@extends('hms.layout')
@section('title','Microsoft staff sign-in')
@section('content')
<div class="card p-3 mb-3"><h1 class="h4">Microsoft sign-in · {{ $organization->name }}</h1>
<p>Connect this organisation's Microsoft Entra tenant and link existing staff accounts. Microsoft authenticates the person; HMS keeps control of their roles, facility and employment access.</p>
@if(!$ready)<div class="alert alert-warning">The platform administrator must configure the Microsoft app registration credentials and HTTPS callback URL before sign-in can work.</div>@endif
@if($callbackUrl)<p class="small">Web redirect URI: <code>{{ $callbackUrl }}</code></p>@endif
<p class="small">Organisation code: <strong>{{ $organization->slug }}</strong><br>Staff sign-in link: <a href="{{ route('microsoft.redirect',['organization'=>$organization->slug]) }}">{{ route('microsoft.redirect',['organization'=>$organization->slug]) }}</a></p>
<form method="POST" action="{{ route('hms.microsoft.update') }}">@csrf @method('PUT')
<label for="tenant_id" class="form-label">Microsoft Directory (tenant) ID</label><input id="tenant_id" name="tenant_id" class="form-control mb-3" required maxlength="36" value="{{ old('tenant_id',$connection?->tenant_id) }}">
<label for="enabled" class="form-label">Microsoft sign-in</label><select id="enabled" name="enabled" class="form-select mb-3"><option value="0" @selected(!old('enabled',$connection?->enabled))>Disabled</option><option value="1" @selected(old('enabled',$connection?->enabled))>Enabled for linked staff</option></select>
<label for="settings_password" class="form-label">Your current HMS password</label><input id="settings_password" name="current_password" type="password" class="form-control mb-3" required autocomplete="current-password">
<button class="btn btn-primary">Save connection</button></form>
<p class="small text-muted mt-3 mb-0">Changing the tenant requires removing all existing links first. Disabling the connection ends Microsoft access on the next request. Local password login remains available.</p></div>
<div class="card p-3"><h2 class="h5">Link staff Microsoft accounts</h2>
<p class="small">In Microsoft Entra admin centre, open Users → select the staff member → copy Object ID. This is not the application/client ID or their email address. Only link an identity after confirming it belongs to the intended staff member in this tenant. Linking does not create a new HMS account or copy Microsoft groups into HMS roles.</p>
@if(!$connection)<p>Save the organisation's tenant ID above before linking accounts.</p>@else
@foreach($members as $member)
@php($identity=$identities->get($member->id))
<div class="border-top py-3"><strong>{{ $member->user?->name }}</strong> <span class="text-muted">{{ $member->user?->email }}</span>
@if($member->user?->is_platform_admin || ($member->role==='admin' && $member->user_id!==auth()->id() && !auth()->user()->is_platform_admin))
<p class="small mb-0">Protected administrator account. Platform accounts use local sign-in.</p>
@else
<form method="POST" action="{{ route('hms.microsoft.link') }}" class="row g-2 mt-1">@csrf<input type="hidden" name="membership_id" value="{{ $member->id }}">
<div class="col-md-5"><label class="form-label" for="object-{{ $member->id }}">Microsoft user Object ID</label><input id="object-{{ $member->id }}" name="object_id" class="form-control" required maxlength="36" value="{{ $identity?->object_id }}"></div>
<div class="col-md-5"><label class="form-label" for="link-password-{{ $member->id }}">Your HMS password</label><input id="link-password-{{ $member->id }}" name="current_password" type="password" class="form-control" required autocomplete="current-password"></div>
<div class="col-md-2 d-flex align-items-end"><button class="btn btn-outline-primary">Save link</button></div></form>
@if($identity)<form method="POST" action="{{ route('hms.microsoft.unlink',$member->id) }}" class="mt-2" onsubmit="return confirm('Remove this Microsoft link and revoke its Microsoft sessions?')">@csrf @method('DELETE')
<label class="form-label" for="unlink-password-{{ $member->id }}">Your HMS password to remove link</label><div class="d-flex gap-2"><input id="unlink-password-{{ $member->id }}" name="current_password" type="password" class="form-control" required autocomplete="current-password"><button class="btn btn-outline-danger">Remove link</button></div></form>@endif
@endif</div>
@endforeach
@endif</div>
@endsection