{{--
    Shared user invite/edit form partial.
    Expects:
        $formAction   (string)         — route URL the form posts to
        $formMethod   ('POST'|'PUT')   — HTTP verb
        $user         (User|null)      — null when creating
        $currentIps   (string)         — pre-filled allowed IPs textarea
--}}
<form method="POST" action="{{ $formAction }}">
    @csrf
    @if($formMethod === 'PUT')
        @method('PUT')
    @endif

    {{-- Name --}}
    <div class="mb-4">
        <label class="label" for="user_name">Full Name</label>
        <input
            id="user_name"
            class="field"
            type="text"
            name="name"
            value="{{ old('name', $user?->name) }}"
            required
            maxlength="255"
            style="max-width:400px"
            placeholder="e.g. Jane Smith"
            autocomplete="name"
        >
    </div>

    {{-- Email --}}
    <div class="mb-4">
        <label class="label" for="user_email">Email Address</label>
        <input
            id="user_email"
            class="field"
            type="email"
            name="email"
            value="{{ old('email', $user?->email) }}"
            required
            maxlength="255"
            style="max-width:400px"
            placeholder="e.g. jane@example.com"
            autocomplete="email"
        >
    </div>

    {{-- Administrator Toggle --}}
    <div class="mb-4">
        <label class="label">Administrator</label>
        <label class="flex items-center gap-2" style="cursor:pointer;font-size:13.5px;padding:8px 0">
            <input
                type="hidden"
                name="is_admin"
                value="0"
            >
            <input
                type="checkbox"
                name="is_admin"
                value="1"
                id="is_admin_toggle"
                {{ old('is_admin', $user?->is_admin) ? 'checked' : '' }}
            >
            <span>
                Allow access-management screens
                <span class="pill pill-blue" style="margin-left:4px">is_admin</span>
            </span>
        </label>
        <p class="muted text-xs" style="margin-top:4px">
            Enabling this allows the user to manage users, roles, permissions, and page access.
        </p>
    </div>

    {{-- Roles --}}
    @php
        $roleOptions   = collect($roles ?? []);
        $selectedRoles = old('roles', $userRoles ?? []);
    @endphp
    <div class="mb-4">
        <label class="label">Roles</label>
        @if($roleOptions->isEmpty())
            <p class="muted text-xs" style="margin-top:4px">
                No roles exist yet — create one under
                <a href="{{ route('access.roles.index') }}">Roles</a> first.
            </p>
        @else
            <div style="display:flex;flex-direction:column;gap:4px;margin-top:4px">
                @foreach($roleOptions as $role)
                    <label class="flex items-center gap-2" style="cursor:pointer;font-size:13.5px;padding:4px 0">
                        <input
                            type="checkbox"
                            name="roles[]"
                            value="{{ $role->name }}"
                            {{ in_array($role->name, (array) $selectedRoles, true) ? 'checked' : '' }}
                        >
                        <span>{{ $role->name }}</span>
                    </label>
                @endforeach
            </div>
            <p class="muted text-xs" style="margin-top:6px">
                The user's sidebar pages come from the permissions on these roles.
                A user with no role (and no page permissions) has nothing to land on after signing in.
            </p>
        @endif
        @error('roles')<p class="text-xs" style="color:var(--red);margin-top:4px">{{ $message }}</p>@enderror
        @error('roles.*')<p class="text-xs" style="color:var(--red);margin-top:4px">{{ $message }}</p>@enderror
    </div>

    {{-- Allowed Login IPs --}}
    <div class="mb-4">
        <label class="label" for="allowed_login_ips">
            Allowed Login IPs
            @if(config('fortify.login_ip_check_enabled'))
                <span style="color:var(--red)">*</span>
            @endif
        </label>
        <textarea
            id="allowed_login_ips"
            class="field"
            name="allowed_login_ips"
            rows="4"
            style="max-width:400px;resize:vertical;font-family:monospace;font-size:13px"
            placeholder="One IP or CIDR per line, e.g.&#10;203.0.113.10&#10;203.0.113.0/24"
            @required(config('fortify.login_ip_check_enabled'))
        >{{ old('allowed_login_ips', $currentIps) }}</textarea>
        <p class="muted text-xs" style="margin-top:6px">
            Enter one IP address or CIDR range per line (commas also accepted).
            Supports exact IPs (e.g. <code>203.0.113.10</code>) and CIDR ranges (e.g. <code>203.0.113.0/24</code>).
            @if(config('fortify.login_ip_check_enabled'))
                <strong>This field is required</strong> — a user with no allowed IPs cannot log in.
            @else
                This field is optional because login IP checking is currently disabled in the environment.
            @endif
        </p>
    </div>

    <div class="flex gap-2 items-center mt-6">
        <button type="submit" class="btn btn-primary">
            {{ $user ? 'Save Changes' : 'Send Invitation' }}
        </button>
        <a href="{{ route('access.users.index') }}" class="btn">Cancel</a>
    </div>
</form>