{#
  Unified permissions landing page — rendered at /admin/permissions in every
  consumer app that has HAS_PERMISSION_ADMIN = True. Replaces the old 404 and
  gives every app a visually consistent entry point into its capability matrix.

  Expected context:
    app_display_name : str         — "Digi", "Beany", "Grind"
    auth_roles_url   : str         — deep link to Auth role admin, e.g.
                                     https://auth.coffeehouse.tools/admin/apps/digi/roles
    dimensions       : list[dict]  — one card per capability dimension:
        {
          "name": "Permissions",       # human label
          "description": "...",        # optional, shown under name
          "dept_url": "/admin/department-permissions",
          "role_url": "/admin/role-permissions",
          "simulate_url": "/admin/simulate-permissions",
        }
    stale_roles      : list[str]   — optional orphan slugs (banner rendered if any)
    cleanup_url      : str         — POST target for "Clean up" button
    csrf_token       : str         — CSRF token for the cleanup form
#}
{% extends "base.html" %}
{% block title %}Permissions · {{ app_display_name }}{% endblock %}
{% block content %}
{% with page_title="Permissions",
        page_actions='<a href="' ~ auth_roles_url ~ '" target="_blank" rel="noopener" class="btn btn-ghost btn-sm">Manage roles in Auth &rarr;</a>' %}
{% include "components/page_header.html" %}
{% endwith %}

{% set flashes = pop_flashes(request) if pop_flashes is defined else [] %}
{% if flashes %}
{% with flash_messages=flashes %}
{% include "components/flash.html" %}
{% endwith %}
{% endif %}

{% if stale_roles %}
{% with stale_role_slugs=stale_roles, cleanup_url=cleanup_url, csrf_token=csrf_token %}
{% include "components/stale_roles_banner.html" %}
{% endwith %}
{% endif %}

<p class="text-sm text-base-content/70 mb-4">
    Capabilities this app offers, grouped by dimension.
    Department baselines apply to everyone in a department; role grants/revokes layer on top.
    Use <a href="{{ auth_roles_url }}" target="_blank" rel="noopener" class="link link-hover">Auth</a>
    to create or edit roles themselves.
</p>

<div class="grid gap-4 md:grid-cols-2">
    {% for dim in dimensions %}
    <div class="card bg-base-100 shadow-sm">
        <div class="card-body">
            <h2 class="card-title">{{ dim.name }}</h2>
            {% if dim.description %}
            <p class="text-sm text-base-content/70">{{ dim.description }}</p>
            {% endif %}
            <div class="card-actions justify-start mt-3 flex-wrap gap-2">
                <a href="{{ dim.dept_url }}" class="btn btn-sm btn-primary">Department baseline</a>
                <a href="{{ dim.role_url }}" class="btn btn-sm btn-outline">Role matrix</a>
                <a href="{{ dim.simulate_url }}" class="btn btn-sm btn-ghost">Simulate</a>
            </div>
        </div>
    </div>
    {% endfor %}
</div>
{% endblock %}