<?= $this->extend('layouts/enterprise') ?>

<?= $this->section('content') ?>

<section class="enterprise-workspace-hero">
    <div class="enterprise-workspace-crumb">
        <span class="enterprise-crumb-pill">Administration</span>
        <span class="enterprise-crumb-sep">/</span>
        <span class="enterprise-crumb-current">Modules & Security</span>
    </div>
    <h1 class="enterprise-workspace-title">Company Modules & Security Settings</h1>
    <p class="enterprise-workspace-desc">
        Choose which modules are available for your company and configure security policies
        such as TPIN (Transaction PIN) requirements for sensitive actions.
    </p>
</section>

<?php if (session()->getFlashdata('success')): ?>
    <div class="alert alert-success py-2 small enterprise-alert"><?= esc(session()->getFlashdata('success')) ?></div>
<?php endif; ?>

<?php if (session()->getFlashdata('errors')): ?>
    <div class="alert alert-danger py-2 small enterprise-alert">
        <ul class="mb-0 ps-3">
            <?php foreach ((array) session()->getFlashdata('errors') as $err): ?>
                <li><?= esc(is_array($err) ? implode(', ', $err) : $err) ?></li>
            <?php endforeach; ?>
        </ul>
    </div>
<?php endif; ?>

<form action="<?= base_url('settings/modules') ?>" method="post" novalidate>
    <?= csrf_field() ?>

    <div class="enterprise-settings-grid">
        <div class="enterprise-settings-main">
            <article class="enterprise-settings-card">
                <div class="enterprise-settings-card__head">
                    <i class="fa-solid fa-puzzle-piece"></i>
                    <h2 class="enterprise-settings-card__title">Enabled Modules</h2>
                </div>
                <p class="enterprise-settings-card__intro">
                    Turn modules on or off for your company. Disabled modules are hidden from navigation
                    and their routes are blocked for all users.
                </p>

                <div class="enterprise-module-list">
                    <?php foreach ($modules as $key => $module): ?>
                        <label class="enterprise-module-item<?= $module['is_core'] ? ' enterprise-module-item--core' : '' ?>">
                            <input
                                type="checkbox"
                                name="modules[<?= esc($key) ?>]"
                                value="1"
                                <?= $module['is_enabled'] ? 'checked' : '' ?>
                                <?= $module['is_core'] ? 'checked disabled' : '' ?>
                            >
                            <span class="enterprise-module-item__icon">
                                <i class="fa-solid <?= esc($module['icon']) ?>"></i>
                            </span>
                            <span class="enterprise-module-item__body">
                                <span class="enterprise-module-item__title">
                                    <?= esc($module['label']) ?>
                                    <?php if ($module['is_core']): ?>
                                        <span class="badge bg-secondary ms-1">Core</span>
                                    <?php endif; ?>
                                </span>
                                <span class="enterprise-module-item__desc"><?= esc($module['description']) ?></span>
                            </span>
                        </label>
                    <?php endforeach; ?>
                </div>
            </article>

            <article class="enterprise-settings-card">
                <div class="enterprise-settings-card__head">
                    <i class="fa-solid fa-shield-halved"></i>
                    <h2 class="enterprise-settings-card__title">TPIN & Security Policy</h2>
                </div>
                <p class="enterprise-settings-card__intro">
                    Configure Transaction PIN (TPIN) behavior for your company. Users set their own PIN
                    in their profile; you control whether TPIN is required and lockout rules here.
                </p>

                <div class="enterprise-settings-fields enterprise-settings-fields--single">
                    <div class="enterprise-field">
                        <div class="form-check form-switch">
                            <input
                                class="form-check-input"
                                type="checkbox"
                                role="switch"
                                id="tpin_enabled"
                                name="tpin_enabled"
                                value="1"
                                <?= old('tpin_enabled', $company['tpin_enabled'] ?? 1) ? 'checked' : '' ?>
                            >
                            <label class="form-check-label enterprise-field-label" for="tpin_enabled">
                                Enable TPIN for this company
                            </label>
                        </div>
                        <small class="text-muted">When disabled, TPIN confirmation is not required anywhere.</small>
                    </div>

                    <div class="enterprise-field">
                        <div class="form-check form-switch">
                            <input
                                class="form-check-input"
                                type="checkbox"
                                role="switch"
                                id="tpin_required_by_default"
                                name="tpin_required_by_default"
                                value="1"
                                <?= old('tpin_required_by_default', $company['tpin_required_by_default'] ?? 0) ? 'checked' : '' ?>
                            >
                            <label class="form-check-label enterprise-field-label" for="tpin_required_by_default">
                                Require TPIN for new users by default
                            </label>
                        </div>
                        <small class="text-muted">Individual user TPIN requirements can still be managed per user.</small>
                    </div>

                    <div class="enterprise-field">
                        <label class="enterprise-field-label" for="tpin_max_failed_attempts">Max Failed TPIN Attempts</label>
                        <input
                            type="number"
                            id="tpin_max_failed_attempts"
                            name="tpin_max_failed_attempts"
                            class="form-control"
                            min="3"
                            max="10"
                            value="<?= esc(old('tpin_max_failed_attempts', $company['tpin_max_failed_attempts'] ?? 5)) ?>"
                        >
                    </div>

                    <div class="enterprise-field">
                        <label class="enterprise-field-label" for="tpin_lockout_minutes">Lockout Duration (minutes)</label>
                        <input
                            type="number"
                            id="tpin_lockout_minutes"
                            name="tpin_lockout_minutes"
                            class="form-control"
                            min="5"
                            max="60"
                            value="<?= esc(old('tpin_lockout_minutes', $company['tpin_lockout_minutes'] ?? 15)) ?>"
                        >
                    </div>
                </div>

                <div class="enterprise-settings-card__footer">
                    <button type="submit" class="btn btn-primary">
                        Save Module & Security Settings
                    </button>
                    <a href="<?= base_url('settings') ?>" class="btn btn-outline-secondary ms-2">Back to Settings</a>
                </div>
            </article>
        </div>

        <aside class="enterprise-settings-aside">
            <article class="enterprise-settings-card">
                <div class="enterprise-settings-card__head">
                    <i class="fa-solid fa-circle-info"></i>
                    <h2 class="enterprise-settings-card__title">How It Works</h2>
                </div>
                <p class="enterprise-settings-card__intro">
                    When setting up your company, enable only the modules you need. For example, if you
                    do not use Transport, turn it off and it will disappear from the menu for everyone.
                </p>
                <ul class="small text-muted ps-3 mb-0">
                    <li class="mb-2">Administration is always enabled and cannot be turned off.</li>
                    <li class="mb-2">Users still need role permissions to access enabled modules.</li>
                    <li class="mb-2">TPIN is a step-up PIN users set in Profile → TPIN.</li>
                    <li>Manage individual user TPIN requirements from the Users screen.</li>
                </ul>
            </article>

            <article class="enterprise-settings-card">
                <div class="enterprise-settings-card__head">
                    <i class="fa-solid fa-building"></i>
                    <h2 class="enterprise-settings-card__title">Company Profile</h2>
                </div>
                <p class="enterprise-settings-card__intro">
                    Need to update company name, logo, or currency? Use the company profile settings.
                </p>
                <div class="enterprise-settings-card__footer">
                    <a href="<?= base_url('settings/company') ?>" class="btn btn-sm btn-outline-secondary w-100">
                        Edit Company Profile
                    </a>
                </div>
            </article>
        </aside>
    </div>
</form>

<?= $this->endSection() ?>
