{#
  Unified permissions landing page — rendered at /admin/permissions in every
  consumer app that has HAS_PERMISSION_ADMIN = True. Replaces the old 404 and
  gives every app a visually consistent entry point into its capability matrix.

  Expected context:
    app_display_name : str         — "Digi", "Beany", "Grind"
    auth_roles_url   : str         — deep link to Auth role admin, e.g.
                                     https://auth.coffeehouse.tools/admin/apps/digi/roles
    dimensions       : list[dict]  — one card per capability dimension:
        {
          "name": "Permissions",       # human label
          "description": "...",        # optional, shown under name
          "dept_url": "/admin/department-permissions",
          "role_url": "/admin/role-permissions",
          "simulate_url": "/admin/simulate-permissions",
        }
    stale_roles      : list[str]   — optional orphan slugs (banner rendered if any)
    cleanup_url      : str         — POST target for "Clean up" button
    csrf_token       : str         — CSRF token for the cleanup form
#}
{% extends "base.html" %}{% from "macros/i18n.html" import ch_t %}
{% block title %}{{ ch_t("Permissions") }} · {{ app_display_name }}{% endblock %}
{% block content %}
{% set _manage = "Manage roles in Auth" %}{% if ch_i18n is defined and ch_i18n.translates(_manage) %}{% set _actions %}<a href="{{ auth_roles_url }}" target="_blank" rel="noopener" class="btn btn-ghost btn-sm">{{ ch_t("Manage roles in Auth") }} &rarr;</a>{% endset %}{% else %}{% set _actions = '<a href="' ~ auth_roles_url ~ '" target="_blank" rel="noopener" class="btn btn-ghost btn-sm">Manage roles in Auth &rarr;</a>' %}{% endif %}{% with page_title=ch_t("Permissions"),
        page_actions=_actions %}
{% include "components/page_header.html" %}
{% endwith %}

{% set flashes = pop_flashes(request) if pop_flashes is defined else [] %}
{% if flashes %}
{% with flash_messages=flashes %}
{% include "components/flash.html" %}
{% endwith %}
{% endif %}

{% if stale_roles %}
{% with stale_role_slugs=stale_roles, cleanup_url=cleanup_url, csrf_token=csrf_token %}
{% include "components/stale_roles_banner.html" %}
{% endwith %}
{% endif %}

<p class="text-sm text-base-content/70 mb-4">
    {%- set _use = "Use %(auth_link)s to create or edit roles themselves." %}
    {%- if ch_i18n is defined and ch_i18n.translates(_use) %}
    {{ ch_t("Capabilities this app offers, grouped by dimension.") }}
    {{ ch_t("Department baselines apply to everyone in a department; role grants/revokes layer on top.") }}
    {% set _link %}<a href="{{ auth_roles_url }}" target="_blank" rel="noopener" class="link link-hover">Auth</a>{% endset -%}
    {{ ch_t("Use %(auth_link)s to create or edit roles themselves.", auth_link=_link) }}
    {%- else %}
    Capabilities this app offers, grouped by dimension.
    Department baselines apply to everyone in a department; role grants/revokes layer on top.
    Use <a href="{{ auth_roles_url }}" target="_blank" rel="noopener" class="link link-hover">Auth</a>
    to create or edit roles themselves.
    {%- endif %}
</p>

<div class="grid gap-4 md:grid-cols-2">
    {% for dim in dimensions %}
    <div class="card bg-base-100 shadow-sm">
        <div class="card-body">
            <h2 class="card-title">{{ dim.name }}</h2>
            {% if dim.description %}
            <p class="text-sm text-base-content/70">{{ dim.description }}</p>
            {% endif %}
            <div class="card-actions justify-start mt-3 flex-wrap gap-2">
                <a href="{{ dim.dept_url }}" class="btn btn-sm btn-primary">{{ ch_t("Department baseline") }}</a>
                <a href="{{ dim.role_url }}" class="btn btn-sm btn-outline">{{ ch_t("Role matrix") }}</a>
                <a href="{{ dim.simulate_url }}" class="btn btn-sm btn-ghost">{{ ch_t("Simulate") }}</a>
            </div>
        </div>
    </div>
    {% endfor %}
</div>
{% endblock %}