📄 user_form.php

<?php
require_once __DIR__ . '/../includes/auth.php';
require_role(['admin']);

$id = isset($_GET['id']) ? (int) $_GET['id'] : null;
$isEdit = $id !== null;
$pageTitle = ($isEdit ? 'Edit' : 'Add') . ' User';

$user = [];
if ($isEdit) {
    $stmt = db()->prepare('SELECT * FROM users WHERE id = ?');
    $stmt->execute([$id]);
    $user = $stmt->fetch() ?: [];
    if (!$user) { http_response_code(404); die('User not found.'); }
}

$errors = [];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!csrf_verify()) {
        $errors[] = 'Session expired, please try again.';
    } else {
        $data = [
            'name' => trim($_POST['name'] ?? ''),
            'username' => trim($_POST['username'] ?? ''),
            'email' => trim($_POST['email'] ?? ''),
            'role' => in_array($_POST['role'] ?? '', ['admin', 'editor', 'counsellor']) ? $_POST['role'] : 'editor',
            'status' => in_array($_POST['status'] ?? '', ['active', 'inactive']) ? $_POST['status'] : 'active',
        ];
        $password = $_POST['password'] ?? '';

        if ($data['name'] === '') $errors[] = 'Name is required.';
        if ($data['username'] === '') $errors[] = 'Username is required.';
        if ($data['email'] === '') $errors[] = 'Email is required.';
        if (!$isEdit && strlen($password) < 8) $errors[] = 'Password must be at least 8 characters.';
        if ($isEdit && $password !== '' && strlen($password) < 8) $errors[] = 'New password must be at least 8 characters.';

        if (!$errors) {
            if ($password !== '') {
                $data['password_hash'] = password_hash($password, PASSWORD_BCRYPT);
            }
            if ($isEdit) {
                $set = implode(', ', array_map(fn($k) => "$k = :$k", array_keys($data)));
                $stmt = db()->prepare("UPDATE users SET $set WHERE id = :id");
                $data['id'] = $id;
                $stmt->execute($data);
            } else {
                $cols = implode(', ', array_keys($data));
                $ph = implode(', ', array_map(fn($k) => ":$k", array_keys($data)));
                $stmt = db()->prepare("INSERT INTO users ($cols) VALUES ($ph)");
                $stmt->execute($data);
            }
            flash_set('success', 'User saved.');
            redirect('users.php');
        } else {
            $user = array_merge($user, $data);
        }
    }
}

require __DIR__ . '/partials/header.php';
require __DIR__ . '/partials/sidebar.php';
require __DIR__ . '/partials/topbar.php';
?>

<?php if ($errors): ?>
  <div class="mb-6 px-4 py-3 rounded-xl bg-red-50 text-brand-red text-sm font-medium border border-red-200">
    <ul class="list-disc list-inside"><?php foreach ($errors as $err): ?><li><?= e($err) ?></li><?php endforeach; ?></ul>
  </div>
<?php endif; ?>

<div class="max-w-2xl bg-white rounded-2xl shadow-sm p-6">
  <form method="post" class="space-y-5">
    <?= csrf_field() ?>
    <div><label class="block text-sm font-medium mb-1.5">Full Name <span class="text-brand-red">*</span></label>
      <input type="text" name="name" value="<?= e($user['name'] ?? '') ?>" required class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green"></div>
    <div class="grid md:grid-cols-2 gap-5">
      <div><label class="block text-sm font-medium mb-1.5">Username <span class="text-brand-red">*</span></label>
        <input type="text" name="username" value="<?= e($user['username'] ?? '') ?>" required class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green"></div>
      <div><label class="block text-sm font-medium mb-1.5">Email <span class="text-brand-red">*</span></label>
        <input type="email" name="email" value="<?= e($user['email'] ?? '') ?>" required class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green"></div>
    </div>
    <div class="grid md:grid-cols-2 gap-5">
      <div><label class="block text-sm font-medium mb-1.5">Role</label>
        <select name="role" class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green">
          <option value="admin" <?= ($user['role'] ?? '') === 'admin' ? 'selected' : '' ?>>Admin (full access)</option>
          <option value="editor" <?= ($user['role'] ?? 'editor') === 'editor' ? 'selected' : '' ?>>Editor (content only)</option>
          <option value="counsellor" <?= ($user['role'] ?? '') === 'counsellor' ? 'selected' : '' ?>>Counsellor (leads only)</option>
        </select></div>
      <div><label class="block text-sm font-medium mb-1.5">Status</label>
        <select name="status" class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green">
          <option value="active" <?= ($user['status'] ?? 'active') === 'active' ? 'selected' : '' ?>>Active</option>
          <option value="inactive" <?= ($user['status'] ?? '') === 'inactive' ? 'selected' : '' ?>>Inactive</option>
        </select></div>
    </div>
    <div><label class="block text-sm font-medium mb-1.5"><?= $isEdit ? 'New Password (leave blank to keep current)' : 'Password' ?> <?= $isEdit ? '' : '<span class="text-brand-red">*</span>' ?></label>
      <input type="password" name="password" minlength="8" class="w-full rounded-xl border border-gray-300 px-4 py-2.5 text-sm focus:outline-none focus:ring-2 focus:ring-brand-green"></div>

    <div class="flex items-center gap-3 pt-2">
      <button type="submit" class="bg-gradient-to-r from-brand-red to-brand-green text-white font-semibold px-6 py-3 rounded-xl hover:brightness-110 transition">
        <i class="fa-solid fa-floppy-disk mr-2"></i>Save User
      </button>
      <a href="users.php" class="text-gray-500 text-sm font-medium hover:text-gray-700">Cancel</a>
    </div>
  </form>
</div>

<?php require __DIR__ . '/partials/footer.php'; ?>