(()=>{const page=document.getElementById('staff');if(!page||typeof api!=='function')return;const esc=v=>String(v??'').replace(/[&<>\"]/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;'}[c]));const roles=['super_admin','admin_manager','store_manager','billing_staff','order_staff','inventory_staff','content_manager','support_staff','review_moderator','report_viewer'];page.innerHTML=`<div class="card"><div class="toolbar"><div><h2>Staff & roles</h2><p class="small">Live staff accounts from the production database. Super Admins can create staff and change roles; your own account cannot be disabled.</p></div><button class="primary" id="staffAdd">+ Add staff</button></div><div id="staffStatus" class="status">Loading…</div></div><div class="section card"><div class="toolbar"><input id="staffSearch" placeholder="Search email or name"><select id="staffRoleFilter"><option value="">All roles</option>${roles.map(r=>`<option>${r}</option>`).join('')}</select></div><div class="table-wrap"><table class="table"><thead><tr><th>Staff</th><th>Role</th><th>Status</th><th>Created</th><th>Actions</th></tr></thead><tbody id="staffRows"></tbody></table></div></div><div id="staffModal" class="login hidden"><div class="loginbox"><h2>Add staff account</h2><p class="small">Creates the Supabase Auth account, profile and role together. Passwords are never stored by this UI.</p><label>Name</label><input id="sName" autocomplete="name"><label>Email</label><input id="sEmail" type="email" autocomplete="email"><label>Phone</label><input id="sPhone" autocomplete="tel"><label>Role</label><select id="sRole">${roles.map(r=>`<option value="${r}">${r}</option>`).join('')}</select><label>Initial password</label><input id="sPassword" type="password" minlength="10" autocomplete="new-password"><div class="actions"><button class="primary" id="sCreate">Create staff</button><button class="ghost" id="sCancel">Cancel</button></div><div id="sStatus" class="status"></div></div></div>`;let rows=[];const msg=(id,t,e=false)=>{const x=document.getElementById(id);if(x){x.textContent=t;x.className='status'+(e?' error':'')}};const load=async()=>{try{msg('staffStatus','Loading staff…');const d=await api('/v1/admin/staff');rows=d.staff||[];render();msg('staffStatus',`${rows.length} staff account${rows.length===1?'':'s'} loaded from database.`)}catch(e){msg('staffStatus',e.message||'Unable to load staff',true)}};const render=()=>{const q=document.getElementById('staffSearch').value.toLowerCase().trim(),rf=document.getElementById('staffRoleFilter').value;const data=rows.filter(x=>(!rf||x.role===rf)&&(`${x.email||''} ${x.display_name||''} ${x.phone||''}`).toLowerCase().includes(q));document.getElementById('staffRows').innerHTML=data.map(x=>`<tr><td><b>${esc(x.display_name||'Unnamed')}</b><div class="small">${esc(x.email)}${x.phone?' · '+esc(x.phone):''}</div></td><td><select class="role-edit" data-id="${esc(x.id)}" ${x.id===state.ctx?.user_id?'disabled':''}>${roles.map(r=>`<option value="${r}" ${r===x.role?'selected':''}>${r}</option>`).join('')}</select></td><td><span class="badge ${x.is_active?'':'danger'}">${x.is_active?'ACTIVE':'DISABLED'}</span></td><td class="small">${esc(new Date(x.created_at).toLocaleString('en-IN'))}</td><td>${x.id===state.ctx?.user_id?'<span class="small">Current account</span>':`<button class="ghost active-toggle" data-id="${esc(x.id)}" data-next="${!x.is_active}">${x.is_active?'Disable':'Enable'}</button>`}</td></tr>`).join('')||'<tr><td colspan="5" class="small">No matching staff accounts.</td></tr>';document.querySelectorAll('.role-edit').forEach(s=>s.onchange=async()=>{const next=s.value;if(!confirm(`Change this staff role to ${next}?`)){render();return}s.disabled=true;try{await api('/v1/admin/staff/'+encodeURIComponent(s.dataset.id)+'/role',{method:'POST',body:JSON.stringify({role:next})});await load()}catch(e){alert(e.message||'Role change failed');await load()}});document.querySelectorAll('.active-toggle').forEach(b=>b.onclick=async()=>{if(!confirm(`${b.dataset.next==='true'?'Enable':'Disable'} this staff account?`))return;try{b.disabled=true;await api('/v1/admin/staff/'+encodeURIComponent(b.dataset.id)+'/active',{method:'POST',body:JSON.stringify({is_active:b.dataset.next==='true'})});await load()}catch(e){alert(e.message||'Status change failed');b.disabled=false}})};document.getElementById('staffSearch').oninput=render;document.getElementById('staffRoleFilter').onchange=render;document.getElementById('staffAdd').onclick=()=>{document.getElementById('staffModal').classList.remove('hidden');msg('sStatus','')};document.getElementById('sCancel').onclick=()=>document.getElementById('staffModal').classList.add('hidden');document.getElementById('sCreate').onclick=async()=>{try{const email=document.getElementById('sEmail').value.trim(),password=document.getElementById('sPassword').value;if(!email||password.length<10)throw new Error('Valid email and password of at least 10 characters are required');msg('sStatus','Creating staff account…');document.getElementById('sCreate').disabled=true;await api('/v1/admin/staff',{method:'POST',body:JSON.stringify({email,password,display_name:document.getElementById('sName').value.trim(),phone:document.getElementById('sPhone').value.trim(),role:document.getElementById('sRole').value})});document.getElementById('staffModal').classList.add('hidden');document.getElementById('sPassword').value='';await load()}catch(e){msg('sStatus',e.message||'Staff creation failed',true)}finally{document.getElementById('sCreate').disabled=false}};window.DTStaff={load};load()})();