View Code - 20260722

user_role_manage.php | 20260722_120325.php Initial Domain Snapshot

<?php
/* =============================================================================
   File: /erp/user_role_manage.php
   Purpose: Add / Edit / Delete User Roles
   ========================================================================== */

require_once __DIR__ . '/modules/auth/page_acl.php';
$ctx = page_require_access('users_manage');

$u          = $ctx['user'] ?? null;
$company_id = (int)($ctx['company_id'] ?? 0);
$pdo        = $ctx['pdo'] ?? null;
require_once __DIR__ . '/modules/activity/activity_logger.php';

/* -----------------------------------------------------------------------------
   Helpers
----------------------------------------------------------------------------- */
if (!function_exists('h')) {
    function h($str)
    {
        return htmlspecialchars((string)$str, ENT_QUOTES, 'UTF-8');
    }
}

/* -----------------------------------------------------------------------------
   CSRF
----------------------------------------------------------------------------- */
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

/* -----------------------------------------------------------------------------
   Defaults
----------------------------------------------------------------------------- */
$errors  = [];
$success = '';

$edit_id   = 0;
$role_name = '';
$status    = 1;

/* -----------------------------------------------------------------------------
   Delete
----------------------------------------------------------------------------- */
if (
    isset($_GET['delete'])
    && ctype_digit($_GET['delete'])
) {

$delete_id = (int)$_GET['delete'];

$del = $pdo->prepare("
        DELETE FROM user_roles
        WHERE id = :id
          AND company_id = :cid
        LIMIT 1
    ");

$del->execute([
        ':id'  => $delete_id,
        ':cid' => $company_id
    ]);

activity_log([
        'company_id'  => $company_id,
        'user_id'     => (int)($u['id'] ?? 0),
        'module'      => 'users',
        'action_name' => 'delete',
        'entity_type' => 'user_role',
        'entity_id'   => $delete_id,
        'remarks'     => 'Deleted user role'
    ]);

header("Location: user_role_manage.php?deleted=1");
    exit;
}

/* -----------------------------------------------------------------------------
   Edit Load
----------------------------------------------------------------------------- */
if (
    isset($_GET['edit'])
    && ctype_digit($_GET['edit'])
) {

$edit_id = (int)$_GET['edit'];

$qry = $pdo->prepare("
        SELECT
            id,
            role_name,
            status
        FROM user_roles
        WHERE id = :id
          AND company_id = :cid
        LIMIT 1
    ");

$qry->execute([
        ':id'  => $edit_id,
        ':cid' => $company_id
    ]);

$row = $qry->fetch(PDO::FETCH_ASSOC);

if ($row) {
        $role_name = $row['role_name'];
        $status    = (int)$row['status'];
    }
}

/* -----------------------------------------------------------------------------
   Save
----------------------------------------------------------------------------- */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$csrf = $_POST['csrf_token'] ?? '';

if (!hash_equals($_SESSION['csrf_token'], $csrf)) {
        $errors[] = 'Invalid CSRF token.';
    }

$edit_id   = (int)($_POST['edit_id'] ?? 0);
    $role_name = trim($_POST['role_name'] ?? '');
    $status    = (int)($_POST['status'] ?? 1);

if ($role_name === '') {
        $errors[] = 'Role name is required.';
    }

/* -------------------------------------------------------------------------
       Duplicate Check
    ------------------------------------------------------------------------- */
    if (!$errors) {

$dup = $pdo->prepare("
            SELECT id
            FROM user_roles
            WHERE company_id = :cid
              AND LOWER(role_name) = LOWER(:role_name)
              AND id != :id
            LIMIT 1
        ");

$dup->execute([
            ':cid'       => $company_id,
            ':role_name' => $role_name,
            ':id'        => $edit_id
        ]);

if ($dup->fetch()) {
            $errors[] = 'Role already exists.';
        }
    }

/* -------------------------------------------------------------------------
       Insert / Update
    ------------------------------------------------------------------------- */
    if (!$errors) {

if ($edit_id > 0) {

$upd = $pdo->prepare("
                UPDATE user_roles
                SET
                    role_name = :role_name,
                    status    = :status
                WHERE id = :id
                  AND company_id = :cid
                LIMIT 1
            ");

$upd->execute([
                ':role_name' => $role_name,
                ':status'    => $status,
                ':id'        => $edit_id,
                ':cid'       => $company_id
            ]);

activity_log([
                'company_id'  => $company_id,
                'user_id'     => (int)($u['id'] ?? 0),
                'module'      => 'users',
                'action_name' => 'edit',
                'entity_type' => 'user_role',
                'entity_id'   => $edit_id,
                'remarks'     => "Updated user role {$role_name}"
            ]);

header("Location: user_role_manage.php?updated=1");
            exit;

} else {

$ins = $pdo->prepare("
                INSERT INTO user_roles
                (
                    company_id,
                    role_name,
                    status
                )
                VALUES
                (
                    :company_id,
                    :role_name,
                    :status
                )
            ");

$ins->execute([
                ':company_id' => $company_id,
                ':role_name'  => $role_name,
                ':status'     => $status
            ]);

activity_log([
                'company_id'  => $company_id,
                'user_id'     => (int)($u['id'] ?? 0),
                'module'      => 'users',
                'action_name' => 'create',
                'entity_type' => 'user_role',
                'entity_id'   => (int)$pdo->lastInsertId(),
                'remarks'     => "Created user role {$role_name}"
            ]);

header("Location: user_role_manage.php?added=1");
            exit;
        }
    }
}

/* -----------------------------------------------------------------------------
   Messages
----------------------------------------------------------------------------- */
if (isset($_GET['added'])) {
    $success = 'Role added successfully.';
}

if (isset($_GET['updated'])) {
    $success = 'Role updated successfully.';
}

if (isset($_GET['deleted'])) {
    $success = 'Role deleted successfully.';
}

/* -----------------------------------------------------------------------------
   Role List
----------------------------------------------------------------------------- */
$list = $pdo->prepare("
    SELECT
        id,
        role_name,
        status
    FROM user_roles
    WHERE company_id = :cid
    ORDER BY role_name ASC
");

$list->execute([
    ':cid' => $company_id
]);

$roles = $list->fetchAll(PDO::FETCH_ASSOC);

require_once __DIR__ . '/partials/header.php';
?>

<?php if ($errors): ?>

<?php foreach ($errors as $e): ?>
                            <li><?= h($e) ?></li>
                        <?php endforeach; ?>

</ul>
                </div>

<?php endif; ?>

<?php if ($success): ?>

<?php endif; ?>

<input
                            type="text"
                            name="role_name"
                            class="form-control"
                            value="<?= h($role_name) ?>"
                            required
                        >

</div>

<label class="form-label">
                            Status
                        </label>

<option value="1" <?= $status == 1 ? 'selected' : '' ?>>
                                Active
                            </option>

<option value="0" <?= $status == 0 ? 'selected' : '' ?>>
                                Inactive
                            </option>

</select>

</div>

<?= $edit_id > 0 ? 'Update Role' : 'Save Role' ?>

</button>

<?php if ($edit_id > 0): ?>

<a
                        href="user_role_manage.php"
                        class="btn btn-secondary"
                    >
                        Cancel
                    </a>

<?php endif; ?>

</form>

</div>

<thead>

<tr>
                            <th width="80">ID</th>
                            <th>Role Name</th>
                            <th width="120">Status</th>
                            <th width="180">Action</th>
                        </tr>

</thead>

<tbody>

<?php if (!$roles): ?>

<tr>
                                <td colspan="4" class="text-center">
                                    No roles found.
                                </td>
                            </tr>

<?php else: ?>

<?php foreach ($roles as $r): ?>

<tr>

<td>

<?php if ((int)$r['status'] === 1): ?>

<span class="badge bg-success">
                                                Active
                                            </span>

<?php else: ?>

<span class="badge bg-danger">
                                                Inactive
                                            </span>

<?php endif; ?>

</td>

<td>

<a
                                            href="?edit=<?= (int)$r['id'] ?>"
                                            class="btn btn-sm btn-primary"
                                        >
                                            Edit
                                        </a>

<a
                                            href="?delete=<?= (int)$r['id'] ?>"
                                            class="btn btn-sm btn-danger"
                                            onclick="return confirm('Delete this role?');"
                                        >
                                            Delete
                                        </a>

</td>

</tr>

<?php endforeach; ?>

<?php endif; ?>

</tbody>

</table>

</div>

<?php require_once __DIR__ . '/partials/footer.php'; ?>