<?php
require_once 'header.php';

$me = get_current_user_data();
if (!$me || $me['role'] !== 'admin') {
    echo '<div class="alert alert-danger m-3">Samo administrator može upravljati korisnicima.</div>';
    require_once 'footer.php';
    exit;
}

// Dodavanje novog korisnika
if (isset($_POST['action']) && $_POST['action'] === 'create') {
    $username = trim($_POST['username'] ?? '');
    $password = trim($_POST['password'] ?? '');
    $role     = $_POST['role'] ?? 'user';

    $can_projects  = isset($_POST['can_projects']) ? 1 : 0;
    $can_items     = isset($_POST['can_items']) ? 1 : 0;
    $can_orders    = isset($_POST['can_orders']) ? 1 : 0;
    $can_suppliers = isset($_POST['can_suppliers']) ? 1 : 0;
    $can_receipts  = isset($_POST['can_receipts']) ? 1 : 0;
    $can_stock     = isset($_POST['can_stock']) ? 1 : 0;

    if ($username !== '' && $password !== '') {
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $stmt = $mysqli->prepare("
            INSERT INTO users
                (username, password_hash, role,
                 can_projects, can_items, can_orders,
                 can_suppliers, can_receipts, can_stock)
            VALUES (?,?,?,?,?,?,?,?,?)
        ");
        $stmt->bind_param(
            'sssiiiiii',
            $username, $hash, $role,
            $can_projects, $can_items, $can_orders,
            $can_suppliers, $can_receipts, $can_stock
        );
        $stmt->execute();
        $stmt->close();
        echo '<div class="alert alert-success mb-3">Korisnik dodan.</div>';
    } else {
        echo '<div class="alert alert-danger mb-3">Korisničko ime i lozinka su obavezni.</div>';
    }
}

// Ažuriranje prava postojećih korisnika
if (isset($_POST['action']) && $_POST['action'] === 'update_rights') {
    $uid = (int)($_POST['user_id'] ?? 0);
    if ($uid > 0) {
        $role     = $_POST['role'] ?? 'user';
        $can_projects  = isset($_POST['can_projects']) ? 1 : 0;
        $can_items     = isset($_POST['can_items']) ? 1 : 0;
        $can_orders    = isset($_POST['can_orders']) ? 1 : 0;
        $can_suppliers = isset($_POST['can_suppliers']) ? 1 : 0;
        $can_receipts  = isset($_POST['can_receipts']) ? 1 : 0;
        $can_stock     = isset($_POST['can_stock']) ? 1 : 0;

        $stmt = $mysqli->prepare("
            UPDATE users
            SET role = ?,
                can_projects = ?, can_items = ?, can_orders = ?,
                can_suppliers = ?, can_receipts = ?, can_stock = ?
            WHERE id = ?
        ");
        $stmt->bind_param(
            'siiiiiii',
            $role,
            $can_projects, $can_items, $can_orders,
            $can_suppliers, $can_receipts, $can_stock,
            $uid
        );
        $stmt->execute();
        $stmt->close();

        echo '<div class="alert alert-success mb-3">Prava korisnika ažurirana.</div>';

        if ($uid === $me['id']) {
            unset($_SESSION['user']);
        }
    }
}

$usersRes = $mysqli->query("
    SELECT id, username, role,
           can_projects, can_items, can_orders,
           can_suppliers, can_receipts, can_stock
    FROM users
    ORDER BY username
");
?>
<div class="row g-3 mb-3 align-items-center">
    <div class="col">
        <div class="section-title">Korisnici i prava</div>
        <div class="text-muted small">Dodavanje korisnika i odabir kartica koje smiju koristiti</div>
    </div>
</div>

<div class="row g-3">
    <div class="col-12 col-lg-4">
        <div class="card card-soft">
            <div class="card-header card-soft-header">
                <span class="fw-semibold">Novi korisnik</span>
            </div>
            <div class="card-body card-soft-body">
                <form method="post">
                    <input type="hidden" name="action" value="create">
                    <div class="mb-2">
                        <label class="form-label">Korisničko ime</label>
                        <input type="text" name="username" class="form-control" required>
                    </div>
                    <div class="mb-2">
                        <label class="form-label">Lozinka</label>
                        <input type="password" name="password" class="form-control" required>
                    </div>
                    <div class="mb-2">
                        <label class="form-label">Uloga</label>
                        <select name="role" class="form-select form-select-sm">
                            <option value="user">User</option>
                            <option value="admin">Admin</option>
                        </select>
                    </div>
                    <div class="mb-2">
                        <label class="form-label small mb-1">Kartice kojima ima pristup</label>
                        <div class="form-check">
                            <input class="form-check-input" type="checkbox" name="can_projects" id="cproj_n" checked>
                            <label class="form-check-label" for="cproj_n">Projekti</label>
                        </div>
                        <div class="form-check">
                            <input class="form-check-input" type="checkbox" name="can_items" id="citems_n" checked>
                            <label class="form-check-label" for="citems_n">Artikli</label>
                        </div>
                        <div class="form-check">
                            <input class="form-check-input" type="checkbox" name="can_orders" id="corders_n" checked>
                            <label class="form-check-label" for="corders_n">Nalozi utroška</label>
                        </div>
                        <div class="form-check">
                            <input class="form-check-input" type="checkbox" name="can_suppliers" id="csupp_n" checked>
                            <label class="form-check-label" for="csupp_n">Dobavljači</label>
                        </div>
                        <div class="form-check">
                            <input class="form-check-input" type="checkbox" name="can_receipts" id="crec_n" checked>
                            <label class="form-check-label" for="crec_n">Primke</label>
                        </div>
                        <div class="form-check">
                            <input class="form-check-input" type="checkbox" name="can_stock" id="cstock_n" checked>
                            <label class="form-check-label" for="cstock_n">Stanje skladišta</label>
                        </div>
                    </div>
                    <button class="btn btn-primary btn-soft w-100" type="submit">Spremi korisnika</button>
                </form>
            </div>
        </div>
    </div>

    <div class="col-12 col-lg-8">
        <div class="card card-soft">
            <div class="card-header card-soft-header">
                <span class="fw-semibold">Postojeći korisnici</span>
            </div>
            <div class="card-body card-soft-body">
                <div class="table-responsive">
                    <table class="table table-sm align-middle">
                        <thead class="small text-muted">
                        <tr>
                            <th>Korisnik</th>
                            <th>Uloga</th>
                            <th>Kartice</th>
                            <th class="text-end">Spremi</th>
                        </tr>
                        </thead>
                        <tbody>
                        <?php while ($urow = $usersRes->fetch_assoc()): ?>
                            <tr>
                                <td class="fw-semibold">
                                    <?php echo htmlspecialchars($urow['username']); ?>
                                </td>
                                <td colspan="3">
                                    <form method="post" class="row g-1 align-items-center">
                                        <input type="hidden" name="action" value="update_rights">
                                        <input type="hidden" name="user_id" value="<?php echo $urow['id']; ?>">

                                        <div class="col-12 col-md-3">
                                            <select name="role" class="form-select form-select-sm">
                                                <option value="user" <?php echo $urow['role']==='user'?'selected':''; ?>>User</option>
                                                <option value="admin" <?php echo $urow['role']==='admin'?'selected':''; ?>>Admin</option>
                                            </select>
                                        </div>
                                        <div class="col-12 col-md-7">
                                            <div class="d-flex flex-wrap gap-2 small">
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox"
                                                           name="can_projects"
                                                           <?php echo $urow['can_projects'] ? 'checked' : ''; ?>>
                                                    <label class="form-check-label">Projekti</label>
                                                </div>
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox"
                                                           name="can_items"
                                                           <?php echo $urow['can_items'] ? 'checked' : ''; ?>>
                                                    <label class="form-check-label">Artikli</label>
                                                </div>
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox"
                                                           name="can_orders"
                                                           <?php echo $urow['can_orders'] ? 'checked' : ''; ?>>
                                                    <label class="form-check-label">Nalozi</label>
                                                </div>
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox"
                                                           name="can_suppliers"
                                                           <?php echo $urow['can_suppliers'] ? 'checked' : ''; ?>>
                                                    <label class="form-check-label">Dobavljači</label>
                                                </div>
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox"
                                                           name="can_receipts"
                                                           <?php echo $urow['can_receipts'] ? 'checked' : ''; ?>>
                                                    <label class="form-check-label">Primke</label>
                                                </div>
                                                <div class="form-check">
                                                    <input class="form-check-input" type="checkbox"
                                                           name="can_stock"
                                                           <?php echo $urow['can_stock'] ? 'checked' : ''; ?>>
                                                    <label class="form-check-label">Stanje</label>
                                                </div>
                                            </div>
                                        </div>
                                        <div class="col-12 col-md-2 text-end mt-2 mt-md-0">
                                            <button class="btn btn-sm btn-outline-primary btn-soft" type="submit">
                                                Spremi
                                            </button>
                                        </div>
                                    </form>
                                </td>
                            </tr>
                        <?php endwhile; ?>
                        </tbody>
                    </table>
                </div>
                <div class="text-muted small mt-2">
                    Napomena: <strong>Admin</strong> uvijek ima pristup svim karticama, bez obzira na kvačice.
                </div>
            </div>
        </div>
    </div>
</div>

<?php require_once 'footer.php'; ?>
