{% extends 'admin/layout.html.twig' %}
{% block title %}Groupes & permissions — WTL{% endblock %}
{% block admin_body %}
{% include 'admin/ui/_page_header.html.twig' with {page_eyebrow:'Administration',page_title:'Groupes et permissions',page_subtitle:'Chaque action fait évoluer le niveau : aucun, lecture, écriture, puis suppression.',page_actions:[{label:'Nouveau groupe',href:'#',icon:'bi-plus-lg',primary:true,attributes:{'data-bs-toggle':'modal','data-bs-target':'#newPermissionGroup'}}]} only %}
{% include 'admin/ui/_context_help.html.twig' with {help_title:'Comprendre les niveaux',help_items:['Lecture permet de consulter.','Écriture permet aussi de créer ou modifier.','Suppression ajoute les suppressions autorisées par le métier ; elle ne contourne jamais les documents immuables ni les règles de conservation.']} only %}
<div class="alert alert-light border shadow-sm"><i class="bi bi-shield-lock me-2"></i><strong>Super administrateur :</strong> possède toujours tous les droits et n'est pas limité par cette matrice. Le niveau « suppression » ne contourne jamais les règles d'immutabilité métier.</div>
<div class="d-flex flex-wrap gap-2 mb-3 small"><span class="badge border text-secondary">Aucun</span><span class="badge border text-primary"><i class="bi bi-eye me-1"></i>Lecture</span><span class="badge border text-success"><i class="bi bi-pencil me-1"></i>Lecture / écriture</span><span class="badge border text-danger"><i class="bi bi-trash me-1"></i>Lecture / écriture / suppression</span><span class="text-secondary align-self-center">Cliquez directement sur une cellule pour passer au niveau suivant.</span></div>
<div class="mobile-card-list permission-group-cards mb-4">
{% for g in groups %}<article class="card business-card"><div class="card-body"><div class="d-flex justify-content-between gap-2"><div><h2 class="h5 mb-1">{{ g.name }}</h2><div class="small text-secondary">{{ g.description ?: 'Aucune description' }}</div></div>{% if g.system %}<span class="badge text-bg-secondary align-self-start">Système</span>{% endif %}</div><div class="permission-mobile-list mt-3">{% set mobileCategory=null %}{% for code,def in permissions %}{% if def.category != mobileCategory %}<h3 class="permission-mobile-category">{{ def.category }}</h3>{% set mobileCategory=def.category %}{% endif %}{% set level=g.permissionLevel(code) %}<div class="permission-mobile-row"><span>{{ def.label }}</span><form method="post" class="permission-cell-form" action="{{ path('admin_permission_group_cycle',{id:g.id,code:code}) }}"><input type="hidden" name="_token" value="{{ csrf_token('permission-'~g.id~'-'~code) }}"><button class="btn btn-sm w-100 {{ level==0?'btn-outline-secondary':(level==1?'btn-outline-primary':(level==2?'btn-outline-success':'btn-outline-danger')) }}">{% if level==0 %}Aucun{% elseif level==1 %}<i class="bi bi-eye me-1"></i>Lecture{% elseif level==2 %}<i class="bi bi-pencil me-1"></i>Écriture{% else %}<i class="bi bi-trash me-1"></i>Suppression{% endif %}</button></form></div>{% endfor %}</div>{% if not g.system %}<form method="post" action="{{ path('admin_permission_group_delete',{id:g.id}) }}" class="mt-3" onsubmit="return confirm('Désactiver ce groupe ?')"><input type="hidden" name="_token" value="{{ csrf_token('permission-group-delete-'~g.id) }}"><button class="btn btn-outline-danger w-100">Désactiver ce groupe</button></form>{% endif %}</div></article>{% endfor %}
</div>
<div class="card table-card"><div class="table-responsive"><table class="table table-bordered align-middle mb-0 permission-matrix"><thead class="table-light"><tr><th style="min-width:260px">Fonction</th>{% for g in groups %}<th class="text-center" style="min-width:165px">{{ g.name }}{% if g.system %}<div class="small text-secondary fw-normal">Groupe système</div>{% endif %}</th>{% endfor %}</tr></thead><tbody>
{% set lastCategory = null %}{% for code,def in permissions %}{% if def.category != lastCategory %}<tr class="table-secondary"><th colspan="{{ groups|length + 1 }}" class="text-uppercase small">{{ def.category }}</th></tr>{% set lastCategory=def.category %}{% endif %}<tr><th><div class="fw-semibold">{{ def.label }}</div></th>{% for g in groups %}{% set level=g.permissionLevel(code) %}<td class="text-center"><form method="post" class="permission-cell-form" action="{{ path('admin_permission_group_cycle',{id:g.id,code:code}) }}"><input type="hidden" name="_token" value="{{ csrf_token('permission-'~g.id~'-'~code) }}"><button class="btn btn-sm w-100 {{ level == 0 ? 'btn-outline-secondary' : (level == 1 ? 'btn-outline-primary' : (level == 2 ? 'btn-outline-success' : 'btn-outline-danger')) }}">{% if level == 0 %}Aucun{% elseif level == 1 %}<i class="bi bi-eye me-1"></i>Lecture{% elseif level == 2 %}<i class="bi bi-pencil me-1"></i>Lecture / écriture{% else %}<i class="bi bi-trash me-1"></i>Lecture / écriture / suppression{% endif %}</button></form></td>{% endfor %}</tr>{% endfor %}
</tbody></table></div></div>
<div class="mt-4"><h2 class="h5">Groupes</h2><div class="row g-3">{% for g in groups %}<div class="col-md-6 col-xl-4"><div class="card h-100"><div class="card-body"><div class="d-flex justify-content-between"><div><strong>{{ g.name }}</strong><div class="small text-secondary">{{ g.description ?: 'Aucune description' }}</div></div>{% if g.system %}<span class="badge text-bg-secondary">Système</span>{% endif %}</div>{% if not g.system %}<form method="post" action="{{ path('admin_permission_group_delete',{id:g.id}) }}" class="mt-3" onsubmit="return confirm('Désactiver ce groupe ?')"><input type="hidden" name="_token" value="{{ csrf_token('permission-group-delete-'~g.id) }}"><button class="btn btn-sm btn-outline-danger">Désactiver</button></form>{% endif %}</div></div></div>{% endfor %}</div></div>
<div class="modal fade" id="newPermissionGroup" tabindex="-1"><div class="modal-dialog"><form class="modal-content" method="post" action="{{ path('admin_permission_group_new') }}"><div class="modal-header"><h5 class="modal-title">Nouveau groupe</h5><button type="button" class="btn-close" data-bs-dismiss="modal"></button></div><div class="modal-body"><input type="hidden" name="_token" value="{{ csrf_token('permission-group-new') }}"><label class="form-label">Nom *</label><input class="form-control mb-3" name="name" required><label class="form-label">Description</label><textarea class="form-control" name="description" rows="3"></textarea></div><div class="modal-footer"><button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Annuler</button><button class="btn btn-dark">Créer</button></div></form></div></div>
{% endblock %}

{% block javascripts %}{{ parent() }}
<script>
document.addEventListener('submit', async (event) => {
    const form = event.target.closest('.permission-cell-form');
    if (!form) return;
    event.preventDefault();
    const button = form.querySelector('button');
    button.disabled = true;
    try {
        const response = await fetch(form.action, {
            method: 'POST',
            body: new FormData(form),
            headers: {'X-Requested-With': 'XMLHttpRequest'}
        });
        if (!response.ok) throw new Error('HTTP '+response.status);
        const data = await response.json();
        const classes = ['btn-outline-secondary','btn-outline-primary','btn-outline-success','btn-outline-danger'];
        classes.forEach(c => button.classList.remove(c));
        button.classList.add(classes[data.level] || classes[0]);
        const icon = data.level === 1 ? '<i class="bi bi-eye me-1"></i>' : (data.level === 2 ? '<i class="bi bi-pencil me-1"></i>' : (data.level === 3 ? '<i class="bi bi-trash me-1"></i>' : ''));
        button.innerHTML = icon + data.label;
    } catch (e) {
        window.location.reload();
    } finally {
        button.disabled = false;
    }
});
</script>
{% endblock %}