autocrm/app/Filament/Tenant/Resources/UserResource.php

<?php

namespace App\Filament\Tenant\Resources;

use App\Filament\Tenant\Resources\UserResource\Pages;
use App\Filament\Tenant\Resources\UserResource\RelationManagers;
use App\Models\Tenant\User;
use Filament\Forms;
use Filament\Resources\Resource;
use Filament\Schemas\Schema;
use Filament\Actions;
use Filament\Schemas;
use Filament\Tables;
use Filament\Tables\Table;
use Illuminate\Support\Facades\Hash;

class UserResource extends Resource
{
    protected static ?string $model = User::class;

    protected static string|\BackedEnum|null $navigationIcon = 'heroicon-o-user-group';

    public static function getNavigationLabel(): string
    {
        return __('nav.label.Utilizatori');
    }

    public static function getNavigationGroup(): ?string
    {
        return __('nav.group.Admin');
    }

    protected static ?string $modelLabel = 'utilizator';

    protected static ?string $pluralModelLabel = 'utilizatori';

    protected static ?int $navigationSort = 80;

    public static function canViewAny(): bool
    {
        return auth()->user()?->canDo(\App\Auth\Permissions::ADMIN_USERS_VIEW) ?? false;
    }

    public static function canCreate(): bool
    {
        return auth()->user()?->canDo(\App\Auth\Permissions::ADMIN_USERS_MANAGE) ?? false;
    }

    public static function canDelete($record): bool
    {
        return auth()->user()?->canDo(\App\Auth\Permissions::ADMIN_USERS_MANAGE) ?? false;
    }

    public static function form(Schema $schema): Schema
    {
        return $schema->components([
            Schemas\Components\Section::make(__('Identitate'))
                ->columns(2)
                ->schema([
                    Forms\Components\TextInput::make('name')->label(__('Nume'))->required()->maxLength(120),
                    Forms\Components\TextInput::make('email')->email()->required()->maxLength(120),
                    Forms\Components\TextInput::make('phone')->tel()->maxLength(40),
                    Forms\Components\Select::make('locale')
                        ->options(['ro' => 'Română', 'ru' => 'Русский', 'en' => 'English'])
                        ->default('ro'),
                ]),
            Schemas\Components\Section::make(__('Acces'))
                ->columns(2)
                ->schema([
                    Forms\Components\Select::make('role')
                        ->label(__('Rol primar'))
                        ->options(\App\Auth\Permissions::roleLabels())
                        ->required()
                        ->default('mechanic')
                        ->helperText(__('Rolul principal — sincronizat automat cu drepturile RBAC.')),
                    Forms\Components\Select::make('status')
                        ->options(['active' => 'Activ', 'inactive' => 'Inactiv', 'blocked' => 'Blocat'])
                        ->default('active')
                        ->required(),
                    Forms\Components\TextInput::make('password')
                        ->label(__('Parolă'))
                        ->password()
                        ->required(fn (string $context) => $context === 'create')
                        ->dehydrated(fn ($state) => filled($state))
                        ->dehydrateStateUsing(fn ($state) => Hash::make($state))
                        ->minLength(6)
                        ->helperText(__('La editare lasă gol pentru a păstra parola actuală.')),
                    Forms\Components\Select::make('roles_picked')
                        ->label(__('Roluri suplimentare'))
                        ->multiple()
                        ->options(\App\Auth\Permissions::roleLabels())
                        ->afterStateHydrated(function ($component, $record) {
                            if ($record) $component->state($record->roles->pluck('name')->all());
                        })
                        ->dehydrated(false)
                        ->columnSpanFull()
                        ->helperText(__('Roluri suplimentare peste rolul primar — drepturile se cumulează.')),
                ]),
            Schemas\Components\Section::make(__('Salariu & marjă'))
                ->description(__('Configurează procentele pentru calcul salariu. Marja internă (nu TVA) se scade din prețul de manoperă pentru a determina baza salariului.'))
                ->columns(2)
                ->visible(fn () => auth()->user()?->canDo(\App\Auth\Permissions::FINANCE_VIEW_INTERNAL_MARGIN) ?? false)
                ->schema([
                    Forms\Components\TextInput::make('hourly_rate')
                        ->label(__('Tarif orar (MDL)'))
                        ->numeric()
                        ->step(0.01)
                        ->placeholder(__('Ex: 100')),
                    Forms\Components\TextInput::make('internal_margin_pct')
                        ->label(__('Marjă internă (%)'))
                        ->numeric()
                        ->step(0.01)
                        ->minValue(0)
                        ->maxValue(90)
                        ->placeholder(__('Ex: 20 pentru +20%'))
                        ->helperText(__('Doar la manopere (proprii + subcontract). Baza salariu = preț client × (1 − marjă/100). Lasă gol pentru a folosi valoarea implicită a companiei.')),
                ]),
            Schemas\Components\Section::make(__('Securitate'))
                ->columns(2)
                ->schema([
                    Forms\Components\Placeholder::make('mfa_status')
                        ->label(__('Autentificare 2FA'))
                        ->content(fn ($record) => $record && $record->hasTwoFactorEnabled() ? '✓ Activat (TOTP)' : '✗ Dezactivat'),
                    Forms\Components\Placeholder::make('last_login')
                        ->label(__('Ultima autentificare'))
                        ->content(fn ($record) => $record?->last_login_at?->diffForHumans() ?? '—'),
                ]),
        ]);
    }

    public static function table(Table $table): Table
    {
        return $table
            ->columns([
                Tables\Columns\TextColumn::make('name')->searchable()->sortable(),
                Tables\Columns\TextColumn::make('email')->searchable()->copyable(),
                Tables\Columns\TextColumn::make('phone')->placeholder('—'),
                Tables\Columns\TextColumn::make('role')
                    ->formatStateUsing(fn ($state) => \App\Auth\Permissions::roleLabels()[$state] ?? $state)
                    ->badge(),
                Tables\Columns\IconColumn::make('app_authentication_secret')
                    ->label(__('2FA'))
                    ->boolean()
                    ->getStateUsing(fn ($record) => $record->hasTwoFactorEnabled())
                    ->trueIcon('heroicon-o-shield-check')
                    ->trueColor('success')
                    ->falseIcon('heroicon-o-shield-exclamation')
                    ->falseColor('warning'),
                Tables\Columns\TextColumn::make('active_sessions')
                    ->label(__('Sesiuni'))
                    ->getStateUsing(fn ($record) => \Illuminate\Support\Facades\DB::table('sessions')->where('user_id', $record->id)->count())
                    ->badge()
                    ->color(fn ($state) => $state > 0 ? 'success' : 'gray')
                    ->toggleable(),
                Tables\Columns\TextColumn::make('permission_overrides_count')
                    ->counts('permissionOverrides')
                    ->label(__('Excepții'))
                    ->badge()
                    ->color('warning')
                    ->toggleable(isToggledHiddenByDefault: true),
                Tables\Columns\TextColumn::make('status')
                    ->badge()
                    ->colors([
                        'success' => ['active'],
                        'warning' => ['inactive'],
                        'danger' => ['blocked'],
                    ]),
                Tables\Columns\TextColumn::make('last_login_at')->dateTime()->placeholder('—')->toggleable(),
                Tables\Columns\TextColumn::make('created_at')->date()->sortable()->toggleable(isToggledHiddenByDefault: true),
            ])
            ->filters([
                Tables\Filters\SelectFilter::make('role')->options([
                    'admin' => 'Admin', 'manager' => 'Manager', 'receptionist' => 'Recepție',
                    'mechanic' => 'Mecanic', 'parts_manager' => 'Magazie', 'accountant' => 'Contabil', 'marketer' => 'Marketing',
                ]),
                Tables\Filters\SelectFilter::make('status')->options([
                    'active' => 'Activ', 'inactive' => 'Inactiv', 'blocked' => 'Blocat',
                ]),
            ])
            ->actions([
                Actions\EditAction::make(),
                Actions\Action::make('force_logout')
                    ->label(__('Force logout'))
                    ->icon('heroicon-o-arrow-right-on-rectangle')
                    ->color('warning')
                    ->visible(fn ($record) => \Illuminate\Support\Facades\DB::table('sessions')->where('user_id', $record->id)->exists())
                    ->requiresConfirmation()
                    ->modalDescription('Va deconecta utilizatorul pe toate device-urile.')
                    ->action(function ($record) {
                        $n = \Illuminate\Support\Facades\DB::table('sessions')->where('user_id', $record->id)->delete();
                        \Filament\Notifications\Notification::make()->title("$n sesiuni revoke-uite")->success()->send();
                    }),
                Actions\Action::make('reset_2fa')
                    ->label(__('Resetează 2FA'))
                    ->icon('heroicon-o-shield-exclamation')
                    ->color('warning')
                    ->visible(fn ($record) => $record && $record->hasTwoFactorEnabled())
                    ->requiresConfirmation()
                    ->modalDescription(__('Dezactivează 2FA pentru acest utilizator. Va trebui să re-configureze TOTP la următoarea autentificare.'))
                    ->action(function ($record) {
                        $record->saveAppAuthenticationSecret(null);
                        $record->saveAppAuthenticationRecoveryCodes(null);
                        \Filament\Notifications\Notification::make()->title(__('2FA resetat'))->success()->send();
                    }),
                Actions\DeleteAction::make(),
            ])
            ->defaultSort('created_at', 'desc');
    }

    public static function getRelations(): array
    {
        return [
            RelationManagers\PermissionOverridesRelationManager::class,
        ];
    }

    public static function getPages(): array
    {
        return [
            'index' => Pages\ListUsers::route('/'),
            'create' => Pages\CreateUser::route('/create'),
            'edit' => Pages\EditUser::route('/{record}/edit'),
        ];
    }
}