<?php
require_once $_SERVER['DOCUMENT_ROOT'] . '/erp/config/database.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/erp/config/auth.php';
require_once $_SERVER['DOCUMENT_ROOT'] . '/erp/config/functions.php';

requireRole('director', 'accountant');

$user = currentUser();
$pdo  = getDBConnection();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && verifyCSRF($_POST['csrf_token'] ?? '')) {
    $action    = $_POST['action']    ?? '';
    $target_id = (int)($_POST['user_id'] ?? 0);

    if ($target_id && $target_id !== $user['id']) {
        if ($action === 'lock') {
            $pdo->prepare("UPDATE users SET is_active = 0 WHERE id = ?")->execute([$target_id]);
            setFlash('warning', 'Đã khoá tài khoản.');

        } elseif ($action === 'unlock') {
            $pdo->prepare("UPDATE users SET is_active = 1 WHERE id = ?")->execute([$target_id]);
            setFlash('success', 'Đã mở khoá tài khoản.');

        } elseif ($action === 'delete') {
            if (hasRole('director')) {
                try {
                    $pdo->beginTransaction();

                    // ── BƯỚC 1: SET NULL các cột approved_by / created_by / tham chiếu ngược ──
                    // Các bảng có cột tham chiếu đến users nhưng KHÔNG phải user_id chính
                    $nullifyQueries = [
                        // leave_requests: approved_by → NULL
                        "UPDATE leave_requests      SET approved_by = NULL WHERE approved_by = ?",
                        // overtime_requests: approved_by → NULL
                        "UPDATE overtime_requests   SET approved_by = NULL WHERE approved_by = ?",
                        // salary_records: approved_by → NULL (nếu có)
                        "UPDATE salary_records      SET approved_by = NULL WHERE approved_by = ?",
                        // advance_requests: approved_by → NULL (nếu có)
                        "UPDATE advance_requests    SET approved_by = NULL WHERE approved_by = ?",
                        // notifications: sender_id / created_by → NULL (nếu có)
                        "UPDATE notifications       SET sender_id   = NULL WHERE sender_id   = ?",
                        // audit_logs: changed_by → NULL (nếu có)
                        "UPDATE audit_logs          SET changed_by  = NULL WHERE changed_by  = ?",
                        // attendance_logs: edited_by → NULL (nếu có)
                        "UPDATE attendance_logs     SET edited_by   = NULL WHERE edited_by   = ?",
                    ];

                    foreach ($nullifyQueries as $sql) {
                        try {
                            $pdo->prepare($sql)->execute([$target_id]);
                        } catch (\PDOException $e) {
                            // Bảng hoặc cột không tồn tại (1146, 1054) → bỏ qua
                            if (!preg_match('/1146|1054/', $e->getMessage())) throw $e;
                        }
                    }

                    // ── BƯỚC 2: XOÁ các bản ghi có user_id = target_id ──
                    $deleteQueries = [
                        "DELETE FROM notifications      WHERE user_id = ?",
                        "DELETE FROM overtime_requests  WHERE user_id = ?",
                        "DELETE FROM leave_requests     WHERE user_id = ?",
                        "DELETE FROM attendance_logs    WHERE user_id = ?",
                        "DELETE FROM employee_shifts    WHERE user_id = ?",
                        "DELETE FROM salary_records     WHERE user_id = ?",
                        "DELETE FROM advance_requests   WHERE user_id = ?",
                        "DELETE FROM audit_logs         WHERE user_id = ?",
                        "DELETE FROM user_sessions      WHERE user_id = ?",
                    ];

                    foreach ($deleteQueries as $sql) {
                        try {
                            $pdo->prepare($sql)->execute([$target_id]);
                        } catch (\PDOException $e) {
                            // Bảng không tồn tại → bỏ qua
                            if (!preg_match('/1146|1054/', $e->getMessage())) throw $e;
                        }
                    }

                    // ── BƯỚC 3: XOÁ USER ──
                    $pdo->prepare("DELETE FROM users WHERE id = ?")->execute([$target_id]);

                    $pdo->commit();
                    setFlash('success', '✅ Đã xoá tài khoản và toàn bộ dữ liệu liên quan.');

                } catch (\PDOException $e) {
                    $pdo->rollBack();

                    // Hiển thị tên bảng/cột bị lỗi để dễ debug
                    preg_match('/`(\w+)`.*FOREIGN KEY.*`(\w+)`/', $e->getMessage(), $m);
                    $hint = !empty($m) ? " (Bảng: <code>{$m[1]}</code>, cột: <code>{$m[2]}</code>)" : '';
                    setFlash('danger', '❌ Không thể xoá.' . $hint . '<br><small class="text-muted">' . htmlspecialchars($e->getMessage()) . '</small>');
                }
            } else {
                setFlash('danger', 'Bạn không có quyền xoá tài khoản.');
            }
        }
    }

    header('Location: /erp/modules/users/index.php');
    exit();
}

// Lọc & tìm kiếm
$search     = trim($_GET['search'] ?? '');
$filterRole = $_GET['role']        ?? '';
$filterDept = (int)($_GET['dept']  ?? 0);

$sql    = "SELECT u.*, r.name AS role, r.display_name AS role_name, d.name AS dept_name
           FROM users u
           JOIN roles r ON u.role_id = r.id
           LEFT JOIN departments d ON u.department_id = d.id
           WHERE 1=1 ";
$params = [];

if ($search) {
    $sql    .= " AND (u.full_name LIKE ? OR u.username LIKE ? OR u.employee_code LIKE ? OR u.email LIKE ?)";
    $like    = "%$search%";
    $params  = array_merge($params, [$like, $like, $like, $like]);
}
if ($filterRole) {
    $sql    .= " AND r.name = ?";
    $params[] = $filterRole;
}
if ($filterDept) {
    $sql    .= " AND u.department_id = ?";
    $params[] = $filterDept;
}
$sql .= " ORDER BY u.is_active DESC, r.id ASC, u.full_name ASC";

$stmt = $pdo->prepare($sql);
$stmt->execute($params);
$users = $stmt->fetchAll();

$depts = $pdo->query("SELECT * FROM departments ORDER BY name")->fetchAll();
$roles = $pdo->query("SELECT * FROM roles ORDER BY id")->fetchAll();

$csrf = generateCSRF();
include $_SERVER['DOCUMENT_ROOT'] . '/erp/includes/header.php';
include $_SERVER['DOCUMENT_ROOT'] . '/erp/includes/sidebar.php';
?>

<div class="main-content">
<div class="container-fluid py-4">

    <div class="d-flex justify-content-between align-items-center mb-4">
        <div>
            <h4 class="mb-1">👥 Quản lý Tài khoản</h4>
            <p class="text-muted mb-0">Tổng: <strong><?= count($users) ?></strong> tài khoản</p>
        </div>
        <a href="/erp/modules/users/create.php" class="btn btn-primary">
            <i class="fas fa-user-plus me-2"></i>Tạo tài khoản mới
        </a>
    </div>

    <?php showFlash(); ?>

    <!-- Bộ lọc -->
    <div class="card border-0 shadow-sm mb-3">
        <div class="card-body py-3">
            <form method="GET" class="row g-2 align-items-end">
                <div class="col-md-4">
                    <label class="form-label small fw-semibold mb-1">🔍 Tìm kiếm</label>
                    <input type="text" name="search" class="form-control form-control-sm"
                           placeholder="Tên, username, mã NV, email..."
                           value="<?= htmlspecialchars($search) ?>">
                </div>
                <div class="col-md-3">
                    <label class="form-label small fw-semibold mb-1">🎭 Phân quyền</label>
                    <select name="role" class="form-select form-select-sm">
                        <option value="">-- Tất cả --</option>
                        <?php foreach ($roles as $r): ?>
                        <option value="<?= $r['name'] ?>" <?= $filterRole === $r['name'] ? 'selected' : '' ?>>
                            <?= htmlspecialchars($r['display_name']) ?>
                        </option>
                        <?php endforeach; ?>
                    </select>
                </div>
                <div class="col-md-3">
                    <label class="form-label small fw-semibold mb-1">🏢 Phòng ban</label>
                    <select name="dept" class="form-select form-select-sm">
                        <option value="">-- Tất cả --</option>
                        <?php foreach ($depts as $d): ?>
                        <option value="<?= $d['id'] ?>" <?= $filterDept == $d['id'] ? 'selected' : '' ?>>
                            <?= htmlspecialchars($d['name']) ?>
                        </option>
                        <?php endforeach; ?>
                    </select>
                </div>
                <div class="col-md-2 d-flex gap-2">
                    <button type="submit" class="btn btn-primary btn-sm w-100">Lọc</button>
                    <a href="/erp/modules/users/index.php" class="btn btn-outline-secondary btn-sm">↺</a>
                </div>
            </form>
        </div>
    </div>

    <!-- Bảng danh sách -->
    <div class="card border-0 shadow-sm">
        <div class="card-body p-0">
            <div class="table-responsive">
                <table class="table table-hover align-middle mb-0">
                    <thead class="table-dark">
                        <tr>
                            <th>Nhân viên</th>
                            <th>Username</th>
                            <th>Phân quyền</th>
                            <th>Phòng ban</th>
                            <th>Liên hệ</th>
                            <th>Trạng thái</th>
                            <th class="text-center">Thao tác</th>
                        </tr>
                    </thead>
                    <tbody>
                    <?php foreach ($users as $u): ?>
                    <?php $badge = getRoleBadge($u['role']); ?>
                    <tr class="<?= !$u['is_active'] ? 'table-secondary text-muted' : '' ?>">
                        <td>
                            <div class="d-flex align-items-center gap-2">
                                <div class="avatar-circle bg-<?= $badge['class'] ?>">
                                    <?= mb_substr($u['full_name'], 0, 1) ?>
                                </div>
                                <div>
                                    <div class="fw-semibold"><?= htmlspecialchars($u['full_name']) ?></div>
                                    <small class="text-muted"><?= htmlspecialchars($u['employee_code']) ?></small>
                                </div>
                            </div>
                        </td>
                        <td><code><?= htmlspecialchars($u['username']) ?></code></td>
                        <td>
                            <span class="badge bg-<?= $badge['class'] ?>">
                                <?= $badge['icon'] ?> <?= $badge['label'] ?>
                            </span>
                        </td>
                        <td><small><?= htmlspecialchars($u['dept_name'] ?? '-') ?></small></td>
                        <td>
                            <small class="d-block"><?= htmlspecialchars($u['email'] ?? '-') ?></small>
                            <small class="text-muted"><?= htmlspecialchars($u['phone'] ?? '') ?></small>
                        </td>
                        <td>
                            <?php if ($u['is_active']): ?>
                                <span class="badge bg-success">✅ Hoạt động</span>
                            <?php else: ?>
                                <span class="badge bg-secondary">🔒 Đã khoá</span>
                            <?php endif; ?>
                        </td>
                        <td class="text-center">
                            <div class="d-flex justify-content-center gap-1">
                                <!-- Hồ sơ -->
                                <a href="/erp/modules/users/profile.php?id=<?= $u['id'] ?>"
                                   class="btn btn-sm btn-outline-success" title="Hồ sơ nhân viên">
                                    <i class="fas fa-id-card"></i>
                                </a>
                                <!-- Sửa -->
                                <a href="/erp/modules/users/edit.php?id=<?= $u['id'] ?>"
                                   class="btn btn-sm btn-outline-primary" title="Chỉnh sửa">
                                    <i class="fas fa-edit"></i>
                                </a>
                                <!-- Đổi mật khẩu -->
                                <a href="/erp/modules/users/change_password.php?id=<?= $u['id'] ?>"
                                   class="btn btn-sm btn-outline-warning" title="Đổi mật khẩu">
                                    <i class="fas fa-key"></i>
                                </a>

                                <?php if ($u['id'] !== $user['id']): ?>
                                <!-- Khoá / Mở khoá -->
                                <form method="POST" class="d-inline">
                                    <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                    <input type="hidden" name="user_id"    value="<?= $u['id'] ?>">
                                    <?php if ($u['is_active']): ?>
                                        <input type="hidden" name="action" value="lock">
                                        <button type="submit" class="btn btn-sm btn-outline-secondary"
                                                title="Khoá tài khoản"
                                                onclick="return confirm('Khoá tài khoản <?= htmlspecialchars(addslashes($u['full_name'])) ?>?')">
                                            <i class="fas fa-lock"></i>
                                        </button>
                                    <?php else: ?>
                                        <input type="hidden" name="action" value="unlock">
                                        <button type="submit" class="btn btn-sm btn-outline-success" title="Mở khoá">
                                            <i class="fas fa-lock-open"></i>
                                        </button>
                                    <?php endif; ?>
                                </form>

                                <!-- Xoá — chỉ Giám đốc -->
                                <?php if (hasRole('director')): ?>
                                <button type="button"
                                        class="btn btn-sm btn-outline-danger"
                                        title="Xoá tài khoản"
                                        onclick="confirmDelete(<?= $u['id'] ?>, '<?= htmlspecialchars(addslashes($u['full_name'])) ?>')">
                                    <i class="fas fa-trash"></i>
                                </button>
                                <?php endif; ?>
                                <?php endif; ?>
                            </div>
                        </td>
                    </tr>
                    <?php endforeach; ?>
                    <?php if (empty($users)): ?>
                    <tr>
                        <td colspan="7" class="text-center text-muted py-5">
                            <i class="fas fa-search fa-2x mb-2 d-block"></i>
                            Không tìm thấy tài khoản nào
                        </td>
                    </tr>
                    <?php endif; ?>
                    </tbody>
                </table>
            </div>
        </div>
    </div>

</div>
</div>

<!-- Modal xác nhận xoá -->
<div class="modal fade" id="deleteModal" tabindex="-1">
    <div class="modal-dialog">
        <div class="modal-content border-danger">
            <form method="POST" id="deleteForm">
                <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                <input type="hidden" name="action"     value="delete">
                <input type="hidden" name="user_id"    id="deleteUserId">
                <div class="modal-header bg-danger text-white border-0">
                    <h6 class="modal-title fw-bold">
                        <i class="fas fa-exclamation-triangle me-2"></i>Xác nhận xoá tài khoản
                    </h6>
                    <button type="button" class="btn-close btn-close-white" data-bs-dismiss="modal"></button>
                </div>
                <div class="modal-body">
                    <p class="mb-2">Bạn sắp xoá tài khoản:
                        <strong id="deleteUserName" class="text-danger"></strong>
                    </p>
                    <div class="alert alert-warning py-2 small mb-0">
                        <i class="fas fa-exclamation-circle me-1"></i>
                        Hành động này sẽ <strong>xoá vĩnh viễn</strong> tài khoản và toàn bộ
                        dữ liệu liên quan bao gồm: chấm công, OT, nghỉ phép, lương...
                        <br><strong>Không thể hoàn tác!</strong>
                    </div>
                </div>
                <div class="modal-footer border-0">
                    <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">
                        <i class="fas fa-times me-1"></i>Huỷ
                    </button>
                    <button type="submit" class="btn btn-danger">
                        <i class="fas fa-trash me-1"></i>Xác nhận xoá
                    </button>
                </div>
            </form>
        </div>
    </div>
</div>

<style>
.avatar-circle {
    width: 36px; height: 36px;
    border-radius: 50%;
    display: inline-flex; align-items: center; justify-content: center;
    color: white; font-weight: 700; font-size: 15px;
    flex-shrink: 0;
}
</style>

<script>
function confirmDelete(userId, userName) {
    document.getElementById('deleteUserId').value        = userId;
    document.getElementById('deleteUserName').textContent = userName;
    new bootstrap.Modal(document.getElementById('deleteModal')).show();
}
</script>

<?php include $_SERVER['DOCUMENT_ROOT'] . '/erp/includes/footer.php'; ?>