{% extends "base.html" %}

{% block title %}{{ 'Edit User' if user else 'Invite User' }} - LSMC Hub{% endblock %}

{% block content %}
{% set user_euid = user.euid if user and user.euid is defined else (user.id if user else None) %}
<div class="page-header">
    <h1>{{ 'Edit User' if user else 'Invite User' }}</h1>
</div>

<div class="card" style="max-width: 800px;">
    <form method="post" action="{{ '/admin/users/' + user_euid|string + '/edit' if user else '/admin/users/create' }}">
        <input type="hidden" name="csrf_token" value="{{ csrf_token }}">
        {% if error %}
        <div class="alert alert-danger">
            {{ error }}
        </div>
        {% endif %}

        {% if user %}
        <div class="form-group">
            <label for="cognito_sub">Cognito Subject ID</label>
            <input
                type="text"
                id="cognito_sub"
                name="cognito_sub"
                value="{{ user.cognito_sub if user else '' }}"
                readonly
                disabled
            >
            <small class="text-muted">
                Auto-assigned when the user was invited
            </small>
        </div>
        {% endif %}

        <div class="form-group">
            <label for="email">Email *</label>
            <input 
                type="email" 
                id="email" 
                name="email" 
                value="{{ user.email if user else '' }}"
                required
            >
        </div>

        <div class="form-group">
            <label for="name">Full Name</label>
            <input 
                type="text" 
                id="name" 
                name="name" 
                value="{{ user.name if user else '' }}"
            >
        </div>

        <div class="form-group">
            <label for="tenant_id">Organization *</label>
            <select id="tenant_id" name="tenant_id" required {% if user %}disabled{% endif %}>
                <option value="">Select Organization</option>
                {% for org in organizations %}
                <option value="{{ org.euid }}"
                        {% if user and user.tenant_id|string == org.euid %}selected{% endif %}>
                    {{ org.display_name or org.name }}
                </option>
                {% endfor %}
            </select>
            {% if user %}
            <input type="hidden" name="tenant_id" value="{{ user.tenant_id }}">
            {% endif %}
        </div>

        <div class="form-group">
            <label>Roles *</label>

            <div style="margin-bottom: var(--space-sm);">
                <small class="text-muted" style="text-transform: uppercase; letter-spacing: 0.05em; font-weight: 600;">External Roles</small>
            </div>
            <div class="checkbox-group" style="margin-bottom: var(--space-lg);">
                <label class="checkbox-label">
                    <input
                        type="checkbox"
                        name="roles"
                        value="READ_ONLY"
                        {% if user and 'READ_ONLY' in user.roles %}checked{% endif %}
                    >
                    <span>Read Only</span>
                    <small class="text-muted">View-only access within own tenant (no create/modify)</small>
                </label>

                <label class="checkbox-label">
                    <input
                        type="checkbox"
                        name="roles"
                        value="READ_WRITE"
                        {% if user and 'READ_WRITE' in user.roles %}checked{% endif %}
                    >
                    <span>Read Write</span>
                    <small class="text-muted">Create and modify records within own tenant</small>
                </label>

                <label class="checkbox-label">
                    <input
                        type="checkbox"
                        name="roles"
                        value="EXTERNAL_USER"
                        {% if user and 'EXTERNAL_USER' in user.roles %}checked{% endif %}
                    >
                    <span>External User</span>
                    <small class="text-muted">External clinic/collaborator (same as Read Write, backward compat)</small>
                </label>

                <label class="checkbox-label">
                    <input
                        type="checkbox"
                        name="roles"
                        value="EXTERNAL_USER_ADMIN"
                        {% if user and 'EXTERNAL_USER_ADMIN' in user.roles %}checked{% endif %}
                    >
                    <span>External User Admin</span>
                    <small class="text-muted">Organization admin — manage users, tokens, and settings within tenant</small>
                </label>
            </div>

            <div style="border-top: 1px solid var(--border-color); margin-bottom: var(--space-sm); padding-top: var(--space-sm);">
                <small class="text-muted" style="text-transform: uppercase; letter-spacing: 0.05em; font-weight: 600;">Internal Roles</small>
            </div>
            <div class="checkbox-group">
                <label class="checkbox-label">
                    <input
                        type="checkbox"
                        name="roles"
                        value="INTERNAL_USER"
                        {% if user and 'INTERNAL_USER' in user.roles %}checked{% endif %}
                    >
                    <span>Internal User</span>
                    <small class="text-muted">LSMC staff with cross-tenant access and intake operations</small>
                </label>

                <label class="checkbox-label">
                    <input
                        type="checkbox"
                        name="roles"
                        value="ADMIN"
                        {% if user and 'ADMIN' in user.roles %}checked{% endif %}
                    >
                    <span>Admin</span>
                    <small class="text-muted">Full administrative access to all operations</small>
                </label>
            </div>
        </div>

        {% if user %}
        <div class="form-group">
            <label class="checkbox-label">
                <input 
                    type="checkbox" 
                    name="is_active" 
                    value="true"
                    {% if user.is_active %}checked{% endif %}
                >
                <span>Active</span>
            </label>
        </div>
        {% endif %}

        <div class="form-actions">
            <button type="submit" class="btn btn-primary">
                {{ 'Update User' if user else 'Invite User' }}
            </button>
            <a href="/admin/users" class="btn btn-secondary">Cancel</a>
        </div>
    </form>
</div>
{% endblock %}