website/admin/users.php

<?php
// Start session for language preference
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

require_once '../includes/config.php';
require_once '../includes/database.php';
require_once '../includes/auth.php';
require_once '../includes/translation.php';

// Translation system is auto-initialized when translation.php is included

// Check if user is logged in and has admin privileges
$auth = new Auth();
if (!$auth->isLoggedIn() || !$auth->isAdmin()) {
    header('Location: login.php');
    exit;
}

// Handle user actions
$action = $_GET['action'] ?? 'list';
$user_id = $_GET['id'] ?? null;
$message = '';
$error = '';

// Get database instance
$db = Database::getInstance();

switch ($action) {
    case 'list':
        // Get filter parameters
        $search = trim($_GET['search'] ?? '');
        $role_filter = $_GET['role'] ?? 'all';
        $status_filter = $_GET['status'] ?? 'all';
        $page = max(1, (int)($_GET['page'] ?? 1));
        $limit = 20;
        $offset = ($page - 1) * $limit;
        
        // Build WHERE clause for filtering
        $where_conditions = [];
        $params = [];
        
        if (!empty($search)) {
            $where_conditions[] = "(username LIKE ? OR email LIKE ?)";
            $params[] = "%$search%";
            $params[] = "%$search%";
        }
        
        if ($role_filter !== 'all') {
            $where_conditions[] = "role = ?";
            $params[] = $role_filter;
        }
        
        if ($status_filter !== 'all') {
            $where_conditions[] = "status = ?";
            $params[] = $status_filter;
        }
        
        $where_clause = !empty($where_conditions) ? "WHERE " . implode(" AND ", $where_conditions) : "";
        
        // Get total users count with filters
        $count_sql = "SELECT COUNT(*) as count FROM users $where_clause";
        $total_users = $db->fetch($count_sql, $params)['count'];
        $total_pages = ceil($total_users / $limit);
        
        // Get users for current page with filters
        $sql = "SELECT id, username, email, auth_type, role, status, created_at, last_login FROM users $where_clause ORDER BY created_at DESC LIMIT ? OFFSET ?";
        $query_params = array_merge($params, [$limit, $offset]);
        $users = $db->fetchAll($sql, $query_params);
        
        break;
        
    case 'edit':
        if (!$user_id) {
            header('Location: users.php');
            exit;
        }
        
        // Handle form submission for user update
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            $username = trim($_POST['username'] ?? '');
            $email = trim($_POST['email'] ?? '');
            $auth_type = trim($_POST['auth_type'] ?? 'local');
            $role = trim($_POST['role'] ?? 'user');
            $status = trim($_POST['status'] ?? 'active');
            $password = trim($_POST['password'] ?? '');
            
            // Validation
            if (empty($username)) $error = t('admin_username_required');
            elseif (empty($email)) $error = t('admin_email_required');
            elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) $error = t('admin_email_invalid');
            
            if (!$error) {
                try {
                    $update_data = [
                        'username' => $username,
                        'email' => $email,
                        'auth_type' => $auth_type,
                        'role' => $role,
                        'status' => $status
                    ];
                    
                    // Update password if provided
                    if (!empty($password)) {
                        $update_data['password'] = password_hash($password, PASSWORD_DEFAULT);
                    }
                    
                    $db->update('users', $update_data, 'id = ?', [$user_id]);
                    $message = t('admin_user_updated_success');
                    
                    // Redirect to avoid form resubmission
                    header('Location: users.php?message=' . urlencode($message));
                    exit;
                    
                } catch (Exception $e) {
                    if (strpos($e->getMessage(), 'Duplicate') !== false) {
                        $error = t('admin_username_exists');
                    } else {
                        $error = t('admin_user_update_error') . ' ' . $e->getMessage();
                    }
                }
            }
        }
        
        // Get user details
        $user = $db->fetch("SELECT * FROM users WHERE id = ?", [$user_id]);
        if (!$user) {
            $error = t('admin_user_not_found');
            break;
        }
        
        break;
        
    case 'delete':
        if (!$user_id) {
            header('Location: users.php');
            exit;
        }
        
        // Don't allow deletion of the currently logged-in user
        if ($user_id == $_SESSION['user_id']) {
            $error = t('admin_user_cannot_delete_own');
            break;
        }
        
        // Delete user
        $db->delete('users', 'id = ?', [$user_id]);
        $message = t('admin_user_deleted_success');
        
        // Redirect back to user list
        header('Location: users.php?action=list&message=' . urlencode($message));
        exit;
        
    case 'create':
        // Handle user creation
        if ($_SERVER['REQUEST_METHOD'] === 'POST') {
            $username = trim($_POST['username'] ?? '');
            $email = trim($_POST['email'] ?? '');
            $password = trim($_POST['password'] ?? '');
            $auth_type = trim($_POST['auth_type'] ?? 'local');
            
            // Validation
            if (empty($username)) $error = t('admin_username_required');
            elseif (empty($email)) $error = t('admin_email_required');
            elseif (empty($password) && $auth_type === 'local') $error = t('admin_password_required_local');
            elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) $error = t('admin_email_invalid');
            
            // Get role and status from form
            $role = trim($_POST['role'] ?? 'user');
            $status = trim($_POST['status'] ?? 'active');
            
            if (!$error) {
                // Check if username already exists
                $existing_user = $db->fetch("SELECT id FROM users WHERE username = ?", [$username]);
                if ($existing_user) {
                    $error = t('admin_username_exists');
                } else {
                    // Create new user
                    $hashed_password = password_hash($password, PASSWORD_DEFAULT);
                    $sql = "INSERT INTO users (username, email, password, auth_type, role, status, created_at) VALUES (?, ?, ?, ?, ?, ?, NOW())";
                    $db->query($sql, [$username, $email, $hashed_password, $auth_type, $role, $status]);
                    
                    $message = t('admin_user_created_success');
                    
                    // If LDAP is enabled, we could also create LDAP user here
                    if ($auth_type === 'ldap' && LDAP_ENABLED) {
                        // Additional LDAP user creation logic could be added here
                    }
                }
            }
        }
        
        break;
        
    default:
        header('Location: users.php');
        exit;
}
?>
<!DOCTYPE html>
<html lang="<?php echo Translation::getCurrentLang(); ?>">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?php echo t('manage_users'); ?> - <?php echo SITE_TITLE; ?></title>
    <link rel="stylesheet" href="../css/style.css">
    <link rel="stylesheet" href="../css/admin-users.css">
</head>
<body>
    <header class="admin-header">
        <div class="container">
            <h1><a href="/index.php"><?php echo SITE_TITLE; ?></a></h1>
                <nav class="admin-nav">
                    <a href="index.php" class="nav-link"><?php echo t('admin_nav_dashboard'); ?></a>
                    <a href="publications.php" class="nav-link"><?php echo t('admin_nav_publications'); ?></a>
                    <a href="categories.php" class="nav-link"><?php echo t('admin_nav_categories'); ?></a>
                    <a href="comments.php" class="nav-link"><?php echo t('admin_nav_comments'); ?></a>
                    <a href="users.php" class="nav-link active"><?php echo t('manage_users'); ?></a>
                    <a href="wordpress_import.php" class="nav-link"><?php echo t('wordpress_import'); ?></a>
                    <?php if (LDAP_ENABLED): ?>
                        <a href="ldap-users.php" class="nav-link"><?php echo t('admin_nav_ldap_users'); ?></a>
                    <?php endif; ?>
                    <a href="logout.php" class="nav-link"><?php echo t('admin_nav_logout'); ?></a>
                </nav>
        </div>
    </header>

    <main class="admin-main">
        <div class="container">
            <?php if ($message): ?>
                <div class="alert alert-success">
                    <?php echo htmlspecialchars($message); ?>
                </div>
            <?php endif; ?>
            
            <?php if ($error): ?>
                <div class="alert alert-error">
                    <?php echo htmlspecialchars($error); ?>
                </div>
            <?php endif; ?>
            
            <?php if ($action === 'list'): ?>
                <div class="users-management">
                    <div class="section-header">
                        <h2><?php echo t('manage_users'); ?></h2>
                        <div class="section-actions">
                            <a href="users.php?action=create" class="btn btn-primary"><?php echo t('create_user'); ?></a>
                        </div>
                    </div>
                    
                    <div class="filters">
                        <form method="get" class="filter-form">
                            <div class="filter-group">
                                <label for="search"><?php echo t('search'); ?>:</label>
                                <input type="text" id="search" name="search" value="<?php echo htmlspecialchars($search); ?>" placeholder="<?php echo t('search_users_placeholder'); ?>">
                            </div>
                            
                            <div class="filter-group">
                                <label for="role"><?php echo t('role'); ?>:</label>
                                <select id="role" name="role">
                                    <option value="all" <?php echo $role_filter === 'all' ? 'selected' : ''; ?>><?php echo t('filter_all'); ?></option>
                                    <option value="admin" <?php echo $role_filter === 'admin' ? 'selected' : ''; ?>><?php echo t('role_admin'); ?></option>
                                    <option value="user" <?php echo $role_filter === 'user' ? 'selected' : ''; ?>><?php echo t('role_user'); ?></option>
                                </select>
                            </div>
                            
                            <div class="filter-group">
                                <label for="status"><?php echo t('status'); ?>:</label>
                                <select id="status" name="status">
                                    <option value="all" <?php echo $status_filter === 'all' ? 'selected' : ''; ?>><?php echo t('filter_all'); ?></option>
                                    <option value="active" <?php echo $status_filter === 'active' ? 'selected' : ''; ?>><?php echo t('status_active'); ?></option>
                                    <option value="inactive" <?php echo $status_filter === 'inactive' ? 'selected' : ''; ?>><?php echo t('status_inactive'); ?></option>
                                </select>
                            </div>
                            
                            <button type="submit" class="btn btn-sm"><?php echo t('filter'); ?></button>
                            <?php if ($search || $role_filter !== 'all' || $status_filter !== 'all'): ?>
                                <a href="users.php" class="btn btn-sm btn-secondary"><?php echo t('clear'); ?></a>
                            <?php endif; ?>
                        </form>
                    </div>
                    
                    <div class="users-table">
                        <table class="admin-table">
                            <thead>
                                <tr>
                                    <th><?php echo t('username'); ?></th>
                                    <th><?php echo t('email'); ?></th>
                                    <th><?php echo t('auth_type'); ?></th>
                                    <th><?php echo t('role'); ?></th>
                                    <th><?php echo t('status'); ?></th>
                                    <th><?php echo t('created'); ?></th>
                                    <th><?php echo t('last_login'); ?></th>
                                    <th><?php echo t('actions'); ?></th>
                                </tr>
                            </thead>
                            <tbody>
                                <?php foreach ($users as $user): ?>
                                    <tr>
                                        <td><?php echo htmlspecialchars($user['username']); ?></td>
                                        <td><?php echo htmlspecialchars($user['email']); ?></td>
                                        <td>
                                            <span class="auth-type <?php echo $user['auth_type']; ?>">
                                                <?php echo ucfirst($user['auth_type']); ?>
                                            </span>
                                        </td>
                                        <td>
                                            <span class="role-badge role-<?php echo $user['role']; ?>">
                                                <?php echo t('role_' . $user['role']); ?>
                                            </span>
                                        </td>
                                        <td>
                                            <span class="status-badge status-<?php echo $user['status']; ?>">
                                                <?php echo t('status_' . $user['status']); ?>
                                            </span>
                                        </td>
                                        <td><?php echo date('Y-m-d H:i', strtotime($user['created_at'])); ?></td>
                                        <td><?php echo $user['last_login'] ? date('Y-m-d H:i', strtotime($user['last_login'])) : 'Never'; ?></td>
                                        <td>
                                            <a href="users.php?action=edit&id=<?php echo $user['id']; ?>" class="btn btn-sm"><?php echo t('edit'); ?></a>
                                            <?php if ($user['id'] != $_SESSION['user_id']): ?>
                                                <a href="users.php?action=delete&id=<?php echo $user['id']; ?>" class="btn btn-sm btn-danger" onclick="return confirm('<?php echo t('delete_user_confirm'); ?>')"><?php echo t('delete'); ?></a>
                                            <?php endif; ?>
                                        </td>
                                    </tr>
                                <?php endforeach; ?>
                            </tbody>
                        </table>
                        
                        <?php if ($total_pages > 1): ?>
                            <div class="pagination">
                                <?php if ($page > 1): ?>
                                    <a href="users.php?page=<?php echo $page - 1; ?>" class="btn"><?php echo t('previous'); ?></a>
                                <?php endif; ?>
                                
                                <span class="page-info">
                                    <?php echo t('page'); ?> <?php echo $page; ?> <?php echo t('of'); ?> <?php echo $total_pages; ?>
                                </span>
                                
                                <?php if ($page < $total_pages): ?>
                                    <a href="users.php?page=<?php echo $page + 1; ?>" class="btn"><?php echo t('next'); ?></a>
                                <?php endif; ?>
                            </div>
                        <?php endif; ?>
                    </div>
                </div>
                
            <?php elseif ($action === 'edit' && isset($user)): ?>
                <div class="user-edit">
                    <div class="section-header">
                        <h2><?php echo t('edit_user'); ?></h2>
                    </div>
                    
                    <form method="post" class="admin-form">
                        <div class="form-group">
                            <label for="username"><?php echo t('username'); ?>:</label>
                            <input type="text" id="username" name="username" value="<?php echo htmlspecialchars($user['username']); ?>" required>
                        </div>
                        
                        <div class="form-group">
                            <label for="email"><?php echo t('email'); ?>:</label>
                            <input type="email" id="email" name="email" value="<?php echo htmlspecialchars($user['email']); ?>" required>
                        </div>
                        
                        <div class="form-group">
                            <label for="auth_type"><?php echo t('auth_type'); ?>:</label>
                            <select id="auth_type" name="auth_type">
                                <option value="local" <?php echo $user['auth_type'] === 'local' ? 'selected' : ''; ?>><?php echo t('local'); ?></option>
                                <option value="ldap" <?php echo $user['auth_type'] === 'ldap' ? 'selected' : ''; ?>><?php echo t('ldap'); ?></option>
                            </select>
                        </div>
                        
                        <div class="form-group">
                            <label for="role"><?php echo t('role'); ?>:</label>
                            <select id="role" name="role">
                                <option value="user" <?php echo ($user['role'] ?? 'user') === 'user' ? 'selected' : ''; ?>><?php echo t('role_user'); ?></option>
                                <option value="admin" <?php echo ($user['role'] ?? 'user') === 'admin' ? 'selected' : ''; ?>><?php echo t('role_admin'); ?></option>
                            </select>
                        </div>
                        
                        <div class="form-group">
                            <label for="status"><?php echo t('status'); ?>:</label>
                            <select id="status" name="status">
                                <option value="active" <?php echo ($user['status'] ?? 'active') === 'active' ? 'selected' : ''; ?>><?php echo t('status_active'); ?></option>
                                <option value="inactive" <?php echo ($user['status'] ?? 'active') === 'inactive' ? 'selected' : ''; ?>><?php echo t('status_inactive'); ?></option>
                            </select>
                        </div>
                        
                        <div class="form-actions">
                            <button type="submit" class="btn btn-primary"><?php echo t('update'); ?></button>
                            <a href="users.php" class="btn"><?php echo t('cancel'); ?></a>
                        </div>
                    </form>
                </div>
                
            <?php elseif ($action === 'create'): ?>
                <div class="user-create">
                    <div class="section-header">
                        <h2><?php echo t('create_user'); ?></h2>
                    </div>
                    
                    <form method="post" class="admin-form">
                        <div class="form-group">
                            <label for="username"><?php echo t('username'); ?>:</label>
                            <input type="text" id="username" name="username" value="<?php echo htmlspecialchars($username ?? ''); ?>" required>
                        </div>
                        
                        <div class="form-group">
                            <label for="email"><?php echo t('email'); ?>:</label>
                            <input type="email" id="email" name="email" value="<?php echo htmlspecialchars($email ?? ''); ?>" required>
                        </div>
                        
                        <div class="form-group">
                            <label for="password"><?php echo t('password'); ?>:</label>
                            <input type="password" id="password" name="password" value="<?php echo htmlspecialchars($password ?? ''); ?>" required>
                        </div>
                        
                        <div class="form-group">
                            <label for="auth_type"><?php echo t('auth_type'); ?>:</label>
                            <select id="auth_type" name="auth_type">
                                <option value="local"><?php echo t('local'); ?></option>
                                <?php if (LDAP_ENABLED): ?>
                                    <option value="ldap"><?php echo t('ldap'); ?></option>
                                <?php endif; ?>
                            </select>
                        </div>
                        
                        <div class="form-group">
                            <label for="role"><?php echo t('role'); ?>:</label>
                            <select id="role" name="role">
                                <option value="user"><?php echo t('role_user'); ?></option>
                                <option value="admin"><?php echo t('role_admin'); ?></option>
                            </select>
                        </div>
                        
                        <div class="form-group">
                            <label for="status"><?php echo t('status'); ?>:</label>
                            <select id="status" name="status">
                                <option value="active"><?php echo t('status_active'); ?></option>
                                <option value="inactive"><?php echo t('status_inactive'); ?></option>
                            </select>
                        </div>
                        
                        <div class="form-actions">
                            <button type="submit" class="btn btn-primary"><?php echo t('create'); ?></button>
                            <a href="users.php" class="btn"><?php echo t('cancel'); ?></a>
                        </div>
                    </form>
                </div>
            <?php endif; ?>
        </div>
    </main>
</body>
</html>