<?php
include '../db/db.php';
session_start();
$log = htmlspecialchars(trim($_SESSION['user']), ENT_QUOTES, 'UTF-8');
$log_lang = htmlspecialchars(trim($_SESSION['lang']), ENT_QUOTES, 'UTF-8');

$menu = htmlspecialchars(trim($_SESSION['menu']), ENT_QUOTES, 'UTF-8');
$emp_id = htmlspecialchars(trim($_SESSION['emp_id']), ENT_QUOTES, 'UTF-8');

if (empty($log)) {
	$redirectUrl = "index.php";
	echo "<script type=\"text/javascript\">";
	echo "window.location.href = '$redirectUrl'";
	echo "</script>";

} else {

	$sqlu = "SELECT * FROM user_priv_q WHERE emp_id='$emp_id' AND user='$log' AND menu_id='$menu'";
	$resultu = mysqli_query($conn, $sqlu);
	$countu = mysqli_num_rows($resultu);

	if($countu == 1){
		$rowc = mysqli_fetch_assoc($resultu);
		$user_id = $rowc['user_id'];

		/****************************** Insert *************************************/
		
		if (array_key_exists('create_user', $_POST)) {
			$group = htmlspecialchars(strip_tags(trim($_POST['group'])), ENT_QUOTES, 'UTF-8');
			$emp_id = htmlspecialchars(strip_tags(trim($_POST['emp_id'])), ENT_QUOTES, 'UTF-8');
			$username = htmlspecialchars(strip_tags(trim($_POST['username'])), ENT_QUOTES, 'UTF-8');
			$pass = htmlspecialchars(strip_tags(trim($_POST['password'])), ENT_QUOTES, 'UTF-8');
			
			// Password Hash
			$password = hash('sha256', $pass);

			$sql_usr = mysqli_query($conn, "SELECT user FROM user_acc_tbl WHERE user='$username'");

			if($log_lang == 1) {
				if(mysqli_num_rows($sql_usr) == 0) {
					$sql = "INSERT INTO user_acc_tbl SET emp_id='$emp_id', user='$username', pass='$password', group_id='$group', access=1";

					if(mysqli_query($conn, $sql)) {
						echo json_encode(array("msgType" => 1, "msg" => "Successfully Added"));
					
					} else {
						echo json_encode(array("msgType" => 2, "msg" => "Sorry ! Could not be Save Data"));
					}
				
				} else {
					echo json_encode(array("msgType" => 3, "msg" => "Data Already Exist"));
				}
			}
		}
		
		/****************************** Remove *************************************/
		
		if (array_key_exists('remove_acc', $_POST)) {

			if($log_lang == 1) {
			
				$uid = htmlspecialchars(strip_tags(trim($_POST['uid'])), ENT_QUOTES, 'UTF-8');

				$sql = "DELETE FROM user_acc_tbl WHERE id='$uid'";				
				if(!empty($uid)) {
				
					if(mysqli_query($conn, $sql)) {
						echo json_encode(array("msgType" => 1, "msg" => "Successfully Removed"));
					
					} else {
						echo json_encode(array("msgType" => 2, "msg" => "Sorry ! not deleted"));
					}
				
				} else {
					echo json_encode(array("msgType" => 2, "msg" => "Sorry ! empty id"));
				}
			}
		}		
		
		/****************************** Load Form Data *************************************/
		
		if (array_key_exists('get_dataset', $_POST)) {

			$uid = htmlspecialchars(strip_tags(trim($_POST['uid'])), ENT_QUOTES, 'UTF-8');
			
			$data = array();
			$sql = mysqli_query($conn, "SELECT emp_id, user, group_id FROM user_acc_tbl WHERE id='$uid'");

			while ($row = mysqli_fetch_assoc($sql)) {
				$data[] = $row;
			}
			echo json_encode($data);
		}
		
		if (array_key_exists('get_group', $_POST)) {
			$group_id = htmlspecialchars(strip_tags(trim($_POST['group_id'])), ENT_QUOTES, 'UTF-8');
			$sql = "SELECT id, type FROM group_profile WHERE del=0";

			$result = mysqli_query($conn, $sql);
			while ($row = mysqli_fetch_assoc($result)) {
				$data[] = $row;
			}

			if (!empty($data)) {
				foreach ($data AS $data) { ?><option value="<?php echo $data['id']; ?>" <?php if($data['id'] == $group_id){ echo "selected"; } ?>><?php echo $data['type']; ?></option>
				<?php }
			}
			echo json_encode($data);
		}
		
		if (array_key_exists('get_emp', $_POST)) {
			$emp_id = htmlspecialchars(strip_tags(trim($_POST['emp_id'])), ENT_QUOTES, 'UTF-8');
			$sql = "SELECT id, name FROM staff_members WHERE del=0 and id NOT IN (SELECT emp_id FROM user_acc_tbl WHERE emp_id!= '$emp_id') ORDER BY name ASC";

			$result = mysqli_query($conn, $sql);
			while ($row = mysqli_fetch_assoc($result)) {
				$data[] = $row;
			}

			if (!empty($data)) {
				foreach ($data AS $data) { ?><option value="<?php echo $data['id']; ?>" <?php if($data['id'] == $emp_id){ echo "selected"; } ?>><?php echo $data['name']; ?></option>
				<?php }
			}
			echo json_encode($data);
		}		
		
		/****************************** Update *************************************/
		
		if (array_key_exists('update_acc', $_POST)) {
			$uid = htmlspecialchars(strip_tags(trim($_POST['uid'])), ENT_QUOTES, 'UTF-8');
			$gid = htmlspecialchars(strip_tags(trim($_POST['gid'])), ENT_QUOTES, 'UTF-8');
			$emp_id = htmlspecialchars(strip_tags(trim($_POST['emp_id'])), ENT_QUOTES, 'UTF-8');

			if($log_lang == 1) {
				$sql_up = mysqli_query($conn, "UPDATE user_acc_tbl SET emp_id='$emp_id', group_id='$gid' WHERE id='$uid'");
				
				if($sql_up) {
					echo json_encode(array("msgType" => 1, "msg" => "Successfully Added"));
				
				} else {
					echo json_encode(array("msgType" => 2, "msg" => "Sorry ! Could not be Save Data"));
				}
			}
		}		

		/******************************************************************/		

	} else{
		$redirectUrl = "index.php";
		echo "<script type=\"text/javascript\">";
		echo "window.location.href = '$redirectUrl'";
		echo "</script>";	
	}
}
?>