@if (user(); as currentUser) {
<section class="profile">
  <header class="profile-header">
    <h1 class="title">My profile</h1>
    <p class="intro">
      Identity served by the BFF from the active admin session. Read-only — role assignments are
      managed in the Entra Admin Center.
    </p>
  </header>

  <article class="card" aria-labelledby="identity-heading">
    <h2 id="identity-heading" class="card-title">Identity</h2>
    <dl class="grid">
      <div>
        <dt>Display name</dt>
        <dd data-testid="profile-displayname">{{ currentUser.displayName }}</dd>
      </div>
      <div>
        <dt>Username</dt>
        <dd data-testid="profile-username">{{ currentUser.username }}</dd>
      </div>
      <div>
        <dt>Entra object id</dt>
        <dd class="mono" data-testid="profile-oid">{{ currentUser.oid }}</dd>
      </div>
      <div>
        <dt>Tenant id</dt>
        <dd class="mono" data-testid="profile-tid">{{ currentUser.tid }}</dd>
      </div>
    </dl>
  </article>

  @if (currentUser.roles && currentUser.roles.length > 0) {
  <article class="card" aria-labelledby="roles-heading">
    <h2 id="roles-heading" class="card-title">App roles</h2>
    <p class="card-intro">
      Roles assigned on the BFF's Entra app registration. Drives access to
      <code>/api/admin/*</code> through <code>&#64;RequireAdmin</code>.
    </p>
    <ul class="roles" data-testid="profile-roles">
      @for (role of currentUser.roles; track role) {
      <li class="role-chip">{{ role }}</li>
      }
    </ul>
  </article>
  }
</section>
}