@extends('layouts.internal')
@section('title',($managedUser?'Manage User':'Create User').' · PLOCAL Internal')
@section('content')
<a class="back-link" href="{{ route('internal.users.index') }}">← Internal Users</a>
<header class="page-heading"><div><p class="eyebrow">Administrator access control</p><h1>{{ $managedUser ? 'Manage Internal User' : 'Create Internal User' }}</h1><p>{{ $managedUser ? 'Update identity, roles, account state, and session access.' : 'Create a named account with one or more approved roles.' }}</p></div></header>
<section class="form-surface"><form method="post" action="{{ $managedUser ? route('internal.users.update',$managedUser->public_id) : route('internal.users.store') }}">@csrf @if($managedUser)@method('PUT')@endif
<div class="field"><label for="display_name">Display name</label><input id="display_name" name="display_name" value="{{ old('display_name',$managedUser?->display_name) }}" required @if($errors->has('display_name')) aria-invalid="true" aria-describedby="user-display-name-error" @endif>@error('display_name')<span class="field-error" id="user-display-name-error">{{ $message }}</span>@enderror</div>
@if(!$managedUser)
<div class="field"><label for="email">Email</label><input id="email" name="email" type="email" value="{{ old('email') }}" autocomplete="username" required @if($errors->has('email')) aria-invalid="true" aria-describedby="user-email-error" @endif>@error('email')<span class="field-error" id="user-email-error">{{ $message }}</span>@enderror</div>
<div class="two-fields"><div class="field"><label for="password">Temporary password</label><input id="password" name="password" type="password" autocomplete="new-password" required @if($errors->has('password')) aria-invalid="true" aria-describedby="user-password-error" @endif>@error('password')<span class="field-error" id="user-password-error">{{ $message }}</span>@enderror</div><div class="field"><label for="password_confirmation">Confirm password</label><input id="password_confirmation" name="password_confirmation" type="password" autocomplete="new-password" required></div></div>
@endif
<fieldset class="role-box" @if($errors->has('roles')) aria-describedby="user-roles-error" @endif><legend>Approved roles</legend>@foreach(['administrator'=>'Administrator','evaluator'=>'Evaluator','reviewer'=>'Reviewer'] as $code=>$label)<label><input name="roles[]" type="checkbox" value="{{ $code }}" @checked(in_array($code,old('roles',$selectedRoles))) @if($errors->has('roles')) aria-invalid="true" @endif> {{ $label }}</label>@endforeach @error('roles')<span class="field-error" id="user-roles-error">{{ $message }}</span>@enderror</fieldset>
@if($managedUser)<label class="check-line"><input name="must_change_password" type="checkbox" value="1" @checked(old('must_change_password',$managedUser->must_change_password))> Require password change</label>@else<label class="check-line"><input name="skip_password_change" type="checkbox" value="1" @checked(old('skip_password_change'))> Administrator confirms this account does not need a password change</label>@endif
<button class="button" type="submit">{{ $managedUser ? 'Save User Settings' : 'Create Internal User' }}</button></form>
@if($managedUser)<div class="account-actions"><h2>Account access</h2><p>These actions invalidate active authentication when access changes.</p>@if($managedUser->account_status==='active')<form method="post" action="{{ route('internal.users.disable',$managedUser->public_id) }}">@csrf<label class="check-line"><input name="confirm_disable" type="checkbox" value="1" required @if($errors->has('account')) aria-invalid="true" aria-describedby="user-account-error" @endif> Confirm that this account should be disabled and its sessions revoked.</label>@error('account')<span class="field-error" id="user-account-error">{{ $message }}</span>@enderror<button class="button danger" type="submit">Disable Account</button></form>@else<form method="post" action="{{ route('internal.users.enable',$managedUser->public_id) }}">@csrf<button class="button" type="submit">Enable Account</button></form>@endif<form method="post" action="{{ route('internal.users.revoke-sessions',$managedUser->public_id) }}">@csrf<button class="button secondary" type="submit">Revoke Active Sessions</button></form></div>@endif
</section>
@endsection
<script src="/assets/js/password-visibility.js" defer></script>