<?php
require_once __DIR__ . '/../inc/auth.php';
cms_require_admin();

$data = cms_load_users();
$msg = '';
$err = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  if (!cms_check_csrf($_POST['csrf'] ?? null)) {
    $err = 'Błąd CSRF. Odśwież stronę i spróbuj ponownie.';
  } else {
    $action = (string)($_POST['action'] ?? '');

    if ($action === 'add') {
      $username = trim((string)($_POST['new_username'] ?? ''));
      $role = (string)($_POST['new_role'] ?? 'editor');
      $pass = (string)($_POST['new_password'] ?? '');

      if ($username === '' || $pass === '') {
        $err = 'Login i hasło są wymagane.';
      } elseif (cms_find_user($username)) {
        $err = 'Taki użytkownik już istnieje.';
      } else {
        $data['users'][] = [
          'username' => $username,
          'role' => ($role === 'admin') ? 'admin' : 'editor',
          'pass_hash' => password_hash($pass, PASSWORD_DEFAULT),
          'created_at' => date('c'),
        ];
        if (cms_save_json(cms_users_file(), $data)) $msg = 'Dodano użytkownika ✔'; else $err = 'Nie mogę zapisać users.json (prawa do /data).';
      }
    }

    if ($action === 'setpass') {
      $username = trim((string)($_POST['username'] ?? ''));
      $pass = (string)($_POST['password'] ?? '');
      if ($username === '' || $pass === '') {
        $err = 'Podaj hasło.';
      } else {
        $changed = false;
        foreach ($data['users'] as &$u) {
          if (isset($u['username']) && $u['username'] === $username) {
            $u['pass_hash'] = password_hash($pass, PASSWORD_DEFAULT);
            $changed = true;
            break;
          }
        }
        unset($u);
        if ($changed) {
          if (cms_save_json(cms_users_file(), $data)) $msg = 'Zmieniono hasło ✔'; else $err = 'Nie mogę zapisać users.json (prawa do /data).';
        } else {
          $err = 'Nie znaleziono użytkownika.';
        }
      }
    }


    if ($action === 'setrole') {
      $username = trim((string)($_POST['username'] ?? ''));
      $role = (string)($_POST['role'] ?? 'editor');
      $role = ($role === 'admin') ? 'admin' : 'editor';
      $changed = false;
      foreach ($data['users'] as &$u) {
        if (isset($u['username']) && $u['username'] === $username) {
          $u['role'] = $role;
          $changed = true;
          break;
        }
      }
      unset($u);
      if ($changed) {
        if (cms_save_json(cms_users_file(), $data)) $msg = 'Zmieniono rolę ✔'; else $err = 'Nie mogę zapisać users.json (prawa do /data).';
      } else {
        $err = 'Nie znaleziono użytkownika.';
      }
    }

    if ($action === 'delete') {
      $username = trim((string)($_POST['username'] ?? ''));
      if ($username === 'admin') {
        $err = 'Nie usuwaj konta admin.';
      } else {
        $before = count($data['users']);
        $data['users'] = array_values(array_filter($data['users'], fn($u) => ($u['username'] ?? '') !== $username));
        if (count($data['users']) === $before) {
          $err = 'Nie znaleziono użytkownika.';
        } else {
          if (cms_save_json(cms_users_file(), $data)) $msg = 'Usunięto użytkownika ✔'; else $err = 'Nie mogę zapisać users.json (prawa do /data).';
        }
      }
    }
  }
}

cms_layout_header('Użytkownicy');
?>
<div class="card">
  <h1 style="margin:0 0 10px 0;font-size:20px">Użytkownicy</h1>
  <div class="muted">Tutaj dodajesz loginy i zmieniasz hasła. Role: <b>admin</b> (pełny dostęp), <b>editor</b> (edycja treści).</div>

  <div class="actions">
    <a class="btn secondary" href="/admin/import_htpasswd.php" style="text-decoration:none;display:inline-block">Import z .htpasswd</a>
    <a class="btn secondary" href="/admin/import_users.php" style="text-decoration:none;display:inline-block">Import ręczny</a>
  </div>

  <?php if ($msg): ?><div class="msg"><?= cms_h($msg) ?></div><?php endif; ?>
  <?php if ($err): ?><div class="msg" style="background:#fff0f0;border-color:#ffd0d0"><?= cms_h($err) ?></div><?php endif; ?>

  <h2 style="font-size:16px;margin:14px 0 8px">Lista</h2>
  <table>
    <thead><tr><th>Login</th><th>Rola</th><th>Hasło</th><th>Akcje</th></tr></thead>
    <tbody>
    <?php foreach ($data['users'] as $u): $un = (string)($u['username'] ?? ''); ?>
      <tr>
        <td><b><?= cms_h($un) ?></b></td>
        <td>
          <form method="post" class="actions" style="margin:0">
            <input type="hidden" name="csrf" value="<?= cms_h(cms_csrf_token()) ?>">
            <input type="hidden" name="action" value="setrole">
            <input type="hidden" name="username" value="<?= cms_h($un) ?>">
            <select name="role" style="min-width:140px">
              <option value="editor" <?= (($u['role'] ?? 'editor') === 'editor') ? 'selected' : '' ?>>editor</option>
              <option value="admin" <?= (($u['role'] ?? 'editor') === 'admin') ? 'selected' : '' ?>>admin</option>
            </select>
            <button class="btn" type="submit" style="padding:6px 10px">Zapisz</button>
          </form>
        </td>
        <td>
          <form method="post" class="actions" style="margin:0">
            <input type="hidden" name="csrf" value="<?= cms_h(cms_csrf_token()) ?>">
            <input type="hidden" name="action" value="setpass">
            <input type="hidden" name="username" value="<?= cms_h($un) ?>">
            <input type="password" name="password" placeholder="Nowe hasło" required>
            <button class="btn" type="submit">Zmień</button>
          </form>
        </td>
        <td>
          <?php if ($un !== 'admin'): ?>
          <form method="post" onsubmit="return confirm('Usunąć użytkownika <?= cms_h($un) ?>?');" style="margin:0">
            <input type="hidden" name="csrf" value="<?= cms_h(cms_csrf_token()) ?>">
            <input type="hidden" name="action" value="delete">
            <input type="hidden" name="username" value="<?= cms_h($un) ?>">
            <button class="btn danger" type="submit">Usuń</button>
          </form>
          <?php else: ?>
            <span class="muted">(admin)</span>
          <?php endif; ?>
        </td>
      </tr>
    <?php endforeach; ?>
    </tbody>
  </table>

  <h2 style="font-size:16px;margin:16px 0 8px">Dodaj użytkownika</h2>
  <form method="post">
    <input type="hidden" name="csrf" value="<?= cms_h(cms_csrf_token()) ?>">
    <input type="hidden" name="action" value="add">
    <div class="actions" style="align-items:flex-end">
      <div style="flex:1;min-width:200px">
        <label class="muted">Login</label>
        <input name="new_username" required>
      </div>
      <div style="width:160px">
        <label class="muted">Rola</label>
        <select name="new_role">
          <option value="editor">editor</option>
          <option value="admin">admin</option>
        </select>
      </div>
      <div style="flex:1;min-width:220px">
        <label class="muted">Hasło</label>
        <input type="password" name="new_password" required>
      </div>
      <div>
        <button class="btn secondary" type="submit">Dodaj</button>
      </div>
    </div>
  </form>
</div>
<?php cms_layout_footer(); ?>