USB-RAID-Array/Web/content/adminpanel.php

<?php
require_once __DIR__ . '/../includes/auth.php';
requireLogin('../index.php');
requirePermission('admin', 'You do not have permission to manage users.');
require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/workspace.php';

$database = getDatabaseConnection();

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = is_string($_POST['uname'] ?? null) ? trim($_POST['uname']) : '';
    $password = is_string($_POST['pswd'] ?? null) ? $_POST['pswd'] : '';
    $defaultPath = is_string($_POST['defPath'] ?? null) ? normalizePath(trim($_POST['defPath'])) : '/';
    $isAdmin = isset($_POST['admin']) ? 1 : 0;
    $canDelete = isset($_POST['delPer']) ? 1 : 0;
    $canDownload = isset($_POST['downPer']) ? 1 : 0;
    $canUpload = isset($_POST['upPer']) ? 1 : 0;
    $_SESSION['message_type'] = 'error';

    if ($username === '' || $password === '') {
        $_SESSION['message'] = 'Error: Username and password are required!';
    } elseif (!isPasswordValid($password)) {
        $_SESSION['message'] = 'Error: Password must be at least 8 characters long, contain at least one number and one uppercase letter!';
    } else {
        try {
            $statement = $database->prepare('SELECT uname FROM users WHERE uname = ?');
            $statement->bind_param('s', $username);
            $statement->execute();
            $result = $statement->get_result();
            $userExists = $result->num_rows > 0;
            $result->free();
            $statement->close();

            if ($userExists) {
                $_SESSION['message'] = 'Error: Username already exists!';
            } else {
                $passwordHash = password_hash($password, PASSWORD_BCRYPT);
                $statement = $database->prepare('INSERT INTO users (uname, pswd, admin, defPath, delPer, downPer, upPer) VALUES (?, ?, ?, ?, ?, ?, ?)');
                $statement->bind_param('ssisiii', $username, $passwordHash, $isAdmin, $defaultPath, $canDelete, $canDownload, $canUpload);
                $statement->execute();
                $statement->close();
                $_SESSION['message'] = 'User added successfully!';
                $_SESSION['message_type'] = 'success';
            }
        } catch (mysqli_sql_exception $exception) {
            error_log($exception->getMessage());
            $_SESSION['message'] = 'Error: Failed to add user. Please try again later.';
        }
    }
    $database->close();
    header('Location: adminpanel.php');
    exit;
}

if (isset($_GET['delete']) && is_string($_GET['delete'])) {
    $usernameToDelete = $_GET['delete'];
    try {
        $statement = $database->prepare('DELETE FROM users WHERE uname = ?');
        $statement->bind_param('s', $usernameToDelete);
        $statement->execute();
        $statement->close();
        $_SESSION['message'] = 'User deleted successfully!';
        $_SESSION['message_type'] = 'success';
    } catch (mysqli_sql_exception $exception) {
        error_log($exception->getMessage());
        $_SESSION['message'] = 'Error: Failed to delete user.';
        $_SESSION['message_type'] = 'error';
    }
    $database->close();
    header('Location: adminpanel.php');
    exit;
}

$result = $database->query('SELECT uname, admin, defPath, delPer, downPer, upPer FROM users');
$message = $_SESSION['message'] ?? '';
$messageType = $_SESSION['message_type'] ?? '';
unset($_SESSION['message'], $_SESSION['message_type']);
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Admin Panel</title>
    <link rel="icon" href="../img/favicon.ico" type="image/x-icon">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'css/modern.css') ?>">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'css/workspace.css') ?>">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'content/css/adminpanel.css') ?>">
    <script>
        function confirmDelete(uname) {
            if (confirm('Are you sure you want to delete this user?')) {
                window.location.href = 'adminpanel.php?delete=' + encodeURIComponent(uname);
            }
        }
    </script>
    <script src="<?= workspaceAsset('../', 'js/theme.js') ?>"></script>
    <script src="<?= workspaceAsset('../', 'js/ui.js') ?>" defer></script>
</head>
<?php renderWorkspaceStart([
    'root' => '../',
    'active' => 'users',
    'section' => 'User management',
    'eyebrow' => 'Workspace administration',
    'title' => 'User management',
    'description' => 'Manage accounts, storage locations and access permissions.',
    'class' => 'users-page',
]); ?>

    <section class="users-layout">

            <?php if ($message): ?>
                <div class="alert alert-<?php echo $messageType === 'success' ? 'success' : 'danger'; ?>">
                    <?php echo htmlspecialchars($message); ?>
                </div>
            <?php endif; ?>
<div class="content-panel user-create"><div class="panel-heading"><h2>Add a member</h2><p>Set up an account and choose its access.</p></div>
            <form method="POST" action="" class="add-user-form">
                <div class="mb-3">
                    <label class="form-label" for="memberUsername">Username</label>
                    <input type="text" name="uname" id="memberUsername" class="form-control" placeholder="Username" required>
                </div>
                <div class="mb-3">
                    <label class="form-label" for="memberPassword">Password</label>
                    <input type="password" name="pswd" id="memberPassword" class="form-control" placeholder="Password" required>
                </div>
                <div class="mb-3">
                    <label class="form-label" for="memberPath">Default path</label>
                    <input type="text" name="defPath" id="memberPath" class="form-control" placeholder="Default Path (e.g., /mnt/raid)" required>
                </div>
                <div class="d-flex flex-column align-items-center mb-3">
                    <div class="form-check mb-2">
                        <input type="checkbox" name="admin" id="adminCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="adminCheck">Admin</label>
                    </div>
                    <div class="form-check mb-2">
                        <input type="checkbox" name="delPer" id="delPerCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="delPerCheck">Delete Permission</label>
                    </div>
                    <div class="form-check mb-2">
                        <input type="checkbox" name="downPer" id="downPerCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="downPerCheck">Download Permission</label>
                    </div>
                    <div class="form-check mb-2">
                        <input type="checkbox" name="upPer" id="upPerCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="upPerCheck">Upload Permission</label>
                    </div>
                </div>
                <button type="submit" class="btn btn-primary">Add User</button>
            </form></div>
<div class="content-panel user-list"><div class="panel-heading"><h2>Workspace members</h2><p>Accounts and permissions for your storage.</p></div>


            <div class="table-scroll"><table class="table users-table">
                <thead class="table-dark">
                    <tr>
                        <th>Username</th>
                        <th>Admin</th>
                        <th>Default Path</th>
                        <th>Delete Permission</th>
                        <th>Download Permission</th>
                        <th>Upload Permission</th>
                        <th>Actions</th>
                    </tr>
                </thead>
                <tbody>
                    <?php while ($user = $result->fetch_assoc()) { ?>
                        <tr>
                            <td><?php echo htmlspecialchars($user['uname']); ?></td>
                            <td><?php echo $user['admin'] ? 'Yes' : 'No'; ?></td>
                            <td><?php echo htmlspecialchars($user['defPath']); ?></td>
                            <td><?php echo $user['delPer'] ? 'Yes' : 'No'; ?></td>
                            <td><?php echo $user['downPer'] ? 'Yes' : 'No'; ?></td>
                            <td><?php echo $user['upPer'] ? 'Yes' : 'No'; ?></td>
                            <td>
                                <button class="btn btn-danger btn-sm" onclick="confirmDelete(<?= workspaceEscape(json_encode($user['uname'])) ?>)">Delete</button>
                            </td>
                        </tr>
                    <?php } ?>
                </tbody>
            </table></div>
        </div>
    </section>
    <?php renderWorkspaceEnd(); ?>
</body>
</html>
<?php
$database->close();
?>