@extends('admin.layouts.app')
@section('page-title', 'User Access Control')
@push('styles')
    <link rel="stylesheet" href="{{ asset('assets/staff-users.css') }}?v={{ filemtime(public_path('assets/staff-users.css')) }}">
    <link rel="stylesheet" href="{{ asset('assets/user-access.css') }}?v={{ filemtime(public_path('assets/user-access.css')) }}">
@endpush
@push('scripts')
    <script src="{{ asset('assets/user-access.js') }}?v={{ filemtime(public_path('assets/user-access.js')) }}" defer></script>
@endpush
@section('content')
<div class="access-workspace">
    <section class="panel access-users" aria-labelledby="access-users-heading">
        <header class="staff-heading"><h2 id="access-users-heading">Select User</h2><a class="access-text-link" href="{{ route('admin.settings.users') }}">Manage users</a></header>
        <form class="access-search" action="{{ route('admin.settings.access') }}" method="get"><label class="staff-search"><span class="sr-only">Search staff users</span><input type="search" name="q" value="{{ $search }}" maxlength="100" placeholder="Name, email or mobile"></label><button class="staff-button" type="submit"><x-icon name="search" :size="16" /><span class="sr-only">Search</span></button></form>
        <div class="access-user-list">
            @forelse($users as $staffUser)
                <a href="{{ route('admin.settings.access.edit', ['user' => $staffUser->id, 'q' => $search, 'page' => $users->currentPage()]) }}" class="access-user-link" @if($selectedUser?->id === $staffUser->id) aria-current="page" @endif><span><strong>{{ $staffUser->name }}</strong><small>{{ $staffUser->email }}</small></span>@unless($staffUser->is_active)<span class="staff-badge">Inactive</span>@endunless<x-icon name="chevron" :size="13" /></a>
            @empty
                <p class="access-empty-list">No staff users found. <a href="{{ route('admin.settings.users.create') }}">Create a user</a></p>
            @endforelse
        </div>
        <div class="staff-pagination access-user-pages"><span>{{ $users->total() }} users</span><nav aria-label="User selection pages">@if($users->previousPageUrl())<a href="{{ $users->previousPageUrl() }}" rel="prev">Previous</a>@endif<span>{{ $users->currentPage() }} / {{ $users->lastPage() }}</span>@if($users->nextPageUrl())<a href="{{ $users->nextPageUrl() }}" rel="next">Next</a>@endif</nav></div>
    </section>
    <section class="panel access-editor" aria-labelledby="access-heading">
        <header class="staff-heading"><div><h2 id="access-heading">User Access Control</h2><p>Choose modules and features for one user</p></div></header>
        @if(session('status'))<p class="staff-message staff-success" role="status">{{ session('status') }}</p>@endif
        @if($selectedUser)
            <div class="access-selected-user"><div><strong>{{ $selectedUser->name }}</strong><p>{{ $selectedUser->email }}<br>{{ $selectedUser->phone ?: 'Mobile not set' }}</p></div><div><span class="staff-badge {{ $selectedUser->is_active ? 'is-positive' : '' }}">{{ $selectedUser->is_active ? 'Active' : 'Inactive' }}</span><span class="staff-badge {{ $selectedUser->phone_verified_at ? 'is-positive' : 'is-pending' }}">{{ $selectedUser->phone_verified_at ? 'Mobile verified' : 'Verification pending' }}</span></div></div>
            @if(!$selectedUser->is_active || !$selectedUser->phone_verified_at)<p class="access-note">You can prepare access now. The user can sign in after the account is active and mobile verification is complete.</p>@endif
            @if($errors->any())<div class="staff-message staff-error" role="alert"><ul>@foreach($errors->all() as $error)<li>{{ $error }}</li>@endforeach</ul><a href="{{ route('admin.settings.access.edit', $selectedUser->id) }}">Reload saved access</a></div>@endif
            @php
                $selectedPermissions = old('permissions', $snapshot['permissions']);
                $selectedPermissions = is_array($selectedPermissions) ? $selectedPermissions : $snapshot['permissions'];
                $formVersion = old('version', $snapshot['version']);
                $formVersion = is_string($formVersion) && preg_match('/^[a-f0-9]{64}$/D', $formVersion) ? $formVersion : $snapshot['version'];
            @endphp
            <form method="post" action="{{ route('admin.settings.access.update', $selectedUser->id) }}" class="access-form" data-access-form>
                @csrf @method('PATCH')
                <input type="hidden" name="version" value="{{ $formVersion }}">
                <input type="hidden" name="permissions[]" value="">
                <noscript><p class="access-note">Select individual feature checkboxes below. Module selection helpers require JavaScript.</p></noscript>
                <div class="access-instructions"><p>A module checkbox selects its available features. Partial selection is shown automatically.</p><button type="button" class="access-text-button" data-access-clear>Clear selection</button></div>
                <div class="access-groups">
                @foreach($groups as $key => $group)
                    <fieldset class="access-group" data-access-group>
                        <legend><label><input type="checkbox" data-module-toggle aria-label="Select all available {{ $group['name'] }} features"><x-icon :name="$group['icon']" :size="17" /><strong>{{ $group['name'] }}</strong></label><span data-group-count></span></legend>
                        <div class="access-features">
                        @foreach($group['features'] as $feature)
                            @php($planned = $feature['planned'] ?? false)
                            <label @class(['access-feature', 'is-planned' => $planned])><input type="checkbox" name="permissions[]" value="{{ $feature['key'] }}" data-permission @if($feature['key'] === $key.'.view') data-module-view @endif @checked(!$planned && in_array($feature['key'], $selectedPermissions, true)) @disabled($planned)><span>{{ $feature['label'] }}</span>@if($planned)<small>Coming later</small>@endif</label>
                        @endforeach
                        </div>
                        @isset($group['note'])<p class="access-group-note">{{ $group['note'] }}</p>@endisset
                    </fieldset>
                @endforeach
                </div>
                <div class="access-save-panel"><p class="access-note">Only selected features are allowed. A designation does not grant access; new features stay denied until assigned. Saved changes take effect on the user's next request.</p><label class="access-password" for="access-current-password">Confirm your current password<input id="access-current-password" name="current_password" type="password" autocomplete="current-password" maxlength="128" required></label><div class="access-actions"><button type="submit" class="staff-button staff-primary">Save access</button><span data-access-summary role="status" aria-live="polite">Choose features above</span></div></div>
            </form>
        @else
            <div class="staff-empty access-empty"><x-icon name="users" :size="30" /><h3>Select a user to manage access</h3><p>Permissions are assigned to each user individually.</p></div>
        @endif
    </section>
</div>
@endsection