@php
    $selected = old('permissions', $role?->permissions->pluck('name')->all() ?? []);
@endphp

{{--
    Permissions are grouped by the module that owns them, derived from the name
    prefix. A newly installed module's permissions therefore appear here on their
    own, with no registry for anyone to forget to update.
--}}
<div class="row g-3">
    @foreach ($permissionGroups as $group => $permissions)
        <div class="col-12 col-md-6 col-xl-4">
            <div class="border rounded p-3 h-100">
                <div class="d-flex justify-content-between align-items-center mb-2">
                    <strong class="text-capitalize small">{{ str_replace('_', ' ', $group) }}</strong>
                    <button type="button" class="btn btn-link btn-sm p-0"
                            data-clinic-check-group="{{ $group }}">
                        {{ __('auth::messages.roles.select_all') }}
                    </button>
                </div>

                @foreach ($permissions as $permission)
                    <div class="form-check">
                        <input class="form-check-input" type="checkbox" name="permissions[]"
                               value="{{ $permission->name }}"
                               id="perm-{{ $permission->name }}"
                               data-clinic-group="{{ $group }}"
                               @checked(in_array($permission->name, $selected, true))>
                        <label class="form-check-label small font-monospace" for="perm-{{ $permission->name }}">
                            {{ \Illuminate\Support\Str::after($permission->name, '.') }}
                        </label>
                    </div>
                @endforeach
            </div>
        </div>
    @endforeach
</div>

@error('permissions')<div class="text-danger small mt-2">{{ $message }}</div>@enderror

{{--
    The group toggle is wired in resources/js/app.js, not in an inline <script>.
    The Content-Security-Policy sets script-src 'self', so an inline block would
    simply be blocked — and a checkbox that silently does nothing is worse than
    no checkbox at all.
--}}