View Code - 20260723

page_permissions_user_manage.php | 20260723_000646.php Initial Domain Snapshot

<?php
ob_start();

require_once __DIR__ . '/modules/auth/auth.php';
require_once __DIR__ . '/modules/activity/activity_logger.php';

if (!function_exists('auth_user')) {
    die('Authentication function auth_user() not found. Please check your auth.php include.');
}

$user = auth_user();
if (!$user || !is_array($user)) {
    header("Location: /erp/public/login.php");
    exit();
}
$company_id = (int)($user['company_id'] ?? 0);

require_once __DIR__ . '/core/db.php';
include_once __DIR__ . '/partials/header.php';

function h($s) { return htmlspecialchars((string)$s, ENT_QUOTES); }
function url_to_slug($url) {
    $url = trim((string)$url);
    if ($url === '' || $url === '#' || stripos($url, 'javascript:') === 0) {
        return '';
    }

$path = (string)parse_url($url, PHP_URL_PATH);
    $slug = basename($path !== '' ? $path : $url, '.php');
    $slug = trim($slug, '/');

return $slug === '#' ? '' : $slug;
}

// Users list for selected company
$users = [];
try {
    $stmt = $pdo->prepare("SELECT id, name FROM users WHERE is_active=1 AND company_id=? ORDER BY name ASC");
    $stmt->execute([$company_id]);
    $users = $stmt->fetchAll(PDO::FETCH_ASSOC);
    if (!is_array($users)) $users = [];
} catch (Throwable $e) { $users = []; }

// Menu sections
$sections = [];
try {
    $stmt = $pdo->query("SELECT id, name FROM nav_menu_sections WHERE is_enabled=1 ORDER BY sort_order, name ASC");
    $sections = $stmt->fetchAll(PDO::FETCH_ASSOC);
    if (!is_array($sections)) $sections = [];
} catch (Throwable $e) { $sections = []; }

// Menu items with slug fallback
$items = [];
$items_slug_map = [];
try {
    $stmt2 = $pdo->query("SELECT id, section_id, title, slug, url FROM nav_menu_items WHERE is_enabled=1 ORDER BY section_id ASC, sort_order ASC, title ASC");
    while ($row = $stmt2->fetch(PDO::FETCH_ASSOC)) {
        $slug = trim((string)($row['slug'] ?? ''));
        if (empty($slug)) { $slug = url_to_slug($row['url'] ?? ''); }
        $slug = strtolower(trim($slug, '/'));
        if ($slug === '#' || $slug === '') continue;
        if ($slug === '') continue;
        $items[$row['section_id']][] = $row;
        $items_slug_map[(int)$row['id']] = $slug;
    }
} catch (Throwable $e) { $items = []; $items_slug_map = []; }

$selected_user = 0;
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['user_id'])) {
    $selected_user = (int)$_POST['user_id'];
} elseif (isset($_GET['user_id'])) {
    $selected_user = (int)$_GET['user_id'];
}

$page_perms = [];
if ($selected_user) {
    try {
        $stmt = $pdo->prepare("SELECT slug, allow_user_ids FROM page_permissions WHERE is_enabled=1");
        $stmt->execute();
        while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
            $user_ids = json_decode($row['allow_user_ids'] ?? '[]', true);
            if (is_array($user_ids) && in_array($selected_user, $user_ids)) {
                $page_perms[$row['slug']] = true;
            }
        }
    } catch (Throwable $e) { $page_perms = []; }
}

$success = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $selected_user) {
    $allowed_item_ids = isset($_POST['perm']) ? array_map('intval', array_keys($_POST['perm'])) : [];
    $perm_map = [];
    $stmt = $pdo->query("SELECT id, slug, allow_user_ids FROM page_permissions WHERE is_enabled=1");
    while ($r = $stmt->fetch(PDO::FETCH_ASSOC)) {
        $uids = json_decode($r['allow_user_ids'] ?? '[]', true);
        $perm_map[(int)$r['id']] = ['slug' => $r['slug'], 'user_ids' => is_array($uids) ? $uids : []];
    }

$processed_slugs = [];

foreach ($items_slug_map as $item_id => $slug) {
        if (isset($processed_slugs[$slug])) {
            continue;
        }
        $processed_slugs[$slug] = true;

$in_perm = in_array($item_id, $allowed_item_ids);
        $exists_id = null;
        foreach ($perm_map as $pid => $pinfo) {
            if ($pinfo['slug'] === $slug) {
                $exists_id = $pid;
                break;
            }
        }
        if ($exists_id) {
            $cur_users = $perm_map[$exists_id]['user_ids'];
            if ($in_perm && !in_array($selected_user, $cur_users)) {
                $cur_users[] = $selected_user;
            }
            if (!$in_perm && in_array($selected_user, $cur_users)) {
                $cur_users = array_values(array_diff($cur_users, [$selected_user]));
            }
            $pdo->prepare("UPDATE page_permissions SET allow_user_ids=?, company_id=?, granted_by=? WHERE id=?")
                ->execute([json_encode($cur_users), $company_id, $user['id'], $exists_id]);
        } elseif ($in_perm) {
            $pdo->prepare("INSERT INTO page_permissions (company_id, slug, allow_user_ids, is_enabled, granted_by, granted_at) VALUES (?, ?, ?, 1, ?, NOW())")
                ->execute([
                    $company_id,
                    $slug,
                    json_encode([$selected_user]),
                    $user['id']
                ]);

$perm_map[(int)$pdo->lastInsertId()] = [
                'slug' => $slug,
                'user_ids' => [$selected_user]
            ];
        }
    }

activity_log([
        'company_id'  => $company_id,
        'user_id'     => (int)($user['id'] ?? 0),
        'module'      => 'page_permissions',
        'action_name' => 'edit',
        'entity_type' => 'user_permission',
        'entity_id'   => $selected_user,
        'remarks'     => 'Updated page permissions for user'
    ]);

header("Location: " . $_SERVER['PHP_SELF'] . "?user_id=$selected_user&success=1");
    exit;
}
if (isset($_GET['success'])) { $success = "Permissions updated!"; }
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Roll and permission</title>
</head>
<body>
<div class="container py-4" style="max-width: 900px;">
    <div class="card shadow-sm border-0">
        <div class="card-header bg-primary text-white py-3">
            <h2 class="h5 mb-0 fw-bold text-center">Roll and permission</h2>
        </div>
        <div class="card-body bg-light">
            <form method="get" class="row g-3 align-items-end mb-4">
                <div class="col-md-12">
                    <label for="user-select" class="form-label fw-semibold">User</label>
                    <select id="user-select" name="user_id" class="form-select" onchange="this.form.submit()">
                        <option value="">Select User</option>
                        <?php if (is_array($users)): foreach ($users as $u): ?>
                            <option value="<?= (int)$u['id'] ?>"<?= $selected_user == $u['id'] ? ' selected' : '' ?>>
                                <?= h($u['name']) ?>
                            </option>
                        <?php endforeach; endif; ?>
                    </select>
                </div>
            </form>

<?php if ($selected_user): ?>
                <form method="post">
                    <input type="hidden" name="user_id" value="<?= $selected_user ?>">

<?php if ($success): ?>
                        <div class="alert alert-success text-center"><?= h($success) ?></div>
                    <?php endif; ?>

<?php if (is_array($sections)): foreach ($sections as $section): ?>
                        <div class="card mb-4 border-0 shadow-sm section">
                            <div class="card-header bg-white d-flex justify-content-between align-items-center">
                                <span class="fw-semibold"><?= h($section['name']) ?></span>
                                <div class="form-check m-0">
                                    <input type="checkbox" class="form-check-input all-checkbox" id="all-<?= (int)$section['id'] ?>">
                                    <label class="form-check-label" for="all-<?= (int)$section['id'] ?>">All</label>
                                </div>
                            </div>

<?php if (!empty($items[$section['id']])): ?>
                                <div class="list-group list-group-flush">
                                    <?php foreach ($items[$section['id']] as $item):
                                        $checked = !empty($page_perms[$items_slug_map[$item['id']]]); ?>
                                        <label class="list-group-item d-flex justify-content-between align-items-center perm-row mb-0">
                                            <input type="text" class="form-control me-3 bg-light" value="<?= h($item['title']) ?>" readonly>
                                            <input type="checkbox" class="form-check-input mt-0" name="perm[<?= (int)$item['id'] ?>]" <?= $checked ? 'checked' : '' ?>>
                                        </label>
                                    <?php endforeach; ?>
                                </div>
                            <?php endif; ?>
                        </div>
                    <?php endforeach; endif; ?>

<div class="d-flex justify-content-end gap-2">
                        <button type="reset" class="btn btn-outline-secondary">Reset</button>
                        <button type="submit" class="btn btn-primary">Update</button>
                    </div>
                </form>
            <?php endif; ?>
        </div>
    </div>
</div>
<script>
document.addEventListener("DOMContentLoaded", function() {
    document.querySelectorAll('.section').forEach(function(section) {
        const allCheckbox = section.querySelector('.all-checkbox');
        if (!allCheckbox) return;
        allCheckbox.addEventListener('change', function() {
            const checkboxes = section.querySelectorAll('.perm-row input[type="checkbox"]');
            checkboxes.forEach(function(chk) { chk.checked = allCheckbox.checked; });
        });
        const permCheckboxes = section.querySelectorAll('.perm-row input[type="checkbox"]');
        permCheckboxes.forEach(function(chk) {
            chk.addEventListener('change', function() { allCheckbox.checked = Array.from(permCheckboxes).every(c => c.checked); });
        });
        allCheckbox.checked = permCheckboxes.length && Array.from(permCheckboxes).every(c => c.checked);
    });
});
</script>
<?php
include_once __DIR__ . '/partials/footer.php';
ob_end_flush();
?>
</body>
</html>