<?php $locked = (bool) $role['is_system']; ?>
<a href="<?= Router::url('admin/roles') ?>" style="font-size:13px;color:var(--color-text-muted);"><i class="fa-solid fa-arrow-left"></i> Back to Roles</a>

<div class="panel" style="margin-top:14px;">
<?php if ($locked): ?>
<div class="alert alert-success"><i class="fa-solid fa-lock"></i> This is a system role — it always has full access to every module and can't be changed.</div>
<?php endif; ?>

<form method="POST" action="<?= Router::url('admin/roles/permissions/save') ?>">
    <?= $csrf ?>
    <input type="hidden" name="role_id" value="<?= $role['id'] ?>">
    <div style="overflow-x:auto;">
    <table class="data-table">
    <thead>
    <tr><th>Module</th><th style="text-align:center;">View</th><th style="text-align:center;">Add</th><th style="text-align:center;">Edit</th><th style="text-align:center;">Delete</th></tr>
    </thead>
    <tbody>
    <?php foreach ($matrix as $row): ?>
    <tr>
        <td><?= e($row['module_label']) ?></td>
        <?php foreach (['view','add','edit','delete'] as $action): ?>
        <td style="text-align:center;">
            <input type="checkbox"
                name="perm[<?= $row['permission_id'] ?>][<?= $action ?>]"
                value="1"
                <?= $row['can_' . $action] ? 'checked' : '' ?>
                <?= $locked ? 'disabled' : '' ?>>
        </td>
        <?php endforeach; ?>
    </tr>
    <?php endforeach; ?>
    </tbody>
    </table>
    </div>

    <?php if (!$locked): ?>
    <button type="submit" class="btn btn-primary" style="margin-top:18px;"><i class="fa-solid fa-floppy-disk"></i> Save Permissions</button>
    <?php endif; ?>
</form>
</div>
