View Code - 20260722

employee_self.php | 20260722_120325.php Initial Domain Snapshot

<?php
/* =============================================================================
   File: /erp/public/employee_self.php
   Purpose: Employee Portal Dashboard — show links user is granted to
   Scope  : Page-local only (no global/base edits). Multi-company aware.
   Debug  : add ?debug=1 to see sources & resolved cards
   ============================================================================= */
header('X-Frame-Options: SAMEORIGIN');
error_reporting(E_ALL); ini_set('display_errors', 1);

/* --- Auth + DB ----------------------------------------------------------- */
require __DIR__ . '/../modules/auth/auth.php';
require_login();
$u = auth_user();
$company_id = (int)$u['company_id'];
$user_id    = (int)$u['id'];
$user_role  = (string)$u['role'];

$pdo = $GLOBALS['pdo'] ?? null;
if (!$pdo) { require __DIR__ . '/../core/db.php'; }

/* --- Helpers ------------------------------------------------------------- */
function tbl_exists(PDO $pdo, $name) {
  static $cache=[]; if(isset($cache[$name])) return $cache[$name];
  $q="SELECT 1 FROM information_schema.tables WHERE table_schema=DATABASE() AND table_name=?"; 
  $st=$pdo->prepare($q); $st->execute([$name]); 
  return $cache[$name]=(bool)$st->fetchColumn();
}
function col_exists(PDO $pdo,$t,$c){
  static $cache=[]; $k="$t|$c"; if(isset($cache[$k])) return $cache[$k];
  $q="SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name=? AND column_name=?";
  $st=$pdo->prepare($q); $st->execute([$t,$c]);
  return $cache[$k]=(bool)$st->fetchColumn();
}
function esc($s){ return htmlspecialchars((string)$s,ENT_QUOTES,'UTF-8'); }

/* --- Page-permissions field detection ----------------------------------- */
$HAS_PPERM = tbl_exists($pdo,'page_permissions');
$HAS_ACL   = tbl_exists($pdo,'page_acl_grants');
$HAS_PACC  = tbl_exists($pdo,'page_access');

$hasP_title     = $HAS_PPERM && col_exists($pdo,'page_permissions','title');
$hasP_pagename  = $HAS_PPERM && col_exists($pdo,'page_permissions','page_name');
$hasP_openpath  = $HAS_PPERM && col_exists($pdo,'page_permissions','open_path');
$hasP_category  = $HAS_PPERM && col_exists($pdo,'page_permissions','category');
$hasP_isactive  = $HAS_PPERM && col_exists($pdo,'page_permissions','is_active');
$hasP_allowed   = $HAS_PPERM && col_exists($pdo,'page_permissions','allowed_roles');
$hasP_rolecsv   = $HAS_PPERM && col_exists($pdo,'page_permissions','role_csv');

$SEL_TITLE = $hasP_title     ? "COALESCE(NULLIF(p.title,''), p.slug)"
           : ($hasP_pagename ? "COALESCE(NULLIF(p.page_name,''), p.slug)"
                             : "p.slug");
$SEL_PATH  = $hasP_openpath  ? "CASE WHEN NULLIF(p.open_path,'') IS NOT NULL THEN p.open_path ELSE CONCAT('/erp/', p.slug, '.php') END"
                             : "CONCAT('/erp/', p.slug, '.php')";
$SEL_CAT   = $hasP_category  ? "COALESCE(NULLIF(p.category,''),'General')"
                             : "'General'";
$COND_ACTIVE = $hasP_isactive ? "AND COALESCE(p.is_active,1)=1" : "";

/* --- Collect links from multiple sources -------------------------------- */
$items = [];      // slug => row
$log   = [];

/* (A) NEW: page_acl_grants + page_permissions */
if ($HAS_ACL && $HAS_PPERM) {
  $sql = "SELECT p.slug,
                 {$SEL_TITLE} AS title,
                 {$SEL_PATH}  AS path,
                 {$SEL_CAT}   AS category,
                 'acl_grant'  AS _src
          FROM page_acl_grants g
          JOIN page_permissions p
            ON p.company_id = g.company_id AND p.slug = g.page_slug
          WHERE g.company_id = :cid
            AND g.user_id    = :uid
            AND COALESCE(g.can_view,1) = 1
            {$COND_ACTIVE}
          ORDER BY p.slug";
  $st=$pdo->prepare($sql);
  $st->execute([':cid'=>$company_id, ':uid'=>$user_id]);
  foreach ($st->fetchAll(PDO::FETCH_ASSOC) as $r){
    $items[$r['slug']] = $r; $log[]="A: ".$r['slug'];
  }
}

/* (B) LEGACY: page_access (user->slug) + best-effort enrich from page_permissions */
if ($HAS_PACC) {
  $hasAllowed = col_exists($pdo,'page_access','is_allowed');
  $hasCompany = col_exists($pdo,'page_access','company_id');
  $cond = [];
  $cond[] = $hasCompany ? "company_id=:cid" : "1=1";
  $cond[] = "user_id=:uid";
  if ($hasAllowed) $cond[]="COALESCE(is_allowed,1)=1";
  $sql = "SELECT page_slug AS slug FROM page_access WHERE ".implode(" AND ",$cond);
  $st=$pdo->prepare($sql);
  $bind=[':uid'=>$user_id]; if($hasCompany){$bind[':cid']=$company_id;}
  $st->execute($bind);
  $legacy = $st->fetchAll(PDO::FETCH_COLUMN) ?: [];

$permMap=[];
  if ($legacy && $HAS_PPERM){
    $in=implode(",",array_fill(0,count($legacy),"?" ));
    $sql2="SELECT slug, {$SEL_TITLE} AS title, {$SEL_PATH} AS path, {$SEL_CAT} AS category
           FROM page_permissions WHERE company_id=? {$COND_ACTIVE} AND slug IN ($in)";
    $st2=$pdo->prepare($sql2);
    $st2->execute(array_merge([$company_id],$legacy));
    foreach($st2->fetchAll(PDO::FETCH_ASSOC) as $r){ $permMap[$r['slug']]=$r; }
  }
  foreach ($legacy as $slug){
    if(!isset($items[$slug])){
      $r = $permMap[$slug] ?? [
        'slug'=>$slug, 'title'=>$slug, 'path'=>"/erp/{$slug}.php", 'category'=>'General', '_src'=>'legacy_access'
      ];
      $r['_src']='legacy_access';
      $items[$slug]=$r;
    }
    $log[]="B: ".$slug;
  }
}

/* (C) Role-based defaults from page_permissions (allowed_roles/role_csv) */
if ($HAS_PPERM && ($hasP_allowed || $hasP_rolecsv)) {
  $roleCol = $hasP_allowed ? 'allowed_roles' : 'role_csv';
  $sql="SELECT slug, {$SEL_TITLE} AS title, {$SEL_PATH} AS path, {$SEL_CAT} AS category
        FROM page_permissions
        WHERE company_id=:cid {$COND_ACTIVE} AND FIND_IN_SET(:role, {$roleCol})";
  $st=$pdo->prepare($sql);
  $st->execute([':cid'=>$company_id, ':role'=>$user_role]);
  foreach($st->fetchAll(PDO::FETCH_ASSOC) as $r){
    if(!isset($items[$r['slug']])){ $r['_src']='role_default'; $items[$r['slug']]=$r; }
    $log[]="C: ".$r['slug'];
  }
}

/* --- Normalize + sort ---------------------------------------------------- */
$cards = array_values($items);
usort($cards,function($a,$b){
  $c = strcmp($a['category']??'General',$b['category']??'General'); if($c!==0) return $c;
  return strcmp(strtoupper($a['title']), strtoupper($b['title']));
});

$isEmployee = (strcasecmp($user_role,'Employee')===0);
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Mr. Manager — Employee Portal</title>
<style>
:root{--mm-green:#34A853;--mm-mint:#F5FFF7;--mm-gray:#5F6368;}
body{margin:0;font-family:system-ui,-apple-system,Segoe UI,Roboto,Helvetica,Arial,sans-serif;background:#f7fff9;}
.topbar{display:flex;gap:16px;align-items:center;padding:10px 18px;background:linear-gradient(90deg,var(--mm-mint),#e9ffef);}
.brand{font-weight:700;}
.tag{background:#e8f5e9;color:#1b5e20;padding:4px 8px;border-radius:999px;font-size:12px;}
.wrap{max-width:1200px;margin:18px auto;padding:0 16px;}
.panel{background:#fff;border-radius:14px;padding:18px;box-shadow:0 10px 24px rgba(0,0,0,.06);}
h1{margin:0 0 8px;font-size:24px;}
.muted{color:#4b5563;font-size:14px;}
h2{margin:0 0 10px;font-size:20px;}
.grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(260px,1fr));gap:14px;}
.card{background:#fff;border:1px solid #ecf2ec;border-radius:16px;padding:16px;box-shadow:0 6px 14px rgba(52,168,83,.08);}
.card a{display:block;text-decoration:none;color:inherit;}
.card .title{font-weight:700;margin-bottom:8px;}
.card .slug{font-size:12px;color:#6b7280;}
.badge{display:inline-block;font-size:11px;padding:3px 8px;border-radius:999px;background:#eef7ff;}
.empty{padding:28px;text-align:center;color:#6b7280;}
.debug{margin-top:18px;font-family:ui-monospace,Consolas,monospace;font-size:12px;white-space:pre-wrap;background:#0f172a;color:#e5e7eb;padding:12px;border-radius:10px;}
.logout{margin-left:auto}.btn{background:var(--mm-green);color:#fff;border:none;padding:8px 14px;border-radius:10px;cursor:pointer;}
</style>
</head>
<body>
  <div class="topbar">
    <div class="brand">Mr. Manager</div>
    <span class="tag"><?= $isEmployee ? 'Employee' : esc($user_role) ?></span>
    <div class="logout"><a class="btn" href="/erp/public/logout.php">Logout</a></div>
  </div>

<div class="wrap">
    <div class="panel" style="margin-bottom:14px;">
      <h1>Welcome, <?= esc($u['name'] ?? 'User'); ?> 👋</h1>
      <div class="muted">Company ID: <?= $company_id; ?> • Role: <?= esc($user_role); ?></div>
    </div>

<div class="panel">
      <h2>Your Access</h2>
      <?php if(!$cards): ?>
        <div class="empty">No pages granted for your account.</div>
      <?php else: ?>
        <div class="grid">
          <?php foreach($cards as $c): ?>
            <div class="card">
              <a href="<?= esc($c['path']); ?>">
                <div class="title"><?= esc($c['title']); ?></div>
                <div class="slug"><?= esc($c['slug']); ?> · <span class="badge"><?= esc($c['category']); ?></span></div>
              </a>
            </div>
          <?php endforeach; ?>
        </div>
      <?php endif; ?>
    </div>

<?php if(!empty($_GET['debug'])): ?>
      <div class="debug"><?= esc("DEBUG sources:\n".implode("\n",$log)."\n\nResolved cards:\n".print_r($cards,true)); ?></div>
    <?php endif; ?>
  </div>
</body>
</html>