{% extends 'admin/layout.html.twig' %}
{% block title %}Utilisateurs — WTL{% endblock %}
{% block admin_body %}
<div class="d-flex justify-content-between align-items-start gap-3 mb-4">
    <div>
        <h1 class="h2 mb-1">Utilisateurs</h1>
        <p class="text-secondary mb-0">Comptes, groupes fonctionnels, projets autorisés et droits sensibles de l'application.</p>
    </div>
    <div class="d-flex gap-2"><a class="btn btn-outline-dark" href="{{ path('admin_permission_group_index') }}"><i class="bi bi-grid-3x3-gap-fill me-1"></i>Groupes & permissions</a><button class="btn btn-dark" data-bs-toggle="modal" data-bs-target="#newUserModal"><i class="bi bi-person-plus me-1"></i>Nouveau compte</button></div>
</div>

<div class="alert alert-light border shadow-sm">
    <i class="bi bi-shield-check me-2"></i>
    <strong>Super administrateur :</strong> accès automatique à toutes les fonctions et tous les projets. Pour les autres comptes, attribuez un ou plusieurs groupes et les projets autorisés. Les droits effectifs sont la somme des permissions de leurs groupes.
</div>

<div class="card table-card">
    <div class="card-body p-3">
        <div class="table-responsive">
            <table class="table align-middle data-table" data-order-column="0">
                <thead><tr><th>Utilisateur</th><th>Groupes</th><th>Projets</th><th>État</th><th>Super admin</th><th data-orderable="false">Actions</th></tr></thead>
                <tbody>
                {% for user in users %}
                    <tr>
                        <td><div class="fw-semibold">{{ user.displayName }}</div><div class="small text-secondary">{{ user.email }}</div></td>
                        <td>{% if user.superAdmin %}<span class="badge text-bg-dark">Tous les droits</span>{% elseif user.userGroups|length %}<div class="d-flex flex-wrap gap-1">{% for g in user.userGroups %}<span class="badge text-bg-light border">{{ g.name }}</span>{% endfor %}</div>{% else %}<span class="badge text-bg-warning">Aucun accès BO</span>{% endif %}</td>
                        <td>
                            {% if user.superAdmin %}
                                <span class="badge text-bg-dark">Tous les projets</span>
                            {% elseif user.artisticProjects|length %}
                                <div class="d-flex flex-wrap gap-1">{% for p in user.artisticProjects %}<span class="badge border text-dark" style="border-color:{{ p.primaryColor }}!important"><span class="project-color-dot project-color-dot-sm me-1" style="background:{{ p.primaryColor }}"></span>{{ p.name }}</span>{% endfor %}</div>
                            {% else %}
                                <span class="badge text-bg-warning">Aucun projet</span>
                            {% endif %}
                        </td>
                                                <td>{% if user.active %}<span class="badge text-bg-success">Actif</span>{% else %}<span class="badge text-bg-secondary">Désactivé</span>{% endif %}</td>
                        <td>{% if user.superAdmin %}<span class="badge text-bg-danger">Super admin</span>{% else %}<span class="text-secondary">—</span>{% endif %}</td>
                        <td class="text-end text-nowrap">
                            <button class="btn btn-sm btn-outline-dark" data-bs-toggle="modal" data-bs-target="#editUserModal-{{ user.id }}" title="Modifier"><i class="bi bi-pencil"></i></button>
                            <form class="d-inline" method="post" action="{{ path('admin_user_toggle_active',{id:user.id}) }}">
                                <input type="hidden" name="_token" value="{{ csrf_token('toggle-active-'~user.id) }}">
                                <button class="btn btn-sm {{ user.active ? 'btn-outline-warning' : 'btn-outline-success' }}" {{ app.user.id == user.id ? 'disabled' : '' }} title="{{ user.active ? 'Désactiver' : 'Réactiver' }}"><i class="bi {{ user.active ? 'bi-person-slash' : 'bi-person-check' }}"></i></button>
                            </form>
                            <form class="d-inline" method="post" action="{{ path('admin_user_toggle_super',{id:user.id}) }}">
                                <input type="hidden" name="_token" value="{{ csrf_token('toggle-super-'~user.id) }}">
                                <button class="btn btn-sm {{ user.superAdmin ? 'btn-outline-danger' : 'btn-outline-dark' }}" {{ app.user.id == user.id and user.superAdmin ? 'disabled' : '' }} title="{{ user.superAdmin ? 'Retirer super admin' : 'Promouvoir super admin' }}"><i class="bi bi-shield-lock"></i></button>
                            </form>
                        </td>
                    </tr>
                {% else %}
                    <tr><td colspan="6" class="text-center text-secondary py-4">Aucun utilisateur.</td></tr>
                {% endfor %}
                </tbody>
            </table>
        </div>
    </div>
</div>

<div class="modal fade" id="newUserModal" tabindex="-1">
    <div class="modal-dialog modal-lg"><form class="modal-content" method="post" action="{{ path('admin_user_new') }}">
        <div class="modal-header"><div><h5 class="modal-title mb-0">Nouveau compte</h5><div class="small text-secondary">Le compte peut être limité à certains projets dès sa création.</div></div><button type="button" class="btn-close" data-bs-dismiss="modal"></button></div>
        <div class="modal-body">
            <input type="hidden" name="_token" value="{{ csrf_token('user-new') }}">
            <div class="row g-3">
                <div class="col-md-6"><label class="form-label">Nom affiché *</label><input class="form-control" name="display_name" required></div>
                <div class="col-md-6"><label class="form-label">E-mail *</label><input class="form-control" type="email" name="email" required></div>
                <div class="col-md-6"><label class="form-label">Mot de passe *</label><input class="form-control" type="password" name="password" required></div>
                <div class="col-md-6"><label class="form-label">Type de compte</label><select class="form-select" name="role"><option value="ROLE_ADMIN">Back-office</option><option value="ROLE_PRESSE">Presse uniquement</option><option value="ROLE_USER">Compte sans back-office</option></select><div class="form-text">Un compte avec un groupe fonctionnel est automatiquement traité comme compte back-office.</div></div><div class="col-12"><label class="form-label fw-semibold">Groupes fonctionnels</label><div class="row g-2">{% for g in groups %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="group_ids[]" value="{{ g.id }}"><strong>{{ g.name }}</strong>{% if g.description %}<div class="small text-secondary">{{ g.description }}</div>{% endif %}</label></div>{% endfor %}</div><div class="form-text">Les droits se cumulent si plusieurs groupes sont cochés.</div></div>
                <div class="col-12"><hr class="my-1"><div class="fw-semibold mb-2">Projets autorisés</div><div class="row g-2">{% for p in projects %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="project_ids[]" value="{{ p.id }}"><span class="project-color-dot project-color-dot-sm me-1" style="background:{{ p.primaryColor }}"></span>{{ p.name }}</label></div>{% endfor %}</div></div>
                                <div class="col-12"><div class="form-check"><input class="form-check-input" type="checkbox" name="is_super_admin" value="1" id="newSuper"><label class="form-check-label" for="newSuper"><strong>Super administrateur</strong><div class="small text-secondary">Donne automatiquement accès à tous les projets, à la comptabilité et à l'administration sensible.</div></label></div></div>
            </div>
        </div>
        <div class="modal-footer"><button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Annuler</button><button class="btn btn-dark">Créer le compte</button></div>
    </form></div>
</div>

{% for user in users %}
<div class="modal fade" id="editUserModal-{{ user.id }}" tabindex="-1">
    <div class="modal-dialog modal-lg"><form class="modal-content" method="post" action="{{ path('admin_user_edit',{id:user.id}) }}">
        <div class="modal-header"><div><h5 class="modal-title mb-0">Modifier {{ user.displayName }}</h5><div class="small text-secondary">Les changements de droits sont appliqués dès la prochaine requête.</div></div><button type="button" class="btn-close" data-bs-dismiss="modal"></button></div>
        <div class="modal-body">
            <input type="hidden" name="_token" value="{{ csrf_token('user-edit-'~user.id) }}">
            <div class="row g-3">
                <div class="col-md-6"><label class="form-label">Nom affiché *</label><input class="form-control" name="display_name" value="{{ user.displayName }}" required></div>
                <div class="col-md-6"><label class="form-label">E-mail *</label><input class="form-control" type="email" name="email" value="{{ user.email }}" required></div>
                <div class="col-md-6"><label class="form-label">Nouveau mot de passe</label><input class="form-control" type="password" name="password"><div class="form-text">Laisser vide pour conserver le mot de passe actuel.</div></div>
                <div class="col-md-6"><label class="form-label">Type de compte</label><select class="form-select" name="role"><option value="ROLE_ADMIN" {{ 'ROLE_ADMIN' in user.roles ? 'selected' : '' }}>Back-office</option><option value="ROLE_PRESSE" {{ 'ROLE_ADMIN' not in user.roles and 'ROLE_PRESSE' in user.roles ? 'selected' : '' }}>Presse uniquement</option><option value="ROLE_USER" {{ 'ROLE_ADMIN' not in user.roles and 'ROLE_PRESSE' not in user.roles ? 'selected' : '' }}>Compte sans back-office</option></select><div class="form-text">Les groupes fonctionnels activent automatiquement le back-office.</div></div><div class="col-12"><label class="form-label fw-semibold">Groupes fonctionnels</label><div class="row g-2">{% for g in groups %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="group_ids[]" value="{{ g.id }}" {{ g in user.userGroups ? 'checked' : '' }}><strong>{{ g.name }}</strong>{% if g.description %}<div class="small text-secondary">{{ g.description }}</div>{% endif %}</label></div>{% endfor %}</div></div>
                <div class="col-12"><hr class="my-1"><div class="fw-semibold mb-2">Projets autorisés</div><div class="row g-2">{% for p in projects %}<div class="col-md-6"><label class="form-check border rounded p-2 ps-5 d-block"><input class="form-check-input" type="checkbox" name="project_ids[]" value="{{ p.id }}" {{ user.canAccessProject(p) ? 'checked' : '' }}><span class="project-color-dot project-color-dot-sm me-1" style="background:{{ p.primaryColor }}"></span>{{ p.name }}</label></div>{% endfor %}</div>{% if user.superAdmin %}<div class="form-text">Le super administrateur a automatiquement accès à tous les projets.</div>{% endif %}</div>
                                <div class="col-12"><div class="form-check"><input class="form-check-input" type="checkbox" name="is_super_admin" value="1" id="super-{{ user.id }}" {{ user.superAdmin ? 'checked' : '' }} {{ app.user.id == user.id and user.superAdmin ? 'disabled' : '' }}><label class="form-check-label" for="super-{{ user.id }}"><strong>Super administrateur</strong></label>{% if app.user.id == user.id and user.superAdmin %}<input type="hidden" name="is_super_admin" value="1"><div class="form-text">Tu ne peux pas retirer ton propre statut super administrateur.</div>{% endif %}</div></div>
            </div>
        </div>
        <div class="modal-footer"><button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Annuler</button><button class="btn btn-dark">Enregistrer</button></div>
    </form></div>
</div>
{% endfor %}
{% endblock %}