{# The login form itself, shared by security/login.html.twig and security/login_oauth2.html.twig so
   the field names, the CSRF token id and the error rendering cannot drift between the two pages.
   Expects `error` and `last_username` from the including template's context. #}
{% if error %}
    {% include '_partials/_alert.html.twig' with { 'level': 'error', messages: [ error.messageKey|trans(error.messageData, 'security') ] } %}
{% endif %}
<div class="pb-4">
    <form action="{{ path('app_login') }}" method="post">
        <div class="mb-4">
            <label for="username" class="mb-1 font-semibold text-white">
                E-Mail:
            </label>
            <input type="email"
                   id="username"
                   name="_username"
                   value="{{ last_username }}"
                   class="form-field"
                   required
                   autocomplete="username">
        </div>
        <div class="mb-4" {{ stimulus_controller('password-reveal') }}>
            <label for="password" class="mb-1 font-semibold text-white">
                Passwort:
            </label>
            <div class="relative">
                <input type="password"
                       id="password"
                       name="_password"
                       class="form-field"
                        {{ stimulus_target('password-reveal', 'field') }}
                       required
                       autocomplete="current-password">
                <button type="button"
                        {{ stimulus_action('password-reveal', 'toggle') }}
                        class="absolute top-0 right-0 mt-2 mr-2">
                    {{ icon('eye', 'w-6 h-6 text-gray-500') }}
                </button>
            </div>
        </div>
        <div class="flex flex-col lg:flex-row space-y-2 lg:space-y-0 lg:space-x-2 mt-4">
            <button type="submit" class="button button--primary">
                Login
            </button>
        </div>
        <input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}">
    </form>
</div>