@extends('layouts.portal')
@section('title', 'Team & roles')
@section('subtitle', 'Who can open which part of the back office. Every change is written to the audit log.')
@section('content')
@php $roleLabels = collect(config('rbac.roles'))->map(fn ($r) => $r[0]); @endphp
<div class="grid g2">
  <section class="panel"><div class="panel-head"><h2>Add a team member</h2></div><div class="panel-body">
    <form method="post" action="{{ route('admin.team.store') }}">@csrf
      <div class="form-grid">
        <x-field name="name" label="Full name" required/>
        <x-field name="email" label="Work email" type="email" required/>
      </div>
      <x-field name="role" label="Role" type="select" required blank="Choose a role" :options="collect($roles)->reject(fn ($r) => $r === 'super_admin' && ! auth()->user()->isSuperAdmin())->mapWithKeys(fn ($r) => [$r => $roleLabels[$r].' — '.config('rbac.roles.'.$r.'.1')])->all()"/>
      <button class="btn btn-primary" type="submit"><x-icon name="user-plus" :size="16"/> Invite</button>
      <p class="small muted mt-1 mb-0">They get a set-password email. Two-factor authentication is required before they can use the back office.</p>
    </form>
  </div></section>
  <section class="panel"><div class="panel-head"><h2>Roles</h2></div><div class="panel-body small">
    @foreach(config('rbac.roles') as $k => [$label, $desc])<div class="mb-1"><b>{{ $label }}</b> <span class="muted">— {{ $desc }}</span></div>@endforeach
  </div></section>
</div>

<section class="panel"><div class="panel-head"><h2>Back-office team ({{ $staff->count() }})</h2></div>
  <div class="table-wrap" style="border:0;border-radius:0"><table class="table">
    <thead><tr><th>Name</th><th>Role & status</th><th>2FA</th><th>Last sign-in</th><th class="actions">Change</th></tr></thead>
    <tbody>
    @foreach($staff as $m)
      <tr>
        <td><b>{{ $m->name }}</b>@if($m->id === auth()->id()) <span class="pill pill-blue">you</span>@endif<div class="xs muted">{{ $m->email }}</div></td>
        <td><span class="pill {{ $m->isSuperAdmin() ? 'pill-violet' : 'pill-blue' }}">{{ $m->roleLabel() }}</span> @if($m->isSuspended())<span class="pill pill-red">Suspended</span>@endif</td>
        <td>@if($m->hasTwoFactor())<span class="pill pill-green">On</span>@else<span class="pill pill-amber">Not set up</span>@endif</td>
        <td class="nowrap">{{ $m->last_login_at?->diffForHumans() ?? 'Never' }}</td>
        <td class="actions">
          @if($m->id !== auth()->id() && (! $m->isSuperAdmin() || auth()->user()->isSuperAdmin()))
          <form method="post" action="{{ route('admin.team.update', $m) }}" class="row gap-1" style="justify-content:flex-end">@csrf @method('PUT')
            <select class="select" name="role" aria-label="Role for {{ $m->name }}">@foreach($roles as $r)@continue($r === 'super_admin' && ! auth()->user()->isSuperAdmin())<option value="{{ $r }}" @selected($m->role === $r)>{{ $roleLabels[$r] }}</option>@endforeach<option value="student">Remove staff access</option></select>
            <select class="select" name="status" aria-label="Status"><option value="active" @selected(! $m->isSuspended())>Active</option><option value="suspended" @selected($m->isSuspended())>Suspended</option></select>
            <button class="btn btn-secondary btn-sm" type="submit">Save</button>
          </form>
          @if($canEdit && $m->hasTwoFactor())<form method="post" action="{{ route('admin.team.reset-2fa', $m) }}" data-confirm="Reset two-factor for {{ $m->name }}? Use this only when they lost their phone and recovery codes.">@csrf<button class="btn btn-ghost btn-sm" type="submit">Reset 2FA</button></form>@endif
          @endif
        </td>
      </tr>
    @endforeach
    </tbody>
  </table></div>
</section>

<section class="panel"><div class="panel-head"><h2>Permission matrix</h2>@if($canEdit)<form method="post" action="{{ route('admin.roles.reset') }}" data-confirm="Reset every role to the default permissions?">@csrf<button class="btn btn-ghost btn-sm" type="submit">Reset to defaults</button></form>@endif</div>
  <form method="post" action="{{ route('admin.roles.update') }}">@csrf @method('PUT')
  <div class="table-wrap" style="border:0;border-radius:0"><table class="table op-matrix">
    <thead><tr><th>Module</th>@foreach($roles as $r)<th class="c">{{ $roleLabels[$r] }}</th>@endforeach</tr></thead>
    <tbody>
    @foreach($modules as $mod => [$label, $group])
      <tr><td><b>{{ $label }}</b><div class="xs muted">{{ $group }}</div></td>
        @foreach($roles as $r)
          <td class="c nowrap">
            @if($r === 'super_admin')<span class="xs muted">all</span>
            @else
              @foreach(['view' => 'V', 'manage' => 'M'] as $act => $short)
                <label class="op-perm" title="{{ $roleLabels[$r] }}: {{ $act }} {{ $label }}"><input type="checkbox" name="perm[{{ $r }}][]" value="{{ $mod }}.{{ $act }}" @checked(in_array($mod.'.'.$act, $matrix[$r], true)) @disabled(! $canEdit)> {{ $short }}</label>
              @endforeach
            @endif
          </td>
        @endforeach
      </tr>
    @endforeach
    </tbody>
  </table></div>
  @if($canEdit)<div class="panel-body"><button class="btn btn-primary" type="submit">Save permissions</button> <span class="small muted">V = view, M = create / edit / send / delete. Only a Super Admin can change this.</span></div>@endif
  </form>
</section>
@endsection