gravity/เว็บไซต์หน่วยงานภายใน/api/admin_settings.php

<?php
// api/admin_settings.php - Super Admin Management API for Agencies, Passwords, and System Settings
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Origin: *');

require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/logger.php';

try {
    $dbInfo = getDbConnection();
    $pdo = $dbInfo['pdo'];

    $method = $_SERVER['REQUEST_METHOD'];

    if ($method === 'GET') {
        // Fetch all agencies including password
        $agenciesStmt = $pdo->query("SELECT id, name, code, COALESCE(admin_password, '1234') AS admin_password FROM agencies ORDER BY id ASC");
        $agencies = $agenciesStmt->fetchAll();

        // Fetch all system settings
        $settingsStmt = $pdo->query("SELECT setting_key, setting_value FROM system_settings");
        $rawSettings = $settingsStmt->fetchAll();
        $settings = [];
        foreach ($rawSettings as $row) {
            $settings[$row['setting_key']] = $row['setting_value'];
        }

        echo json_encode([
            'status' => 'success',
            'agencies' => $agencies,
            'settings' => $settings
        ], JSON_UNESCAPED_UNICODE);
        exit;
    }

    if ($method === 'POST') {
        $input = json_decode(file_get_contents('php://input'), true);
        if (!$input) {
            $input = $_POST;
        }

        $action = $input['action'] ?? '';

        if ($action === 'save_agency') {
            $id       = strtoupper(trim($input['id'] ?? ''));
            $name     = trim($input['name'] ?? '');
            $code     = strtoupper(trim($input['code'] ?? ''));
            $password = trim($input['password'] ?? '1234');
            $isEdit   = !empty($input['is_edit']);

            if (empty($id) || empty($name) || empty($code)) {
                echo json_encode(['status' => 'error', 'message' => 'กรุณากรอกรหัสหน่วยงาน ชื่อกลุ่มงาน และอักษรย่อให้ครบถ้วน']);
                exit;
            }

            if ($isEdit) {
                $stmt = $pdo->prepare("UPDATE agencies SET name = ?, code = ?, admin_password = ? WHERE id = ?");
                $stmt->execute([$name, $code, $password, $id]);
                $msg = 'บันทึกการแก้ไขหน่วยงานเรียบร้อยแล้ว';
            } else {
                // Check if duplicate ID
                $chk = $pdo->prepare("SELECT COUNT(*) AS cnt FROM agencies WHERE id = ?");
                $chk->execute([$id]);
                if ($chk->fetch()['cnt'] > 0) {
                    echo json_encode(['status' => 'error', 'message' => "รหัสหน่วยงาน '{$id}' มีอยู่ในระบบแล้ว"]);
                    exit;
                }

                $stmt = $pdo->prepare("INSERT INTO agencies (id, name, code, admin_password) VALUES (?, ?, ?, ?)");
                $stmt->execute([$id, $name, $code, $password]);
                $msg = 'สร้างหน่วยงานใหม่เรียบร้อยแล้ว';
            }

            $actionUserId = $input['action_user_id'] ?? 'SUPER_ADMIN';
            $actionUserName = $input['action_user_name'] ?? 'ผู้ดูแลระบบ';
            logActivity($pdo, $actionUserId, $actionUserName, 'SAVE_AGENCY', ['agency_id' => $id, 'name' => $name, 'code' => $code, 'is_edit' => $isEdit]);

            echo json_encode(['status' => 'success', 'message' => $msg], JSON_UNESCAPED_UNICODE);
            exit;
        }

        if ($action === 'delete_agency') {
            $id = trim($input['id'] ?? '');
            if (empty($id)) {
                echo json_encode(['status' => 'error', 'message' => 'ไม่พบรหัสหน่วยงาน']);
                exit;
            }

            // Check if news exist for this agency
            $chk = $pdo->prepare("SELECT COUNT(*) AS cnt FROM news WHERE agency_id = ?");
            $chk->execute([$id]);
            if ($chk->fetch()['cnt'] > 0) {
                echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถลบหน่วยงานนี้ได้เนื่องจากมีหนังสือเวียนของหน่วยงานนี้อยู่ในระบบ']);
                exit;
            }

            $stmt = $pdo->prepare("DELETE FROM agencies WHERE id = ?");
            $stmt->execute([$id]);

            $actionUserId = $input['action_user_id'] ?? 'SUPER_ADMIN';
            $actionUserName = $input['action_user_name'] ?? 'ผู้ดูแลระบบ';
            logActivity($pdo, $actionUserId, $actionUserName, 'DELETE_AGENCY', ['agency_id' => $id]);

            echo json_encode(['status' => 'success', 'message' => 'ลบหน่วยงานออกจากระบบเรียบร้อยแล้ว'], JSON_UNESCAPED_UNICODE);
            exit;
        }

        if ($action === 'save_settings') {
            $validKeys = [
                'hospital_name',
                'system_title',
                'hospital_logo_url',
                'ticker_text',
                'super_admin_password',
                'gdrive_gas_url',
                'footer_text'
            ];

            $sql = "REPLACE INTO system_settings (setting_key, setting_value) VALUES (?, ?)";
            $stmt = $pdo->prepare($sql);

            foreach ($validKeys as $key) {
                if (isset($input[$key])) {
                    $stmt->execute([$key, trim($input[$key])]);
                }
            }

            $actionUserId = $input['action_user_id'] ?? 'SUPER_ADMIN';
            $actionUserName = $input['action_user_name'] ?? 'ผู้ดูแลระบบ';
            logActivity($pdo, $actionUserId, $actionUserName, 'SAVE_SETTINGS', ['updated_keys' => array_keys($input)]);

            echo json_encode(['status' => 'success', 'message' => 'บันทึกการตั้งค่าระบบเรียบร้อยแล้ว'], JSON_UNESCAPED_UNICODE);
            exit;
        }
    }

    echo json_encode(['status' => 'error', 'message' => 'Invalid action']);
} catch (\Exception $e) {
    echo json_encode(['status' => 'error', 'message' => $e->getMessage()]);
}
?>