{#
  GET /permissions/grants — crate::pages::permissions::grants::ui::GrantsTemplate

  One matrix per profile: objects down the side, actions across the top. Every
  button on the page — a single cell, a whole row, a whole profile, everything —
  posts the same form to /permissions/grants/apply and differs only in the list
  of object|action pairs it carries. The lists are built in Rust
  (grants::state), so the page never asks the server to work out what "all"
  meant.
#}
{% extends "ui/base.html" %}

{% block title %}Access{% endblock %}

{% macro apply(role, mode, pairs, label, style, hint) %}
<form hx-post="/permissions/grants/apply" hx-target="#permission-status">
  <input type="hidden" name="role" value="{{ role }}">
  <input type="hidden" name="mode" value="{{ mode }}">
  {% for pair in pairs %}<input type="hidden" name="pair" value="{{ pair }}">{% endfor %}
  <button type="submit" class="{{ style }}" title="{{ hint }}">{{ label }}</button>
</form>
{% endmacro %}

{% block content %}
<main>
  <section class="heading">
    <div>
      <p class="eyebrow">Permissions</p>
      <h1>Access</h1>
      <p>What a role may do with the data. Everyone holding the role gets exactly this.</p>
    </div>
  </section>

  {% include "pages/permissions/tabs.html" %}

  {% if page.updated %}<p class="notice">Access updated. It applies to the next request every holder of the role makes.</p>{% endif %}

  {% if page.roles.is_empty() %}
    <section class="panel">
      <h2>No role to edit</h2>
      <p class="hint">There is no role here you outrank. <a href="/permissions/roles">Create one</a> first.</p>
    </section>
  {% else %}

  <section class="panel">
    <h2>Role</h2>
    <form method="get" action="/permissions/grants" class="form-grid">
      <label>Editing
        <select name="role" onchange="this.form.submit()">
          {% for role in page.roles %}
          <option value="{{ role.name }}" {% if page.selected(role.name.as_str()) %}selected{% endif %}>{{ role.name }}{% if !role.parent.is_empty() %} → inherits {{ role.parent }}{% endif %}</option>
          {% endfor %}
        </select>
      </label>
    </form>
    <p class="hint">
      {% if !page.selected_parent.is_empty() %}
        <strong>{{ page.selected_role }}</strong> inherits everything <strong>{{ page.selected_parent }}</strong> has. Inherited access shows below but is changed on the parent.
      {% else %}
        <strong>{{ page.selected_role }}</strong> inherits from nothing, so what you see below is all it has.
      {% endif %}
      {% if page.selected_is_structural %}
        This role designs the system and may never write row data, so only the read column is open.
      {% endif %}
    </p>

    <h3 class="panel-subhead">Shortcuts</h3>
    <p class="hint">These grant the wildcard objects, so they keep covering profiles and tables created later.</p>
    <div class="actions shortcut-row">
      {% call apply(page.selected_role, "grant", page.everything_read_pairs(), "Read everything", "secondary", "Read on every profile, journal and exchange rate") %}{% endcall %}
      {% call apply(page.selected_role, "grant", page.everything_pairs(), "Full access to everything", "secondary", "Every action the role may hold, on every profile") %}{% endcall %}
      {% if page.has_direct() %}
        {% call apply(page.selected_role, "revoke", page.direct_pairs(), "Remove all access", "danger", "Revoke every grant this role holds directly") %}{% endcall %}
      {% endif %}
    </div>
  </section>

  {% for group in page.groups %}
  <section class="panel">
    <h2>{% if group.global %}Everything, everywhere{% else %}Profile: {{ group.title }}{% endif %}<span class="count">{{ group.rows.len() }}</span></h2>
    <div class="actions shortcut-row">
      {% if group.has_wildcards() %}
        {% call apply(page.selected_role, "grant", group.read_pairs(), "Read only", "secondary", "Read on everything in here") %}{% endcall %}
        {% call apply(page.selected_role, "grant", group.all_pairs(), "Full access", "secondary", "Every action the role may hold, on everything in here") %}{% endcall %}
      {% endif %}
      {% if group.has_direct() %}
        {% call apply(page.selected_role, "revoke", group.direct_pairs(), "Clear", "danger", "Revoke everything this role holds directly in here") %}{% endcall %}
      {% endif %}
    </div>

    <div class="table-scroll">
      <table class="builder-table grant-matrix">
        <thead>
          <tr>
            <th>Object</th>
            {% for action in page.actions() %}<th>{{ action }}</th>{% endfor %}
            <th>Row</th>
          </tr>
        </thead>
        <tbody>
          {% for row in group.rows %}
          <tr>
            <td>
              <span class="object-label">{{ row.label }}</span>
              {% if !row.note.is_empty() %}<small>{{ row.note }}</small>{% endif %}
              <code>{{ row.object }}</code>
            </td>
            {% for cell in row.cells %}
            <td class="grant-cell">
              {% if !cell.allowed %}
                <span class="cell-closed" title="Not available for this role">·</span>
              {% else if cell.direct %}
                {% call apply(page.selected_role, "revoke", row.one_pair(cell.action.as_str()), "✓", "cell-on", "Held directly — click to revoke") %}{% endcall %}
              {% else if cell.inherited %}
                <span class="cell-inherited" title="inherited: covered by the parent role or a wider grant">↑</span>
              {% else %}
                {% call apply(page.selected_role, "grant", row.one_pair(cell.action.as_str()), "+", "cell-off", "Click to grant") %}{% endcall %}
              {% endif %}
            </td>
            {% endfor %}
            <td class="grant-cell">
              <div class="actions">
                {% call apply(page.selected_role, "grant", row.all_pairs(), "All", "secondary", "Grant every action available on this object") %}{% endcall %}
                {% if row.has_direct() %}
                  {% call apply(page.selected_role, "revoke", row.direct_pairs(), "None", "danger", "Revoke this object's direct grants") %}{% endcall %}
                {% endif %}
              </div>
            </td>
          </tr>
          {% endfor %}
        </tbody>
      </table>
    </div>
  </section>
  {% endfor %}
  {% endif %}

  <div id="permission-status" aria-live="polite"></div>
</main>
{% endblock %}