@extends('layouts.app')
@section('title', 'Permissões ACL · '.$dossier->name)
@section('content')
<div class="page-header"><div><h1>Permissões ACL</h1><p class="muted">{{ $dossier->name }} · {{ $folder?->path ?? 'Raiz do dossiê' }}</p></div><div class="actions">@if($canManageGroups)<a class="btn btn-secondary" href="{{ route('access-groups.index') }}">Gerir grupos</a>@endif<a class="btn btn-secondary" href="{{ route('dossiers.show', $dossier->id) }}">Voltar</a></div></div>
<div class="grid grid-2">
<div class="card">
<h2>Localização</h2>
<form method="get" action="{{ route('dossiers.access.index', $dossier->id) }}"><label>Pasta<select name="folder" onchange="this.form.submit()"><option value="">Raiz do dossiê</option>@foreach($dossier->folders->sortBy('path') as $item)<option value="{{ $item->id }}" @selected($folder?->id === $item->id)>{{ $item->path }}</option>@endforeach</select></label></form>
@if($folder)
<form method="post" action="{{ route('dossiers.access.inheritance', [$dossier->id, $folder->id]) }}" style="margin-top:14px">@csrf @method('PUT')<input type="hidden" name="acl_inherits" value="{{ $folder->acl_inherits ? 0 : 1 }}"><button class="btn btn-secondary">{{ $folder->acl_inherits ? 'Interromper herança' : 'Ativar herança' }}</button></form>
<p class="muted">Ao interromper a herança, esta pasta deixa de receber regras da raiz e das pastas superiores. As permissões base do role continuam ativas até serem negadas explicitamente.</p>
@endif
<h3>Cadeia aplicada</h3><div class="acl-chain">@foreach($explanation['inheritance_chain'] as $chain)<span class="badge">{{ $chain['name'] }}</span>@if(!$loop->last) → @endif @endforeach</div>
</div>
<div class="card"><h2>As suas permissões efetivas</h2><div class="permission-grid">@foreach($permissions as $code => $label)<div><span class="badge {{ $explanation['effective'][$code] ? 'badge-success' : 'badge-danger' }}">{{ $explanation['effective'][$code] ? 'Permitido' : 'Negado' }}</span> {{ $label }}</div>@endforeach</div><p class="muted">Role base: <strong>{{ $explanation['role'] ?? 'nenhum' }}</strong>. Uma regra de negação aplicável prevalece sobre permissões concedidas.</p></div>
</div>

<div class="card" style="margin-top:18px"><h2>Adicionar regra</h2>
<form method="post" action="{{ route('dossiers.access.store', $dossier->id) }}" class="form-grid" id="acl-rule-form">@csrf<input type="hidden" name="folder_id" value="{{ $folder?->id }}">
<div class="form-row"><label>Principal<select name="principal_type" id="principal-type" required><option value="everyone">Todos os membros</option><option value="role">Role</option><option value="group">Grupo ACL</option><option value="user">Utilizador</option></select></label><label>Efeito<select name="effect"><option value="allow">Permitir</option><option value="deny">Negar</option></select></label></div>
<div id="principal-role"><label>Role<select name="principal_value">@foreach($roles as $role)<option value="{{ $role }}">{{ $role }}</option>@endforeach</select></label></div>
<div id="principal-group" hidden><label>Grupo<select name="principal_id" disabled>@foreach($groups as $group)<option value="{{ $group->id }}">{{ $group->name }} ({{ $group->users_count }})</option>@endforeach</select></label></div>
<div id="principal-user" hidden><label>Utilizador<select name="principal_id" disabled>@foreach($members as $member)<option value="{{ $member->id }}">{{ $member->name }} · {{ $member->email }}</option>@endforeach</select></label></div>
<fieldset><legend>Permissões</legend><div class="permission-grid">@foreach($permissions as $code => $label)<label class="checkbox"><input type="checkbox" name="permissions[]" value="{{ $code }}"> {{ $label }}</label>@endforeach</div></fieldset>
<button class="btn btn-primary">Adicionar regra</button></form></div>

<div class="card" style="margin-top:18px"><h2>Regras diretas nesta localização</h2><div class="table-wrap"><table><thead><tr><th>Efeito</th><th>Principal</th><th>Permissões</th><th></th></tr></thead><tbody>
@forelse($entries as $entry)
@php
$principal = match($entry->principal_type) {
 'everyone' => 'Todos os membros',
 'role' => 'Role: '.$entry->principal_value,
 'group' => 'Grupo: '.optional($groups->firstWhere('id', $entry->principal_id))->name,
 'user' => 'Utilizador: '.optional($members->firstWhere('id', $entry->principal_id))->name,
 default => $entry->principal_type,
};
@endphp
<tr><td><span class="badge {{ $entry->effect === 'allow' ? 'badge-success' : 'badge-danger' }}">{{ $entry->effect === 'allow' ? 'Permitir' : 'Negar' }}</span></td><td>{{ $principal }}</td><td>{{ collect($entry->permissions)->map(fn($p) => $permissions[$p] ?? $p)->join(', ') }}</td><td><form method="post" action="{{ route('dossiers.access.destroy', [$dossier->id, $entry->id]) }}" onsubmit="return confirm('Remover esta regra?')">@csrf @method('DELETE')<button class="btn btn-danger btn-sm">Remover</button></form></td></tr>
@empty<tr><td colspan="4" class="muted">Sem regras diretas. Aplicam-se a herança e as permissões base do role.</td></tr>@endforelse
</tbody></table></div></div>
@endsection
@push('scripts')<script>
(() => { const type=document.getElementById('principal-type'); const blocks={role:document.getElementById('principal-role'),group:document.getElementById('principal-group'),user:document.getElementById('principal-user')}; const sync=()=>{Object.entries(blocks).forEach(([key,block])=>{const show=type.value===key; block.hidden=!show; block.querySelectorAll('select').forEach(el=>el.disabled=!show);});}; type.addEventListener('change',sync); sync(); })();
</script>@endpush