{% extends "base.html" %}

{% block title %}Аудиторская вселенная — DataAudit Platform{% endblock %}

{% block content %}
<link rel="stylesheet" href="{{ url_for('static', path='/css/grc.css') }}">

<div class="page-content">
    <div class="grc-toolbar">
        <a href="/workflows/universes" class="btn-back">
            <i data-lucide="arrow-left"></i> Реестр вселенных
        </a>
        <div class="toolbar-actions" id="toolbar-actions">
            <!-- Export / Import buttons injected here after load -->
        </div>
    </div>

    <!-- Universe Header -->
    <div class="detail-header" id="universe-header">
        <div class="stats-loading">Загрузка...</div>
    </div>

    <!-- Objects Section -->
    <div class="grc-section" id="objects-section">
        <div class="section-header">
            <h3 id="objects-section-title">Объекты аудита</h3>
            <div style="display:flex;gap:8px;align-items:center;">
                <input type="text" id="obj-search" class="form-input"
                       placeholder="Поиск..." style="width:200px;"
                       oninput="filterObjects(this.value)">
                <button class="btn btn-sm btn-primary" id="btn-add-object" style="display:none;"
                        onclick="openCreateModal()">
                    <i data-lucide="plus"></i> Добавить объект
                </button>
            </div>
        </div>
        <div class="grc-table-wrap">
            <table class="grc-table">
                <thead>
                    <tr>
                        <th>Название</th>
                        <th>Категория</th>
                        <th>Направление</th>
                        <th>Процессный</th>
                        <th>СВК</th>
                        <th>Значимость</th>
                        <th>Итог</th>
                        <th>Риск</th>
                        <th>Вывод</th>
                        <th id="objects-actions-th"></th>
                    </tr>
                </thead>
                <tbody id="objects-tbody">
                    <tr><td colspan="10" class="loading-cell">Загрузка...</td></tr>
                </tbody>
            </table>
        </div>
    </div>

    <!-- Reviewer Group -->
    <div class="grc-section">
        <div class="section-header">
            <h3>Группа согласования</h3>
            <button class="btn btn-sm btn-outline" id="btn-add-reviewer" style="display:none;"
                    onclick="openModal('modal-reviewer')">
                <i data-lucide="user-plus"></i> Добавить
            </button>
        </div>
        <div id="reviewers-container">
            <div class="stats-loading">Загрузка...</div>
        </div>
    </div>

    <!-- Comments -->
    <div class="grc-section">
        <div class="section-header">
            <h3>Комментарии</h3>
        </div>
        <div id="comments-container">
            <div class="stats-loading">Загрузка...</div>
        </div>
        <div class="comment-form">
            <textarea id="comment-text" rows="2" class="form-input"
                      placeholder="Написать комментарий..."></textarea>
            <button class="btn btn-sm btn-primary" onclick="addComment()">Отправить</button>
        </div>
    </div>

    <!-- Activity Log -->
    <div class="grc-section">
        <div class="section-header">
            <h3>История изменений</h3>
        </div>
        <div class="activity-feed" id="universe-activity"></div>
    </div>
</div>

<!-- Status Transition Modal -->
<div class="modal-overlay" id="modal-transition" style="display:none;">
    <div class="modal">
        <div class="modal-header">
            <h3>Изменение статуса</h3>
            <button class="modal-close" onclick="closeModal('modal-transition')">&times;</button>
        </div>
        <div class="modal-body">
            <p id="transition-desc"></p>
            <div class="form-group">
                <label>Комментарий (необязательно)</label>
                <textarea id="transition-comment" rows="2" class="form-input"></textarea>
            </div>
        </div>
        <div class="modal-footer">
            <button class="btn btn-secondary" onclick="closeModal('modal-transition')">Отмена</button>
            <button class="btn btn-primary" id="btn-confirm-transition"
                    onclick="confirmTransition()">Подтвердить</button>
        </div>
    </div>
</div>

<!-- Edit Metadata Modal -->
<div class="modal-overlay" id="modal-edit" style="display:none;">
    <div class="modal">
        <div class="modal-header">
            <h3>Редактировать вселенную</h3>
            <button class="modal-close" onclick="closeModal('modal-edit')">&times;</button>
        </div>
        <div class="modal-body">
            <div class="form-group">
                <label>Название</label>
                <input type="text" id="edit-title" class="form-input">
            </div>
            <div class="form-group">
                <label>Описание</label>
                <textarea id="edit-description" rows="3" class="form-input"></textarea>
            </div>
            <div class="form-group">
                <label>Заметки</label>
                <textarea id="edit-notes" rows="2" class="form-input"></textarea>
            </div>
        </div>
        <div class="modal-footer">
            <button class="btn btn-secondary" onclick="closeModal('modal-edit')">Отмена</button>
            <button class="btn btn-primary" onclick="saveEdit()">Сохранить</button>
        </div>
    </div>
</div>

<!-- Add Reviewer Modal -->
<div class="modal-overlay" id="modal-reviewer" style="display:none;">
    <div class="modal">
        <div class="modal-header">
            <h3>Добавить рецензента</h3>
            <button class="modal-close" onclick="closeModal('modal-reviewer')">&times;</button>
        </div>
        <div class="modal-body">
            <div class="form-group">
                <label>Логин (AD) *</label>
                <input type="text" id="rev-user-id" class="form-input" placeholder="ivanov_ia">
            </div>
            <div class="form-group">
                <label>Полное имя *</label>
                <input type="text" id="rev-full-name" class="form-input" placeholder="Иванов Иван Алексеевич">
            </div>
            <div class="form-group">
                <label>Email</label>
                <input type="email" id="rev-email" class="form-input" placeholder="ivanov@mcb.ru">
            </div>
        </div>
        <div class="modal-footer">
            <button class="btn btn-secondary" onclick="closeModal('modal-reviewer')">Отмена</button>
            <button class="btn btn-primary" onclick="addReviewer()">Добавить</button>
        </div>
    </div>
</div>

<!-- Import Modal -->
<div class="modal-overlay" id="modal-import" style="display:none;">
    <div class="modal">
        <div class="modal-header">
            <h3>Импорт объектов из XLSX</h3>
            <button class="modal-close" onclick="closeModal('modal-import')">&times;</button>
        </div>
        <div class="modal-body">
            <p style="font-size:13px;color:#6b7280;margin-bottom:12px;">
                Файл должен содержать столбец «Название». Оценки риска (1–3) считываются
                по русскоязычным заголовкам. Существующие объекты обновляются по имени.
            </p>
            <div class="form-group">
                <label>Файл XLSX *</label>
                <input type="file" id="import-file" class="form-input" accept=".xlsx">
            </div>
            <div id="import-result" style="display:none;margin-top:12px;font-size:13px;"></div>
        </div>
        <div class="modal-footer">
            <button class="btn btn-secondary" onclick="closeModal('modal-import')">Закрыть</button>
            <button class="btn btn-primary" id="btn-confirm-import" onclick="confirmImport()">
                Загрузить
            </button>
        </div>
    </div>
</div>

<script src="{{ url_for('static', path='/js/grc.js') }}"></script>
<script>
const universeId = {{ universe_id }};
let universeData = null;
let allObjects = [];
let userRole = 'viewer';
let pendingTransition = null;
let currentDetailId = null;
let currentDetailData = null;

const U_STATUS_LABELS = {
    draft: 'Черновик', review: 'На проверке',
    approval: 'Согласование', approved: 'Утверждён', archived: 'Архив',
};
const UNIVERSE_TRANSITIONS = {
    draft: ['review'],
    review: ['approval', 'draft'],
    approval: ['approved', 'review'],
    approved: ['archived'],
};
const U_RISK_LABELS = { high: 'Высокий', medium: 'Средний', low: 'Низкий' };
const U_CONCLUSION_LABELS = {
    current_year: 'Текущий год',
    next_year: 'Следующий год',
    year_three: 'Третий год',
};

document.addEventListener('DOMContentLoaded', async function() {
    try {
        const me = await fetch('/api/me').then(r => r.json());
        userRole = me.role;
    } catch(e) {}

    // Load org units for object create/edit form
    try {
        const units = await fetch('/api/grc/org-units').then(r => r.json());
        const sel = document.getElementById('obj-owner-unit');
        units.forEach(u => {
            sel.innerHTML += `<option value="${u.id}">${escHtml(u.name)}</option>`;
        });
    } catch(e) {}

    await Promise.all([
        loadUniverse(),
        loadComments(),
        loadActivity(),
        loadReviewers(),
    ]);
});

async function loadUniverse() {
    try {
        const resp = await fetch(`/api/grc/universes/${universeId}`);
        if (!resp.ok) {
            document.getElementById('universe-header').innerHTML =
                '<div class="empty-state">Вселенная не найдена</div>';
            return;
        }
        universeData = await resp.json();
        renderHeader();
        await loadObjects();
    } catch(e) {
        console.error(e);
    }
}

function renderHeader() {
    const u = universeData;
    const header = document.getElementById('universe-header');
    const statusLabel = U_STATUS_LABELS[u.status] || u.status;
    const isLocked = u.status === 'approved';
    const canEdit = ['admin', 'manager'].includes(userRole) && !isLocked;
    const canTransition = ['admin', 'manager'].includes(userRole);
    const transitions = UNIVERSE_TRANSITIONS[u.status] || [];

    const lockIcon = isLocked
        ? '<i data-lucide="lock" style="width:18px;height:18px;color:#6b7280;margin-left:6px;" title="Утверждена — объекты закрыты для редактирования"></i>'
        : '';

    let transitionBtns = '';
    if (canTransition && transitions.length) {
        transitionBtns = transitions.map(t =>
            `<button class="btn btn-sm btn-outline" onclick="startTransition('${t}')">
                ${U_STATUS_LABELS[t] || t}
            </button>`
        ).join('');
    }

    const editBtn = canEdit
        ? `<button class="btn btn-sm btn-secondary" onclick="openEditModal()">
               <i data-lucide="edit-2"></i> Редактировать
           </button>`
        : '';

    // Toolbar: export always, import only if not approved
    const toolbar = document.getElementById('toolbar-actions');
    toolbar.innerHTML = `
        <a href="/api/grc/universes/${universeId}/export"
           class="btn btn-sm btn-outline" title="Скачать XLSX">
            <i data-lucide="download"></i> Экспорт
        </a>
        ${!isLocked && ['admin','manager'].includes(userRole) ? `
        <button class="btn btn-sm btn-outline" onclick="openModal('modal-import')"
                title="Импорт из XLSX">
            <i data-lucide="upload"></i> Импорт
        </button>` : ''}
    `;

    header.innerHTML = `
        <div class="detail-title-row">
            <div>
                <h2>${escHtml(u.title)}${lockIcon}</h2>
                <div class="detail-meta">
                    <span class="status-badge status-${u.status}">${statusLabel}</span>
                    <span>Год: <strong>${u.year}</strong></span>
                    <span>Объектов: <strong>${u.object_count ?? 0}</strong></span>
                    ${u.source_title
                        ? `<span>Создана из: <a href="/workflows/universes/${u.created_from_id}">${escHtml(u.source_title)}</a></span>`
                        : ''}
                    ${u.approved_by ? `<span>Утвердил: ${escHtml(u.approved_by)} (${u.approved_at_str})</span>` : ''}
                    ${u.strategic_plan_title
                        ? `<span>Стратегический план: <a href="/workflows/strategic-plans/${u.strategic_plan_id}">${escHtml(u.strategic_plan_title)}</a></span>`
                        : ''}
                </div>
                ${u.description ? `<p class="detail-desc">${escHtml(u.description)}</p>` : ''}
            </div>
            <div class="detail-actions">
                ${editBtn}
                ${transitionBtns}
                ${u.status === 'approved' && !u.strategic_plan_id && ['admin','manager'].includes(userRole)
                    ? `<a href="/workflows/strategic-plans/new?universe_id=${u.id}&year=${u.year}"
                          class="btn btn-sm btn-primary">
                           <i data-lucide="file-plus"></i> Создать стратплан
                       </a>`
                    : ''}
            </div>
        </div>
    `;

    // Show add-object button only if not locked
    if (!isLocked && ['admin', 'manager'].includes(userRole)) {
        document.getElementById('btn-add-object').style.display = '';
    }
    if (isLocked) {
        document.getElementById('objects-section-title').textContent =
            'Объекты аудита (только чтение)';
        document.getElementById('objects-actions-th').style.display = 'none';
    }

    // Admin: show add reviewer button
    if (userRole === 'admin') {
        document.getElementById('btn-add-reviewer').style.display = '';
    }

    lucide.createIcons();
}

async function loadObjects() {
    try {
        const resp = await fetch(`/api/grc/audit-objects?universe_id=${universeId}&status=active`);
        allObjects = await resp.json();
        renderObjects(allObjects);
    } catch(e) {
        document.getElementById('objects-tbody').innerHTML =
            '<tr><td colspan="10" class="loading-cell">Ошибка загрузки объектов</td></tr>';
    }
}

function filterObjects(q) {
    const lower = q.toLowerCase();
    renderObjects(allObjects.filter(o =>
        o.name.toLowerCase().includes(lower) ||
        (o.description || '').toLowerCase().includes(lower)
    ));
}

function renderObjects(objects) {
    const tbody = document.getElementById('objects-tbody');
    const isLocked = universeData && universeData.status === 'approved';
    const canEdit = ['admin', 'manager'].includes(userRole) && !isLocked;

    if (!objects.length) {
        tbody.innerHTML = '<tr><td colspan="10" class="loading-cell">Нет объектов</td></tr>';
        return;
    }

    const riskColors = { high: 'badge-danger', medium: 'badge-warning', low: 'badge-default' };

    tbody.innerHTML = objects.map(o => `
        <tr>
            <td><strong>${escHtml(o.name)}</strong></td>
            <td>${escHtml(o.category || '—')}</td>
            <td>${escHtml(o.audit_division || '—')}</td>
            <td style="text-align:center;">${o.process_composite ?? '—'}</td>
            <td style="text-align:center;">${o.svk_composite ?? '—'}</td>
            <td style="text-align:center;">${o.importance_composite ?? '—'}</td>
            <td style="text-align:center;font-weight:600;">${o.composite_score ?? '—'}</td>
            <td>
                <span class="badge ${riskColors[o.risk_level] || ''}">
                    ${U_RISK_LABELS[o.risk_level] || o.risk_level || '—'}
                </span>
            </td>
            <td>${U_CONCLUSION_LABELS[o.conclusion] || o.conclusion || '—'}</td>
            <td>
                ${canEdit
                    ? `<button class="btn btn-xs btn-outline" onclick="openDetail(${o.id})" title="Редактировать">
                           <i data-lucide="edit-2"></i>
                       </button>
                       <button class="btn btn-xs btn-outline" style="color:#dc2626;" data-del-id="${o.id}" data-del-name="${escHtml(o.name)}" onclick="deleteObject(this)" title="Удалить">
                           <i data-lucide="trash-2"></i>
                       </button>`
                    : ''}
            </td>
        </tr>
    `).join('');
    lucide.createIcons();
}

// ── Transition ─────────────────────────────────────────────────

function startTransition(target) {
    pendingTransition = target;
    const currentLabel = U_STATUS_LABELS[universeData.status] || universeData.status;
    const targetLabel  = U_STATUS_LABELS[target] || target;
    document.getElementById('transition-desc').textContent =
        `Перевести вселенную из «${currentLabel}» в «${targetLabel}»?`;
    if (target === 'approval') {
        document.getElementById('transition-desc').textContent +=
            '\n\nГруппа согласования получит уведомление.';
    }
    document.getElementById('transition-comment').value = '';
    openModal('modal-transition');
}

async function confirmTransition() {
    if (!pendingTransition) return;
    const btn = document.getElementById('btn-confirm-transition');
    btn.disabled = true;
    try {
        const resp = await fetch(`/api/grc/universes/${universeId}/transition`, {
            method: 'POST',
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify({
                target_status: pendingTransition,
                comment: document.getElementById('transition-comment').value.trim() || null,
            }),
        });
        const result = await resp.json();
        if (resp.ok) {
            closeModal('modal-transition');
            await loadUniverse();
            await loadComments();
            await loadActivity();
        } else {
            alert(result.detail || 'Ошибка');
        }
    } catch(e) { alert('Ошибка сети'); }
    finally { btn.disabled = false; }
}

// ── Edit metadata ──────────────────────────────────────────────

function openEditModal() {
    document.getElementById('edit-title').value = universeData.title || '';
    document.getElementById('edit-description').value = universeData.description || '';
    document.getElementById('edit-notes').value = universeData.notes || '';
    openModal('modal-edit');
}

async function saveEdit() {
    const body = {
        title:       document.getElementById('edit-title').value.trim() || null,
        description: document.getElementById('edit-description').value.trim() || null,
        notes:       document.getElementById('edit-notes').value.trim() || null,
    };
    try {
        const resp = await fetch(`/api/grc/universes/${universeId}`, {
            method: 'PUT',
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify(body),
        });
        const result = await resp.json();
        if (resp.ok) {
            closeModal('modal-edit');
            await loadUniverse();
        } else {
            alert(result.detail || 'Ошибка сохранения');
        }
    } catch(e) { alert('Ошибка сети'); }
}

// ── Reviewers ──────────────────────────────────────────────────

async function loadReviewers() {
    try {
        const resp = await fetch('/api/grc/admin/universe-reviewers');
        const reviewers = await resp.json();
        renderReviewers(reviewers);
    } catch(e) {}
}

function renderReviewers(reviewers) {
    const container = document.getElementById('reviewers-container');
    const active = reviewers.filter(r => r.is_active);
    if (!active.length) {
        container.innerHTML = '<p class="text-muted" style="font-size:13px;">Группа согласования не настроена</p>';
        return;
    }
    container.innerHTML = `
        <div style="display:flex;flex-wrap:wrap;gap:8px;">
            ${active.map(r => `
                <div style="display:flex;align-items:center;gap:6px;background:#f1f5f9;
                             border-radius:6px;padding:6px 10px;font-size:13px;">
                    <i data-lucide="user" style="width:14px;height:14px;"></i>
                    <span>${escHtml(r.full_name)}</span>
                    ${r.email ? `<span style="color:#6b7280;">(${escHtml(r.email)})</span>` : ''}
                    ${userRole === 'admin'
                        ? `<button onclick="removeReviewer(${r.id})"
                                   style="background:none;border:none;cursor:pointer;color:#6b7280;padding:0 2px;"
                                   title="Убрать">×</button>`
                        : ''}
                </div>
            `).join('')}
        </div>
    `;
    lucide.createIcons();
}

async function addReviewer() {
    const userId   = document.getElementById('rev-user-id').value.trim();
    const fullName = document.getElementById('rev-full-name').value.trim();
    const email    = document.getElementById('rev-email').value.trim() || null;
    if (!userId || !fullName) { alert('Логин и имя обязательны'); return; }
    try {
        const resp = await fetch('/api/grc/admin/universe-reviewers', {
            method: 'POST',
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify({ user_id: userId, full_name: fullName, email }),
        });
        if (resp.ok) {
            closeModal('modal-reviewer');
            await loadReviewers();
        } else {
            const r = await resp.json();
            alert(r.detail || 'Ошибка');
        }
    } catch(e) { alert('Ошибка сети'); }
}

async function removeReviewer(reviewerId) {
    if (!confirm('Убрать рецензента из группы согласования?')) return;
    try {
        const resp = await fetch(`/api/grc/admin/universe-reviewers/${reviewerId}`, { method: 'DELETE' });
        if (resp.ok) await loadReviewers();
    } catch(e) {}
}

// ── Comments ───────────────────────────────────────────────────

async function loadComments() {
    try {
        const resp = await fetch(`/api/grc/comments/universe/${universeId}`);
        const comments = await resp.json();
        renderComments(document.getElementById('comments-container'), comments);
    } catch(e) {}
}

async function addComment() {
    const body = document.getElementById('comment-text').value.trim();
    if (!body) return;
    try {
        await fetch('/api/grc/comments', {
            method: 'POST',
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify({ entity_type: 'universe', entity_id: universeId, body }),
        });
        document.getElementById('comment-text').value = '';
        await loadComments();
    } catch(e) {}
}

// ── Activity Log ───────────────────────────────────────────────

async function loadActivity() {
    try {
        const resp = await fetch(`/api/grc/activity/universe/${universeId}`);
        const activities = await resp.json();
        renderActivityLog(document.getElementById('universe-activity'), activities);
    } catch(e) {}
}

// ── XLSX Import ────────────────────────────────────────────────

async function confirmImport() {
    const fileInput = document.getElementById('import-file');
    const file = fileInput.files[0];
    if (!file) { alert('Выберите файл'); return; }

    const btn = document.getElementById('btn-confirm-import');
    btn.disabled = true;
    btn.textContent = 'Загрузка...';

    const formData = new FormData();
    formData.append('file', file);

    try {
        const resp = await fetch(`/api/grc/universes/${universeId}/import`, {
            method: 'POST',
            body: formData,
        });
        const result = await resp.json();
        const resultDiv = document.getElementById('import-result');
        resultDiv.style.display = '';

        if (resp.ok) {
            resultDiv.innerHTML = `
                <div style="color:#16a34a;">
                    ✓ Обработано: <strong>${result.upserted}</strong>,
                    пропущено: <strong>${result.skipped}</strong>
                    ${result.errors.length ? `<br>Ошибки: ${result.errors.slice(0,5).map(escHtml).join('; ')}` : ''}
                </div>`;
            await loadUniverse();
            await loadObjects();
        } else {
            resultDiv.innerHTML = `<div style="color:#dc2626;">Ошибка: ${escHtml(result.detail || 'Неизвестная ошибка')}</div>`;
        }
    } catch(e) {
        document.getElementById('import-result').style.display = '';
        document.getElementById('import-result').innerHTML = '<div style="color:#dc2626;">Ошибка сети</div>';
    } finally {
        btn.disabled = false;
        btn.textContent = 'Загрузить';
    }
}

// -- Object Delete --
async function deleteObject(btn) {
    const objectId = btn.dataset.delId;
    const objectName = btn.dataset.delName;
    if (!confirm(`Удалить объект "${objectName}"?`)) return;
    try {
        const resp = await fetch(`/api/grc/audit-objects/${objectId}`, { method: 'DELETE' });
        const result = await resp.json();
        if (resp.ok) {
            await loadObjects();
            await loadUniverse();
        } else {
            alert(result.detail || 'Ошибка удаления');
        }
    } catch(e) {
        alert('Ошибка сети');
    }
}

// ── Object Create / Edit ───────────────────────────────────────

function openCreateModal() {
    document.getElementById('modal-object-title').textContent = 'Новый объект аудита';
    document.getElementById('obj-edit-id').value = '';
    document.getElementById('obj-name').value = '';
    document.getElementById('obj-description').value = '';
    document.getElementById('obj-category').value = 'business_process';
    document.getElementById('obj-owner-unit').value = '';
    document.getElementById('obj-division').value = '';
    document.getElementById('obj-last-audit-date').value = '';
    openModal('modal-object');
}

function openEditModal(obj) {
    document.getElementById('modal-object-title').textContent = 'Редактировать объект';
    document.getElementById('obj-edit-id').value = obj.id;
    document.getElementById('obj-name').value = obj.name || '';
    document.getElementById('obj-description').value = obj.description || '';
    document.getElementById('obj-category').value = obj.category || 'business_process';
    document.getElementById('obj-owner-unit').value = obj.owner_unit_id || '';
    document.getElementById('obj-division').value = obj.audit_division || '';
    if (obj.last_audit_date && obj.last_audit_date.includes('.')) {
        const parts = obj.last_audit_date.split('.');
        document.getElementById('obj-last-audit-date').value = `${parts[2]}-${parts[1]}-${parts[0]}`;
    } else {
        document.getElementById('obj-last-audit-date').value = obj.last_audit_date || '';
    }
    openModal('modal-object');
}

async function saveObject() {
    const editId = document.getElementById('obj-edit-id').value;
    const name = document.getElementById('obj-name').value.trim();
    if (!name) { alert('Укажите название'); return; }

    const body = {
        name,
        description: document.getElementById('obj-description').value.trim(),
        category: document.getElementById('obj-category').value,
        owner_unit_id: document.getElementById('obj-owner-unit').value || null,
        audit_division: document.getElementById('obj-division').value || null,
        last_audit_date: document.getElementById('obj-last-audit-date').value || null,
        universe_id: universeId,
    };

    try {
        const url = editId ? `/api/grc/audit-objects/${editId}` : '/api/grc/audit-objects';
        const method = editId ? 'PUT' : 'POST';
        const resp = await fetch(url, {
            method,
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify(body),
        });
        if (resp.ok) {
            closeModal('modal-object');
            await loadObjects();
        } else {
            const r = await resp.json();
            alert(r.detail || 'Ошибка сохранения');
        }
    } catch(e) { alert('Ошибка сети'); }
}

// ── Object Detail + 4-Block Scoring ───────────────────────────

async function openDetail(objectId) {
    currentDetailId = objectId;
    try {
        const resp = await fetch(`/api/grc/audit-objects/${objectId}`);
        if (!resp.ok) { alert('Объект не найден'); return; }
        currentDetailData = await resp.json();
        renderDetail();
        openModal('modal-detail');
    } catch(e) {
        alert('Ошибка загрузки');
        console.error(e);
    }
}

function renderDetail() {
    const d = currentDetailData;
    const composite = parseFloat(d.composite_score) || 0;
    const level = d.risk_level || 'low';
    const canEdit = ['admin', 'manager'].includes(userRole) && universeData && universeData.status !== 'approved';

    document.getElementById('detail-title').textContent = d.name;

    document.getElementById('detail-risk-summary').innerHTML = `
        <div>
            <div class="risk-summary-score level-${level}">${composite.toFixed(2)}</div>
            <div class="risk-summary-label">Итоговый балл</div>
        </div>
        <div>
            ${renderRiskBadge(level)}
            <div class="risk-summary-label" style="margin-top:4px">${renderFrequency(d.audit_frequency)}</div>
        </div>
        <div>
            ${renderDivisionBadge(d.audit_division)}
            ${d.regulatory_required ? '<span class="cbr-badge" style="margin-left:8px">ЦБ</span>' : ''}
        </div>
        <div style="flex:1"></div>
        ${canEdit ? `
            <button class="btn btn-sm btn-outline" onclick="closeModal('modal-detail');openEditModal(currentDetailData)">
                <i data-lucide="edit-2"></i> Редактировать
            </button>
        ` : ''}
    `;

    document.getElementById('detail-info').innerHTML = `
        <div class="detail-grid-v2">
            <div class="detail-block">
                <h4>Описание</h4>
                <p>${escHtml(d.description || '—')}</p>
                <h4>Категория</h4>
                <p>${renderCategoryBadge(d.category)}</p>
            </div>
            <div class="detail-block">
                <h4>Подразделение-владелец</h4>
                <p>${escHtml(d.owner_unit_name || '—')}</p>
                <h4>Вывод для планирования</h4>
                <p>${renderConclusionBadge(d.conclusion)}</p>
            </div>
            <div class="detail-block">
                <h4>Последняя проверка</h4>
                <p>${d.last_audit_date_str || '—'}</p>
                <h4>Создан / Обновлён</h4>
                <p>${escHtml(d.created_by || '—')} · ${d.created_at_str || ''}<br>${d.updated_at_str || '—'}</p>
            </div>
        </div>
    `;

    renderRiskFlagsSection(d);
    renderScoringBlocks(d);
    renderRegulatoryBlock(d);
    renderFinalScore(d);

    const refs = d.strategic_refs || [];
    if (refs.length > 0) {
        document.getElementById('strat-refs-section').style.display = '';
        document.getElementById('strat-refs').innerHTML = refs.map(r =>
            `<span class="badge badge-info" style="margin-right:0.5rem;margin-bottom:0.25rem">
                <a href="/workflows/strategic-plans/${r.plan_id}" style="color:inherit;text-decoration:none">
                    ${escHtml(r.plan_title)} — ${r.planned_year}${r.quarter ? ' ' + r.quarter : ''}
                </a>
            </span>`
        ).join('');
    } else {
        document.getElementById('strat-refs-section').style.display = 'none';
    }

    document.getElementById('scoring-actions').style.display = canEdit ? '' : 'none';
    lucide.createIcons();
}

function renderRiskFlagsSection(d) {
    const container = document.getElementById('detail-risk-flags');
    const flags = d.risk_flags || {};
    const canEdit = ['admin', 'manager'].includes(userRole) && universeData && universeData.status !== 'approved';

    container.innerHTML = Object.entries(RISK_FLAG_LABELS).map(([key, label]) => {
        const active = !!flags[key];
        return `
            <div class="risk-flag-toggle ${active ? 'active' : ''} ${canEdit ? 'editable' : ''}"
                 ${canEdit ? `onclick="toggleRiskFlag('${key}')"` : ''}
                 id="rf-${key}">
                <span class="risk-flag-dot"></span>
                ${label}
            </div>
        `;
    }).join('');
}

function toggleRiskFlag(key) {
    if (!currentDetailData) return;
    const flags = currentDetailData.risk_flags || {};
    flags[key] = !flags[key];
    currentDetailData.risk_flags = flags;
    const el = document.getElementById(`rf-${key}`);
    if (el) el.classList.toggle('active');
}

function renderScoringBlocks(d) {
    const container = document.getElementById('scoring-blocks');
    const scores = d.risk_scores || {};
    const canEdit = ['admin', 'manager'].includes(userRole) && universeData && universeData.status !== 'approved';
    let html = '';

    for (const [blockKey, block] of Object.entries(SCORING_BLOCKS)) {
        const blockComposite = parseFloat(d[blockKey + '_composite']) || calcBlockComposite(
            Object.fromEntries(Object.keys(block.dimensions).map(k => [k, (scores[k] || {}).score || 1])),
            blockKey
        );
        const compLevel = blockComposite >= 2.0 ? 'high' : blockComposite >= 1.5 ? 'medium' : 'low';

        let rows = '';
        for (const [dimKey, dim] of Object.entries(block.dimensions)) {
            const existing = scores[dimKey];
            const score = existing ? existing.score : 1;
            const labels = SCORE_LABELS[dimKey] || [];
            const weightPct = Math.round(dim.weight * 100);

            if (canEdit) {
                let options = '';
                for (let i = 1; i <= 3; i++) {
                    const lbl = labels[i-1] ? `${i} — ${labels[i-1]}` : i;
                    options += `<option value="${i}" ${score === i ? 'selected' : ''}>${lbl}</option>`;
                }
                rows += `
                    <div class="scoring-row">
                        <div class="scoring-row-label">${dim.label}</div>
                        <div class="scoring-row-weight">${weightPct}%</div>
                        <div class="scoring-row-select">
                            <select id="score-${dimKey}" onchange="updateLiveScores()">${options}</select>
                        </div>
                        <div class="scoring-row-value sv-${score}" id="sv-${dimKey}">${score}</div>
                    </div>`;
            } else {
                rows += `
                    <div class="scoring-row">
                        <div class="scoring-row-label">${dim.label}</div>
                        <div class="scoring-row-weight">${weightPct}%</div>
                        <div style="width:200px;font-size:0.8125rem;color:#64748b;text-align:right">${labels[score-1] || '—'}</div>
                        <div class="scoring-row-value sv-${score}">${score}</div>
                    </div>`;
            }
        }

        html += `
            <div class="scoring-block">
                <div class="scoring-block-header">
                    <span>${block.label}</span>
                    <span class="scoring-block-composite composite-${compLevel}" id="bc-${blockKey}">${blockComposite.toFixed(2)}</span>
                </div>
                <div class="scoring-block-body">${rows}</div>
            </div>`;
    }
    container.innerHTML = html;
}

function renderRegulatoryBlock(d) {
    const container = document.getElementById('regulatory-body');
    const canEdit = ['admin', 'manager'].includes(userRole) && universeData && universeData.status !== 'approved';
    const items = [
        { key: 'regulatory_required', label: 'Требуется проверка по ЦБ', value: !!d.regulatory_required },
        { key: 'kar_request',         label: 'Запрос КАР / руководства', value: !!d.kar_request },
        { key: 'other_factors',       label: 'Другие факторы',           value: !!d.other_factors },
    ];
    container.innerHTML = items.map(item => {
        if (canEdit) {
            return `
                <div class="reg-toggle-row">
                    <span class="reg-toggle-label">${item.label}</span>
                    <label style="display:flex;align-items:center;gap:6px;cursor:pointer">
                        <input type="checkbox" id="reg-${item.key}" ${item.value ? 'checked' : ''}
                               onchange="updateLiveScores()">
                        <span style="font-size:0.8125rem;color:#334155">${item.value ? 'ДА' : 'НЕТ'}</span>
                    </label>
                </div>`;
        } else {
            return `
                <div class="reg-toggle-row">
                    <span class="reg-toggle-label">${item.label}</span>
                    <span style="font-weight:600;color:${item.value ? '#dc2626' : '#16a34a'}">${item.value ? 'ДА' : 'НЕТ'}</span>
                </div>`;
        }
    }).join('');
}

function renderFinalScore(d) {
    const composite = parseFloat(d.composite_score) || 0;
    const level = d.risk_level || 'low';
    const process = parseFloat(d.process_composite) || 0;
    const svk = parseFloat(d.svk_composite) || 0;
    const importance = parseFloat(d.importance_composite) || 0;
    const residual = d.residual_risk || 1;
    const levelColor = { high: '#dc2626', medium: '#d97706', low: '#16a34a' }[level] || '#64748b';

    document.getElementById('final-score-bar').innerHTML = `
        <div>
            <div class="final-score-value" id="fs-value" style="color:${levelColor}">${composite.toFixed(2)}</div>
            <div class="final-score-label">Итого</div>
        </div>
        <div>${renderRiskBadge(level)}</div>
        <div class="final-score-breakdown">
            <span><span class="fsb-val" id="fs-process">${process.toFixed(2)}</span>Процесс</span>
            <span><span class="fsb-val" id="fs-svk">${svk.toFixed(2)}</span>СВК</span>
            <span><span class="fsb-val" id="fs-residual">${residual}</span>Ост. риск</span>
            <span><span class="fsb-val" id="fs-importance">${importance.toFixed(2)}</span>Важность</span>
        </div>
    `;
}

function updateLiveScores() {
    const scores = {};
    for (const dim of Object.keys(RISK_DIMENSIONS)) {
        const el = document.getElementById(`score-${dim}`);
        if (el) {
            scores[dim] = parseInt(el.value) || 1;
            const sv = document.getElementById(`sv-${dim}`);
            if (sv) { sv.textContent = scores[dim]; sv.className = `scoring-row-value sv-${scores[dim]}`; }
        }
    }
    for (const blockKey of Object.keys(SCORING_BLOCKS)) {
        const comp = calcBlockComposite(scores, blockKey);
        const compLevel = comp >= 2.0 ? 'high' : comp >= 1.5 ? 'medium' : 'low';
        const el = document.getElementById(`bc-${blockKey}`);
        if (el) { el.textContent = comp.toFixed(2); el.className = `scoring-block-composite composite-${compLevel}`; }
    }
    const process = calcBlockComposite(scores, 'process');
    const svk = calcBlockComposite(scores, 'svk');
    const importance = calcBlockComposite(scores, 'importance');
    const residual = calcResidualRisk(process, svk);
    const composite = Math.round(((residual + importance) / 2) * 100) / 100;
    const level = getRiskLevel(composite);
    const levelColor = { high: '#dc2626', medium: '#d97706', low: '#16a34a' }[level] || '#64748b';
    const fsVal = document.getElementById('fs-value');
    if (fsVal) { fsVal.textContent = composite.toFixed(2); fsVal.style.color = levelColor; }
    const fsProcess = document.getElementById('fs-process'); if (fsProcess) fsProcess.textContent = process.toFixed(2);
    const fsSvk = document.getElementById('fs-svk'); if (fsSvk) fsSvk.textContent = svk.toFixed(2);
    const fsResidual = document.getElementById('fs-residual'); if (fsResidual) fsResidual.textContent = residual;
    const fsImportance = document.getElementById('fs-importance'); if (fsImportance) fsImportance.textContent = importance.toFixed(2);
    const summary = document.getElementById('detail-risk-summary');
    const scoreEl = summary ? summary.querySelector('.risk-summary-score') : null;
    if (scoreEl) { scoreEl.textContent = composite.toFixed(2); scoreEl.className = `risk-summary-score level-${level}`; }
}

async function saveScores() {
    const scores = {};
    for (const dim of Object.keys(RISK_DIMENSIONS)) {
        const el = document.getElementById(`score-${dim}`);
        if (el) scores[dim] = parseInt(el.value) || 1;
    }
    const risk_flags = {};
    for (const key of Object.keys(RISK_FLAG_LABELS)) {
        const el = document.getElementById(`rf-${key}`);
        risk_flags[key] = el ? el.classList.contains('active') : false;
    }
    const regulatory_required = document.getElementById('reg-regulatory_required')?.checked || false;
    const kar_request = document.getElementById('reg-kar_request')?.checked || false;
    const other_factors = document.getElementById('reg-other_factors')?.checked || false;

    try {
        const resp = await fetch(`/api/grc/audit-objects/${currentDetailId}/score`, {
            method: 'POST',
            headers: {'Content-Type': 'application/json'},
            body: JSON.stringify({ scores, risk_flags, regulatory_required, kar_request, other_factors }),
        });
        if (resp.ok) {
            await openDetail(currentDetailId);
            await loadObjects();
        } else {
            const r = await resp.json();
            alert(r.detail || 'Ошибка сохранения');
        }
    } catch(e) { alert('Ошибка сети'); }
}
</script>

<!-- ═══ Create/Edit Object Modal ═══ -->
<div class="modal-overlay" id="modal-object" style="display:none;" onclick="if(event.target===this)closeModal('modal-object')">
    <div class="modal modal-lg">
        <div class="modal-header">
            <h3 id="modal-object-title">Новый объект аудита</h3>
            <button class="modal-close" onclick="closeModal('modal-object')">&times;</button>
        </div>
        <div class="modal-body">
            <input type="hidden" id="obj-edit-id">
            <div class="form-group">
                <label>Название *</label>
                <input type="text" class="form-input" id="obj-name" placeholder="Название объекта аудита">
            </div>
            <div class="form-group">
                <label>Описание</label>
                <textarea class="form-input" id="obj-description" rows="2"></textarea>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Категория</label>
                    <select class="form-input" id="obj-category">
                        <option value="business_process">Бизнес-процесс</option>
                        <option value="regulatory">Регуляторное направление</option>
                        <option value="it_system">ИТ-система</option>
                        <option value="department">Подразделение</option>
                    </select>
                </div>
                <div class="form-group">
                    <label>Подразделение-владелец</label>
                    <select class="form-input" id="obj-owner-unit">
                        <option value="">— Не указано —</option>
                    </select>
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Отдел ДВА</label>
                    <select class="form-input" id="obj-division">
                        <option value="">— Не указан —</option>
                        <option value="ОСА">ОСА</option>
                        <option value="ОАКБ">ОАКБ</option>
                        <option value="ОАРБ">ОАРБ</option>
                        <option value="ОАИБ">ОАИБ</option>
                        <option value="ОВЦБ">ОВЦБ</option>
                    </select>
                </div>
                <div class="form-group">
                    <label>Дата последней проверки</label>
                    <input type="date" class="form-input" id="obj-last-audit-date">
                </div>
            </div>
        </div>
        <div class="modal-footer">
            <button class="btn btn-secondary" onclick="closeModal('modal-object')">Отмена</button>
            <button class="btn btn-primary" onclick="saveObject()">Сохранить</button>
        </div>
    </div>
</div>

<!-- ═══ Object Detail + 4-Block Scoring Modal ═══ -->
<div class="modal-overlay" id="modal-detail" style="display:none;" onclick="if(event.target===this)closeModal('modal-detail')">
    <div class="modal modal-xl">
        <div class="modal-header">
            <h3 id="detail-title">Объект аудита</h3>
            <button class="modal-close" onclick="closeModal('modal-detail')">&times;</button>
        </div>
        <div class="modal-body">
            <div class="risk-summary" id="detail-risk-summary"></div>
            <div class="grc-section">
                <div class="section-header"><h3>Информация</h3></div>
                <div id="detail-info"></div>
            </div>
            <div class="grc-section">
                <div class="section-header"><h3>Неотъемлемые риски процесса</h3></div>
                <div class="risk-flags-grid" id="detail-risk-flags"></div>
            </div>
            <div class="grc-section" id="scoring-section">
                <div class="section-header"><h3>Оценка рисков (4-блочная модель)</h3></div>
                <div id="scoring-blocks"></div>
                <div class="scoring-block" id="regulatory-block">
                    <div class="scoring-block-header">Регуляторные требования</div>
                    <div class="scoring-block-body" id="regulatory-body"></div>
                </div>
                <div class="final-score-bar" id="final-score-bar"></div>
                <div style="margin-top:1rem;text-align:right;" id="scoring-actions" style="display:none;">
                    <button class="btn btn-primary" onclick="saveScores()">
                        <i data-lucide="save"></i> Сохранить оценку
                    </button>
                </div>
            </div>
            <div class="grc-section" id="strat-refs-section" style="display:none;">
                <div class="section-header"><h3>В стратегических планах</h3></div>
                <div id="strat-refs"></div>
            </div>
        </div>
    </div>
</div>

{% endblock %}