{% extends 'admin/layout.html.twig' %}
{% block title %}Utilisateurs — WTL{% endblock %}
{% block admin_body %}
{% include 'admin/ui/_page_header.html.twig' with {page_eyebrow:'Administration',page_title:'Utilisateurs',page_subtitle:'Gère les comptes, leurs groupes et les projets qu’ils peuvent consulter.',page_actions:[{label:'Groupes et permissions',href:path('admin_permission_group_index'),icon:'bi-grid-3x3-gap-fill'},{label:'Nouveau compte',href:'#',icon:'bi-person-plus',primary:true,attributes:{'data-bs-toggle':'modal','data-bs-target':'#newUserModal'}}]} only %}
{% include 'admin/ui/_context_help.html.twig' with {help_title:'Comment donner les bons accès ?',help_items:['Choisis d’abord un groupe fonctionnel, puis les projets autorisés.','Un utilisateur standard ne voit que les projets cochés.','Réserve le statut super administrateur aux personnes qui doivent accéder à tous les projets et aux réglages sensibles.']} only %}

<div class="alert alert-light border shadow-sm">
    <i class="bi bi-shield-check me-2"></i>
    <strong>Super administrateur :</strong> accès automatique à toutes les fonctions et tous les projets. Pour les autres comptes, attribuez un ou plusieurs groupes et les projets autorisés. Les droits effectifs sont la somme des permissions de leurs groupes.
</div>
<div class="alert alert-warning border shadow-sm"><i class="bi bi-diagram-3 me-2"></i>Un compte back-office non super-admin doit être associé à au moins un projet. Sans projet, la connexion reste reconnue mais l’accès à <code>/admin</code> est refusé.</div>

<div class="card table-card">
    <div class="card-body p-3">
        <div class="mobile-card-list user-admin-cards">{% for user in users %}<article class="card business-card"><div class="card-body"><div class="d-flex justify-content-between gap-2"><div><h2 class="h6 mb-1">{{ user.displayName }}</h2><div class="small text-secondary text-break">{{ user.email }}</div></div><span class="badge {{ user.active?'text-bg-success':'text-bg-secondary' }} align-self-start">{{ user.active?'Actif':'Désactivé' }}</span></div><div class="mt-3"><div class="small fw-semibold text-secondary">Accès</div><div class="d-flex flex-wrap gap-1 mt-1">{% if user.superAdmin %}<span class="badge text-bg-danger">Super administrateur</span>{% elseif user.userGroups|length %}{% for g in user.userGroups %}<span class="badge text-bg-light border">{{ g.name }}</span>{% endfor %}{% else %}<span class="badge text-bg-warning">Aucun accès back-office</span>{% endif %}</div></div><div class="mt-3"><div class="small fw-semibold text-secondary">Projets</div><div class="small mt-1">{% if user.superAdmin %}Tous les projets{% elseif user.artisticProjects|length %}{{ user.artisticProjects|map(p=>p.name)|join(', ') }}{% else %}<span class="text-warning-emphasis">Aucun projet</span>{% endif %}</div></div><div class="card-actions mt-3"><button class="btn btn-dark flex-grow-1 touch-target" data-bs-toggle="modal" data-bs-target="#editUserModal-{{ user.id }}">Modifier le compte</button><div class="dropdown action-menu"><button class="btn btn-outline-secondary icon-only-action" data-bs-toggle="dropdown" aria-label="Autres actions pour {{ user.displayName }}"><i class="bi bi-three-dots"></i></button><ul class="dropdown-menu dropdown-menu-end"><li><form method="post" action="{{ path('admin_user_toggle_active',{id:user.id}) }}"><input type="hidden" name="_token" value="{{ csrf_token('toggle-active-'~user.id) }}"><button class="dropdown-item" {{ app.user.id==user.id?'disabled':'' }}><i class="bi {{ user.active?'bi-person-slash':'bi-person-check' }}"></i>{{ user.active?'Désactiver':'Réactiver' }}</button></form></li><li><form method="post" action="{{ path('admin_user_toggle_super',{id:user.id}) }}" onsubmit="return confirm('{{ user.superAdmin ? 'Retirer les droits de super administrateur ?' : 'Donner tous les droits et tous les projets à ce compte ?' }}');"><input type="hidden" name="_token" value="{{ csrf_token('toggle-super-'~user.id) }}"><button class="dropdown-item text-danger" {{ app.user.id==user.id and user.superAdmin?'disabled':'' }}><i class="bi bi-shield-lock"></i>{{ user.superAdmin?'Retirer super admin':'Promouvoir super admin' }}</button></form></li></ul></div></div></div></article>{% else %}{% include 'admin/ui/_empty_state.html.twig' with {empty_title:'Aucun utilisateur',empty_text:'Crée un compte pour commencer.'} only %}{% endfor %}</div>
        <div class="table-responsive desktop-table-only">
            <table class="table align-middle data-table" data-order-column="0">
                <thead><tr><th>Utilisateur</th><th>Groupes</th><th>Projets</th><th>État</th><th>Super admin</th><th data-orderable="false">Actions</th></tr></thead>
                <tbody>
                {% for user in users %}
                    <tr>
                        <td><div class="fw-semibold">{{ user.displayName }}</div><div class="small text-secondary">{{ user.email }}</div></td>
                        <td>{% if user.superAdmin %}<span class="badge text-bg-dark">Tous les droits</span>{% elseif user.userGroups|length %}<div class="d-flex flex-wrap gap-1">{% for g in user.userGroups %}<span class="badge text-bg-light border">{{ g.name }}</span>{% endfor %}</div>{% else %}<span class="badge text-bg-warning">Aucun accès BO</span>{% endif %}</td>
                        <td>
                            {% if user.superAdmin %}
                                <span class="badge text-bg-dark">Tous les projets</span>
                            {% elseif user.artisticProjects|length %}
                                <div class="d-flex flex-wrap gap-1">{% for p in user.artisticProjects %}<span class="badge border text-dark" style="border-color:{{ p.primaryColor }}!important"><span class="project-color-dot project-color-dot-sm me-1" style="background:{{ p.primaryColor }}"></span>{{ p.name }}</span>{% endfor %}</div>
                            {% else %}
                                <span class="badge text-bg-warning">Aucun projet</span>
                            {% endif %}
                        </td>
                                                <td>{% if user.active %}<span class="badge text-bg-success">Actif</span>{% else %}<span class="badge text-bg-secondary">Désactivé</span>{% endif %}</td>
                        <td>{% if user.superAdmin %}<span class="badge text-bg-danger">Super admin</span>{% else %}<span class="text-secondary">—</span>{% endif %}</td>
                        <td class="text-end text-nowrap">
                            <button class="btn btn-sm btn-outline-dark" data-bs-toggle="modal" data-bs-target="#editUserModal-{{ user.id }}" title="Modifier"><i class="bi bi-pencil"></i></button>
                            <form class="d-inline" method="post" action="{{ path('admin_user_toggle_active',{id:user.id}) }}">
                                <input type="hidden" name="_token" value="{{ csrf_token('toggle-active-'~user.id) }}">
                                <button class="btn btn-sm {{ user.active ? 'btn-outline-warning' : 'btn-outline-success' }}" {{ app.user.id == user.id ? 'disabled' : '' }} title="{{ user.active ? 'Désactiver' : 'Réactiver' }}"><i class="bi {{ user.active ? 'bi-person-slash' : 'bi-person-check' }}"></i></button>
                            </form>
                            <form class="d-inline" method="post" action="{{ path('admin_user_toggle_super',{id:user.id}) }}">
                                <input type="hidden" name="_token" value="{{ csrf_token('toggle-super-'~user.id) }}">
                                <button class="btn btn-sm {{ user.superAdmin ? 'btn-outline-danger' : 'btn-outline-dark' }}" {{ app.user.id == user.id and user.superAdmin ? 'disabled' : '' }} title="{{ user.superAdmin ? 'Retirer super admin' : 'Promouvoir super admin' }}"><i class="bi bi-shield-lock"></i></button>
                            </form>
                        </td>
                    </tr>
                {% else %}
                    <tr><td colspan="6" class="text-center text-secondary py-4">Aucun utilisateur.</td></tr>
                {% endfor %}
                </tbody>
            </table>
        </div>
    </div>
</div>

<div class="modal fade" id="newUserModal" tabindex="-1">
    <div class="modal-dialog modal-lg modal-dialog-scrollable"><form class="modal-content modal-scroll-form" method="post" action="{{ path('admin_user_new') }}" data-prevent-double-submit="true">
        <div class="modal-header"><div><h5 class="modal-title mb-0">Nouveau compte</h5><div class="small text-secondary">Le compte peut être limité à certains projets dès sa création.</div></div><button type="button" class="btn-close" data-bs-dismiss="modal"></button></div>
        <div class="modal-body">
            <input type="hidden" name="_token" value="{{ csrf_token('user-new') }}">
            <div class="row g-3">
                <div class="col-md-6"><label class="form-label">Nom affiché *</label><input class="form-control" name="display_name" required></div>
                <div class="col-md-6"><label class="form-label">E-mail *</label><input class="form-control" type="email" name="email" required></div>
                <div class="col-md-6"><label class="form-label">Mot de passe *</label><input class="form-control" type="password" name="password" required></div>
                <div class="col-md-6"><label class="form-label">Type de compte</label><select class="form-select" name="role"><option value="ROLE_ADMIN">Back-office</option><option value="ROLE_PRESSE">Presse uniquement</option><option value="ROLE_USER">Compte sans back-office</option></select><div class="form-text">Un compte avec un groupe fonctionnel est automatiquement traité comme compte back-office.</div></div><div class="col-12"><label class="form-label fw-semibold">Groupes fonctionnels</label><div class="row g-2">{% for g in groups %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="group_ids[]" value="{{ g.id }}"><strong>{{ g.name }}</strong>{% if g.description %}<div class="small text-secondary">{{ g.description }}</div>{% endif %}</label></div>{% endfor %}</div><div class="form-text">Les droits se cumulent si plusieurs groupes sont cochés.</div></div>
                <div class="col-12"><hr class="my-1"><div class="fw-semibold mb-2">Projets autorisés</div><div class="row g-2">{% for p in projects %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="project_ids[]" value="{{ p.id }}"><span class="project-color-dot project-color-dot-sm me-1" style="background:{{ p.primaryColor }}"></span>{{ p.name }}</label></div>{% endfor %}</div></div>
                                <div class="col-12"><div class="form-check"><input class="form-check-input" type="checkbox" name="is_super_admin" value="1" id="newSuper"><label class="form-check-label" for="newSuper"><strong>Super administrateur</strong><div class="small text-secondary">Donne automatiquement accès à tous les projets, à la comptabilité et à l'administration sensible.</div></label></div></div>
            </div>
        </div>
        <div class="modal-footer"><button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Annuler</button><button class="btn btn-dark">Créer le compte</button></div>
    </form></div>
</div>

{% for user in users %}
<div class="modal fade" id="editUserModal-{{ user.id }}" tabindex="-1">
    <div class="modal-dialog modal-lg modal-dialog-scrollable"><form class="modal-content modal-scroll-form" method="post" action="{{ path('admin_user_edit',{id:user.id}) }}" data-prevent-double-submit="true">
        <div class="modal-header"><div><h5 class="modal-title mb-0">Modifier {{ user.displayName }}</h5><div class="small text-secondary">Les changements de droits sont appliqués dès la prochaine requête.</div></div><button type="button" class="btn-close" data-bs-dismiss="modal"></button></div>
        <div class="modal-body">
            <input type="hidden" name="_token" value="{{ csrf_token('user-edit-'~user.id) }}">
            <div class="row g-3">
                <div class="col-md-6"><label class="form-label">Nom affiché *</label><input class="form-control" name="display_name" value="{{ user.displayName }}" required></div>
                <div class="col-md-6"><label class="form-label">E-mail *</label><input class="form-control" type="email" name="email" value="{{ user.email }}" required></div>
                <div class="col-md-6"><label class="form-label">Nouveau mot de passe</label><input class="form-control" type="password" name="password"><div class="form-text">Laisser vide pour conserver le mot de passe actuel.</div></div>
                <div class="col-md-6"><label class="form-label">Type de compte</label><select class="form-select" name="role"><option value="ROLE_ADMIN" {{ 'ROLE_ADMIN' in user.roles ? 'selected' : '' }}>Back-office</option><option value="ROLE_PRESSE" {{ 'ROLE_ADMIN' not in user.roles and 'ROLE_PRESSE' in user.roles ? 'selected' : '' }}>Presse uniquement</option><option value="ROLE_USER" {{ 'ROLE_ADMIN' not in user.roles and 'ROLE_PRESSE' not in user.roles ? 'selected' : '' }}>Compte sans back-office</option></select><div class="form-text">Les groupes fonctionnels activent automatiquement le back-office.</div></div><div class="col-12"><label class="form-label fw-semibold">Groupes fonctionnels</label><div class="row g-2">{% for g in groups %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="group_ids[]" value="{{ g.id }}" {{ g in user.userGroups ? 'checked' : '' }}><strong>{{ g.name }}</strong>{% if g.description %}<div class="small text-secondary">{{ g.description }}</div>{% endif %}</label></div>{% endfor %}</div></div>
                <div class="col-12"><hr class="my-1"><div class="fw-semibold mb-2">Projets autorisés</div><div class="row g-2">{% for p in projects %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="project_ids[]" value="{{ p.id }}" {{ user.canAccessProject(p) ? 'checked' : '' }}><span class="project-color-dot project-color-dot-sm me-1" style="background:{{ p.primaryColor }}"></span>{{ p.name }}</label></div>{% endfor %}</div>{% if user.superAdmin %}<div class="form-text">Le super administrateur a automatiquement accès à tous les projets.</div>{% endif %}</div>
                                <div class="col-12"><div class="form-check"><input class="form-check-input" type="checkbox" name="is_super_admin" value="1" id="super-{{ user.id }}" {{ user.superAdmin ? 'checked' : '' }} {{ app.user.id == user.id and user.superAdmin ? 'disabled' : '' }}><label class="form-check-label" for="super-{{ user.id }}"><strong>Super administrateur</strong></label>{% if app.user.id == user.id and user.superAdmin %}<input type="hidden" name="is_super_admin" value="1"><div class="form-text">Tu ne peux pas retirer ton propre statut super administrateur.</div>{% endif %}</div></div>
            </div>
        </div>
        <div class="modal-footer"><button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Annuler</button><button class="btn btn-dark">Enregistrer</button></div>
    </form></div>
</div>
{% endfor %}
{% endblock %}