📄 users.php

<?php
require_once __DIR__ . '/../includes/auth.php';
require_role(['admin']);
$pageTitle = 'Users & Roles';

if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'delete' && csrf_verify()) {
    $id = (int) ($_POST['id'] ?? 0);
    if ($id === (int) $_SESSION['admin_user_id']) {
        flash_set('error', 'You cannot delete your own account while logged in.');
    } else {
        $stmt = db()->prepare('DELETE FROM users WHERE id = ?');
        $stmt->execute([$id]);
        flash_set('success', 'User deleted.');
    }
    redirect('users.php');
}

$users = db()->query('SELECT id, name, username, email, role, status, last_login, created_at FROM users ORDER BY id')->fetchAll();

require __DIR__ . '/partials/header.php';
require __DIR__ . '/partials/sidebar.php';
require __DIR__ . '/partials/topbar.php';
?>

<div class="flex items-center justify-between mb-5">
  <p class="text-gray-500 text-sm"><?= count($users) ?> users</p>
  <a href="user_form.php" class="bg-gradient-to-r from-brand-red to-brand-green text-white text-sm font-semibold px-5 py-2.5 rounded-xl hover:brightness-110 transition">
    <i class="fa-solid fa-plus mr-1"></i> Add New User
  </a>
</div>

<div class="bg-white rounded-2xl shadow-sm overflow-hidden">
  <div class="overflow-x-auto">
    <table class="w-full text-sm">
      <thead class="bg-gray-50"><tr class="text-left text-gray-400">
        <th class="px-5 py-3 font-medium">Name</th>
        <th class="px-5 py-3 font-medium">Username / Email</th>
        <th class="px-5 py-3 font-medium">Role</th>
        <th class="px-5 py-3 font-medium">Status</th>
        <th class="px-5 py-3 font-medium">Last Login</th>
        <th class="px-5 py-3 font-medium text-right">Actions</th>
      </tr></thead>
      <tbody>
        <?php foreach ($users as $u): ?>
        <tr class="border-t border-gray-100 hover:bg-gray-50/60">
          <td class="px-5 py-3 font-medium"><?= e($u['name']) ?></td>
          <td class="px-5 py-3 text-gray-500"><?= e($u['username']) ?><br><?= e($u['email']) ?></td>
          <td class="px-5 py-3"><span class="px-2.5 py-1 rounded-full text-xs font-medium bg-brand-black/5 text-brand-black capitalize"><?= e($u['role']) ?></span></td>
          <td class="px-5 py-3"><span class="px-2.5 py-1 rounded-full text-xs font-medium <?= $u['status'] === 'active' ? 'bg-brand-green/10 text-brand-green' : 'bg-gray-200 text-gray-500' ?>"><?= e(ucfirst($u['status'])) ?></span></td>
          <td class="px-5 py-3 text-gray-400"><?= $u['last_login'] ? e(date('d M Y H:i', strtotime($u['last_login']))) : 'Never' ?></td>
          <td class="px-5 py-3 text-right whitespace-nowrap">
            <a href="user_form.php?id=<?= (int) $u['id'] ?>" class="text-brand-green hover:text-green-700 mr-3"><i class="fa-solid fa-pen-to-square"></i></a>
            <form method="post" class="inline" onsubmit="return confirm('Delete this user?');">
              <?= csrf_field() ?>
              <input type="hidden" name="action" value="delete">
              <input type="hidden" name="id" value="<?= (int) $u['id'] ?>">
              <button type="submit" class="text-brand-red hover:text-red-700"><i class="fa-solid fa-trash"></i></button>
            </form>
          </td>
        </tr>
        <?php endforeach; ?>
      </tbody>
    </table>
  </div>
</div>

<?php require __DIR__ . '/partials/footer.php'; ?>