View Code - 20260723

khata_ad.php | 20260723_000646.php Initial Domain Snapshot

<?php
/* ============================================================================
   File: /erp/khata_add.php
   Purpose: Add new khata (company-scoped)
   Author: assistant (ERP standard-compliant)
   ============================================================================ */

require_once __DIR__ . '/modules/auth/page_acl.php';
$ctx = page_require_access('khata_add');
$user = $ctx['user'] ?? null;
$company_id = (int)($ctx['company_id'] ?? 0);
$pdo = $ctx['pdo'] ?? null;

if (!$pdo) {
    require_once __DIR__ . '/core/db.php';
    if (isset($GLOBALS['pdo'])) $pdo = $GLOBALS['pdo'];
}

if (!$pdo) {
    die("Database connection not available.");
}

if (!function_exists('h')) {
    function h($s) { return htmlspecialchars($s ?? '', ENT_QUOTES, 'UTF-8'); }
}

// CSRF
if (session_status() === PHP_SESSION_NONE) session_start();
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(16));
}

$errors = [];
$success = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $token = $_POST['csrf_token'] ?? '';
    if (!hash_equals($_SESSION['csrf_token'], (string)$token)) {
        $errors[] = "Invalid CSRF token.";
    }

$name = trim($_POST['name'] ?? '');
    $code = trim($_POST['code'] ?? '');
    $machine_from = (int)($_POST['machine_from'] ?? 0);
    $machine_to = (int)($_POST['machine_to'] ?? 0);
    $is_active = isset($_POST['is_active']) ? 1 : 0;

if ($name === '') $errors[] = "Khata name required.";
    if ($code === '') $errors[] = "Khata code required.";
    if ($machine_from <= 0) $errors[] = "Machine From required.";
    if ($machine_to <= 0) $errors[] = "Machine To required.";
    if ($company_id <= 0) $errors[] = "Invalid company context.";

// Check duplicates (per company)
    if (empty($errors)) {
        $chk = $pdo->prepare("SELECT COUNT(*) FROM khatas WHERE company_id = :cid AND code = :code");
        $chk->execute([':cid' => $company_id, ':code' => $code]);
        if ($chk->fetchColumn() > 0) {
            $errors[] = "Duplicate Khata code in this company.";
        }
    }

if (empty($errors)) {
        try {
            $stmt = $pdo->prepare("
                INSERT INTO khatas (company_id, name, code, machine_from, machine_to, is_active)
                VALUES (:cid, :name, :code, :from, :to, :active)
            ");
            $stmt->execute([
                ':cid' => $company_id,
                ':name' => $name,
                ':code' => $code,
                ':from' => $machine_from,
                ':to' => $machine_to,
                ':active' => $is_active
            ]);

$success = "Khata '{$name}' added successfully!";
            $_SESSION['csrf_token'] = bin2hex(random_bytes(16));
        } catch (Exception $e) {
            $errors[] = "Database error: " . $e->getMessage();
        }
    }
}

require_once __DIR__ . '/partials/header.php';
?>

<h4 class="fw-bold mb-4">Add New Khata</h4>

<?php if (!empty($errors)): ?>
        <div class="alert alert-danger">
          <ul class="mb-0">
            <?php foreach ($errors as $err): ?>
              <li><?= h($err); ?></li>
            <?php endforeach; ?>
          </ul>
        </div>
      <?php endif; ?>

<?php if ($success): ?>
        <div class="alert alert-success">
          <?= h($success); ?>
        </div>
      <?php endif; ?>

<div class="col-md-6">
            <label class="form-label">Khata Name</label>
            <input type="text"
                   name="name"
                   class="form-control"
                   required
                   placeholder="Enter khata name">
          </div>

<div class="col-md-6">
            <label class="form-label">Khata Code</label>
            <input type="text"
                   name="code"
                   class="form-control"
                   required
                   placeholder="e.g., MST1">
          </div>

<div class="col-md-3">
            <label class="form-label">Machine From</label>
            <input type="number"
                   name="machine_from"
                   class="form-control"
                   required
                   min="1"
                   placeholder="Start machine no.">
          </div>

<div class="col-md-3">
            <label class="form-label">Machine To</label>
            <input type="number"
                   name="machine_to"
                   class="form-control"
                   required
                   min="1"
                   placeholder="End machine no.">
          </div>

<div class="col-md-3 d-flex align-items-end">
            <div class="form-check">
              <input type="checkbox"
                     name="is_active"
                     class="form-check-input"
                     id="is_active"
                     checked>
              <label class="form-check-label" for="is_active">
                Active
              </label>
            </div>
          </div>

<div class="col-12 text-end mt-3">
            <button type="submit"
                    class="btn btn-primary px-4 fw-semibold">
              Add Khata
            </button>

</div>
      </form>

<div class="mt-3 small text-muted">
        Company ID: <?= h($company_id); ?> |
        Auth user: <?= h($user['username'] ?? ''); ?>
      </div>

</div>
  </div>

</div>

<?php require_once __DIR__ . '/partials/footer.php'; ?>