{% extends "base.html" %}

{% block title %}Nornsight | Legislative Accountability{% endblock %}

{% block body %}
  <main class="shell home-shell">
    {% if auth_error %}
      <div class="notice auth-notice">Authentication failed. Try signing in again.</div>
    {% endif %}

    <section class="hero-panel">
      <div class="hero-copy">
        <p class="eyebrow">Invite-only access</p>
        <h1>Track legislative behavior with role-aware access and shared WorkOS sign-in.</h1>
        <p class="hero-text">
          Nornsight turns roll-call data into issue-level accountability views for your invited team.
          Use the public home page as the front door, then move signed-in users into the dashboard,
          legislator search, and comparison tools.
        </p>
        <div class="hero-actions">
          {% if is_authenticated %}
            <a class="hero-primary" href="/dashboard">Open dashboard</a>
            {% if is_admin %}
              <a class="hero-secondary" href="/admin">Admin settings</a>
            {% endif %}
          {% else %}
            <a class="hero-primary" href="/login?next=/dashboard">Sign in</a>
            <a class="hero-secondary" href="#access-model">How access works</a>
          {% endif %}
        </div>
      </div>

      <aside class="hero-card">
        <h2>Launch access model</h2>
        <ul>
          <li>Public landing page at <code>/</code></li>
          <li>Invite-only AuthKit login with Email + Password and Google</li>
          <li><code>viewer</code> role for dashboard, legislators, and compare</li>
          <li><code>admin</code> role for settings and account administration</li>
        </ul>
      </aside>
    </section>

    <section id="access-model" class="home-grid">
      <article class="home-card">
        <h2>For invited users</h2>
        <p>View the dashboard, inspect legislator profiles, and compare issue scoring without sharing a local password.</p>
      </article>
      <article class="home-card">
        <h2>For admins</h2>
        <p>Manage invitations and role assignments in WorkOS while the app enforces role-based route access.</p>
      </article>
      <article class="home-card">
        <h2>For rollout</h2>
        <p>Authentication is centralized, sessions are sealed, and the old hard-coded admin login is removed.</p>
      </article>
    </section>
  </main>
{% endblock %}