<?php
defined('BASEPATH') OR exit('No direct script access allowed');
class Roles extends MY_Admin_Controller
{
    private $features; private $actions;
    public function __construct()
    {
        parent::__construct();
        $this->config->load('permissions', true);
        $cfg = $this->config->item('permissions');
        $this->features = $cfg['permission_features']; $this->actions = $cfg['permission_actions'];
    }
    public function index()
    {
        $data = array('active_menu'=>'roles','roles'=>$this->db->order_by('is_super_admin','DESC')->order_by('is_system','DESC')->order_by('nama_role')->get('roles')->result(),'features'=>$this->features,'actions'=>$this->actions);
        $this->load->view('partials/header',$data);$this->load->view('roles/index',$data);$this->load->view('partials/footer');
    }
    public function detail($id)
    {
        $role=$this->db->get_where('roles',array('id'=>(int)$id))->row();if(!$role)return json_response(false,'Role tidak ditemukan.',array(),404);
        $role->permissions=json_decode($role->permissions,true)?:array();return json_response(true,'Role ditemukan.',array('result'=>(array)$role));
    }
    public function save()
    {
        $id=(int)$this->input->post('id');$name=trim((string)$this->input->post('name',true));$description=trim((string)$this->input->post('description',true));
        if($name===''||$description==='')return json_response(false,'Nama dan penjelasan tanggung jawab role wajib diisi.',array(),422);
        $existing=$id?$this->db->get_where('roles',array('id'=>$id))->row():null;
        if($id&&!$existing)return json_response(false,'Role tidak ditemukan.',array(),404);
        if($existing&&!empty($existing->is_super_admin))return json_response(false,'Permission Master Admin bersifat penuh dan tidak dapat dibatasi.',array(),422);
        $duplicate=$this->db->where('nama_role',$name)->where('id !=',$id)->count_all_results('roles');if($duplicate)return json_response(false,'Nama role sudah digunakan.',array(),422);
        $posted=(array)$this->input->post('permissions');$permissions=array();
        foreach($this->features as$key=>$label){$allowedActions=array_keys($this->actions);if($key==='payroll')$allowedActions=array_merge($allowedActions,array('can_manage_all_salary','can_manage_allowances'));$selected=array_values(array_intersect((array)(isset($posted[$key])?$posted[$key]:array()),$allowedActions));if($key==='payroll'&&in_array('can_manage_allowances',$selected,true)&&!in_array('can_update',$selected,true))$selected[]='can_update';if($selected){if(!in_array('can_view',$selected,true))array_unshift($selected,'can_view');$permissions[$key]=$selected;}}
        if(!$permissions)return json_response(false,'Role wajib mempunyai minimal satu permission.',array(),422);
        $data=array('nama_role'=>$name,'description'=>$description,'permissions'=>json_encode($permissions),'is_active'=>$this->input->post('is_active')?1:0,'updated_at'=>date('Y-m-d H:i:s'));
        if($id)$this->db->where('id',$id)->update('roles',$data);else{$data['is_system']=0;$data['is_super_admin']=0;$data['created_at']=date('Y-m-d H:i:s');$this->db->insert('roles',$data);$id=$this->db->insert_id();}
        log_activity('roles',$existing?'update':'create',($existing?'Mengubah':'Membuat').' role '.$name,'success');return json_response(true,'Role dan permission berhasil disimpan.',array('id'=>$id));
    }
    public function delete($id)
    {
        $role=$this->db->get_where('roles',array('id'=>(int)$id))->row();if(!$role)return json_response(false,'Role tidak ditemukan.',array(),404);
        if($role->is_system||$role->is_super_admin)return json_response(false,'Role bawaan aplikasi tidak dapat dihapus.',array(),422);
        if($this->db->where('role_id',$role->id)->count_all_results('users'))return json_response(false,'Role masih digunakan oleh pengguna.',array(),422);
        $this->db->where('id',$role->id)->delete('roles');return json_response(true,'Role custom berhasil dihapus.');
    }
}