{{-- Access — the role decides everything this person may do in the portal. --}}
@php
    use App\Support\Permissions;

    $actor     = auth()->user();
    $self      = $user->is($actor);
    $canRoles  = $actor->canAccess(Permissions::ROLES);
    $role      = $user->primaryRole();

    $effective = $user->effectivePermissions();
    $screens   = array_values(array_intersect(Permissions::pageNames(), $effective));
    $admin     = array_values(array_intersect(
        [Permissions::USERS, Permissions::ROLES, Permissions::VERSIONS, Permissions::DIGEST, Permissions::QUICK_LOGIN],
        $effective,
    ));
    $scope     = in_array(Permissions::VIEW_ALL, $effective, true) ? 'Everyone in the company'
               : (in_array(Permissions::VIEW_TEAM, $effective, true) ? 'Members of the teams they lead, and themselves' : 'Only themselves');

    // Why the role can't be changed from here, if it can't.
    $locked = match (true) {
        $user->isSuperAdmin()        => 'The Super Admin has every permission, whatever the role.',
        $user->roleFromWorkspace()   => 'Follows their workspace role (“' . $user->workspace_role . '”) — change it in the workspace.',
        $self                        => 'You can’t change your own role.',
        ! $canRoles                  => 'Assigning roles needs Manage Roles & Permissions.',
        default                      => null,
    };
@endphp

<div class="wlu-pane-head">
    <h3 class="wlu-pane-title">Access</h3>
    <span class="wlu-pane-hint">Their role decides what they can open and whose data they see</span>
</div>

<form method="POST" action="{{ route('admin.users.access.update', $user) }}">
    @csrf @method('PATCH')

    <div class="mb-3">
        <label class="form-label">Role</label>
        @if ($locked)
            {{-- No name: the save then leaves the role as it is. --}}
            <select class="form-select" disabled>
                <option>{{ $role?->label ?? $role?->name ?? '— None —' }}</option>
            </select>
            <div class="form-hint">{{ $locked }}</div>
        @else
            <select name="role_id" class="form-select">
                <option value="">— None (desktop only) —</option>
                @foreach ($roles as $r)
                    @continue(! $actor->canGrant($r) && ! $user->roles->contains($r->id))
                    <option value="{{ $r->id }}" @selected($user->roles->contains($r->id))>{{ $r->label ?? $r->name }}</option>
                @endforeach
            </select>
            <div class="form-hint">Only roles holding no more than your own access are offered.</div>
        @endif
        @if ($role && $canRoles)
            <a href="{{ route('admin.roles.show', $role) }}" class="small">What “{{ $role->label ?? $role->name }}” can do →</a>
        @endif
    </div>

    <div class="mb-3">
        <input type="hidden" name="track_timesheet" value="0">
        <label class="form-check form-switch">
            <input class="form-check-input" type="checkbox" name="track_timesheet" value="1" @checked($user->tracksTimesheet())>
            <span class="form-check-label">On the Timesheet</span>
            <span class="form-check-description">Off for accounts whose hours the report is not about — HR, office admins.</span>
        </label>
    </div>

    <div class="text-end">
        <button class="btn btn-primary"><i class="ti ti-device-floppy me-1"></i>Save access</button>
    </div>
</form>

<h4 class="subheader mb-2 mt-4">Sign-in link</h4>
<div class="wlu-chain mb-3">
    <div class="wlu-chain-row">
        <span class="wlu-chain-label">Personal link</span>
        <span class="wlu-chain-value">
            @if ($loginLink)
                Active <span class="wlu-chain-meta">sent {{ $loginLink->created_at->diffForHumans() }}
                · {{ $loginLink->used_at ? 'last used ' . $loginLink->used_at->diffForHumans() . ($loginLink->used_ip ? ' from ' . $loginLink->used_ip : '') : 'not used yet' }}</span>
            @else
                None <span class="wlu-chain-meta">Send Portal Invite gives them one</span>
            @endif
        </span>
        @if ($loginLink)
            <form method="POST" action="{{ route('admin.users.login-link.revoke', $user) }}" class="ms-auto"
                  onsubmit="return confirm('Switch off their sign-in link? It stops working at once; their password still works.')">
                @csrf
                <button class="btn btn-sm btn-outline-danger"><i class="ti ti-link-off me-1"></i>Revoke</button>
            </form>
        @endif
    </div>
</div>

<h4 class="subheader mb-2 mt-4">Effective access</h4>
<div class="wlu-chain mb-3">
    <div class="wlu-chain-row">
        <span class="wlu-chain-label">Screens</span>
        <span class="wlu-chain-value">
            @if ($screens)
                {{ collect($screens)->map(fn ($p) => Permissions::label($p))->implode(', ') }}
            @else
                None — desktop only
            @endif
        </span>
    </div>
    <div class="wlu-chain-row">
        <span class="wlu-chain-label">Whose data</span>
        <span class="wlu-chain-value">
            {{ $screens ? $scope : '—' }}
            @if ($screens && $activity['visible_count'] !== null)
                <span class="wlu-chain-meta">{{ $activity['visible_count'] }} {{ \Illuminate\Support\Str::plural('person', $activity['visible_count']) }} today</span>
            @endif
        </span>
    </div>
    <div class="wlu-chain-row">
        <span class="wlu-chain-label">Administration</span>
        <span class="wlu-chain-value">
            {{ $admin ? collect($admin)->map(fn ($p) => Permissions::label($p))->implode(', ') : '—' }}
        </span>
    </div>
    <div class="wlu-chain-row">
        <span class="wlu-chain-label">From</span>
        <span class="wlu-chain-value">
            {{ $user->isSuperAdmin() ? 'Super Admin' : ($role ? ($role->label ?? $role->name) . ' role' : 'No role') }}
            @if ($user->status === \App\Support\EmployeeStatus::INACTIVE)
                <span class="wlu-chain-meta">inactive — no access while they are</span>
            @endif
        </span>
    </div>
</div>