{% extends "base.html" %}

{% block title %}Rôles et permissions — GMAO{% endblock %}

{% block content %}
<div class="container-fluid">
  <div class="d-flex justify-content-between align-items-center mb-4">
    <div>
      <h1 class="h3"><i class="bi bi-shield-check"></i> Rôles et permissions</h1>
      <p class="text-muted mb-0">Gérez les rôles et les permissions métier de chaque domaine.</p>
    </div>
    <a href="{{ url_for('admin.users') }}" class="btn btn-outline-primary"><i class="bi bi-people"></i> Utilisateurs</a>
  </div>

  <div class="alert alert-info">
    Les rôles peuvent cumuler plusieurs permissions. Le code technique reste affiché à titre secondaire pour le diagnostic.
  </div>

  <div class="row g-3">
    {% for role in roles_list %}
    <div class="col-xl-4 col-md-6">
      <div class="card h-100">
        <div class="card-header d-flex justify-content-between">
          <strong>{{ role.name }}</strong>
          <span class="badge bg-secondary">{{ role.user_links|length }} compte(s)</span>
        </div>
        <div class="card-body">
          {% if role.slug == 'super_admin' %}
          <div class="alert alert-danger mb-0"><strong>Super administrateur — accès complet</strong><br><small>Ce rôle possède automatiquement toutes les permissions de l'application. Sa matrice n'est pas configurable.</small></div>
          {% else %}<h2 class="h6">Permissions</h2>
          {% if role.permission_links|selectattr('permission.code', 'equalto', '*')|list %}
          <span class="badge bg-danger">Accès complet</span>
          {% else %}
          <div class="d-flex flex-wrap gap-1 mb-3">
            {% for link in role.permission_links if link.effect == 'allow' and link.permission.is_active %}
            <span class="badge text-bg-light border" title="{{ link.permission.description }}">{{ link.permission.name }} <small class="text-muted">({{ link.permission.code }})</small></span>
            {% endfor %}
          </div>
          {% endif %}{% endif %}

          {% if role.user_links %}
          <hr>
          {% for link in role.user_links %}{% set user = link.user %}
          <form method="post" action="{{ url_for('admin.update_user_permissions', id=user.id) }}" class="row g-2 align-items-center mb-2">
            <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
            <div class="col"><span class="small">{{ user.full_name or user.username }}</span></div>
            <div class="col-auto">
              <select name="role_ids" class="form-select form-select-sm" aria-label="Rôle de {{ user.username }}">
                <option value="{{ role.id }}" selected>{{ role.name }}</option>
              </select>
            </div>
            <div class="col-auto"><button class="btn btn-sm btn-outline-primary" type="submit">Appliquer</button></div>
          </form>
          {% endfor %}
          {% endif %}
        </div>
      </div>
    </div>
    {% endfor %}
  </div>
</div>
{% endblock %}