@php $selectedRole = $selectedRole?->loadMissing(['permissions', 'menuItems']); $selectedPermissionIds = $selectedRole?->permissions->pluck('id')->all() ?? []; $selectedMenuIds = $selectedRole?->menuItems->pluck('id')->all() ?? []; $selectedPermissionLookup = array_fill_keys(array_map('intval', $selectedPermissionIds), true); $selectedMenuLookup = array_fill_keys(array_map('intval', $selectedMenuIds), true); $planFeatures = [ 'ai_message' => __('AI Message'), 'schedule_message' => __('Schedule Message'), 'bulk_message' => __('Bulk Message'), 'autoreply' => __('Auto Reply'), 'send_message' => __('Send Message'), 'send_media' => __('Send Media'), 'send_product' => __('Send Product'), 'send_text_channel' => __('Text To Channel'), 'send_list' => __('Send List'), 'send_button' => __('Send Button'), 'send_location' => __('Send Location'), 'send_sticker' => __('Send Sticker'), 'send_vcard' => __('Send VCard'), 'send_template' => __('Send Template'), 'send_poll' => __('Send Poll'), 'webhook' => __('Webhook'), 'api' => __('API'), ]; @endphp

{{ __('Granular access control for roles, permissions, menu visibility, and user assignments.') }}

@if (!empty($canSyncCatalog)) @endif

@if ($errors->any())

{{ $error }}

@endif

@foreach($summaryCards as $card)

@endforeach

@if (!empty($canSyncCatalog)) @endif @php $tabIcons = [ 'roles' => 'tabler-user-shield', 'permissions' => 'tabler-key', 'access' => 'tabler-report', 'users' => 'tabler-users', 'help' => 'tabler-info-circle', ]; @endphp

{{ $tabLabel }}

@if ($activeTab === 'roles')

@csrf @if($editingRole) @method('PUT') @endif

{{ __('Use a clear business-facing role name that admins can recognize quickly.') }}

@error('name')

@enderror

{{ __('Use lowercase letters, numbers, dots, or dashes only. Example: supervisor or support.lead') }}

@error('slug')

@enderror

{{ __('Briefly explain what this role is responsible for and where it should be used.') }}

@error('description')

@enderror

@if($editingRole) {{ __('Reset') }} @endif

@forelse($roles as $role) @empty @endforelse

{{ __('Actions') }}	{{ __('Role') }}	{{ __('Description') }}	{{ __('Created At') }}	{{ __('Updated At') }}	{{ __('Created By') }}	{{ __('Updated By') }}
@if(!$role->is_system) @endif	{{ $role->name }} {{ $role->slug }}	@php $roleDescription = $role->description ?: __('No description'); @endphp @if($role->description) @else {{ $roleDescription }} @endif	@if($role->created_at) {{ $role->created_at->copy()->utc()->format('Y-m-d H:i:s') }} {{ __('UTC') }} @else - @endif	@if($role->updated_at) {{ $role->updated_at->copy()->utc()->format('Y-m-d H:i:s') }} {{ __('UTC') }} @else - @endif	@if($role->creator) {{ $role->creator->username }} {{ $role->creator->email }} @else - @endif	@if($role->updater) {{ $role->updater->username }} {{ $role->updater->email }} @else - @endif
{{ __('No roles found yet.') }}

{{ __('A role is an access bundle. You create one role, attach permissions and menu visibility to it, then assign that role to one or more users.') }}

{{ __('This keeps access management consistent because you do not need to configure every user one by one.') }}

{{ __('Create a new role when a group of users needs a distinct responsibility, such as sales staff, support agents, supervisors, or branch operators.') }}

{{ __('Avoid creating too many nearly identical roles. If only one or two permissions differ, review whether the access matrix can be simplified first.') }}

{{ __('Use a human-readable role name such as Supervisor, Customer Support, or Branch Admin.') }}

{{ __('Use the slug as a stable internal identifier. Keep it lowercase and simple, for example supervisor, support, or branch-admin.') }}

{{ __('Write a short description that explains the job scope so another admin can understand the role without opening the access matrix first.') }}

{{ __('After saving the role, continue to Menu Access and choose only the pages that the role should open. Then assign the role to a non-admin test user and verify the user experience.') }}

{{ __('Admin users keep full access, and existing plan checks still run. RBAC should be used as an additional control layer for operational users, not as a replacement for subscription logic.') }}

@endif @if ($activeTab === 'permissions')

{{ $editingPermission ? ('Edit Permission') : ('Create Permission') }}

@csrf @if($editingPermission) @method('PUT') @endif

@error('name')

@enderror

{{ __('Use lowercase letters, numbers, dots, or dashes only.') }}

@error('slug')

@enderror

@error('description')

@enderror

@error('route_patterns')

@enderror

@if($editingPermission) {{ __('Reset') }} @endif

@forelse($permissionTable as $permission) @empty @endforelse

{{ __('Actions') }}	{{ __('Permission') }}	{{ __('Description') }}	{{ __('Route Patterns') }}	{{ __('Created At') }}	{{ __('Updated At') }}	{{ __('Created By') }}	{{ __('Updated By') }}
@if(!$permission->is_system) @endif	{{ $permission->name }} {{ $permission->slug }} {{ __($permission->status_label ?? ($permission->is_system ? 'System' : 'Custom')) }}	@php $permissionDescription = $permission->description ?: __('No description'); @endphp @if($permission->description) @else {{ $permissionDescription }} @endif	@php $permissionRoutePatterns = $permission->route_patterns ?? []; $patternCount = count($permissionRoutePatterns); @endphp @if($patternCount > 0) @else {{ __('No route patterns') }} @endif	@if($permission->created_at) {{ $permission->created_at->copy()->utc()->format('Y-m-d H:i:s') }} {{ __('UTC') }} @else-@endif	@if($permission->updated_at) {{ $permission->updated_at->copy()->utc()->format('Y-m-d H:i:s') }} {{ __('UTC') }} @else-@endif	@if($permission->creator) {{ $permission->creator->username }} {{ $permission->creator->email }}@else-@endif	@if($permission->updater) {{ $permission->updater->username }} {{ $permission->updater->email }}@else-@endif
{{ __('No permissions found yet.') }}

{{ __('A permission defines one capability that can later be attached to one or more roles. Think of it as a reusable access rule, not a job title.') }}

{{ __('For example, instead of creating a permission called Supervisor Access, create permissions such as View Devices, Manage Devices, or Export Reports.') }}

{{ __('This makes your RBAC setup easier to understand and easier to reuse across multiple teams.') }}

{{ __('Permission Name is the label that humans will read. Keep it short and clear, for example: View Devices, Manage Contacts, or Edit Campaigns.') }}

{{ __('Permission Slug is the internal identifier used by the system. Keep it lowercase and stable, for example: core.devices.view or admin.users.manage.') }}

{{ __('A good rule is simple: the name should be easy for admins to read, and the slug should be clean and predictable for long-term maintenance.') }}

{{ __('Use the description to explain what the permission gives access to in real terms. This helps another admin understand the purpose without opening the route list first.') }}

{{ __('Example: Allows the user to create, reconnect, update, and delete connected devices.') }}

{{ __('Route Patterns tell the plugin which page or action belongs to this permission. Write one route name or route pattern per line.') }}

{{ __('Example: if the permission is about devices, you might add routes such as devices, addDevice, and deleteDevice on separate lines.') }}

{{ __('If you put unrelated routes into one permission, access control becomes harder to audit later. Keep each permission focused.') }}

{{ __('After a permission is created, go to the Menu Access tab and attach that permission to the right role. Then assign the role to the right user.') }}

{{ __('Test with a non-admin account to confirm the user can only open the pages and actions that should be allowed.') }}

{{ __('This plugin adds RBAC on top of the existing plan-based checks, so a user still needs to satisfy the normal plan/subscription rules as well.') }}

@endif @if ($activeTab === 'access')

@if($roles->isEmpty())

{{ __('Create at least one role in the Roles tab before configuring menu and permission access.') }}

@else

{{ __('Pick one role, then check only the permissions and menus that role should access.') }}

@php $selectedPermissionCount = count($selectedPermissionIds ?? []); $selectedMenuCount = count($selectedMenuIds ?? []); $activeMenuSectionCount = collect($menuItems ?? []) ->filter(fn ($sectionItems) => collect($sectionItems)->contains(fn ($menuItem) => !empty($selectedMenuLookup[(int) $menuItem->id]))) ->count(); @endphp

{{ $selectedPermissionCount }} {{ __('Permissions') }} {{ $selectedMenuCount }} {{ __('Menus') }} {{ $activeMenuSectionCount }} {{ __('Active Sections') }} {{ __('Saved snapshot') }}

@if($selectedRole) @if (session('rbac_access_plan_notice'))

@endif

@csrf @method('PUT')

@foreach($permissions->groupBy(fn ($permission) => explode('.', $permission->slug)[0] ?? 'general') as $group => $groupPermissions) @php $allPermissionsLocked = $groupPermissions->every(fn ($permission) => str_starts_with($permission->slug, 'admin.')); @endphp

@foreach($groupPermissions as $permission) @php $isAdminLockedPermission = str_starts_with($permission->slug, 'admin.'); $planGates = $permissionPlanGateMap[$permission->id] ?? []; @endphp id])) @disabled($isAdminLockedPermission)> {{ $permission->name }} @if(!empty($planGates)) @if(count($planGates) === 1) {{ __('Plan-gated: :feature', ['feature' => $planGates[0]['label'] ?? __('Unknown feature')]) }} @else @endif @endif @if($isAdminLockedPermission) {{ __('Locked - MPWA Codebase') }} @if(!empty($selectedPermissionLookup[(int) $permission->id])) @endif @endif @endforeach

@endforeach

@foreach($menuItems as $section => $sectionItems) @php $allMenusLocked = $sectionItems->every(fn ($menuItem) => (bool) ($menuItem->admin_only ?? false)); @endphp

@foreach($sectionItems as $menuItem) @php $isAdminLockedMenu = (bool) ($menuItem->admin_only ?? false); $planGates = $menuPlanGateMap[$menuItem->id] ?? []; @endphp id])) @disabled($isAdminLockedMenu)> {{ __($menuItem->label) }} @if(!empty($planGates)) @if(count($planGates) === 1) {{ __('Plan-gated: :feature', ['feature' => $planGates[0]['label'] ?? __('Unknown feature')]) }} @else @endif @endif @if($isAdminLockedMenu) {{ __('Locked - MPWA Codebase') }} @if(!empty($selectedMenuLookup[(int) $menuItem->id])) @endif @endif @endforeach

@endforeach

@else

@endif @endif

{{ __('Use Role to Configure to choose one role. All changes you save only apply to the selected role.') }}

{{ __('Permission checkboxes decide what actions the role can perform at route/action level.') }}

{{ __('Grant only what is required for daily tasks (principle of least privilege).') }}

{{ __('Menu checkboxes control which navigation items are visible for that role.') }}

{{ __('A hidden menu does not replace permission checks, so keep both permissions and menus aligned.') }}

{{ __('Items with badge Locked - MPWA Codebase come from core MPWA routes that are hard-locked by the main application code (for example, routes with admin middleware).') }}

{{ __('Those items are shown for transparency, but their access rules are controlled by the MPWA core, not by this plugin matrix.') }}

{{ __('In short: this badge means you can see the item in the matrix, but final access behavior follows the MPWA codebase policy.') }}

{{ __('RBAC decides what role can access. Plan Features decide whether that access can actually be used.') }}

{{ __('Beginner shortcut: if menu is visible but action/page is denied, usually one required Plan Feature is still OFF.') }}

{{ __('3) If OFF, enable it from Users > Plan Features, then test again.') }}

@forelse($planGatedMatrix as $rule) @empty @endforelse

{{ __('Route/Menu') }}	{{ __('Required Plan Feature') }}	{{ __('If OFF') }}	{{ __('What to do') }}
{{ $rule['examples'] ?? '-' }}	{{ $rule['feature_label'] ?? ($rule['feature_key'] ?? '-') }}	{{ $rule['impact'] ?? '-' }}	{{ $rule['action'] ?? '-' }}
{{ __('No plan-gated mapping defined.') }}

{{ __('Note: some entries are action-level (for example Single Message type: poll/text/media), so they may fail even if the menu opens.') }}

{{ __('Checklist: 1) Role has permission, 2) Role has menu, 3) User Plan Feature is ON.') }}

{{ __('After saving, test login with a user assigned to this role and verify access + menu visibility.') }}

{{ __('Admin users still have full access; use non-admin accounts for validation.') }}

@endif @if ($activeTab === 'users')

@csrf @if($editingUser) @method('PUT') @endif

{{ __('Use 3+ characters. Allowed: letters, numbers, dot, underscore, dash.') }}

@error('username')

@enderror

{{ __('Email') }} @error('email')

@enderror

@if($editingUser) {{ __('Leave empty to keep the current password.') }} @endif @error('password')

@enderror

{{ __('Messages Limit') }} @error('messages_limit')

@enderror

{{ __('Device Limit') }} @error('limit_device')

@enderror

{{ __('Subscription') }} @error('active_subscription')

@enderror

{{ __('Plan Name') }} @error('plan_name')

@enderror

@error('subscription_expired')

@enderror

@foreach($planFeatures as $featureKey => $featureLabel) @php $featureEnabled = old('plan_data.' . $featureKey, data_get($editingUser?->plan_data ?? [], $featureKey, false)); @endphp {{ $featureLabel }} @endforeach

@error('plan_data')

@enderror

{{ __('Roles') }} @php $selectedRoleIds = collect(old('role_ids', $editingUser?->roles->pluck('id')->all() ?? [])) ->map(fn ($value) => (int) $value) ->all(); @endphp

@foreach($roles as $role) id, $selectedRoleIds, true))> {{ $role->name }} @endforeach

@error('role_ids')

@enderror @error('role_ids.*')

@enderror

@if($editingUser) {{ __('Reset') }} @endif

@forelse($users as $user) @empty @endforelse

{{ __('Actions') }}	{{ __('User') }}	{{ __('Level') }}	{{ __('Status') }}	{{ __('Roles') }}	{{ __('Created At') }}	{{ __('Updated At') }}	{{ __('Created By') }}	{{ __('Updated By') }}
@if($user->level !== 'admin') @endif	{{ $user->username }} {{ $user->email }}	{{ __($user->level) }}	{{ __($user->status) }}	@forelse($user->roles as $role) {{ $role->name }} @empty {{ __('No role assigned') }} @endforelse @if(!empty($userPlanWarnings[$user->id] ?? [])) @endif	@if($user->created_at) {{ \Illuminate\Support\Carbon::parse($user->created_at)->utc()->format('Y-m-d H:i:s') }} {{ __('UTC') }} @else-@endif	@if($user->updated_at) {{ \Illuminate\Support\Carbon::parse($user->updated_at)->utc()->format('Y-m-d H:i:s') }} {{ __('UTC') }} @else-@endif	@if($user->creator_username) {{ $user->creator_username }} {{ $user->creator_email }}@else-@endif	@if($user->updater_username) {{ $user->updater_username }} {{ $user->updater_email }}@else-@endif
{{ __('No users found yet.') }}

{{ __('Set Username, Email, and Password as the base identity. Use a clear username format so admins can search users quickly.') }}

{{ __('For edit mode, leaving Password empty keeps the existing password unchanged.') }}

{{ __('Messages Limit and Device Limit define account capacity. Keep these values aligned with the user plan and policy.') }}

{{ __('If Subscription is Active, make sure Subscription Expired At is filled with a valid future date/time.') }}

{{ __('Plan Features are capability switches (API, Bulk Message, Webhook, etc).') }}

{{ __('Keep this section minimal: enable only what user really needs.') }}

{{ __('Use the accordion to open Plan Features only when configuring this part.') }}

{{ __('Roles are now checklist-based. Check one or more roles that match user responsibility.') }}

{{ __('If no role is checked, user will not get role-based access from this plugin.') }}

{{ __('If you see Plan mismatch badge in Users table, role grants access but required Plan Features are still OFF.') }}

{{ __('Click the badge to open detail modal, then enable required features from Edit User form.') }}

{{ __('After update, retest with non-admin account to confirm access works as expected.') }}

@endif @if ($activeTab === 'help')

{{ __('Contact us for support, feature requests, bug fixes, or project collaboration.') }}

@endif @if (session('alert')) @endif

{{ __('RBAC Manager') }}

{{ $editingRole ? ('Edit Role') : ('Create Role') }}

{{ $editingPermission ? ('Edit Permission') : ('Create Permission') }}

{{ __('Menu Access Matrix') }}

{{ __('Permissions') }}

{{ __('Menus') }}

{{ $editingUser ? ('Edit User') : ('Create User') }}

{{ __('Need help with RBAC Manager?') }}

{{ __('RBAC Manager') }}

{{ $editingRole ? __('Edit Role') : __('Create Role') }}

{{ $editingPermission ? __('Edit Permission') : __('Create Permission') }}

{{ __('Menu Access Matrix') }}

{{ __('Permissions') }}

{{ __('Menus') }}

{{ $editingUser ? __('Edit User') : __('Create User') }}

{{ __('Plan Features') }} 0

{{ __('Need help with RBAC Manager?') }}

{{ $editingRole ? ('Edit Role') : ('Create Role') }}

{{ $editingPermission ? ('Edit Permission') : ('Create Permission') }}

{{ $editingUser ? ('Edit User') : ('Create User') }}