View Code - 20260722

advance_request.php | 20260722_120325.php Initial Domain Snapshot

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);

require __DIR__ . '/../modules/auth/auth.php';
require_login();

$u = auth_user();
$pdo = $GLOBALS['pdo'] ?? null;
if (!$pdo instanceof PDO) {
    require __DIR__ . '/../core/db.php';
    $pdo = $GLOBALS['pdo'] ?? null;
}
if (!$pdo instanceof PDO) {
    http_response_code(500);
    exit('DB not available');
}

$company_id = (int)($u['company_id'] ?? 0);
$user_id = (int)($u['id'] ?? 0);

if (session_status() !== PHP_SESSION_ACTIVE) {
    session_start();
}
if (empty($_SESSION['csrf'])) {
    $_SESSION['csrf'] = bin2hex(random_bytes(16));
}
$csrf = $_SESSION['csrf'];

function h($value): string {
    return htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8');
}

function self_employee_id(PDO $pdo, int $company_id, int $user_id): int {
    try {
        $userCols = [];
        foreach ($pdo->query("SHOW COLUMNS FROM users") as $column) {
            $userCols[strtolower((string)$column['Field'])] = true;
        }

if (isset($userCols['employee_id'])) {
            $st = $pdo->prepare(
                "SELECT cem.id
                   FROM company_employee_master cem
                   JOIN users u ON u.company_id = cem.company_id AND u.employee_id = cem.id
                  WHERE u.id = ? AND cem.company_id = ?
                  LIMIT 1"
            );
            $st->execute([$user_id, $company_id]);
            return (int)($st->fetchColumn() ?: 0);
        }

if (isset($userCols['name'])) {
            $st = $pdo->prepare(
                "SELECT cem.id
                   FROM company_employee_master cem
                   JOIN users u ON u.company_id = cem.company_id
                  WHERE u.id = ?
                    AND cem.company_id = ?
                    AND TRIM(LOWER(cem.name)) = TRIM(LOWER(u.name))
                  ORDER BY cem.id DESC
                  LIMIT 1"
            );
            $st->execute([$user_id, $company_id]);
            return (int)($st->fetchColumn() ?: 0);
        }
    } catch (Throwable $e) {
        return 0;
    }

return 0;
}

$employee_id = self_employee_id($pdo, $company_id, $user_id);

$pdo->exec(
    "CREATE TABLE IF NOT EXISTS employee_advance_requests (
        id BIGINT PRIMARY KEY AUTO_INCREMENT,
        company_id BIGINT NOT NULL,
        user_id BIGINT NOT NULL,
        employee_id BIGINT NULL,
        amount DECIMAL(12,2) NOT NULL,
        request_date DATE NOT NULL,
        reason VARCHAR(255) NULL,
        status ENUM('Pending','Approved','Rejected') NOT NULL DEFAULT 'Pending',
        created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
        updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
        INDEX idx_company_user (company_id, user_id),
        INDEX idx_company_status (company_id, status)
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4"
);

$message = '';
$error = '';
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
    if (!hash_equals($csrf, $_POST['csrf'] ?? '')) {
        $error = 'Security check failed.';
    } else {
        $amount = (float)($_POST['amount'] ?? 0);
        $request_date = trim((string)($_POST['request_date'] ?? ''));
        $reason = trim((string)($_POST['reason'] ?? ''));

if ($amount <= 0) {
            $error = 'Amount must be greater than zero.';
        } elseif (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $request_date)) {
            $error = 'Valid request date is required.';
        } else {
            $st = $pdo->prepare(
                "INSERT INTO employee_advance_requests
                    (company_id, user_id, employee_id, amount, request_date, reason, status)
                 VALUES (?, ?, ?, ?, ?, ?, 'Pending')"
            );
            $st->execute([$company_id, $user_id, $employee_id ?: null, $amount, $request_date, $reason !== '' ? $reason : null]);
            $message = 'Advance request submitted.';
        }
    }
}

$rows = [];
$st = $pdo->prepare(
    "SELECT request_date, amount, reason, status, created_at
       FROM employee_advance_requests
      WHERE company_id = ? AND user_id = ?
      ORDER BY id DESC"
);
$st->execute([$company_id, $user_id]);
$rows = $st->fetchAll(PDO::FETCH_ASSOC);
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Advance Request</title>
<style>
  :root{--primary:#34A853;--bg:#F5FFF7;--card:#fff;--text:#202124;--border:#e5e7eb;--shadow:0 8px 20px rgba(0,0,0,.08)}
  *{box-sizing:border-box} body{margin:0;background:var(--bg);color:var(--text);font:14px/1.45 system-ui,-apple-system,Segoe UI,Roboto,Arial}
  .wrap{max-width:920px;margin:20px auto;padding:16px}.card{background:var(--card);border:1px solid var(--border);border-radius:16px;box-shadow:var(--shadow);padding:18px}
  .top{display:flex;justify-content:space-between;align-items:center;gap:10px;margin-bottom:12px}.link{color:#0b57d0;text-decoration:none;font-weight:600}
  .grid{display:grid;gap:14px;grid-template-columns:1fr 1fr}.full{grid-column:1/-1}@media(max-width:720px){.grid{grid-template-columns:1fr}}
  label{display:block;margin:8px 0 6px;font-weight:600} input,textarea{width:100%;padding:10px;border:1px solid #d0d7de;border-radius:10px}
  textarea{min-height:110px;resize:vertical}.btn{padding:10px 16px;border:0;border-radius:10px;cursor:pointer;font-weight:600;background:var(--primary);color:#fff}
  .ok{margin:10px 0;background:#ecfdf5;border:1px solid #a7f3d0;color:#065f46;padding:8px;border-radius:10px}.err{margin:10px 0;background:#fee2e2;border:1px solid #fecaca;color:#7f1d1d;padding:8px;border-radius:10px}
  table{width:100%;border-collapse:collapse;margin-top:14px} th,td{padding:10px;border-bottom:1px solid #e5e7eb;text-align:left}.right{text-align:right}
  .pill{display:inline-block;padding:4px 10px;border-radius:999px;font-size:12px;font-weight:700}.pending{background:#fef3c7;color:#92400e}.approved{background:#dcfce7;color:#166534}.rejected{background:#fee2e2;color:#991b1b}
</style>
</head>
<body>
<div class="wrap">
  <div class="top">
    <a class="link" href="/erp/public/employee_portal.php">&larr; Dashboard</a>
    <div>Logged in: <b><?= h($u['name'] ?? 'User') ?></b></div>
  </div>

<div class="card">
    <h2 style="margin:0 0 8px">Advance Request</h2>
    <div style="color:#5F6368;margin-bottom:12px">Submit your own advance request and track approval status.</div>
    <?php if ($message): ?><div class="ok"><?= h($message) ?></div><?php endif; ?>
    <?php if ($error): ?><div class="err"><?= h($error) ?></div><?php endif; ?>

<form method="post" class="grid">
      <input type="hidden" name="csrf" value="<?= h($csrf) ?>">
      <div>
        <label>Amount</label>
        <input type="number" name="amount" min="1" step="0.01" value="<?= h($_POST['amount'] ?? '') ?>" required>
      </div>
      <div>
        <label>Request Date</label>
        <input type="date" name="request_date" value="<?= h($_POST['request_date'] ?? date('Y-m-d')) ?>" required>
      </div>
      <div class="full">
        <label>Reason</label>
        <textarea name="reason" placeholder="Reason for advance request"><?= h($_POST['reason'] ?? '') ?></textarea>
      </div>
      <div class="full">
        <button class="btn" type="submit">Submit Request</button>
      </div>
    </form>
  </div>

<div class="card" style="margin-top:16px">
    <h3 style="margin:0 0 8px">My Requests</h3>
    <table>
      <thead>
        <tr>
          <th>Date</th>
          <th class="right">Amount</th>
          <th>Reason</th>
          <th>Status</th>
          <th>Created</th>
        </tr>
      </thead>
      <tbody>
        <?php if (!$rows): ?>
          <tr><td colspan="5">No advance requests yet.</td></tr>
        <?php else: ?>
          <?php foreach ($rows as $row): ?>
            <?php $status = strtolower((string)$row['status']); ?>
            <tr>
              <td><?= h($row['request_date']) ?></td>
              <td class="right"><?= number_format((float)$row['amount'], 2) ?></td>
              <td><?= h($row['reason'] ?: '-') ?></td>
              <td><span class="pill <?= h($status) ?>"><?= h($row['status']) ?></span></td>
              <td><?= h($row['created_at']) ?></td>
            </tr>
          <?php endforeach; ?>
        <?php endif; ?>
      </tbody>
    </table>
  </div>
</div>
</body>
</html>