{% extends "base.html" %}

{% block title %}Администрирование - AWM{% endblock %}

{% block content %}
<link rel="stylesheet" href="/static/css/server-logs-terminal.css">
<script src="/static/js/server-logs-view.js"></script>
<style>
    .admin-root {
        border: 1px solid var(--border);
        border-radius: 14px;
        box-shadow: 0 10px 30px rgba(15, 23, 42, 0.06);
    }
    .admin-header-note { color: var(--text-muted); margin-top: 6px; max-width: 760px; }
    .admin-stat-grid {
        display: grid;
        grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
        gap: 12px;
        margin-bottom: 18px;
    }
    .admin-stat { border: 1px solid var(--border); border-radius: 12px; padding: 14px; background: linear-gradient(180deg, var(--surface) 0%, var(--bg-secondary) 100%); }
    .admin-stat-label { font-size: 12px; color: var(--gray-500); text-transform: uppercase; letter-spacing: .03em; }
    .admin-stat-value { font-size: 24px; font-weight: 700; color: var(--gray-800); margin-top: 4px; }
    .platform-kpi-grid {
        display: grid;
        grid-template-columns: repeat(3, minmax(140px, 1fr));
        gap: 10px;
        margin-bottom: 14px;
    }
    .platform-kpi-card {
        border: 1px solid var(--border);
        border-radius: 12px;
        padding: 12px;
        background: linear-gradient(180deg, var(--surface) 0%, var(--bg-secondary) 100%);
    }
    .platform-kpi-label { font-size: 12px; color: var(--gray-500); }
    .platform-kpi-value { font-size: 26px; font-weight: 700; color: var(--gray-800); margin-top: 4px; }
    .platform-kpi-note { font-size: 11px; color: var(--gray-500); margin-top: 2px; }
    .platform-health {
        display: flex;
        align-items: center;
        justify-content: space-between;
        gap: 12px;
        margin: 0 0 12px;
        padding: 12px 14px;
        border: 1px solid var(--border);
        border-radius: 12px;
        background: var(--surface);
    }
    .platform-health.stable { border-color: color-mix(in srgb, #16a34a 40%, var(--border)); }
    .platform-health.attention { border-color: color-mix(in srgb, #d97706 45%, var(--border)); }
    .platform-health.critical { border-color: color-mix(in srgb, #dc2626 45%, var(--border)); }
    .platform-health-score { font-size: 28px; font-weight: 800; color: var(--gray-800); }
    .platform-health-label { font-size: 13px; color: var(--gray-600); }
    .platform-finding {
        border-radius: 10px;
        padding: 10px 12px;
        margin-bottom: 8px;
        border: 1px solid var(--border);
        background: var(--bg-secondary);
    }
    .platform-finding:last-child { margin-bottom: 0; }
    .platform-finding.danger { border-color: color-mix(in srgb, #dc2626 35%, var(--border)); }
    .platform-finding.warning { border-color: color-mix(in srgb, #d97706 35%, var(--border)); }
    .platform-finding.ok { border-color: color-mix(in srgb, #16a34a 30%, var(--border)); }
    .platform-finding-title { font-weight: 700; font-size: 13px; color: var(--gray-800); }
    .platform-finding-detail { font-size: 12px; color: var(--gray-600); margin-top: 4px; }
    .platform-stats-grid {
        display: grid;
        grid-template-columns: repeat(2, minmax(280px, 1fr));
        gap: 12px;
    }
    .platform-stats-panel {
        border: 1px solid var(--border);
        border-radius: 12px;
        padding: 14px;
        background: var(--surface);
    }
    .platform-stats-panel h4 { margin: 0 0 10px; font-size: 14px; }
    .platform-stats-panel.span-2 { grid-column: 1 / -1; }
    .platform-kv { display: grid; gap: 7px; }
    .platform-kv-item {
        display: flex;
        justify-content: space-between;
        gap: 10px;
        padding: 7px 10px;
        border-radius: 8px;
        background: var(--bg-secondary);
        font-size: 13px;
    }
    .platform-module-row {
        display: flex;
        justify-content: space-between;
        gap: 8px;
        align-items: center;
        padding: 8px 10px;
        border-radius: 8px;
        background: var(--bg-secondary);
        font-size: 13px;
    }
    .platform-runs-table { width: 100%; border-collapse: collapse; font-size: 13px; }
    .platform-runs-table th, .platform-runs-table td {
        text-align: left;
        padding: 8px 6px;
        border-bottom: 1px solid var(--border);
    }
    .platform-status {
        border-radius: 999px;
        display: inline-flex;
        padding: 2px 8px;
        font-size: 11px;
        font-weight: 600;
    }
    .platform-status.success { background: #dcfce7; color: #166534; }
    .platform-status.failed { background: #fee2e2; color: #991b1b; }
    .platform-status.running, .platform-status.pending { background: #ffedd5; color: #9a3412; }
    .platform-status.cancelled { background: #e5e7eb; color: #374151; }
    @media (max-width: 1100px) {
        .platform-kpi-grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
        .platform-stats-grid { grid-template-columns: 1fr; }
        .platform-stats-panel.span-2 { grid-column: auto; }
    }
    .admin-nav {
        display: flex;
        flex-wrap: wrap;
        gap: 8px;
        margin-bottom: 18px;
        padding: 10px;
        border: 1px solid var(--border);
        border-radius: 12px;
        background: var(--bg-secondary);
    }
    .admin-section {
        scroll-margin-top: 90px;
        margin-top: 14px;
        border: 1px solid var(--border);
        border-radius: 12px;
        background: var(--surface);
    }
    .admin-sections-grid {
        display: grid;
        grid-template-columns: repeat(2, minmax(0, 1fr));
        align-items: start;
        gap: 14px;
        margin-top: 8px;
    }
    .admin-section.full-width {
        grid-column: 1 / -1;
    }
    .admin-subtitle { font-size: 12px; color: var(--text-muted); margin-top: -8px; margin-bottom: 14px; max-width: 760px; }
    .admin-api-token-actions {
        display: inline-flex;
        flex-wrap: nowrap;
        align-items: center;
        gap: 4px;
        white-space: nowrap;
    }
    .admin-api-token-actions .ui-icon-btn {
        flex-shrink: 0;
        width: 28px;
        height: 28px;
        min-width: 28px;
        border-radius: 8px;
    }
    .admin-badge { display: inline-block; padding: 2px 8px; border-radius: 999px; font-size: 11px; font-weight: 600; }
    .admin-badge.ok { background: #dcfce7; color: #166534; }
    .admin-badge.off { background: #fee2e2; color: #991b1b; }
    [data-theme="violet"] .admin-badge.ok {
        background: color-mix(in srgb, var(--success) 22%, var(--surface));
        color: var(--gray-900);
        border: 1px solid color-mix(in srgb, var(--success) 40%, var(--border));
    }
    [data-theme="violet"] .admin-badge.off {
        background: color-mix(in srgb, var(--danger) 22%, var(--surface));
        color: var(--gray-900);
        border: 1px solid color-mix(in srgb, var(--danger) 40%, var(--border));
    }
    .provider-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(290px, 1fr)); gap: 12px; }
    .provider-card { border: 1px solid var(--border); border-radius: 12px; padding: 14px; background: linear-gradient(180deg, var(--surface) 0%, var(--bg-secondary) 100%); }
    .provider-title { display: flex; justify-content: space-between; align-items: center; margin-bottom: 8px; font-weight: 700; color: var(--gray-800); }
    .provider-meta { font-size: 12px; color: var(--gray-500); display: flex; gap: 12px; flex-wrap: wrap; margin-bottom: 8px; }
    .provider-config { font-size: 12px; color: var(--gray-700); background: var(--bg-secondary); border: 1px solid var(--border); border-radius: 8px; padding: 8px; white-space: pre-wrap; word-break: break-word; max-height: 130px; overflow: auto; }
    .provider-actions { margin-top: 10px; display: flex; gap: 8px; flex-wrap: wrap; }
    .mapping-grid { display: grid; grid-template-columns: 1fr 1.2fr; gap: 12px 16px; align-items: start; }
    .mapping-head { font-size: 12px; color: var(--gray-500); font-weight: 600; padding-bottom: 4px; }
    .mapping-row { display: contents; }
    .mapping-grid .mapping-field-label {
        display: flex;
        align-items: center;
        min-height: 44px;
        color: var(--gray-800);
        font-weight: 600;
        font-size: 14px;
    }
    .mapping-grid .sso-map-select,
    .mapping-grid .sso-map-custom,
    .mapping-grid .provider-map-select,
    .mapping-grid .provider-map-custom { width: 100%; }
    #users-list, #roles-list, #allowed-hosts-list, #audit-list, #auth-providers-list, #integrations-list, #server-logs-list {
        border: 1px solid var(--border);
        border-radius: 10px;
        padding: 8px;
        background: var(--surface);
    }
    .admin-global-error {
        margin: 0 0 16px;
    }
    .admin-global-error:empty {
        display: none !important;
    }
    #users-list .data-table th {
        position: sticky;
        top: 0;
        z-index: 1;
        background: var(--bg-secondary);
    }
    .user-cell-main { display:flex; flex-direction:column; gap:2px; }
    .user-cell-title { font-weight:700; color:var(--gray-800); }
    .user-cell-sub { font-size:12px; color:var(--gray-500); }
    .user-badges { display:flex; gap:6px; flex-wrap:wrap; }
    .user-role-chip {
        display:inline-block;
        padding:2px 8px;
        border-radius:999px;
        font-size:11px;
        font-weight:600;
        background:#e0e7ff;
        color:#3730a3;
        border:1px solid #c7d2fe;
    }
    [data-theme="violet"] .user-role-chip {
        background: color-mix(in srgb, var(--primary) 24%, var(--surface));
        color: var(--gray-900);
        border-color: color-mix(in srgb, var(--primary) 42%, var(--border));
    }
    .user-actions { display:flex; gap:6px; flex-wrap:wrap; }
    .office-check-list {
        display: flex;
        flex-direction: column;
        gap: 8px;
        max-height: 200px;
        overflow: auto;
        padding: 12px 16px;
        border: 2px solid var(--border);
        border-radius: 10px;
        background: var(--input-bg);
    }
    .office-check-item {
        display: flex;
        align-items: center;
        gap: 8px;
        margin: 0;
        font-size: 14px;
        font-weight: 500;
        color: var(--gray-800);
        cursor: pointer;
    }
    .admin-spoiler-content { margin-top: 10px; }
    .admin-spoiler-toggle { margin-left: auto; }
    .admin-gated-hidden { display: none !important; }
    .server-log-wrap { margin-top: 10px; border: 1px solid var(--border); border-radius: 10px; overflow: hidden; }
    .server-log-toolbar { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; padding: 10px; background: var(--bg-secondary); border-bottom: 1px solid var(--border); }
    .server-log-toolbar .server-log-debug-label {
        display: inline-flex;
        align-items: center;
        gap: 6px;
        font-size: 13px;
        font-weight: 600;
        color: var(--gray-700);
        margin: 0;
        cursor: pointer;
        user-select: none;
    }
    #audit-list .data-table th {
        position: sticky;
        top: 0;
        z-index: 1;
        background: var(--bg-secondary);
    }
    #audit-list {
        max-height: 560px;
        overflow: auto;
        border: 1px solid var(--border);
        border-radius: 10px;
    }
    #audit-list .empty-state,
    #audit-list .loading,
    #audit-list .admin-error {
        border: none;
    }
    .audit-action-title {
        font-weight: 650;
        color: var(--gray-900);
        line-height: 1.25;
    }
    .audit-action-code {
        margin-top: 2px;
        font-size: 11px;
        color: var(--gray-500);
        font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
    }
    .audit-resource-cell {
        line-height: 1.3;
    }
    .audit-resource-type {
        color: var(--gray-800);
        font-weight: 600;
    }
    .audit-resource-id {
        margin-top: 2px;
        font-size: 12px;
        color: var(--gray-500);
        word-break: break-all;
    }
    .audit-details-pre {
        margin: 8px 0 0;
        max-height: 220px;
        overflow: auto;
        white-space: pre-wrap;
        font-size: 12px;
        line-height: 1.35;
        color: var(--gray-700);
        background: var(--bg-secondary);
        border: 1px solid var(--border);
        border-radius: 8px;
        padding: 8px 10px;
    }
    .audit-details-summary {
        cursor: pointer;
        color: var(--primary);
        font-size: 12px;
        font-weight: 600;
        list-style: none;
    }
    .audit-details-summary::-webkit-details-marker { display: none; }
    .audit-meta-muted {
        color: var(--gray-500);
        font-size: 12px;
    }
    #section-danger {
        border-color: color-mix(in srgb, var(--danger) 42%, var(--border)) !important;
        background: linear-gradient(
            180deg,
            color-mix(in srgb, var(--danger) 12%, var(--surface)) 0%,
            color-mix(in srgb, var(--danger) 18%, var(--bg-secondary)) 100%
        ) !important;
    }
    #section-danger .toolbar h3 {
        color: var(--gray-800);
    }
    #section-danger .admin-subtitle {
        color: color-mix(in srgb, var(--danger) 45%, var(--gray-700));
        max-width: 820px;
    }
    #purge-modal .purge-warning {
        display: block;
        text-align: left;
        margin-bottom: 12px;
        padding: 12px 14px;
        border-radius: 10px;
        border: 1px solid color-mix(in srgb, var(--danger) 42%, var(--border));
        background: color-mix(in srgb, var(--danger) 12%, var(--surface));
        color: var(--gray-800);
    }
    #purge-modal .purge-warning ul {
        margin: 8px 0 0 1.1em;
        padding: 0;
        color: var(--gray-700);
        font-size: 13px;
    }
    #purge-modal .purge-keep {
        margin: 10px 0 0;
        font-size: 13px;
        color: var(--gray-500);
    }
    #role-modal .modal-content {
        max-width: 920px;
        width: min(920px, 96vw);
        max-height: calc(100vh - 48px);
        display: flex;
        flex-direction: column;
        overflow: hidden;
    }
    #role-modal form {
        display: flex;
        flex-direction: column;
        min-height: 0;
        flex: 1;
        overflow: hidden;
    }
    #role-modal .role-perm-toolbar {
        display: flex;
        flex-wrap: wrap;
        gap: 10px;
        align-items: center;
        margin-bottom: 10px;
    }
    #role-modal .role-perm-toolbar .form-control {
        flex: 1 1 220px;
        min-width: 180px;
        padding: 10px 14px;
    }
    #role-modal .role-perm-meta {
        font-size: 12px;
        color: var(--gray-500);
        white-space: nowrap;
    }
    #role-modal .role-perm-actions {
        display: flex;
        gap: 8px;
        flex-wrap: wrap;
    }
    #role-modal .role-perm-actions .btn {
        padding: 6px 12px;
        font-size: 13px;
    }
    #role-modal .role-perm-actions #role-perm-preset {
        min-width: 220px;
        width: auto;
        flex: 1 1 220px;
        padding: 6px 12px;
        font-size: 13px;
    }
    #role-permissions-panel {
        flex: 1;
        min-height: 280px;
        max-height: min(52vh, 520px);
        overflow: auto;
        border: 1px solid var(--border);
        border-radius: 12px;
        background: var(--bg-secondary);
        padding: 8px;
    }
    #role-modal .role-perm-group {
        margin-bottom: 8px;
        border: 1px solid var(--border);
        border-radius: 10px;
        background: var(--surface);
        overflow: hidden;
    }
    #role-modal .role-perm-group-header {
        display: flex;
        align-items: center;
        gap: 10px;
        padding: 8px 12px;
        background: var(--bg-secondary);
        border-bottom: 1px solid var(--border);
        cursor: pointer;
        user-select: none;
    }
    #role-modal .role-perm-group-header strong {
        flex: 1;
        font-size: 13px;
        color: var(--gray-800);
    }
    #role-modal .role-perm-group-count {
        font-size: 12px;
        color: var(--gray-500);
    }
    #role-modal .role-perm-group-body {
        display: flex;
        flex-direction: column;
    }
    #role-modal .role-perm-group.collapsed .role-perm-group-body {
        display: none;
    }
    #role-modal .role-perm-row {
        display: grid;
        grid-template-columns: 22px minmax(0, 1fr) auto;
        gap: 8px 10px;
        align-items: start;
        padding: 7px 12px;
        border-top: 1px solid var(--border);
        cursor: pointer;
    }
    #role-modal .role-perm-row:first-child {
        border-top: none;
    }
    #role-modal .role-perm-row:hover {
        background: color-mix(in srgb, var(--primary) 6%, var(--surface));
    }
    #role-modal .role-perm-row input {
        margin-top: 2px;
    }
    #role-modal .role-perm-title {
        font-size: 13px;
        font-weight: 600;
        color: var(--gray-800);
        line-height: 1.3;
    }
    #role-modal .role-perm-desc {
        font-size: 12px;
        color: var(--gray-500);
        line-height: 1.35;
        margin-top: 2px;
        display: -webkit-box;
        -webkit-line-clamp: 2;
        -webkit-box-orient: vertical;
        overflow: hidden;
    }
    #role-modal .role-perm-code {
        font-size: 11px;
        color: var(--gray-500);
        white-space: nowrap;
        margin-top: 2px;
    }
    #role-modal .role-perm-empty {
        padding: 24px 12px;
        text-align: center;
        color: var(--gray-500);
        font-size: 13px;
    }
    #role-modal .role-modal-footer {
        display: flex;
        gap: 10px;
        justify-content: flex-end;
        margin-top: 14px;
        padding-top: 4px;
        flex-shrink: 0;
    }
    @media (max-width: 700px) {
        #role-modal .role-perm-row {
            grid-template-columns: 22px minmax(0, 1fr);
        }
        #role-modal .role-perm-code {
            grid-column: 2;
            white-space: normal;
            word-break: break-all;
        }
    }
    .admin-api-tokens-filters {
        display: grid;
        grid-template-columns: repeat(4, minmax(0, 1fr));
        gap: 14px 16px;
        margin: 14px 0 12px;
        padding: 14px 16px;
        border: 1px solid var(--border);
        border-radius: 12px;
        background: linear-gradient(180deg, var(--surface) 0%, var(--bg-secondary) 100%);
    }
    .admin-users-filters {
        display: grid;
        grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
        gap: 14px 16px;
        margin: 14px 0 12px;
        padding: 14px 16px;
        border: 1px solid var(--border);
        border-radius: 12px;
        background: linear-gradient(180deg, var(--surface) 0%, var(--bg-secondary) 100%);
    }
    .admin-api-tokens-filters .form-group,
    .admin-users-filters .form-group {
        margin: 0;
        min-width: 0;
    }
    .admin-api-tokens-filters .form-group label,
    .admin-users-filters .form-group label {
        display: block;
        margin-bottom: 6px;
        font-size: 14px;
        font-weight: 600;
        color: var(--gray-700);
    }
    @media (max-width: 1100px) {
        .admin-api-tokens-filters,
        .admin-users-filters {
            grid-template-columns: repeat(2, minmax(0, 1fr));
        }
    }
    @media (max-width: 900px) {
        .admin-nav { padding: 8px; }
        .admin-nav .btn { flex: 1 1 calc(50% - 8px); justify-content: center; }
        .mapping-grid { grid-template-columns: 1fr; }
        .admin-sections-grid { grid-template-columns: 1fr; }
        .admin-section.full-width { grid-column: auto; }
        .admin-api-tokens-filters,
        .admin-users-filters {
            grid-template-columns: 1fr;
            padding: 12px;
        }
    }
    @media (max-width: 640px) {
        .admin-stat-grid {
            grid-template-columns: 1fr 1fr;
        }
        .admin-nav .btn {
            flex: 1 1 100%;
        }
        .provider-grid {
            grid-template-columns: 1fr;
        }
        #users-list,
        #roles-list,
        #allowed-hosts-list,
        #audit-list,
        #auth-providers-list,
        #integrations-list,
        #server-logs-list {
            overflow-x: auto;
        }
    }
</style>

<div class="card admin-root">
    <div class="toolbar">
        <div>
            <h2>Центр администрирования</h2>
            <div class="admin-header-note">Управление доступами, пользователями и безопасностью платформы.</div>
        </div>
    </div>
    <div id="admin-error" class="admin-global-error" style="display:none;" role="alert"></div>
    <div id="admin-no-sections" class="empty-state" style="display:none;">
        Нет доступных разделов администрирования. Обратитесь к администратору платформы для назначения прав.
    </div>

    <div id="admin-stat-grid" class="admin-stat-grid">
        <div class="admin-stat" data-admin-access="users"><div class="admin-stat-label">Пользователи</div><div id="stat-users" class="admin-stat-value">0</div></div>
        <div class="admin-stat" data-admin-access="users"><div class="admin-stat-label">Активные</div><div id="stat-users-active" class="admin-stat-value">0</div></div>
        <div class="admin-stat" data-admin-access="roles"><div class="admin-stat-label">Роли</div><div id="stat-roles" class="admin-stat-value">0</div></div>
        <div class="admin-stat" data-admin-access="hosts"><div class="admin-stat-label">Разрешенные хосты</div><div id="stat-allowed-hosts" class="admin-stat-value">0</div></div>
        <div class="admin-stat" data-admin-access="audit"><div class="admin-stat-label">Записи аудита</div><div id="stat-audit" class="admin-stat-value">0</div></div>
        <div class="admin-stat" data-admin-access="backups"><div class="admin-stat-label">Бэкапы</div><div id="stat-backups" class="admin-stat-value">0</div></div>
        <div class="admin-stat" data-admin-access="integrations"><div class="admin-stat-label">Интеграции</div><div id="stat-integrations" class="admin-stat-value">0</div></div>
    </div>

    <div id="admin-nav" class="admin-nav">
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="statistics" onclick="scrollToAdminSection('section-platform-statistics')">Статистика</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="users" onclick="scrollToAdminSection('section-users')">Пользователи</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="personal_data_requests" onclick="scrollToAdminSection('section-personal-data-requests')">Запросы ПДн</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="roles" onclick="scrollToAdminSection('section-roles')">Роли</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="offices" onclick="scrollToAdminSection('section-offices')">Подразделения</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="sso" onclick="scrollToAdminSection('section-sso')">SSO</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="backups" onclick="scrollToAdminSection('section-backups')">Бэкапы</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="hosts" onclick="scrollToAdminSection('section-hosts')">Хосты</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="audit" onclick="scrollToAdminSection('section-audit')">Аудит</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="server_logs" onclick="scrollToAdminSection('section-server-logs')">Логи сервера</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="integrations" onclick="scrollToAdminSection('section-integrations')">Интеграции</button>
        <button type="button" class="btn btn-secondary btn-sm{% if not admin_access.remote_desktop %} admin-gated-hidden{% endif %}" data-admin-access="remote_desktop" onclick="scrollToAdminSection('section-remote-desktop')">Guacamole</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="plugins" onclick="scrollToAdminSection('section-plugins')">Плагины</button>
        <button type="button" class="btn btn-secondary btn-sm" data-admin-access="api_tokens" onclick="scrollToAdminSection('section-api-tokens')">API-токены</button>
        <button type="button" class="btn btn-danger btn-sm" data-admin-access="purge" onclick="scrollToAdminSection('section-danger')">Опасная зона</button>
    </div>

    <div class="admin-sections-grid">
    <div id="section-platform-statistics" class="card admin-section full-width" data-admin-access="statistics">
        <div class="toolbar">
            <h3>Статистика платформы</h3>
            <button class="btn btn-secondary btn-sm" type="button" onclick="refreshPlatformStatistics()">Обновить</button>
            <button class="btn btn-primary btn-sm" type="button" onclick="exportPlatformStatisticsPdf()">Экспорт PDF</button>
        </div>
        <div class="admin-subtitle">Анализ запусков, агентов, учёток и административных сервисов по всей платформе.</div>
        <div id="platform-health-banner" class="platform-health" hidden>
            <div>
                <div class="platform-kpi-label">Индекс здоровья</div>
                <div id="platform-health-label" class="platform-health-label">—</div>
            </div>
            <div id="platform-health-score" class="platform-health-score">—</div>
        </div>
        <div id="platform-kpi-grid" class="platform-kpi-grid">
            <div class="platform-kpi-card"><div class="platform-kpi-label">Пользователи</div><div id="platform-kpi-users" class="platform-kpi-value">0</div><div id="platform-kpi-users-active" class="platform-kpi-note">Активных: 0</div></div>
            <div class="platform-kpi-card"><div class="platform-kpi-label">Запусков</div><div id="platform-kpi-runs" class="platform-kpi-value">0</div><div id="platform-kpi-runs-rate" class="platform-kpi-note">Успешность: 0%</div></div>
            <div class="platform-kpi-card"><div class="platform-kpi-label">Ошибки / активные</div><div id="platform-kpi-runs-failed" class="platform-kpi-value">0</div><div id="platform-kpi-runs-active" class="platform-kpi-note">Активных: 0</div></div>
            <div class="platform-kpi-card"><div class="platform-kpi-label">Ресурсы</div><div id="platform-kpi-resources" class="platform-kpi-value">0</div><div id="platform-kpi-monitoring" class="platform-kpi-note">Мониторинг в сети: 0</div></div>
            <div class="platform-kpi-card"><div class="platform-kpi-label">7 дней</div><div id="platform-kpi-rate-7d" class="platform-kpi-value">0%</div><div id="platform-kpi-failed-24h" class="platform-kpi-note">Ошибок за 24 ч: 0</div></div>
            <div class="platform-kpi-card"><div class="platform-kpi-label">Аудит / бэкапы</div><div id="platform-kpi-audit" class="platform-kpi-value">0</div><div id="platform-kpi-backups" class="platform-kpi-note">Бэкапов: 0</div></div>
        </div>
        <div id="platform-stats-content" class="platform-stats-grid">
            <div class="loading">Загрузка статистики...</div>
        </div>
    </div>
    <div id="section-users" class="card admin-section full-width" data-admin-access="users">
        <div class="toolbar">
            <h3>Пользователи</h3>
            <button class="btn btn-success btn-sm" onclick="createUserPrompt()">Создать пользователя</button>
        </div>
        <div class="admin-subtitle" id="users-section-subtitle">Управление учётными записями, статусом, ролями и членством в подразделениях.</div>
        <div class="admin-users-filters" role="search" aria-label="Фильтры пользователей">
            <div class="form-group">
                <label for="users-search">Поиск</label>
                <input type="search" id="users-search" class="form-control" placeholder="Логин, email, ФИО, телефон, отдел, роль…" title="Поиск по логину, email, ФИО, телефону, отделу, должности, провайдеру и ролям" autocomplete="off">
            </div>
            <div class="form-group">
                <label for="users-status-filter">Статус</label>
                <select id="users-status-filter" class="form-control">
                    <option value="">Все статусы</option>
                    <option value="active">Активен</option>
                    <option value="disabled">Отключен</option>
                </select>
            </div>
            <div class="form-group">
                <label for="users-provider-filter">Провайдер</label>
                <select id="users-provider-filter" class="form-control">
                    <option value="">Все провайдеры</option>
                    <option value="local">Локальный</option>
                    <option value="sso">SSO</option>
                </select>
            </div>
            <div class="form-group">
                <label for="users-role-filter">Роль</label>
                <select id="users-role-filter" class="form-control">
                    <option value="">Все роли</option>
                </select>
            </div>
            <div class="form-group" id="users-office-filter-group">
                <label for="users-office-filter">Подразделение</label>
                <select id="users-office-filter" class="form-control">
                    <option value="">Все подразделения</option>
                </select>
            </div>
        </div>
        <div id="users-filter-meta" class="admin-subtitle" style="margin-top:-4px; margin-bottom:10px;"></div>
        <div id="users-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-personal-data-requests" class="card admin-section full-width" data-admin-access="personal_data_requests">
        <div class="toolbar">
            <h3>Запросы субъектов ПДн</h3>
            <button class="btn btn-secondary btn-sm" onclick="loadPersonalDataRequestsAdmin()">Обновить</button>
        </div>
        <div class="admin-subtitle">Запросы на деактивацию, удаление и экспорт. Для локальных пользователей деактивация выполняется автоматически; для SSO — инструкция по действиям в IdP. Для экспорта — кнопка «Выгрузить информацию».</div>
        <div id="personal-data-requests-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-roles" class="card admin-section full-width" data-admin-access="roles">
        <div class="toolbar">
            <h3>Роли и доступы</h3>
            <button class="btn btn-success btn-sm" onclick="openRoleModal()">Создать роль</button>
        </div>
        <div class="admin-subtitle">Роли и права доступа по действиям.</div>
        <div id="roles-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-offices" class="card admin-section full-width" data-admin-access="offices">
        <div class="toolbar">
            <h3>Подразделения</h3>
            <button class="btn btn-success btn-sm" type="button" onclick="openCreateOfficeModal()">Создать подразделение</button>
        </div>
        <div class="admin-subtitle">Раздел доступен в основном подразделении. Здесь создаются филиалы; лицензия, узлы исполнения и бэкапы остаются общими на установку. Режим нескольких подразделений задан при установке и его нельзя сменить на одно подразделение.</div>
        <div id="offices-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-sso" class="card admin-section full-width" data-admin-access="sso">
        <div class="toolbar">
            <h3>SSO (Keycloak / OIDC)</h3>
            <button class="btn btn-primary btn-sm" onclick="saveSsoSettings()">Сохранить SSO</button>
        </div>
        <div class="admin-subtitle" id="sso-context-banner">Вход через внешний SSO-провайдер. После включения на странице входа отображается кнопка SSO.</div>
        <div id="sso-office-howto" class="admin-subtitle" style="margin:0 0 14px;"></div>
        <div class="form-row" id="sso-save-scope-row" style="display:none;">
            <div class="form-group">
                <label for="sso-save-scope">Куда сохранить параметры входа</label>
                <select id="sso-save-scope" class="form-control">
                    <option value="shared">Общие для всех подразделений</option>
                    <option value="office">Только текущее подразделение</option>
                </select>
                <small style="color:var(--gray-500);">Общие — один клиент Keycloak на установку. «Только текущее» — свой Issuer/Client, если у филиала отдельный realm.</small>
            </div>
            <div class="form-group" id="sso-reset-override-wrap" style="display:none;">
                <label>Свои параметры этого подразделения</label>
                <button type="button" class="btn btn-secondary btn-sm" onclick="resetSsoOfficeOverride()">Вернуть общие настройки</button>
                <small style="color:var(--gray-500); display:block; margin-top:6px;">Удаляет переопределение филиала. Снова будут действовать общие параметры.</small>
            </div>
        </div>
        <div class="form-row">
            <div class="form-group">
                <label style="display:flex; gap:8px; align-items:center;">
                    <input type="checkbox" id="sso-enabled" onchange="syncSsoRedirectUriRequired()">
                    Включить SSO вход
                </label>
                <small style="color:var(--gray-500);">Если выключено, на странице входа показывается только локальная авторизация.</small>
            </div>
            <div class="form-group">
                <label for="sso-button-text">Текст кнопки на странице входа</label>
                <input type="text" id="sso-button-text" placeholder="Войти с помощью SSO">
                <small style="color:var(--gray-500);">Например: "Войти через корпоративный портал".</small>
            </div>
        </div>
        <div class="form-row">
            <div class="form-group">
                <label for="sso-issuer-url">Адрес SSO realm (Issuer URL)</label>
                <input type="text" id="sso-issuer-url" placeholder="https://sso.example.local/realms/company">
                <small style="color:var(--gray-500);">Базовый URL realm. Из него система автоматически получает OIDC endpoints.</small>
            </div>
            <div class="form-group">
                <label for="sso-client-id">Идентификатор клиента (Client ID)</label>
                <input type="text" id="sso-client-id" placeholder="awm-client">
                <small style="color:var(--gray-500);">Идентификатор клиента из настроек Keycloak.</small>
            </div>
        </div>
        <div class="form-row">
            <div class="form-group">
                <label for="sso-client-secret">Секрет клиента (оставьте пустым, чтобы не менять)</label>
                <input type="password" id="sso-client-secret" placeholder="********">
                <small style="color:var(--gray-500);">Секрет клиента Keycloak. При пустом поле сохранится текущее значение.</small>
            </div>
            <div class="form-group">
                <label for="sso-redirect-uri">Redirect URI <span style="color:#b91c1c;">*</span></label>
                <input type="url" id="sso-redirect-uri" placeholder="https://awm.example.local/api/auth/sso/callback">
                <small style="color:var(--gray-500);" id="sso-redirect-hint">Полный callback URL. Должен совпадать с Valid Redirect URIs в Keycloak.</small>
                <button type="button" class="btn btn-secondary btn-sm" style="margin-top:8px;" onclick="applySuggestedSsoRedirectUri()">Подставить URL по умолчанию</button>
            </div>
        </div>
        <div class="form-row">
            <div class="form-group">
                <label for="sso-scopes">Области доступа (Scopes)</label>
                <input type="text" id="sso-scopes" placeholder="openid profile email">
                <small style="color:var(--gray-500);">Рекомендуемый минимальный набор: <code>openid profile email</code>.</small>
            </div>
            <div class="form-group">
                <label for="sso-default-role">Роль для новых SSO-пользователей</label>
                <select id="sso-default-role">
                    <option value="operator">Оператор</option>
                </select>
                <small style="color:var(--gray-500);">Назначается при первом входе, если пользователь создается автоматически.</small>
            </div>
        </div>
        <div class="form-row">
            <div class="form-group">
                <label>Сопоставление полей профиля</label>
                <div id="sso-mapping-summary" class="admin-subtitle" style="margin:0 0 8px;">Загрузка…</div>
                <button type="button" class="btn btn-secondary btn-sm" onclick="openSsoMappingModal()">Настроить сопоставление…</button>
                <small style="color:var(--gray-500); display:block; margin-top:6px;">
                    Укажите, какой claim из SSO (отдел, должность, email и т.д.) заполняет поле профиля в AWM.
                </small>
            </div>
            <div class="form-group">
                <label style="display:flex; gap:8px; align-items:center;">
                    <input type="checkbox" id="sso-auto-create-users">
                    Автоматически создавать пользователей при первом SSO-входе
                </label>
                <small style="color:var(--gray-500);">Если выключено, вход разрешен только заранее созданным SSO-пользователям.</small>
            </div>
        </div>
        <div id="sso-assign-section" style="display:none;">
        <div class="admin-subtitle" style="margin:16px 0 8px; font-weight:700;">Подразделение после входа через SSO</div>
        <div class="admin-subtitle" id="sso-assign-locked-note" style="display:none; margin:0 0 10px;">Эту таблицу заполняет администратор установки в основном подразделении.</div>
        <div id="sso-assign-fields">
            <div class="form-group">
                <label for="sso-office-assign-mode">Как выбрать подразделение</label>
                <select id="sso-office-assign-mode" class="form-control" onchange="syncSsoOfficeAssignUi()">
                    <option value="login_select">Пользователь выбирает сам на странице входа</option>
                    <option value="claim">AWM назначает по полю из SSO</option>
                </select>
                <small style="color:var(--gray-500);" id="sso-office-assign-mode-hint">Если названия в Keycloak и в AWM разные — используйте назначение по полю из SSO и таблицу ниже.</small>
            </div>
            <div class="form-group" id="sso-office-claim-wrap">
                <label for="sso-office-claim">Поле SSO, из которого брать подразделение</label>
                <input type="text" id="sso-office-claim" class="form-control" list="sso-office-claim-suggestions" placeholder="department">
                <datalist id="sso-office-claim-suggestions">
                    <option value="department"></option>
                    <option value="office"></option>
                    <option value="groups"></option>
                    <option value="organization.unit"></option>
                    <option value="attributes.department"></option>
                </datalist>
                <small style="color:var(--gray-500);">Имя атрибута в токене Keycloak (например <code>department</code> или <code>office</code>). Это не поле «Отдел» в карточке пользователя.</small>
            </div>
            <div class="form-group" id="sso-office-map-wrap">
                <label>Таблица соответствий</label>
                <div class="form-hint" style="margin:0 0 10px;">
                    Слева уже стоят подразделения AWM — их не меняют. Справа впишите значение атрибута из SSO
                    (то, что приходит в поле выше, например <code>department</code>).
                    Названия почти всегда отличаются: в Keycloak может быть «Столица», а в AWM — «Москва».
                </div>
                <div class="form-hint" style="margin:0 0 10px;">
                    <strong>Пример.</strong> Подразделение «Москва» → в SSO укажите <code>Столица, MSK, Moscow</code>.
                    Несколько вариантов через запятую. Регистр не важен. Пустое поле справа — в это подразделение по таблице никто не попадёт.
                </div>
                <div class="mapping-grid" id="sso-office-map-head" style="margin-bottom:4px;">
                    <div class="mapping-head">Подразделение в AWM</div>
                    <div class="mapping-head">Как записано в SSO</div>
                </div>
                <div class="mapping-grid" id="sso-office-map-rows"></div>
                <small class="form-hint" style="display:block; margin-top:8px;">
                    Откуда взять значение: карточка пользователя в Keycloak → атрибут с тем же именем, что в поле выше.
                    Для групп укажите имя группы целиком или последний сегмент (<code>/Company/msk</code> или <code>msk</code>).
                </small>
            </div>
            <div class="form-row" id="sso-office-unmatched-row">
                <div class="form-group">
                    <label for="sso-office-unmatched">Если значения нет в таблице</label>
                    <select id="sso-office-unmatched" class="form-control">
                        <option value="default">Поместить в запасное подразделение</option>
                        <option value="deny">Не пускать в систему</option>
                    </select>
                    <small class="form-hint">Срабатывает, когда атрибут SSO пустой или не совпал ни с одной строкой справа.</small>
                </div>
                <div class="form-group">
                    <label for="sso-office-default-slug">Запасное подразделение</label>
                    <select id="sso-office-default-slug" class="form-control"></select>
                </div>
            </div>
            <div class="form-group" id="sso-office-replace-wrap">
                <label style="display:flex; gap:8px; align-items:center;">
                    <input type="checkbox" id="sso-office-assign-replace">
                    Оставлять пользователя только в найденном подразделении
                </label>
                <small style="color:var(--gray-500);">Иначе он добавляется туда и сохраняет остальные членства.</small>
            </div>
            <div class="form-row" id="sso-office-preview-row">
                <div class="form-group">
                    <label for="sso-office-preview-value">Проверка</label>
                    <input type="text" id="sso-office-preview-value" class="form-control" placeholder="Вставьте значение из SSO, как у сотрудника">
                    <small class="form-hint">Не сохраняет настройки. Показывает, в какое подразделение попадёт такое значение.</small>
                </div>
                <div class="form-group" style="display:flex; align-items:flex-end; gap:8px; flex-wrap:wrap;">
                    <button type="button" class="btn btn-secondary btn-sm" onclick="previewSsoOfficeAssign()">Куда попадёт</button>
                </div>
            </div>
            <div id="sso-office-preview-result" class="admin-subtitle" style="margin:0 0 10px;"></div>
        </div>
        </div>
        <div class="admin-subtitle" style="margin:16px 0 8px; font-weight:700;">Синхронизация пользователей из SSO</div>
        <div class="form-row">
            <div class="form-group">
                <label style="display:flex; gap:8px; align-items:center;">
                    <input type="checkbox" id="sso-sync-enabled">
                    Включить периодическую синхронизацию
                </label>
                <small style="color:var(--gray-500);">Обновляет профили и статус (вкл/выкл) пользователей SSO из каталога. Запуск выполняется в фоне при готовой очереди задач, иначе в процессе приложения.</small>
            </div>
            <div class="form-group">
                <label for="sso-sync-interval">Интервал синхронизации (минуты)</label>
                <input type="number" id="sso-sync-interval" min="5" max="1440" step="1" value="60">
                <small style="color:var(--gray-500);">От 5 до 1440 минут. По умолчанию 60.</small>
            </div>
        </div>
        <div class="form-row">
            <div class="form-group">
                <label for="sso-admin-client-id">Идентификатор админ-клиента (опционально)</label>
                <input type="text" id="sso-admin-client-id" placeholder="awm-admin-sync">
                <small style="color:var(--gray-500);">Пусто — используется Client ID SSO. Рекомендуется отдельный client с Service account и ролями view-users / query-users.</small>
            </div>
            <div class="form-group">
                <label for="sso-admin-client-secret">Секрет Admin Client (оставьте пустым, чтобы не менять)</label>
                <input type="password" id="sso-admin-client-secret" placeholder="********">
                <small style="color:var(--gray-500);">Пусто — сохранить текущий Admin Secret или взять Client Secret SSO.</small>
            </div>
        </div>
        <div id="sso-sync-status-block" style="margin:0 0 10px;">
            <div id="sso-sync-status-line" class="admin-subtitle" style="margin:0 0 6px;">Статус синхронизации: ещё не запускалась</div>
            <div id="sso-sync-message-line" class="admin-subtitle" style="margin:0 0 6px; color:var(--gray-500);"></div>
            <button class="btn btn-secondary btn-sm" type="button" id="sso-sync-details-btn" style="display:none;" onclick="openSsoSyncReportModal()">Подробнее о последней синхронизации</button>
        </div>
        <div style="display:flex; gap:8px; justify-content:flex-end;">
            <button class="btn btn-secondary btn-sm" onclick="loadSsoSettings()">Обновить</button>
            <button class="btn btn-secondary btn-sm" type="button" onclick="runSsoSyncNow()">Синхронизировать сейчас</button>
            <button class="btn btn-info btn-sm" onclick="window.open('/api/auth/sso/login', '_blank')">Проверить вход SSO</button>
        </div>
        <div id="sso-status" style="margin-top:10px; color:var(--gray-600);"></div>
    </div>

    <div id="sso-sync-report-modal" class="modal" onclick="if(event.target===this)closeSsoSyncReportModal()">
        <div class="modal-content" style="max-width:720px;">
            <div class="modal-header">
                <h3>Результат синхронизации SSO</h3>
                <button type="button" class="close-btn" onclick="closeSsoSyncReportModal()" aria-label="Закрыть">&times;</button>
            </div>
            <div id="sso-sync-report-summary" class="admin-subtitle" style="margin:0 0 12px;"></div>
            <div id="sso-sync-report-body" style="max-height:420px; overflow:auto;"></div>
            <div style="display:flex; justify-content:flex-end; margin-top:16px;">
                <button type="button" class="btn btn-secondary" onclick="closeSsoSyncReportModal()">Закрыть</button>
            </div>
        </div>
    </div>

    <div id="section-backups" class="card admin-section full-width" data-admin-access="backups">
        <div class="toolbar">
            <h3>Бэкапы и восстановление</h3>
            <div style="display:flex; gap:8px; flex-wrap:wrap;">
                <button class="btn btn-success btn-sm" onclick="openCreateBackupModal()">Создать бэкап</button>
                <button class="btn btn-primary btn-sm" onclick="openBackupPlanModal()">План бэкапа</button>
            </div>
        </div>
        <div class="admin-subtitle">Локальные и облачные (S3) бэкапы, восстановление и расписание по интервалу, дням недели или простою системы.</div>
        <h4 style="margin: 8px 0;">Архивы</h4>
        <div id="backups-list"><div class="loading">Загрузка...</div></div>
        <h4 style="margin: 16px 0 8px;">Планы</h4>
        <div id="backup-plans-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-hosts" class="card admin-section full-width" data-admin-access="hosts">
        <div class="toolbar">
            <h3>Разрешенные хосты</h3>
            <button class="btn btn-success btn-sm" onclick="addAllowedHostPrompt()">Добавить</button>
        </div>
        <div class="admin-subtitle">Белый список хостов и масок для ограничений выполнения.</div>
        <div id="allowed-hosts-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-audit" class="card admin-section full-width" data-admin-access="audit">
        <div class="toolbar">
            <h3>Журнал аудита</h3>
            <div style="display:flex; gap:8px; flex-wrap:wrap;">
                <button class="btn btn-secondary btn-sm" id="audit-export-csv-btn" type="button">Экспорт CSV</button>
                <button class="btn btn-secondary btn-sm" id="audit-export-json-btn" type="button">Экспорт JSON</button>
                <button class="btn btn-danger btn-sm" id="audit-purge-btn" type="button" disabled title="Сначала выполните экспорт">Очистить журнал</button>
                <button class="btn btn-secondary btn-sm" id="audit-refresh-btn" type="button">Обновить</button>
            </div>
        </div>
        <div class="admin-subtitle">Действия пользователей и системы. Экспорт (фоновый) и очистка только после успешной выгрузки.</div>
        <div class="form-row" style="margin-bottom: 12px;">
            <div class="form-group">
                <label>Поиск</label>
                <input type="text" id="audit-search" placeholder="логин, действие, ресурс, текст в деталях">
            </div>
            <div class="form-group">
                <label>Инициатор</label>
                <input type="text" id="audit-filter-actor" placeholder="admin / system">
            </div>
            <div class="form-group">
                <label>С</label>
                <input type="date" id="audit-date-from">
            </div>
            <div class="form-group">
                <label>По</label>
                <input type="date" id="audit-date-to">
            </div>
        </div>
        <div class="form-row" style="margin-bottom: 12px;">
            <div class="form-group">
                <label>Действие</label>
                <select id="audit-filter-action">
                    <option value="">Все действия</option>
                </select>
            </div>
            <div class="form-group">
                <label>Тип ресурса</label>
                <select id="audit-filter-resource">
                    <option value="">Все ресурсы</option>
                </select>
            </div>
        </div>
        <div style="display:flex; gap:10px; margin-bottom: 12px; flex-wrap: wrap; align-items:center;">
            <button class="btn btn-secondary btn-sm" id="audit-sort-date" type="button">Сортировка: новые сверху</button>
            <button class="btn btn-secondary btn-sm" id="audit-clear-filters" type="button">Сбросить фильтры</button>
            <span class="audit-meta-muted" id="audit-result-hint"></span>
        </div>
        <div id="audit-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-server-logs" class="card admin-section full-width" data-admin-access="server_logs">
        <div class="toolbar">
            <h3>Логи сервера</h3>
            <div style="display:flex; gap:8px; flex-wrap:wrap;">
                <button class="btn btn-secondary btn-sm" id="server-logs-export-btn" type="button">Экспорт ZIP</button>
                <button class="btn btn-danger btn-sm" id="server-logs-purge-btn" type="button" disabled title="Сначала выполните экспорт ZIP">Очистить логи</button>
                <button class="btn btn-secondary btn-sm" onclick="loadServerLogs()">Обновить</button>
            </div>
        </div>
        <div class="admin-subtitle">Централизованный журнал сервера. Экспорт ZIP (фоновый) и очистка только после успешной выгрузки; отдельные файлы можно скачать.</div>
        <div class="card" style="padding:12px; margin-bottom:10px;">
            <h4 style="margin:0 0 10px;">Политика ротации и хранения</h4>
            <div class="form-row">
                <div class="form-group">
                    <label>Макс. строк в файле</label>
                    <input type="number" id="server-log-policy-lines" min="100" step="100" value="200000">
                </div>
                <div class="form-group">
                    <label>Макс. размер файла (байт)</label>
                    <input type="number" id="server-log-policy-bytes" min="1024" step="1024" value="10485760">
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Макс. возраст файла (часы)</label>
                    <input type="number" id="server-log-policy-age" min="1" step="1" value="24">
                </div>
                <div class="form-group">
                    <label>Хранить файлов</label>
                    <input type="number" id="server-log-policy-retention" min="1" step="1" value="20">
                </div>
            </div>
            <div style="display:flex; gap:8px; justify-content:flex-end;">
                <button class="btn btn-secondary btn-sm" onclick="loadServerLogPolicy()">Обновить политику</button>
                <button class="btn btn-primary btn-sm" onclick="saveServerLogPolicy()">Сохранить политику</button>
            </div>
        </div>
        <div id="server-logs-list"><div class="loading">Загрузка...</div></div>
        <div class="server-log-wrap">
            <div class="server-log-toolbar">
                <label for="server-log-lines">Строк:</label>
                <select id="server-log-lines">
                    <option value="100">100</option>
                    <option value="300" selected>300</option>
                    <option value="500">500</option>
                    <option value="1000">1000</option>
                </select>
                <label class="server-log-debug-label" for="server-log-debug" title="Показывать строки уровня DBG / DEBUG">
                    <input type="checkbox" id="server-log-debug">
                    Дебаг
                </label>
                <button class="btn btn-primary btn-sm" onclick="reloadSelectedServerLog()">Открыть</button>
                <button class="btn btn-secondary btn-sm" type="button" onclick="openServerLogsLiveWindow()" title="Онлайн-просмотр в отдельном окне">Online</button>
                <span id="server-log-current" style="margin-left:auto; color:var(--gray-500); font-size:12px;">Файл не выбран</span>
            </div>
            <div id="server-log-content" class="server-log-content"><div class="server-log-empty">Лог не загружен.</div></div>
        </div>
    </div>

    <div id="section-integrations" class="card admin-section full-width" data-admin-access="integrations">
        <div class="toolbar">
            <h3>Интеграции и уведомления</h3>
            <div style="display:flex; gap:8px; flex-wrap:wrap;">
                <button class="btn btn-info btn-sm" onclick="openIntegrationsHelpModal()">Справка</button>
                <button class="btn btn-success btn-sm" onclick="openIntegrationModal()">Добавить интеграцию</button>
            </div>
        </div>
        <div class="admin-subtitle">Каналы оповещений и входящие вебхуки: Telegram, MAX, Matrix, Zabbix, Grafana, Prometheus и универсальные.</div>
        <div id="integrations-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-remote-desktop" class="card admin-section full-width{% if not admin_access.remote_desktop %} admin-gated-hidden{% endif %}" data-admin-access="remote_desktop">
        <div class="toolbar">
            <h3>Удалённое управление (Guacamole)</h3>
            <div style="display:flex; gap:8px; flex-wrap:wrap;">
                <button type="button" class="btn btn-secondary btn-sm" onclick="adminGuacamoleRefreshAdmin()">Обновить</button>
                <button type="button" class="btn btn-secondary btn-sm" onclick="adminGuacamoleOpenApiPassword()">Сменить пароль API</button>
                <a class="btn btn-primary btn-sm" href="/settings#settings-spoiler-guacamole">Настроить интеграцию</a>
            </div>
        </div>
        <div class="admin-subtitle">
            Управление удалёнными подключениями, учётными записями доступа, группами и активными сессиями из AWM.
            Параметры интеграции — <a href="/settings#settings-spoiler-guacamole">Настройки → Удалённое управление (Guacamole)</a>.
        </div>
        <div id="admin-guac-admin-status" class="awm-inline-status" role="status" aria-live="polite"></div>
        <div style="display:grid; gap:16px; margin-top:8px;">
            <div>
                <div class="toolbar" style="margin-bottom:8px;">
                    <h4 style="margin:0;">Подключения Guacamole ↔ AWM</h4>
                    <div style="display:flex; gap:8px; flex-wrap:wrap;">
                        <button type="button" class="btn btn-secondary btn-sm" onclick="adminGuacamoleRefreshConnections()">Обновить список</button>
                        <button type="button" class="btn btn-primary btn-sm" onclick="adminGuacamoleImportConnections()">Импортировать в AWM</button>
                    </div>
                </div>
                <div class="admin-subtitle" style="margin:0 0 8px;">
                    Подключения создаются в AWM и синхронизируются со шлюзом удалённого доступа.
                    Записи, появившиеся только на шлюзе, подтягиваются по расписанию (настройки интеграции) или кнопкой ниже.
                </div>
                <div id="admin-guac-connections-summary" class="admin-subtitle" style="margin:0 0 8px;display:none;"></div>
                <div id="admin-guac-connections-list"><div class="empty-state">Нажмите «Обновить список»</div></div>
            </div>
            <div>
                <div class="toolbar" style="margin-bottom:8px;">
                    <h4 style="margin:0;">Пользователи Guacamole</h4>
                    <button type="button" class="btn btn-primary btn-sm" onclick="adminGuacamoleOpenCreateUser()">Добавить</button>
                </div>
                <div id="admin-guac-users-list"><div class="empty-state">Нажмите «Обновить» после настройки интеграции</div></div>
            </div>
            <div>
                <div class="toolbar" style="margin-bottom:8px;">
                    <h4 style="margin:0;">Группы пользователей Guacamole</h4>
                    <button type="button" class="btn btn-primary btn-sm" onclick="adminGuacamoleOpenCreateGroup()">Добавить</button>
                </div>
                <div id="admin-guac-groups-list"><div class="empty-state">Нажмите «Обновить» после настройки интеграции</div></div>
            </div>
            <div>
                <div class="toolbar" style="margin-bottom:8px;">
                    <h4 style="margin:0;">Активные сессии Guacamole</h4>
                    <button type="button" class="btn btn-secondary btn-sm" onclick="adminGuacamoleRefreshSessions()">Обновить сессии</button>
                </div>
                <div id="admin-guac-sessions-list"><div class="empty-state">Нажмите «Обновить» после настройки интеграции</div></div>
            </div>
        </div>
    </div>

    <div id="section-plugins" class="card admin-section full-width" data-admin-access="plugins">
        <div class="toolbar">
            <h3>Плагины</h3>
            <div style="display:flex; gap:8px; flex-wrap:wrap;">
                <input id="plugin-import-file" type="file" accept=".zip" style="max-width:260px;">
                <button class="btn btn-info btn-sm" onclick="precheckPluginUpdate()">Проверить обновление</button>
                <button class="btn btn-success btn-sm" onclick="importPlugin()">Импорт/Установка</button>
                <button class="btn btn-warning btn-sm" onclick="updatePluginFromZip()">Обновить ZIP</button>
            </div>
        </div>
        <div class="admin-subtitle">Установка, обновление, экспорт и управление состоянием расширений.</div>
        <div id="plugins-list"><div class="loading">Загрузка...</div></div>
        <div id="plugins-updates-history" style="margin-top:12px;"></div>
    </div>
    <div id="plugin-update-passport-modal" class="modal">
        <div class="modal-content" style="max-width: 820px;">
            <div class="modal-header">
                <h3>Паспорт риска обновления плагина</h3>
                <button class="close-btn" onclick="closePluginUpdatePassportModal()">&times;</button>
            </div>
            <div id="plugin-update-passport-content"></div>
            <div id="plugin-update-passport-history" style="margin-top:12px;"></div>
            <div style="display:flex; gap:10px; justify-content:flex-end; margin-top:12px;">
                <button type="button" class="btn btn-secondary" onclick="closePluginUpdatePassportModal()">Закрыть</button>
                <button type="button" class="btn btn-warning" id="plugin-update-passport-apply-btn" onclick="applyPluginUpdateFromPassport()">Подтвердить обновление</button>
            </div>
            <div id="plugin-update-passport-result" style="margin-top:12px;"></div>
        </div>
    </div>

    <div id="section-api-tokens" class="card admin-section full-width" data-admin-access="api_tokens">
        <div class="toolbar">
            <h3>Постоянные API-токены</h3>
            <button class="btn btn-secondary btn-sm" onclick="loadAdminApiTokens()">Обновить</button>
        </div>
        <div class="admin-subtitle">Просмотр, пауза, отзыв и удаление персональных API-токенов. Создание — в профиле владельца.</div>
        <div class="admin-api-tokens-filters" role="search" aria-label="Фильтры API-токенов">
            <div class="form-group">
                <label for="admin-api-tokens-search">Поиск</label>
                <input type="search" id="admin-api-tokens-search" class="form-control" placeholder="Часть префикса токена (awm_pat_…)" title="Поиск по началу секрета токена или его идентификатору" oninput="applyAdminApiTokensFilters()" autocomplete="off">
            </div>
            <div class="form-group">
                <label for="admin-api-tokens-user-query">Пользователь</label>
                <div id="admin-api-tokens-user-picker" class="admin-user-picker awm-user-picker">
                    <div class="admin-user-picker-field awm-user-picker-field">
                        <input type="text" id="admin-api-tokens-user-query" class="form-control awm-user-picker-query" placeholder="Все пользователи — начните ввод" autocomplete="off" autocapitalize="off" spellcheck="false" aria-autocomplete="list" aria-controls="admin-api-tokens-user-menu" aria-expanded="false" role="combobox">
                        <input type="hidden" id="admin-api-tokens-user-filter" class="awm-user-picker-value" value="">
                        <button type="button" class="admin-user-picker-clear awm-user-picker-clear" id="admin-api-tokens-user-clear" title="Сбросить фильтр" aria-label="Сбросить фильтр пользователя">&times;</button>
                    </div>
                    <div id="admin-api-tokens-user-menu" class="admin-user-picker-menu awm-user-picker-menu" role="listbox" hidden></div>
                </div>
            </div>
            <div class="form-group">
                <label for="admin-api-tokens-status-filter">Статус</label>
                <select id="admin-api-tokens-status-filter" class="form-control" onchange="applyAdminApiTokensFilters()">
                    <option value="">Все статусы</option>
                    <option value="active">Активен</option>
                    <option value="suspended">Приостановлен</option>
                    <option value="revoked">Отозван</option>
                    <option value="expired">Истёк</option>
                    <option value="outside_schedule">Вне расписания</option>
                </select>
            </div>
            <div class="form-group">
                <label for="admin-api-tokens-schedule-filter">Расписание</label>
                <select id="admin-api-tokens-schedule-filter" class="form-control" onchange="applyAdminApiTokensFilters()">
                    <option value="">Любое</option>
                    <option value="enabled">С расписанием</option>
                    <option value="disabled">Без расписания</option>
                </select>
            </div>
        </div>
        <div id="admin-api-tokens-filter-meta" class="admin-subtitle" style="margin-top:-4px; margin-bottom:10px;"></div>
        <div id="admin-api-tokens-list"><div class="loading">Загрузка...</div></div>
    </div>

    <div id="section-danger" class="card admin-section full-width" data-admin-access="purge">
        <div class="toolbar">
            <h3>Опасная зона</h3>
            <button class="btn btn-danger btn-sm" onclick="openPurgeModal()">Полная очистка системы</button>
        </div>
        <div class="admin-subtitle">
            Необратимо удаляет данные всех разделов: Ansible, Terraform, секреты, SSH-ключи, переменные,
            команды, расписания, мониторинг, инвентаризация активов, воркеры, группы, API-токены,
            интеграции, уведомления, бэкапы, настройки и SSO, данные плагинов и остальных
            пользователей. Сохраняются: ваш аккаунт и роли, каталог прав, лицензия, журнал аудита.
            После очистки потребуется повторный вход.
        </div>
    </div>
    </div>
</div>

<div id="provider-modal" class="modal">
    <div class="modal-content" style="max-width: 760px;">
        <div class="modal-header">
            <h3 id="provider-modal-title">Настройка провайдера</h3>
            <button class="close-btn" onclick="closeProviderModal()">&times;</button>
        </div>
        <form id="provider-form">
            <div class="form-row">
                <div class="form-group">
                    <label>Название</label>
                    <input type="text" id="provider-name" maxlength="120" required>
                </div>
                <div class="form-group">
                    <label>Тип</label>
                    <select id="provider-type">
                        <option value="ad">AD</option>
                        <option value="freeipa">FreeIPA</option>
                        <option value="oidc">SSO (OIDC)</option>
                    </select>
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Включен</label>
                    <select id="provider-enabled">
                        <option value="true">Да</option>
                        <option value="false">Нет</option>
                    </select>
                </div>
                <div class="form-group">
                    <label>Приоритет</label>
                    <input type="number" id="provider-priority" min="1" max="999" value="50">
                </div>
            </div>
            <div id="provider-dynamic-fields"></div>
            <div class="form-row">
                <div class="form-group">
                    <label>Тестовый логин (опционально)</label>
                    <input type="text" id="provider-test-username" placeholder="user@example.com">
                </div>
                <div class="form-group">
                    <label>Тестовый пароль (опционально)</label>
                    <input type="password" id="provider-test-password" placeholder="******">
                </div>
            </div>
            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-info" onclick="testProviderConnection()">Проверить подключение</button>
                <button type="button" class="btn btn-secondary" onclick="closeProviderModal()">Отмена</button>
                <button type="submit" class="btn btn-primary">Сохранить</button>
            </div>
            <div id="provider-test-result" style="margin-top:12px; font-size:13px;"></div>
        </form>
    </div>
</div>

<div id="office-form-modal" class="modal">
    <div class="modal-content" style="max-width: 520px;">
        <div class="modal-header">
            <h3 id="office-form-title">Новое подразделение</h3>
            <button type="button" class="close-btn" onclick="closeOfficeFormModal()">&times;</button>
        </div>
        <form id="office-form" onsubmit="submitOfficeForm(event)">
            <input type="hidden" id="office-form-id" value="">
            <div class="form-group">
                <label for="office-form-name">Название <span style="color:var(--danger);">*</span></label>
                <input type="text" id="office-form-name" class="form-control" required maxlength="120">
            </div>
            <div class="form-group">
                <label for="office-form-slug">Код подразделения <span style="color:var(--danger);">*</span></label>
                <input type="text" id="office-form-slug" class="form-control" required maxlength="64" placeholder="msk">
                <small class="form-hint">Латиница, цифры и дефис. Используется в адресе входа SSO этого подразделения.</small>
            </div>
            <div class="form-group">
                <label for="office-form-description">Описание</label>
                <textarea id="office-form-description" class="form-control" rows="3" maxlength="500" placeholder="Необязательно: город, филиал, комментарий для администраторов"></textarea>
            </div>
            <div class="form-group" id="office-form-active-wrap">
                <label style="display:flex; gap:8px; align-items:center;">
                    <input type="checkbox" id="office-form-active" checked>
                    Подразделение активно
                </label>
            </div>
            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeOfficeFormModal()">Отмена</button>
                <button type="submit" class="btn btn-primary" id="office-form-submit">Создать</button>
            </div>
        </form>
    </div>
</div>

<div id="office-members-modal" class="modal">
    <div class="modal-content" style="max-width: 560px;">
        <div class="modal-header">
            <h3 id="office-members-title">Участники подразделения</h3>
            <button type="button" class="close-btn" onclick="closeOfficeMembersModal()">&times;</button>
        </div>
        <div id="office-members-list"><div class="loading">Загрузка...</div></div>
        <div class="form-row" style="margin-top:12px;">
            <div class="form-group">
                <label for="office-member-user-query">Пользователь</label>
                <div id="office-member-user-picker" class="admin-user-picker awm-user-picker">
                    <div class="admin-user-picker-field awm-user-picker-field">
                        <input type="text" id="office-member-user-query" class="form-control awm-user-picker-query" placeholder="Логин, имя или фамилия" autocomplete="off" autocapitalize="off" spellcheck="false" aria-autocomplete="list" aria-controls="office-member-user-menu" aria-expanded="false" role="combobox">
                        <input type="hidden" id="office-member-user-id" class="awm-user-picker-value" value="">
                        <button type="button" class="admin-user-picker-clear awm-user-picker-clear" title="Очистить" aria-label="Очистить выбранного пользователя">&times;</button>
                    </div>
                    <div id="office-member-user-menu" class="admin-user-picker-menu awm-user-picker-menu" role="listbox" hidden></div>
                </div>
                <small class="form-hint">Начните ввод — поиск по логину, имени и фамилии.</small>
            </div>
            <div class="form-group" style="display:flex; align-items:flex-end;">
                <button type="button" class="btn btn-primary" onclick="addOfficeMember()">Добавить</button>
            </div>
        </div>
    </div>
</div>

<div id="office-admin-assign-modal" class="modal">
    <div class="modal-content" style="max-width: 560px;">
        <div class="modal-header">
            <h3 id="office-admin-assign-title">Назначить администратора</h3>
            <button type="button" class="close-btn" onclick="closeOfficeAdminAssignModal()">&times;</button>
        </div>
        <p class="admin-subtitle" style="margin-top:0;">
            Выберите пользователя. Он станет членом этого филиала и получит роль «Администратор подразделения».
        </p>
        <div class="form-group">
            <label for="office-admin-user-query">Пользователь</label>
            <div id="office-admin-user-picker" class="admin-user-picker awm-user-picker">
                <div class="admin-user-picker-field awm-user-picker-field">
                    <input type="text" id="office-admin-user-query" class="form-control awm-user-picker-query" placeholder="Логин, имя или фамилия" autocomplete="off" autocapitalize="off" spellcheck="false" aria-autocomplete="list" aria-controls="office-admin-user-menu" aria-expanded="false" role="combobox">
                    <input type="hidden" id="office-admin-user-id" class="awm-user-picker-value" value="">
                    <button type="button" class="admin-user-picker-clear awm-user-picker-clear" title="Очистить" aria-label="Очистить выбранного пользователя">&times;</button>
                </div>
                <div id="office-admin-user-menu" class="admin-user-picker-menu awm-user-picker-menu" role="listbox" hidden></div>
            </div>
            <small class="form-hint">Начните ввод — поиск по логину, имени и фамилии.</small>
        </div>
        <div style="display:flex; gap:10px; justify-content:flex-end;">
            <button type="button" class="btn btn-secondary" onclick="closeOfficeAdminAssignModal()">Отмена</button>
            <button type="button" class="btn btn-primary" onclick="submitOfficeAdminAssign()">Назначить</button>
        </div>
    </div>
</div>

<div id="role-assign-modal" class="modal">
    <div class="modal-content" style="max-width: 520px;">
        <div class="modal-header">
            <h3>Назначить роль</h3>
            <button class="close-btn" onclick="closeRoleAssignModal()">&times;</button>
        </div>
        <form id="role-assign-form">
            <input type="hidden" id="role-assign-user-id">
            <div class="form-group">
                <label>Пользователь</label>
                <input type="text" id="role-assign-username" readonly>
            </div>
            <div class="form-group">
                <label>Роли</label>
                <select id="role-assign-role" multiple size="8" required></select>
                <div class="form-hint">Выберите одну или несколько ролей. Текущий набор ролей будет заменен.</div>
            </div>
            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeRoleAssignModal()">Отмена</button>
                <button type="submit" class="btn btn-primary">Сохранить</button>
            </div>
        </form>
    </div>
</div>

<div id="sso-mapping-modal" class="modal">
    <div class="modal-content" style="max-width: 720px;">
        <div class="modal-header">
            <h3>Сопоставление полей SSO → AWM</h3>
            <button type="button" class="close-btn" onclick="closeSsoMappingModal()">&times;</button>
        </div>
        <p class="admin-subtitle" style="margin-top:0;">
            Для каждого поля карточки пользователя выберите атрибут из SSO. Пустое значение — поле не заполняется.
            «Отдел» в этой таблице — отдел в профиле, не филиал. Филиал задаётся таблицей соответствий ниже на странице.
        </p>
        <div class="mapping-grid" id="sso-field-mapping-grid"></div>
        <div style="display:flex; gap:10px; justify-content:flex-end; margin-top:16px;">
            <button type="button" class="btn btn-secondary" onclick="closeSsoMappingModal()">Отмена</button>
            <button type="button" class="btn btn-primary" onclick="applySsoMappingModal()">Применить</button>
        </div>
    </div>
</div>

<div id="role-modal" class="modal">
    <div class="modal-content">
        <div class="modal-header">
            <h3 id="role-modal-title">Создание роли</h3>
            <button class="close-btn" onclick="closeRoleModal()">&times;</button>
        </div>
        <form id="role-form">
            <input type="hidden" id="role-id">
            <div class="form-row">
                <div class="form-group">
                    <label>Название роли</label>
                    <input type="text" id="role-name" class="form-control" required>
                </div>
                <div class="form-group">
                    <label>Описание</label>
                    <input type="text" id="role-description" class="form-control" placeholder="Краткое назначение роли">
                </div>
            </div>
            <div class="form-group" style="margin-bottom:0; min-height:0; display:flex; flex-direction:column; flex:1;">
                <label>Права доступа</label>
                <div class="role-perm-toolbar">
                    <input type="search" id="role-perm-search" class="form-control" placeholder="Поиск по названию, описанию или коду…" autocomplete="off">
                    <span class="role-perm-meta" id="role-perm-selected-count">Выбрано: 0</span>
                    <div class="role-perm-actions">
                        <select id="role-perm-preset" class="form-control" aria-label="Готовый набор прав">
                            <option value="">Готовый набор…</option>
                        </select>
                        <button type="button" class="btn btn-secondary btn-sm" id="role-perm-apply-preset">Применить набор</button>
                        <button type="button" class="btn btn-secondary btn-sm" id="role-perm-expand-all">Развернуть</button>
                        <button type="button" class="btn btn-secondary btn-sm" id="role-perm-collapse-all">Свернуть</button>
                    </div>
                </div>
                <div id="role-permissions-panel">
                    <div id="role-permissions-grid"></div>
                </div>
            </div>
            <div class="role-modal-footer">
                <button type="button" class="btn btn-secondary" onclick="closeRoleModal()">Отмена</button>
                <button type="submit" class="btn btn-primary">Сохранить роль</button>
            </div>
        </form>
    </div>
</div>

<div id="user-edit-modal" class="modal">
    <div class="modal-content" style="max-width: 760px;">
        <div class="modal-header">
            <h3>Редактирование пользователя</h3>
            <button class="close-btn" onclick="closeUserEditModal()">&times;</button>
        </div>
        <form id="user-edit-form">
            <input type="hidden" id="user-edit-id">
            <div class="form-row">
                <div class="form-group">
                    <label>Логин</label>
                    <input type="text" id="user-edit-username" readonly>
                </div>
                <div class="form-group">
                    <label>Адрес email</label>
                    <input type="email" id="user-edit-email" placeholder="user@example.com">
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Полное имя</label>
                    <input type="text" id="user-edit-full-name" placeholder="Иванов Иван Иванович">
                </div>
                <div class="form-group">
                    <label>Имя</label>
                    <input type="text" id="user-edit-first-name" placeholder="Иван">
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Фамилия</label>
                    <input type="text" id="user-edit-last-name" placeholder="Иванов">
                </div>
                <div class="form-group">
                    <label>Телефон</label>
                    <input type="text" id="user-edit-phone" placeholder="+7 ...">
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Отдел</label>
                    <input type="text" id="user-edit-department" placeholder="DevOps">
                </div>
                <div class="form-group">
                    <label>Должность</label>
                    <input type="text" id="user-edit-job-title" placeholder="System Administrator">
                </div>
            </div>
            <div class="form-group">
                <label>Часовой пояс</label>
                <select id="user-edit-timezone"></select>
            </div>
            <div class="form-group" id="user-edit-offices-group">
                <label>Подразделения</label>
                <div id="user-edit-offices" class="office-check-list"></div>
                <small class="form-hint">Можно выбрать несколько. Пользователь переключается между ними в шапке.</small>
            </div>
            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeUserEditModal()">Отмена</button>
                <button type="submit" class="btn btn-primary">Сохранить</button>
            </div>
        </form>
    </div>
</div>

<div id="user-create-modal" class="modal">
    <div class="modal-content" style="max-width: 760px;">
        <div class="modal-header">
            <h3>Создание пользователя</h3>
            <button class="close-btn" onclick="closeUserCreateModal()">&times;</button>
        </div>
        <form id="user-create-form">
            <div class="form-row">
                <div class="form-group">
                    <label>Логин *</label>
                    <input type="text" id="user-create-username" required>
                </div>
                <div class="form-group">
                    <label>Пароль *</label>
                    <input type="password" id="user-create-password" required>
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Адрес email</label>
                    <input type="email" id="user-create-email" placeholder="user@example.com">
                </div>
                <div class="form-group">
                    <label>Полное имя</label>
                    <input type="text" id="user-create-full-name" placeholder="Иванов Иван Иванович">
                </div>
            </div>
            <div class="form-group">
                <label>Роль *</label>
                <select id="user-create-role" class="form-control" required></select>
            </div>
            <div class="form-group" id="user-create-offices-group">
                <label>Подразделения *</label>
                <div id="user-create-offices" class="office-check-list"></div>
                <small class="form-hint">Можно выбрать несколько. Пользователь станет членом отмеченных подразделений.</small>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Провайдер</label>
                    <input type="text" id="user-create-auth-provider" value="LOCAL" readonly>
                </div>
            </div>
            <div class="form-group">
                <label style="display:flex; align-items:center; gap:8px;">
                    <input type="checkbox" id="user-create-active" checked>
                    Активен
                </label>
            </div>
            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeUserCreateModal()">Отмена</button>
                <button type="submit" class="btn btn-success">Создать</button>
            </div>
        </form>
    </div>
</div>

<div id="purge-modal" class="modal">
    <div class="modal-content" style="max-width: 620px;">
        <div class="modal-header">
            <h3>Подтверждение полной очистки системы</h3>
            <button class="close-btn" onclick="closePurgeModal()">&times;</button>
        </div>
        <div class="purge-warning">
            <strong>Внимание:</strong> операция необратима.
            <ul>
                <li>Будут удалены данные всех рабочих разделов и бэкапы на диске</li>
                <li>Сбросятся настройки, SSO и allowed hosts</li>
                <li>Удалятся все пользователи, кроме вашего аккаунта</li>
                <li>Все сессии завершатся — потребуется повторный вход</li>
            </ul>
            <p class="purge-keep">Останутся: ваш пользователь и роли, каталог прав, лицензия, журнал аудита.</p>
        </div>
        <p style="margin: 8px 0;">Введите код <strong id="purge-code-text">------</strong> в поле ниже:</p>
        <div class="form-group">
            <label for="purge-code-input">6-значный код подтверждения</label>
            <input type="text" id="purge-code-input" class="form-control" maxlength="6" placeholder="000000" autocomplete="off">
        </div>
        <div style="display:flex; gap:10px; justify-content:flex-end;">
            <button type="button" class="btn btn-secondary" onclick="closePurgeModal()">Отмена</button>
            <button type="button" class="btn btn-danger" onclick="executePurge()">Подтвердить и очистить</button>
        </div>
    </div>
</div>

<div id="backup-create-modal" class="modal">
    <div class="modal-content" style="max-width: 760px;">
        <div class="modal-header">
            <h3>Создать бэкап</h3>
            <button class="close-btn" onclick="closeBackupCreateModal()">&times;</button>
        </div>
        <form id="backup-create-form">
            <div class="form-row">
                <div class="form-group"><label>Имя (опционально)</label><input type="text" id="backup-name"></div>
                <div class="form-group"><label>Состав</label><select id="backup-scope"><option value="all">Система + БД</option><option value="system">Только система</option><option value="database">Только БД</option></select></div>
            </div>
            <div class="form-row">
                <div class="form-group"><label>Цель</label><select id="backup-target-type" onchange="toggleBackupCreateTargetFields()"><option value="local">Локально</option><option value="s3">S3/MinIO</option><option value="ftp">FTP</option><option value="ssh">SSH</option></select></div>
                <div class="form-group" id="backup-local-dir-group">
                    <label>Локальная директория</label>
                    <input type="text" id="backup-local-directory" placeholder="/opt/AWM/backups">
                </div>
            </div>
            <div class="form-row" id="backup-create-s3-row1" style="display:none;">
                <div class="form-group"><label>Корзина S3</label><input type="text" id="backup-s3-bucket"></div>
                <div class="form-group"><label>Префикс S3</label><input type="text" id="backup-s3-prefix"></div>
            </div>
            <div class="form-row" id="backup-create-s3-row2" style="display:none;">
                <div class="form-group"><label>URL конечной точки S3</label><input type="text" id="backup-s3-endpoint" placeholder="https://minio.example.local"></div>
                <div class="form-group"><label>Ключ доступа S3</label><input type="text" id="backup-s3-access-key"></div>
            </div>
            <div class="form-row" id="backup-create-s3-row3" style="display:none;">
                <div class="form-group"><label>Секретный ключ S3</label><input type="password" id="backup-s3-secret-key"></div>
                <div class="form-group"></div>
            </div>
            <div class="form-row" id="backup-create-ftp-row1" style="display:none;">
                <div class="form-group"><label>Хост FTP</label><input type="text" id="backup-ftp-host" placeholder="ftp.example.com"></div>
                <div class="form-group"><label>Порт FTP</label><input type="number" id="backup-ftp-port" min="1" value="21"></div>
            </div>
            <div class="form-row" id="backup-create-ftp-row2" style="display:none;">
                <div class="form-group"><label>Имя пользователя FTP</label><input type="text" id="backup-ftp-username"></div>
                <div class="form-group"><label>Пароль FTP</label><input type="password" id="backup-ftp-password"></div>
            </div>
            <div class="form-row" id="backup-create-ftp-row3" style="display:none;">
                <div class="form-group"><label>Удалённый каталог FTP</label><input type="text" id="backup-ftp-remote-directory" placeholder="/backups/awm"></div>
                <div class="form-group">
                    <label style="display:flex; align-items:center; gap:8px; margin-top:28px;">
                        <input type="checkbox" id="backup-ftp-tls">
                        Использовать FTPS/TLS
                    </label>
                </div>
            </div>
            <div class="form-row" id="backup-create-ssh-row1" style="display:none;">
                <div class="form-group"><label>Хост SSH</label><input type="text" id="backup-ssh-host" placeholder="10.0.0.10"></div>
                <div class="form-group"><label>Порт SSH</label><input type="number" id="backup-ssh-port" min="1" value="22"></div>
            </div>
            <div class="form-row" id="backup-create-ssh-row2" style="display:none;">
                <div class="form-group"><label>Имя пользователя SSH</label><input type="text" id="backup-ssh-username"></div>
                <div class="form-group"><label>Удалённый каталог</label><input type="text" id="backup-ssh-remote-directory" placeholder="/opt/backups/awm"></div>
            </div>
            <div class="form-row" id="backup-create-ssh-row3" style="display:none;">
                <div class="form-group"><label>Путь к приватному SSH-ключу (необязательно)</label><input type="text" id="backup-ssh-private-key-path" placeholder="/home/awm/.ssh/id_rsa"></div>
                <div class="form-group"><label>SSH Password (если без ключа)</label><input type="password" id="backup-ssh-password"></div>
            </div>
            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeBackupCreateModal()">Отмена</button>
                <button type="submit" class="btn btn-success">Создать</button>
            </div>
        </form>
    </div>
</div>

<div id="backup-plan-modal" class="modal">
    <div class="modal-content" style="max-width: 860px;">
        <div class="modal-header">
            <h3>План бэкапа</h3>
            <button class="close-btn" onclick="closeBackupPlanModal()">&times;</button>
        </div>
        <form id="backup-plan-form">
            <div class="form-row">
                <div class="form-group">
                    <label>Название плана *</label>
                    <input type="text" id="backup-plan-name" required placeholder="daily-backup">
                </div>
                <div class="form-group">
                    <label>Состав</label>
                    <select id="backup-plan-scope">
                        <option value="all">Система + БД</option>
                        <option value="system">Только система</option>
                        <option value="database">Только БД</option>
                    </select>
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Цель</label>
                    <select id="backup-plan-target-type" onchange="toggleBackupPlanTargetFields()">
                        <option value="local">Локально</option>
                        <option value="s3">S3/MinIO</option>
                        <option value="ftp">FTP</option>
                        <option value="ssh">SSH</option>
                    </select>
                </div>
                <div class="form-group">
                    <label>Часовой пояс</label>
                    <select id="backup-plan-timezone"></select>
                </div>
            </div>
            <div class="form-row" id="backup-plan-local-row">
                <div class="form-group">
                    <label>Локальная директория</label>
                    <input type="text" id="backup-plan-local-directory" placeholder="/opt/AWM/backups">
                </div>
                <div class="form-group"></div>
            </div>

            <div class="form-row" id="backup-plan-s3-row1" style="display:none;">
                <div class="form-group"><label>Корзина S3</label><input type="text" id="backup-plan-s3-bucket"></div>
                <div class="form-group"><label>Префикс S3</label><input type="text" id="backup-plan-s3-prefix" placeholder="awm-backups"></div>
            </div>
            <div class="form-row" id="backup-plan-s3-row2" style="display:none;">
                <div class="form-group"><label>URL конечной точки S3</label><input type="text" id="backup-plan-s3-endpoint" placeholder="https://minio.example.local"></div>
                <div class="form-group"><label>Ключ доступа S3</label><input type="text" id="backup-plan-s3-access-key"></div>
            </div>
            <div class="form-row" id="backup-plan-s3-row3" style="display:none;">
                <div class="form-group"><label>Секретный ключ S3</label><input type="password" id="backup-plan-s3-secret-key"></div>
                <div class="form-group"><label>S3 Session Token (опционально)</label><input type="text" id="backup-plan-s3-session-token"></div>
            </div>
            <div class="form-row" id="backup-plan-ftp-row1" style="display:none;">
                <div class="form-group"><label>Хост FTP</label><input type="text" id="backup-plan-ftp-host" placeholder="ftp.example.com"></div>
                <div class="form-group"><label>Порт FTP</label><input type="number" id="backup-plan-ftp-port" min="1" value="21"></div>
            </div>
            <div class="form-row" id="backup-plan-ftp-row2" style="display:none;">
                <div class="form-group"><label>Имя пользователя FTP</label><input type="text" id="backup-plan-ftp-username"></div>
                <div class="form-group"><label>Пароль FTP</label><input type="password" id="backup-plan-ftp-password"></div>
            </div>
            <div class="form-row" id="backup-plan-ftp-row3" style="display:none;">
                <div class="form-group"><label>Удалённый каталог FTP</label><input type="text" id="backup-plan-ftp-remote-directory" placeholder="/backups/awm"></div>
                <div class="form-group">
                    <label style="display:flex; align-items:center; gap:8px; margin-top:28px;">
                        <input type="checkbox" id="backup-plan-ftp-tls">
                        Использовать FTPS/TLS
                    </label>
                </div>
            </div>
            <div class="form-row" id="backup-plan-ssh-row1" style="display:none;">
                <div class="form-group"><label>Хост SSH</label><input type="text" id="backup-plan-ssh-host" placeholder="10.0.0.10"></div>
                <div class="form-group"><label>Порт SSH</label><input type="number" id="backup-plan-ssh-port" min="1" value="22"></div>
            </div>
            <div class="form-row" id="backup-plan-ssh-row2" style="display:none;">
                <div class="form-group"><label>Имя пользователя SSH</label><input type="text" id="backup-plan-ssh-username"></div>
                <div class="form-group"><label>Удалённый каталог</label><input type="text" id="backup-plan-ssh-remote-directory" placeholder="/opt/backups/awm"></div>
            </div>
            <div class="form-row" id="backup-plan-ssh-row3" style="display:none;">
                <div class="form-group"><label>Путь к приватному SSH-ключу (необязательно)</label><input type="text" id="backup-plan-ssh-private-key-path" placeholder="/home/awm/.ssh/id_rsa"></div>
                <div class="form-group"><label>SSH Password (если без ключа)</label><input type="password" id="backup-plan-ssh-password"></div>
            </div>

            <div class="form-row">
                <div class="form-group">
                    <label>Режим расписания</label>
                    <select id="backup-plan-schedule-mode" onchange="toggleBackupPlanScheduleFields()">
                        <option value="interval">Интервал</option>
                        <option value="weekly">По дням недели</option>
                        <option value="idle">При простое системы</option>
                    </select>
                </div>
                <div class="form-group">
                    <label style="display:flex; align-items:center; gap:8px; margin-top:28px;">
                        <input type="checkbox" id="backup-plan-active" checked>
                        Активен
                    </label>
                </div>
            </div>

            <div class="form-row" id="backup-plan-interval-row">
                <div class="form-group">
                    <label>Интервал (минут)</label>
                    <input type="number" id="backup-plan-interval-minutes" min="1" value="60">
                </div>
                <div class="form-group"></div>
            </div>

            <div id="backup-plan-weekly-block" style="display:none;">
                <div class="form-group">
                    <label>Дни недели</label>
                    <div style="display:flex; flex-wrap:wrap; gap:8px;">
                        <label><input type="checkbox" class="backup-plan-weekday" value="0" checked> Пн</label>
                        <label><input type="checkbox" class="backup-plan-weekday" value="1" checked> Вт</label>
                        <label><input type="checkbox" class="backup-plan-weekday" value="2" checked> Ср</label>
                        <label><input type="checkbox" class="backup-plan-weekday" value="3" checked> Чт</label>
                        <label><input type="checkbox" class="backup-plan-weekday" value="4" checked> Пт</label>
                        <label><input type="checkbox" class="backup-plan-weekday" value="5"> Сб</label>
                        <label><input type="checkbox" class="backup-plan-weekday" value="6"> Вс</label>
                    </div>
                </div>
                <div class="form-row">
                    <div class="form-group"><label>Час запуска</label><input type="number" id="backup-plan-run-hour" min="0" max="23" value="3"></div>
                    <div class="form-group"><label>Минута запуска</label><input type="number" id="backup-plan-run-minute" min="0" max="59" value="0"></div>
                </div>
            </div>

            <div class="form-row" id="backup-plan-idle-row" style="display:none;">
                <div class="form-group">
                    <label>Простой системы (минут)</label>
                    <input type="number" id="backup-plan-idle-minutes" min="1" value="20">
                </div>
                <div class="form-group"></div>
            </div>

            <div style="margin: 10px 0 6px; font-weight:600; color:var(--gray-700);">Политика хранения (опционально)</div>
            <div class="form-row">
                <div class="form-group">
                    <label>Макс. количество архивов</label>
                    <input type="number" id="backup-plan-retention-count" min="1" placeholder="например: 30">
                </div>
                <div class="form-group">
                    <label>Удалять старше (дней)</label>
                    <input type="number" id="backup-plan-retention-days" min="1" placeholder="например: 14">
                </div>
            </div>
            <div class="form-row">
                <div class="form-group">
                    <label>Макс. общий размер (MB)</label>
                    <input type="number" id="backup-plan-retention-size-mb" min="1" placeholder="например: 10240">
                </div>
                <div class="form-group"></div>
            </div>

            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeBackupPlanModal()">Отмена</button>
                <button type="submit" class="btn btn-primary">Сохранить план</button>
            </div>
        </form>
    </div>
</div>

<div id="integration-modal" class="modal">
    <div class="modal-content" style="max-width: 860px;">
        <div class="modal-header">
            <h3 id="integration-modal-title">Новая интеграция</h3>
            <button class="close-btn" onclick="closeIntegrationModal()">&times;</button>
        </div>
        <form id="integration-form">
            <input type="hidden" id="integration-id">
            <div class="form-row">
                <div class="form-group"><label>Название *</label><input type="text" id="integration-name" required></div>
                <div class="form-group">
                    <label>Тип</label>
                    <select id="integration-type" onchange="toggleIntegrationFields()">
                        <option value="webhook">Webhook</option>
                        <option value="telegram">Telegram</option>
                        <option value="max">MAX API</option>
                        <option value="matrix">Matrix</option>
                        <option value="grafana">Grafana Webhook</option>
                        <option value="snmp">SNMP v2c / v3</option>
                        <option value="prometheus">Prometheus Pushgateway</option>
                    </select>
                </div>
            </div>
            <div class="form-group">
                <label>События</label>
                <div id="integration-events-grid" style="display:grid; grid-template-columns:repeat(auto-fit, minmax(220px, 1fr)); gap:6px;">
                    <label><input type="checkbox" class="integration-event-checkbox" value="run_started" checked> Запуск плейбука</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="run_retry_started"> Повторный запуск</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="run_finished_success" checked> Успешное завершение</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="run_finished_failed" checked> Ошибка выполнения</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="backup_created"> Создан бэкап</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="backup_failed"> Ошибка бэкапа</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="monitoring_agent_offline"> Мониторинг: хост не в сети</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="monitoring_agent_online"> Мониторинг: хост в сети</label>
                    <label><input type="checkbox" class="integration-event-checkbox" value="monitoring_threshold_alert"> Мониторинг: порог метрики</label>
                </div>
            </div>
            <div class="form-group">
                <label style="display:flex; align-items:center; gap:8px;">
                    <input type="checkbox" id="integration-enabled" checked>
                    Интеграция активна
                </label>
            </div>

            <div id="integration-webhook-fields">
                <div class="form-row">
                    <div class="form-group"><label>URL вебхука</label><input type="text" id="integration-webhook-url" placeholder="https://example.local/hook"></div>
                    <div class="form-group"><label>Token (опционально)</label><input type="password" id="integration-token"></div>
                </div>
            </div>

            <div id="integration-max-fields" style="display:none;">
                <div class="form-row">
                    <div class="form-group"><label>Токен бота MAX</label><input type="password" id="integration-max-token"></div>
                    <div class="form-group"><label>ID чата MAX</label><input type="text" id="integration-max-chat-id"></div>
                </div>
                <div class="form-group"><label>MAX API URL (опционально)</label><input type="text" id="integration-max-api-url" placeholder="https://platform-api.max.ru/messages"></div>
            </div>

            <div id="integration-telegram-fields" style="display:none;">
                <div class="form-row">
                    <div class="form-group"><label>Токен бота Telegram</label><input type="password" id="integration-telegram-token"></div>
                    <div class="form-group"><label>ID чата</label><input type="text" id="integration-chat-id"></div>
                </div>
                <div class="form-group">
                    <label>Прокси (опционально)</label>
                    <input type="text" id="integration-telegram-proxy" placeholder="http://user:pass@host:3128 или socks5://host:1080">
                    <small style="display:block;margin-top:4px;color:var(--gray-600);">
                        Если api.telegram.org недоступен напрямую — укажите HTTP(S) или SOCKS5 прокси только для этой интеграции.
                    </small>
                </div>
            </div>

            <div id="integration-matrix-fields" style="display:none;">
                <div class="form-row">
                    <div class="form-group"><label>URL homeserver (Matrix)</label><input type="text" id="integration-matrix-url" placeholder="https://matrix.example.com"></div>
                    <div class="form-group"><label>Токен доступа</label><input type="password" id="integration-matrix-token"></div>
                </div>
                <div class="form-group"><label>Идентификатор комнаты</label><input type="text" id="integration-matrix-room-id" placeholder="!roomid:server"></div>
            </div>

            <div id="integration-snmp-fields" style="display:none;">
                <div class="form-row">
                    <div class="form-group">
                        <label>Версия SNMP</label>
                        <select id="integration-snmp-version" onchange="toggleSnmpVersionFields()">
                            <option value="2c">SNMP v2c</option>
                            <option value="3">SNMP v3</option>
                        </select>
                    </div>
                    <div class="form-group">
                        <label>Получатель trap (host) *</label>
                        <input type="text" id="integration-snmp-host" placeholder="zabbix.example.com">
                    </div>
                </div>
                <div class="form-row">
                    <div class="form-group">
                        <label>UDP порт</label>
                        <input type="number" id="integration-snmp-port" min="1" max="65535" value="162">
                    </div>
                    <div class="form-group">
                        <label>Trap OID</label>
                        <input type="text" id="integration-snmp-trap-oid" placeholder="1.3.6.1.4.1.58119.1.1">
                    </div>
                </div>
                <div id="integration-snmp-v2c-fields">
                    <div class="form-group"><label>Community (SNMPv2c)</label><input type="text" id="integration-snmp-community" placeholder="public"></div>
                </div>
                <div id="integration-snmp-v3-fields" style="display:none;">
                    <div class="form-row">
                        <div class="form-group"><label>Пользователь SNMPv3 *</label><input type="text" id="integration-snmp-v3-user"></div>
                        <div class="form-group">
                            <label>Уровень безопасности</label>
                            <select id="integration-snmp-v3-security-level">
                                <option value="noAuthNoPriv">noAuthNoPriv</option>
                                <option value="authNoPriv">authNoPriv</option>
                                <option value="authPriv" selected>authPriv</option>
                            </select>
                        </div>
                    </div>
                    <div class="form-row">
                        <div class="form-group"><label>Протокол аутентификации</label>
                            <select id="integration-snmp-v3-auth-protocol">
                                <option value="MD5">MD5</option>
                                <option value="SHA" selected>SHA</option>
                                <option value="SHA256">SHA256</option>
                            </select>
                        </div>
                        <div class="form-group"><label>Ключ аутентификации</label><input type="password" id="integration-snmp-v3-auth-key"></div>
                    </div>
                    <div class="form-row">
                        <div class="form-group"><label>Протокол шифрования</label>
                            <select id="integration-snmp-v3-priv-protocol">
                                <option value="DES">DES</option>
                                <option value="AES" selected>AES</option>
                                <option value="AES256">AES256</option>
                            </select>
                        </div>
                        <div class="form-group"><label>Ключ шифрования</label><input type="password" id="integration-snmp-v3-priv-key"></div>
                    </div>
                </div>
                <p style="font-size:12px;color:var(--gray-600);margin:8px 0 0;">
                    Документация и шаблоны Zabbix: <code>docs/administrators/integrations/SNMP_ZABBIX.md</code>
                </p>
            </div>

            <div id="integration-prometheus-fields" style="display:none;">
                <div class="form-group"><label>URL Pushgateway</label><input type="text" id="integration-prometheus-url" placeholder="http://pushgateway:9091/metrics/job/awm"></div>
            </div>

            <div style="display:flex; gap:10px; justify-content:flex-end;">
                <button type="button" class="btn btn-secondary" onclick="closeIntegrationModal()">Отмена</button>
                <button type="submit" class="btn btn-primary">Сохранить</button>
            </div>
        </form>
    </div>
</div>

<div id="integrations-help-modal" class="modal">
    <div class="modal-content" style="max-width: 920px;">
        <div class="modal-header">
            <h3>Справка по настройке интеграций</h3>
            <button class="close-btn" onclick="closeIntegrationsHelpModal()">&times;</button>
        </div>
        <div style="max-height: 70vh; overflow: auto; padding-right: 4px;">
            <div class="empty-state" style="display:block; text-align:left; margin-bottom:12px;">
                Выберите тип интеграции, укажите события и выполните тест отправки. Рекомендуется включать минимум
                <code>run_started</code>, <code>run_finished_success</code>, <code>run_finished_failed</code>.
            </div>

            <h4 style="margin: 10px 0 6px;">Telegram (рекомендуется)</h4>
            <ul style="margin: 0 0 12px 18px; color: var(--gray-700);">
                <li>Создайте бота через <code>@BotFather</code> и получите <code>bot token</code>.</li>
                <li>Добавьте бота в нужный чат/группу и дайте право писать сообщения.</li>
                <li>Получите <code>chat_id</code> (например через <code>getUpdates</code>).</li>
                <li>В AWM выберите тип <strong>Telegram</strong>, заполните <strong>токен бота Telegram</strong> и <strong>ID чата</strong>.</li>
                <li>Если Bot API недоступен из сети сервера — укажите <strong>Прокси</strong> (<code>http://</code>, <code>https://</code>, <code>socks5://</code> / <code>socks5h://</code>). Для SOCKS нужен пакет <code>PySocks</code>.</li>
                <li>Нажмите <strong>Тест</strong> после сохранения интеграции.</li>
            </ul>

            <h4 style="margin: 10px 0 6px;">SNMP v2c / v3 (Zabbix и др.)</h4>
            <ul style="margin: 0 0 12px 18px; color: var(--gray-700);">
                <li>Прямая интеграция Zabbix (<code>zabbix_sender</code>) <strong>не используется</strong>.</li>
                <li>AWM отправляет <strong>SNMP trap</strong> на UDP <code>162</code> (получатель — Zabbix или <code>snmptrapd</code>).</li>
                <li>Укажите host, порт, community (v2c) или учётные данные SNMPv3.</li>
                <li>OID по умолчанию: <code>1.3.6.1.4.1.58119.1.1</code> (см. <code>docs/administrators/integrations/SNMP_ZABBIX.md</code>).</li>
                <li>Импортируйте шаблон <code>docs/administrators/integrations/zabbix/zabbix_template_awm_snmp.xml</code> в Zabbix.</li>
                <li>Тест вручную (v2c): <code>snmptrap -v 2c -c public &lt;host&gt;:162 '' 1.3.6.1.4.1.58119.1.1 ...</code></li>
            </ul>

            <h4 style="margin: 10px 0 6px;">Webhook / Grafana</h4>
            <ul style="margin: 0 0 12px 18px; color: var(--gray-700);">
                <li>Укажите <strong>URL вебхука</strong> принимающего сервиса.</li>
                <li>Если нужно, передайте токен в поле <strong>Token</strong>.</li>
            </ul>

            <h4 style="margin: 10px 0 6px;">MAX API</h4>
            <ul style="margin: 0 0 12px 18px; color: var(--gray-700);">
                <li>Используйте endpoint сообщений: <code>https://platform-api.max.ru/messages</code>.</li>
                <li>Укажите <strong>MAX Bot Token</strong> и <strong>MAX Chat ID</strong>.</li>
                <li>Токен передается в заголовке <code>Authorization</code> (без query-параметров).</li>
            </ul>

            <h4 style="margin: 10px 0 6px;">Matrix</h4>
            <ul style="margin: 0 0 12px 18px; color: var(--gray-700);">
                <li><strong>URL homeserver</strong> — адрес Matrix homeserver.</li>
                <li><strong>Токен доступа</strong> — токен пользователя/бота.</li>
                <li><strong>Идентификатор комнаты</strong> — ID комнаты вида <code>!roomid:server</code>.</li>
            </ul>

            <h4 style="margin: 10px 0 6px;">Prometheus Pushgateway</h4>
            <ul style="margin: 0 0 12px 18px; color: var(--gray-700);">
                <li>Укажите URL push endpoint, например <code>http://pushgateway:9091/metrics/job/awm</code>.</li>
                <li>Проверьте доступность Pushgateway с сервера AWM.</li>
            </ul>
        </div>
        <div style="display:flex; justify-content:flex-end; margin-top: 10px;">
            <button class="btn btn-secondary" onclick="closeIntegrationsHelpModal()">Закрыть</button>
        </div>
    </div>
</div>

<div id="admin-guac-user-modal" class="modal admin-gated-hidden" data-admin-access="remote_desktop">
    <div class="modal-content" style="max-width:520px;">
        <div class="modal-header">
            <h3>Пользователь Guacamole</h3>
            <button type="button" class="close-btn" onclick="adminGuacamoleCloseModal('userModal')" aria-label="Закрыть">&times;</button>
        </div>
        <div class="form-group">
            <label for="admin-guac-user-name">Имя <span style="color:var(--danger)">*</span></label>
            <input id="admin-guac-user-name" class="form-control" type="text" autocomplete="off">
        </div>
        <div class="form-group">
            <label for="admin-guac-user-password">Пароль <span style="color:var(--danger)">*</span></label>
            <input id="admin-guac-user-password" class="form-control" type="password" autocomplete="new-password">
        </div>
        <div class="form-group">
            <label for="admin-guac-user-fullname">Полное имя</label>
            <input id="admin-guac-user-fullname" class="form-control" type="text" autocomplete="off">
        </div>
        <div class="form-group">
            <label for="admin-guac-user-org">Организация</label>
            <input id="admin-guac-user-org" class="form-control" type="text" autocomplete="off">
        </div>
        <div class="form-group">
            <label class="setup-check">
                <input id="admin-guac-user-disabled" type="checkbox">
                <span>Отключён</span>
            </label>
        </div>
        <div style="display:flex;justify-content:flex-end;gap:8px;">
            <button type="button" class="btn btn-secondary" onclick="adminGuacamoleCloseModal('userModal')">Отмена</button>
            <button type="button" class="btn btn-primary" onclick="adminGuacamoleSubmitCreateUser()">Создать</button>
        </div>
    </div>
</div>

<div id="admin-guac-password-modal" class="modal admin-gated-hidden" data-admin-access="remote_desktop">
    <div class="modal-content" style="max-width:480px;">
        <div class="modal-header">
            <h3>Смена пароля пользователя Guacamole</h3>
            <button type="button" class="close-btn" onclick="adminGuacamoleCloseModal('passwordModal')" aria-label="Закрыть">&times;</button>
        </div>
        <div class="form-group">
            <label for="admin-guac-password-username">Пользователь</label>
            <input id="admin-guac-password-username" class="form-control" type="text" readonly>
        </div>
        <div class="form-group" id="admin-guac-password-old-wrap">
            <label for="admin-guac-password-old">Текущий пароль</label>
            <input id="admin-guac-password-old" class="form-control" type="password" autocomplete="current-password">
        </div>
        <div class="form-group">
            <label for="admin-guac-password-new">Новый пароль <span style="color:var(--danger)">*</span></label>
            <input id="admin-guac-password-new" class="form-control" type="password" autocomplete="new-password">
        </div>
        <div style="display:flex;justify-content:flex-end;gap:8px;">
            <button type="button" class="btn btn-secondary" onclick="adminGuacamoleCloseModal('passwordModal')">Отмена</button>
            <button type="button" class="btn btn-primary" onclick="adminGuacamoleSubmitPassword()">Сохранить</button>
        </div>
    </div>
</div>

<div id="admin-guac-api-password-modal" class="modal admin-gated-hidden" data-admin-access="remote_desktop">
    <div class="modal-content" style="max-width:480px;">
        <div class="modal-header">
            <h3>Смена пароля API Guacamole</h3>
            <button type="button" class="close-btn" onclick="adminGuacamoleCloseModal('apiPasswordModal')" aria-label="Закрыть">&times;</button>
        </div>
        <p class="admin-subtitle" style="margin-top:0;">
            Пароль служебного пользователя из настроек интеграции меняется в Guacamole и сразу сохраняется в AWM.
        </p>
        <div class="form-group">
            <label for="admin-guac-api-password-new">Новый пароль <span style="color:var(--danger)">*</span></label>
            <input id="admin-guac-api-password-new" class="form-control" type="password" autocomplete="new-password">
        </div>
        <div style="display:flex;justify-content:flex-end;gap:8px;">
            <button type="button" class="btn btn-secondary" onclick="adminGuacamoleCloseModal('apiPasswordModal')">Отмена</button>
            <button type="button" class="btn btn-primary" onclick="adminGuacamoleSubmitApiPassword()">Сохранить</button>
        </div>
    </div>
</div>

<div id="admin-guac-group-modal" class="modal admin-gated-hidden" data-admin-access="remote_desktop">
    <div class="modal-content" style="max-width:480px;">
        <div class="modal-header">
            <h3>Группа Guacamole</h3>
            <button type="button" class="close-btn" onclick="adminGuacamoleCloseModal('groupModal')" aria-label="Закрыть">&times;</button>
        </div>
        <div class="form-group">
            <label for="admin-guac-group-id">Идентификатор <span style="color:var(--danger)">*</span></label>
            <input id="admin-guac-group-id" class="form-control" type="text" autocomplete="off">
        </div>
        <div style="display:flex;justify-content:flex-end;gap:8px;">
            <button type="button" class="btn btn-secondary" onclick="adminGuacamoleCloseModal('groupModal')">Отмена</button>
            <button type="button" class="btn btn-primary" onclick="adminGuacamoleSubmitCreateGroup()">Создать</button>
        </div>
    </div>
</div>
{% endblock %}

{% block scripts %}
<script src="/static/js/guacamole_admin.js"></script>
<script id="admin-access-json" type="application/json">{{ admin_access | tojson }}</script>
<script id="admin-office-ui-json" type="application/json">{{ office_ui | default({}) | tojson }}</script>
<script id="admin-demo-restrictions-json" type="application/json">{{ demo_restrictions | tojson }}</script>
<script>
    const ADMIN_ACCESS = JSON.parse(document.getElementById('admin-access-json').textContent);
    const ADMIN_OFFICE_UI = JSON.parse(document.getElementById('admin-office-ui-json').textContent || '{}');
    const ADMIN_DEMO_RESTRICTIONS = JSON.parse(document.getElementById('admin-demo-restrictions-json').textContent || '{}');
    let adminGuacamoleAdminUi = null;

    function ensureAdminGuacamoleAdminUi() {
        if (adminGuacamoleAdminUi || typeof AwmGuacamoleAdminUi !== 'function') {
            return adminGuacamoleAdminUi;
        }
        adminGuacamoleAdminUi = new AwmGuacamoleAdminUi();
        return adminGuacamoleAdminUi;
    }

    function adminGuacamoleRefreshAdmin() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.refreshAll();
    }

    function adminGuacamoleRefreshSessions() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.loadSessions();
    }

    function adminGuacamoleRefreshConnections() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.loadConnections();
    }

    function adminGuacamoleImportConnections() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.importConnections();
    }

    function adminGuacamoleOpenCreateUser() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.openCreateUser();
    }

    function adminGuacamoleSubmitCreateUser() {
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.submitCreateUser();
    }

    function adminGuacamoleOpenCreateGroup() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.openCreateGroup();
    }

    function adminGuacamoleSubmitCreateGroup() {
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.submitCreateGroup();
    }

    function adminGuacamoleOpenApiPassword() {
        if (!hasAdminAccess('remote_desktop')) return;
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.openChangeApiPassword();
    }

    function adminGuacamoleSubmitPassword() {
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.submitPassword();
    }

    function adminGuacamoleSubmitApiPassword() {
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.submitApiPassword();
    }

    function adminGuacamoleCloseModal(key) {
        const ui = ensureAdminGuacamoleAdminUi();
        if (ui) ui.closeModal(key);
    }

    function hasAdminAccess(key) {
        return Boolean(ADMIN_ACCESS[key]);
    }

    function isMultiOfficeMode() {
        return String(ADMIN_OFFICE_UI.mode || '').toLowerCase() === 'multi';
    }

    function applySingleOfficeUsersUi() {
        const multi = isMultiOfficeMode();
        ['users-office-filter-group', 'user-edit-offices-group', 'user-create-offices-group'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.hidden = !multi;
        });
        const subtitle = document.getElementById('users-section-subtitle');
        if (subtitle) {
            subtitle.textContent = multi
                ? 'Управление учётными записями, статусом, ролями и членством в подразделениях.'
                : 'Управление учётными записями, статусом и ролями.';
        }
        const officeSelect = document.getElementById('users-office-filter');
        if (!multi && officeSelect) officeSelect.value = '';
    }

    function applyAdminSectionVisibility() {
        document.querySelectorAll('[data-admin-access]').forEach((el) => {
            const key = el.getAttribute('data-admin-access');
            if (!hasAdminAccess(key)) {
                el.classList.add('admin-gated-hidden');
            } else {
                el.classList.remove('admin-gated-hidden');
            }
        });
        const statGrid = document.getElementById('admin-stat-grid');
        if (statGrid) {
            const hasStat = [...statGrid.querySelectorAll('.admin-stat')].some(
                (el) => !el.classList.contains('admin-gated-hidden')
            );
            statGrid.classList.toggle('admin-gated-hidden', !hasStat);
        }
        const nav = document.getElementById('admin-nav');
        if (nav) {
            const hasNav = [...nav.querySelectorAll('button[data-admin-access]')].some(
                (el) => !el.classList.contains('admin-gated-hidden')
            );
            nav.classList.toggle('admin-gated-hidden', !hasNav);
        }
        const sectionsGrid = document.querySelector('.admin-sections-grid');
        if (sectionsGrid) {
            const hasSection = [...sectionsGrid.querySelectorAll('[data-admin-access]')].some(
                (el) => !el.classList.contains('admin-gated-hidden')
            );
            sectionsGrid.classList.toggle('admin-gated-hidden', !hasSection);
        }
        const noSectionsEl = document.getElementById('admin-no-sections');
        if (noSectionsEl) {
            noSectionsEl.style.display = ADMIN_ACCESS.has_any_section ? 'none' : 'block';
        }
    }

    function applyDemoAdminRestrictions() {
        if (!ADMIN_DEMO_RESTRICTIONS || !ADMIN_DEMO_RESTRICTIONS.enabled) return;
        const blocked = ADMIN_DEMO_RESTRICTIONS.items || {};
        const disableIf = (selector, featureKey) => {
            if (!blocked[featureKey]) return;
            document.querySelectorAll(selector).forEach((el) => {
                el.disabled = true;
                el.title = 'В демо-режиме недоступно';
                if (el.classList && el.classList.contains('btn-danger')) {
                    el.classList.remove('btn-danger');
                    el.classList.add('btn-secondary');
                }
            });
        };
        disableIf('[onclick="openPurgeModal()"]', 'system_purge');
        disableIf('[onclick="addAllowedHostPrompt()"]', 'allowed_hosts_edit');
        disableIf('[onclick="saveSsoSettings()"]', 'sso_settings');
        disableIf('[onclick="openCreateBackupModal()"]', 'backups');
        disableIf('[onclick="openBackupPlanModal()"]', 'backups');
        disableIf('[onclick="importPlugin()"]', 'plugin_management');
        disableIf('[onclick="openIntegrationModal()"]', 'integrations');
        disableIf('[onclick*="togglePlugin"]', 'plugin_management');
        disableIf('[onclick*="toggleBackupPlan"]', 'backups');
        disableIf('[onclick*="rotateEnrollment"]', 'worker_management');
        disableIf('[onclick*="purgeAudit"]', 'system_purge');
        disableIf('[onclick*="purgeServerLogs"]', 'system_purge');
        const dangerSection = document.getElementById('section-danger');
        if (dangerSection && blocked.system_purge) {
            let note = dangerSection.querySelector('.demo-admin-restriction-note');
            if (!note) {
                note = document.createElement('div');
                note.className = 'demo-admin-restriction-note';
                note.style.cssText = 'margin-top:10px;padding:10px 12px;border-radius:10px;border:1px solid var(--border);background:var(--bg-secondary);color:var(--gray-700);font-size:13px;';
                note.textContent = 'В демо-режиме полная очистка недоступна — окружение периодически сбрасывается автоматически.';
                dangerSection.appendChild(note);
            }
        }
    }

    let currentProvider = null;
    let isCreatingProvider = false;
    let adminRoles = [];
    let adminPermissions = [];
    let adminPermissionGroups = [];
    let adminPermissionPresets = [];
    let roleModalSelected = new Set();
    let roleModalSearchBound = false;
    let adminUsersById = {};
    let auditItems = [];
    let auditSortDesc = true;
    const auditPager = { limit: 50, offset: 0, total: 0 };
    let purgeChallengeToken = null;
    let purgeChallengeCode = null;
    let backupPlans = [];
    let integrationsItems = [];
    let pluginsItems = [];
    let pluginUpdatePendingBytes = null;
    let pluginUpdatePendingForce = false;
    let pluginUpdatePendingPrecheck = null;
    let serverLogsItems = [];
    let selectedServerLogName = null;
    let usersItems = [];
    let usersSearchText = '';
    let usersStatusFilter = '';
    let usersProviderFilter = '';
    let usersRoleFilter = '';
    let usersOfficeFilter = '';
    let usersPerPage = 10;
    let usersCurrentPage = 1;
    let userEditSsoManaged = false;
    let usersFiltersBound = false;

    const ROLE_TITLES_UI = {
        admin: 'Администратор',
        office_admin: 'Администратор подразделения',
        operator: 'Оператор',
        auditor: 'Аудитор',
        viewer: 'Наблюдатель',
    };

    function roleTitle(name) {
        const key = String(name || '').trim().toLowerCase();
        if (!key) return 'Роль';
        if (ROLE_TITLES_UI[key]) return ROLE_TITLES_UI[key];
        const titled = key.replace(/[_-]+/g, ' ').trim();
        if (!titled) return 'Роль';
        return titled.replace(/\b\w/g, (ch) => ch.toUpperCase());
    }

    function isSsoManagedAuthProvider(provider) {
        const p = String(provider || 'local').toLowerCase();
        return p === 'oidc' || p === 'sso';
    }

    async function api(method, url, data = null) {
        const options = { method, headers: { 'Content-Type': 'application/json' } };
        if (data) options.body = JSON.stringify(data);
        const response = await fetch(url, options);
        const payload = await response.json().catch(() => ({}));
        if (!response.ok) {
            if (window.AWM_ERRORS && typeof window.AWM_ERRORS.createApiError === 'function') {
                throw window.AWM_ERRORS.createApiError(payload, response.status);
            }
            throw new Error(payload.detail || `HTTP ${response.status}`);
        }
        return payload;
    }

    function isAdminLicenseError(error) {
        return !!(window.AWM_ERRORS && typeof window.AWM_ERRORS.isLicenseError === 'function'
            && window.AWM_ERRORS.isLicenseError(error));
    }

    function renderAdminError(target, error, options) {
        if (!target) return;
        if (typeof window.awmRenderError === 'function') {
            window.awmRenderError(target, error, options);
            return;
        }
        const message = (error && error.message) ? error.message : String(error || 'Неизвестная ошибка');
        target.innerHTML = `<div class="empty-state">${escapeHtml(message)}</div>`;
    }

    function handleAdminLicenseError(error, targetEl, options = {}) {
        if (!isAdminLicenseError(error)) return false;
        if (typeof options.onStat === 'function') options.onStat();
        renderAdminError(targetEl, error, { compact: true, ...(options.render || {}) });
        if (options.clearPager) {
            const pagerHost = document.getElementById(options.clearPager);
            if (pagerHost) pagerHost.innerHTML = '';
        }
        return true;
    }

    function showAdminGlobalError(error) {
        const err = document.getElementById('admin-error');
        if (!err) return;
        renderAdminError(err, error, { compact: true });
        err.style.display = 'block';
    }

    function scrollToAdminSection(id) {
        const el = document.getElementById(id);
        if (!el) return;
        const body = el.querySelector('.admin-spoiler-content');
        const toggle = el.querySelector('.admin-spoiler-toggle');
        if (body && body.style.display === 'none') {
            body.style.display = '';
            if (toggle) toggle.textContent = 'Свернуть';
        }
        if (el.id) void loadAdminSectionData(el.id);
        el.scrollIntoView({ behavior: 'smooth', block: 'start' });
    }

    function setStat(id, value) {
        const el = document.getElementById(id);
        if (el) el.textContent = String(value);
    }

    function platformPercent(part, total) {
        if (!total) return '0%';
        return `${Math.round((part / total) * 100)}%`;
    }

    function platformRunStatusLabel(status) {
        const value = String(status || '').toLowerCase();
        if (value === 'success') return 'Успешно';
        if (value === 'failed') return 'Ошибка';
        if (value === 'running') return 'Выполняется';
        if (value === 'pending') return 'В очереди';
        if (value === 'cancelled') return 'Отменён';
        return status || 'unknown';
    }

    function platformModuleTitle(key) {
        const map = {
            playbooks: 'Ansible Playbooks',
            inventories: 'Ansible Inventories',
            runs: 'Ansible Runs',
            secrets: 'Секреты',
            vars: 'Переменные',
            workspaces: 'Terraform Workspaces',
            groups: 'Группы',
            monitoring: 'Мониторинг',
        };
        return map[key] || key;
    }

    function platformHealthTitle(label) {
        if (label === 'stable') return 'Стабильно';
        if (label === 'attention') return 'Требует внимания';
        if (label === 'critical') return 'Критично';
        return 'Нет оценки';
    }

    function platformFormatBytes(bytes) {
        const value = Number(bytes || 0);
        if (value < 1024) return `${value} Б`;
        if (value < 1024 * 1024) return `${(value / 1024).toFixed(1)} КиБ`;
        if (value < 1024 * 1024 * 1024) return `${(value / (1024 * 1024)).toFixed(1)} МиБ`;
        return `${(value / (1024 * 1024 * 1024)).toFixed(1)} ГиБ`;
    }

    function platformFormatDuration(seconds) {
        if (seconds == null || seconds === '') return '—';
        const value = Number(seconds);
        if (!Number.isFinite(value)) return '—';
        if (value < 60) return `${Math.round(value)} с`;
        if (value < 3600) return `${Math.round(value / 60)} мин`;
        return `${(value / 3600).toFixed(1)} ч`;
    }

    function renderPlatformStatistics(data) {
        const kpi = data.kpi || {};
        const modules = data.modules || {};
        const runsRecent = (data.runs && data.runs.recent) || [];
        const byStatus = (data.runs && data.runs.by_status) || {};
        const windows = data.windows || {};
        const findings = data.findings || [];
        const identity = data.identity || {};
        const operations = data.operations || {};
        const durations = data.durations || {};
        const health = data.health || {};
        const topFailing = (data.runs && data.runs.top_failing_playbooks) || [];

        setStat('platform-kpi-users', kpi.users_total || 0);
        const usersActiveEl = document.getElementById('platform-kpi-users-active');
        if (usersActiveEl) usersActiveEl.textContent = `Активных: ${kpi.users_active || 0}`;
        setStat('platform-kpi-runs', kpi.runs_total || 0);
        const runsRateEl = document.getElementById('platform-kpi-runs-rate');
        if (runsRateEl) runsRateEl.textContent = `Успешность: ${kpi.runs_success_rate || 0}%`;
        setStat('platform-kpi-runs-failed', kpi.runs_failed || 0);
        const runsActiveEl = document.getElementById('platform-kpi-runs-active');
        if (runsActiveEl) runsActiveEl.textContent = `Активных: ${kpi.runs_active || 0}`;
        setStat('platform-kpi-resources', kpi.total_resources || 0);
        const monitoringEl = document.getElementById('platform-kpi-monitoring');
        if (monitoringEl) {
            monitoringEl.textContent = `Мониторинг в сети: ${kpi.monitoring_online || 0} / ${kpi.monitoring_total || 0}`;
        }
        setStat('platform-kpi-rate-7d', `${kpi.runs_success_rate_7d || 0}%`);
        const failed24El = document.getElementById('platform-kpi-failed-24h');
        if (failed24El) failed24El.textContent = `Ошибок за 24 ч: ${kpi.runs_failed_24h || 0}`;
        setStat('platform-kpi-audit', kpi.audit_total || 0);
        const backupsEl = document.getElementById('platform-kpi-backups');
        if (backupsEl) backupsEl.textContent = `Бэкапов: ${kpi.backups_total || 0}`;

        const healthBanner = document.getElementById('platform-health-banner');
        const healthScoreEl = document.getElementById('platform-health-score');
        const healthLabelEl = document.getElementById('platform-health-label');
        if (healthBanner && healthScoreEl && healthLabelEl) {
            healthBanner.hidden = false;
            healthBanner.className = `platform-health ${escapeHtml(health.label || '')}`.trim();
            healthScoreEl.textContent = String(health.score ?? kpi.health_score ?? '—');
            healthLabelEl.textContent = platformHealthTitle(health.label);
        }

        const moduleRows = Object.entries(modules).map(([key, mod]) => {
            const accessible = Boolean(mod && mod.accessible);
            const total = Number((mod && mod.total) || 0);
            const note = accessible ? `${total} объектов` : ((mod && mod.error) || 'недоступно');
            return `<div class="platform-module-row"><div><strong>${platformModuleTitle(key)}</strong><div style="font-size:12px;color:var(--gray-500);">${escapeHtml(note)}</div></div><span class="admin-badge ${accessible ? 'ok' : 'off'}">${accessible ? 'ОК' : '—'}</span></div>`;
        }).join('');

        const statusKeys = ['success', 'failed', 'running', 'pending', 'cancelled'];
        const statusRows = Object.entries(byStatus)
            .filter(([status]) => statusKeys.includes(status) || !['total', 'success_rate', 'running', 'pending', 'cancelled', 'success', 'failed'].includes(status) || statusKeys.includes(status))
            .filter(([status]) => !['total', 'success_rate'].includes(status))
            .map(([status, count]) => `
            <div class="platform-kv-item"><span>${escapeHtml(platformRunStatusLabel(status))}</span><strong>${count}</strong></div>
        `).join('') || '<div class="empty-state">Нет данных по запускам</div>';

        const windowCard = (title, block) => {
            const item = block || {};
            return `<div class="platform-kv-item"><span>${title}</span><strong>${item.total || 0} · ${item.success_rate || 0}%</strong></div>`;
        };

        const findingsHtml = findings.length
            ? findings.map((item) => `
                <div class="platform-finding ${escapeHtml(item.severity || 'info')}">
                    <div class="platform-finding-title">${escapeHtml(item.title || '')}</div>
                    <div class="platform-finding-detail">${escapeHtml(item.detail || '')}</div>
                </div>
            `).join('')
            : '<div class="empty-state">Замечания отсутствуют</div>';

        const failRows = topFailing.length
            ? topFailing.map((row) => `<div class="platform-kv-item"><span>${escapeHtml(row.name || '—')}</span><strong>${row.failed || 0}</strong></div>`).join('')
            : '<div class="empty-state">Ошибок playbook за 30 дней нет</div>';

        const runsTable = runsRecent.length
            ? `<div style="overflow-x:auto;"><table class="platform-runs-table"><thead><tr><th>Время</th><th>Плейбук</th><th>Инвентори</th><th>Статус</th></tr></thead><tbody>${runsRecent.map((run) => `
                <tr>
                    <td>${run.created_at ? new Date(run.created_at).toLocaleString('ru-RU') : '-'}</td>
                    <td>${escapeHtml(run.playbook_name || '-')}</td>
                    <td>${escapeHtml(run.inventory_name || '-')}</td>
                    <td><span class="platform-status ${escapeHtml(run.status || '')}">${escapeHtml(platformRunStatusLabel(run.status))}</span></td>
                </tr>
            `).join('')}</tbody></table></div>`
            : '<div class="empty-state">Запуски отсутствуют</div>';

        const license = operations.license || {};
        const contentEl = document.getElementById('platform-stats-content');
        if (!contentEl) return;
        contentEl.innerHTML = `
            <section class="platform-stats-panel span-2">
                <h4>Анализ системы</h4>
                ${findingsHtml}
            </section>
            <section class="platform-stats-panel">
                <h4>Окна активности</h4>
                <div class="platform-kv">
                    ${windowCard('24 часа', windows.h24)}
                    ${windowCard('7 дней', windows.d7)}
                    ${windowCard('30 дней', windows.d30)}
                    <div class="platform-kv-item"><span>Средняя длительность</span><strong>${platformFormatDuration(durations.avg_seconds)}</strong></div>
                    <div class="platform-kv-item"><span>95-й процентиль</span><strong>${platformFormatDuration(durations.p95_seconds)}</strong></div>
                </div>
            </section>
            <section class="platform-stats-panel">
                <h4>Ошибки playbook (30 дней)</h4>
                <div class="platform-kv">${failRows}</div>
            </section>
            <section class="platform-stats-panel">
                <h4>Модули платформы</h4>
                <div class="platform-kv">${moduleRows}</div>
            </section>
            <section class="platform-stats-panel">
                <h4>Администрирование</h4>
                <div class="platform-kv">
                    <div class="platform-kv-item"><span>Роли</span><strong>${kpi.roles_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Записи аудита</span><strong>${kpi.audit_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Аудит за 24 ч</span><strong>${kpi.audit_24h || 0}</strong></div>
                    <div class="platform-kv-item"><span>Бэкапы</span><strong>${kpi.backups_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Интеграции</span><strong>${kpi.integrations_enabled || 0} / ${kpi.integrations_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Плагины</span><strong>${kpi.plugins_enabled || 0} / ${kpi.plugins_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Расписания</span><strong>${kpi.schedules_active || 0} / ${kpi.schedules_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Подразделения</span><strong>${kpi.offices_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>SSH-ключи</span><strong>${kpi.ssh_keys_total || 0}</strong></div>
                    <div class="platform-kv-item"><span>Terraform (активные)</span><strong>${kpi.terraform_active_runs || 0}</strong></div>
                    <div class="platform-kv-item"><span>Размер БД</span><strong>${platformFormatBytes(operations.db_size_bytes)}</strong></div>
                    <div class="platform-kv-item"><span>Лицензия</span><strong>${license.active === false ? 'неактивна' : (license.package || '—')}</strong></div>
                </div>
            </section>
            <section class="platform-stats-panel">
                <h4>Запуски по статусам</h4>
                <div class="platform-kv">${statusRows}</div>
            </section>
            <section class="platform-stats-panel">
                <h4>Учётные записи</h4>
                <div class="platform-kv">
                    <div class="platform-kv-item"><span>Локальные</span><strong>${identity.users_local || 0}</strong></div>
                    <div class="platform-kv-item"><span>SSO</span><strong>${identity.users_sso || 0}</strong></div>
                    <div class="platform-kv-item"><span>Администраторы</span><strong>${identity.users_admins || 0}</strong></div>
                    <div class="platform-kv-item"><span>Доступных модулей</span><strong>${kpi.accessible_modules || 0}</strong></div>
                </div>
            </section>
            <section class="platform-stats-panel span-2">
                <h4>Последние запуски</h4>
                ${runsTable}
            </section>
        `;
    }

    async function loadPlatformStatistics() {
        const contentEl = document.getElementById('platform-stats-content');
        if (!contentEl || !hasAdminAccess('statistics')) return;
        try {
            const data = await api('GET', '/api/admin/statistics/summary');
            renderPlatformStatistics(data);
        } catch (e) {
            contentEl.innerHTML = `<div class="empty-state">Ошибка загрузки статистики: ${escapeHtml(e.message || e)}</div>`;
        }
    }

    function refreshPlatformStatistics() {
        const contentEl = document.getElementById('platform-stats-content');
        if (contentEl) contentEl.innerHTML = '<div class="loading">Загрузка статистики...</div>';
        loadPlatformStatistics();
    }

    async function exportPlatformStatisticsPdf() {
        if (!hasAdminAccess('statistics')) return;
        if (typeof awmConfirmHeavyTask === 'function') {
            if (!(await awmConfirmHeavyTask('экспорт PDF статистики платформы'))) return;
        }
        try {
            const started = await api('POST', '/api/admin/statistics/export/pdf/jobs', {});
            if (!started.job_id) throw new Error('Не получен идентификатор задачи');
            const poll = async () => {
                const st = await api('GET', `/api/admin/statistics/export/pdf/jobs/${encodeURIComponent(started.job_id)}`);
                if (st.status === 'completed') return st;
                if (st.status === 'failed') throw new Error(st.error || 'Ошибка формирования PDF');
                await new Promise((r) => setTimeout(r, 1500));
                return poll();
            };
            await poll();
            const response = await fetch(`/api/admin/statistics/export/pdf/jobs/${encodeURIComponent(started.job_id)}/download`);
            if (!response.ok) {
                let detail = `HTTP ${response.status}`;
                try {
                    const payload = await response.json();
                    detail = payload.detail || detail;
                } catch (e) {}
                throw new Error(detail);
            }
            const blob = await response.blob();
            const cd = response.headers.get('Content-Disposition') || '';
            const match = cd.match(/filename="?([^";\n]+)"?/);
            const filename = match ? match[1] : 'awm-platform-statistics.pdf';
            const url = URL.createObjectURL(blob);
            const link = document.createElement('a');
            link.href = url;
            link.download = filename;
            link.click();
            URL.revokeObjectURL(url);
        } catch (e) {
            alert(`Ошибка экспорта PDF: ${e.message || e}`);
        }
    }

    const adminSectionLoaded = new Set();

    function bindServerLogsToolbarOnce() {
        const exportBtn = document.getElementById('server-logs-export-btn');
        const purgeBtn = document.getElementById('server-logs-purge-btn');
        if (exportBtn && !exportBtn.dataset.bound) {
            exportBtn.dataset.bound = '1';
            exportBtn.addEventListener('click', () => exportServerLogsZip());
        }
        if (purgeBtn && !purgeBtn.dataset.bound) {
            purgeBtn.dataset.bound = '1';
            purgeBtn.addEventListener('click', () => purgeServerLogs());
        }
    }

    async function loadAdminSectionData(sectionId, { force = false } = {}) {
        if (!sectionId) return;
        if (!force && adminSectionLoaded.has(sectionId)) return;
        if (!hasAdminAccess({
            'section-platform-statistics': 'statistics',
            'section-users': 'users',
            'section-personal-data-requests': 'users',
            'section-roles': 'users',
            'section-offices': 'offices',
            'section-sso': 'sso',
            'section-backups': 'backups',
            'section-hosts': 'hosts',
            'section-audit': 'audit',
            'section-server-logs': 'server_logs',
            'section-integrations': 'integrations',
            'section-plugins': 'plugins',
            'section-api-tokens': 'api_tokens',
        }[sectionId])) {
            return;
        }
        const tasks = [];
        if (sectionId === 'section-platform-statistics') {
            tasks.push(loadPlatformStatistics());
        } else if (sectionId === 'section-users') {
            tasks.push(loadUsers());
        } else if (sectionId === 'section-personal-data-requests') {
            tasks.push(loadPersonalDataRequestsAdmin());
        } else if (sectionId === 'section-roles') {
            tasks.push(loadRolesAndPermissions());
        } else if (sectionId === 'section-offices') {
            tasks.push(loadOfficesAdmin());
        } else if (sectionId === 'section-hosts') {
            tasks.push(loadAllowedHosts());
        } else if (sectionId === 'section-audit') {
            tasks.push(loadAudit());
        } else if (sectionId === 'section-sso') {
            tasks.push(loadSsoSettings());
        } else if (sectionId === 'section-server-logs') {
            bindServerLogsToolbarOnce();
            tasks.push(loadServerLogPolicy(), loadServerLogs(), refreshServerLogsPurgeAvailability());
        } else if (sectionId === 'section-backups') {
            tasks.push(loadBackups(), loadBackupPlans());
        } else if (sectionId === 'section-integrations') {
            tasks.push(loadIntegrations());
        } else if (sectionId === 'section-plugins') {
            tasks.push(loadPlugins());
        } else if (sectionId === 'section-api-tokens') {
            tasks.push(loadAdminApiTokens());
        }
        if (!tasks.length) return;
        const results = await Promise.allSettled(tasks);
        const failed = results.find((r) => r.status === 'rejected' && !isAdminLicenseError(r.reason));
        if (failed && failed.status === 'rejected') {
            adminSectionLoaded.delete(sectionId);
            showAdminGlobalError(failed.reason);
            return;
        }
        adminSectionLoaded.add(sectionId);
    }

    function initializeAdminSpoilers() {
        document.querySelectorAll('.admin-section').forEach((section, index) => {
            if (section.dataset.spoilerReady === '1') return;
            const toolbar = section.querySelector('.toolbar');
            if (!toolbar) return;
            const contentNodes = Array.from(section.children).filter((n) => n !== toolbar);
            if (!contentNodes.length) return;

            const body = document.createElement('div');
            body.className = 'admin-spoiler-content';
            contentNodes.forEach((n) => body.appendChild(n));
            section.appendChild(body);

            const toggle = document.createElement('button');
            toggle.type = 'button';
            toggle.className = 'btn btn-secondary btn-sm admin-spoiler-toggle';
            const expandedByDefault = false;
            body.style.display = expandedByDefault ? '' : 'none';
            toggle.textContent = expandedByDefault ? 'Свернуть' : 'Развернуть';
            toggle.addEventListener('click', () => {
                const isHidden = body.style.display === 'none';
                body.style.display = isHidden ? '' : 'none';
                toggle.textContent = isHidden ? 'Свернуть' : 'Развернуть';
                if (isHidden && section.id) {
                    void loadAdminSectionData(section.id);
                }
            });
            toolbar.appendChild(toggle);
            section.dataset.spoilerReady = '1';
        });
    }

    function escapeHtml(value) {
        return String(value ?? '')
            .replaceAll('&', '&amp;')
            .replaceAll('<', '&lt;')
            .replaceAll('>', '&gt;')
            .replaceAll('"', '&quot;')
            .replaceAll("'", '&#39;');
    }

    function normalizeAuditDetails(details) {
        if (details == null || details === '') return '';
        if (typeof details === 'string') {
            try {
                const parsed = JSON.parse(details);
                return JSON.stringify(parsed, null, 2);
            } catch (e) {
                return details;
            }
        }
        try {
            return JSON.stringify(details, null, 2);
        } catch (e) {
            return String(details);
        }
    }

    function extractAuditIp(item) {
        if (item && item.ip_address) return item.ip_address;
        const details = item?.details;
        if (!details) return '';
        if (typeof details === 'string') {
            try {
                const parsed = JSON.parse(details);
                return parsed.ip_address || parsed.ip || parsed.client_ip || '';
            } catch (e) {
                return '';
            }
        }
        return details.ip_address || details.ip || details.client_ip || '';
    }

    function formatAuditWhen(iso) {
        if (!iso) return '—';
        try {
            return new Date(iso).toLocaleString('ru-RU', {
                day: '2-digit',
                month: '2-digit',
                year: 'numeric',
                hour: '2-digit',
                minute: '2-digit',
                second: '2-digit',
            });
        } catch (e) {
            return String(iso);
        }
    }

    function renderAuditTable(items) {
        const list = document.getElementById('audit-list');
        if (!items.length) {
            list.innerHTML = '<div class="empty-state">Нет записей по заданным фильтрам</div>';
            return;
        }
        list.innerHTML = `
            <table class="data-table">
                <thead>
                    <tr>
                        <th style="min-width:150px;">Когда</th>
                        <th style="min-width:120px;">Кто</th>
                        <th style="min-width:180px;">Действие</th>
                        <th style="min-width:160px;">Объект</th>
                        <th style="min-width:140px;">Детали</th>
                    </tr>
                </thead>
                <tbody>
                    ${items.map((i) => {
                        const actionTitle = i.action_label || i.action || '—';
                        const codeLine = (i.action && i.action !== actionTitle)
                            ? `<div class="audit-action-code">${escapeHtml(i.action)}</div>`
                            : '';
                        const resType = i.resource_type_label || i.resource_type || '—';
                        const resIdRaw = i.resource_id ? String(i.resource_id) : '';
                        const resName = (i.resource_id_label && String(i.resource_id_label).trim())
                            ? String(i.resource_id_label).trim()
                            : '';
                        const resPrimary = resName || resIdRaw;
                        const resIdLine = (resIdRaw && resName && resName !== resIdRaw)
                            ? `<div class="audit-resource-id">${escapeHtml(resIdRaw)}</div>`
                            : '';
                        const ip = extractAuditIp(i);
                        const who = i.actor_username || 'system';
                        const detailsText = normalizeAuditDetails(i.details);
                        const hasDetails = Boolean(detailsText && detailsText !== '—');
                        return `
                        <tr>
                            <td>
                                <div>${escapeHtml(formatAuditWhen(i.created_at))}</div>
                                ${ip ? `<div class="audit-meta-muted">IP ${escapeHtml(ip)}</div>` : ''}
                            </td>
                            <td>
                                <div class="user-cell-main">
                                    <div class="user-cell-title">${escapeHtml(who)}</div>
                                </div>
                            </td>
                            <td>
                                <div class="audit-action-title">${escapeHtml(actionTitle)}</div>
                                ${codeLine}
                            </td>
                            <td class="audit-resource-cell">
                                <div class="audit-resource-type">${escapeHtml(resType)}</div>
                                ${resPrimary ? `<div>${escapeHtml(resPrimary)}</div>` : ''}
                                ${resIdLine}
                            </td>
                            <td>
                                ${hasDetails ? `
                                <details>
                                    <summary class="audit-details-summary">Показать данные</summary>
                                    <pre class="audit-details-pre">${escapeHtml(detailsText)}</pre>
                                </details>` : '<span class="audit-meta-muted">—</span>'}
                            </td>
                        </tr>`;
                    }).join('')}
                </tbody>
            </table>
        `;
    }

    function populateAuditFilters(facets) {
        const actionSelect = document.getElementById('audit-filter-action');
        const resourceSelect = document.getElementById('audit-filter-resource');
        const currentAction = actionSelect.value;
        const currentResource = resourceSelect.value;
        const actions = (facets && facets.actions) || [];
        const resources = (facets && facets.resource_types) || [];
        actionSelect.innerHTML = `<option value="">Все действия</option>${actions.map((a) => {
            const label = (auditActionLabels[a] || a);
            const text = label !== a ? `${label} (${a})` : a;
            return `<option value="${escapeHtml(a)}">${escapeHtml(text)}</option>`;
        }).join('')}`;
        resourceSelect.innerHTML = `<option value="">Все ресурсы</option>${resources.map((r) => {
            const label = (auditResourceLabels[r] || r);
            const text = label !== r ? `${label} (${r})` : r;
            return `<option value="${escapeHtml(r)}">${escapeHtml(text)}</option>`;
        }).join('')}`;
        if (currentAction) actionSelect.value = currentAction;
        if (currentResource) resourceSelect.value = currentResource;
        if (currentAction && actionSelect.value !== currentAction) {
            actionSelect.insertAdjacentHTML('beforeend', `<option value="${escapeHtml(currentAction)}">${escapeHtml(currentAction)}</option>`);
            actionSelect.value = currentAction;
        }
        if (currentResource && resourceSelect.value !== currentResource) {
            resourceSelect.insertAdjacentHTML('beforeend', `<option value="${escapeHtml(currentResource)}">${escapeHtml(currentResource)}</option>`);
            resourceSelect.value = currentResource;
        }
    }

    // Подписи с сервера в item.action_label; для селектов — локальный fallback по коду.
    const auditActionLabels = {};
    const auditResourceLabels = {};
    const AUDIT_EXPORT_JOB_KEY = 'awm_admin_audit_export_job_id';
    let lastAuditExportJobId = sessionStorage.getItem(AUDIT_EXPORT_JOB_KEY) || '';

    function buildAuditFilterPayload() {
        const search = (document.getElementById('audit-search').value || '').trim();
        const actor = (document.getElementById('audit-filter-actor').value || '').trim();
        const action = document.getElementById('audit-filter-action').value;
        const resource = document.getElementById('audit-filter-resource').value;
        const dateFrom = (document.getElementById('audit-date-from').value || '').trim();
        const dateTo = (document.getElementById('audit-date-to').value || '').trim();
        return {
            q: search || undefined,
            actor: actor || undefined,
            action: action || undefined,
            resource_type: resource || undefined,
            date_from: dateFrom || undefined,
            date_to: dateTo || undefined,
            sort: auditSortDesc ? 'desc' : 'asc',
        };
    }

    function buildAuditQueryParams(includePager) {
        const params = buildAuditFilterPayload();
        if (includePager) {
            params.limit = auditPager.limit;
            params.offset = auditPager.offset;
        }
        return window.awmPagination.buildQuery(params);
    }

    function setAuditPurgeEnabled(enabled) {
        const btn = document.getElementById('audit-purge-btn');
        if (!btn) return;
        btn.disabled = !enabled;
        btn.title = enabled
            ? 'Удалить записи, попавшие в последний успешный экспорт'
            : 'Сначала выполните экспорт';
    }

    async function refreshAuditPurgeAvailability() {
        if (!lastAuditExportJobId) {
            setAuditPurgeEnabled(false);
            return;
        }
        try {
            const st = await api('GET', `/api/admin/audit/export/jobs/${encodeURIComponent(lastAuditExportJobId)}`);
            setAuditPurgeEnabled(!!st.purge_eligible);
            if (st.purged) {
                lastAuditExportJobId = '';
                sessionStorage.removeItem(AUDIT_EXPORT_JOB_KEY);
                setAuditPurgeEnabled(false);
            }
        } catch (_e) {
            setAuditPurgeEnabled(false);
        }
    }

    async function exportAudit(format) {
        const fmt = format === 'json' ? 'json' : 'csv';
        const label = fmt === 'json' ? 'экспорт журнала аудита (JSON)' : 'экспорт журнала аудита (CSV)';
        if (typeof awmConfirmHeavyTask === 'function') {
            if (!(await awmConfirmHeavyTask(label))) return;
        }
        try {
            const payload = { ...buildAuditFilterPayload(), format: fmt };
            const started = await api('POST', '/api/admin/audit/export/jobs', payload);
            if (!started.job_id) throw new Error('Не получен идентификатор задачи');
            const poll = async () => {
                const st = await api('GET', `/api/admin/audit/export/jobs/${encodeURIComponent(started.job_id)}`);
                if (st.status === 'completed') return st;
                if (st.status === 'failed') throw new Error(st.error || 'Ошибка экспорта журнала');
                await new Promise((r) => setTimeout(r, 1500));
                return poll();
            };
            const done = await poll();
            const response = await fetch(
                done.download_url || `/api/admin/audit/export/jobs/${encodeURIComponent(started.job_id)}/download`,
                { credentials: 'same-origin' }
            );
            if (!response.ok) {
                let detail = `HTTP ${response.status}`;
                try {
                    const err = await response.json();
                    detail = err.detail || detail;
                } catch (_e) { /* ignore */ }
                throw new Error(typeof detail === 'string' ? detail : JSON.stringify(detail));
            }
            const blob = await response.blob();
            const cd = response.headers.get('Content-Disposition') || '';
            const match = /filename=\"?([^\";]+)\"?/i.exec(cd);
            const filename = match ? match[1] : `awm-audit.${fmt}`;
            const link = document.createElement('a');
            const objectUrl = URL.createObjectURL(blob);
            link.href = objectUrl;
            link.download = filename;
            document.body.appendChild(link);
            link.click();
            link.remove();
            URL.revokeObjectURL(objectUrl);
            lastAuditExportJobId = started.job_id;
            sessionStorage.setItem(AUDIT_EXPORT_JOB_KEY, lastAuditExportJobId);
            setAuditPurgeEnabled(true);
            await loadAudit(false);
        } catch (e) {
            alert(`Не удалось выгрузить журнал: ${e.message || e}`);
        }
    }

    async function purgeAuditLog() {
        if (!lastAuditExportJobId) {
            alert('Сначала выполните экспорт журнала.');
            return;
        }
        const confirmFn = typeof awmConfirm === 'function' ? awmConfirm : null;
        const ok = confirmFn
            ? await confirmFn(
                'Удалить из журнала все записи, попавшие в последний успешный экспорт? Действие необратимо. Запись об очистке будет добавлена в журнал.',
                'Очистка журнала аудита'
            )
            : window.confirm('Удалить записи журнала по последнему экспорту?');
        if (!ok) return;
        try {
            const result = await api('POST', '/api/admin/audit/purge', { export_job_id: lastAuditExportJobId });
            lastAuditExportJobId = '';
            sessionStorage.removeItem(AUDIT_EXPORT_JOB_KEY);
            setAuditPurgeEnabled(false);
            alert(`Удалено записей: ${result.deleted ?? 0}`);
            await loadAudit(true);
        } catch (e) {
            alert(`Не удалось очистить журнал: ${e.message || e}`);
            await refreshAuditPurgeAvailability();
        }
    }

    let auditFilterTimer = null;
    function applyAuditFilters(resetPage) {
        if (auditFilterTimer) window.clearTimeout(auditFilterTimer);
        auditFilterTimer = window.setTimeout(() => {
            loadAudit(resetPage !== false);
        }, 280);
    }

    async function loadAudit(resetPage) {
        const listEl = document.getElementById('audit-list');
        try {
        if (resetPage) auditPager.offset = 0;
        const query = buildAuditQueryParams(true);
        const data = await api('GET', `/api/admin/audit${query}`);
        auditItems = data.items || [];
        auditPager.total = Number(data.total ?? auditItems.length);
        setStat('stat-audit', auditPager.total);
        const hint = document.getElementById('audit-result-hint');
        if (hint) {
            const from = auditPager.total === 0 ? 0 : auditPager.offset + 1;
            const to = Math.min(auditPager.offset + auditItems.length, auditPager.total);
            hint.textContent = auditPager.total
                ? `Показано ${from}–${to} из ${auditPager.total}`
                : 'Записей нет';
        }
        (auditItems || []).forEach((item) => {
            if (item.action && item.action_label) auditActionLabels[item.action] = item.action_label;
            if (item.resource_type && item.resource_type_label) {
                auditResourceLabels[item.resource_type] = item.resource_type_label;
            }
        });
        populateAuditFilters(data.facets || {});
        if (!auditItems.length) {
            document.getElementById('audit-list').innerHTML = '<div class="empty-state">Записей отсутствуют</div>';
            const host = document.getElementById('audit-list-pager');
            if (host) host.innerHTML = '';
            return;
        }
        renderAuditTable(auditItems);
        let pagerHost = document.getElementById('audit-list-pager');
        if (!pagerHost) {
            pagerHost = document.createElement('div');
            pagerHost.id = 'audit-list-pager';
            pagerHost.className = 'awm-pagination-host';
            document.getElementById('audit-list').insertAdjacentElement('afterend', pagerHost);
        }
        if (window.awmPagination) {
            pagerHost.innerHTML = window.awmPagination.renderBarHtml({
                total: auditPager.total,
                limit: auditPager.limit,
                offset: auditPager.offset,
                idPrefix: 'audit-list',
            });
            window.awmPagination.bindBar(pagerHost, auditPager, (next) => {
                auditPager.limit = next.limit;
                auditPager.offset = next.offset;
                loadAudit(false);
            });
        }
        } catch (e) {
            if (handleAdminLicenseError(e, listEl, {
                onStat: () => setStat('stat-audit', 0),
                clearPager: 'audit-list-pager',
            })) {
                return;
            }
            renderAdminError(listEl, e, { compact: true });
            const host = document.getElementById('audit-list-pager');
            if (host) host.innerHTML = '';
        }
    }

    function providerDisplayName(name) {
        const map = {
            'local-default': 'Локальная УЗ',
            'ldap-default': 'LDAP',
            'ad-default': 'AD',
            'freeipa-default': 'FreeIPA',
            'oidc-default': 'OIDC'
        };
        return map[name] || name;
    }

    function defaultProviderConfig(providerType) {
        if (providerType === 'oidc') {
            return {
                issuer: '',
                client_id: '',
                client_secret: '',
                token_endpoint: '',
                userinfo_endpoint: '',
                field_mapping: {
                    username: 'preferred_username',
                    email: 'email',
                    full_name: 'name',
                    first_name: 'given_name',
                    last_name: 'family_name',
                    phone: 'phone_number',
                    department: 'department',
                    job_title: 'title',
                    timezone: 'zoneinfo'
                }
            };
        }
        if (providerType === 'ad' || providerType === 'freeipa' || providerType === 'ldap') {
            return {
                server_uri: '',
                base_dn: '',
                bind_dn: '',
                bind_password: '',
                user_dn_template: '',
                field_mapping: {
                    email: 'mail',
                    full_name: 'displayName',
                    first_name: 'givenName',
                    last_name: 'sn',
                    phone: 'telephoneNumber',
                    department: 'department',
                    job_title: 'title',
                    timezone: 'timezone'
                }
            };
        }
        return {};
    }

    function prettyProviderConfig(config) {
        if (!config || Object.keys(config).length === 0) return 'Дополнительные параметры не заданы';
        const lines = Object.entries(config).map(([k, v]) => {
            const value = (v === null || v === undefined || v === '') ? '—' : String(v);
            return `${k}: ${value}`;
        });
        return lines.join('\n');
    }

    async function loadUsers() {
        bindUsersFiltersOnce();
        await ensureAdminRolesForUserFilters();
        populateUsersOfficeFilter();
        const data = await api('GET', '/api/admin/users');
        adminUsersById = Object.fromEntries((data.users || []).map(u => [String(u.id), u]));
        const list = document.getElementById('users-list');
        if (!data.users.length) {
            list.innerHTML = '<div class="empty-state">Пользователей нет</div>';
            const meta = document.getElementById('users-filter-meta');
            if (meta) meta.textContent = '';
            setStat('stat-users', 0);
            setStat('stat-users-active', 0);
            return;
        }
        usersItems = data.users || [];
        const activeCount = usersItems.filter(u => u.is_active).length;
        setStat('stat-users', usersItems.length);
        setStat('stat-users-active', activeCount);
        renderUsersTable();
    }

    async function ensureAdminRolesForUserFilters() {
        if (!adminRoles.length) {
            try {
                const rolesData = await api('GET', '/api/admin/roles');
                adminRoles = rolesData.items || [];
            } catch (_err) {
                adminRoles = adminRoles || [];
            }
        }
        populateUsersRoleFilter();
    }

    function populateUsersRoleFilter() {
        const select = document.getElementById('users-role-filter');
        if (!select) return;
        const previous = usersRoleFilter || select.value || '';
        const roleOptions = assignableAdminRoles()
            .map((r) => ({
                name: String(r.name || '').trim(),
                title: String(r.title || '').trim() || roleTitle(r.name),
            }))
            .filter((r) => r.name)
            .sort((a, b) => a.title.localeCompare(b.title, 'ru'));
        select.innerHTML = [
            '<option value="">Все роли</option>',
            ...roleOptions.map((r) => {
                const selected = previous === r.name ? ' selected' : '';
                return `<option value="${escapeHtml(r.name)}"${selected}>${escapeHtml(r.title)}</option>`;
            }),
        ].join('');
        if (previous && !roleOptions.some((r) => r.name === previous)) {
            usersRoleFilter = '';
            select.value = '';
        } else {
            select.value = previous;
            usersRoleFilter = previous;
        }
    }

    function populateUsersOfficeFilter() {
        const select = document.getElementById('users-office-filter');
        if (!select) return;
        const previous = usersOfficeFilter || select.value || '';
        const offices = Array.isArray(ADMIN_OFFICE_UI.offices) ? ADMIN_OFFICE_UI.offices : [];
        const options = offices
            .map((item) => ({
                id: item && item.id != null ? String(item.id) : '',
                name: String((item && item.name) || '').trim(),
            }))
            .filter((item) => item.id && item.name)
            .sort((a, b) => a.name.localeCompare(b.name, 'ru'));
        select.innerHTML = [
            '<option value="">Все подразделения</option>',
            ...options.map((item) => {
                const selected = previous === item.id ? ' selected' : '';
                return `<option value="${escapeHtml(item.id)}"${selected}>${escapeHtml(item.name)}</option>`;
            }),
        ].join('');
        if (previous && !options.some((item) => item.id === previous)) {
            usersOfficeFilter = '';
            select.value = '';
        } else {
            select.value = previous;
            usersOfficeFilter = previous;
        }
    }

    async function loadPersonalDataRequestsAdmin() {
        const box = document.getElementById('personal-data-requests-list');
        if (!box) return;
        try {
            const data = await api('GET', '/api/admin/personal-data/requests');
            const items = Array.isArray(data.items) ? data.items : [];
            const requestTypeLabel = (value) => ({
                deactivate: 'Деактивация аккаунта',
                delete: 'Удаление данных',
                export: 'Админский экспорт',
            }[String(value || '').toLowerCase()] || '—');
            const statusLabel = (value) => ({
                pending: 'Ожидает обработки',
                completed: 'Выполнен',
                rejected: 'Отклонён',
            }[String(value || '').toLowerCase()] || '—');
            const authProviderLabel = (value) => {
                const provider = String(value || 'local').toLowerCase();
                if (provider === 'oidc' || provider === 'sso') return 'SSO';
                return 'Локальный';
            };
            if (!items.length) {
                box.innerHTML = '<div class="empty-state">Запросов нет</div>';
                return;
            }
            box.innerHTML = `
                <div style="overflow-x:auto;">
                    <table class="data-table">
                        <thead>
                            <tr>
                                <th>Пользователь</th>
                                <th>Тип входа</th>
                                <th>Тип запроса</th>
                                <th>Статус</th>
                                <th>Создан</th>
                                <th>Комментарий</th>
                                <th>Ответ</th>
                                <th></th>
                            </tr>
                        </thead>
                        <tbody>
                            ${items.map((item) => `
                                <tr>
                                    <td>${escapeHtml(item.username || ('#' + (item.user_id || '')))}</td>
                                    <td>${escapeHtml(authProviderLabel(item.auth_provider))}</td>
                                    <td>${escapeHtml(requestTypeLabel(item.request_type))}</td>
                                    <td>${escapeHtml(statusLabel(item.status))}</td>
                                    <td>${escapeHtml(item.requested_at || item.created_at || '—')}</td>
                                    <td>${escapeHtml(item.request_comment || '—')}</td>
                                    <td style="white-space:pre-wrap; max-width:280px;">${escapeHtml(item.admin_comment || '—')}</td>
                                    <td>
                                        ${item.status === 'pending'
                                            ? `<div style="display:flex; gap:8px; flex-wrap:wrap;">
                                                ${String(item.request_type || '').toLowerCase() === 'export'
                                                    ? `<button class="btn btn-primary btn-sm" onclick="exportPersonalDataRequest(${Number(item.id)})">Выгрузить информацию</button>`
                                                    : `<button class="btn btn-primary btn-sm" onclick="processPersonalDataRequest(${Number(item.id)}, 'completed')">Выполнить</button>`
                                                }
                                                <button class="btn btn-secondary btn-sm" onclick="processPersonalDataRequest(${Number(item.id)}, 'rejected')">Отклонить</button>
                                            </div>`
                                            : (item.download_available
                                                ? '<span class="form-hint">Выгрузка готова для субъекта</span>'
                                                : '—')}
                                    </td>
                                </tr>
                            `).join('')}
                        </tbody>
                    </table>
                </div>
            `;
        } catch (error) {
            renderAdminError(box, error);
        }
    }

    async function processPersonalDataRequest(requestId, status) {
        const adminComment = window.prompt(
            status === 'completed'
                ? 'Комментарий администратора (необязательно):'
                : 'Причина отклонения (необязательно):',
            ''
        );
        if (adminComment === null) return;
        const result = await api('POST', `/api/admin/personal-data/requests/${requestId}/process`, {
            status,
            admin_comment: (adminComment || '').trim() || null,
        });
        if (result && result.execution && result.execution.sso_manual) {
            const hint = (result.admin_comment || 'Для SSO-пользователя требуется ручная обработка в IdP.');
            if (typeof awmAlert === 'function') {
                await awmAlert(hint);
            } else {
                window.alert(hint);
            }
        }
        await loadPersonalDataRequestsAdmin();
        await loadUsers();
    }

    async function exportPersonalDataRequest(requestId) {
        const confirmed = typeof awmConfirm === 'function'
            ? await awmConfirm('Сформировать выгрузку, завершить запрос и отправить субъекту ссылку на скачивание?')
            : window.confirm('Сформировать выгрузку и отправить субъекту ссылку на скачивание?');
        if (!confirmed) return;
        if (typeof awmConfirmHeavyTask === 'function') {
            if (!(await awmConfirmHeavyTask('выгрузку персональных данных'))) return;
        }
        try {
            const started = await api('POST', `/api/admin/personal-data/requests/${requestId}/export`, {});
            if (!started.job_id) throw new Error('Не получен идентификатор задачи');
            const poll = async () => {
                const st = await api('GET', `/api/admin/personal-data/export/jobs/${encodeURIComponent(started.job_id)}`);
                if (st.status === 'completed') return st;
                if (st.status === 'failed') throw new Error(st.error || 'Ошибка формирования выгрузки');
                await new Promise((r) => setTimeout(r, 1500));
                return poll();
            };
            const done = await poll();
            const link = (done && done.subject_download_url) || '';
            if (typeof awmAlert === 'function') {
                await awmAlert(
                    link
                        ? `Выгрузка готова. Субъекту отправлены уведомление и полная ссылка на скачивание:\n${link}`
                        : 'Выгрузка готова. Субъекту отправлены уведомление и ссылка в разделе «Запросы субъектов ПДн».'
                );
            }
            await loadPersonalDataRequestsAdmin();
        } catch (e) {
            const msg = (e && e.message) || String(e);
            if (typeof awmAlert === 'function') {
                await awmAlert(`Ошибка выгрузки: ${msg}`);
            } else {
                alert(`Ошибка выгрузки: ${msg}`);
            }
        }
    }

    function userHasAdminRole(user) {
        return Array.isArray(user && user.roles) && user.roles.includes('admin');
    }

    function countActiveAdminUsers() {
        return usersItems.filter((u) => u.is_active && userHasAdminRole(u)).length;
    }

    function isSoleActiveAdminUser(user) {
        return !!(user && user.is_active && userHasAdminRole(user) && countActiveAdminUsers() <= 1);
    }

    function filterUsersItems(items) {
        const normalizedSearch = (usersSearchText || '').trim().toLowerCase();
        const status = (usersStatusFilter || '').trim().toLowerCase();
        const provider = (usersProviderFilter || '').trim().toLowerCase();
        const role = (usersRoleFilter || '').trim().toLowerCase();
        const officeId = String(usersOfficeFilter || '').trim();
        return (items || []).filter((u) => {
            if (status === 'active' && !u.is_active) return false;
            if (status === 'disabled' && u.is_active) return false;
            if (provider === 'local' && isSsoManagedAuthProvider(u.auth_provider)) return false;
            if (provider === 'sso' && !isSsoManagedAuthProvider(u.auth_provider)) return false;
            if (role) {
                const roles = Array.isArray(u.roles) ? u.roles.map((r) => String(r || '').toLowerCase()) : [];
                if (!roles.includes(role)) return false;
            }
            if (officeId && isMultiOfficeMode()) {
                const offices = Array.isArray(u.offices) ? u.offices : [];
                const match = offices.some((item) => String((item && item.id) || '') === officeId);
                if (!match) return false;
            }
            if (!normalizedSearch) return true;
            const roleNames = Array.isArray(u.roles) ? u.roles : [];
            const officeNames = isMultiOfficeMode() && Array.isArray(u.offices)
                ? u.offices.map((item) => String((item && item.name) || ''))
                : [];
            const visibleRoles = isMultiOfficeMode()
                ? roleNames
                : roleNames.filter((r) => String(r || '') !== 'office_admin');
            const haystack = [
                u.username || '',
                u.email || '',
                u.auth_provider || '',
                u.full_name || '',
                u.first_name || '',
                u.last_name || '',
                u.phone || '',
                u.department || '',
                u.job_title || '',
                ...visibleRoles,
                ...visibleRoles.map((r) => roleTitle(r)),
                ...officeNames,
            ].join(' ').toLowerCase();
            return haystack.includes(normalizedSearch);
        });
    }

    function bindUsersFiltersOnce() {
        if (usersFiltersBound) return;
        usersFiltersBound = true;
        const searchInput = document.getElementById('users-search');
        const statusSelect = document.getElementById('users-status-filter');
        const providerSelect = document.getElementById('users-provider-filter');
        const roleSelect = document.getElementById('users-role-filter');
        const officeSelect = document.getElementById('users-office-filter');
        if (searchInput) {
            searchInput.value = usersSearchText;
            searchInput.addEventListener('input', () => {
                usersSearchText = searchInput.value || '';
                usersCurrentPage = 1;
                renderUsersTable();
            });
        }
        if (statusSelect) {
            statusSelect.value = usersStatusFilter;
            statusSelect.addEventListener('change', () => {
                usersStatusFilter = statusSelect.value || '';
                usersCurrentPage = 1;
                renderUsersTable();
            });
        }
        if (providerSelect) {
            providerSelect.value = usersProviderFilter;
            providerSelect.addEventListener('change', () => {
                usersProviderFilter = providerSelect.value || '';
                usersCurrentPage = 1;
                renderUsersTable();
            });
        }
        if (roleSelect) {
            roleSelect.addEventListener('change', () => {
                usersRoleFilter = roleSelect.value || '';
                usersCurrentPage = 1;
                renderUsersTable();
            });
        }
        if (officeSelect) {
            officeSelect.addEventListener('change', () => {
                usersOfficeFilter = officeSelect.value || '';
                usersCurrentPage = 1;
                renderUsersTable();
            });
        }
    }

    function renderUsersTable() {
        const list = document.getElementById('users-list');
        if (!list) return;
        if (!usersItems.length) {
            list.innerHTML = '<div class="empty-state">Пользователей нет</div>';
            const metaEmpty = document.getElementById('users-filter-meta');
            if (metaEmpty) metaEmpty.textContent = '';
            return;
        }
        const filtered = filterUsersItems(usersItems);
        const totalPages = Math.max(1, Math.ceil(filtered.length / usersPerPage));
        if (usersCurrentPage > totalPages) usersCurrentPage = totalPages;
        if (usersCurrentPage < 1) usersCurrentPage = 1;
        const start = (usersCurrentPage - 1) * usersPerPage;
        const pageItems = filtered.slice(start, start + usersPerPage);
        const meta = document.getElementById('users-filter-meta');
        if (meta) {
            meta.textContent = `Найдено: ${filtered.length} из ${usersItems.length}`;
        }
        const multi = isMultiOfficeMode();

        list.innerHTML = `
            <div style="display:flex; gap:10px; align-items:end; justify-content:flex-end; margin-bottom:10px; flex-wrap:wrap;">
                <div class="form-group" style="margin:0; width:120px;">
                    <label style="margin-bottom:4px;">На странице</label>
                    <select id="users-per-page" class="form-control">
                        ${[5, 10, 15, 20, 25, 30, 40, 50].map(n => `<option value="${n}" ${usersPerPage === n ? 'selected' : ''}>${n}</option>`).join('')}
                    </select>
                </div>
            </div>
            <div style="max-height:560px; overflow:auto; border:1px solid var(--border); border-radius:10px;">
            <table class="data-table">
                <thead>
                    <tr>
                        <th>Пользователь</th>
                        <th>Контакты</th>
                        <th>Доступ</th>
                        <th>Роли</th>
                        ${multi ? '<th>Подразделения</th>' : ''}
                        <th>Действия</th>
                    </tr>
                </thead>
                <tbody>
                    ${pageItems.length ? pageItems.map(u => `
                        <tr>
                            <td>
                                <div class="user-cell-main">
                                    <div class="user-cell-title">${escapeHtml(u.full_name || u.username || '-')}</div>
                                    <div class="user-cell-sub">@${escapeHtml(u.username || '-')}</div>
                                </div>
                            </td>
                            <td>
                                <div class="user-cell-main">
                                    <div class="user-cell-sub">${escapeHtml(u.email || '-')}</div>
                                    <div class="user-cell-sub">${escapeHtml(u.phone || '-')}</div>
                                </div>
                            </td>
                            <td>
                                <div class="user-cell-main">
                                    <div class="user-badges">
                                        <span class="admin-badge ${u.is_active ? 'ok' : 'off'}">${u.is_active ? 'Активен' : 'Отключен'}</span>
                                        <span class="admin-badge">${escapeHtml(isSsoManagedAuthProvider(u.auth_provider) ? 'SSO' : 'Локальный')}</span>
                                        ${u.totp_enabled ? '<span class="admin-badge ok">2FA</span>' : ''}
                                    </div>
                                    <div class="user-cell-sub">${escapeHtml(u.department || '-')} · ${escapeHtml(u.job_title || '-')}</div>
                                </div>
                            </td>
                            <td>
                                <div class="user-badges">
                                    ${(() => {
                                        const roles = visibleUserRoleNames(u);
                                        return roles.length
                                            ? roles.map(r => `<span class="user-role-chip" title="${escapeHtml(r)}">${escapeHtml(roleTitle(r))}</span>`).join('')
                                            : '<span class="user-cell-sub">—</span>';
                                    })()}
                                </div>
                            </td>
                            ${multi ? `<td>
                                <div class="user-badges">
                                    ${Array.isArray(u.offices) && u.offices.length
                                        ? u.offices.map((item) => `<span class="user-role-chip">${escapeHtml(String((item && item.name) || ''))}</span>`).join('')
                                        : '<span class="user-cell-sub">—</span>'}
                                </div>
                            </td>` : ''}
                            <td>
                                <div class="user-actions">
                                    ${(() => {
                                        if (!u.is_active) {
                                            return `<button class="btn btn-secondary btn-sm" onclick="toggleUser(${u.id}, true)">Включить</button>`;
                                        }
                                        if (isSoleActiveAdminUser(u)) {
                                            return `<button class="btn btn-secondary btn-sm" disabled title="Нельзя отключить последнего активного администратора">Отключить</button>`;
                                        }
                                        const ssoHint = isSsoManagedAuthProvider(u.auth_provider)
                                            ? ' title="Отключает доступ в AWM (сессии сбрасываются). Профиль IdP не меняется."'
                                            : '';
                                        return `<button class="btn btn-secondary btn-sm" onclick="toggleUser(${u.id}, false)"${ssoHint}>Отключить</button>`;
                                    })()}
                                    <button class="btn btn-info btn-sm" ${isSsoManagedAuthProvider(u.auth_provider) ? 'disabled title="Пароль пользователя SSO задаётся в панели IdP"' : `onclick="resetPassword(${u.id})"`}>Сброс</button>
                                    <button class="btn btn-secondary btn-sm" ${(!u.totp_enabled || isSsoManagedAuthProvider(u.auth_provider)) ? 'disabled title="2FA не настроена или недоступна для SSO"' : `onclick="resetUserTotp(${u.id})"`}>Сброс 2FA</button>
                                    <button class="btn btn-primary btn-sm" onclick="openRoleAssignModal(${u.id}, '${encodeURIComponent(u.username)}')">Роль</button>
                                    <button class="btn btn-secondary btn-sm" onclick="editUser(${u.id})">Ред.</button>
                                    <button class="btn btn-danger btn-sm" ${isSoleActiveAdminUser(u) ? 'disabled title="Нельзя удалить последнего активного администратора"' : `onclick="deleteUser(${u.id}, '${encodeURIComponent(u.username)}')"`}>Удалить</button>
                                </div>
                            </td>
                        </tr>
                    `).join('') : `
                        <tr>
                            <td colspan="6"><div class="empty-state" style="padding:24px;">Нет пользователей по выбранным фильтрам</div></td>
                        </tr>
                    `}
                </tbody>
            </table>
            </div>
            <div style="display:flex; justify-content:space-between; align-items:center; gap:10px; margin-top:10px; flex-wrap:wrap;">
                <div style="font-size:12px; color:var(--gray-500);">Страница ${usersCurrentPage} из ${totalPages}</div>
                <div style="display:flex; gap:6px;">
                    <button class="btn btn-secondary btn-sm" id="users-page-prev" ${usersCurrentPage <= 1 ? 'disabled' : ''}>← Назад</button>
                    <button class="btn btn-secondary btn-sm" id="users-page-next" ${usersCurrentPage >= totalPages ? 'disabled' : ''}>Вперед →</button>
                </div>
            </div>
        `;
        const perPageSelect = document.getElementById('users-per-page');
        const prevBtn = document.getElementById('users-page-prev');
        const nextBtn = document.getElementById('users-page-next');
        if (perPageSelect) {
            perPageSelect.addEventListener('change', () => {
                usersPerPage = Number(perPageSelect.value || '10');
                usersCurrentPage = 1;
                renderUsersTable();
            });
        }
        if (prevBtn) {
            prevBtn.addEventListener('click', () => {
                usersCurrentPage -= 1;
                renderUsersTable();
            });
        }
        if (nextBtn) {
            nextBtn.addEventListener('click', () => {
                usersCurrentPage += 1;
                renderUsersTable();
            });
        }
    }

    function assignableAdminRoles() {
        const isSuper = Boolean(ADMIN_ACCESS.is_super);
        return (adminRoles || []).filter((role) => {
            const name = String(role.name || '').trim();
            if (!name) return false;
            if (!isMultiOfficeMode() && name === 'office_admin') return false;
            return isSuper || name !== 'admin';
        });
    }

    function visibleUserRoleNames(user) {
        const roles = Array.isArray(user && user.roles) ? user.roles : [];
        if (isMultiOfficeMode()) return roles;
        return roles.filter((name) => String(name || '').trim() !== 'office_admin');
    }

    function currentOfficeIdForSingleMode() {
        const currentId = ADMIN_OFFICE_UI.current && ADMIN_OFFICE_UI.current.id;
        const n = Number(currentId);
        return Number.isFinite(n) && n > 0 ? n : 0;
    }

    function availableAdminOffices() {
        const offices = Array.isArray(ADMIN_OFFICE_UI.offices) ? ADMIN_OFFICE_UI.offices : [];
        const active = offices.filter((item) => item && item.is_active !== false);
        return active.length ? active : offices;
    }

    function fillOfficeCheckboxList(containerId, selectedIds) {
        const host = document.getElementById(containerId);
        if (!host) return;
        const selected = new Set((selectedIds || []).map((item) => String(item)));
        const currentId = ADMIN_OFFICE_UI.current && ADMIN_OFFICE_UI.current.id != null
            ? String(ADMIN_OFFICE_UI.current.id)
            : '';
        const source = availableAdminOffices();
        if (!selected.size && currentId) selected.add(currentId);
        const rows = source.map((item) => {
            const id = String(item.id);
            const name = String(item.name || '').trim() || String(item.slug || '');
            const checked = selected.has(id) ? ' checked' : '';
            return `<label class="office-check-item"><input type="checkbox" value="${escapeHtml(id)}"${checked}> ${escapeHtml(name)}</label>`;
        });
        if (!rows.length && currentId) {
            const currentName = String((ADMIN_OFFICE_UI.current && ADMIN_OFFICE_UI.current.name) || '').trim()
                || 'Текущее подразделение';
            rows.push(`<label class="office-check-item"><input type="checkbox" value="${escapeHtml(currentId)}" checked> ${escapeHtml(currentName)}</label>`);
        }
        host.innerHTML = rows.join('') || '<div class="admin-subtitle">Нет доступных подразделений.</div>';
    }

    function selectedOfficeIds(containerId) {
        return Array.from(document.querySelectorAll(`#${containerId} input[type="checkbox"]:checked`))
            .map((el) => Number(el.value))
            .filter((n) => Number.isFinite(n) && n > 0);
    }

    function createUserPrompt() {
        const roleSelect = document.getElementById('user-create-role');
        const roles = assignableAdminRoles();
        roleSelect.innerHTML = roles.map(r => {
            const name = String(r.name || '').trim();
            const title = String(r.title || '').trim() || roleTitle(name);
            return `<option value="${escapeHtml(name)}">${escapeHtml(title)}</option>`;
        }).join('');
        if (!roleSelect.innerHTML) {
            roleSelect.innerHTML = `<option value="operator">${escapeHtml(roleTitle('operator'))}</option>`;
        }
        if (isMultiOfficeMode()) {
            fillOfficeCheckboxList('user-create-offices');
        }
        document.getElementById('user-create-modal').classList.add('active');
    }

    function closeUserCreateModal() {
        document.getElementById('user-create-modal').classList.remove('active');
        document.getElementById('user-create-form').reset();
        document.getElementById('user-create-active').checked = true;
    }

    async function openPurgeModal() {
        if (!await awmConfirm('Подтвердите: вы действительно хотите запустить полную очистку системы?')) return;
        if (!await awmConfirm('Подтвердите еще раз: данные всех разделов, бэкапы и остальные пользователи будут удалены. Продолжить?')) return;
        const challenge = await api('POST', '/api/admin/data/purge/challenge');
        purgeChallengeToken = challenge.token;
        purgeChallengeCode = challenge.code;
        document.getElementById('purge-code-text').textContent = challenge.code;
        document.getElementById('purge-code-input').value = '';
        document.getElementById('purge-modal').classList.add('active');
    }

    function closePurgeModal() {
        document.getElementById('purge-modal').classList.remove('active');
        purgeChallengeToken = null;
        purgeChallengeCode = null;
    }

    async function executePurge() {
        const enteredCode = (document.getElementById('purge-code-input').value || '').trim();
        if (!purgeChallengeToken || !purgeChallengeCode) {
            alert('Challenge-код не получен. Откройте окно повторно.');
            return;
        }
        if (enteredCode.length !== 6) {
            alert('Код должен быть 6-значным.');
            return;
        }
        if (enteredCode !== purgeChallengeCode) {
            alert('Неверный код подтверждения.');
            return;
        }
        if (!await awmConfirm('Последнее подтверждение: выполнить полную очистку системы прямо сейчас?')) return;

        await api('POST', '/api/admin/data/purge', { token: purgeChallengeToken, code: enteredCode });
        closePurgeModal();
        await awmAlert('Очистка выполнена. Сессии сброшены — выполните вход снова.', 'Выполнено');
        window.location.href = '/login';
    }

    async function toggleUser(userId, isActive) {
        const u = adminUsersById[String(userId)];
        if (u && !isActive && isSoleActiveAdminUser(u)) {
            alert('Нельзя отключить последнего активного администратора. Сначала назначьте роль admin другому активному пользователю.');
            return;
        }
        if (u && !isActive && isSsoManagedAuthProvider(u.auth_provider)) {
            if (!await awmConfirm(
                `Отключить SSO-пользователя @${u.username || userId} в AWM?\n\n`
                + 'Доступ в систему будет запрещён, активные сессии сброшены. '
                + 'Учётная запись останется в списке со статусом «Отключен». '
                + 'Профиль в IdP не изменится.'
            )) {
                return;
            }
        }
        await api('PATCH', `/api/admin/users/${userId}/status`, { is_active: isActive });
        await loadUsers();
    }

    async function resetPassword(userId) {
        const u = adminUsersById[String(userId)];
        if (u && isSsoManagedAuthProvider(u.auth_provider)) {
            alert('Пароль пользователя SSO задаётся в панели администрирования IdP.');
            return;
        }
        const password = await awmPrompt('Новый пароль пользователя:');
        if (!password) return;
        await api('POST', `/api/admin/users/${userId}/reset-password`, { password });
        alert('Пароль обновлен');
    }

    async function resetUserTotp(userId) {
        const ok = await awmConfirm('Сбросить двухфакторную аутентификацию пользователя? Сессии будут завершены.');
        if (!ok) return;
        await api('POST', `/api/admin/users/${userId}/totp/reset`, {});
        alert('2FA сброшена');
        await loadUsers();
    }

    function openRoleAssignModal(userId, usernameEncoded) {
        const username = decodeURIComponent(usernameEncoded);
        const user = adminUsersById[String(userId)] || {};
        const selectedRoles = new Set(Array.isArray(user.roles) ? user.roles : []);
        document.getElementById('role-assign-user-id').value = String(userId);
        document.getElementById('role-assign-username').value = username;
        const select = document.getElementById('role-assign-role');
        select.innerHTML = assignableAdminRoles()
            .map((r) => {
                const name = String(r.name || '').trim();
                const title = String(r.title || '').trim() || roleTitle(name);
                return `<option value="${escapeHtml(name)}" ${selectedRoles.has(name) ? 'selected' : ''}>${escapeHtml(title)}</option>`;
            })
            .join('');
        document.getElementById('role-assign-modal').classList.add('active');
    }

    function closeRoleAssignModal() {
        document.getElementById('role-assign-modal').classList.remove('active');
    }

    function editUser(userId) {
        const user = adminUsersById[String(userId)];
        if (!user) {
            alert('Не удалось загрузить данные пользователя');
            return;
        }
        document.getElementById('user-edit-id').value = String(user.id);
        document.getElementById('user-edit-username').value = user.username || '';
        document.getElementById('user-edit-email').value = user.email || '';
        document.getElementById('user-edit-full-name').value = user.full_name || '';
        document.getElementById('user-edit-first-name').value = user.first_name || '';
        document.getElementById('user-edit-last-name').value = user.last_name || '';
        document.getElementById('user-edit-phone').value = user.phone || '';
        document.getElementById('user-edit-department').value = user.department || '';
        document.getElementById('user-edit-job-title').value = user.job_title || '';
        if (window.awmTimezones) {
            window.awmTimezones.fillSelect(document.getElementById('user-edit-timezone'), {
                value: user.timezone || '',
                includeEmpty: true,
                emptyLabel: '— не выбран —',
            });
        } else {
            document.getElementById('user-edit-timezone').value = user.timezone || '';
        }
        userEditSsoManaged = isSsoManagedAuthProvider(user.auth_provider);
        ['user-edit-email', 'user-edit-full-name', 'user-edit-first-name', 'user-edit-last-name'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.readOnly = !!userEditSsoManaged;
        });
        if (isMultiOfficeMode()) {
            const userOfficeIds = Array.isArray(user.offices)
                ? user.offices.map((item) => item && item.id).filter((item) => item != null)
                : [];
            fillOfficeCheckboxList('user-edit-offices', userOfficeIds);
        }
        document.getElementById('user-edit-modal').classList.add('active');
    }

    function closeUserEditModal() {
        document.getElementById('user-edit-modal').classList.remove('active');
        document.getElementById('user-edit-form').reset();
        userEditSsoManaged = false;
        ['user-edit-email', 'user-edit-full-name', 'user-edit-first-name', 'user-edit-last-name'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.readOnly = false;
        });
    }

    async function deleteUser(userId, usernameEncoded) {
        const username = decodeURIComponent(usernameEncoded);
        if (!await awmConfirm(`Удалить пользователя ${username}?`)) return;
        await api('DELETE', `/api/admin/users/${userId}`);
        await loadUsers();
    }

    async function loadAllowedHosts() {
        const data = await api('GET', '/api/admin/allowed-hosts');
        const list = document.getElementById('allowed-hosts-list');
        setStat('stat-allowed-hosts', data.items.length || 0);
        if (!data.items.length) {
            list.innerHTML = '<div class="empty-state">Список пуст</div>';
            return;
        }
        list.innerHTML = data.items.map(h => `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">${h.host_pattern}</div>
                    <div class="list-item-meta"><span>${h.description || '-'}</span></div>
                </div>
                <div class="list-item-actions">
                    <button class="btn btn-danger btn-sm" onclick="deleteAllowedHost('${h.host_pattern}')">Удалить</button>
                </div>
            </div>
        `).join('');
    }

    let ssoFieldMapping = {};

    const SSO_PROFILE_FIELDS = [
        { key: 'username', label: 'Логин' },
        { key: 'email', label: 'Email' },
        { key: 'full_name', label: 'Полное имя (ФИО)' },
        { key: 'first_name', label: 'Имя' },
        { key: 'last_name', label: 'Фамилия' },
        { key: 'phone', label: 'Телефон' },
        { key: 'department', label: 'Отдел' },
        { key: 'job_title', label: 'Должность' },
        { key: 'timezone', label: 'Часовой пояс' },
    ];
    const SSO_CLAIM_SUGGESTIONS = [
        'preferred_username', 'email', 'name', 'given_name', 'family_name',
        'phone_number', 'department', 'title', 'zoneinfo', 'groups',
    ];

    function defaultSsoFieldMapping() {
        return {
            username: 'preferred_username',
            email: 'email',
            full_name: 'name',
            first_name: 'given_name',
            last_name: 'family_name',
            phone: 'phone_number',
            department: 'department',
            job_title: 'title',
            timezone: 'zoneinfo',
        };
    }

    function normalizeSsoFieldMapping(raw, fillDefaults) {
        const base = defaultSsoFieldMapping();
        const src = (raw && typeof raw === 'object') ? raw : {};
        const out = {};
        const useDefaults = Boolean(fillDefaults) || !Object.keys(src).length;
        SSO_PROFILE_FIELDS.forEach((field) => {
            if (Object.prototype.hasOwnProperty.call(src, field.key)) {
                const value = String(src[field.key] == null ? '' : src[field.key]).trim();
                if (value) out[field.key] = value;
                return;
            }
            if (useDefaults && base[field.key]) {
                out[field.key] = base[field.key];
            }
        });
        if (!out.username) out.username = 'preferred_username';
        return out;
    }

    function renderSsoMappingSummary() {
        const el = document.getElementById('sso-mapping-summary');
        if (!el) return;
        const parts = SSO_PROFILE_FIELDS
            .filter((f) => ssoFieldMapping[f.key])
            .map((f) => `${f.label} ← ${ssoFieldMapping[f.key]}`);
        el.textContent = parts.length
            ? parts.join(' · ')
            : 'Сопоставление не задано (будет использовано по умолчанию).';
    }

    function collectSsoMappingFromModal() {
        const out = {};
        const grid = document.getElementById('sso-field-mapping-grid');
        if (!grid) return { username: 'preferred_username' };
        grid.querySelectorAll('select[data-map-target]').forEach((select) => {
            const key = select.getAttribute('data-map-target');
            let value = String(select.value || '').trim();
            if (value === '__custom__') {
                const custom = grid.querySelector(`input[data-map-custom="${key}"]`);
                value = custom ? String(custom.value || '').trim() : '';
            }
            // Явно фиксируем ключ, даже если пусто — чтобы не подмешивать defaults.
            if (key) out[key] = value;
        });
        const cleaned = {};
        Object.keys(out).forEach((key) => {
            if (out[key]) cleaned[key] = out[key];
        });
        if (!cleaned.username) cleaned.username = 'preferred_username';
        return cleaned;
    }

    function attachSsoMappingHandlers() {
        const grid = document.getElementById('sso-field-mapping-grid');
        if (!grid) return;
        grid.querySelectorAll('select[data-map-target]').forEach((select) => {
            select.onchange = () => {
                const key = select.getAttribute('data-map-target');
                const custom = grid.querySelector(`input[data-map-custom="${key}"]`);
                if (!custom) return;
                custom.style.display = select.value === '__custom__' ? '' : 'none';
            };
        });
    }

    function openSsoMappingModal() {
        const grid = document.getElementById('sso-field-mapping-grid');
        if (!grid) return;
        const mapping = normalizeSsoFieldMapping(ssoFieldMapping, !Object.keys(ssoFieldMapping || {}).length);
        const options = [''].concat(SSO_CLAIM_SUGGESTIONS);
        grid.innerHTML = `
            <div class="mapping-head">Поле в AWM</div>
            <div class="mapping-head">Claim в SSO</div>
            ${SSO_PROFILE_FIELDS.map((field) => {
                const value = mapping[field.key] || '';
                const hasPredefined = options.includes(value);
                const selectValue = hasPredefined ? value : (value ? '__custom__' : '');
                const customValue = hasPredefined ? '' : value;
                const requiredHint = field.key === 'username' ? ' <span style="color:#b91c1c;">*</span>' : '';
                return `
                    <div class="mapping-row">
                        <div class="mapping-field-label">${escapeHtml(field.label)}${requiredHint}</div>
                        <div>
                            <select data-map-target="${field.key}" class="form-control sso-map-select">
                                <option value="">Не заполнять</option>
                                ${options.filter(Boolean).map((opt) => `<option value="${escapeHtml(opt)}" ${selectValue === opt ? 'selected' : ''}>${escapeHtml(opt)}</option>`).join('')}
                                <option value="__custom__" ${selectValue === '__custom__' ? 'selected' : ''}>Свой claim…</option>
                            </select>
                            <input
                                type="text"
                                class="form-control sso-map-custom"
                                data-map-custom="${field.key}"
                                placeholder="например organization.department"
                                value="${escapeHtml(customValue)}"
                                style="margin-top:6px; ${selectValue === '__custom__' ? '' : 'display:none;'}"
                            >
                        </div>
                    </div>
                `;
            }).join('')}
        `;
        attachSsoMappingHandlers();
        document.getElementById('sso-mapping-modal').classList.add('active');
    }

    function closeSsoMappingModal() {
        const modal = document.getElementById('sso-mapping-modal');
        if (modal) modal.classList.remove('active');
    }

    function applySsoMappingModal() {
        const next = collectSsoMappingFromModal();
        if (!next.username) {
            awmAlert('Укажите claim для логина — без него SSO-вход не сможет определить пользователя.');
            return;
        }
        ssoFieldMapping = next;
        renderSsoMappingSummary();
        closeSsoMappingModal();
    }

    let currentOfficeMembersId = null;
    let officeMemberUserPicker = null;
    let currentOfficeAdminAssignId = null;
    let officeAdminUserPicker = null;
    let officesAdminCache = [];

    function officeDescriptionPreview(text) {
        const value = String(text || '').trim();
        if (!value) return '—';
        return value.length > 80 ? `${value.slice(0, 77)}…` : value;
    }

    async function loadOfficesAdmin() {
        const listEl = document.getElementById('offices-list');
        if (!listEl) return;
        try {
            const data = await api('GET', '/api/offices');
            const offices = data.offices || [];
            officesAdminCache = offices;
            if (!offices.length) {
                listEl.innerHTML = '<div class="admin-subtitle">Подразделений отсутствуют.</div>';
                return;
            }
            listEl.innerHTML = `
                <table class="data-table">
                    <thead><tr><th>Название</th><th>Код</th><th>Описание</th><th></th></tr></thead>
                    <tbody>
                        ${offices.map((office) => {
                            const inactive = Number(office.is_active) === 0 ? ' (отключено)' : '';
                            const isPrimary = Number(office.is_primary) === 1;
                            const primaryMark = isPrimary ? ' (основное)' : '';
                            return `
                            <tr>
                                <td>${escapeHtml((office.name || '') + inactive + primaryMark)}</td>
                                <td>${escapeHtml(office.slug || '')}</td>
                                <td>${escapeHtml(officeDescriptionPreview(office.description))}</td>
                                <td>
                                    <button type="button" class="btn btn-secondary btn-sm" onclick="openOfficeEditModal(${Number(office.id)})">Изменить</button>
                                    <button type="button" class="btn btn-secondary btn-sm" onclick="openOfficeMembersModal(${Number(office.id)}, '${escapeHtml(office.name || '')}')">Участники</button>
                                    ${isPrimary ? '' : `<button type="button" class="btn btn-primary btn-sm" onclick="openOfficeAdminAssignModal(${Number(office.id)}, '${encodeURIComponent(office.name || '')}')">Назначить администратора</button>`}
                                    ${isPrimary ? '' : `<button type="button" class="btn btn-danger btn-sm" onclick="deleteOfficeAdmin(${Number(office.id)})">Удалить</button>`}
                                </td>
                            </tr>
                        `;
                        }).join('')}
                    </tbody>
                </table>
            `;
        } catch (e) {
            listEl.innerHTML = `<div class="admin-subtitle">Не удалось загрузить подразделения: ${escapeHtml(e.message || String(e))}</div>`;
        }
    }

    function setOfficeFormLockedFields(isPrimary) {
        const nameEl = document.getElementById('office-form-name');
        const slugEl = document.getElementById('office-form-slug');
        const activeWrap = document.getElementById('office-form-active-wrap');
        if (nameEl) nameEl.disabled = false;
        if (slugEl) slugEl.disabled = false;
        if (activeWrap) activeWrap.style.display = isPrimary ? 'none' : '';
    }

    function openCreateOfficeModal() {
        const modal = document.getElementById('office-form-modal');
        if (!modal) return;
        document.getElementById('office-form-title').textContent = 'Новое подразделение';
        document.getElementById('office-form-submit').textContent = 'Создать';
        document.getElementById('office-form-id').value = '';
        document.getElementById('office-form-name').value = '';
        document.getElementById('office-form-slug').value = '';
        document.getElementById('office-form-description').value = '';
        document.getElementById('office-form-active').checked = true;
        setOfficeFormLockedFields(false);
        const activeWrap = document.getElementById('office-form-active-wrap');
        if (activeWrap) activeWrap.style.display = 'none';
        modal.classList.add('active');
    }

    function openOfficeEditModal(officeId) {
        const office = officesAdminCache.find((item) => Number(item.id) === Number(officeId));
        const modal = document.getElementById('office-form-modal');
        if (!office || !modal) return;
        const isPrimary = Number(office.is_primary) === 1;
        document.getElementById('office-form-title').textContent = isPrimary
            ? 'Основное подразделение'
            : 'Изменить подразделение';
        document.getElementById('office-form-submit').textContent = 'Сохранить';
        document.getElementById('office-form-id').value = String(office.id);
        document.getElementById('office-form-name').value = office.name || '';
        document.getElementById('office-form-slug').value = office.slug || '';
        document.getElementById('office-form-description').value = office.description || '';
        document.getElementById('office-form-active').checked = Number(office.is_active) !== 0;
        setOfficeFormLockedFields(isPrimary);
        modal.classList.add('active');
    }

    function closeOfficeFormModal() {
        const modal = document.getElementById('office-form-modal');
        if (modal) modal.classList.remove('active');
    }

    function closeCreateOfficeModal() {
        closeOfficeFormModal();
    }

    async function submitOfficeForm(event) {
        event.preventDefault();
        const officeId = String(document.getElementById('office-form-id').value || '').trim();
        const name = document.getElementById('office-form-name').value.trim();
        const slug = document.getElementById('office-form-slug').value.trim();
        const description = document.getElementById('office-form-description').value.trim();
        const isActive = document.getElementById('office-form-active').checked;
        try {
            if (officeId) {
                const payload = { description, name, slug };
                const activeWrap = document.getElementById('office-form-active-wrap');
                if (activeWrap && activeWrap.style.display !== 'none') {
                    payload.is_active = isActive;
                }
                await api('PATCH', `/api/offices/${officeId}`, payload);
            } else {
                await api('POST', '/api/offices', { name, slug, description });
            }
            closeOfficeFormModal();
            adminSectionLoaded.delete('section-offices');
            await loadOfficesAdmin();
        } catch (e) {
            awmAlert(e.message || String(e));
        }
    }

    async function deleteOfficeAdmin(officeId) {
        const ok = await awmConfirm('Удалить подразделение? Данные подразделения в этой версии не переносятся автоматически.');
        if (!ok) return;
        try {
            await api('DELETE', `/api/offices/${officeId}`);
            adminSectionLoaded.delete('section-offices');
            await loadOfficesAdmin();
        } catch (e) {
            awmAlert(e.message || String(e));
        }
    }

    function bindOfficeMemberUserPicker() {
        if (officeMemberUserPicker || !window.awmUserPicker) return;
        const root = document.getElementById('office-member-user-picker');
        if (!root) return;
        officeMemberUserPicker = window.awmUserPicker.mount({
            root,
            minQueryLength: 1,
            emptyHint: 'Введите часть логина, имени или фамилии',
            notFoundText: 'Никого не найдено',
            formatUser: window.awmUserPicker.defaultFormatUser,
            fetchUsers: async (query) => {
                const qs = new URLSearchParams();
                if (query) qs.set('q', query);
                qs.set('limit', '40');
                if (currentOfficeMembersId) qs.set('office_id', String(currentOfficeMembersId));
                const data = await api('GET', `/api/offices/users/candidates?${qs.toString()}`);
                return Array.isArray(data) ? data : (data.users || []);
            },
        });
    }

    function clearOfficeMemberPicker() {
        bindOfficeMemberUserPicker();
        if (officeMemberUserPicker) officeMemberUserPicker.clear({ silent: true });
        else {
            const hid = document.getElementById('office-member-user-id');
            const q = document.getElementById('office-member-user-query');
            if (hid) hid.value = '';
            if (q) q.value = '';
        }
    }

    async function openOfficeMembersModal(officeId, officeName) {
        currentOfficeMembersId = officeId;
        document.getElementById('office-members-title').textContent = `Участники: ${officeName}`;
        document.getElementById('office-members-modal').classList.add('active');
        bindOfficeMemberUserPicker();
        clearOfficeMemberPicker();
        await refreshOfficeMembers();
    }

    function closeOfficeMembersModal() {
        const modal = document.getElementById('office-members-modal');
        if (modal) modal.classList.remove('active');
        currentOfficeMembersId = null;
        clearOfficeMemberPicker();
    }

    async function refreshOfficeMembers() {
        const listEl = document.getElementById('office-members-list');
        if (!listEl || !currentOfficeMembersId) return;
        try {
            const data = await api('GET', `/api/offices/${currentOfficeMembersId}/members`);
            const members = data.members || [];
            if (!members.length) {
                listEl.innerHTML = '<div class="admin-subtitle">Пока никого нет.</div>';
                return;
            }
            listEl.innerHTML = members.map((member) => {
                const login = String(member.username || '').trim();
                const fio = [member.last_name, member.first_name]
                    .map((part) => String(part || '').trim())
                    .filter(Boolean)
                    .join(' ');
                const person = fio || String(member.full_name || '').trim();
                const label = person && person !== login ? `${login} — ${person}` : (login || person);
                const adminMark = member.is_office_admin
                    ? ' <span class="user-role-chip">Администратор подразделения</span>'
                    : '';
                return `
                <div style="display:flex; justify-content:space-between; gap:8px; padding:8px 0; border-bottom:1px solid var(--border);">
                    <span>${escapeHtml(label)}${adminMark}</span>
                    <button type="button" class="btn btn-secondary btn-sm" onclick="removeOfficeMember(${Number(member.user_id)})">Исключить</button>
                </div>
            `;
            }).join('');
        } catch (e) {
            listEl.innerHTML = `<div class="admin-subtitle">${escapeHtml(e.message || String(e))}</div>`;
        }
    }

    async function addOfficeMember() {
        bindOfficeMemberUserPicker();
        const userId = Number(
            (officeMemberUserPicker && officeMemberUserPicker.getValue())
            || document.getElementById('office-member-user-id').value
        );
        if (!currentOfficeMembersId || !userId) {
            awmAlert('Выберите пользователя из списка поиска');
            return;
        }
        try {
            await api('POST', `/api/offices/${currentOfficeMembersId}/members`, {user_id: userId});
            clearOfficeMemberPicker();
            await refreshOfficeMembers();
        } catch (e) {
            awmAlert(e.message || String(e));
        }
    }

    async function removeOfficeMember(userId) {
        if (!currentOfficeMembersId) return;
        try {
            await api('DELETE', `/api/offices/${currentOfficeMembersId}/members/${userId}`);
            await refreshOfficeMembers();
        } catch (e) {
            awmAlert(e.message || String(e));
        }
    }

    function bindOfficeAdminUserPicker() {
        if (officeAdminUserPicker || !window.awmUserPicker) return;
        const root = document.getElementById('office-admin-user-picker');
        if (!root) return;
        officeAdminUserPicker = window.awmUserPicker.mount({
            root,
            minQueryLength: 1,
            emptyHint: 'Введите часть логина, имени или фамилии',
            notFoundText: 'Никого не найдено',
            formatUser: window.awmUserPicker.defaultFormatUser,
            fetchUsers: async (query) => {
                const qs = new URLSearchParams();
                if (query) qs.set('q', query);
                qs.set('limit', '40');
                const data = await api('GET', `/api/offices/users/candidates?${qs.toString()}`);
                return Array.isArray(data) ? data : (data.users || []);
            },
        });
    }

    function clearOfficeAdminPicker() {
        bindOfficeAdminUserPicker();
        if (officeAdminUserPicker) officeAdminUserPicker.clear({ silent: true });
        else {
            const hid = document.getElementById('office-admin-user-id');
            const q = document.getElementById('office-admin-user-query');
            if (hid) hid.value = '';
            if (q) q.value = '';
        }
    }

    function openOfficeAdminAssignModal(officeId, officeNameEncoded) {
        currentOfficeAdminAssignId = officeId;
        let officeName = '';
        try {
            officeName = decodeURIComponent(officeNameEncoded || '');
        } catch (e) {
            officeName = String(officeNameEncoded || '');
        }
        document.getElementById('office-admin-assign-title').textContent = officeName
            ? `Назначить администратора: ${officeName}`
            : 'Назначить администратора';
        document.getElementById('office-admin-assign-modal').classList.add('active');
        bindOfficeAdminUserPicker();
        clearOfficeAdminPicker();
    }

    function closeOfficeAdminAssignModal() {
        const modal = document.getElementById('office-admin-assign-modal');
        if (modal) modal.classList.remove('active');
        currentOfficeAdminAssignId = null;
        clearOfficeAdminPicker();
    }

    async function submitOfficeAdminAssign() {
        bindOfficeAdminUserPicker();
        const userId = Number(
            (officeAdminUserPicker && officeAdminUserPicker.getValue())
            || document.getElementById('office-admin-user-id').value
        );
        if (!currentOfficeAdminAssignId || !userId) {
            awmAlert('Выберите пользователя из списка поиска');
            return;
        }
        try {
            await api('POST', `/api/offices/${currentOfficeAdminAssignId}/admins`, {user_id: userId});
            closeOfficeAdminAssignModal();
            awmAlert('Администратор подразделения назначен.');
        } catch (e) {
            awmAlert(e.message || String(e));
        }
    }

    let ssoAdminContext = {};
    let ssoOfficeMapRows = [];
    let ssoSuggestedRedirect = { shared: '', office: '' };

    function ssoOfficeOptionsHtml(selectedSlug) {
        const offices = Array.isArray(ssoAdminContext.offices) ? ssoAdminContext.offices : [];
        const source = offices.filter((item) => item && item.is_active !== false);
        const list = source.length ? source : offices;
        const selected = String(selectedSlug || '');
        const opts = ['<option value="">—</option>'].concat(list.map((item) => {
            const slug = String(item.slug || '');
            const name = String(item.name || slug);
            const mark = item.is_primary ? ' (основное)' : '';
            const sel = slug && slug === selected ? ' selected' : '';
            return `<option value="${escapeHtml(slug)}"${sel}>${escapeHtml(name + mark)}</option>`;
        }));
        return opts.join('');
    }

    function ssoOfficesForMap() {
        const offices = Array.isArray(ssoAdminContext.offices) ? ssoAdminContext.offices : [];
        const active = offices.filter((item) => item && item.is_active !== false);
        return active.length ? active : offices;
    }

    function splitSsoMatchValues(raw) {
        return String(raw || '')
            .split(/[,;\n]+/)
            .map((item) => item.trim())
            .filter(Boolean);
    }

    function ssoMatchesGroupedBySlug(rows) {
        const grouped = {};
        (Array.isArray(rows) ? rows : []).forEach((row) => {
            const slug = String((row && row.office_slug) || '').trim();
            const match = String((row && row.match) || '').trim();
            if (!slug || !match) return;
            if (!grouped[slug]) grouped[slug] = [];
            if (grouped[slug].indexOf(match) < 0) grouped[slug].push(match);
        });
        return grouped;
    }

    function renderSsoOfficeMapRows() {
        const host = document.getElementById('sso-office-map-rows');
        const head = document.getElementById('sso-office-map-head');
        if (!host) return;
        const offices = ssoOfficesForMap();
        const grouped = ssoMatchesGroupedBySlug(ssoOfficeMapRows);
        if (!offices.length) {
            if (head) head.style.display = 'none';
            host.innerHTML = '<div class="admin-subtitle" style="grid-column:1/-1;">Сначала создайте подразделения — тогда здесь появится таблица соответствий.</div>';
            return;
        }
        if (head) head.style.display = '';
        host.innerHTML = offices.map((item) => {
            const slug = String(item.slug || '');
            const name = String(item.name || slug);
            const mark = item.is_primary ? ' (основное)' : '';
            const values = (grouped[slug] || []).join(', ');
            return `
                <div class="mapping-field-label">${escapeHtml(name + mark)}</div>
                <div data-sso-map-slug="${escapeHtml(slug)}">
                    <input type="text" class="form-control sso-office-map-match" value="${escapeHtml(values)}" placeholder="Например: Столица, MSK" title="Значения атрибута SSO для подразделения «${escapeHtml(name)}». Несколько вариантов через запятую.">
                </div>
            `;
        }).join('');
    }

    function collectSsoOfficeMapRows() {
        const host = document.getElementById('sso-office-map-rows');
        if (!host) return ssoOfficeMapRows.slice();
        const rows = [];
        host.querySelectorAll('[data-sso-map-slug]').forEach((wrap) => {
            const slug = String(wrap.getAttribute('data-sso-map-slug') || '').trim();
            const raw = String((wrap.querySelector('.sso-office-map-match') || {}).value || '');
            splitSsoMatchValues(raw).forEach((match) => {
                rows.push({ match, office_slug: slug });
            });
        });
        ssoOfficeMapRows = rows;
        return rows;
    }

    function syncSsoOfficeAssignUi() {
        const modeEl = document.getElementById('sso-office-assign-mode');
        const mode = modeEl ? modeEl.value : 'login_select';
        const claim = mode === 'claim';
        ['sso-office-claim-wrap', 'sso-office-unmatched-row', 'sso-office-replace-wrap', 'sso-office-map-wrap', 'sso-office-preview-row'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = claim ? '' : 'none';
        });
        const resultEl = document.getElementById('sso-office-preview-result');
        if (resultEl && !claim) resultEl.textContent = '';
        const hint = document.getElementById('sso-office-assign-mode-hint');
        if (hint) {
            hint.textContent = claim
                ? 'Заполните таблицу: какое значение из SSO соответствует каждому подразделению AWM.'
                : 'Пользователь сначала выбирает подразделение, затем нажимает SSO.';
        }
    }

    function applySsoAdminContext(data) {
        ssoAdminContext = (data && data.context) || {};
        const canShared = Boolean(data && data.can_edit_shared);
        const canAssign = Boolean(data && data.can_edit_assign);
        const isMulti = Boolean(ssoAdminContext.is_multi);
        const isPrimary = Boolean(ssoAdminContext.is_primary);
        const name = String(ssoAdminContext.office_name || '').trim() || 'текущее';
        const slug = String(ssoAdminContext.office_slug || '');
        const banner = document.getElementById('sso-context-banner');
        if (banner) {
            if (!isMulti) {
                banner.textContent = 'Вход через внешний SSO-провайдер. После включения на странице входа отображается кнопка SSO.';
            } else if (isPrimary) {
                banner.textContent = `Сейчас вы в основном подразделении «${name}». Здесь задаются общие параметры SSO для всей установки.`;
            } else {
                banner.textContent = `Сейчас вы в подразделении «${name}» (код ${slug || '—'}). Пустые поля берутся из общих настроек. Сохранение «только текущее» делает отдельный клиент для этого филиала.`;
            }
        }
        const howto = document.getElementById('sso-office-howto');
        if (howto) {
            if (!isMulti) {
                howto.textContent = 'Redirect URI в AWM и Valid Redirect URIs в Keycloak должны совпадать.';
            } else {
                const sharedUri = ssoAdminContext.suggested_redirect_uri_shared || '/api/auth/sso/callback';
                const officeUri = ssoAdminContext.suggested_redirect_uri_office || sharedUri;
                howto.innerHTML = isPrimary
                    ? `Для общей настройки в Keycloak укажите Valid Redirect URI: <code>${escapeHtml(sharedUri)}</code>.`
                    : `Для своего клиента этого филиала в Keycloak укажите: <code>${escapeHtml(officeUri)}</code>. Общий callback: <code>${escapeHtml(sharedUri)}</code>.`;
            }
        }
        ssoSuggestedRedirect = {
            shared: ssoAdminContext.suggested_redirect_uri_shared || '',
            office: ssoAdminContext.suggested_redirect_uri_office || '',
        };
        const hint = document.getElementById('sso-redirect-hint');
        if (hint && isMulti && !isPrimary) {
            hint.textContent = 'Для своего клиента филиала путь заканчивается кодом подразделения: /api/auth/sso/callback/' + (slug || 'код') + '. Для общего клиента — без кода.';
        } else if (hint) {
            hint.textContent = 'Полный callback URL. Должен совпадать с Valid Redirect URIs в Keycloak.';
        }
        const scopeRow = document.getElementById('sso-save-scope-row');
        if (scopeRow) scopeRow.style.display = isMulti ? '' : 'none';
        const scopeEl = document.getElementById('sso-save-scope');
        if (scopeEl) {
            scopeEl.value = data.save_scope_default === 'office' ? 'office' : 'shared';
            const sharedOpt = scopeEl.querySelector('option[value="shared"]');
            if (sharedOpt) sharedOpt.disabled = !canShared;
            if (!canShared) scopeEl.value = 'office';
        }
        const resetWrap = document.getElementById('sso-reset-override-wrap');
        if (resetWrap) {
            resetWrap.style.display = (isMulti && ssoAdminContext.has_override) ? '' : 'none';
        }
        const assignSection = document.getElementById('sso-assign-section');
        if (assignSection) assignSection.style.display = isMulti ? '' : 'none';
        const assignFields = document.getElementById('sso-assign-fields');
        const locked = document.getElementById('sso-assign-locked-note');
        if (assignFields) assignFields.style.display = canAssign ? '' : 'none';
        if (locked) locked.style.display = (!canAssign && isMulti) ? '' : 'none';
        const previewResult = document.getElementById('sso-office-preview-result');
        if (previewResult) previewResult.textContent = '';
        const defSel = document.getElementById('sso-office-default-slug');
        if (defSel) {
            defSel.innerHTML = ssoOfficeOptionsHtml(data.office_assign_default_slug || '');
        }
        const modeEl = document.getElementById('sso-office-assign-mode');
        if (modeEl) modeEl.value = data.office_assign_mode === 'claim' ? 'claim' : 'login_select';
        const claimEl = document.getElementById('sso-office-claim');
        if (claimEl) claimEl.value = data.office_claim || 'department';
        const unmatchedEl = document.getElementById('sso-office-unmatched');
        if (unmatchedEl) unmatchedEl.value = data.office_assign_unmatched === 'deny' ? 'deny' : 'default';
        const replaceEl = document.getElementById('sso-office-assign-replace');
        if (replaceEl) replaceEl.checked = Boolean(data.office_assign_replace);
        ssoOfficeMapRows = Array.isArray(data.office_claim_map) ? data.office_claim_map.slice() : [];
        renderSsoOfficeMapRows();
        syncSsoOfficeAssignUi();
    }

    function collectSsoOfficeAssignPayload() {
        return {
            office_assign_mode: (document.getElementById('sso-office-assign-mode') || {}).value || 'login_select',
            office_claim: (document.getElementById('sso-office-claim') || {}).value || '',
            office_claim_map: collectSsoOfficeMapRows(),
            office_assign_unmatched: (document.getElementById('sso-office-unmatched') || {}).value || 'default',
            office_assign_default_slug: (document.getElementById('sso-office-default-slug') || {}).value || '',
            office_assign_replace: Boolean((document.getElementById('sso-office-assign-replace') || {}).checked),
        };
    }

    function ssoMatchedByLabel(code) {
        const key = String(code || '');
        if (key === 'map') return 'по таблице соответствий';
        if (key === 'slug') return 'совпало с кодом подразделения';
        if (key === 'name') return 'совпало с названием подразделения';
        if (key === 'default') return 'запасное подразделение';
        return key || '—';
    }

    async function previewSsoOfficeAssign() {
        const resultEl = document.getElementById('sso-office-preview-result');
        const value = String((document.getElementById('sso-office-preview-value') || {}).value || '').trim();
        if (!resultEl) return;
        if (!value) {
            resultEl.textContent = 'Укажите значение claim, как оно приходит из SSO.';
            return;
        }
        resultEl.textContent = 'Проверка…';
        try {
            const payload = collectSsoOfficeAssignPayload();
            payload.claim_value = value;
            const data = await api('POST', '/api/admin/sso-settings/preview-office-assign', payload);
            if (data.denied) {
                resultEl.textContent = `Значение «${value}» нет в таблице — вход будет запрещён.`;
                return;
            }
            const office = data.office || {};
            const name = String(office.name || office.slug || '').trim();
            if (!name) {
                resultEl.textContent = 'В этом режиме подразделение назначается на странице входа, а не по SSO.';
                return;
            }
            const via = ssoMatchedByLabel(data.matched_by);
            resultEl.textContent = `Попадёт в «${name}» (${via}).`;
        } catch (e) {
            resultEl.textContent = e.message || String(e);
        }
    }

    function applySuggestedSsoRedirectUri() {
        const scopeEl = document.getElementById('sso-save-scope');
        const scope = scopeEl ? scopeEl.value : 'shared';
        const uri = (scope === 'office' ? ssoSuggestedRedirect.office : ssoSuggestedRedirect.shared)
            || ssoAdminContext.suggested_redirect_uri
            || '';
        const input = document.getElementById('sso-redirect-uri');
        if (input && uri) input.value = uri;
    }

    async function resetSsoOfficeOverride() {
        const statusEl = document.getElementById('sso-status');
        if (!await awmConfirm('Вернуть общие настройки SSO для этого подразделения? Свои Issuer/Client филиала будут удалены.')) {
            return;
        }
        statusEl.textContent = 'Сброс…';
        try {
            await api('POST', '/api/admin/sso-settings/reset-office-override', {});
            statusEl.innerHTML = '<span style="color:#166534; font-weight:600;">Снова действуют общие настройки SSO.</span>';
            await loadSsoSettings();
        } catch (e) {
            statusEl.innerHTML = `<span style="color:#b91c1c; font-weight:600;">Ошибка сброса: ${escapeHtml(e.message || String(e))}</span>`;
        }
    }

    async function loadSsoSettings() {
        const statusEl = document.getElementById('sso-status');
        try {
            const data = await api('GET', '/api/admin/sso-settings');
            document.getElementById('sso-enabled').checked = Boolean(data.enabled);
            document.getElementById('sso-button-text').value = data.button_text || 'Войти с помощью SSO';
            document.getElementById('sso-issuer-url').value = data.issuer_url || '';
            document.getElementById('sso-client-id').value = data.client_id || '';
            document.getElementById('sso-client-secret').value = '';
            document.getElementById('sso-redirect-uri').value = data.redirect_uri || '';
            document.getElementById('sso-scopes').value = data.scopes || 'openid profile email';
            const incoming = data.field_mapping && typeof data.field_mapping === 'object'
                ? data.field_mapping
                : {
                    username: data.username_claim || 'preferred_username',
                    email: data.email_claim || 'email',
                    full_name: data.full_name_claim || 'name',
                };
            ssoFieldMapping = normalizeSsoFieldMapping(incoming, !Object.keys(incoming || {}).length);
            renderSsoMappingSummary();
            renderSsoDefaultRoleOptions(data.default_role || 'operator');
            document.getElementById('sso-auto-create-users').checked = data.auto_create_users !== false;
            document.getElementById('sso-sync-enabled').checked = Boolean(data.sync_enabled);
            document.getElementById('sso-sync-interval').value = String(data.sync_interval_minutes || 60);
            document.getElementById('sso-admin-client-id').value = data.admin_client_id || '';
            document.getElementById('sso-admin-client-secret').value = '';
            applySsoAdminContext(data);
            renderSsoSyncStatusLine(data);
            syncSsoRedirectUriRequired();
            statusEl.textContent = '';
        } catch (e) {
            if (handleAdminLicenseError(e, statusEl)) {
                return;
            }
            statusEl.innerHTML = `<span style="color:#b91c1c; font-weight:600;">Ошибка загрузки SSO: ${escapeHtml(e.message || String(e))}</span>`;
        }
    }

    let lastSsoSyncReport = null;

    function parseSsoSyncReport(raw) {
        if (!raw) return null;
        if (typeof raw === 'object') return raw;
        const text = String(raw || '').trim();
        if (!text) return null;
        try {
            return JSON.parse(text);
        } catch (_) {
            return null;
        }
    }

    function ssoSyncStatusLabel(status) {
        const key = String(status || '').trim().toLowerCase();
        if (key === 'ok') return 'Успешно';
        if (key === 'error') return 'Ошибка';
        if (key === 'running') return 'Выполняется';
        return status || '—';
    }

    function renderSsoSyncStatusLine(data) {
        const el = document.getElementById('sso-sync-status-line');
        const msgEl = document.getElementById('sso-sync-message-line');
        const detailsBtn = document.getElementById('sso-sync-details-btn');
        if (!el) return;
        const runAt = String((data && data.sync_last_run_at) || '').trim();
        const status = String((data && data.sync_last_status) || '').trim();
        const error = String((data && data.sync_last_error) || '').trim();
        const message = String((data && data.sync_last_message) || '').trim();
        lastSsoSyncReport = parseSsoSyncReport(data && data.sync_last_report);
        if (!runAt && !status && !message) {
            el.textContent = 'Статус синхронизации: ещё не запускалась';
            if (msgEl) msgEl.textContent = '';
            if (detailsBtn) detailsBtn.style.display = 'none';
            return;
        }
        el.textContent = `Статус синхронизации: ${ssoSyncStatusLabel(status)} · ${runAt || '—'}`;
        if (msgEl) {
            msgEl.textContent = message || (error ? `Ошибка: ${error}` : '');
        }
        if (detailsBtn) {
            const hasDetails = Boolean(lastSsoSyncReport) || Boolean(message) || Boolean(error);
            detailsBtn.style.display = hasDetails ? '' : 'none';
        }
    }

    function openSsoSyncReportModal() {
        const modal = document.getElementById('sso-sync-report-modal');
        const summaryEl = document.getElementById('sso-sync-report-summary');
        const bodyEl = document.getElementById('sso-sync-report-body');
        if (!modal || !summaryEl || !bodyEl) return;
        const report = lastSsoSyncReport || {};
        const stats = (report && report.stats) || {};
        const events = Array.isArray(report && report.events) ? report.events : [];
        const message = document.getElementById('sso-sync-message-line');
        summaryEl.textContent = (message && message.textContent) || 'Нет краткого сообщения о синхронизации.';
        const statBits = [
            `В IdP: ${stats.idp_users || 0}`,
            `создано: ${stats.created || 0}`,
            `профилей: ${stats.updated || 0}`,
            `статус: ${stats.status_changed || 0}`,
            `отключено: ${stats.disabled || 0}`,
            `включено: ${stats.enabled || 0}`,
            `без изменений: ${stats.unchanged || 0}`,
        ];
        let html = `<p class="admin-subtitle" style="margin:0 0 12px;">${escapeHtml(statBits.join(' · '))}</p>`;
        if (report && report.error) {
            html += `<p style="color:var(--danger); margin:0 0 12px;">${escapeHtml(String(report.error))}</p>`;
        }
        if (!events.length) {
            html += '<p class="admin-subtitle">Нет подробных событий по пользователям (всё без изменений или отчёт пуст).</p>';
        } else {
            html += '<table class="data-table" style="width:100%;"><thead><tr><th>Пользователь</th><th>Действие</th><th>Детали</th></tr></thead><tbody>';
            events.forEach((ev) => {
                const label = (ev && (ev.action_label || ev.action)) || '—';
                html += `<tr><td>${escapeHtml(String((ev && ev.username) || ''))}</td>`
                    + `<td>${escapeHtml(String(label))}</td>`
                    + `<td>${escapeHtml(String((ev && ev.detail) || ''))}</td></tr>`;
            });
            html += '</tbody></table>';
            if (report.events_truncated) {
                html += '<p class="admin-subtitle" style="margin-top:10px;">Список событий обрезан по лимиту.</p>';
            }
        }
        bodyEl.innerHTML = html;
        modal.classList.add('active');
    }

    function closeSsoSyncReportModal() {
        const modal = document.getElementById('sso-sync-report-modal');
        if (modal) modal.classList.remove('active');
    }

    async function runSsoSyncNow() {
        const statusEl = document.getElementById('sso-status');
        statusEl.textContent = 'Запуск синхронизации…';
        try {
            const result = await api('POST', '/api/admin/sso-settings/sync-now', {});
            const ok = result.result && result.result.ok;
            const msg = (result.result && (result.result.message || result.result.error)) || '';
            statusEl.innerHTML = ok
                ? `<span style="color:#166534; font-weight:600;">Синхронизация выполнена. ${escapeHtml(msg)}</span>`
                : `<span style="color:#b91c1c; font-weight:600;">Синхронизация завершилась с ошибкой. ${escapeHtml(msg)}</span>`;
            await loadSsoSettings();
        } catch (e) {
            statusEl.innerHTML = `<span style="color:#b91c1c; font-weight:600;">Ошибка синхронизации: ${escapeHtml(e.message || String(e))}</span>`;
        }
    }

    function syncSsoRedirectUriRequired() {
        const enabled = document.getElementById('sso-enabled').checked;
        const input = document.getElementById('sso-redirect-uri');
        if (input) {
            input.required = enabled;
        }
    }

    function isValidSsoRedirectUri(value) {
        const uri = String(value || '').trim();
        if (!uri) return false;
        try {
            const parsed = new URL(uri);
            return (parsed.protocol === 'http:' || parsed.protocol === 'https:') && Boolean(parsed.hostname);
        } catch (_) {
            return false;
        }
    }

    async function saveSsoSettings() {
        const statusEl = document.getElementById('sso-status');
        statusEl.textContent = 'Сохранение...';
        try {
            const ssoEnabled = document.getElementById('sso-enabled').checked;
            const redirectUri = document.getElementById('sso-redirect-uri').value.trim();
            if (ssoEnabled && !isValidSsoRedirectUri(redirectUri)) {
                throw new Error('Укажите Redirect URI — полный URL callback (http/https), совпадающий с настройками Keycloak.');
            }
            const mapping = normalizeSsoFieldMapping(ssoFieldMapping, false);
            if (!mapping.username) {
                throw new Error('В сопоставлении полей укажите claim для логина.');
            }
            const payload = {
                enabled: ssoEnabled,
                button_text: document.getElementById('sso-button-text').value.trim() || 'Войти с помощью SSO',
                issuer_url: document.getElementById('sso-issuer-url').value.trim(),
                client_id: document.getElementById('sso-client-id').value.trim(),
                client_secret: document.getElementById('sso-client-secret').value.trim(),
                redirect_uri: redirectUri,
                scopes: document.getElementById('sso-scopes').value.trim() || 'openid profile email',
                username_claim: mapping.username || 'preferred_username',
                email_claim: mapping.email || 'email',
                full_name_claim: mapping.full_name || 'name',
                field_mapping: mapping,
                default_role: document.getElementById('sso-default-role').value.trim() || 'operator',
                auto_create_users: document.getElementById('sso-auto-create-users').checked,
                sync_enabled: document.getElementById('sso-sync-enabled').checked,
                sync_interval_minutes: Number(document.getElementById('sso-sync-interval').value || 60),
                admin_client_id: document.getElementById('sso-admin-client-id').value.trim(),
                admin_client_secret: document.getElementById('sso-admin-client-secret').value.trim(),
                save_scope: (document.getElementById('sso-save-scope') || {}).value || 'shared',
                ...collectSsoOfficeAssignPayload(),
            };
            if (payload.office_assign_mode === 'claim' && !(payload.office_claim_map || []).length) {
                throw new Error('Заполните таблицу соответствий: укажите, как каждое подразделение AWM записано в SSO.');
            }
            await api('PUT', '/api/admin/sso-settings', payload);
            statusEl.innerHTML = '<span style="color:#166534; font-weight:600;">SSO настройки сохранены.</span>';
            document.getElementById('sso-client-secret').value = '';
            document.getElementById('sso-admin-client-secret').value = '';
            await loadSsoSettings();
            renderSsoMappingSummary();
        } catch (e) {
            statusEl.innerHTML = `<span style="color:#b91c1c; font-weight:600;">Ошибка сохранения SSO: ${escapeHtml(e.message || String(e))}</span>`;
        }
    }

    function renderSsoDefaultRoleOptions(selectedRole = 'operator') {
        const select = document.getElementById('sso-default-role');
        if (!select) return;
        const roleNames = (adminRoles || []).map((r) => String(r.name || '').trim()).filter(Boolean);
        const uniqueRoleNames = Array.from(new Set(roleNames)).filter((name) => {
            return isMultiOfficeMode() || name !== 'office_admin';
        });
        if (!uniqueRoleNames.length) {
            uniqueRoleNames.push('operator');
        }
        if (selectedRole && !uniqueRoleNames.includes(selectedRole)) {
            uniqueRoleNames.push(selectedRole);
        }
        select.innerHTML = uniqueRoleNames
            .map((name) => {
                const item = (adminRoles || []).find((r) => String(r.name || '').trim() === name);
                const title = String((item && item.title) || '').trim() || roleTitle(name);
                return `<option value="${escapeHtml(name)}">${escapeHtml(title)}</option>`;
            })
            .join('');
        select.value = selectedRole && uniqueRoleNames.includes(selectedRole) ? selectedRole : uniqueRoleNames[0];
    }

    async function addAllowedHostPrompt() {
        const hostPattern = await awmPrompt('Маска/хост (пример: 10.10.* или web-01.example.com):');
        if (!hostPattern) return;
        const description = await awmPrompt('Описание (опционально):') || '';
        await api('POST', '/api/admin/allowed-hosts', { host_pattern: hostPattern, description });
        await loadAllowedHosts();
    }

    async function deleteAllowedHost(hostPattern) {
        if (!await awmConfirm(`Удалить ${hostPattern}?`)) return;
        await api('DELETE', `/api/admin/allowed-hosts/${encodeURIComponent(hostPattern)}`);
        await loadAllowedHosts();
    }

    const backupsPager = { limit: 50, offset: 0, total: 0 };

    async function loadBackups(resetPage) {
        const list = document.getElementById('backups-list');
        if (resetPage) backupsPager.offset = 0;
        let data;
        try {
            const query = window.awmPagination.buildQuery({
                limit: backupsPager.limit,
                offset: backupsPager.offset,
            });
            data = await api('GET', `/api/admin/backups${query}`);
        } catch (e) {
            if (handleAdminLicenseError(e, list, {
                onStat: () => setStat('stat-backups', 0),
                clearPager: 'backups-list-pager',
            })) {
                return;
            }
            if (String(e.message || '').includes('Not Found') || String(e.message || '').includes('HTTP 404')) {
                setStat('stat-backups', 0);
                list.innerHTML = '<div class="empty-state">Функция бэкапов недоступна в текущей версии backend</div>';
                return;
            }
            throw e;
        }
        const items = data.items || [];
        backupsPager.total = Number(data.total ?? items.length);
        setStat('stat-backups', backupsPager.total);
        if (!items.length) {
            list.innerHTML = '<div class="empty-state">Бэкапов отсутствуют</div>';
            return;
        }
        list.innerHTML = `
            <table class="data-table">
                <thead><tr><th>Дата</th><th>Имя</th><th>Состав</th><th>Цель</th><th>Размер</th><th>Действия</th></tr></thead>
                <tbody>
                    ${items.map(b => `
                        <tr>
                            <td>${escapeHtml(new Date(b.created_at).toLocaleString('ru'))}</td>
                            <td>${escapeHtml(b.name)}</td>
                            <td>${escapeHtml(b.scope)}</td>
                            <td>${escapeHtml(b.target_type)} ${b.remote_url ? `<br><small>${escapeHtml(b.remote_url)}</small>` : ''}</td>
                            <td>${escapeHtml(((b.file_size || 0) / 1024 / 1024).toFixed(2))} MB</td>
                            <td style="display:flex; gap:6px; flex-wrap:wrap;">
                                <button class="btn btn-warning btn-sm" onclick="restoreBackup(${b.id})">Восстановить</button>
                                <button class="btn btn-danger btn-sm" onclick="deleteBackup(${b.id})">Удалить</button>
                            </td>
                        </tr>
                    `).join('')}
                </tbody>
            </table>
        `;
        let pagerHost = document.getElementById('backups-list-pager');
        if (!pagerHost) {
            pagerHost = document.createElement('div');
            pagerHost.id = 'backups-list-pager';
            pagerHost.className = 'awm-pagination-host';
            list.insertAdjacentElement('afterend', pagerHost);
        }
        if (window.awmPagination) {
            pagerHost.innerHTML = window.awmPagination.renderBarHtml({
                total: backupsPager.total,
                limit: backupsPager.limit,
                offset: backupsPager.offset,
                idPrefix: 'backups-list',
            });
            window.awmPagination.bindBar(pagerHost, backupsPager, (next) => {
                backupsPager.limit = next.limit;
                backupsPager.offset = next.offset;
                loadBackups(false);
            });
        }
    }

    async function loadBackupPlans() {
        const list = document.getElementById('backup-plans-list');
        let data;
        try {
            data = await api('GET', '/api/admin/backup-plans');
        } catch (e) {
            if (handleAdminLicenseError(e, list)) {
                return;
            }
            if (String(e.message || '').includes('Not Found') || String(e.message || '').includes('HTTP 404')) {
                list.innerHTML = '<div class="empty-state">Планы бэкапов недоступны в текущей версии backend</div>';
                return;
            }
            throw e;
        }
        backupPlans = data.items || [];
        if (!backupPlans.length) {
            list.innerHTML = '<div class="empty-state">Планы бэкапа не настроены</div>';
            return;
        }
        list.innerHTML = backupPlans.map(p => `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">${escapeHtml(p.name)} <span class="admin-badge ${p.is_active ? 'ok' : 'off'}">${p.is_active ? 'Активен' : 'Отключен'}</span></div>
                    <div class="list-item-meta">
                        <span>Режим: ${escapeHtml(p.schedule_mode)}</span>
                        <span>Состав: ${escapeHtml(p.scope)}</span>
                        <span>Цель: ${escapeHtml(p.target_type)}</span>
                        <span>Локальная директория: ${escapeHtml(p.local_directory || '/opt/AWM/backups')}</span>
                        <span>Хранение: count=${escapeHtml(p.retention_max_count || '-')} / days=${escapeHtml(p.retention_max_age_days || '-')} / sizeMB=${escapeHtml(p.retention_max_size_mb || '-')}</span>
                        <span>Следующий запуск: ${escapeHtml(p.next_run_at || '-')}</span>
                        <span>Ошибка: ${escapeHtml(p.last_error || '-')}</span>
                    </div>
                </div>
                <div class="list-item-actions">
                    <button class="btn btn-secondary btn-sm" onclick="toggleBackupPlan(${p.id}, ${p.is_active ? 'false' : 'true'})">${p.is_active ? 'Отключить' : 'Включить'}</button>
                    <button class="btn btn-danger btn-sm" onclick="deleteBackupPlan(${p.id})">Удалить</button>
                </div>
            </div>
        `).join('');
    }

    async function loadIntegrations() {
        const list = document.getElementById('integrations-list');
        let data;
        try {
            data = await api('GET', '/api/admin/integrations');
        } catch (e) {
            if (handleAdminLicenseError(e, list, {
                onStat: () => setStat('stat-integrations', 0),
            })) {
                return;
            }
            if (String(e.message || '').includes('Not Found') || String(e.message || '').includes('HTTP 404')) {
                setStat('stat-integrations', 0);
                list.innerHTML = '<div class="empty-state">Интеграции недоступны: серверная часть не обновлена до версии с этим API</div>';
                return;
            }
            throw e;
        }
        integrationsItems = data.items || [];
        setStat('stat-integrations', integrationsItems.length);
        if (!integrationsItems.length) {
            list.innerHTML = '<div class="empty-state">Интеграции не настроены</div>';
            return;
        }
        list.innerHTML = integrationsItems.map((i) => `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">${escapeHtml(i.name)} <span class="admin-badge ${i.is_enabled ? 'ok' : 'off'}">${i.is_enabled ? 'Активна' : 'Отключена'}</span></div>
                    <div class="list-item-meta">
                        <span>Тип: ${escapeHtml(i.integration_type)}</span>
                        <span>События: ${escapeHtml((i.events || []).join(', ') || 'все')}</span>
                        <span>Последняя ошибка: ${escapeHtml(i.last_error || '-')}</span>
                        <span>Последняя отправка: ${escapeHtml(i.last_sent_at || '-')}</span>
                    </div>
                </div>
                <div class="list-item-actions">
                    <button class="btn btn-info btn-sm" onclick="testIntegration(${i.id})">Тест</button>
                    <button class="btn btn-secondary btn-sm" onclick="editIntegration(${i.id})">Ред.</button>
                    <button class="btn btn-danger btn-sm" onclick="deleteIntegration(${i.id})">Удалить</button>
                </div>
            </div>
        `).join('');
    }

    function openIntegrationModal(item = null) {
        document.getElementById('integration-form').reset();
        document.getElementById('integration-id').value = item ? String(item.id) : '';
        document.getElementById('integration-modal-title').textContent = item ? `Интеграция: ${item.name}` : 'Новая интеграция';
        document.getElementById('integration-name').value = item?.name || '';
        document.getElementById('integration-type').value = item?.integration_type || 'webhook';
        const selectedEvents = new Set(item?.events || []);
        document.querySelectorAll('.integration-event-checkbox').forEach((el) => {
            el.checked = selectedEvents.size ? selectedEvents.has(el.value) : (el.value === 'run_started' || el.value === 'run_finished_success' || el.value === 'run_finished_failed');
        });
        document.getElementById('integration-enabled').checked = Boolean(item ? item.is_enabled : true);
        document.getElementById('integration-webhook-url').value = item?.webhook_url || '';
        document.getElementById('integration-token').value = item?.token || '';
        document.getElementById('integration-max-token').value = item?.token || '';
        document.getElementById('integration-max-chat-id').value = item?.chat_id || '';
        document.getElementById('integration-max-api-url').value = item?.webhook_url || '';
        document.getElementById('integration-telegram-token').value = item?.token || '';
        document.getElementById('integration-chat-id').value = item?.chat_id || '';
        document.getElementById('integration-telegram-proxy').value = item?.proxy_url || item?.headers?.proxy_url || '';
        document.getElementById('integration-matrix-url').value = item?.webhook_url || '';
        document.getElementById('integration-matrix-token').value = item?.token || '';
        document.getElementById('integration-matrix-room-id').value = item?.matrix_room_id || '';
        document.getElementById('integration-snmp-version').value = item?.snmp_version || item?.snmp?.version || '2c';
        document.getElementById('integration-snmp-port').value = item?.snmp_port || item?.snmp?.port || 162;
        document.getElementById('integration-snmp-host').value = item?.snmp_host || item?.snmp?.host || '';
        document.getElementById('integration-snmp-community').value = item?.snmp_community || item?.snmp?.community || 'public';
        document.getElementById('integration-snmp-trap-oid').value = item?.snmp_trap_oid || item?.snmp?.trap_oid || '1.3.6.1.4.1.58119.1.1';
        document.getElementById('integration-snmp-v3-user').value = item?.snmp_v3_user || item?.snmp?.v3_user || '';
        document.getElementById('integration-snmp-v3-security-level').value = item?.snmp_v3_security_level || item?.snmp?.v3_security_level || 'authPriv';
        document.getElementById('integration-snmp-v3-auth-protocol').value = item?.snmp_v3_auth_protocol || item?.snmp?.v3_auth_protocol || 'SHA';
        document.getElementById('integration-snmp-v3-auth-key').value = item?.snmp_v3_auth_key || item?.snmp?.v3_auth_key || '';
        document.getElementById('integration-snmp-v3-priv-protocol').value = item?.snmp_v3_priv_protocol || item?.snmp?.v3_priv_protocol || 'AES';
        document.getElementById('integration-snmp-v3-priv-key').value = item?.snmp_v3_priv_key || item?.snmp?.v3_priv_key || '';
        document.getElementById('integration-prometheus-url').value = item?.webhook_url || '';
        toggleIntegrationFields();
        toggleSnmpVersionFields();
        document.getElementById('integration-modal').classList.add('active');
    }

    function closeIntegrationModal() {
        document.getElementById('integration-modal').classList.remove('active');
    }

    function openIntegrationsHelpModal() {
        document.getElementById('integrations-help-modal').classList.add('active');
    }

    function closeIntegrationsHelpModal() {
        document.getElementById('integrations-help-modal').classList.remove('active');
    }

    function toggleSnmpVersionFields() {
        const v = document.getElementById('integration-snmp-version')?.value || '2c';
        const v2 = document.getElementById('integration-snmp-v2c-fields');
        const v3 = document.getElementById('integration-snmp-v3-fields');
        if (v2) v2.style.display = v === '3' ? 'none' : '';
        if (v3) v3.style.display = v === '3' ? '' : 'none';
    }

    function toggleIntegrationFields() {
        const t = document.getElementById('integration-type').value;
        const show = (id, value) => { const el = document.getElementById(id); if (el) el.style.display = value ? '' : 'none'; };
        show('integration-webhook-fields', t === 'webhook' || t === 'grafana');
        show('integration-max-fields', t === 'max');
        show('integration-telegram-fields', t === 'telegram');
        show('integration-matrix-fields', t === 'matrix');
        show('integration-snmp-fields', t === 'snmp');
        show('integration-prometheus-fields', t === 'prometheus');
    }

    function editIntegration(integrationId) {
        const item = integrationsItems.find((x) => x.id === integrationId);
        if (!item) return;
        openIntegrationModal(item);
    }

    async function deleteIntegration(integrationId) {
        if (!await awmConfirm('Удалить интеграцию?')) return;
        await api('DELETE', `/api/admin/integrations/${integrationId}`);
        await loadIntegrations();
    }

    async function testIntegration(integrationId) {
        await api('POST', `/api/admin/integrations/${integrationId}/test`);
        alert('Тест отправлен');
        await loadIntegrations();
    }

    let adminApiTokensCache = [];
    let adminApiTokensUserOptionsFromTokens = [];
    let adminApiTokensUserPicker = null;

    function getAdminApiTokenStatusCode(item) {
        if (item && item.status) return String(item.status);
        if (item && item.revoked_at) return 'revoked';
        if (item && item.suspended_at) return 'suspended';
        return 'active';
    }

    function normalizeAdminApiTokenSearchQuery(raw) {
        let text = String(raw || '').trim().toLowerCase();
        if (text.startsWith('awm_pat_')) {
            text = text.slice('awm_pat_'.length);
        }
        return text;
    }

    function adminApiTokenSearchHaystack(item) {
        const prefix = String(item?.token_prefix || '').toLowerCase();
        const parts = [prefix, String(item?.id || '').toLowerCase()];
        if (prefix) {
            parts.push(`awm_pat_${prefix}`);
        }
        return parts.filter(Boolean).join(' ');
    }

    function filterAdminApiTokens(items) {
        const search = normalizeAdminApiTokenSearchQuery(
            document.getElementById('admin-api-tokens-search')?.value || ''
        );
        const status = (document.getElementById('admin-api-tokens-status-filter')?.value || '').trim();
        const schedule = (document.getElementById('admin-api-tokens-schedule-filter')?.value || '').trim();
        return (items || []).filter((item) => {
            if (status && getAdminApiTokenStatusCode(item) !== status) return false;
            if (schedule === 'enabled' && !item.schedule_enabled) return false;
            if (schedule === 'disabled' && item.schedule_enabled) return false;
            if (search) {
                const hay = adminApiTokenSearchHaystack(item);
                if (!hay.includes(search)) return false;
            }
            return true;
        });
    }

    function renderAdminApiTokensTable(items) {
        const list = document.getElementById('admin-api-tokens-list');
        const meta = document.getElementById('admin-api-tokens-filter-meta');
        if (!list) return;
        const total = (adminApiTokensCache || []).length;
        const shown = (items || []).length;
        if (meta) {
            meta.textContent = total
                ? `Показано: ${shown} из ${total}`
                : '';
        }
        if (!items.length) {
            list.innerHTML = `<div class="empty-state">${total ? 'Нет токенов по выбранным фильтрам' : 'Токенов нет'}</div>`;
            return;
        }
        list.innerHTML = `
            <div style="overflow-x:auto;">
            <table class="data-table">
                <thead>
                    <tr>
                        <th>Пользователь</th>
                        <th>Название</th>
                        <th>Префикс</th>
                        <th>Срок</th>
                        <th>Расписание</th>
                        <th>Последнее использование</th>
                        <th>Права</th>
                        <th>Статус</th>
                        <th></th>
                    </tr>
                </thead>
                <tbody>
                    ${items.map((item) => {
                        const revoked = !!item.revoked_at;
                        const suspended = !!item.suspended_at;
                        const status = item.status_label || (revoked ? 'Отозван' : (suspended ? 'Приостановлен' : 'Активен'));
                        const statusClass = (item.status === 'active') ? 'ok' : 'off';
                        const scopes = (item.permissions_view || []).map((p) =>
                            escapeHtml(p.title || p.name || '')
                        ).join(', ') || (item.permissions || []).map(escapeHtml).join(', ') || '—';
                        let schedule = 'Всегда';
                        if (item.schedule_enabled) {
                            const days = (item.schedule_days_labels || []).join(', ') || '—';
                            schedule = `${escapeHtml(days)} · ${escapeHtml(item.schedule_time_start || '—')}–${escapeHtml(item.schedule_time_end || '—')}`;
                        }
                        const tid = escapeHtml(item.id || '');
                        return `<tr>
                            <td>${escapeHtml(item.username || ('#' + (item.user_id || '')))}</td>
                            <td>${escapeHtml(item.name || '')}</td>
                            <td><code>awm_pat_${escapeHtml(item.token_prefix || '')}…</code></td>
                            <td>${item.expires_at ? escapeHtml(String(item.expires_at)) : 'Бессрочно'}</td>
                            <td>${schedule}</td>
                            <td>${item.last_used_at ? escapeHtml(String(item.last_used_at)) : '—'}</td>
                            <td style="max-width:280px;">${scopes}</td>
                            <td><span class="admin-badge ${statusClass}">${escapeHtml(status)}</span></td>
                            <td>
                                <div class="admin-api-token-actions" role="group" aria-label="Действия с токеном">
                                    ${(!revoked && !suspended) ? `<button type="button" class="ui-icon-btn" onclick="suspendAdminApiToken('${tid}')" title="Приостановить" aria-label="Приостановить"><span class="ui-icon" aria-hidden="true">⏸</span></button>` : ''}
                                    ${(!revoked && suspended) ? `<button type="button" class="ui-icon-btn" onclick="resumeAdminApiToken('${tid}')" title="Возобновить" aria-label="Возобновить"><span class="ui-icon" aria-hidden="true">▶</span></button>` : ''}
                                    ${!revoked ? `<button type="button" class="ui-icon-btn ui-icon-btn-danger" onclick="revokeAdminApiToken('${tid}')" title="Отозвать" aria-label="Отозвать"><span class="ui-icon" aria-hidden="true">🚫</span></button>` : ''}
                                    <button type="button" class="ui-icon-btn ui-icon-btn-danger" onclick="deleteAdminApiToken('${tid}')" title="Удалить" aria-label="Удалить"><span class="ui-icon" aria-hidden="true">🗑</span></button>
                                </div>
                            </td>
                        </tr>`;
                    }).join('')}
                </tbody>
            </table>
            </div>
        `;
    }

    function applyAdminApiTokensFilters() {
        renderAdminApiTokensTable(filterAdminApiTokens(adminApiTokensCache));
    }

    function filterLocalAdminApiTokensUsers(query) {
        const q = String(query || '').trim().toLowerCase();
        const source = adminApiTokensUserOptionsFromTokens || [];
        if (!q) return source.slice(0, 40);
        return source.filter((user) => {
            const hay = [
                user.username,
                user.full_name,
                user.first_name,
                user.last_name,
                user.email,
                user.id,
            ].map((v) => String(v || '').toLowerCase()).join(' ');
            return hay.includes(q);
        }).slice(0, 40);
    }

    function clearAdminApiTokensUserFilter() {
        if (adminApiTokensUserPicker) {
            adminApiTokensUserPicker.clear();
        } else {
            const filter = document.getElementById('admin-api-tokens-user-filter');
            const input = document.getElementById('admin-api-tokens-user-query');
            if (filter) filter.value = '';
            if (input) input.value = '';
            loadAdminApiTokens();
        }
    }

    function syncAdminApiTokensUserFilterFromItems(items) {
        const byId = new Map();
        (items || []).forEach((item) => {
            if (item.user_id == null) return;
            const id = String(item.user_id);
            if (!byId.has(id)) {
                byId.set(id, {
                    id,
                    username: item.username || ('#' + id),
                });
            }
        });
        adminApiTokensUserOptionsFromTokens = [...byId.values()]
            .sort((a, b) => String(a.username).localeCompare(String(b.username), 'ru'));
        const selectedId = (document.getElementById('admin-api-tokens-user-filter')?.value || '').trim();
        const input = document.getElementById('admin-api-tokens-user-query');
        if (selectedId && input && !String(input.value || '').trim()) {
            const match = adminApiTokensUserOptionsFromTokens.find((u) => String(u.id) === selectedId);
            if (adminApiTokensUserPicker) {
                adminApiTokensUserPicker.setValue(selectedId, match ? match.username : ('#' + selectedId), { silent: true });
            } else {
                input.value = match ? match.username : ('#' + selectedId);
            }
        }
    }

    function bindAdminApiTokensUserPicker() {
        if (adminApiTokensUserPicker || !window.awmUserPicker) return;
        const root = document.getElementById('admin-api-tokens-user-picker');
        if (!root) return;
        adminApiTokensUserPicker = window.awmUserPicker.mount({
            root,
            minQueryLength: 0,
            emptyHint: 'Начните ввод имени или логина',
            notFoundText: 'Никого не найдено',
            formatUser: window.awmUserPicker.defaultFormatUser,
            fetchUsers: async (query) => {
                if (!hasAdminAccess('users')) {
                    return filterLocalAdminApiTokensUsers(query);
                }
                try {
                    const qs = new URLSearchParams();
                    if (query) qs.set('q', query);
                    qs.set('limit', '40');
                    const data = await api('GET', `/api/admin/users?${qs.toString()}`);
                    return data.users || [];
                } catch (_e) {
                    return filterLocalAdminApiTokensUsers(query);
                }
            },
            onChange: () => {
                loadAdminApiTokens();
            },
        });
    }

    async function loadAdminApiTokens() {
        const list = document.getElementById('admin-api-tokens-list');
        if (!list) return;
        bindAdminApiTokensUserPicker();
        list.innerHTML = '<div class="loading">Загрузка...</div>';
        try {
            const userId = (document.getElementById('admin-api-tokens-user-filter')?.value || '').trim();
            const qs = new URLSearchParams();
            if (userId) qs.set('user_id', userId);
            qs.set('include_revoked', 'true');
            const data = await api('GET', `/api/admin/api-tokens?${qs.toString()}`);
            adminApiTokensCache = data.items || [];
            syncAdminApiTokensUserFilterFromItems(adminApiTokensCache);
            applyAdminApiTokensFilters();
        } catch (e) {
            adminApiTokensCache = [];
            list.innerHTML = `<div class="empty-state">Ошибка: ${escapeHtml(e.message || 'unknown')}</div>`;
            const meta = document.getElementById('admin-api-tokens-filter-meta');
            if (meta) meta.textContent = '';
        }
    }

    async function revokeAdminApiToken(tokenId) {
        const id = String(tokenId || '').trim();
        if (!id) return;
        if (!await awmConfirm('Отозвать этот API-токен пользователя?', 'Отзыв токена')) return;
        await api('POST', `/api/admin/api-tokens/${encodeURIComponent(id)}/revoke`);
        await loadAdminApiTokens();
    }

    async function suspendAdminApiToken(tokenId) {
        const id = String(tokenId || '').trim();
        if (!id) return;
        if (!await awmConfirm('Приостановить API-токен пользователя?', 'Пауза токена')) return;
        await api('POST', `/api/admin/api-tokens/${encodeURIComponent(id)}/suspend`);
        await loadAdminApiTokens();
    }

    async function resumeAdminApiToken(tokenId) {
        const id = String(tokenId || '').trim();
        if (!id) return;
        await api('POST', `/api/admin/api-tokens/${encodeURIComponent(id)}/resume`);
        await loadAdminApiTokens();
    }

    async function deleteAdminApiToken(tokenId) {
        const id = String(tokenId || '').trim();
        if (!id) return;
        if (!await awmConfirm('Удалить API-токен безвозвратно? Это нельзя отменить.', 'Удаление токена')) return;
        await api('DELETE', `/api/admin/api-tokens/${encodeURIComponent(id)}`);
        await loadAdminApiTokens();
    }

    async function loadPlugins() {
        const list = document.getElementById('plugins-list');
        try {
            const data = await api('GET', '/api/admin/plugins');
            pluginsItems = data.items || [];
        } catch (e) {
            if (handleAdminLicenseError(e, list)) {
                return;
            }
            if (String(e.message || '').includes('Not Found') || String(e.message || '').includes('HTTP 404')) {
                list.innerHTML = '<div class="empty-state">Модуль плагинов недоступен: серверная часть не обновлена.</div>';
                return;
            }
            throw e;
        }
        if (!pluginsItems.length) {
            list.innerHTML = '<div class="empty-state">Плагины не установлены</div>';
            return;
        }
        list.innerHTML = pluginsItems.map((p) => `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">${escapeHtml(p.name)} <span class="admin-badge ${p.is_enabled ? 'ok' : 'off'}">${p.is_enabled ? 'Включен' : 'Отключен'}</span></div>
                    <div class="list-item-meta">
                        <span>slug: ${escapeHtml(p.slug)}</span>
                        <span>uid: ${escapeHtml(p.plugin_uid || '-')}</span>
                        <span>версия: ${escapeHtml(p.version || '0.0.0')}</span>
                        <span>автор: ${escapeHtml(p.author || '-')}</span>
                        <span>entrypoint: ${escapeHtml(p.entrypoint || '-')}</span>
                    </div>
                </div>
                <div class="list-item-actions">
                    <button class="btn btn-secondary btn-sm" onclick="togglePlugin('${encodeURIComponent(p.slug)}', ${p.is_enabled ? 'false' : 'true'})">${p.is_enabled ? 'Отключить' : 'Включить'}</button>
                    <button class="btn btn-info btn-sm" onclick="viewPluginUpdates('${encodeURIComponent(p.slug)}')">История обновлений</button>
                    <button class="btn btn-info btn-sm" onclick="exportPlugin('${encodeURIComponent(p.slug)}')">Экспорт</button>
                    <button class="btn btn-warning btn-sm" onclick="clearPluginData('${encodeURIComponent(p.slug)}')">Очистить</button>
                    <button class="btn btn-danger btn-sm" onclick="dropAndDeletePlugin('${encodeURIComponent(p.slug)}')">Удалить с БД</button>
                    <button class="btn btn-danger btn-sm" onclick="deletePlugin('${encodeURIComponent(p.slug)}')">Удалить</button>
                </div>
            </div>
        `).join('');
    }

    async function importPlugin() {
        const input = document.getElementById('plugin-import-file');
        const file = input?.files?.[0];
        if (!file) {
            alert('Выберите ZIP архив плагина.');
            return;
        }
        const bytes = await file.arrayBuffer();
        const response = await fetch('/api/admin/plugins/import', {
            method: 'POST',
            headers: { 'Content-Type': 'application/octet-stream' },
            body: bytes,
        });
        const payload = await response.json().catch(() => ({}));
        if (!response.ok || !payload.ok) {
            throw new Error(payload.detail || payload.message || `HTTP ${response.status}`);
        }
        input.value = '';
        const mode = payload.mode || payload.plugin?.mode || 'install';
        const name = payload.plugin?.name || payload.name || '';
        alert(`Плагин ${name} обработан (${mode})`);
        await loadPlugins();
    }

    function closePluginUpdatePassportModal() {
        document.getElementById('plugin-update-passport-modal').classList.remove('active');
    }

    function openPluginUpdatePassportModal() {
        document.getElementById('plugin-update-passport-modal').classList.add('active');
    }

    function renderPluginUpdatePassport(precheckPayload, mode = 'precheck') {
        const content = document.getElementById('plugin-update-passport-content');
        const historyBox = document.getElementById('plugin-update-passport-history');
        const resultBox = document.getElementById('plugin-update-passport-result');
        const applyBtn = document.getElementById('plugin-update-passport-apply-btn');
        resultBox.innerHTML = '';
        historyBox.innerHTML = '';
        const result = precheckPayload.result || {};
        const manifest = precheckPayload.manifest || {};
        const risk = result.risk_flags || {};
        const policy = result.update_policy || {};
        const risks = [
            risk.destructive ? 'destructive' : '',
            risk.breaking_change ? 'breaking_change' : '',
            risk.major_bump ? 'major_bump' : '',
        ].filter(Boolean);
        const isUpdate = (result.mode || '') === 'update';
        const compatible = 'совместим (precheck OK)';
        content.innerHTML = `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">${escapeHtml(manifest.name || manifest.slug || '-')} <span class="admin-badge ${isUpdate ? 'warn' : 'ok'}">${escapeHtml(result.mode || '-')}</span></div>
                    <div class="list-item-meta">
                        <span>UID: ${escapeHtml(manifest.plugin_uid || '-')}</span>
                        <span>Slug: ${escapeHtml(manifest.slug || '-')}</span>
                        <span>Версия: ${escapeHtml((result.current_version || '-') + ' -> ' + (result.new_version || manifest.version || '-'))}</span>
                    </div>
                </div>
            </div>
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">Риск-профиль</div>
                    <div class="list-item-meta">
                        <span>Strategy: ${escapeHtml(policy.strategy || 'safe')}</span>
                        <span>Requires backup: ${(policy.requires_backup === false) ? 'нет' : 'да'}</span>
                        <span>Breaking change: ${policy.breaking_change ? 'да' : 'нет'}</span>
                        <span>Риски: ${escapeHtml(risks.join(', ') || 'нет')}</span>
                    </div>
                </div>
            </div>
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">Совместимость и заметки</div>
                    <div class="list-item-meta">
                        <span>AWM compatibility: ${escapeHtml(compatible)}</span>
                        <span>min/max: ${escapeHtml((manifest.min_awm_version || '-') + ' / ' + (manifest.max_awm_version || '-'))}</span>
                        <span>Upgrade notes: ${escapeHtml(policy.upgrade_notes || '-')}</span>
                    </div>
                </div>
            </div>
        `;
        if (!isUpdate || mode === 'precheck') {
            applyBtn.style.display = isUpdate ? '' : 'none';
            applyBtn.textContent = 'Подтвердить обновление';
        } else {
            applyBtn.style.display = '';
            applyBtn.textContent = 'Выполнить обновление';
        }
        loadPluginUpdatePassportHistory(String(manifest.slug || ''));
    }

    async function loadPluginUpdatePassportHistory(slug) {
        const historyBox = document.getElementById('plugin-update-passport-history');
        if (!slug) {
            historyBox.innerHTML = '';
            return;
        }
        try {
            const data = await api('GET', `/api/admin/plugins/${encodeURIComponent(slug)}/updates?limit=10`);
            const items = data.items || [];
            if (!items.length) {
                historyBox.innerHTML = '<div class="empty-state">История обновлений для этого плагина отсутствует</div>';
                return;
            }
            historyBox.innerHTML = `
                <h4 style="margin:0 0 8px 0;">Последние обновления</h4>
                ${items.map((i) => `
                    <div class="list-item">
                        <div class="list-item-info">
                            <div class="list-item-name">${escapeHtml(i.from_version || '-')} -> ${escapeHtml(i.to_version || '-')} <span class="admin-badge ${i.status === 'success' ? 'ok' : 'warn'}">${escapeHtml(i.status || '-')}</span></div>
                            <div class="list-item-meta">
                                <span>${escapeHtml(i.started_at || '-')}</span>
                                <span>${escapeHtml(i.error_message || '-')}</span>
                                <span>${escapeHtml(i.backup_ref || '-')}</span>
                            </div>
                        </div>
                    </div>
                `).join('')}
            `;
        } catch (e) {
            historyBox.innerHTML = `<div class="empty-state">Не удалось загрузить историю обновлений: ${escapeHtml(String((e && e.message) || e || 'unknown'))}</div>`;
        }
    }

    async function runPluginPrecheckFromFile() {
        const input = document.getElementById('plugin-import-file');
        const file = input?.files?.[0];
        if (!file) {
            throw new Error('Выберите ZIP архив плагина.');
        }
        const bytesBuffer = await file.arrayBuffer();
        const bytes = new Uint8Array(bytesBuffer);
        const response = await fetch('/api/admin/plugins/update/precheck', {
            method: 'POST',
            headers: { 'Content-Type': 'application/octet-stream' },
            body: bytes,
        });
        const payload = await response.json().catch(() => ({}));
        if (!response.ok || !payload.ok) {
            throw new Error(payload.detail || payload.message || `HTTP ${response.status}`);
        }
        pluginUpdatePendingBytes = bytes;
        pluginUpdatePendingPrecheck = payload;
        const result = payload.result || {};
        const policy = result.update_policy || {};
        pluginUpdatePendingForce = Boolean(result.requires_confirmation || policy.breaking_change || (policy.strategy === 'destructive'));
        return payload;
    }

    async function precheckPluginUpdate() {
        const precheckPayload = await runPluginPrecheckFromFile();
        renderPluginUpdatePassport(precheckPayload, 'precheck');
        openPluginUpdatePassportModal();
    }

    async function updatePluginFromZip() {
        const precheckPayload = await runPluginPrecheckFromFile();
        renderPluginUpdatePassport(precheckPayload, 'update');
        openPluginUpdatePassportModal();
    }

    async function applyPluginUpdateFromPassport() {
        const resultBox = document.getElementById('plugin-update-passport-result');
        if (!pluginUpdatePendingBytes || !pluginUpdatePendingPrecheck) {
            resultBox.innerHTML = '<div class="empty-state">Нет подготовленного пакета обновления. Выполните precheck.</div>';
            return;
        }
        const pre = pluginUpdatePendingPrecheck.result || {};
        if ((pre.mode || '') !== 'update') {
            resultBox.innerHTML = '<div class="empty-state">Этот архив не является обновлением установленного плагина.</div>';
            return;
        }
        const response = await fetch(`/api/admin/plugins/update?force=${pluginUpdatePendingForce ? '1' : '0'}`, {
            method: 'POST',
            headers: { 'Content-Type': 'application/octet-stream' },
            body: pluginUpdatePendingBytes,
        });
        const payload = await response.json().catch(() => ({}));
        if (!response.ok || !payload.ok) {
            throw new Error(payload.detail || payload.message || `HTTP ${response.status}`);
        }
        resultBox.innerHTML = `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">Обновление выполнено <span class="admin-badge ok">success</span></div>
                    <div class="list-item-meta">
                        <span>Плагин: ${escapeHtml(payload.slug || '-')}</span>
                        <span>Версия: ${escapeHtml(payload.version || '-')}</span>
                        <span>Ссылка на бэкап: ${escapeHtml(payload.backup_ref || '-')}</span>
                    </div>
                </div>
            </div>
        `;
        await loadPluginUpdatePassportHistory(String(payload.slug || ''));
        const input = document.getElementById('plugin-import-file');
        if (input) input.value = '';
        await loadPlugins();
    }

    async function viewPluginUpdates(encodedSlug) {
        const slug = decodeURIComponent(encodedSlug);
        const data = await api('GET', `/api/admin/plugins/${encodeURIComponent(slug)}/updates?limit=20`);
        const box = document.getElementById('plugins-updates-history');
        const items = data.items || [];
        if (!items.length) {
            box.innerHTML = '<div class="empty-state">История обновлений пуста</div>';
            return;
        }
        box.innerHTML = `
            <h4 style="margin:0 0 8px 0;">История обновлений: ${escapeHtml(slug)}</h4>
            ${items.map((i) => `
                <div class="list-item">
                    <div class="list-item-info">
                        <div class="list-item-name">${escapeHtml(i.from_version || '-')} -> ${escapeHtml(i.to_version || '-')} <span class="admin-badge ${i.status === 'success' ? 'ok' : 'warn'}">${escapeHtml(i.status || '-')}</span></div>
                        <div class="list-item-meta"><span>${escapeHtml(i.started_at || '-')}</span><span>${escapeHtml(i.error_message || '-')}</span><span>${escapeHtml(i.backup_ref || '-')}</span></div>
                    </div>
                </div>
            `).join('')}
        `;
    }

    async function exportPlugin(encodedSlug) {
        const slug = decodeURIComponent(encodedSlug);
        const response = await fetch(`/api/admin/plugins/${encodeURIComponent(slug)}/export`);
        if (!response.ok) {
            const payload = await response.json().catch(() => ({}));
            throw new Error(payload.detail || `HTTP ${response.status}`);
        }
        const blob = await response.blob();
        const url = URL.createObjectURL(blob);
        const a = document.createElement('a');
        a.href = url;
        a.download = `plugin-${slug}.zip`;
        document.body.appendChild(a);
        a.click();
        setTimeout(() => {
            URL.revokeObjectURL(url);
            a.remove();
        }, 500);
    }

    async function togglePlugin(encodedSlug, enabled) {
        const slug = decodeURIComponent(encodedSlug);
        await api('PATCH', `/api/admin/plugins/${encodeURIComponent(slug)}/toggle`, { is_enabled: enabled });
        await loadPlugins();
    }

    async function deletePlugin(encodedSlug) {
        const slug = decodeURIComponent(encodedSlug);
        if (!await awmConfirm(`Удалить плагин ${slug}?`)) return;
        await api('DELETE', `/api/admin/plugins/${encodeURIComponent(slug)}`);
        await loadPlugins();
    }

    async function clearPluginData(encodedSlug) {
        const slug = decodeURIComponent(encodedSlug);
        const ask = (typeof window.awmConfirm === 'function')
            ? await window.awmConfirm(`Очистить данные плагина ${slug}? Будут очищены только таблицы plg_${slug}*`)
            : await awmConfirm(`Очистить данные плагина ${slug}? Будут очищены только таблицы plg_${slug}*`);
        if (!ask) return;
        const result = await api('POST', `/api/admin/plugins/${encodeURIComponent(slug)}/clear`, {});
        const count = Number((result.tables_cleared || []).length || 0);
        if (typeof window.awmAlert === 'function') {
            await window.awmAlert(`Очистка завершена. Таблиц очищено: ${count}`);
        } else {
            alert(`Очистка завершена. Таблиц очищено: ${count}`);
        }
    }

    async function dropAndDeletePlugin(encodedSlug) {
        const slug = decodeURIComponent(encodedSlug);
        const ask = (typeof window.awmConfirm === 'function')
            ? await window.awmConfirm(`Удалить плагин и таблицы для ${slug}? Будут удалены таблицы plg_${slug}* и сам плагин.`)
            : await awmConfirm(`Удалить плагин и таблицы для ${slug}? Будут удалены таблицы plg_${slug}* и сам плагин.`);
        if (!ask) return;
        await api('DELETE', `/api/admin/plugins/${encodeURIComponent(slug)}/drop-and-delete`);
        if (typeof window.awmAlert === 'function') {
            await window.awmAlert(`Плагин ${slug} удален вместе с таблицами.`);
        } else {
            alert(`Плагин ${slug} удален вместе с таблицами.`);
        }
        await loadPlugins();
    }

    function openCreateBackupModal() {
        document.getElementById('backup-create-modal').classList.add('active');
        toggleBackupCreateTargetFields();
    }

    function closeBackupCreateModal() {
        document.getElementById('backup-create-modal').classList.remove('active');
        document.getElementById('backup-create-form').reset();
        document.getElementById('backup-target-type').value = 'local';
        toggleBackupCreateTargetFields();
    }

    function toggleBackupCreateTargetFields() {
        const targetType = document.getElementById('backup-target-type').value;
        const isS3 = targetType === 's3';
        const isFtp = targetType === 'ftp';
        const isSsh = targetType === 'ssh';
        const localDirGroup = document.getElementById('backup-local-dir-group');
        if (localDirGroup) {
            localDirGroup.style.display = (isS3 || isFtp || isSsh) ? 'none' : '';
        }
        ['backup-create-s3-row1', 'backup-create-s3-row2', 'backup-create-s3-row3'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = isS3 ? '' : 'none';
        });
        ['backup-create-ftp-row1', 'backup-create-ftp-row2', 'backup-create-ftp-row3'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = isFtp ? '' : 'none';
        });
        ['backup-create-ssh-row1', 'backup-create-ssh-row2', 'backup-create-ssh-row3'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = isSsh ? '' : 'none';
        });
    }

    function openBackupPlanModal() {
        document.getElementById('backup-plan-modal').classList.add('active');
        if (window.awmTimezones) {
            const el = document.getElementById('backup-plan-timezone');
            if (el && !el.options.length) {
                window.awmTimezones.fillSelect(el, {
                    value: 'Europe/Moscow',
                    includeEmpty: false,
                });
            }
        }
        toggleBackupPlanTargetFields();
        toggleBackupPlanScheduleFields();
    }

    function closeBackupPlanModal() {
        document.getElementById('backup-plan-modal').classList.remove('active');
        document.getElementById('backup-plan-form').reset();
        document.getElementById('backup-plan-active').checked = true;
        if (window.awmTimezones) {
            window.awmTimezones.fillSelect(document.getElementById('backup-plan-timezone'), {
                value: 'Europe/Moscow',
                includeEmpty: false,
            });
        } else {
            document.getElementById('backup-plan-timezone').value = 'Europe/Moscow';
        }
        document.getElementById('backup-plan-schedule-mode').value = 'interval';
        document.getElementById('backup-plan-target-type').value = 'local';
        toggleBackupPlanTargetFields();
        toggleBackupPlanScheduleFields();
    }

    function toggleBackupPlanTargetFields() {
        const targetType = document.getElementById('backup-plan-target-type').value;
        const isS3 = targetType === 's3';
        const isFtp = targetType === 'ftp';
        const isSsh = targetType === 'ssh';
        const localRow = document.getElementById('backup-plan-local-row');
        if (localRow) localRow.style.display = (isS3 || isFtp || isSsh) ? 'none' : '';
        ['backup-plan-s3-row1', 'backup-plan-s3-row2', 'backup-plan-s3-row3'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = isS3 ? '' : 'none';
        });
        ['backup-plan-ftp-row1', 'backup-plan-ftp-row2', 'backup-plan-ftp-row3'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = isFtp ? '' : 'none';
        });
        ['backup-plan-ssh-row1', 'backup-plan-ssh-row2', 'backup-plan-ssh-row3'].forEach((id) => {
            const el = document.getElementById(id);
            if (el) el.style.display = isSsh ? '' : 'none';
        });
    }

    function toggleBackupPlanScheduleFields() {
        const mode = document.getElementById('backup-plan-schedule-mode').value;
        document.getElementById('backup-plan-interval-row').style.display = mode === 'interval' ? '' : 'none';
        document.getElementById('backup-plan-weekly-block').style.display = mode === 'weekly' ? '' : 'none';
        document.getElementById('backup-plan-idle-row').style.display = mode === 'idle' ? '' : 'none';
    }

    async function restoreBackup(archiveId) {
        const scope = await awmPrompt('Что восстановить? all/system/database', 'all') || 'all';
        if (!await awmConfirm('Подтвердите восстановление из бэкапа.')) return;
        if (typeof awmConfirmHeavyTask === 'function') {
            if (!(await awmConfirmHeavyTask('восстановление из бэкапа'))) return;
        }
        const started = await api('POST', '/api/admin/backups/restore', { archive_id: archiveId, restore_scope: scope });
        const jobId = started.job_id;
        if (!jobId) {
            alert(started.message || 'Восстановление запущено.');
            return;
        }
        alert('Восстановление запущено в фоне. Ожидайте…');
        const poll = async () => {
            const st = await api('GET', `/api/admin/backups/restore/jobs/${encodeURIComponent(jobId)}`);
            if (st.status === 'completed') {
                alert(st.message || 'Восстановление завершено. Рекомендуется перезапустить сервис.');
                return;
            }
            if (st.status === 'failed') {
                throw new Error(st.error || 'Ошибка восстановления');
            }
            await new Promise((r) => setTimeout(r, 1500));
            return poll();
        };
        try {
            await poll();
        } catch (e) {
            alert(e.message || String(e));
        }
    }

    async function deleteBackup(archiveId) {
        if (!await awmConfirm('Удалить архив бэкапа?')) return;
        await api('DELETE', `/api/admin/backups/${archiveId}`);
        await loadBackups();
    }

    async function toggleBackupPlan(planId, isActive) {
        await api('PATCH', `/api/admin/backup-plans/${planId}/toggle`, { is_active: isActive });
        await loadBackupPlans();
    }

    async function deleteBackupPlan(planId) {
        if (!await awmConfirm('Удалить план бэкапа?')) return;
        await api('DELETE', `/api/admin/backup-plans/${planId}`);
        await loadBackupPlans();
    }

    async function loadRolesAndPermissions() {
        const rolesResult = await Promise.allSettled([
            api('GET', '/api/admin/roles'),
            api('GET', '/api/admin/permissions'),
            api('GET', '/api/admin/permission-presets').catch(() => ({ items: [] })),
        ]);
        const rolesData = rolesResult[0].status === 'fulfilled' ? rolesResult[0].value : { items: [] };
        const permissionsData = rolesResult[1].status === 'fulfilled' ? rolesResult[1].value : { items: [], groups: [] };
        const presetsData = rolesResult[2].status === 'fulfilled' ? rolesResult[2].value : { items: [] };
        const hardFail = [rolesResult[0], rolesResult[1]].find((r) => r.status === 'rejected');
        if (hardFail && hardFail.status === 'rejected') {
            showAdminGlobalError(hardFail.reason);
        }
        adminRoles = (rolesData.items || []).filter((role) => {
            const name = String(role.name || '').trim();
            return isMultiOfficeMode() || name !== 'office_admin';
        });
        adminPermissions = permissionsData.items || [];
        adminPermissionGroups = permissionsData.groups || [];
        adminPermissionPresets = (presetsData.items || []).filter((preset) => {
            const id = String(preset.id || '').trim();
            return isMultiOfficeMode() || id !== 'office_admin';
        });
        populateRolePermPresetOptions();
        populateUsersRoleFilter();
        renderSsoDefaultRoleOptions(document.getElementById('sso-default-role')?.value || 'operator');
        setStat('stat-roles', adminRoles.length);
        const list = document.getElementById('roles-list');
        if (!list) return;
        if (!adminRoles.length) {
            list.innerHTML = '<div class="empty-state">Ролей нет</div>';
            return;
        }
        list.innerHTML = adminRoles.map(role => `
            <div class="list-item">
                <div class="list-item-info">
                    <div class="list-item-name">${escapeHtml(role.title || roleTitle(role.name))}</div>
                    <div class="list-item-meta"><span>${escapeHtml(role.description || '-')}</span></div>
                    <div class="list-item-meta"><span>${escapeHtml(formatRolePermissionsSummary(role.permissions || []))}</span></div>
                </div>
                <div class="list-item-actions">
                    <button class="btn btn-secondary btn-sm" onclick='openRoleModal(${JSON.stringify(role)})'>Редактировать</button>
                    ${role.name === 'admin' ? '' : `<button class="btn btn-danger btn-sm" onclick="deleteRole(${role.id}, '${role.name}')">Удалить</button>`}
                </div>
            </div>
        `).join('');
    }

    function populateRolePermPresetOptions() {
        const select = document.getElementById('role-perm-preset');
        if (!select) return;
        const current = select.value;
        select.innerHTML = '<option value="">Готовый набор…</option>' + adminPermissionPresets.map((preset) => {
            const id = escapeHtml(String(preset.id || ''));
            const title = escapeHtml(String(preset.title || preset.id || ''));
            return `<option value="${id}">${title}</option>`;
        }).join('');
        if (current && adminPermissionPresets.some((item) => item.id === current)) {
            select.value = current;
        }
    }

    async function applyRolePermissionPreset() {
        const select = document.getElementById('role-perm-preset');
        const presetId = String(select?.value || '').trim();
        const preset = adminPermissionPresets.find((item) => String(item.id) === presetId);
        if (!preset) {
            await awmAlert('Выберите готовый набор прав.');
            return;
        }
        const title = String(preset.title || 'этот набор');
        const ok = await awmConfirm(`Заменить выбранные права набором «${title}»?`);
        if (!ok) return;
        const names = Array.isArray(preset.permissions) ? preset.permissions : [];
        roleModalSelected = new Set(names.map((name) => String(name)));
        renderRolePermissionsGrid();
    }

    function permissionTitleByName(name) {
        const key = String(name || '').trim();
        const found = adminPermissions.find(p => p.name === key);
        if (found && found.title) return found.title;
        if (key.startsWith('plugin.')) {
            const slug = key.split('.')[1] || 'plugin';
            return `Плагин «${slug}»: доступ`;
        }
        return key;
    }

    function formatRolePermissionsSummary(perms) {
        const names = Array.isArray(perms) ? perms : [];
        if (!names.length) return 'Права не назначены';
        const titles = names.map(permissionTitleByName);
        if (titles.length <= 4) return `Права: ${titles.join(', ')}`;
        return `Права (${titles.length}): ${titles.slice(0, 3).join(', ')} и ещё ${titles.length - 3}`;
    }

    function ensureRoleModalSearchBound() {
        if (roleModalSearchBound) return;
        roleModalSearchBound = true;
        const search = document.getElementById('role-perm-search');
        search?.addEventListener('input', () => renderRolePermissionsGrid());
        document.getElementById('role-perm-expand-all')?.addEventListener('click', () => {
            document.querySelectorAll('#role-permissions-grid .role-perm-group').forEach(el => el.classList.remove('collapsed'));
        });
        document.getElementById('role-perm-collapse-all')?.addEventListener('click', () => {
            document.querySelectorAll('#role-permissions-grid .role-perm-group').forEach(el => el.classList.add('collapsed'));
        });
        document.getElementById('role-perm-apply-preset')?.addEventListener('click', () => {
            void applyRolePermissionPreset();
        });
        document.getElementById('role-permissions-grid')?.addEventListener('change', (event) => {
            const target = event.target;
            if (!(target instanceof HTMLInputElement)) return;
            if (target.classList.contains('role-perm-group-toggle')) {
                const group = target.closest('.role-perm-group');
                const checked = target.checked;
                group?.querySelectorAll('input.role-perm-cb').forEach(cb => {
                    cb.checked = checked;
                    if (checked) roleModalSelected.add(cb.value);
                    else roleModalSelected.delete(cb.value);
                });
                updateRolePermSelectedCount();
                syncRoleGroupToggles();
                return;
            }
            if (target.classList.contains('role-perm-cb')) {
                if (target.checked) roleModalSelected.add(target.value);
                else roleModalSelected.delete(target.value);
                updateRolePermSelectedCount();
                syncRoleGroupToggles();
            }
        });
        document.getElementById('role-permissions-grid')?.addEventListener('click', (event) => {
            const header = event.target.closest?.('.role-perm-group-header');
            if (!header) return;
            if (event.target.closest('input')) return;
            header.closest('.role-perm-group')?.classList.toggle('collapsed');
        });
    }

    function updateRolePermSelectedCount() {
        const el = document.getElementById('role-perm-selected-count');
        if (el) el.textContent = `Выбрано: ${roleModalSelected.size}`;
    }

    function syncRoleGroupToggles() {
        document.querySelectorAll('#role-permissions-grid .role-perm-group').forEach(group => {
            const boxes = Array.from(group.querySelectorAll('input.role-perm-cb'));
            const toggle = group.querySelector('input.role-perm-group-toggle');
            if (!toggle || !boxes.length) return;
            const checkedCount = boxes.filter(cb => cb.checked).length;
            toggle.checked = checkedCount === boxes.length;
            toggle.indeterminate = checkedCount > 0 && checkedCount < boxes.length;
        });
    }

    function buildRolePermissionGroupsForRender(query) {
        const q = String(query || '').trim().toLowerCase();
        const match = (p) => {
            if (!q) return true;
            const hay = `${p.title || ''} ${p.description || ''} ${p.name || ''} ${p.group_label || ''}`.toLowerCase();
            return hay.includes(q);
        };
        if (adminPermissionGroups.length) {
            return adminPermissionGroups
                .map(g => ({
                    group: g.group,
                    label: g.label || g.group_label || 'Прочие права',
                    permissions: (g.permissions || []).filter(match),
                }))
                .filter(g => g.permissions.length);
        }
        const buckets = {};
        adminPermissions.filter(match).forEach(p => {
            const key = p.group || 'other';
            if (!buckets[key]) {
                buckets[key] = {
                    group: key,
                    label: p.group_label || 'Прочие права',
                    permissions: [],
                };
            }
            buckets[key].permissions.push(p);
        });
        return Object.values(buckets);
    }

    function renderRolePermissionsGrid() {
        const grid = document.getElementById('role-permissions-grid');
        if (!grid) return;
        const query = document.getElementById('role-perm-search')?.value || '';
        const groups = buildRolePermissionGroupsForRender(query);
        if (!groups.length) {
            grid.innerHTML = '<div class="role-perm-empty">Ничего не найдено. Измените строку поиска.</div>';
            updateRolePermSelectedCount();
            return;
        }
        grid.innerHTML = groups.map(g => {
            const gid = escapeHtml(g.group || 'other');
            const collapsedClass = query.trim() ? '' : ' collapsed';
            const rows = g.permissions.map(p => {
                const checked = roleModalSelected.has(p.name) ? 'checked' : '';
                return `
                <label class="role-perm-row" title="${escapeHtml(p.description || '')}">
                    <input type="checkbox" class="role-perm-cb" value="${escapeHtml(p.name)}" ${checked}>
                    <span>
                        <div class="role-perm-title">${escapeHtml(p.title || p.name)}</div>
                        <div class="role-perm-desc">${escapeHtml(p.description || '')}</div>
                    </span>
                    <code class="role-perm-code">${escapeHtml(p.name)}</code>
                </label>`;
            }).join('');
            return `
            <div class="role-perm-group${collapsedClass}" data-group="${gid}">
                <div class="role-perm-group-header">
                    <input type="checkbox" class="role-perm-group-toggle" aria-label="Выбрать группу">
                    <strong>${escapeHtml(g.label)}</strong>
                    <span class="role-perm-group-count">${g.permissions.length}</span>
                </div>
                <div class="role-perm-group-body">${rows}</div>
            </div>`;
        }).join('');
        updateRolePermSelectedCount();
        syncRoleGroupToggles();
    }

    async function openRoleModal(role = null) {
        if (!adminPermissions.length && !adminPermissionGroups.length) {
            try {
                await loadRolesAndPermissions();
                adminSectionLoaded.add('section-roles');
            } catch (e) {
                showAdminGlobalError(e);
                return;
            }
        }
        ensureRoleModalSearchBound();
        const displayName = role ? (role.title || roleTitle(role.name) || role.name) : '';
        document.getElementById('role-modal-title').textContent = role
            ? `Редактирование роли: ${displayName}`
            : 'Создание роли';
        document.getElementById('role-id').value = role ? String(role.id) : '';
        document.getElementById('role-name').value = role?.name || '';
        document.getElementById('role-description').value = role?.description || '';
        const search = document.getElementById('role-perm-search');
        if (search) search.value = '';
        roleModalSelected = new Set(role?.permissions || []);
        renderRolePermissionsGrid();
        document.getElementById('role-modal').classList.add('active');
        search?.focus();
    }

    function closeRoleModal() {
        document.getElementById('role-modal').classList.remove('active');
    }

    async function deleteRole(roleId, roleName) {
        if (!await awmConfirm(`Удалить роль ${roleName}?`)) return;
        await api('DELETE', `/api/admin/roles/${roleId}`);
        await loadRolesAndPermissions();
    }

    async function loadAuthProviders() {
        return;
    }

    async function toggleProvider(providerId, enabled) {
        alert('Функционал провайдеров аутентификации будет реализован в будущих версиях.');
    }

    async function deleteProvider(providerId, providerName) {
        alert('Функционал провайдеров аутентификации будет реализован в будущих версиях.');
    }

    function renderProviderFields(providerType, config) {
        const container = document.getElementById('provider-dynamic-fields');
        const renderFieldMappingEditor = (providerFieldOptions, mapping) => {
            const profileFields = [
                { key: 'username', label: 'Логин' },
                { key: 'email', label: 'Email' },
                { key: 'full_name', label: 'Полное имя' },
                { key: 'first_name', label: 'Имя' },
                { key: 'last_name', label: 'Фамилия' },
                { key: 'phone', label: 'Телефон' },
                { key: 'department', label: 'Отдел' },
                { key: 'job_title', label: 'Должность' },
                { key: 'timezone', label: 'Часовой пояс' }
            ];
            const options = [''].concat(providerFieldOptions || []);
            return `
                <div class="form-group">
                    <label>Сопоставление полей</label>
                    <div class="mapping-grid" id="provider-field-mapping-grid">
                        <div class="mapping-head">Поле профиля AWM</div>
                        <div class="mapping-head">Поле у провайдера</div>
                        ${profileFields.map(field => {
                            const value = (mapping && mapping[field.key]) ? String(mapping[field.key]) : '';
                            const hasPredefined = options.includes(value);
                            const selectValue = hasPredefined ? value : (value ? '__custom__' : '');
                            const customValue = hasPredefined ? '' : value;
                            return `
                                <div class="mapping-row">
                                    <div class="mapping-field-label">${field.label}</div>
                                    <div>
                                        <select data-map-target="${field.key}" class="form-control provider-map-select">
                                            <option value="">Не заполнять</option>
                                            ${options.filter(Boolean).map(opt => `<option value="${escapeHtml(opt)}" ${selectValue === opt ? 'selected' : ''}>${escapeHtml(opt)}</option>`).join('')}
                                            <option value="__custom__" ${selectValue === '__custom__' ? 'selected' : ''}>Своё поле...</option>
                                        </select>
                                        <input
                                            type="text"
                                            class="form-control provider-map-custom"
                                            data-map-custom="${field.key}"
                                            placeholder="custom.path"
                                            value="${escapeHtml(customValue)}"
                                            style="margin-top:6px; ${selectValue === '__custom__' ? '' : 'display:none;'}"
                                        >
                                    </div>
                                </div>
                            `;
                        }).join('')}
                    </div>
                </div>
            `;
        };

        if (providerType === 'oidc') {
            container.innerHTML = `
                <div class="form-row">
                    <div class="form-group"><label>Издатель (Issuer)</label><input type="text" id="cfg-issuer" value="${config.issuer || ''}"></div>
                    <div class="form-group"><label>Идентификатор клиента (Client ID)</label><input type="text" id="cfg-client-id" value="${config.client_id || ''}"></div>
                </div>
                <div class="form-row">
                    <div class="form-group"><label>Секрет клиента</label><input type="password" id="cfg-client-secret" value="${config.client_secret || ''}"></div>
                    <div class="form-group"><label>Endpoint токена</label><input type="text" id="cfg-token-endpoint" value="${config.token_endpoint || ''}"></div>
                </div>
                <div class="form-group"><label>Endpoint сведений о пользователе</label><input type="text" id="cfg-userinfo-endpoint" value="${config.userinfo_endpoint || ''}"></div>
                ${renderFieldMappingEditor(
                    ['preferred_username', 'email', 'name', 'given_name', 'family_name', 'phone_number', 'department', 'title', 'zoneinfo', 'groups'],
                    config.field_mapping || {}
                )}
            `;
            attachFieldMappingHandlers();
            return;
        }
        if (providerType === 'ldap' || providerType === 'ad' || providerType === 'freeipa') {
            container.innerHTML = `
                <div class="form-row">
                    <div class="form-group"><label>URI сервера</label><input type="text" id="cfg-server-uri" value="${config.server_uri || ''}" placeholder="ldap://dc.example.com:389"></div>
                    <div class="form-group"><label>Базовый DN</label><input type="text" id="cfg-base-dn" value="${config.base_dn || ''}" placeholder="dc=example,dc=com"></div>
                </div>
                <div class="form-row">
                    <div class="form-group"><label>Логин для подключения (bind DN) *</label><input type="text" id="cfg-bind-dn" value="${config.bind_dn || ''}" placeholder="cn=svc_awm,ou=svc,dc=example,dc=com"></div>
                    <div class="form-group"><label>Пароль для подключения *</label><input type="password" id="cfg-bind-password" value="${config.bind_password || ''}" placeholder="******"></div>
                </div>
                <div class="form-group"><label>Шаблон DN пользователя</label><input type="text" id="cfg-user-dn-template" value="${config.user_dn_template || ''}" placeholder="uid={username},cn=users,cn=accounts,dc=example,dc=com"></div>
                ${renderFieldMappingEditor(
                    ['uid', 'cn', 'displayName', 'givenName', 'sn', 'mail', 'telephoneNumber', 'department', 'title', 'timezone'],
                    config.field_mapping || {}
                )}
            `;
            attachFieldMappingHandlers();
            return;
        }
        container.innerHTML = `<div class="empty-state" style="padding:15px;">Для local-провайдера дополнительные поля не требуются.</div>`;
    }

    function attachFieldMappingHandlers() {
        document.querySelectorAll('.provider-map-select').forEach((selectEl) => {
            selectEl.addEventListener('change', () => {
                const target = selectEl.getAttribute('data-map-target');
                const customInput = document.querySelector(`.provider-map-custom[data-map-custom="${target}"]`);
                if (!customInput) return;
                if (selectEl.value === '__custom__') {
                    customInput.style.display = '';
                    customInput.focus();
                } else {
                    customInput.style.display = 'none';
                }
            });
        });
    }

    function collectProviderConfig(providerType) {
        const parseFieldMapping = () => {
            const mapping = {};
            const selects = document.querySelectorAll('.provider-map-select');
            selects.forEach((selectEl) => {
                const target = selectEl.getAttribute('data-map-target');
                if (!target) return;
                if (selectEl.value === '__custom__') {
                    const customInput = document.querySelector(`.provider-map-custom[data-map-custom="${target}"]`);
                    const customValue = (customInput?.value || '').trim();
                    if (customValue) mapping[target] = customValue;
                    return;
                }
                const value = (selectEl.value || '').trim();
                if (value) mapping[target] = value;
            });
            return mapping;
        };

        const mapping = parseFieldMapping();
        if (providerType === 'oidc') {
            return {
                issuer: document.getElementById('cfg-issuer').value.trim(),
                client_id: document.getElementById('cfg-client-id').value.trim(),
                client_secret: document.getElementById('cfg-client-secret').value.trim(),
                token_endpoint: document.getElementById('cfg-token-endpoint').value.trim(),
                userinfo_endpoint: document.getElementById('cfg-userinfo-endpoint').value.trim(),
                field_mapping: mapping
            };
        }
        if (providerType === 'ldap' || providerType === 'ad' || providerType === 'freeipa') {
            const bindDn = document.getElementById('cfg-bind-dn').value.trim();
            const bindPassword = document.getElementById('cfg-bind-password').value.trim();
            if (!bindDn || !bindPassword) {
                throw new Error('Для LDAP/AD/FreeIPA обязательны логин и пароль подключения');
            }
            return {
                server_uri: document.getElementById('cfg-server-uri').value.trim(),
                base_dn: document.getElementById('cfg-base-dn').value.trim(),
                bind_dn: bindDn,
                bind_password: bindPassword,
                user_dn_template: document.getElementById('cfg-user-dn-template').value.trim(),
                field_mapping: mapping
            };
        }
        return {};
    }

    function openCreateProviderModal() {
        isCreatingProvider = true;
        currentProvider = null;
        document.getElementById('provider-modal-title').textContent = 'Добавление провайдера';
        document.getElementById('provider-name').value = '';
        document.getElementById('provider-type').disabled = false;
        document.getElementById('provider-type').value = 'ad';
        document.getElementById('provider-enabled').value = 'false';
        document.getElementById('provider-priority').value = 50;
        document.getElementById('provider-test-username').value = '';
        document.getElementById('provider-test-password').value = '';
        document.getElementById('provider-test-result').textContent = '';
        renderProviderFields('ad', defaultProviderConfig('ad'));
        document.getElementById('provider-modal').classList.add('active');
    }

    function openProviderModal(provider) {
        isCreatingProvider = false;
        currentProvider = provider;
        document.getElementById('provider-modal-title').textContent = `Настройка: ${provider.name}`;
        document.getElementById('provider-name').value = provider.name;
        document.getElementById('provider-type').value = String(provider.provider_type || 'local').toLowerCase();
        document.getElementById('provider-type').disabled = true;
        document.getElementById('provider-enabled').value = provider.is_enabled ? 'true' : 'false';
        document.getElementById('provider-priority').value = provider.priority || 50;
        document.getElementById('provider-test-username').value = '';
        document.getElementById('provider-test-password').value = '';
        document.getElementById('provider-test-result').textContent = '';
        renderProviderFields(String(provider.provider_type || 'local').toLowerCase(), provider.config || {});
        document.getElementById('provider-modal').classList.add('active');
    }

    function closeProviderModal() {
        document.getElementById('provider-modal').classList.remove('active');
        document.getElementById('provider-type').disabled = false;
        isCreatingProvider = false;
        currentProvider = null;
    }

    async function testProviderConnection() {
        const resultEl = document.getElementById('provider-test-result');
        resultEl.style.color = '#475569';
        resultEl.textContent = 'Функционал провайдеров аутентификации будет реализован в будущих версиях.';
    }

    document.getElementById('provider-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        alert('Функционал провайдеров аутентификации будет реализован в будущих версиях.');
        closeProviderModal();
    });

    document.getElementById('provider-type').addEventListener('change', () => {
        if (!isCreatingProvider) return;
        const providerType = String(document.getElementById('provider-type').value || '').toLowerCase();
        renderProviderFields(providerType, defaultProviderConfig(providerType));
    });

    document.getElementById('role-assign-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        const userId = document.getElementById('role-assign-user-id').value;
        const selectedRoles = Array.from(document.getElementById('role-assign-role').selectedOptions).map((o) => o.value);
        if (!selectedRoles.length) {
            alert('Выберите хотя бы одну роль');
            return;
        }
        const target = adminUsersById[String(userId)];
        if (target && isSoleActiveAdminUser(target) && !selectedRoles.includes('admin')) {
            alert('Нельзя снять роль admin у последнего активного администратора. Сначала назначьте роль admin другому активному пользователю.');
            return;
        }
        const preserved = Array.isArray(target && target.roles) ? target.roles : [];
        if (!isMultiOfficeMode() && preserved.includes('office_admin') && !selectedRoles.includes('office_admin')) {
            selectedRoles.push('office_admin');
        }
        await api('PUT', `/api/admin/users/${userId}/roles`, { roles: selectedRoles });
        closeRoleAssignModal();
        await loadUsers();
    });

    document.getElementById('role-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        const roleId = document.getElementById('role-id').value;
        const name = document.getElementById('role-name').value.trim();
        const description = document.getElementById('role-description').value.trim();
        const permissions = Array.from(roleModalSelected);
        const payload = { name, description, permissions };
        if (roleId) {
            await api('PUT', `/api/admin/roles/${roleId}`, payload);
        } else {
            await api('POST', '/api/admin/roles', payload);
        }
        closeRoleModal();
        await loadRolesAndPermissions();
    });

    document.getElementById('user-edit-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        const userId = document.getElementById('user-edit-id').value;
        const fullPayload = {
            email: document.getElementById('user-edit-email').value.trim() || null,
            full_name: document.getElementById('user-edit-full-name').value.trim() || null,
            first_name: document.getElementById('user-edit-first-name').value.trim() || null,
            last_name: document.getElementById('user-edit-last-name').value.trim() || null,
            phone: document.getElementById('user-edit-phone').value.trim() || null,
            department: document.getElementById('user-edit-department').value.trim() || null,
            job_title: document.getElementById('user-edit-job-title').value.trim() || null,
            timezone: document.getElementById('user-edit-timezone').value.trim() || null
        };
        const payload = userEditSsoManaged
            ? {
                phone: fullPayload.phone,
                department: fullPayload.department,
                job_title: fullPayload.job_title,
                timezone: fullPayload.timezone,
            }
            : fullPayload;
        await api('PUT', `/api/admin/users/${userId}`, payload);
        if (isMultiOfficeMode()) {
            const officeIds = selectedOfficeIds('user-edit-offices');
            if (!officeIds.length) {
                awmAlert('Выберите хотя бы одно подразделение');
                return;
            }
            await api('PUT', `/api/admin/users/${userId}/offices`, { office_ids: officeIds });
        }
        closeUserEditModal();
        await loadUsers();
    });

    document.getElementById('user-create-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        let officeIds = [];
        if (isMultiOfficeMode()) {
            officeIds = selectedOfficeIds('user-create-offices');
            if (!officeIds.length) {
                awmAlert('Выберите хотя бы одно подразделение');
                return;
            }
        } else {
            const currentId = currentOfficeIdForSingleMode();
            if (!currentId) {
                awmAlert('Не удалось определить подразделение установки');
                return;
            }
            officeIds = [currentId];
        }
        const payload = {
            username: document.getElementById('user-create-username').value.trim(),
            password: document.getElementById('user-create-password').value,
            email: document.getElementById('user-create-email').value.trim() || null,
            full_name: document.getElementById('user-create-full-name').value.trim() || null,
            roles: [document.getElementById('user-create-role').value],
            auth_provider: 'local',
            is_active: document.getElementById('user-create-active').checked,
            office_ids: officeIds,
            office_id: officeIds[0]
        };
        await api('POST', '/api/admin/users', payload);
        closeUserCreateModal();
        await loadUsers();
    });

    document.getElementById('backup-create-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        const targetType = document.getElementById('backup-target-type').value;
        const payload = {
            name: document.getElementById('backup-name').value.trim() || null,
            scope: document.getElementById('backup-scope').value,
            target_type: targetType,
            local_directory: document.getElementById('backup-local-directory').value.trim() || null,
            s3_bucket: document.getElementById('backup-s3-bucket').value.trim() || null,
            s3_key_prefix: document.getElementById('backup-s3-prefix').value.trim() || null,
            s3_endpoint_url: document.getElementById('backup-s3-endpoint').value.trim() || null,
            s3_access_key: document.getElementById('backup-s3-access-key').value.trim() || null,
            s3_secret_key: document.getElementById('backup-s3-secret-key').value.trim() || null,
            ftp_host: document.getElementById('backup-ftp-host').value.trim() || null,
            ftp_port: Number(document.getElementById('backup-ftp-port').value || '21') || 21,
            ftp_username: document.getElementById('backup-ftp-username').value.trim() || null,
            ftp_password: document.getElementById('backup-ftp-password').value.trim() || null,
            ftp_remote_directory: document.getElementById('backup-ftp-remote-directory').value.trim() || null,
            ftp_tls: document.getElementById('backup-ftp-tls').checked,
            ssh_host: document.getElementById('backup-ssh-host').value.trim() || null,
            ssh_port: Number(document.getElementById('backup-ssh-port').value || '22') || 22,
            ssh_username: document.getElementById('backup-ssh-username').value.trim() || null,
            ssh_remote_directory: document.getElementById('backup-ssh-remote-directory').value.trim() || null,
            ssh_private_key_path: document.getElementById('backup-ssh-private-key-path').value.trim() || null,
            ssh_password: document.getElementById('backup-ssh-password').value.trim() || null
        };
        if (targetType !== 's3') {
            payload.s3_bucket = null;
            payload.s3_key_prefix = null;
            payload.s3_endpoint_url = null;
            payload.s3_access_key = null;
            payload.s3_secret_key = null;
        }
        if (targetType !== 'ftp') {
            payload.ftp_host = null;
            payload.ftp_port = null;
            payload.ftp_username = null;
            payload.ftp_password = null;
            payload.ftp_remote_directory = null;
            payload.ftp_tls = null;
        }
        if (targetType !== 'ssh') {
            payload.ssh_host = null;
            payload.ssh_port = null;
            payload.ssh_username = null;
            payload.ssh_remote_directory = null;
            payload.ssh_private_key_path = null;
            payload.ssh_password = null;
        }
        if (targetType !== 'local') {
            payload.local_directory = null;
        }
        if (typeof awmConfirmHeavyTask === 'function') {
            if (!(await awmConfirmHeavyTask('создание резервной копии'))) return;
        }
        await api('POST', '/api/admin/backups', payload);
        closeBackupCreateModal();
        await loadBackups();
    });

    document.getElementById('backup-plan-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        const schedule_mode = document.getElementById('backup-plan-schedule-mode').value;
        const target_type = document.getElementById('backup-plan-target-type').value;
        const payload = {
            name: document.getElementById('backup-plan-name').value.trim(),
            scope: document.getElementById('backup-plan-scope').value,
            target_type,
            schedule_mode,
            timezone: document.getElementById('backup-plan-timezone').value.trim() || 'UTC',
            is_active: document.getElementById('backup-plan-active').checked,
            local_directory: document.getElementById('backup-plan-local-directory').value.trim() || null,
            retention_max_count: Number(document.getElementById('backup-plan-retention-count').value || '0') || null,
            retention_max_age_days: Number(document.getElementById('backup-plan-retention-days').value || '0') || null,
            retention_max_size_mb: Number(document.getElementById('backup-plan-retention-size-mb').value || '0') || null,
            s3_bucket: document.getElementById('backup-plan-s3-bucket').value.trim() || null,
            s3_key_prefix: document.getElementById('backup-plan-s3-prefix').value.trim() || null,
            s3_endpoint_url: document.getElementById('backup-plan-s3-endpoint').value.trim() || null,
            s3_access_key: document.getElementById('backup-plan-s3-access-key').value.trim() || null,
            s3_secret_key: document.getElementById('backup-plan-s3-secret-key').value.trim() || null,
            s3_session_token: document.getElementById('backup-plan-s3-session-token').value.trim() || null,
            ftp_host: document.getElementById('backup-plan-ftp-host').value.trim() || null,
            ftp_port: Number(document.getElementById('backup-plan-ftp-port').value || '21') || 21,
            ftp_username: document.getElementById('backup-plan-ftp-username').value.trim() || null,
            ftp_password: document.getElementById('backup-plan-ftp-password').value.trim() || null,
            ftp_remote_directory: document.getElementById('backup-plan-ftp-remote-directory').value.trim() || null,
            ftp_tls: document.getElementById('backup-plan-ftp-tls').checked,
            ssh_host: document.getElementById('backup-plan-ssh-host').value.trim() || null,
            ssh_port: Number(document.getElementById('backup-plan-ssh-port').value || '22') || 22,
            ssh_username: document.getElementById('backup-plan-ssh-username').value.trim() || null,
            ssh_remote_directory: document.getElementById('backup-plan-ssh-remote-directory').value.trim() || null,
            ssh_private_key_path: document.getElementById('backup-plan-ssh-private-key-path').value.trim() || null,
            ssh_password: document.getElementById('backup-plan-ssh-password').value.trim() || null,
        };
        if (!payload.name) {
            alert('Укажите название плана');
            return;
        }
        if (target_type !== 's3') {
            payload.s3_bucket = null;
            payload.s3_key_prefix = null;
            payload.s3_endpoint_url = null;
            payload.s3_access_key = null;
            payload.s3_secret_key = null;
            payload.s3_session_token = null;
        }
        if (target_type !== 'ftp') {
            payload.ftp_host = null;
            payload.ftp_port = null;
            payload.ftp_username = null;
            payload.ftp_password = null;
            payload.ftp_remote_directory = null;
            payload.ftp_tls = null;
        }
        if (target_type !== 'ssh') {
            payload.ssh_host = null;
            payload.ssh_port = null;
            payload.ssh_username = null;
            payload.ssh_remote_directory = null;
            payload.ssh_private_key_path = null;
            payload.ssh_password = null;
        }
        if (target_type !== 'local') {
            payload.local_directory = null;
        }
        if (schedule_mode === 'interval') {
            payload.interval_minutes = Number(document.getElementById('backup-plan-interval-minutes').value || '60');
        } else if (schedule_mode === 'weekly') {
            payload.weekdays = Array.from(document.querySelectorAll('.backup-plan-weekday:checked')).map((el) => Number(el.value));
            payload.run_hour = Number(document.getElementById('backup-plan-run-hour').value || '3');
            payload.run_minute = Number(document.getElementById('backup-plan-run-minute').value || '0');
        } else if (schedule_mode === 'idle') {
            payload.idle_minutes = Number(document.getElementById('backup-plan-idle-minutes').value || '20');
        }
        await api('POST', '/api/admin/backup-plans', payload);
        closeBackupPlanModal();
        await loadBackupPlans();
    });

    document.getElementById('integration-form').addEventListener('submit', async (e) => {
        e.preventDefault();
        const integrationId = document.getElementById('integration-id').value;
        const integrationType = document.getElementById('integration-type').value;
        const events = Array.from(document.querySelectorAll('.integration-event-checkbox:checked')).map((el) => el.value);
        const payload = {
            name: document.getElementById('integration-name').value.trim(),
            integration_type: integrationType,
            is_enabled: document.getElementById('integration-enabled').checked,
            events,
            webhook_url: null,
            token: null,
            chat_id: null,
            matrix_room_id: null,
            proxy_url: null,
            snmp_version: null,
            snmp_host: null,
            snmp_port: null,
            snmp_community: null,
            snmp_v3_user: null,
            snmp_v3_security_level: null,
            snmp_v3_auth_protocol: null,
            snmp_v3_auth_key: null,
            snmp_v3_priv_protocol: null,
            snmp_v3_priv_key: null,
            snmp_trap_oid: null,
            headers: null,
        };
        if (integrationType === 'webhook' || integrationType === 'grafana') {
            payload.webhook_url = document.getElementById('integration-webhook-url').value.trim() || null;
            payload.token = document.getElementById('integration-token').value.trim() || null;
        } else if (integrationType === 'max') {
            payload.webhook_url = document.getElementById('integration-max-api-url').value.trim() || 'https://platform-api.max.ru/messages';
            payload.token = document.getElementById('integration-max-token').value.trim() || null;
            payload.chat_id = document.getElementById('integration-max-chat-id').value.trim() || null;
        } else if (integrationType === 'telegram') {
            payload.token = document.getElementById('integration-telegram-token').value.trim() || null;
            payload.chat_id = document.getElementById('integration-chat-id').value.trim() || null;
            payload.proxy_url = document.getElementById('integration-telegram-proxy').value.trim() || '';
        } else if (integrationType === 'matrix') {
            payload.webhook_url = document.getElementById('integration-matrix-url').value.trim() || null;
            payload.token = document.getElementById('integration-matrix-token').value.trim() || null;
            payload.matrix_room_id = document.getElementById('integration-matrix-room-id').value.trim() || null;
        } else if (integrationType === 'snmp') {
            payload.snmp_version = document.getElementById('integration-snmp-version').value || '2c';
            payload.snmp_host = document.getElementById('integration-snmp-host').value.trim() || null;
            payload.snmp_port = Number(document.getElementById('integration-snmp-port').value || '162') || 162;
            payload.snmp_community = document.getElementById('integration-snmp-community').value.trim() || null;
            payload.snmp_trap_oid = document.getElementById('integration-snmp-trap-oid').value.trim() || null;
            payload.snmp_v3_user = document.getElementById('integration-snmp-v3-user').value.trim() || null;
            payload.snmp_v3_security_level = document.getElementById('integration-snmp-v3-security-level').value || null;
            payload.snmp_v3_auth_protocol = document.getElementById('integration-snmp-v3-auth-protocol').value || null;
            payload.snmp_v3_auth_key = document.getElementById('integration-snmp-v3-auth-key').value.trim() || null;
            payload.snmp_v3_priv_protocol = document.getElementById('integration-snmp-v3-priv-protocol').value || null;
            payload.snmp_v3_priv_key = document.getElementById('integration-snmp-v3-priv-key').value.trim() || null;
        } else if (integrationType === 'prometheus') {
            payload.webhook_url = document.getElementById('integration-prometheus-url').value.trim() || null;
        }
        if (!payload.name) {
            alert('Укажите название интеграции');
            return;
        }
        if (integrationId) {
            await api('PUT', `/api/admin/integrations/${integrationId}`, payload);
        } else {
            await api('POST', '/api/admin/integrations', payload);
        }
        closeIntegrationModal();
        await loadIntegrations();
    });

    document.getElementById('audit-search').addEventListener('input', () => applyAuditFilters(true));
    document.getElementById('audit-filter-actor').addEventListener('input', () => applyAuditFilters(true));
    document.getElementById('audit-filter-action').addEventListener('change', () => applyAuditFilters(true));
    document.getElementById('audit-filter-resource').addEventListener('change', () => applyAuditFilters(true));
    document.getElementById('audit-date-from').addEventListener('change', () => applyAuditFilters(true));
    document.getElementById('audit-date-to').addEventListener('change', () => applyAuditFilters(true));
    document.getElementById('audit-refresh-btn').addEventListener('click', () => loadAudit(false));
    document.getElementById('audit-export-csv-btn').addEventListener('click', () => exportAudit('csv'));
    document.getElementById('audit-export-json-btn').addEventListener('click', () => exportAudit('json'));
    document.getElementById('audit-purge-btn').addEventListener('click', () => purgeAuditLog());
    refreshAuditPurgeAvailability();
    document.getElementById('audit-sort-date').addEventListener('click', () => {
        auditSortDesc = !auditSortDesc;
        document.getElementById('audit-sort-date').textContent = auditSortDesc
            ? 'Сортировка: новые сверху'
            : 'Сортировка: старые сверху';
        applyAuditFilters(true);
    });
    document.getElementById('audit-clear-filters').addEventListener('click', () => {
        document.getElementById('audit-search').value = '';
        document.getElementById('audit-filter-actor').value = '';
        document.getElementById('audit-filter-action').value = '';
        document.getElementById('audit-filter-resource').value = '';
        document.getElementById('audit-date-from').value = '';
        document.getElementById('audit-date-to').value = '';
        auditSortDesc = true;
        document.getElementById('audit-sort-date').textContent = 'Сортировка: новые сверху';
        applyAuditFilters(true);
    });

    const SERVER_LOGS_EXPORT_JOB_KEY = 'awm_admin_server_logs_export_job_id';
    let lastServerLogsExportJobId = sessionStorage.getItem(SERVER_LOGS_EXPORT_JOB_KEY) || '';
    let serverLogEntriesCache = [];

    function setServerLogPlaceholder(text) {
        const contentEl = document.getElementById('server-log-content');
        if (!contentEl) return;
        contentEl.innerHTML = `<div class="server-log-empty">${escapeHtml(text || '')}</div>`;
    }

    function renderServerLogEntries(entries) {
        const contentEl = document.getElementById('server-log-content');
        const debugOn = !!document.getElementById('server-log-debug')?.checked;
        if (window.AwmServerLogs) {
            window.AwmServerLogs.renderInto(contentEl, entries, {
                debug: debugOn,
                scrollToBottom: true,
            });
            return;
        }
        setServerLogPlaceholder(debugOn ? '(пусто)' : 'Нет строк без DBG.');
    }

    function openServerLogsLiveWindow() {
        const name = selectedServerLogName || 'server.log';
        const debug = document.getElementById('server-log-debug')?.checked ? '1' : '0';
        const url = `/admin/server-logs/live?name=${encodeURIComponent(name)}&debug=${debug}`;
        const popup = window.open(url, 'awm_server_logs_live', 'width=1280,height=820,resizable=yes,scrollbars=yes');
        if (!popup) {
            window.open(url, '_blank', 'noopener');
        } else {
            try { popup.focus(); } catch (_e) { /* ignore */ }
        }
    }

    function setServerLogsPurgeEnabled(enabled) {
        const btn = document.getElementById('server-logs-purge-btn');
        if (!btn) return;
        btn.disabled = !enabled;
        btn.title = enabled
            ? 'Удалить файлы, попавшие в последний успешный ZIP-экспорт'
            : 'Сначала выполните экспорт ZIP';
    }

    async function refreshServerLogsPurgeAvailability() {
        if (!lastServerLogsExportJobId) {
            setServerLogsPurgeEnabled(false);
            return;
        }
        try {
            const st = await api('GET', `/api/admin/server-logs/export/jobs/${encodeURIComponent(lastServerLogsExportJobId)}`);
            setServerLogsPurgeEnabled(!!st.purge_eligible);
            if (st.purged) {
                lastServerLogsExportJobId = '';
                sessionStorage.removeItem(SERVER_LOGS_EXPORT_JOB_KEY);
                setServerLogsPurgeEnabled(false);
            }
        } catch (_e) {
            setServerLogsPurgeEnabled(false);
        }
    }

    async function exportServerLogsZip() {
        if (typeof awmConfirmHeavyTask === 'function') {
            if (!(await awmConfirmHeavyTask('экспорт серверных логов (ZIP)'))) return;
        }
        try {
            const started = await api('POST', '/api/admin/server-logs/export/jobs', {});
            if (!started.job_id) throw new Error('Не получен идентификатор задачи');
            const poll = async () => {
                const st = await api('GET', `/api/admin/server-logs/export/jobs/${encodeURIComponent(started.job_id)}`);
                if (st.status === 'completed') return st;
                if (st.status === 'failed') throw new Error(st.error || 'Ошибка экспорта логов');
                await new Promise((r) => setTimeout(r, 1500));
                return poll();
            };
            const done = await poll();
            const response = await fetch(
                done.download_url || `/api/admin/server-logs/export/jobs/${encodeURIComponent(started.job_id)}/download`,
                { credentials: 'same-origin' }
            );
            if (!response.ok) {
                let detail = `HTTP ${response.status}`;
                try {
                    const err = await response.json();
                    detail = err.detail || detail;
                } catch (_e) { /* ignore */ }
                throw new Error(typeof detail === 'string' ? detail : JSON.stringify(detail));
            }
            const blob = await response.blob();
            const cd = response.headers.get('Content-Disposition') || '';
            const match = /filename=\"?([^\";]+)\"?/i.exec(cd);
            const filename = match ? match[1] : 'awm-server-logs.zip';
            const link = document.createElement('a');
            const objectUrl = URL.createObjectURL(blob);
            link.href = objectUrl;
            link.download = filename;
            document.body.appendChild(link);
            link.click();
            link.remove();
            URL.revokeObjectURL(objectUrl);
            lastServerLogsExportJobId = started.job_id;
            sessionStorage.setItem(SERVER_LOGS_EXPORT_JOB_KEY, lastServerLogsExportJobId);
            setServerLogsPurgeEnabled(true);
            await loadServerLogs();
        } catch (e) {
            alert(`Не удалось выгрузить логи: ${e.message || e}`);
        }
    }

    async function purgeServerLogs() {
        if (!lastServerLogsExportJobId) {
            alert('Сначала выполните экспорт ZIP.');
            return;
        }
        const confirmFn = typeof awmConfirm === 'function' ? awmConfirm : null;
        const ok = confirmFn
            ? await confirmFn(
                'Удалить файлы логов, попавшие в последний ZIP-экспорт? Активный server.log будет очищен. Действие необратимо.',
                'Очистка серверных логов'
            )
            : window.confirm('Очистить серверные логи по последнему экспорту?');
        if (!ok) return;
        try {
            const result = await api('POST', '/api/admin/server-logs/purge', {
                export_job_id: lastServerLogsExportJobId,
            });
            lastServerLogsExportJobId = '';
            sessionStorage.removeItem(SERVER_LOGS_EXPORT_JOB_KEY);
            setServerLogsPurgeEnabled(false);
            alert(`Очищено файлов: ${result.deleted_files ?? 0}`);
            selectedServerLogName = null;
            await loadServerLogs();
        } catch (e) {
            alert(`Не удалось очистить логи: ${e.message || e}`);
            await refreshServerLogsPurgeAvailability();
        }
    }

    async function downloadServerLogFile(encodedName) {
        const name = decodeURIComponent(encodedName);
        try {
            const response = await fetch(
                `/api/admin/server-logs/${encodeURIComponent(name)}/download`,
                { credentials: 'same-origin' }
            );
            if (!response.ok) {
                let detail = `HTTP ${response.status}`;
                try {
                    const err = await response.json();
                    detail = err.detail || detail;
                } catch (_e) { /* ignore */ }
                throw new Error(typeof detail === 'string' ? detail : JSON.stringify(detail));
            }
            const blob = await response.blob();
            const cd = response.headers.get('Content-Disposition') || '';
            const match = /filename=\"?([^\";]+)\"?/i.exec(cd);
            const filename = match ? match[1] : name;
            const link = document.createElement('a');
            const objectUrl = URL.createObjectURL(blob);
            link.href = objectUrl;
            link.download = filename;
            document.body.appendChild(link);
            link.click();
            link.remove();
            URL.revokeObjectURL(objectUrl);
        } catch (e) {
            alert(`Не удалось скачать файл: ${e.message || e}`);
        }
    }

    async function loadServerLogs() {
        const listEl = document.getElementById('server-logs-list');
        const currentEl = document.getElementById('server-log-current');
        try {
            const data = await api('GET', '/api/admin/server-logs');
            serverLogsItems = data.items || [];
            if (!serverLogsItems.length) {
                listEl.innerHTML = '<div class="empty-state">Логи сервера пока не созданы.</div>';
                selectedServerLogName = null;
                currentEl.textContent = 'Файл не выбран';
                serverLogEntriesCache = [];
                setServerLogPlaceholder('Лог не загружен.');
                return;
            }
            if (!selectedServerLogName || !serverLogsItems.some((x) => x.name === selectedServerLogName)) {
                selectedServerLogName = serverLogsItems[0].name;
            }
            listEl.innerHTML = serverLogsItems.map((item) => `
                <div class="list-item">
                    <div class="list-item-info">
                        <div class="list-item-name">${escapeHtml(item.name)}</div>
                        <div class="list-item-meta">
                            <span>Размер: ${Math.max(1, Math.round((item.size_bytes || 0) / 1024))} KB</span>
                            <span>Обновлен: ${escapeHtml(item.updated_at || '')}</span>
                        </div>
                    </div>
                    <div class="list-item-actions">
                        <button class="btn btn-primary btn-sm" onclick="openServerLog('${encodeURIComponent(item.name)}')">Открыть</button>
                        <button class="btn btn-secondary btn-sm" onclick="downloadServerLogFile('${encodeURIComponent(item.name)}')">Скачать</button>
                    </div>
                </div>
            `).join('');
            await reloadSelectedServerLog();
        } catch (e) {
            if (handleAdminLicenseError(e, listEl)) {
                selectedServerLogName = null;
                currentEl.textContent = 'Недоступно';
                serverLogEntriesCache = [];
                setServerLogPlaceholder('');
                return;
            }
            listEl.innerHTML = `<div class="empty-state">Ошибка загрузки логов: ${escapeHtml(e.message || String(e))}</div>`;
        }
    }

    async function loadServerLogPolicy() {
        try {
            const policy = await api('GET', '/api/admin/server-logs/policy');
            document.getElementById('server-log-policy-lines').value = policy.max_lines ?? 200000;
            document.getElementById('server-log-policy-bytes').value = policy.max_bytes ?? 10485760;
            document.getElementById('server-log-policy-age').value = policy.max_age_hours ?? 24;
            document.getElementById('server-log-policy-retention').value = policy.retention_files ?? 20;
        } catch (e) {
            console.error('Failed to load log policy', e);
        }
    }

    async function saveServerLogPolicy() {
        const payload = {
            max_lines: Number(document.getElementById('server-log-policy-lines').value || 200000),
            max_bytes: Number(document.getElementById('server-log-policy-bytes').value || 10485760),
            max_age_hours: Number(document.getElementById('server-log-policy-age').value || 24),
            retention_files: Number(document.getElementById('server-log-policy-retention').value || 20),
        };
        await api('PUT', '/api/admin/server-logs/policy', payload);
        await loadServerLogPolicy();
        await loadServerLogs();
    }

    async function openServerLog(encodedName) {
        selectedServerLogName = decodeURIComponent(encodedName);
        await reloadSelectedServerLog();
    }

    async function reloadSelectedServerLog() {
        const currentEl = document.getElementById('server-log-current');
        const lines = Number(document.getElementById('server-log-lines').value || 300);
        if (!selectedServerLogName) {
            currentEl.textContent = 'Файл не выбран';
            serverLogEntriesCache = [];
            setServerLogPlaceholder('Лог не загружен.');
            return;
        }
        currentEl.textContent = selectedServerLogName;
        try {
            const data = await api('GET', `/api/admin/server-logs/${encodeURIComponent(selectedServerLogName)}?lines=${lines}`);
            serverLogEntriesCache = Array.isArray(data.entries) ? data.entries : [];
            if (!serverLogEntriesCache.length && data.content) {
                // Совместимость со старым ответом API без entries.
                serverLogEntriesCache = String(data.content).split('\n').map((line) => ({
                    ts: '',
                    level: '',
                    logger: '',
                    message: line,
                    raw: line,
                    is_debug: /\bDBG\b|\[DEBUG\]/i.test(line),
                    kind: 'raw',
                }));
            }
            renderServerLogEntries(serverLogEntriesCache);
        } catch (e) {
            serverLogEntriesCache = [];
            setServerLogPlaceholder(`Ошибка чтения лога: ${e.message || e}`);
        }
    }

    document.getElementById('server-log-debug')?.addEventListener('change', () => {
        renderServerLogEntries(serverLogEntriesCache);
    });
    document.getElementById('server-log-lines')?.addEventListener('change', () => {
        reloadSelectedServerLog().catch(() => {});
    });

    async function initAdmin() {
        applyAdminSectionVisibility();
        applySingleOfficeUsersUi();
        applyDemoAdminRestrictions();
        initializeAdminSpoilers();
        if (window.awmTimezones) {
            window.awmTimezones.fillSelect(document.getElementById('backup-plan-timezone'), {
                value: 'Europe/Moscow',
                includeEmpty: false,
            });
        }
        const params = new URLSearchParams(window.location.search);
        if (params.get('guacamole') === 'denied') {
            await awmAlert('Удалённое управление недоступно: нужна лицензия Corp и право настройки Guacamole.');
            params.delete('guacamole');
            const next = params.toString();
            window.history.replaceState({}, '', next ? ('/admin?' + next) : '/admin');
        }
        if (params.get('guacamole') === 'setup' && hasAdminAccess('remote_desktop')) {
            window.location.replace('/settings#settings-spoiler-guacamole');
            return;
        }
        if (hasAdminAccess('remote_desktop')) {
            adminGuacamoleRefreshAdmin();
        }
    }

    initAdmin();
</script>
{% endblock %}