const SETTINGS_API='./api/index.php';
const settingsCtx={csrf:'',user:null,data:null};
const settingsPages=['Overview','Offices','Vendors','Purchases','Assets','Inventory','Issue & transfers','Reports','Users & access','Settings'];
const settingsActions=[['office_create','Create offices'],['office_edit','Edit offices'],['vendor_create','Create vendors'],['vendor_edit','Edit vendors'],['category_create','Create categories'],['category_edit','Edit categories'],['category_delete','Delete categories'],['asset_create','Create assets'],['asset_edit','Edit assets'],['purchase_create','Create purchases'],['stock_create','Create inventory items'],['stock_edit','Edit inventory items'],['movement_create','Issue / transfer / return'],['record_status','Activate / deactivate records'],['record_delete','Delete unlinked records']];
const roleDefaults={admin:{pages:settingsPages,actions:settingsActions.map(x=>x[0])},store:{pages:['Overview','Vendors','Purchases','Assets','Inventory','Issue & transfers','Reports'],actions:['vendor_create','vendor_edit','asset_create','asset_edit','purchase_create','stock_create','stock_edit','movement_create']},office:{pages:['Overview','Assets','Issue & transfers'],actions:[]}};
const settingsEsc=v=>String(v??'').replace(/[&<>"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
const settingsActive=r=>Number(r?.active)!==0;
const settingsPage=()=>document.querySelector('.breadcrumb strong')?.textContent.trim()||'';
async function settingsApi(action,data){const r=await fetch(`${SETTINGS_API}?action=${action}`,{method:data?'POST':'GET',credentials:'same-origin',headers:data?{'Content-Type':'application/json','X-CSRF-Token':settingsCtx.csrf}:undefined,body:data?JSON.stringify(data):undefined});const j=await r.json().catch(()=>({error:'Server returned an invalid response.'}));if(j.csrf)settingsCtx.csrf=j.csrf;if(!r.ok)throw Error(j.error||'Request failed');return j;}
async function settingsLoad(){const s=await settingsApi('session');settingsCtx.user=s.user;if(!settingsCtx.user||settingsCtx.user.role!=='admin')return false;settingsCtx.data=(await settingsApi('data')).data;applyBusinessBranding(settingsCtx.data.settings);return true;}
function applyBusinessBranding(settings){const s=settings||{};const name=s.business_name?.trim()||'AssetDesk';const brand=document.querySelector('.brand');if(brand&&brand.firstChild)brand.firstChild.nodeValue=name;const workspace=document.querySelector('.workspace > div');if(workspace&&workspace.firstChild)workspace.firstChild.nodeValue=name;document.title=`${name} — Office Asset Management`;const icon=document.querySelector('.brand-icon');if(icon&&s.logo){icon.innerHTML=`<img src="${settingsEsc(s.logo)}" alt="${settingsEsc(name)} logo">`;icon.classList.add('has-business-logo');}}
function normalizedPermissions(user){let p=user?.permissions;if(typeof p==='string'){try{p=JSON.parse(p)}catch{p=null}}if(!p||typeof p!=='object')p=roleDefaults[user?.role]||roleDefaults.office;return {pages:Array.isArray(p.pages)?p.pages:[],actions:Array.isArray(p.actions)?p.actions:[]};}
function checkedOptions(options,selected,kind){return options.map(item=>{const key=Array.isArray(item)?item[0]:item;const label=Array.isArray(item)?item[1]:item;return `<label class="permission-option"><input type="checkbox" name="${kind}" value="${settingsEsc(key)}"><span>${settingsEsc(label)}</span></label>`}).join('');}
function settingsPanelMarkup(){return `<section class="settings-admin-panel" data-settings-panel><div class="settings-hero"><div><div class="eyebrow">ADMINISTRATION CENTER</div><h2>Business & access settings</h2><p>Apne business ki identity, users, roles aur form access yahan manage karein.</p></div><span class="settings-hero-badge">ADMIN ONLY</span></div><section class="settings-section"><div class="settings-section-heading"><div><h3>Business profile</h3><p>Yeh naam dashboard, sidebar aur browser title par show hoga.</p></div></div><form class="business-form"><div class="settings-form-grid"><label class="crud-field">Business name<input name="business_name" maxlength="180" required></label><label class="crud-field">Business phone<input name="business_phone" maxlength="40" placeholder="+92 ..."></label><label class="crud-field">Business email<input name="business_email" type="email" maxlength="190"></label><label class="crud-field settings-wide">Business address<textarea name="business_address" maxlength="300" rows="2"></textarea></label><label class="crud-field settings-wide">Logo<input name="logo_file" type="file" accept="image/png,image/jpeg,image/webp,image/svg+xml"><small class="settings-hint">PNG, JPG, WEBP ya SVG. Max 800 KB.</small></label></div><div class="logo-preview-wrap"><div class="logo-preview" data-logo-preview><span>Logo preview</span></div><p class="settings-hint">Logo optional hai. Save karne ke baad sidebar aur dashboard branding update ho jayegi.</p></div><p class="settings-message" data-business-message></p><button class="primary" type="submit">Save business profile</button></form></section><section class="settings-section"><div class="settings-section-heading"><div><h3>User accounts & permissions</h3><p>Har user ke liye role, visible pages aur create/edit/delete rights define karein.</p></div><button class="primary" type="button" data-add-user>+ Create user</button></div><div class="settings-table-wrap"><table class="settings-users-table"><thead><tr><th>USER</th><th>ROLE</th><th>OFFICE</th><th>STATUS</th><th>ACCESS</th><th>ACTIONS</th></tr></thead><tbody data-users-body></tbody></table></div></section><section class="settings-section"><div class="settings-section-heading"><div><h3>Role guide</h3><p>Role defaults apply jab user ke liye custom permissions select na ki jayein.</p></div></div><div class="role-guide"><article><strong>Administrator</strong><span>Complete business, user, record aur settings access.</span></article><article><strong>Store operator</strong><span>Purchases, vendors, assets, inventory aur movements.</span></article><article><strong>Office viewer</strong><span>Assigned office ke records read-only mode mein.</span></article></div></section></section>`;}
function officeName(id){return (settingsCtx.data?.offices||[]).find(o=>Number(o.id)===Number(id))?.name||'All offices';}
function renderUsers(panel){const body=panel.querySelector('[data-users-body]');const users=settingsCtx.data?.users||[];body.innerHTML=users.length?users.map(u=>{const p=normalizedPermissions(u);return `<tr><td><strong>${settingsEsc(u.name)}</strong><small>${settingsEsc(u.email)}</small></td><td><span class="role-pill role-${settingsEsc(u.role)}">${settingsEsc(u.role)}</span></td><td>${settingsEsc(officeName(u.office_id))}</td><td><span class="category-status ${settingsActive(u)?'is-active':'is-inactive'}">${settingsActive(u)?'Active':'Inactive'}</span></td><td><span class="access-count">${p.pages.length} pages · ${p.actions.length} rights</span></td><td><div class="settings-user-actions"><button type="button" class="crud-button edit" data-user-action="edit" data-id="${u.id}">Edit</button><button type="button" class="crud-button toggle" data-user-action="toggle" data-id="${u.id}">${settingsActive(u)?'Deactivate':'Activate'}</button><button type="button" class="crud-button" data-user-action="reset" data-id="${u.id}">Reset password</button><button type="button" class="crud-button delete" data-user-action="delete" data-id="${u.id}">Delete</button></div></td></tr>`}).join(''):'<tr><td colspan="6" class="settings-empty">No users found. Create the first user above.</td></tr>';}
function setBusinessForm(panel){const s=settingsCtx.data?.settings||{};const form=panel.querySelector('.business-form');for(const key of ['business_name','business_phone','business_email','business_address']){const input=form.elements[key];if(input)input.value=s[key]||'';}const preview=panel.querySelector('[data-logo-preview]');if(s.logo){preview.innerHTML=`<img src="${settingsEsc(s.logo)}" alt="Current business logo">`}else preview.innerHTML='<span>No logo selected</span>';}
function openUserEditor(user){const editing=!!user;const initialRole=user?.role||'store';const perms=normalizedPermissions(user||{role:initialRole});const offices=(settingsCtx.data?.offices||[]).filter(settingsActive);const root=document.createElement('div');root.className='settings-user-backdrop';root.innerHTML=`<section class="settings-user-modal" role="dialog" aria-modal="true"><button type="button" class="settings-modal-close">×</button><div class="crud-kicker">USER ACCESS CONTROL</div><h2>${editing?'Edit user':'Create user'}</h2><p class="settings-modal-help">Role pages ko visible rakhta hai aur rights se forms/actions control hote hain.</p><form class="settings-user-form"><div class="settings-form-grid"><label class="crud-field">Full name<input name="name" maxlength="160" required></label><label class="crud-field">Email<input name="email" type="email" maxlength="190" required></label><label class="crud-field">Role<select name="role" required><option value="admin">Administrator</option><option value="store">Store operator</option><option value="office">Office viewer</option></select></label><label class="crud-field" data-office-field>Assigned office<select name="office_id"><option value="">Select office</option>${offices.map(o=>`<option value="${o.id}">${settingsEsc(o.name)}</option>`).join('')}</select></label>${editing?'<label class="crud-field">Account status<select name="active"><option value="1">Active</option><option value="0">Inactive</option></select></label>':'<label class="crud-field">Temporary password<input name="password" type="password" minlength="12" required><small class="settings-hint">Kam az kam 12 characters.</small></label>'}</div><div class="permission-toolbar"><strong>Permission selection</strong><button type="button" class="secondary" data-apply-role-defaults>Apply role defaults</button></div><div class="permission-block"><h4>Visible pages / menu</h4><div class="permission-grid" data-page-options>${checkedOptions(settingsPages,perms.pages,'pages')}</div></div><div class="permission-block"><h4>Forms & actions</h4><div class="permission-grid" data-action-options>${checkedOptions(settingsActions,perms.actions,'actions')}</div></div><p class="settings-message" data-user-message></p><div class="settings-modal-actions"><button type="button" class="secondary settings-modal-cancel">Cancel</button><button class="primary" type="submit">${editing?'Save changes':'Create user'}</button></div></form></section>`;document.body.append(root);const modal=root.firstElementChild;const form=modal.querySelector('form');const close=()=>root.remove();modal.querySelector('.settings-modal-close').onclick=close;modal.querySelector('.settings-modal-cancel').onclick=close;root.addEventListener('click',e=>{if(e.target===root)close()});const role=form.elements.role;const office=form.elements.office_id;const syncOffice=()=>{const isOffice=role.value==='office';modal.querySelector('[data-office-field]').hidden=!isOffice;office.required=isOffice;if(!isOffice)office.value='';};const setChecks=(name,values)=>modal.querySelectorAll(`input[name="${name}"]`).forEach(input=>input.checked=values.includes(input.value));const applyDefaults=()=>{const d=roleDefaults[role.value]||roleDefaults.store;setChecks('pages',d.pages);setChecks('actions',d.actions);};form.elements.name.value=user?.name||'';form.elements.email.value=user?.email||'';role.value=initialRole;if(editing){form.elements.active.value=settingsActive(user)?'1':'0';office.value=user.office_id||'';}role.onchange=syncOffice;modal.querySelector('[data-apply-role-defaults]').onclick=applyDefaults;syncOffice();form.onsubmit=async e=>{e.preventDefault();const button=form.querySelector('button[type="submit"]');const message=modal.querySelector('[data-user-message]');button.disabled=true;message.textContent='';const payload={name:form.elements.name.value,email:form.elements.email.value,role:role.value,office_id:office.value,permissions:JSON.stringify({pages:[...modal.querySelectorAll('input[name="pages"]:checked')].map(x=>x.value),actions:[...modal.querySelectorAll('input[name="actions"]:checked')].map(x=>x.value)})};if(editing){payload.id=user.id;payload.active=form.elements.active.value;}else payload.password=form.elements.password.value;try{await settingsApi(editing?'user_update':'user',payload);close();await refreshSettings();}catch(err){message.textContent=err.message;button.disabled=false;}};}
async function resetUser(user){const password=window.prompt('New password (minimum 12 characters)');if(password===null)return;if(password.length<12){window.alert('Password minimum 12 characters ka hona chahiye.');return;}try{await settingsApi('reset',{id:user.id,password});await refreshSettings();window.alert('Password reset ho gaya.');}catch(e){window.alert(e.message);}}
async function userAction(panel,e){const button=e.target.closest('[data-user-action]');if(!button)return;const user=(settingsCtx.data?.users||[]).find(u=>String(u.id)===button.dataset.id);if(!user)return;try{const action=button.dataset.userAction;if(action==='edit'){openUserEditor(user);return}if(action==='reset'){await resetUser(user);return}if(action==='toggle'){const next=!settingsActive(user);if(!window.confirm(`${next?'Activate':'Deactivate'} this user?`))return;await settingsApi('set_active',{entity:'user',id:user.id,active:next?'1':'0'});}if(action==='delete'){if(!window.confirm('Delete this user permanently? Linked history will block deletion.'))return;await settingsApi('delete_record',{entity:'user',id:user.id});}await refreshSettings();}catch(err){window.alert(err.message);}}
async function readLogo(file){if(!file)return settingsCtx.data?.settings?.logo||'';if(file.size>800000)throw Error('Logo file 800 KB se choti honi chahiye.');return new Promise((resolve,reject)=>{const reader=new FileReader();reader.onload=()=>resolve(reader.result);reader.onerror=()=>reject(Error('Logo read nahi ho saka.'));reader.readAsDataURL(file);});}
function wireBusiness(panel){const form=panel.querySelector('.business-form');form.onsubmit=async e=>{e.preventDefault();const button=form.querySelector('button[type="submit"]');const message=panel.querySelector('[data-business-message]');button.disabled=true;message.textContent='';try{const file=form.elements.logo_file.files[0];const payload={business_name:form.elements.business_name.value,business_phone:form.elements.business_phone.value,business_email:form.elements.business_email.value,business_address:form.elements.business_address.value,logo:await readLogo(file)};await settingsApi('settings_update',payload);await refreshSettings();message.textContent='Business profile save ho gaya.';}catch(err){message.textContent=err.message}finally{button.disabled=false;}};}
async function refreshSettings(){if(!(await settingsLoad()))return;const old=document.querySelector('[data-settings-panel]');if(old){const fresh=document.createElement('div');fresh.innerHTML=settingsPanelMarkup();const panel=fresh.firstElementChild;old.replaceWith(panel);renderUsers(panel);setBusinessForm(panel);wireBusiness(panel);}}
function enhanceSettings(){if(!settingsCtx.user||settingsCtx.user.role!=='admin'||settingsPage()!=='Settings')return;let panel=document.querySelector('[data-settings-panel]');if(!panel){const old=document.querySelector('section.settings');if(!old)return;const holder=document.createElement('div');holder.innerHTML=settingsPanelMarkup();panel=holder.firstElementChild;old.replaceWith(panel);renderUsers(panel);setBusinessForm(panel);wireBusiness(panel);}if(panel&&!panel.dataset.settingsEvents){panel.dataset.settingsEvents='1';panel.querySelector('[data-add-user]').onclick=()=>openUserEditor(null);panel.addEventListener('click',e=>userAction(panel,e));}}
const settingsObserver=new MutationObserver(()=>requestAnimationFrame(enhanceSettings));settingsObserver.observe(document.body,{childList:true,subtree:true});
setInterval(async()=>{if(!settingsCtx.user){if(await settingsLoad())enhanceSettings();}else{applyBusinessBranding(settingsCtx.data?.settings);enhanceSettings();}},1500);
settingsLoad().then(enhanceSettings).catch(()=>{});