<?php
/**
 * View: admin/users
 *
 * Injected variables:
 *   @var string      $action     'list' | 'create' | 'edit'
 *   @var int|null    $userId
 *   @var array|null  $editUser
 *   @var array       $allRoles
 *   @var array       $users
 *   @var array       $userRoles
 *   @var string|null $error
 *   @var array|null  $formUser   (set inline for edit form)
 */

$pageTitle = match($action) {
    'create' => t('user.create'),
    'edit'   => t('user.edit'),
    default  => t('user.list'),
};
include WEBROOT_PATH . '/includes/header.php';
?>
<div class="admin-layout">
<?php include WEBROOT_PATH . '/includes/admin_sidebar.php'; ?>
<div class="admin-content">

<div class="page-header">
    <h1><?= t('user.list') ?></h1>
    <?php if ($action === 'list'): ?>
    <a href="?action=create" class="btn btn-primary"><?= t('user.create') ?></a>
    <?php endif; ?>
</div>

<?php if ($error): echo '<div class="alert alert-error">' . htmlspecialchars($error) . '</div>'; endif; ?>

<?php // ── LIST ──────────────────────────────────────────────────────────────
if ($action === 'list'): ?>

<table class="data-table">
    <thead>
        <tr>
            <th><?= t('auth.username') ?></th>
            <th><?= t('user.email') ?></th>
            <th><?= t('user.roles') ?></th>
            <th><?= t('auth.method') ?></th>
            <th><?= t('user.active') ?></th>
            <th><?= t('user.last_login') ?></th>
            <th><?= t('user.actions') ?></th>
        </tr>
    </thead>
    <tbody>
    <?php foreach ($users as $u): ?>
        <tr class="<?= !$u['active'] ? 'row-inactive' : '' ?>">
            <td><strong><?= htmlspecialchars($u['username']) ?></strong></td>
            <td><?= htmlspecialchars($u['email'] ?? '') ?></td>
            <td>
                <?php if (empty($u['roles'])): ?>
                    <em style="color:var(--color-text-muted)">—</em>
                <?php else: ?>
                    <?php foreach ($u['roles'] as $r): ?>
                        <?php $isAppAdmin = ($r === ROLE_APP_ADMIN); ?>
                        <span class="badge <?= $isAppAdmin ? 'badge-warning' : 'badge-info' ?>"
                              style="margin-right:.25rem;font-size:.72rem">
                            <?= htmlspecialchars(t('role.' . $r)) ?>
                        </span>
                    <?php endforeach; ?>
                <?php endif; ?>
            </td>
            <td><?= htmlspecialchars(t('auth.method_' . $u['auth_method'])) ?></td>
            <td>
                <?php if ($u['active']): ?>
                    <span class="badge badge-success"><?= t('user.active') ?></span>
                <?php else: ?>
                    <span class="badge badge-danger"><?= t('user.inactive') ?></span>
                <?php endif; ?>
            </td>
            <td><?= $u['last_login'] ? htmlspecialchars($u['last_login']) : t('user.never') ?></td>
            <td class="actions">
                <a href="?action=edit&id=<?= $u['id'] ?>" class="btn btn-sm btn-secondary">
                    <?= t('user.edit') ?>
                </a>
                <?php if ($u['id'] !== (int)Session::get('user_id')): ?>
                <form method="post" action="/admin/users.php"
                      onsubmit="return confirm('<?= htmlspecialchars(t('user.confirm_delete', ['username' => $u['username']])) ?>')">
                    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(Session::get('csrf_token')) ?>">
                    <input type="hidden" name="action"     value="delete">
                    <input type="hidden" name="user_id"    value="<?= $u['id'] ?>">
                    <button type="submit" class="btn btn-sm btn-danger"><?= t('user.delete') ?></button>
                </form>
                <?php endif; ?>
            </td>
        </tr>
    <?php endforeach; ?>
    </tbody>
</table>

<?php // ── CREATE FORM ───────────────────────────────────────────────────────
elseif ($action === 'create'): ?>

<h2><?= t('user.create') ?></h2>
<form method="post" action="/admin/users.php" class="edit-form">
    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(Session::get('csrf_token')) ?>">
    <input type="hidden" name="action"     value="create">

    <?php include __DIR__ . '/_user_form.php'; ?>

    <div class="form-actions">
        <button type="submit" class="btn btn-primary"><?= t('user.save') ?></button>
        <a href="/admin/users.php" class="btn btn-secondary"><?= t('user.cancel') ?></a>
    </div>
</form>

<?php // ── EDIT FORM ─────────────────────────────────────────────────────────
elseif ($action === 'edit' && $editUser): ?>

<h2><?= t('user.edit') ?> — <?= htmlspecialchars($editUser['username']) ?></h2>
<form method="post" action="/admin/users.php" class="edit-form">
    <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(Session::get('csrf_token')) ?>">
    <input type="hidden" name="action"     value="edit">
    <input type="hidden" name="user_id"    value="<?= $editUser['id'] ?>">

    <?php $formUser = $editUser; include __DIR__ . '/_user_form.php'; ?>

    <div class="form-group">
        <label for="password"><?= t('auth.password_new') ?> (<?= t('user.save') ?>?)</label>
        <input type="password" id="password" name="password" autocomplete="new-password">
        <small>Leave blank to keep current password.</small>
    </div>

    <div class="form-actions">
        <button type="submit" class="btn btn-primary"><?= t('user.save') ?></button>
        <a href="/admin/users.php" class="btn btn-secondary"><?= t('user.cancel') ?></a>
    </div>
</form>

<?php endif; ?>

</div><!-- .admin-content -->
</div><!-- .admin-layout -->

<?php include WEBROOT_PATH . '/includes/footer.php'; ?>
