HockeyCMS-SHOP/admin/users.php

<?php
// Αρχείο: /var/www/html/hockey-cms/admin/users.php
require_once 'admin_auth.php';
require_once '../config/database.php';
session_start();

// Αυστηρός έλεγχος: Μόνο ο Administrator (role_id = 1) έχει πρόσβαση
if (!isset($_SESSION['user_id']) || $_SESSION['role_id'] != 1) {
    header("Location: index.php");
    exit;
}

// --- Μηχανισμός Αλλαγής Γλώσσας ---
if (isset($_GET['lang']) && in_array($_GET['lang'], ['el', 'en'])) {
    $_SESSION['lang'] = $_GET['lang'];
}
$current_lang = $_SESSION['lang'] ?? 'el';

$translations = [
    'el' => [
        'page_title' => 'Διαχείριση Χρηστών',
        'header_title' => 'Διαχείριση Χρηστών & Sellers',
        'allow_sellers_q' => 'Επιτρέπεται οι χρήστες (Πελάτες) να γίνονται από μόνοι τους Πωλητές (Sellers) μέσα από το προφίλ τους;',
        'yes_allow' => 'ΝΑΙ, ΕΠΙΤΡΕΠΕΤΑΙ',
        'new_account' => 'Δημιουργία Νέου Λογαριασμού',
        'username' => 'Όνομα Χρήστη (Username) *',
        'password' => 'Κωδικός Πρόσβασης (Password) *',
        'first_name' => 'Όνομα',
        'last_name' => 'Επώνυμο',
        'email' => 'Email',
        'phone' => 'Τηλέφωνο',
        'role' => 'Ρόλος (Δικαιώματα) *',
        'select_role' => '-- Επίλεξε Ρόλο --',
        'btn_create' => 'Δημιουργία Χρήστη',
        'user_list' => 'Λίστα Εγγεγραμμένων Χρηστών',
        'th_id' => 'ID',
        'th_user' => 'Χρήστης',
        'th_name' => 'Ονοματεπώνυμο',
        'th_contact' => 'Επικοινωνία',
        'th_role' => 'Ρόλος',
        'th_actions' => 'Ενέργειες',
        'btn_pass' => 'Κωδικός',
        'btn_del' => 'Διαγραφή',
        'your_account' => 'Ο λογαριασμός σας',
        'change_pass_title' => 'Αλλαγή Κωδικού',
        'for_user' => 'Για τον χρήστη:',
        'new_pass_label' => 'Νέος Κωδικός Πρόσβασης',
        'btn_save_pass' => 'Αποθήκευση νέου κωδικού',
        'msg_setting_ok' => 'Η ρύθμιση για τους πωλητές ενημερώθηκε!',
        'msg_user_added' => 'Ο χρήστης δημιουργήθηκε επιτυχώς!',
        'msg_err_empty' => 'Παρακαλώ συμπληρώστε τα υποχρεωτικά πεδία.',
        'msg_err_role_self' => 'Δεν μπορείτε να αλλάξετε τον δικό σας ρόλο!',
        'msg_role_upd' => 'Ο ρόλος του χρήστη ενημερώθηκε επιτυχώς!',
        'msg_err_del_self' => 'Απαγορεύεται η διαγραφή του δικού σας λογαριασμού!',
        'msg_del_ok' => 'Ο χρήστης διαγράφηκε επιτυχώς!',
        'msg_err_del' => 'Δεν μπορεί να διαγραφεί αυτός ο χρήστης γιατί έχει καταχωρημένα προϊόντα ή ιστορικό παραγγελιών.',
        'msg_pass_self_ok' => 'Ο προσωπικός σας κωδικός άλλαξε επιτυχώς! Στην επόμενη σύνδεση θα χρησιμοποιήσετε τον νέο.',
        'msg_pass_ok' => 'Ο κωδικός του χρήστη άλλαξε επιτυχώς!',
        'confirm_del' => 'ΠΡΟΣΟΧΗ: Θέλετε σίγουρα να διαγράψετε τον χρήστη: '
    ],
    'en' => [
        'page_title' => 'User Management',
        'header_title' => 'Users & Sellers Management',
        'allow_sellers_q' => 'Are users (Customers) allowed to become Sellers on their own through their profile?',
        'yes_allow' => 'YES, ALLOWED',
        'new_account' => 'Create New Account',
        'username' => 'Username *',
        'password' => 'Password *',
        'first_name' => 'First Name',
        'last_name' => 'Last Name',
        'email' => 'Email',
        'phone' => 'Phone',
        'role' => 'Role (Permissions) *',
        'select_role' => '-- Select Role --',
        'btn_create' => 'Create User',
        'user_list' => 'Registered Users List',
        'th_id' => 'ID',
        'th_user' => 'User',
        'th_name' => 'Full Name',
        'th_contact' => 'Contact',
        'th_role' => 'Role',
        'th_actions' => 'Actions',
        'btn_pass' => 'Password',
        'btn_del' => 'Delete',
        'your_account' => 'Your account',
        'change_pass_title' => 'Change Password',
        'for_user' => 'For user:',
        'new_pass_label' => 'New Password',
        'btn_save_pass' => 'Save new password',
        'msg_setting_ok' => 'Seller setting updated!',
        'msg_user_added' => 'User created successfully!',
        'msg_err_empty' => 'Please fill in the required fields.',
        'msg_err_role_self' => 'You cannot change your own role!',
        'msg_role_upd' => 'User role updated successfully!',
        'msg_err_del_self' => 'Deleting your own account is forbidden!',
        'msg_del_ok' => 'User deleted successfully!',
        'msg_err_del' => 'Cannot delete this user because they have registered products or order history.',
        'msg_pass_self_ok' => 'Your personal password changed successfully! Use the new one on next login.',
        'msg_pass_ok' => 'User password changed successfully!',
        'confirm_del' => 'WARNING: Are you sure you want to delete user: '
    ]
];
$t = $translations[$current_lang];

header('Content-Type: text/html; charset=utf-8');
$message = '';

try {
    $pdo->exec("CREATE TABLE IF NOT EXISTS settings (`key` VARCHAR(50) PRIMARY KEY, `value` TEXT NOT NULL)");
    $stmt = $pdo->query("SELECT value FROM settings WHERE `key` = 'allow_user_to_seller'");
    if ($stmt->rowCount() == 0) {
        $pdo->exec("INSERT INTO settings (`key`, `value`) VALUES ('allow_user_to_seller', '0')");
    }
} catch (Exception $e) {}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] == 'update_seller_setting') {
    $allow_seller = isset($_POST['allow_seller']) ? '1' : '0';
    $stmt = $pdo->prepare("REPLACE INTO settings (`key`, `value`) VALUES ('allow_user_to_seller', ?)");
    $stmt->execute([$allow_seller]);
    $message = "<div class='alert success'>{$t['msg_setting_ok']}</div>";
}

$stmt = $pdo->query("SELECT value FROM settings WHERE `key` = 'allow_user_to_seller'");
$allow_user_to_seller = (int)$stmt->fetchColumn();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] == 'add_user') {
    $username = trim($_POST['username']);
    $password = $_POST['password'];
    $first_name = trim($_POST['first_name']);
    $last_name = trim($_POST['last_name']);
    $email = trim($_POST['email']);
    $phone = trim($_POST['phone']);
    $role_id = (int)$_POST['role_id'];
    
    if (!empty($username) && !empty($password) && !empty($role_id)) {
        try {
            $hashed_password = password_hash($password, PASSWORD_DEFAULT);
            $stmt = $pdo->prepare("INSERT INTO users (role_id, username, password, first_name, last_name, email, phone) VALUES (?, ?, ?, ?, ?, ?, ?)");
            $stmt->execute([$role_id, $username, $hashed_password, $first_name, $last_name, $email, $phone]);
            $message = "<div class='alert success'>{$t['msg_user_added']}</div>";
        } catch (PDOException $e) {
            $message = "<div class='alert error'>Σφάλμα: " . $e->getMessage() . "</div>";
        }
    } else {
        $message = "<div class='alert error'>{$t['msg_err_empty']}</div>";
    }
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] == 'change_role') {
    $target_user_id = (int)$_POST['user_id'];
    $new_role_id = (int)$_POST['new_role_id'];
    
    if ($target_user_id === (int)$_SESSION['user_id']) {
        $message = "<div class='alert error'>{$t['msg_err_role_self']}</div>";
    } else {
        try {
            $stmt = $pdo->prepare("UPDATE users SET role_id = ? WHERE id = ?");
            $stmt->execute([$new_role_id, $target_user_id]);
            $message = "<div class='alert success'>{$t['msg_role_upd']}</div>";
        } catch (Exception $e) {
            $message = "<div class='alert error'>Σφάλμα: " . $e->getMessage() . "</div>";
        }
    }
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] == 'delete_user') {
    $del_user_id = (int)$_POST['user_id'];
    
    if ($del_user_id === (int)$_SESSION['user_id']) {
        $message = "<div class='alert error'>{$t['msg_err_del_self']}</div>";
    } else {
        try {
            $stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
            $stmt->execute([$del_user_id]);
            $message = "<div class='alert success'>{$t['msg_del_ok']}</div>";
        } catch (PDOException $e) {
            $message = "<div class='alert error'>{$t['msg_err_del']}</div>";
        }
    }
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] == 'change_password') {
    $cp_user_id = (int)$_POST['user_id'];
    $new_password = $_POST['new_password'];
    
    if (!empty($new_password)) {
        try {
            $hashed = password_hash($new_password, PASSWORD_DEFAULT);
            $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
            $stmt->execute([$hashed, $cp_user_id]);
            
            if ($cp_user_id === (int)$_SESSION['user_id']) {
                $message = "<div class='alert success'>{$t['msg_pass_self_ok']}</div>";
            } else {
                $message = "<div class='alert success'>{$t['msg_pass_ok']}</div>";
            }
        } catch (Exception $e) {
            $message = "<div class='alert error'>Σφάλμα: " . $e->getMessage() . "</div>";
        }
    }
}

$roles = $pdo->query("SELECT id, name FROM roles ORDER BY id")->fetchAll();
$users = $pdo->query("
    SELECT u.id, u.username, u.first_name, u.last_name, u.email, u.phone, u.created_at, u.role_id, r.name as role_name 
    FROM users u 
    JOIN roles r ON u.role_id = r.id 
    ORDER BY u.id DESC
")->fetchAll();
?>
<!DOCTYPE html>
<html lang="<?php echo $current_lang; ?>">
<head>
    <meta charset="UTF-8">
    <title><?php echo $t['page_title']; ?> - Hockey CMS</title>
    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
    <style>
        :root {
            --primary: #f97316;
            --primary-hover: #ea580c;
            --bg-color: #0b1120;
            --panel-bg: #1e293b;
            --border-color: #334155;
            --text-main: #f8fafc;
            --text-muted: #94a3b8;
        }
        body { font-family: 'Inter', sans-serif; background-color: var(--bg-color); color: var(--text-main); margin: 0; }
        .content { margin-left: 250px; padding: 30px; }
        .content h2 { margin-top: 0; color: var(--primary); font-size: 26px; text-transform: uppercase; letter-spacing: 0.5px; }
        
        .card { background: var(--panel-bg); padding: 25px; border-radius: 8px; box-shadow: 0 4px 6px -1px rgba(0,0,0,0.3); border: 1px solid var(--border-color); margin-bottom: 25px; }
        .card h3 { margin-top: 0; color: var(--text-main); border-bottom: 1px solid rgba(255,255,255,0.05); padding-bottom: 15px; font-size: 18px; text-transform: uppercase; letter-spacing: 0.5px; }
        
        .form-group { margin-bottom: 20px; }
        .form-group label { display: block; margin-bottom: 8px; font-weight: 700; font-size: 13px; color: var(--text-muted); text-transform: uppercase; letter-spacing: 0.5px;}
        .form-group input, .form-group select { width: 100%; padding: 12px; background: #0f172a; border: 1px solid var(--border-color); color: var(--text-main); border-radius: 6px; box-sizing: border-box; font-family: 'Inter', sans-serif; outline: none; transition: 0.2s; }
        .form-group input:focus, .form-group select:focus { border-color: var(--primary); box-shadow: 0 0 0 2px rgba(249, 115, 22, 0.2); }
        
        .btn { padding: 12px 20px; background: var(--primary); color: white; border: none; border-radius: 6px; cursor: pointer; font-weight: 800; font-size: 14px; text-transform: uppercase; transition: 0.2s; }
        .btn:hover { background: var(--primary-hover); transform: translateY(-1px); }
        
        table { width: 100%; border-collapse: collapse; margin-top: 10px; }
        table th, table td { padding: 15px; border-bottom: 1px solid rgba(255,255,255,0.05); text-align: left; vertical-align: middle; }
        table th { background: rgba(0,0,0,0.2); color: var(--text-muted); text-transform: uppercase; font-size: 13px; font-weight: 700; }
        table td { color: var(--text-main); font-size: 14px; }
        
        .badge { padding: 4px 10px; border-radius: 20px; font-size: 11px; font-weight: 800; color: #fff; text-transform: uppercase; }
        .badge-admin { background: #ef4444; }
        .badge-seller { background: #10b981; }
        .badge-user { background: var(--text-muted); color: #0b1120; }
        
        .alert { padding: 15px; border-radius: 6px; margin-bottom: 20px; font-weight: 600; font-size: 14px;}
        .success { background: rgba(16, 185, 129, 0.1); color: #10b981; border: 1px solid rgba(16, 185, 129, 0.2); }
        .error { background: rgba(239, 68, 68, 0.1); color: #ef4444; border: 1px solid rgba(239, 68, 68, 0.2); }
        
        .btn-small { padding: 6px 12px; border: none; border-radius: 4px; cursor: pointer; font-size: 12px; font-weight: 700; color: #fff; margin-right: 5px; text-transform: uppercase; transition: 0.2s;}
        .btn-pass { background: rgba(59, 130, 246, 0.1); color: #3b82f6; border: 1px solid rgba(59, 130, 246, 0.2); }
        .btn-pass:hover { background: #3b82f6; color: white;}
        .btn-del { background: rgba(239, 68, 68, 0.1); color: #ef4444; border: 1px solid rgba(239, 68, 68, 0.2); }
        .btn-del:hover { background: #ef4444; color: white;}
        
        .modal { display: none; position: fixed; z-index: 1000; left: 0; top: 0; width: 100%; height: 100%; overflow: auto; background-color: rgba(0,0,0,0.8); }
        .modal-content { background-color: var(--panel-bg); margin: 10% auto; padding: 30px; border-radius: 8px; width: 400px; position: relative; box-shadow: 0 10px 25px rgba(0,0,0,0.5); border: 1px solid var(--border-color); }
        .close-btn { position: absolute; right: 20px; top: 15px; font-size: 24px; font-weight: bold; cursor: pointer; color: var(--text-muted); }
        .close-btn:hover { color: var(--text-main); }
        
        .switch-container { background: rgba(249, 115, 22, 0.1); border: 1px solid rgba(249, 115, 22, 0.2); padding: 15px 25px; border-radius: 8px; display: flex; justify-content: space-between; align-items: center; margin-bottom: 25px;}
        .switch-container p { margin: 0; color: var(--primary); font-weight: 600; font-size: 14px;}
    </style>
</head>
<body>
    
    <?php include 'sidebar.php'; ?>

    <div class="content">
        <h2><?php echo $t['header_title']; ?></h2>
        
        <?php echo $message; ?>

        <!-- Ρύθμιση: Να γίνονται μόνοι τους Sellers; -->
        <div class="switch-container">
            <p><?php echo $t['allow_sellers_q']; ?></p>
            <form method="POST" action="users.php" style="margin: 0; display: flex; align-items: center; gap: 10px;">
                <input type="hidden" name="action" value="update_seller_setting">
                <label style="cursor: pointer; display: flex; align-items: center; gap: 8px; font-weight: 800; color: var(--text-main); font-size: 13px;">
                    <input type="checkbox" name="allow_seller" value="1" <?php echo $allow_user_to_seller ? 'checked' : ''; ?> style="width: 18px; height: 18px; accent-color: var(--primary);" onchange="this.form.submit()">
                    <?php echo $t['yes_allow']; ?>
                </label>
            </form>
        </div>

        <!-- Φόρμα Δημιουργίας Χρήστη -->
        <div class="card">
            <h3><?php echo $t['new_account']; ?></h3>
            <form method="POST" action="users.php">
                <input type="hidden" name="action" value="add_user">
                
                <div style="display: grid; grid-template-columns: 1fr 1fr; gap: 20px;">
                    <div class="form-group">
                        <label><?php echo $t['username']; ?></label>
                        <input type="text" name="username" required>
                    </div>
                    <div class="form-group">
                        <label><?php echo $t['password']; ?></label>
                        <input type="password" name="password" required>
                    </div>
                    <div class="form-group">
                        <label><?php echo $t['first_name']; ?></label>
                        <input type="text" name="first_name">
                    </div>
                    <div class="form-group">
                        <label><?php echo $t['last_name']; ?></label>
                        <input type="text" name="last_name">
                    </div>
                    <div class="form-group">
                        <label><?php echo $t['email']; ?></label>
                        <input type="email" name="email">
                    </div>
                    <div class="form-group">
                        <label><?php echo $t['phone']; ?></label>
                        <input type="text" name="phone">
                    </div>
                    <div class="form-group">
                        <label><?php echo $t['role']; ?></label>
                        <select name="role_id" required>
                            <option value=""><?php echo $t['select_role']; ?></option>
                            <?php foreach($roles as $role): ?>
                                <option value="<?php echo $role['id']; ?>"><?php echo strtoupper($role['name']); ?></option>
                            <?php endforeach; ?>
                        </select>
                    </div>
                </div>
                <button type="submit" class="btn"><?php echo $t['btn_create']; ?></button>
            </form>
        </div>

        <!-- Λίστα Χρηστών -->
        <div class="card">
            <h3><?php echo $t['user_list']; ?></h3>
            <table>
                <thead>
                    <tr>
                        <th><?php echo $t['th_id']; ?></th>
                        <th><?php echo $t['th_user']; ?></th>
                        <th><?php echo $t['th_name']; ?></th>
                        <th><?php echo $t['th_contact']; ?></th>
                        <th><?php echo $t['th_role']; ?></th>
                        <th><?php echo $t['th_actions']; ?></th>
                    </tr>
                </thead>
                <tbody>
                    <?php foreach($users as $user): ?>
                    <tr>
                        <td><strong>#<?php echo $user['id']; ?></strong></td>
                        <td><?php echo htmlspecialchars($user['username']); ?></td>
                        <td><?php echo htmlspecialchars($user['first_name'] . ' ' . $user['last_name']); ?></td>
                        <td>
                            <small style="color: var(--text-muted);">
                                ✉️ <?php echo htmlspecialchars($user['email']); ?><br>
                                📞 <?php echo htmlspecialchars($user['phone']); ?>
                            </small>
                        </td>
                        <td>
                            <?php 
                                $badge_class = 'badge-user';
                                if ($user['role_id'] == 1) $badge_class = 'badge-admin';
                                if ($user['role_id'] == 2) $badge_class = 'badge-seller';
                            ?>
                            <span class="badge <?php echo $badge_class; ?>">
                                <?php echo htmlspecialchars($user['role_name']); ?>
                            </span>
                        </td>
                        <td>
                            <?php if ($user['id'] != $_SESSION['user_id']): ?>
                                
                                <form method="POST" action="users.php" style="display: inline-block; margin-right: 5px;">
                                    <input type="hidden" name="action" value="change_role">
                                    <input type="hidden" name="user_id" value="<?php echo $user['id']; ?>">
                                    <select name="new_role_id" style="padding: 6px; border-radius: 4px; font-size: 12px; width: 100px;" onchange="this.form.submit()">
                                        <?php foreach($roles as $role): ?>
                                            <option value="<?php echo $role['id']; ?>" <?php echo ($role['id'] == $user['role_id']) ? 'selected' : ''; ?>>
                                                <?php echo ucfirst($role['name']); ?>
                                            </option>
                                        <?php endforeach; ?>
                                    </select>
                                </form>

                                <button type="button" class="btn-small btn-pass" 
                                    onclick="openPasswordModal(<?php echo $user['id']; ?>, '<?php echo addslashes(htmlspecialchars($user['username'])); ?>')">
                                    <?php echo $t['btn_pass']; ?>
                                </button>
                                
                                <form method="POST" action="users.php" style="display: inline-block;" onsubmit="return confirm('<?php echo $t['confirm_del'] . addslashes(htmlspecialchars($user['username'])); ?>;');">
                                    <input type="hidden" name="action" value="delete_user">
                                    <input type="hidden" name="user_id" value="<?php echo $user['id']; ?>">
                                    <button type="submit" class="btn-small btn-del"><?php echo $t['btn_del']; ?></button>
                                </form>
                                
                            <?php else: ?>
                                <span style="color: var(--text-muted); font-size: 12px; margin-right: 15px; font-style: italic;"><?php echo $t['your_account']; ?></span>
                                
                                <button type="button" class="btn-small btn-pass" 
                                    onclick="openPasswordModal(<?php echo $user['id']; ?>, '<?php echo addslashes(htmlspecialchars($user['username'])); ?>')">
                                    <?php echo $t['btn_pass']; ?>
                                </button>
                            <?php endif; ?>
                        </td>
                    </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>
    </div>

    <!-- Το Αναδυόμενο Παράθυρο (Modal) για την αλλαγή κωδικού -->
    <div id="passwordModal" class="modal">
        <div class="modal-content">
            <span class="close-btn" onclick="closePasswordModal()">&times;</span>
            <h3 style="margin-top: 0; color: var(--text-main); font-size: 18px; text-transform: uppercase;"><?php echo $t['change_pass_title']; ?></h3>
            <p style="color: var(--text-muted); font-size: 14px;"><?php echo $t['for_user']; ?> <strong id="modal-username-display" style="color: var(--primary);"></strong></p>
            
            <form method="POST" action="users.php">
                <input type="hidden" name="action" value="change_password">
                <input type="hidden" name="user_id" id="modal-user-id" value="">
                
                <div class="form-group" style="margin-top: 25px;">
                    <label><?php echo $t['new_pass_label']; ?></label>
                    <input type="password" name="new_password" required placeholder="••••••••">
                </div>
                
                <button type="submit" class="btn" style="width: 100%; margin-top: 10px;"><?php echo $t['btn_save_pass']; ?></button>
            </form>
        </div>
    </div>

    <script>
        function openPasswordModal(userId, username) {
            document.getElementById('modal-user-id').value = userId;
            document.getElementById('modal-username-display').innerText = username;
            document.getElementById('passwordModal').style.display = 'block';
        }
        function closePasswordModal() {
            document.getElementById('passwordModal').style.display = 'none';
        }
        window.onclick = function(event) {
            const modal = document.getElementById('passwordModal');
            if (event.target == modal) {
                closePasswordModal();
            }
        }
    </script>
</body>
</html>