<?php
/**
 * admin/user_edit.php
 * Kullanıcı düzenleme - ayrı sayfa (modal sorunu bypass)
 */

declare(strict_types=1);

$page_title  = 'Kullanıcı Düzenle';
$active_menu = 'users';

require_once __DIR__ . '/../includes/db.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/csrf.php';

require_permission('users');

$id  = get_int('id');
$msg = '';
$err = '';

if (!$id) { header('Location: users.php'); exit; }

$user = db_row("SELECT * FROM users WHERE id = ?", [$id]);
if (!$user) { header('Location: users.php'); exit; }

$me = current_user();

$modules = [
    'dashboard'     => 'Dashboard',
    'reservations'  => 'Rezervasyonlar',
    'customers'     => 'Müşteri CRM',
    'customer_tags' => 'Müşteri Etiketleri',
    'suppliers'     => 'Tedarikçiler',
    'daily_orders'  => 'Günlük Sipariş',
    'staff'         => 'Personel Takip',
    'settings'      => 'Site Ayarları',
    'users'         => 'Kullanıcı Yönetimi',
];

// Mevcut yetkiler
$perms_raw = db_rows(
    "SELECT module_key FROM user_permissions WHERE user_id = ? AND is_active = 1",
    [$id]
);
$user_perms = array_column($perms_raw, 'module_key');

// Form gönderildi mi?
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $csrf_ok = isset($_POST['csrf_token']) && hash_equals(csrf_token(), $_POST['csrf_token']);
    if (!$csrf_ok) {
        $err = 'Güvenlik hatası. Sayfayı yenileyip tekrar deneyin.';
    } else {
        $full_name = trim($_POST['full_name'] ?? '');
        $username  = trim($_POST['username']  ?? '');
        $password  = $_POST['password'] ?? '';
        $role      = ($_POST['role'] ?? '') === 'admin' ? 'admin' : 'staff';
        $is_active = isset($_POST['is_active']) ? 1 : 0;
        $perms_in  = $_POST['permissions'] ?? [];

        if (!$full_name) {
            $err = 'Ad Soyad zorunludur.';
        } elseif (!$username) {
            $err = 'Kullanıcı adı zorunludur.';
        } elseif ($password && strlen($password) < 8) {
            $err = 'Şifre en az 8 karakter olmalıdır.';
        } elseif ($id == $me['id'] && !$is_active) {
            $err = 'Kendinizi pasifleştiremezsiniz.';
        } elseif ($id == $me['id'] && $role !== 'admin') {
            $err = 'Kendi admin rolünüzü kaldıramazsınız.';
        } else {
            // Kullanıcı adı çakışması
            $dup = db_value("SELECT COUNT(*) FROM users WHERE username = ? AND id != ?", [$username, $id]);
            if ($dup) {
                $err = 'Bu kullanıcı adı başka bir kullanıcıya ait.';
            } else {
                try {
                    if ($password) {
                        $hash = password_hash($password, PASSWORD_DEFAULT);
                        db_run(
                            "UPDATE users SET full_name=?, username=?, password_hash=?, role=?, is_active=? WHERE id=?",
                            [$full_name, $username, $hash, $role, $is_active, $id]
                        );
                    } else {
                        db_run(
                            "UPDATE users SET full_name=?, username=?, role=?, is_active=? WHERE id=?",
                            [$full_name, $username, $role, $is_active, $id]
                        );
                    }

                    // Yetkileri kaydet
                    db_run("DELETE FROM user_permissions WHERE user_id = ?", [$id]);
                    if ($role === 'staff') {
                        foreach (array_keys($modules) as $module) {
                            $active = in_array($module, (array)$perms_in) ? 1 : 0;
                            db_run(
                                "INSERT INTO user_permissions (user_id, module_key, is_active) VALUES (?, ?, ?)",
                                [$id, $module, $active]
                            );
                        }
                    }

                    // Güncel veriyi çek
                    $user      = db_row("SELECT * FROM users WHERE id = ?", [$id]);
                    $perms_raw = db_rows("SELECT module_key FROM user_permissions WHERE user_id = ? AND is_active = 1", [$id]);
                    $user_perms = array_column($perms_raw, 'module_key');
                    $msg = 'Kullanıcı başarıyla güncellendi.';
                } catch (Throwable $e) {
                    $err = 'Kayıt hatası: ' . $e->getMessage();
                }
            }
        }
    }
}

require_once __DIR__ . '/../includes/admin_layout.php';
?>

<div class="d-flex align-items-center gap-2 mb-4">
    <a href="users.php" class="btn btn-outline-secondary btn-sm">
        <i class="bi bi-arrow-left me-1"></i>Kullanıcılar
    </a>
    <h5 class="mb-0 ms-2">
        <i class="bi bi-person-gear text-warning me-2"></i>Kullanıcı Düzenle
    </h5>
</div>

<?php if ($msg): ?>
<div class="alert alert-success alert-dismissible fade show">
    <i class="bi bi-check-circle me-2"></i><?= e($msg) ?>
    <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<?php endif; ?>
<?php if ($err): ?>
<div class="alert alert-danger alert-dismissible fade show">
    <i class="bi bi-exclamation-triangle me-2"></i><?= e($err) ?>
    <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<?php endif; ?>

<div class="card" style="max-width:680px">
    <div class="card-header d-flex align-items-center gap-2">
        <i class="bi bi-person-circle text-warning"></i>
        <strong><?= e($user['full_name']) ?></strong>
        <span class="badge <?= $user['role']==='admin'?'bg-warning text-dark':'bg-info text-dark' ?> ms-1">
            <?= $user['role']==='admin'?'Admin':'Staff' ?>
        </span>
        <span class="badge <?= $user['is_active']?'bg-success':'bg-secondary' ?> ms-1">
            <?= $user['is_active']?'Aktif':'Pasif' ?>
        </span>
    </div>
    <div class="card-body">
        <form method="POST" action="user_edit.php?id=<?= $id ?>">
            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(csrf_token()) ?>">

            <div class="row g-3 mb-3">
                <div class="col-md-6">
                    <label class="form-label">Ad Soyad <span class="text-danger">*</span></label>
                    <input type="text" name="full_name" class="form-control"
                        value="<?= e($user['full_name']) ?>" required>
                </div>
                <div class="col-md-6">
                    <label class="form-label">Kullanıcı Adı <span class="text-danger">*</span></label>
                    <input type="text" name="username" class="form-control"
                        value="<?= e($user['username']) ?>" required>
                </div>
            </div>

            <div class="row g-3 mb-3">
                <div class="col-md-6">
                    <label class="form-label">
                        Yeni Şifre
                        <small class="text-muted">(boş bırakılırsa değişmez)</small>
                    </label>
                    <input type="password" name="password" class="form-control"
                        autocomplete="new-password" placeholder="En az 8 karakter">
                </div>
                <div class="col-md-3">
                    <label class="form-label">Rol</label>
                    <select name="role" class="form-select" id="roleSelect"
                        onchange="togglePermsSection()"
                        <?= $id==$me['id']?'disabled':''; ?>>
                        <option value="staff" <?= $user['role']==='staff'?'selected':'' ?>>Staff</option>
                        <option value="admin" <?= $user['role']==='admin'?'selected':'' ?>>Admin</option>
                    </select>
                    <?php if ($id==$me['id']): ?>
                    <input type="hidden" name="role" value="admin">
                    <?php endif; ?>
                </div>
                <div class="col-md-3 d-flex align-items-end pb-2">
                    <div class="form-check form-switch">
                        <input type="checkbox" name="is_active" class="form-check-input" id="isActive"
                            <?= $user['is_active']?'checked':'' ?>
                            <?= $id==$me['id']?'disabled':''; ?>>
                        <label class="form-check-label" for="isActive">Aktif</label>
                        <?php if ($id==$me['id']): ?>
                        <input type="hidden" name="is_active" value="1">
                        <?php endif; ?>
                    </div>
                </div>
            </div>

            <!-- Modül Yetkileri -->
            <div id="permsSection" <?= $user['role']==='admin'?'style="display:none"':'' ?>>
                <hr class="border-secondary">
                <h6 class="text-warning mb-3">
                    <i class="bi bi-shield-check me-2"></i>Modül Yetkileri
                </h6>
                <div class="row g-2 mb-2">
                    <?php foreach ($modules as $key => $label): ?>
                    <div class="col-6 col-md-4">
                        <div class="form-check">
                            <input type="checkbox" name="permissions[]"
                                class="form-check-input perm-cb"
                                id="perm_<?= $key ?>" value="<?= $key ?>"
                                <?= in_array($key, $user_perms)?'checked':'' ?>>
                            <label class="form-check-label" for="perm_<?= $key ?>">
                                <?= e($label) ?>
                            </label>
                        </div>
                    </div>
                    <?php endforeach; ?>
                </div>
                <div class="d-flex gap-2 mt-1">
                    <button type="button" class="btn btn-outline-secondary btn-sm"
                        onclick="document.querySelectorAll('.perm-cb').forEach(c=>c.checked=true)">
                        Tümünü Seç
                    </button>
                    <button type="button" class="btn btn-outline-secondary btn-sm"
                        onclick="document.querySelectorAll('.perm-cb').forEach(c=>c.checked=false)">
                        Tümünü Kaldır
                    </button>
                </div>
            </div>

            <hr class="border-secondary">
            <div class="d-flex gap-2">
                <button type="submit" class="btn btn-warning px-4">
                    <i class="bi bi-check-lg me-1"></i>Kaydet
                </button>
                <a href="users.php" class="btn btn-secondary px-4">İptal</a>
            </div>
        </form>
    </div>
</div>

<script>
function togglePermsSection() {
    const role = document.getElementById('roleSelect')?.value;
    const sec  = document.getElementById('permsSection');
    if (sec) sec.style.display = (role === 'admin') ? 'none' : '';
}
</script>

<?php require_once __DIR__ . '/../includes/admin_layout_end.php'; ?>