{{--
    Roles & Permissions — the company's roles, who holds each and what it opens.
    Obvizio's /roles screen over Worklance's permission catalog.
--}}
@extends('layouts.app')

@php
    use App\Support\Permissions;
    $pages = Permissions::pageNames();
@endphp

@section('header')
    <div class="row g-2 align-items-center">
        <div class="col">
            <div class="page-pretitle">Administration</div>
            <h2 class="page-title">Roles &amp; Permissions</h2>
            <div class="text-secondary mt-1">
                Company: <span class="fw-semibold">{{ $company?->name ?? 'None' }}</span>
            </div>
        </div>
        <div class="col-auto ms-auto">
            <button class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#role-create">
                <i class="ti ti-plus me-1"></i> New Role
            </button>
        </div>
    </div>
@endsection

@section('content')
<div class="alert alert-info" role="alert">
    <div>
        <i class="ti ti-info-circle me-1"></i>
        A role decides everything someone can do in the portal — which screens they open and whose data they see.
        Only the Super Admin can do more. Roles marked <span class="badge bg-cyan-lt">Workspace</span> are given to
        people automatically from their workspace role on every sync.
    </div>
</div>

<div class="card">
    <div class="table-responsive">
        <table class="table table-vcenter card-table">
            <thead>
                <tr>
                    <th>Role</th>
                    <th>People</th>
                    <th>Screens</th>
                    <th>Whose data</th>
                    <th>Permissions</th>
                    <th class="w-1"></th>
                </tr>
            </thead>
            <tbody>
                @forelse ($roles as $role)
                    @php
                        $held     = $role->permissions->pluck('name')->all();
                        $screens  = array_values(array_intersect($pages, $held));
                        $isWs     = in_array($role->name, $mirrored, true)
                                    || in_array(\Illuminate\Support\Str::slug((string) $role->label, '_'), $mirrored, true);
                        $scope    = in_array(Permissions::VIEW_ALL, $held, true) ? 'Everyone'
                                  : (in_array(Permissions::VIEW_TEAM, $held, true) ? 'Their teams' : 'Only themselves');
                    @endphp
                    <tr>
                        <td>
                            <a href="{{ route('admin.roles.show', $role) }}" class="fw-semibold text-reset">{{ $role->label ?? $role->name }}</a>
                            @if ($isWs) <span class="badge bg-cyan-lt ms-1">Workspace</span> @endif
                            @if ($role->company_id === null) <span class="badge bg-secondary-lt ms-1">Global</span> @endif
                            <div class="text-secondary small"><code>{{ $role->name }}</code></div>
                        </td>
                        <td>{{ $role->users_count }}</td>
                        <td>
                            @if ($screens)
                                <div class="d-flex flex-wrap gap-1">
                                    @foreach ($screens as $p)
                                        <span class="badge bg-blue-lt">{{ Permissions::label($p) }}</span>
                                    @endforeach
                                </div>
                            @else
                                <span class="text-secondary">None — desktop only</span>
                            @endif
                        </td>
                        <td class="{{ $screens ? '' : 'text-secondary' }}">{{ $screens ? $scope : '—' }}</td>
                        <td class="text-nowrap">
                            <span class="fw-semibold">{{ count($held) }}</span><span class="text-secondary"> / {{ $total }}</span>
                        </td>
                        <td class="text-end text-nowrap">
                            <a href="{{ route('admin.roles.show', $role) }}" class="btn btn-sm btn-ghost-primary">
                                <i class="ti ti-shield-lock me-1"></i>Permissions
                            </a>
                            @if ($role->company_id !== null || auth()->user()->isSuperAdmin())
                                <div class="dropdown d-inline-block">
                                    <button class="btn btn-sm btn-ghost-secondary" data-bs-toggle="dropdown"><i class="ti ti-dots-vertical"></i></button>
                                    <div class="dropdown-menu dropdown-menu-end">
                                        <button class="dropdown-item" data-bs-toggle="modal" data-bs-target="#role-rename-{{ $role->id }}">
                                            <i class="ti ti-edit me-2"></i> Rename
                                        </button>
                                        @if ($role->users_count === 0)
                                            <div class="dropdown-divider"></div>
                                            <form method="POST" action="{{ route('admin.roles.destroy', $role) }}"
                                                  onsubmit="return confirm('Delete this role?')">
                                                @csrf @method('DELETE')
                                                <button class="dropdown-item text-danger"><i class="ti ti-trash me-2"></i> Delete</button>
                                            </form>
                                        @endif
                                    </div>
                                </div>
                            @endif
                        </td>
                    </tr>
                @empty
                    <tr><td colspan="6" class="text-center text-secondary py-4">
                        No roles yet — create one, or Sync Workspace Users to bring the workspace’s roles across.
                    </td></tr>
                @endforelse
            </tbody>
        </table>
    </div>
</div>

{{-- Modals — outside the table. --}}
@foreach ($roles as $role)
    @continue($role->company_id === null && ! auth()->user()->isSuperAdmin())
    @php $rkey = "role-rename-{$role->id}"; $rErr = old('form_key') === $rkey; @endphp
    <div class="modal modal-blur fade" id="{{ $rkey }}" tabindex="-1">
        <div class="modal-dialog modal-dialog-centered">
            <form class="modal-content js-modal-form" method="POST" action="{{ route('admin.roles.update', $role) }}" novalidate>
                @csrf @method('PUT')
                <input type="hidden" name="form_key" value="{{ $rkey }}">
                <div class="modal-header">
                    <h5 class="modal-title">Rename role</h5>
                    <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
                </div>
                <div class="modal-body">
                    <label class="form-label required">Name</label>
                    <input name="label" maxlength="100" required class="form-control @if($rErr && $errors->has('label')) is-invalid @endif"
                           value="{{ $rErr ? old('label') : ($role->label ?? $role->name) }}">
                    <div class="invalid-feedback">{{ $rErr && $errors->has('label') ? $errors->first('label') : 'Please enter a name.' }}</div>
                    <div class="form-hint">Only the display name changes — workspace roles keep matching it.</div>
                </div>
                <div class="modal-footer">
                    <button type="button" class="btn btn-link link-secondary" data-bs-dismiss="modal">Cancel</button>
                    <button type="submit" class="btn btn-primary">Save</button>
                </div>
            </form>
        </div>
    </div>
@endforeach

@php $cErr = old('form_key') === 'role-create'; @endphp
<div class="modal modal-blur fade" id="role-create" tabindex="-1">
    <div class="modal-dialog modal-dialog-centered">
        <form class="modal-content js-modal-form" method="POST" action="{{ route('admin.roles.store') }}" novalidate>
            @csrf
            <input type="hidden" name="form_key" value="role-create">
            <div class="modal-header">
                <h5 class="modal-title">New role</h5>
                <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
            </div>
            <div class="modal-body">
                <label class="form-label required">Name</label>
                <input name="label" maxlength="100" required placeholder="e.g. HR, Team Lead, Auditor"
                       class="form-control @if($cErr && $errors->has('label')) is-invalid @endif" value="{{ $cErr ? old('label') : '' }}">
                <div class="invalid-feedback">{{ $cErr && $errors->has('label') ? $errors->first('label') : 'Please enter a name.' }}</div>
                <div class="form-hint">You choose its permissions on the next screen. It starts with none.</div>
            </div>
            <div class="modal-footer">
                <button type="button" class="btn btn-link link-secondary" data-bs-dismiss="modal">Cancel</button>
                <button type="submit" class="btn btn-primary">Create role</button>
            </div>
        </form>
    </div>
</div>

@include('admin.partials.modal-form-ux')
@endsection