breadcrumb-the-shire/pages/admin/tenants/_form.phtml

<?php

/**
 * @var array $values
 * @var string|null $formId
 * @var bool $detailsOpenAll
 * @var bool $isReadOnly
 * @var bool $showDangerZone
 * @var string|null $dangerZoneDeleteFormId
 * @var string|null $dangerZoneWarning
 * @var string|null $dangerZoneActionLabel
 * @var bool $showCustomFieldsTab
 * @var bool $showSsoTab
 * @var string|null $customFieldTenantUuid
 * @var array $customFieldDefinitions
 * @var array $ssoUiState
 */

use MintyPHP\Service\Auth\AuthServicesFactory;
use MintyPHP\Session;

$tenantSsoService = (new AuthServicesFactory())->createTenantSsoService();
$values = $values ?? [];
$formId = $formId ?? 'tenant-form';
$detailsOpenAll = $detailsOpenAll ?? false;
$isReadOnly = $isReadOnly ?? false;
$showDangerZone = (bool) ($showDangerZone ?? false);
$dangerZoneDeleteFormId = (string) ($dangerZoneDeleteFormId ?? '');
$dangerZoneWarning = (string) ($dangerZoneWarning ?? t('This action cannot be undone.'));
$dangerZoneActionLabel = (string) ($dangerZoneActionLabel ?? t('Delete'));
$showCustomFieldsTab = (bool) ($showCustomFieldsTab ?? false);
$showSsoTab = (bool) ($showSsoTab ?? false);
$customFieldTenantUuid = trim((string) ($customFieldTenantUuid ?? ''));
$customFieldDefinitions = is_array($customFieldDefinitions ?? null) ? $customFieldDefinitions : [];
$readonlyAttr = $isReadOnly ? 'readonly' : '';
$disabledAttr = $isReadOnly ? 'disabled' : '';
$themes = appThemes();
$primaryColor = (string) ($values['primary_color'] ?? '');
$defaultPrimaryColor = appSetting('app_primary_color') ?? '#2fa4a4';
$useDefaultPrimaryColor = $primaryColor === '';
$tenantDefaultTheme = strtolower(trim((string) ($values['default_theme'] ?? '')));
if ($tenantDefaultTheme !== '' && !isset($themes[$tenantDefaultTheme])) {
  $tenantDefaultTheme = '';
}
$rawAllowUserThemeMode = $values['allow_user_theme_mode'] ?? ($values['allow_user_theme'] ?? null);
if ($rawAllowUserThemeMode === null || $rawAllowUserThemeMode === '') {
  $tenantAllowUserThemeMode = '';
} elseif (in_array(strtolower((string) $rawAllowUserThemeMode), ['1', 'true', 'yes', 'on'], true)) {
  $tenantAllowUserThemeMode = '1';
} else {
  $tenantAllowUserThemeMode = '0';
}
$microsoftEnabledRaw = $values['microsoft_enabled'] ?? $values['enabled'] ?? false;
$microsoftEnabled = in_array(strtolower(trim((string) $microsoftEnabledRaw)), ['1', 'true', 'yes', 'on'], true);
$microsoftEnforceRaw = $values['enforce_microsoft_login'] ?? false;
$microsoftEnforce = in_array(strtolower(trim((string) $microsoftEnforceRaw)), ['1', 'true', 'yes', 'on'], true);
$entraTenantId = strtolower(trim((string) ($values['entra_tenant_id'] ?? '')));
$allowedDomains = trim((string) ($values['allowed_domains'] ?? ''));
$useSharedAppRaw = $values['use_shared_app'] ?? 1;
$useSharedApp = !in_array(strtolower(trim((string) $useSharedAppRaw)), ['0', 'false', 'no', 'off'], true);
$clientIdOverride = trim((string) ($values['client_id_override'] ?? ''));
$syncProfileOnLoginRaw = $values['sync_profile_on_login'] ?? false;
$syncProfileOnLogin = in_array(strtolower(trim((string) $syncProfileOnLoginRaw)), ['1', 'true', 'yes', 'on'], true);
$syncFieldOptions = $tenantSsoService->profileSyncFieldOptions();
$syncProfileFieldsRaw = $values['sync_profile_fields_list'] ?? ($values['sync_profile_fields'] ?? []);
$syncProfileFields = $tenantSsoService->normalizeProfileSyncFields($syncProfileFieldsRaw);
$tenantId = (int) ($values['id'] ?? 0);
$ssoUiState = is_array($ssoUiState ?? null)
  ? $ssoUiState
  : $tenantSsoService->buildMicrosoftUiState($tenantId, $values);
$ssoConfigComplete = !empty($ssoUiState['config_complete']);
$ssoConfigErrorLabel = trim((string) ($ssoUiState['config_error_label'] ?? ''));
$ssoPasswordMode = (string) ($ssoUiState['password_mode'] ?? ($microsoftEnforce ? 'microsoft_only' : 'local_and_microsoft'));
$ssoCredentialSource = (string) ($ssoUiState['credential_source'] ?? ($useSharedApp ? 'shared' : 'override'));
$ssoSyncNeedsGraph = !empty($ssoUiState['sync_needs_graph']);

?>
<form id="<?php e($formId); ?>" method="post">
  <div class="app-tabs" data-tabs data-tabs-param="tab" data-tabs-storage-key="admin-tenant-form">
    <div class="app-tabs-nav">
      <button type="button" data-tab="basic" data-tab-default><?php e(t('Master data')); ?></button>
      <?php if ($showCustomFieldsTab): ?>
        <button type="button" data-tab="custom_fields"><?php e(t('User custom fields')); ?></button>
      <?php endif; ?>
      <?php if ($showSsoTab): ?>
        <button type="button" data-tab="sso"><?php e(t('SSO')); ?></button>
      <?php endif; ?>
      <button type="button" data-tab="visibility"><?php e(t('Visibility')); ?></button>
      <?php if ($showDangerZone && $dangerZoneDeleteFormId !== ''): ?>
        <button type="button" data-tab="danger"><?php e(t('Danger zone')); ?></button>
      <?php endif; ?>
    </div>

    <div data-tab-panel="basic">
      <div class="grid">
        <label for="description">
          <span><?php e(t('Description')); ?></span>
          <input required type="text" name="description" id="description" value="<?php e($values['description'] ?? ''); ?>"
            <?php e($readonlyAttr); ?> />
        </label>
      </div>
      <label for="address">
        <span><?php e(t('Address')); ?></span>
        <input type="text" name="address" id="address" value="<?php e($values['address'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
      </label>
      <div class="grid">
        <label for="postal_code">
          <span><?php e(t('Postal code')); ?></span>
          <input type="text" name="postal_code" id="postal_code" value="<?php e($values['postal_code'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
        </label>
        <label for="city">
          <span><?php e(t('City')); ?></span>
          <input type="text" name="city" id="city" value="<?php e($values['city'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
        </label>
      </div>
      <div class="grid">
        <label for="country">
          <span><?php e(t('Country')); ?></span>
          <input type="text" name="country" id="country" value="<?php e($values['country'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
        </label>
        <label for="region">
          <span><?php e(t('Region')); ?></span>
          <input type="text" name="region" id="region" value="<?php e($values['region'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
        </label>
      </div>
      <div class="grid">
        <label for="vat_id">
          <span><?php e(t('VAT ID')); ?></span>
          <input type="text" name="vat_id" id="vat_id" value="<?php e($values['vat_id'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
        </label>
        <label for="tax_number">
          <span><?php e(t('Tax number')); ?></span>
          <input type="text" name="tax_number" id="tax_number" value="<?php e($values['tax_number'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
        </label>
      </div>
      <hr>
      <details name="tenant-master-contact" <?php e($detailsOpenAll ? 'open' : ''); ?>>
        <summary><?php e(t('Contact')); ?></summary>
        <hr>
        <div class="grid">
          <label for="phone">
            <span><?php e(t('Phone')); ?></span>
            <input type="tel" name="phone" id="phone" value="<?php e($values['phone'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
          </label>
          <label for="fax">
            <span><?php e(t('Fax')); ?></span>
            <input type="tel" name="fax" id="fax" value="<?php e($values['fax'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
          </label>
        </div>
        <div class="grid">
          <label for="email">
            <span><?php e(t('Email')); ?></span>
            <input type="email" name="email" id="email" value="<?php e($values['email'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
          </label>
          <label for="website">
            <span><?php e(t('Website')); ?></span>
            <input type="url" name="website" id="website" value="<?php e($values['website'] ?? ''); ?>" <?php e($readonlyAttr); ?> />
          </label>
        </div>
        <div class="grid">
          <label for="support_email">
            <span><?php e(t('Support email')); ?></span>
            <input type="email" name="support_email" id="support_email" value="<?php e($values['support_email'] ?? ''); ?>"
              <?php e($readonlyAttr); ?> />
          </label>
          <label for="support_phone">
            <span><?php e(t('Support phone')); ?></span>
            <input type="tel" name="support_phone" id="support_phone" value="<?php e($values['support_phone'] ?? ''); ?>"
              <?php e($readonlyAttr); ?> />
          </label>
        </div>
        <label for="billing_email">
          <span><?php e(t('Billing email')); ?></span>
          <input type="email" name="billing_email" id="billing_email" value="<?php e($values['billing_email'] ?? ''); ?>"
            <?php e($readonlyAttr); ?> />
        </label>
      </details>
      <hr>
      <details name="tenant-master-legal" <?php e($detailsOpenAll ? 'open' : ''); ?>>
        <summary><?php e(t('Legal')); ?></summary>
        <hr>
        <div class="grid">
          <label for="privacy_url">
            <span><?php e(t('Privacy URL')); ?></span>
            <input type="url" name="privacy_url" id="privacy_url" value="<?php e($values['privacy_url'] ?? ''); ?>"
              <?php e($readonlyAttr); ?> />
          </label>
          <label for="imprint_url">
            <span><?php e(t('Imprint URL')); ?></span>
            <input type="url" name="imprint_url" id="imprint_url" value="<?php e($values['imprint_url'] ?? ''); ?>"
              <?php e($readonlyAttr); ?> />
          </label>
        </div>
      </details>
    </div>

    <?php if ($showCustomFieldsTab): ?>
      <div data-tab-panel="custom_fields">
        <?php if ($customFieldTenantUuid === ''): ?>
          <p class="muted"><?php e(t('Save tenant first to manage custom fields')); ?></p>
        <?php else: ?>
          <blockquote data-variant="info">
            <?php e(t('Define custom fields here. They appear per user in the "Custom fields" tab and can be maintained there.')); ?>
          </blockquote>
          <hr>
          <details name="tenant-custom-fields-create">
            <summary><?php e(t('Add custom field')); ?> +</summary>
            <hr>
            <fieldset>
              <div class="grid">
              <label for="tenant-custom-field-label">
                <span><?php e(t('Label')); ?></span>
                <input
                  id="tenant-custom-field-label"
                  form="tenant-custom-field-create-form"
                    required
                    type="text"
                  name="label"
                  <?php e($disabledAttr); ?>
                >
                <small class="muted"><?php e(t('The label is shown in user custom fields and in address book filters.')); ?></small>
              </label>

                <label for="tenant-custom-field-type">
                  <span><?php e(t('Field type')); ?></span>
                  <select
                    id="tenant-custom-field-type"
                    form="tenant-custom-field-create-form"
                    name="type"
                    data-custom-field-type-source
                    data-custom-field-group="tenant-custom-field-create"
                    <?php e($disabledAttr); ?>
                  >
                    <option value="text"><?php e(t('Text')); ?></option>
                    <option value="textarea"><?php e(t('Textarea')); ?></option>
                    <option value="select"><?php e(t('Select')); ?></option>
                    <option value="multiselect"><?php e(t('Multiselect')); ?></option>
                    <option value="boolean"><?php e(t('Boolean')); ?></option>
                    <option value="date"><?php e(t('Date')); ?></option>
                  </select>
                  <small class="muted"><?php e(t('The field type controls input and filter behavior.')); ?></small>
                </label>
              </div>
              <div class="grid">
                <fieldset data-custom-field-filterable-target data-custom-field-group="tenant-custom-field-create">
                  <legend><small><?php e(t('Filterable')); ?></small></legend>
                  <label class="app-field">
                    <input form="tenant-custom-field-create-form" type="checkbox" name="is_filterable" value="1"
                      data-custom-field-filterable-input
                      <?php e($disabledAttr); ?>>
                    <span><?php e(t('Filterable')); ?></span>
                  </label>
                  <small class="muted"><?php e(t('Filterable fields are available in address book filters.')); ?></small>
                </fieldset>
                <fieldset>
                  <legend><small><?php e(t('Active')); ?></small></legend>
                  <label class="app-field">
                    <input form="tenant-custom-field-create-form" type="checkbox" name="active" value="1" checked
                      <?php e($disabledAttr); ?>>
                    <span><?php e(t('Active')); ?></span>
                  </label>
                  <small class="muted"><?php e(t('Inactive fields are hidden in forms and filters.')); ?></small>
                </fieldset>
              </div>
              <div data-custom-field-options-target data-custom-field-group="tenant-custom-field-create">
                <label for="tenant-custom-field-options-text">
                  <span><?php e(t('Options (one per line)')); ?></span>
                  <textarea
                    id="tenant-custom-field-options-text"
                    form="tenant-custom-field-create-form"
                    name="options_text"
                    rows="5"
                    placeholder="<?php e(t('Example: manager|Manager')); ?>"
                    <?php e($readonlyAttr); ?>
                  ></textarea>
                  <small class="muted"><?php e(t('One option per line. Optional format: key|Label.')); ?></small>
                </label>
              </div>
              <button type="submit" class="primary" form="tenant-custom-field-create-form" <?php e($disabledAttr); ?>>
                <?php e(t('Add custom field')); ?>
              </button>
            </fieldset>
          </details>
          <hr>
          <?php if (!$customFieldDefinitions): ?>
            <p class="muted"><?php e(t('No custom fields configured yet')); ?></p>
          <?php endif; ?>
          <?php foreach ($customFieldDefinitions as $definition): ?>
            <?php
            $definitionId = (int) ($definition['id'] ?? 0);
            $definitionUuid = (string) ($definition['uuid'] ?? '');
            if ($definitionId <= 0 || $definitionUuid === '') {
              continue;
            }
            $updateFormId = 'tenant-custom-field-update-form-' . $definitionId;
            $deleteFormId = 'tenant-custom-field-delete-form-' . $definitionId;
            $typeGroupId = 'tenant-custom-field-edit-' . $definitionId;
            $definitionType = strtolower((string) ($definition['type'] ?? 'text'));
            $definitionTypeLabel = t(ucfirst($definitionType));
            $definitionOptions = is_array($definition['options'] ?? null) ? $definition['options'] : [];
            $definitionOptionsText = '';
            foreach ($definitionOptions as $option) {
              $optionKey = trim((string) ($option['option_key'] ?? ''));
              $optionLabel = trim((string) ($option['label'] ?? ''));
              if ($optionLabel === '') {
                continue;
              }
              $definitionOptionsText .= ($definitionOptionsText === '' ? '' : "\n")
                . ($optionKey !== '' ? ($optionKey . '|') : '')
                . $optionLabel;
            }
            ?>
            <details name="tenant-custom-fields">
              <summary>
                <?php e((string) ($definition['label'] ?? '')); ?>
                <span class="badge" data-variant="neutral"><?php e($definitionTypeLabel); ?></span>
              </summary>
              <hr>
              <div class="grid">
              <label>
                <span><?php e(t('Label')); ?></span>
                <input
                  type="text"
                  form="<?php e($updateFormId); ?>"
                  name="label"
                  required
                  value="<?php e((string) ($definition['label'] ?? '')); ?>"
                  <?php e($readonlyAttr); ?>
                >
                <small class="muted"><?php e(t('The label is shown in user custom fields and in address book filters.')); ?></small>
              </label>
                <label>
                  <span><?php e(t('Field type')); ?></span>
                  <select
                    form="<?php e($updateFormId); ?>"
                    name="type"
                    data-custom-field-type-source
                    data-custom-field-group="<?php e($typeGroupId); ?>"
                    <?php e($disabledAttr); ?>
                  >
                    <?php foreach (['text', 'textarea', 'select', 'multiselect', 'boolean', 'date'] as $typeOption): ?>
                      <option value="<?php e($typeOption); ?>" <?php e($definitionType === $typeOption ? 'selected' : ''); ?>>
                        <?php e(t(ucfirst($typeOption))); ?>
                      </option>
                    <?php endforeach; ?>
                  </select>
                  <small class="muted"><?php e(t('The field type controls input and filter behavior.')); ?></small>
                </label>
              </div>
              <div class="grid">
                <fieldset data-custom-field-filterable-target data-custom-field-group="<?php e($typeGroupId); ?>">
                  <legend><small><?php e(t('Filterable')); ?></small></legend>
                  <label class="app-field">
                    <input type="checkbox" form="<?php e($updateFormId); ?>" name="is_filterable" value="1"
                      data-custom-field-filterable-input
                      <?php e(!empty($definition['is_filterable']) ? 'checked' : ''); ?>
                      <?php e($disabledAttr); ?>>
                    <span><?php e(t('Filterable')); ?></span>
                  </label>
                  <small class="muted"><?php e(t('Filterable fields are available in address book filters.')); ?></small>
                </fieldset>
                <fieldset>
                  <legend><small><?php e(t('Active')); ?></small></legend>
                  <label class="app-field">
                    <input type="hidden" form="<?php e($updateFormId); ?>" name="active" value="0">
                    <input type="checkbox" form="<?php e($updateFormId); ?>" name="active" value="1"
                      <?php e(!empty($definition['active']) ? 'checked' : ''); ?>
                      <?php e($disabledAttr); ?>>
                    <span><?php e(t('Active')); ?></span>
                  </label>
                  <small class="muted"><?php e(t('Inactive fields are hidden in forms and filters.')); ?></small>
                </fieldset>
              </div>
              <div data-custom-field-options-target data-custom-field-group="<?php e($typeGroupId); ?>">
                <label>
                  <span><?php e(t('Options (one per line)')); ?></span>
                  <textarea
                    form="<?php e($updateFormId); ?>"
                    name="options_text"
                    rows="5"
                    placeholder="<?php e(t('Example: manager|Manager')); ?>"
                    <?php e($readonlyAttr); ?>
                  ><?php e($definitionOptionsText); ?></textarea>
                </label>
                <small class="muted"><?php e(t('One option per line. Optional format: key|Label.')); ?></small>
              </div>
              <hr>
              <div class="grid">
                <button type="submit" class="primary" form="<?php e($updateFormId); ?>" <?php e($disabledAttr); ?>>
                  <?php e(t('Save')); ?>
                </button>
                <button type="submit" class="danger" form="<?php e($deleteFormId); ?>" <?php e($disabledAttr); ?>>
                  <?php e(t('Delete custom field')); ?>
                </button>
              </div>
            </details>
            <hr>
          <?php endforeach; ?>
        <?php endif; ?>
      </div>
    <?php endif; ?>

    <?php if ($showSsoTab): ?>
      <div data-tab-panel="sso" data-tenant-sso-root>
        <fieldset>
          <legend><small><?php e(t('SSO configuration status')); ?></small></legend>
          <div class="grid grid-1-1">
            <div>
              <small><?php e(t('Microsoft login')); ?></small>
              <div><strong><?php e($microsoftEnabled ? t('Active') : t('Inactive')); ?></strong></div>
            </div>
            <div>
              <small><?php e(t('Configuration complete')); ?></small>
              <div><strong><?php e($ssoConfigComplete ? t('Yes') : t('No')); ?></strong></div>
            </div>
            <div>
              <small><?php e(t('Password login mode')); ?></small>
              <div>
                <strong>
                  <?php e($ssoPasswordMode === 'microsoft_only' ? t('Microsoft only') : t('Local password + Microsoft')); ?>
                </strong>
              </div>
            </div>
            <div>
              <small><?php e(t('Credentials source')); ?></small>
              <div>
                <strong>
                  <?php e($ssoCredentialSource === 'shared' ? t('Shared app') : t('Tenant override')); ?>
                </strong>
              </div>
            </div>
          </div>
          <?php if ($microsoftEnabled && !$ssoConfigComplete && $ssoConfigErrorLabel !== ''): ?>
            <hr>
            <small class="muted"><?php e($ssoConfigErrorLabel); ?></small>
          <?php endif; ?>
        </fieldset>

        <fieldset>
          <legend><small><?php e(t('Required Microsoft configuration')); ?></small></legend>
          <label class="app-field">
            <input
              type="checkbox"
              name="microsoft_enabled"
              value="1"
              data-tenant-sso-enabled
              <?php e($microsoftEnabled ? 'checked' : ''); ?>
              <?php e($disabledAttr); ?>
            >
            <span><?php e(t('Enable Microsoft login for this tenant')); ?></span>
          </label>
          <small class="muted"><?php e(t('Required for Microsoft login.')); ?></small>
          <hr>
          <label>
            <span><?php e(t('Entra tenant ID (tid)')); ?></span>
            <input
              type="text"
              name="entra_tenant_id"
              value="<?php e($entraTenantId); ?>"
              placeholder="00000000-0000-0000-0000-000000000000"
              <?php e($readonlyAttr); ?>
            >
          </label>
          <label class="app-field">
            <input
              type="checkbox"
              name="enforce_microsoft_login"
              value="1"
              <?php e($microsoftEnforce ? 'checked' : ''); ?>
              <?php e($disabledAttr); ?>
            >
            <span><?php e(t('Disable password login for this tenant login')); ?></span>
          </label>
          <small class="muted"><?php e(t('Microsoft-only login requires a complete configuration')); ?></small>
        </fieldset>

        <fieldset data-tenant-sso-when-enabled>
          <legend><small><?php e(t('Optional restrictions')); ?></small></legend>
          <label>
            <span><?php e(t('Allowed email domains')); ?></span>
            <textarea name="allowed_domains" rows="3" placeholder="example.com&#10;partner.com" <?php e($readonlyAttr); ?>><?php e($allowedDomains); ?></textarea>
            <small><?php e(t('Optional allow-list, comma or newline separated (example.com).')); ?></small>
          </label>
        </fieldset>

        <fieldset data-tenant-sso-when-enabled>
          <legend><small><?php e(t('Profile sync (optional)')); ?></small></legend>
          <label class="app-field">
            <input
              type="checkbox"
              name="sync_profile_on_login"
              value="1"
              data-tenant-sso-sync-toggle
              <?php e($syncProfileOnLogin ? 'checked' : ''); ?>
              <?php e($disabledAttr); ?>
            >
            <span><?php e(t('Profile sync on Microsoft login')); ?></span>
          </label>
          <small class="muted"><?php e(t('User profile fields are global and affect all tenants of this user')); ?></small>
          <div data-tenant-sso-sync-fields>
            <hr>
            <label><span><?php e(t('Sync fields')); ?></span></label>
            <div class="grid grid-1-1">
              <?php foreach ($syncFieldOptions as $syncFieldKey => $syncFieldLabel): ?>
                <label class="app-field">
                  <input
                    type="checkbox"
                    name="sync_profile_fields[]"
                    value="<?php e($syncFieldKey); ?>"
                    <?php e(in_array($syncFieldKey, $syncProfileFields, true) ? 'checked' : ''); ?>
                    <?php e($disabledAttr); ?>
                  >
                  <span><?php e(t($syncFieldLabel)); ?></span>
                </label>
              <?php endforeach; ?>
            </div>
            <?php if ($ssoSyncNeedsGraph): ?>
              <hr>
              <small class="muted"><?php e(t('Phone/mobile/avatar sync requires Microsoft Graph (User.Read)')); ?></small>
            <?php endif; ?>
          </div>
        </fieldset>

        <details data-tenant-sso-override-details data-remember-state="admin-tenant-sso-override">
          <summary><?php e(t('Advanced app override')); ?></summary>
          <hr>
          <label class="app-field" data-tenant-sso-when-enabled>
            <input type="hidden" name="use_shared_app" value="0">
            <input
              type="checkbox"
              name="use_shared_app"
              value="1"
              data-tenant-sso-shared-toggle
              <?php e($useSharedApp ? 'checked' : ''); ?>
              <?php e($disabledAttr); ?>
            >
            <span><?php e(t('Use shared app credentials from settings')); ?></span>
          </label>
          <small class="muted"><?php e(t('Override only if this tenant needs a separate Entra app.')); ?></small>
          <div class="grid" data-tenant-sso-override-fields>
            <label>
              <span><?php e(t('Client ID override')); ?></span>
              <input type="text" name="client_id_override" value="<?php e($clientIdOverride); ?>" <?php e($readonlyAttr); ?>>
            </label>
            <label>
              <span><?php e(t('Client secret override')); ?></span>
              <input type="password" name="client_secret_override" value="" autocomplete="new-password" <?php e($readonlyAttr); ?>>
              <small><?php e(t('Write-only. Leave empty to keep current secret.')); ?></small>
            </label>
          </div>
          <label class="app-field" data-tenant-sso-override-fields>
            <input type="checkbox" name="clear_client_secret_override" value="1" <?php e($disabledAttr); ?>>
            <span><?php e(t('Clear override secret')); ?></span>
          </label>
        </details>
      </div>
    <?php endif; ?>

    <div data-tab-panel="visibility">
      <blockquote data-variant="info">
        <?php e(t('Using the default color applies the global system appearance.')); ?>
      </blockquote>
      <div class="grid">
        <fieldset>
          <legend><small><?php e(t('Primary color')); ?></small></legend>
          <label for="primary_color">
            <input type="color" name="primary_color" id="primary_color"
              value="<?php e($primaryColor !== '' ? $primaryColor : $defaultPrimaryColor); ?>"
              <?php e($readonlyAttr); ?> />
              <div>
                <?php e(t('Choose color')); ?>
              </div>
          </label>
          <small class="muted"><?php e(t('The primary color affects buttons and accent elements across the app.')); ?></small>
        </fieldset>
        <fieldset>
          <legend>
            <small>
              <?php e(t('Use default color')); ?>
            </small>
          </legend>
          <label class="app-field">
            <input type="hidden" name="primary_color_use_default" value="0">
            <input type="checkbox" name="primary_color_use_default" value="1"
              data-color-default-toggle
              data-color-target="#primary_color"
              data-color-default="<?php e($defaultPrimaryColor); ?>"
              <?php e($useDefaultPrimaryColor ? 'checked' : ''); ?>
              <?php e($readonlyAttr); ?>>
            <span><?php e(t('Use default color')); ?></span>
          </label>
          <small class="muted"><?php e(t('Be careful - this resets the tenants color')); ?></small>
        </fieldset>
      </div>
      <div class="grid">
        <fieldset>
          <legend><small><?php e(t('Default theme')); ?></small></legend>
          <select name="default_theme" <?php e($disabledAttr); ?>>
            <option value=""><?php e(t('Inherit global setting')); ?></option>
            <?php foreach ($themes as $themeKey => $themeLabel): ?>
              <option value="<?php e($themeKey); ?>" <?php e($tenantDefaultTheme === $themeKey ? 'selected' : ''); ?>>
                <?php e(t($themeLabel)); ?>
              </option>
            <?php endforeach; ?>
          </select>
          <small class="muted"><?php e(t('If set, this tenant uses its own default theme instead of the global setting.')); ?></small>
        </fieldset>
        <fieldset>
          <legend><small><?php e(t('User theme policy')); ?></small></legend>
          <select name="allow_user_theme_mode" <?php e($disabledAttr); ?>>
            <option value="" <?php e($tenantAllowUserThemeMode === '' ? 'selected' : ''); ?>>
              <?php e(t('Inherit global setting')); ?>
            </option>
            <option value="1" <?php e($tenantAllowUserThemeMode === '1' ? 'selected' : ''); ?>>
              <?php e(t('Force allow user theme')); ?>
            </option>
            <option value="0" <?php e($tenantAllowUserThemeMode === '0' ? 'selected' : ''); ?>>
              <?php e(t('Force disallow user theme')); ?>
            </option>
          </select>
          <small class="muted"><?php e(t('Controls whether users in this tenant can choose their own theme.')); ?></small>
        </fieldset>
      </div>
      <?php
      $statusFieldName = 'status';
      $statusFieldId = 'tenant-status';
      $statusFieldValue = (string) ($values['status'] ?? 'active');
      $statusFieldOptions = [
        'active' => t('Active'),
        'inactive' => t('Inactive'),
      ];
      $statusFieldHint = t('Inactive tenants are excluded from user access and tenant-scoped data.');
      require templatePath('partials/app-visibility-status-field.phtml');
      ?>
    </div>
    <?php if ($showDangerZone && $dangerZoneDeleteFormId !== ''): ?>
      <div data-tab-panel="danger">
        <?php
        $dangerFormId = $dangerZoneDeleteFormId;
        $dangerLegend = t('Delete');
        $dangerWarning = $dangerZoneWarning;
        $dangerButtonLabel = $dangerZoneActionLabel;
        require templatePath('partials/app-danger-zone-delete-field.phtml');
        ?>
      </div>
    <?php endif; ?>
  </div>
  <?php Session::getCsrfInput(); ?>
</form>
<?php if ($showCustomFieldsTab && $customFieldTenantUuid !== ''): ?>
  <form id="tenant-custom-field-create-form" method="post"
    action="admin/tenants/custom-field-create/<?php e($customFieldTenantUuid); ?>" hidden>
    <?php Session::getCsrfInput(); ?>
  </form>
  <?php foreach ($customFieldDefinitions as $definition): ?>
    <?php
    $definitionId = (int) ($definition['id'] ?? 0);
    $definitionUuid = (string) ($definition['uuid'] ?? '');
    if ($definitionId <= 0 || $definitionUuid === '') {
      continue;
    }
    $updateFormId = 'tenant-custom-field-update-form-' . $definitionId;
    $deleteFormId = 'tenant-custom-field-delete-form-' . $definitionId;
    ?>
    <form id="<?php e($updateFormId); ?>" method="post"
      action="admin/tenants/custom-field-update/<?php e($definitionUuid); ?>" hidden>
      <?php Session::getCsrfInput(); ?>
    </form>
    <form id="<?php e($deleteFormId); ?>" method="post"
      action="admin/tenants/custom-field-delete/<?php e($definitionUuid); ?>" hidden
      onsubmit="return confirm('<?php e(t('Delete custom field')); ?>?');">
      <?php Session::getCsrfInput(); ?>
    </form>
  <?php endforeach; ?>
<?php endif; ?>