gravity/บริหารจัดการงานเปล/api/users.php

<?php
// api/users.php
require_once dirname(__DIR__) . '/config/config.php';
require_once dirname(__DIR__) . '/models/User.php';

header('Content-Type: application/json');

$action = $_REQUEST['action'] ?? '';

if ($action === 'login') {
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        // Validate CSRF
        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF token']);
            exit;
        }

        $username = trim($_POST['username'] ?? '');
        $password = trim($_POST['password'] ?? '');

        if (empty($username) || empty($password)) {
            echo json_encode(['status' => 'error', 'message' => 'กรุณากรอกชื่อผู้ใช้งานและรหัสผ่าน']);
            exit;
        }

        $userModel = new User();
        if ($userModel->login($username, $password)) {
            // Set session variables
            $_SESSION['user_id'] = $userModel->id;
            $_SESSION['username'] = $userModel->username;
            $_SESSION['full_name'] = $userModel->full_name;
            $_SESSION['role'] = $userModel->role;
            $_SESSION['department_id'] = $userModel->department_id;

            echo json_encode(['status' => 'success', 'message' => 'เข้าสู่ระบบสำเร็จ']);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'ชื่อผู้ใช้งานหรือรหัสผ่านไม่ถูกต้อง']);
        }
    } else {
        echo json_encode(['status' => 'error', 'message' => 'Method not allowed']);
    }
} elseif ($action === 'logout') {
    if (isset($_SESSION['user_id'])) {
        $userModel = new User();
        $userModel->updateStatus($_SESSION['user_id'], 'offline');
    }
    
    // Destroy session
    session_unset();
    session_destroy();
    
    // Redirect to login page
    header("Location: ../index.php?page=login");
    exit;
} elseif ($action === 'add' && isset($_SESSION['role']) && $_SESSION['role'] === 'admin') {
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF token']);
            exit;
        }

        $username = trim($_POST['username'] ?? '');
        $password = trim($_POST['password'] ?? '');
        $full_name = trim($_POST['full_name'] ?? '');
        $role = trim($_POST['role'] ?? '');
        $department_id = !empty($_POST['department_id']) ? $_POST['department_id'] : null;

        if (empty($username) || empty($password) || empty($full_name) || empty($role)) {
            echo json_encode(['status' => 'error', 'message' => 'กรุณากรอกข้อมูลให้ครบถ้วน']);
            exit;
        }

        $userModel = new User();
        try {
            if ($userModel->add($username, $password, $full_name, $role, $department_id)) {
                echo json_encode(['status' => 'success', 'message' => 'เพิ่มเจ้าหน้าที่เรียบร้อยแล้ว']);
            } else {
                echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถเพิ่มเจ้าหน้าที่ได้']);
            }
        } catch (PDOException $e) {
            echo json_encode(['status' => 'error', 'message' => 'เกิดข้อผิดพลาด: ' . $e->getMessage()]);
        }
    }
} elseif ($action === 'edit' && isset($_SESSION['role']) && $_SESSION['role'] === 'admin') {
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF token']);
            exit;
        }

        $id = $_POST['id'] ?? '';
        $full_name = trim($_POST['full_name'] ?? '');
        $role = trim($_POST['role'] ?? '');
        $department_id = !empty($_POST['department_id']) ? $_POST['department_id'] : null;

        if (empty($id) || empty($full_name) || empty($role)) {
            echo json_encode(['status' => 'error', 'message' => 'กรุณากรอกข้อมูลให้ครบถ้วน']);
            exit;
        }

        $userModel = new User();
        try {
            if ($userModel->update($id, $full_name, $role, $department_id)) {
                echo json_encode(['status' => 'success', 'message' => 'แก้ไขข้อมูลเจ้าหน้าที่เรียบร้อยแล้ว']);
            } else {
                echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถแก้ไขข้อมูลได้']);
            }
        } catch (PDOException $e) {
            echo json_encode(['status' => 'error', 'message' => 'เกิดข้อผิดพลาด: ' . $e->getMessage()]);
        }
    }
} elseif ($action === 'edit_password' && isset($_SESSION['role']) && $_SESSION['role'] === 'admin') {
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF token']);
            exit;
        }

        $id = $_POST['id'] ?? '';
        $password = trim($_POST['password'] ?? '');

        if (empty($id) || empty($password)) {
            echo json_encode(['status' => 'error', 'message' => 'กรุณากรอกรหัสผ่านใหม่']);
            exit;
        }

        $userModel = new User();
        try {
            if ($userModel->updatePassword($id, $password)) {
                echo json_encode(['status' => 'success', 'message' => 'เปลี่ยนรหัสผ่านเรียบร้อยแล้ว']);
            } else {
                echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถเปลี่ยนรหัสผ่านได้']);
            }
        } catch (PDOException $e) {
            echo json_encode(['status' => 'error', 'message' => 'เกิดข้อผิดพลาด: ' . $e->getMessage()]);
        }
    }
} elseif ($action === 'delete' && isset($_SESSION['role']) && $_SESSION['role'] === 'admin') {
    if ($_SERVER['REQUEST_METHOD'] === 'POST') {
        if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
            echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF token']);
            exit;
        }

        $id = $_POST['id'] ?? '';

        if (empty($id)) {
            echo json_encode(['status' => 'error', 'message' => 'ไม่พบรหัสผู้ใช้งาน']);
            exit;
        }

        // Prevent self-deletion
        if ($id == $_SESSION['user_id']) {
            echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถลบบัญชีของตัวเองได้']);
            exit;
        }

        $userModel = new User();
        try {
            if ($userModel->delete($id)) {
                echo json_encode(['status' => 'success', 'message' => 'ลบเจ้าหน้าที่เรียบร้อยแล้ว']);
            } else {
                echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถลบเจ้าหน้าที่ได้']);
            }
        } catch (PDOException $e) {
            echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถลบได้เนื่องจากมีการผูกกับงานอื่นอยู่']);
        }
    }
} else {
    echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
}