@extends('hms.layout')
@section('title','Roles & permissions')
@section('content')
<p class="page-hint">Create roles for this organisation and select the actions each role permits. Assign several roles to combine their permissions. Platform administration and access management cannot be delegated through these roles.</p>
<div class="card p-3 mb-3">
<h2 class="h5">Create role</h2>
<form method="POST" action="{{ route('hms.roles.store') }}">@csrf
<label class="form-label" for="new-role-name">Role name</label><input id="new-role-name" name="name" class="form-control mb-3" maxlength="120" required value="{{ old('name') }}">
@include('hms.partials.role-permissions',['selectedPermissions'=>old('permissions',[])])
<button class="btn btn-primary mt-2">Create role</button>
</form></div>
<h2 class="h5">Organisation roles</h2>
@forelse($roles as $role)
<details class="card p-3 mb-2"><summary>{{ $role->name }} · {{ count($role->permissions??[]) }} permissions · {{ $role->memberships_count }} staff</summary>
<form class="mt-3" method="POST" action="{{ route('hms.roles.update',$role->id) }}">@csrf @method('PUT')
<label class="form-label" for="role-name-{{ $role->id }}">Role name</label><input id="role-name-{{ $role->id }}" name="name" class="form-control mb-3" maxlength="120" required value="{{ $role->name }}">
@include('hms.partials.role-permissions',['selectedPermissions'=>$role->permissions??[]])
<button class="btn btn-primary mt-2">Save role</button></form>
@if(!$role->memberships_count)<form class="mt-2" method="POST" action="{{ route('hms.roles.destroy',$role->id) }}" onsubmit="return confirm('Delete this unassigned role?')">@csrf @method('DELETE')<button class="btn btn-outline-danger btn-sm">Delete role</button></form>@endif
</details>
@empty<p class="text-muted">No custom roles yet.</p>@endforelse
<div class="card p-3 mt-4"><h2 class="h5">Staff access assignments</h2>
<p class="small text-muted">Standard access preserves the existing job role. Custom access replaces its action permissions with the selected roles. With no roles selected, custom access grants no application actions. Clinical eligibility, assigned facility, record ownership, and enabled modules still apply. A department or unit head receives no permissions automatically.</p>
@foreach($members as $member)
<div class="border-top py-3"><strong>{{ $member->user?->name }}</strong> <span class="text-muted">{{ $member->user?->email }} · {{ ucwords(str_replace('_',' ',$member->role)) }}</span>
@if($member->role==='admin' || $member->user?->is_platform_admin)
<p class="small mb-0">Protected administrator account.</p>
@else
<form method="POST" action="{{ route('hms.roles.assign',$member->id) }}" class="mt-2">@csrf @method('PUT')
<label class="form-label" for="mode-{{ $member->id }}">Access mode</label>
<select id="mode-{{ $member->id }}" name="access_mode" class="form-select mb-2"><option value="standard" @selected(!$member->custom_access)>Standard job access</option><option value="custom" @selected($member->custom_access)>Custom roles only</option></select>
<fieldset><legend class="fs-6">Assigned roles</legend><div class="d-flex flex-wrap gap-3">@foreach($roles as $role)<label><input type="checkbox" name="roles[]" value="{{ $role->id }}" @checked($member->roles->contains('id',$role->id))> {{ $role->name }}</label>@endforeach</div></fieldset>
<button class="btn btn-sm btn-outline-primary mt-2">Save staff access</button>
</form>@endif</div>
@endforeach
{{ $members->links() }}</div>
@endsection