<?php
use App\Core\Permission;
$canManage = Permission::can('administration.permissions.manage');
?>
<link rel="stylesheet" href="/public/assets/css/cda-security.css?v=7220">

<section class="security-hero">
    <div>
        <span class="security-kicker">Administration · Sécurité</span>
        <h2>Sécurité & autorisations</h2>
        <p>Une seule autorité relie les espaces, les menus, les routes et les permissions AXIOM.</p>
    </div>
    <div style="display:flex;gap:10px;flex-wrap:wrap">
        <a href="/public/administration/securite/supervision" class="security-btn security-btn-light">◉ Supervision</a>
        <a href="/public/administration/securite/zero-trust" class="security-btn security-btn-light">◈ Zero Trust</a>
        <a href="/public/administration/securite/mfa" class="security-btn security-btn-light">◎ MFA</a>
        <a href="/public/administration/securite/soc" class="security-btn security-btn-light">◆ Centre SOC</a>
        <a href="/public/administration/securite/siem" class="security-btn security-btn-light">▦ SIEM & SOC Pro</a>
        <a href="/public/administration/securite/ueba" class="security-btn security-btn-light">◇ Détection UEBA</a>
        <a href="/public/administration/securite/sessions" class="security-btn security-btn-light">⌁ Sessions actives</a>
        <a href="/public/administration/securite/integrite" class="security-btn security-btn-light">⛓ Intégrité audit</a>
        <a href="/public/administration/securite/journal" class="security-btn security-btn-light">☰ Journal d’audit</a>
    </div>
</section>

<section class="security-explainer">
    <div><strong>1</strong><span><b>Rôle</b><small>Droits communs au profil</small></span></div>
    <i>＋</i>
    <div><strong>2</strong><span><b>Exception utilisateur</b><small>Autorisation ou interdiction</small></span></div>
    <i>＝</i>
    <div><strong>3</strong><span><b>Droits effectifs</b><small>L’exception est prioritaire</small></span></div>
</section>

<div class="security-tabs">
    <button type="button" class="is-active" data-security-tab="roles">Rôles</button>
    <button type="button" data-security-tab="users">Utilisateurs internes</button>
</div>

<section data-security-panel="roles">
    <div class="security-grid">
        <?php foreach ($roles as $role): ?>
            <article class="security-card">
                <header>
                    <span class="security-card-icon">🛡</span>
                    <div>
                        <strong><?= htmlspecialchars($role['libelle']) ?></strong>
                        <small><?= htmlspecialchars($role['code']) ?></small>
                    </div>
                    <span class="security-status <?= (int)$role['actif'] === 1 ? 'is-on' : 'is-off' ?>">
                        <?= (int)$role['actif'] === 1 ? 'Actif' : 'Inactif' ?>
                    </span>
                </header>
                <div class="security-metrics">
                    <span><b><?= (int)$role['permission_count'] ?></b> permissions</span>
                    <span><b><?= (int)$role['user_count'] ?></b> utilisateurs</span>
                </div>
                <footer>
                    <a href="/public/administration/securite/role?id=<?= (int)$role['id'] ?>">
                        <?= $canManage ? 'Configurer les droits' : 'Consulter les droits' ?> →
                    </a>
                </footer>
            </article>
        <?php endforeach; ?>
    </div>
</section>

<section data-security-panel="users" hidden>
    <div class="security-toolbar">
        <label>
            <span>⌕</span>
            <input type="search" placeholder="Rechercher un utilisateur…" data-security-search>
        </label>
        <span><?= count($users) ?> compte<?= count($users) > 1 ? 's' : '' ?> hors portail habitant</span>
    </div>

    <div class="security-user-list">
        <?php foreach ($users as $account):
            $search = mb_strtolower(
                $account['nom'] . ' ' . $account['prenom'] . ' ' .
                $account['email'] . ' ' . ($account['roles'] ?? '')
            );
        ?>
            <a
                href="/public/administration/securite/utilisateur?id=<?= (int)$account['id'] ?>"
                data-security-user
                data-search="<?= htmlspecialchars($search) ?>"
            >
                <span class="security-avatar">
                    <?= htmlspecialchars(mb_strtoupper(
                        mb_substr($account['prenom'], 0, 1) .
                        mb_substr($account['nom'], 0, 1)
                    )) ?>
                </span>
                <div>
                    <strong><?= htmlspecialchars($account['prenom'] . ' ' . $account['nom']) ?></strong>
                    <small><?= htmlspecialchars($account['email']) ?></small>
                </div>
                <span class="security-role-label">
                    <?= htmlspecialchars($account['roles'] ?: 'Aucun rôle') ?>
                </span>
                <span class="security-override-count">
                    <?= (int)$account['override_count'] ?> exception<?= (int)$account['override_count'] > 1 ? 's' : '' ?>
                </span>
                <b>›</b>
            </a>
        <?php endforeach; ?>
    </div>
</section>

<script>
(() => {
    const tabs = [...document.querySelectorAll('[data-security-tab]')];
    const panels = [...document.querySelectorAll('[data-security-panel]')];

    tabs.forEach(tab => tab.addEventListener('click', () => {
        tabs.forEach(item => item.classList.toggle('is-active', item === tab));
        panels.forEach(panel => {
            panel.hidden = panel.dataset.securityPanel !== tab.dataset.securityTab;
        });
    }));

    const search = document.querySelector('[data-security-search]');
    const users = [...document.querySelectorAll('[data-security-user]')];

    search?.addEventListener('input', () => {
        const query = search.value.trim().toLocaleLowerCase('fr');
        users.forEach(user => {
            user.hidden = !user.dataset.search.includes(query);
        });
    });
})();
</script>
