{% extends "base.html" %}{% block title %}Roles & ACL{% endblock %}{% block page_title %}Roles & ACL{% endblock %}
{% block content %}<div class="page-header"><div><h1>Roles & Access Control</h1><p>Permission grants define allowed actions; visibility scope limits records to own, department, branch, or all branches.</p></div></div><div class="form-note" style="margin-bottom:16px"><strong>Confidentiality rule:</strong> Anonymous reporter identity is visible only to roles with “View protected reporter identity.” Grant global scope sparingly.</div><div class="three-column">{% for role in roles %}<form class="card" method="post" action="{{ url_for('admin.role_update', role_id=role.id) }}"><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><div class="card-header"><div><h2>{{ role.name }}</h2><p>{{ role.code }}</p></div><span class="status">{{ role.scope|title }}</span></div><div class="card-body"><label>Role Name<input type="text" name="name" value="{{ role.name }}" required></label><label>Visibility Scope<select name="scope"><option value="own" {% if role.scope=='own' %}selected{% endif %}>Own reports only</option><option value="department" {% if role.scope=='department' %}selected{% endif %}>Department</option><option value="branch" {% if role.scope=='branch' %}selected{% endif %}>Branch</option><option value="all" {% if role.scope=='all' %}selected{% endif %}>All branches</option></select></label><label style="margin-top:14px">Permissions</label><div style="display:grid;gap:7px;margin-top:8px">{% for permission in permissions %}<label class="choice"><input type="checkbox" name="permission_ids" value="{{ permission.id }}" {% if permission in role.permissions %}checked{% endif %}><span><strong>{{ permission.code }}</strong><br><small>{{ permission.label }}</small></span></label>{% endfor %}</div><button class="button primary" type="submit" style="margin-top:14px">Save ACL</button></div></form>{% endfor %}</div>{% endblock %}