@php
    /*
     | What this account is allowed to do.
     |
     | Off by default and the roles decide, exactly as before. Switched on and
     | the ticks below are the whole answer — not additions to the role, the
     | answer — which is what lets two receptionists be allowed different
     | things without either of them needing a role of their own.
     |
     | Prefilled from the roles when the account has no list yet, so turning it
     | on starts from what the account can do today rather than from nothing.
     | Somebody trimming three permissions off a receptionist should not have to
     | tick the other twenty-two first.
     */
    $hasOwnSet = old('permissions_overridden', ($user ?? null)?->hasOwnPermissionSet() ?? false);

    $roleGranted = collect($selectedRoles)
        ->map(fn (string $name) => $availableRoles->firstWhere('name', $name))
        ->filter()
        ->flatMap(fn ($role) => $role->permissions->pluck('name'))
        ->unique()
        ->values()
        ->all();

    $ticked = old('permissions', $hasOwnSet && isset($user) && $user->hasOwnPermissionSet()
        ? $user->permissions->pluck('name')->all()
        : $roleGranted);
@endphp

<fieldset class="mt-4" data-clinic-permission-set>
    <div class="form-check form-switch mb-2">
        <input class="form-check-input" type="checkbox" role="switch"
               name="permissions_overridden" value="1" id="permissions-overridden"
               data-clinic-permission-toggle
               @checked($hasOwnSet)>
        <label class="form-check-label fw-semibold" for="permissions-overridden">
            {{ __('auth::messages.permissions.own_set') }}
        </label>
    </div>

    <p class="px-hint">{{ __('auth::messages.permissions.own_set_help') }}</p>

    <div @class(['mt-3']) data-clinic-permission-list @if (! $hasOwnSet) hidden @endif>
        <div class="px-advice px-advice--info d-flex align-items-start gap-2 mb-3">
            <i class="bi bi-info-circle px-advice__icon" aria-hidden="true"></i>
            <span class="min-w-0">{{ __('auth::messages.permissions.replaces_role') }}</span>
        </div>

        {{-- Grouped by the module that owns each permission, derived from the
             name prefix — the same grouping the role editor uses, so a new
             module's permissions appear here with no registry to update. --}}
        <div class="row g-3">
            @foreach ($permissionGroups as $group => $permissions)
                <div class="col-12 col-md-6 col-xl-4">
                    <div class="border rounded p-3 h-100">
                        <div class="d-flex justify-content-between align-items-center mb-2">
                            <strong class="text-capitalize small">{{ str_replace('_', ' ', $group) }}</strong>
                            <button type="button" class="btn btn-link btn-sm p-0"
                                    data-clinic-check-group="user-{{ $group }}">
                                {{ __('auth::messages.roles.select_all') }}
                            </button>
                        </div>

                        @foreach ($permissions as $permission)
                            <div class="form-check">
                                <input class="form-check-input" type="checkbox" name="permissions[]"
                                       value="{{ $permission->name }}"
                                       id="user-perm-{{ $permission->name }}"
                                       data-clinic-group="user-{{ $group }}"
                                       @checked(in_array($permission->name, $ticked, true))>
                                <label class="form-check-label small" for="user-perm-{{ $permission->name }}">
                                    {{ \Illuminate\Support\Str::after($permission->name, '.') }}

                                    {{-- Marked where the role would have granted
                                         it anyway, so it is clear what is being
                                         taken away rather than merely not added. --}}
                                    @if (in_array($permission->name, $roleGranted, true))
                                        <span class="px-hint">{{ __('auth::messages.permissions.from_role') }}</span>
                                    @endif
                                </label>
                            </div>
                        @endforeach
                    </div>
                </div>
            @endforeach
        </div>

        @error('permissions')<div class="text-danger small mt-2">{{ $message }}</div>@enderror
    </div>
</fieldset>