<?php
declare(strict_types=1);

require_once dirname(__DIR__) . '/includes/functions.php';
require_admin_role();



/* POLANA_ADMINUSER_CREATE_FIX_V2_START */
/*
 * Fallback tworzenia nowego użytkownika.
 * Wykonuje się po oryginalnej obsłudze POST i tylko wtedy,
 * gdy rekord o podanym username nadal nie istnieje.
 */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    verify_csrf(); /* POLANA_V18_USERS_CSRF */
    try {
        $pf_action = strtolower(trim((string)($_POST['action'] ?? $_POST['op'] ?? $_POST['do'] ?? '')));
        $pf_has_id = isset($_POST['id']) || isset($_POST['user_id']) || isset($_POST['uid']);

        $pf_forbidden = false;
        foreach (['delete','remove','usun','reset','update','edit','change','password','pin'] as $pf_bad) {
            if ($pf_action !== '' && str_contains($pf_action, $pf_bad)) {
                $pf_forbidden = true;
                break;
            }
        }

        $pf_username = trim((string)(
            $_POST['username'] ?? $_POST['login'] ?? $_POST['email'] ?? ''
        ));
        $pf_password = (string)(
            $_POST['password'] ?? $_POST['new_password'] ?? $_POST['newpass'] ?? $_POST['pass'] ?? ''
        );
        $pf_password2 = (string)(
            $_POST['password2'] ?? $_POST['password_confirm'] ?? $_POST['confirm_password']
            ?? $_POST['password_repeat'] ?? $pf_password
        );

        if ($pf_username !== '' && $pf_password !== '' && !$pf_has_id && !$pf_forbidden) {
            if (strlen($pf_password) < 6) {
                throw new RuntimeException('Hasło musi mieć minimum 6 znaków.');
            }
            if ($pf_password !== $pf_password2) {
                throw new RuntimeException('Hasła nie są identyczne.');
            }

            if (!function_exists('db')) {
                foreach ([
                    __DIR__.'/includes/functions.php',
                    dirname(__DIR__).'/includes/functions.php'
                ] as $pf_f) {
                    if (is_file($pf_f)) {
                        require_once $pf_f;
                        break;
                    }
                }
            }
            if (!function_exists('db')) {
                throw new RuntimeException('Brak funkcji db().');
            }

            $pf_db = db();
            if (!$pf_db instanceof PDO) throw new RuntimeException('db() nie zwróciło PDO.');
            $pf_db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

            $pf_chk = $pf_db->prepare('SELECT id FROM users WHERE username = :u LIMIT 1');
            $pf_chk->execute([':u'=>$pf_username]);
            $pf_exists = $pf_chk->fetchColumn();

            if (!$pf_exists) {
                $pf_name = trim((string)(
                    $_POST['name'] ?? $_POST['display_name'] ?? $_POST['fullname']
                    ?? $_POST['full_name'] ?? $pf_username
                ));

                $pf_role = strtolower(trim((string)($_POST['role'] ?? 'waiter')));
                $pf_allowed = ['admin','editor','manager','waiter','kitchen'];
                if (!in_array($pf_role, $pf_allowed, true)) $pf_role = 'waiter';

                $pf_active = 1;
                if (array_key_exists('active', $_POST)) {
                    $pf_raw = strtolower(trim((string)$_POST['active']));
                    $pf_active = in_array($pf_raw, ['1','true','on','yes','tak'], true) ? 1 : 0;
                }

                $pf_hash = password_hash($pf_password, PASSWORD_DEFAULT);
                if ($pf_hash === false) throw new RuntimeException('Nie udało się utworzyć password_hash.');

                $pf_ins = $pf_db->prepare(
                    'INSERT INTO users (username,password_hash,name,role,active)
                     VALUES (:u,:p,:n,:r,:a)'
                );
                $pf_ins->execute([
                    ':u'=>$pf_username,
                    ':p'=>$pf_hash,
                    ':n'=>$pf_name !== '' ? $pf_name : null,
                    ':r'=>$pf_role,
                    ':a'=>$pf_active,
                ]);

                $pf_v = $pf_db->prepare('SELECT password_hash FROM users WHERE username=:u LIMIT 1');
                $pf_v->execute([':u'=>$pf_username]);
                $pf_saved = (string)$pf_v->fetchColumn();

                if ($pf_saved === '' || !password_verify($pf_password, $pf_saved)) {
                    throw new RuntimeException('Konto zapisane, ale password_verify() nie przeszedł.');
                }

                if (session_status() === PHP_SESSION_ACTIVE) {
                    $_SESSION['polana_adminuser_fix_flash'] =
                        'Użytkownik '.$pf_username.' został utworzony poprawnie.';
                }

                $pf_url = strtok((string)($_SERVER['REQUEST_URI'] ?? ''), '?');
                if (!$pf_url) $pf_url = basename(__FILE__);
                header('Location: '.$pf_url.'?user_created=1');
                exit;
            }
        }
    } catch (Throwable $pf_e) {
        error_log('[POLANA ADMINUSER FIX V2] '.$pf_e->getMessage());
        if (session_status() === PHP_SESSION_ACTIVE) {
            $_SESSION['polana_adminuser_fix_flash'] =
                'Błąd tworzenia użytkownika: '.$pf_e->getMessage();
        }
    }
}
/* POLANA_ADMINUSER_CREATE_FIX_V2_END */
$users = db()->query(
    'SELECT id, username, name, role, active, last_login_at, created_at
     FROM users
     ORDER BY active DESC, role ASC, username ASC'
)->fetchAll();

render_admin_header('Użytkownicy');


?>
<div class="admin-title-row">
    <div>
        <h1>Użytkownicy panelu</h1>
        <p>Konta administratorów i osób obsługujących stronę.</p>
    </div>
    <a class="btn btn-primary" href="/admin/user.php">+ Dodaj użytkownika</a>
</div>

<div class="table-wrap">
    <table class="admin-table">
        <thead>
            <tr>
                <th>Użytkownik</th>
                <th>Nazwa</th>
                <th>Rola</th>
                <th>Status</th>
                <th>Ostatnie logowanie</th>
                <th></th>
            </tr>
        </thead>
        <tbody>
        <?php foreach ($users as $row): ?>
            <tr>
                <td><strong><?= e($row['username']) ?></strong></td>
                <td><?= e($row['name'] ?: '—') ?></td>
                <td><?= e(match ($row['role']) {
        'admin' => 'Administrator',
        'waiter' => 'Kelner',
        'kitchen' => 'Kuchnia',
        'manager' => 'Manager',
        default => 'Redaktor',
    }) ?></td>
                <td>
                    <span class="user-status <?= (int)$row['active'] === 1 ? 'is-active' : 'is-off' ?>">
                        <?= (int)$row['active'] === 1 ? 'Aktywny' : 'Wyłączony' ?>
                    </span>
                </td>
                <td><?= $row['last_login_at'] ? e((new DateTimeImmutable($row['last_login_at']))->format('d.m.Y H:i')) : '—' ?></td>
                <td>
                    <a class="btn btn-small btn-light" href="/admin/user.php?id=<?= (int)$row['id'] ?>">Edytuj</a>
                </td>
            </tr>
        <?php endforeach; ?>
        </tbody>
    </table>
</div>
<?php render_admin_footer(); ?>