %>"
      data-ajax="block"
      data-block-form
      data-block-base="/approvals/<%= user.id %>"
      data-confirm
      data-confirm-title="<%= user.blocked ? 'Unblock user' : 'Block user' %>"
      data-confirm-body="<%= user.blocked ? 'This will unblock ' + actionLabel + '.' : 'This will block ' + actionLabel + '.' %>"
      data-confirm-note="Only the blocked column of that one row is written. The user is not deleted and their name, receipt, picked number and approval status stay exactly as they are."
      data-confirm-accept="<%= user.blocked ? 'Yes, unblock' : 'Yes, block' %>">
  <input type="hidden" name="_csrf" value="<%= csrfToken %>" />
  <input type="hidden" name="_return" value="<%= returnTo %>" />
  <button type="submit" class="btn <%= buttonClass %> <%= user.blocked ? 'btn--ghost' : 'btn--danger' %>"
          data-block-toggle><%= user.blocked ? 'Unblock' : 'Block' %></button>
</form>
