<?php
$isEdit = is_array($user);
$form = $form ?? [];
$value = static function (string $key, string $default = '') use ($form, $user): string {
    if (array_key_exists($key, $form)) return (string) $form[$key];
    return is_array($user) ? (string) ($user[$key] ?? $default) : $default;
};
$selected = array_map('intval', is_array($form['roles'] ?? null) ? $form['roles'] : ($selectedRoles ?? []));
?>
<section class="page-header">
    <div><p class="eyebrow">Users</p><h1><?= $isEdit ? 'Edit User' : 'Create User' ?></h1><p><?= $isEdit ? 'Update account details, access status and roles.' : 'Create a secure CRM account.' ?></p></div>
    <a class="btn btn-secondary" href="/crm/public/users">Back to Users</a>
</section>
<?php if (!empty($error)): ?><div class="alert alert-danger" role="alert"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div><?php endif; ?>
<?php if (!empty($message)): ?><div class="alert alert-success" role="status"><?= htmlspecialchars($message, ENT_QUOTES, 'UTF-8') ?></div><?php endif; ?>
<section class="card form-card section-gap">
    <form method="post" action="<?= $isEdit ? '/crm/public/users/' . (int) $user['id'] . '/edit' : '/crm/public/users/create' ?>" class="form-stack">
        <input type="hidden" name="_csrf" value="<?= htmlspecialchars($csrf, ENT_QUOTES, 'UTF-8') ?>">
        <div class="grid grid-2">
            <label class="form-field"><span>Full name *</span><input required maxlength="150" type="text" name="full_name" value="<?= htmlspecialchars($value('full_name'), ENT_QUOTES, 'UTF-8') ?>"></label>
            <label class="form-field"><span>Email *</span><input required type="email" name="email" value="<?= htmlspecialchars($value('email'), ENT_QUOTES, 'UTF-8') ?>"></label>
            <label class="form-field"><span>Phone</span><input type="text" name="phone" maxlength="50" value="<?= htmlspecialchars($value('phone'), ENT_QUOTES, 'UTF-8') ?>"></label>
            <label class="form-field"><span>Status *</span><select name="status"><option value="active" <?= $value('status', 'active') === 'active' ? 'selected' : '' ?>>Active</option><option value="inactive" <?= $value('status') === 'inactive' ? 'selected' : '' ?>>Inactive</option></select></label>
            <label class="form-field"><span><?= $isEdit ? 'New password' : 'Password *' ?></span><input <?= $isEdit ? '' : 'required' ?> minlength="12" type="password" name="password" autocomplete="new-password"><small><?= $isEdit ? 'Leave blank to keep the current password.' : 'Minimum 12 characters.' ?></small></label>
            <div class="form-field"><span>Roles *</span><div class="role-options"><?php foreach ($roles as $role): ?><label class="check-option"><input type="checkbox" name="roles[]" value="<?= (int) $role['id'] ?>" <?= in_array((int) $role['id'], $selected, true) ? 'checked' : '' ?>><span><?= htmlspecialchars($role['display_name'], ENT_QUOTES, 'UTF-8') ?></span></label><?php endforeach; ?></div><small>Administrators can create and manage Therapist accounts only. Only a Super Admin can manage Administrator and Super Admin accounts.</small></div>
        </div>
        <div class="form-actions"><a class="btn btn-secondary" href="/crm/public/users">Cancel</a><button class="btn btn-primary" type="submit"><?= $isEdit ? 'Save changes' : 'Create user' ?></button></div>
    </form>
</section>
<?php if ($isEdit): ?><section class="card section-gap"><div class="card-header"><div><h2>Account information</h2><p>Security-sensitive fields are never displayed in plaintext.</p></div></div><div class="info-grid"><div><span>Created</span><strong><?= htmlspecialchars(date('d/m/Y H:i', strtotime($user['created_at'])), ENT_QUOTES, 'UTF-8') ?></strong></div><div><span>Last login</span><strong><?= $user['last_login_at'] ? htmlspecialchars(date('d/m/Y H:i', strtotime($user['last_login_at'])), ENT_QUOTES, 'UTF-8') : 'Never' ?></strong></div></div></section><?php endif; ?>
