View Code - 20260723

page_permissions_add.php | 20260723_000646.php Initial Domain Snapshot

<?php
// page_permissions_grant_user.php
// Grant page permission to a specific user (no department filter).
// Uses modules/auth/page_acl.php and project rules.

require_once __DIR__ . '/modules/auth/page_acl.php';
$ctx = page_require_access('page_permissions_grant_user');
$pdo = $ctx['pdo'] ?? null;
$company_id = (int)($ctx['company_id'] ?? 0);
$user = $ctx['user'] ?? null;
require_once __DIR__ . '/modules/activity/activity_logger.php';

if (!$pdo) require_once __DIR__ . '/core/db.php';

// Safe session start
if (session_status() !== PHP_SESSION_ACTIVE) session_start();
if (empty($_SESSION['csrf_token'])) $_SESSION['csrf_token'] = bin2hex(random_bytes(16));
$csrf_token = $_SESSION['csrf_token'];

$errors = [];
$success = null;

// ----------- FORM SUBMIT -------------
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!hash_equals($csrf_token, $_POST['csrf_token'] ?? '')) {
        $errors[] = "Invalid CSRF token.";
    } else {
        $selected_user_id = (int)($_POST['user_id'] ?? 0);
        $slug = trim($_POST['slug'] ?? '');

if ($selected_user_id <= 0) $errors[] = "Select a user.";
        if ($slug === '') $errors[] = "Page slug is required.";

if (empty($errors)) {
            try {
                $default_roles = ['Owner','Admin'];

// Check existing permission
                $s = $pdo->prepare("SELECT id, allow_roles, allow_user_ids 
                                    FROM page_permissions 
                                    WHERE company_id = :cid AND slug = :slug LIMIT 1");
                $s->execute([':cid' => $company_id, ':slug' => $slug]);
                $row = $s->fetch(PDO::FETCH_ASSOC);

if (!$row) {
                    // Create new row
                    $ins = $pdo->prepare("
                        INSERT INTO page_permissions
                        (company_id, slug, allow_roles, allow_user_ids, is_enabled, granted_by, granted_at)
                        VALUES (:cid, :slug, :roles, :uids, 1, :uid, NOW())
                    ");

$ok = $ins->execute([
                        ':cid'   => $company_id,
                        ':slug'  => $slug,
                        ':roles' => json_encode($default_roles),
                        ':uids'  => json_encode([$selected_user_id]),
                        ':uid'   => $user['id'] ?? null
                    ]);
                    if ($ok) {
                      activity_log([
                        'company_id'  => $company_id,
                        'user_id'     => (int)($user['id'] ?? 0),
                        'module'      => 'page_permissions',
                        'action_name' => 'create',
                        'entity_type' => 'page_permission',
                        'entity_id'   => (int)$pdo->lastInsertId(),
                        'remarks'     => "Granted {$slug} to user {$selected_user_id}"
                      ]);
                      $success = "Permission created and granted to user ID {$selected_user_id}.";
                    }
                } else {
                    // Update: merge user IDs
                    $current_roles = json_decode($row['allow_roles'], true) ?: [];
                    $current_uids  = array_map('intval', json_decode($row['allow_user_ids'], true) ?: []);

// Always ensure Owner/Admin remain
                    foreach ($default_roles as $r)
                        if (!in_array($r, $current_roles, true)) $current_roles[] = $r;

// Add user ID (no duplicates)
                    if (!in_array($selected_user_id, $current_uids))
                        $current_uids[] = $selected_user_id;

$upd = $pdo->prepare("
                        UPDATE page_permissions
                        SET allow_roles = :roles,
                            allow_user_ids = :uids,
                            is_enabled = 1,
                            granted_by = :uid,
                            granted_at = NOW()
                        WHERE id = :id AND company_id = :cid
                    ");

$upd->execute([
                        ':roles' => json_encode(array_values($current_roles)),
                        ':uids'  => json_encode(array_values($current_uids)),
                        ':uid'   => $user['id'] ?? null,
                        ':id'    => (int)$row['id'],
                        ':cid'   => $company_id
                    ]);

activity_log([
                      'company_id'  => $company_id,
                      'user_id'     => (int)($user['id'] ?? 0),
                      'module'      => 'page_permissions',
                      'action_name' => 'edit',
                      'entity_type' => 'page_permission',
                      'entity_id'   => (int)$row['id'],
                      'remarks'     => "Updated {$slug} permission for user {$selected_user_id}"
                    ]);

$success = "Permission updated. User ID {$selected_user_id} granted.";
                }

} catch (PDOException $e) {
                $errors[] = $e->getMessage();
            }
        }
    }
}

// ---------- Load Users (directly) ----------
$users = [];
try {
    // Adjust if your table name or columns are different
    $q = $pdo->prepare("
        SELECT id, COALESCE(name, username) AS uname, username 
        FROM users
        WHERE company_id = :cid
        ORDER BY uname ASC
    ");
    $q->execute([':cid' => $company_id]);
    $users = $q->fetchAll(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
    $errors[] = "Error loading users: ".$e->getMessage();
}

require_once __DIR__ . '/partials/header.php';
?>

<div class="card">
  <div class="card-header"><h3>Grant Page Permission to User</h3></div>
  <div class="card-body">

<?php if ($success): ?>
      <div class="notice success"><?= htmlspecialchars($success) ?></div>
    <?php endif; ?>

<?php if ($errors): ?>
      <div class="notice danger">
        <ul><?php foreach ($errors as $e) echo "<li>".htmlspecialchars($e)."</li>"; ?></ul>
      </div>
    <?php endif; ?>

<div class="form-row">
        <label for="user_id">User</label>
        <select id="user_id" name="user_id" required>
            <option value="">-- Select User --</option>
            <?php foreach ($users as $u): ?>
              <option value="<?= $u['id'] ?>">
                <?= htmlspecialchars($u['uname']) ?> (ID: <?= $u['id'] ?>)
              </option>
            <?php endforeach; ?>
        </select>
      </div>

<div class="form-row">
        <label for="slug">Page Slug</label>
        <input id="slug" name="slug" type="text" required placeholder="e.g. employee_register">
        <small>User will be added to allow_user_ids for this slug.</small>
      </div>

<div class="form-row">
        <button class="btn btn-primary">Grant Permission</button>
        <a href="page_permissions_manage.php" class="btn">Back to Manage</a>
      </div>
    </form>

</div>
</div>

<?php require_once __DIR__ . '/partials/footer.php'; ?>