<?php
declare(strict_types=1);

require_once __DIR__ . '/includes/iscms_layout.php';

$conn = iscms_init();
iscms_require_roles(['SUPER_ADMIN', 'ADMIN']);

$pageTitle = 'Role permissions';
$activeNav = 'users';

$sql = "SELECT rp.granted_at,
               r.role_name, r.role_code,
               p.permission_key, p.module, p.action,
               CONCAT(TRIM(u.first_name),' ',TRIM(u.last_name)) AS granted_by_name
        FROM role_permissions rp
        INNER JOIN roles r ON rp.role_id = r.id
        INNER JOIN permissions p ON rp.permission_id = p.id
        LEFT JOIN users u ON rp.granted_by = u.id
        ORDER BY r.role_name ASC, p.module ASC, p.permission_key ASC
        LIMIT 2000";
$result = $conn->query($sql);
$rows = $result ? $result->fetch_all(MYSQLI_ASSOC) : [];
$dbError = $result ? null : $conn->error;

iscms_render_head($pageTitle);
iscms_render_sidebar($activeNav);
iscms_render_topbar($pageTitle);
?>
    <div class="page-header">
        <h1>Role permissions</h1>
        <p>Mapping of permission keys to roles.</p>
    </div>

    <div class="section-card mb-4">
        <div class="section-header">
            <h2><i class="ri-links-line"></i> Related</h2>
        </div>
        <div class="quick-actions">
            <a class="qa-btn" href="user_roles.php"><i class="ri-shield-user-line"></i> Roles</a>
            <a class="qa-btn" href="permissions.php"><i class="ri-lock-unlock-line"></i> Permissions catalogue</a>
            <a class="qa-btn" href="list_users.php"><i class="ri-team-line"></i> Users</a>
        </div>
    </div>

    <div class="section-card">
        <div class="section-header">
            <h2><i class="ri-key-2-line"></i> Grants</h2>
            <span class="text-muted" style="font-size:.75rem"><?= count($rows) ?> shown</span>
        </div>
        <div class="table-responsive">
            <?php if ($dbError): ?>
                <div class="alert alert-danger m-3" style="font-size:.85rem">Unable to load data: <?= iscms_h($dbError) ?></div>
            <?php else: ?>
            <table class="ssbs-table">
                <thead>
                    <tr>
                        <th>Role</th>
                        <th>Module</th>
                        <th>Permission</th>
                        <th>Action</th>
                        <th>Granted by</th>
                        <th>Granted at</th>
                    </tr>
                </thead>
                <tbody>
                    <?php if (empty($rows)): ?>
                    <tr class="empty-row"><td colspan="6"><i class="ri-inbox-line me-2"></i>No role permissions</td></tr>
                    <?php else: ?>
                        <?php foreach ($rows as $r): ?>
                        <tr>
                            <td><small><strong><?= iscms_h($r['role_name']) ?></strong> <span class="text-muted iscms-mono">(<?= iscms_h($r['role_code']) ?>)</span></small></td>
                            <td><small><?= iscms_h((string) ($r['module'] ?? '')) ?></small></td>
                            <td class="iscms-mono"><small><?= iscms_h($r['permission_key']) ?></small></td>
                            <td><small><?= iscms_h((string) ($r['action'] ?? '')) ?></small></td>
                            <td><small><?= iscms_val(trim((string) ($r['granted_by_name'] ?? '')) ?: null) ?></small></td>
                            <td><small class="text-muted"><?= !empty($r['granted_at']) ? iscms_h(substr((string) $r['granted_at'], 0, 19)) : '-' ?></small></td>
                        </tr>
                        <?php endforeach; ?>
                    <?php endif; ?>
                </tbody>
            </table>
            <?php endif; ?>
        </div>
    </div>
<?php
iscms_render_footer();
