View Code - 20260722

user_permission.php | 20260722_120325.php Initial Domain Snapshot

<?php
/* =============================================
   File: /erp/admin/user_permission.php
   Purpose: Owner-only UI to grant per-user access to any page (slug)
   Writes to: page_permissions.allow_user_ids (JSON)
   ============================================= */
error_reporting(E_ALL); ini_set('display_errors', 1);

/* Scoped session (same style as rest of app) */
$__sess_dir = dirname(__DIR__) . '/tmp_sessions'; // /erp/tmp_sessions
if (!is_dir($__sess_dir)) { @mkdir($__sess_dir, 0775, true); }
@ini_set('session.save_path', $__sess_dir);
if (session_status() !== PHP_SESSION_ACTIVE) { session_start(); }

/* DB + auth */
require dirname(__DIR__) . '/core/db.php';
require __DIR__ . '/../modules/auth/auth.php';  // auth_user(), require_login()
require_once dirname(__DIR__) . '/modules/activity/activity_logger.php';

/* --- Owner-only guard --- */
$u = auth_user();
if (!$u) { header('Location: /erp/public/login.php?next='.rawurlencode($_SERVER['REQUEST_URI'])); exit; }
if (strtolower($u['role'] ?? '') !== 'owner') {
  http_response_code(403); exit('Forbidden: owner only');
}

$company_id = (int)($u['company_id'] ?? 0);
if ($company_id <= 0) { http_response_code(403); exit('Forbidden: No company'); }

$msg = null; $err = null;

/* Slug candidates:
   - Pull existing from page_permissions
   - plus a small fallback list (if table empty) */
$slugs = [];
try {
  $st = $pdo->prepare("SELECT slug FROM page_permissions WHERE company_id=? ORDER BY slug");
  $st->execute([$company_id]);
  $slugs = $st->fetchAll(PDO::FETCH_COLUMN) ?: [];
} catch (Throwable $e) { /* ignore */ }

if (!$slugs) {
  $slugs = [
    'employee_list','employee_view','employee_register','employee_add','employee_edit',
    'employee_update','employee_delete','employee_bank_view','employee_bank_edit',
    'attendance_list','attendance_mark','attendance_edit','attendance_report',
    'payroll_list','payroll_view','payroll_generate',
    'department_list','department_edit','designation_list','designation_edit',
    'shift_list','shift_edit'
  ];
}

/* Load users of this company (excluding owner to avoid accidental lock) */
$users = [];
try {
  $st = $pdo->prepare("SELECT id, name, username, role FROM users WHERE company_id=? ORDER BY name ASC");
  $st->execute([$company_id]);
  $users = $st->fetchAll(PDO::FETCH_ASSOC);
} catch (Throwable $e) { $err = 'DB error loading users: '.$e->getMessage(); }

/* --- Handle POST (save selections) --- */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  $slug = trim($_POST['slug'] ?? '');
  $ids  = isset($_POST['user_ids']) && is_array($_POST['user_ids']) ? array_map('intval', $_POST['user_ids']) : [];

if ($slug === '') {
    $err = 'Please select a page (slug).';
  } else {
    try {
      // Ensure row exists, then upsert allow_user_ids
      $json = $ids ? json_encode(array_values(array_unique($ids))) : null;

$sql = "INSERT INTO page_permissions (company_id, slug, allow_roles, allow_user_ids, is_enabled)
              VALUES (:c, :s, JSON_ARRAY(), :uids, 1)
              ON DUPLICATE KEY UPDATE allow_user_ids = VALUES(allow_user_ids), is_enabled = 1";
      $st = $pdo->prepare($sql);
      $st->execute([
        ':c' => $company_id,
        ':s' => $slug,
        ':uids' => $json
      ]);
      activity_log([
        'company_id'  => $company_id,
        'user_id'     => (int)($u['id'] ?? 0),
        'module'      => 'page_permissions',
        'action_name' => 'edit',
        'entity_type' => 'page_permission',
        'entity_id'   => 0,
        'remarks'     => 'Updated user access for slug ' . $slug
      ]);
      $msg = 'Saved permissions for slug: '.$slug;
    } catch (Throwable $e) {
      $err = 'DB error saving: '.$e->getMessage();
    }
  }
}

/* --- Load current selection for chosen slug (to pre-check checkboxes) --- */
$current_slug = trim($_POST['slug'] ?? '');
$current_ids = [];
if ($current_slug !== '') {
  try {
    $st = $pdo->prepare("SELECT allow_user_ids FROM page_permissions WHERE company_id=? AND slug=? LIMIT 1");
    $st->execute([$company_id, $current_slug]);
    $row = $st->fetch(PDO::FETCH_ASSOC);
    if ($row && !empty($row['allow_user_ids'])) {
      $tmp = json_decode($row['allow_user_ids'], true);
      if (is_array($tmp)) $current_ids = array_map('intval', $tmp);
    }
  } catch (Throwable $e) { /* ignore */ }
}
?>
<!doctype html>
<html>
<head>
<meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
<title>User Permissions — Owner</title>
<style>
  body{font-family:Inter,Arial,sans-serif;background:#F5FFF7;margin:0;padding:24px;}
  .wrap{max-width:900px;margin:auto}
  .card{background:#fff;border:1px solid #eee;border-radius:16px;padding:20px;box-shadow:0 8px 20px rgba(0,0,0,.06)}
  .h{margin:0 0 12px}
  .row{margin:12px 0}
  .msg{background:#E6FFED;border:1px solid #B7F5C3;padding:10px;border-radius:10px;margin:10px 0}
  .err{background:#FFE5E5;border:1px solid #F5C2C2;padding:10px;border-radius:10px;margin:10px 0;color:#B00020}
  .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:10px}
  .slug{padding:8px;border:1px solid #ddd;border-radius:10px;width:100%}
  .btn{background:#34A853;color:#fff;border:0;border-radius:10px;padding:10px 14px;cursor:pointer}
</style>
</head>
<body>
<div class="wrap">
  <div class="card">
    <h2 class="h">User Permissions (Owner only)</h2>
    <?php if($msg) { ?><div class="msg"><?=htmlspecialchars($msg)?></div><?php } ?>
    <?php if($err) { ?><div class="err"><?=htmlspecialchars($err)?></div><?php } ?>

<form method="post">
      <div class="row">
        <label><b>Select Page (slug):</b></label><br>
        <select name="slug" class="slug" onchange="this.form.submit()">
          <option value="">-- choose --</option>
          <?php foreach($slugs as $s) { ?>
            <option value="<?=htmlspecialchars($s)?>" <?= $current_slug===$s?'selected':'' ?>>
              <?=htmlspecialchars($s)?>
            </option>
          <?php } ?>
        </select>
      </div>

<?php if($current_slug) { ?>
      <div class="row">
        <b>Allow access to these users:</b>
        <div class="grid">
          <?php foreach($users as $usr) { ?>
            <?php $uid=(int)$usr['id']; $checked = in_array($uid,$current_ids,true) ? 'checked' : ''; ?>
            <label style="border:1px solid #eee;border-radius:10px;padding:8px;">
              <input type="checkbox" name="user_ids[]" value="<?=$uid?>" <?=$checked?>>
              <?=htmlspecialchars($usr['name'] ?? ('User #'.$uid))?>
              <small>(<?=htmlspecialchars($usr['username'] ?? '')?> - <?=htmlspecialchars($usr['role'] ?? '-')?>)</small>
            </label>
          <?php } ?>
        </div>
      </div>
      <div class="row">
        <button class="btn" type="submit">Save Permissions</button>
      </div>
      <?php } ?>
    </form>

<div class="row" style="margin-top:16px">
      <a class="btn" href="/erp/main_dashboard.php">⬅ Back to Dashboard</a>
    </div>
  </div>
</div>
</body>
</html>