<?php
include '../includes/db_production.php';
include '../includes/permissions.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $email = $_POST['email'] ?? null;
    $user_id = $_POST['id'] ?? null;
    $posted_permissions = $_POST['permissions'] ?? [];
    
    // Check appropriate permission based on action
    if (!empty($user_id)) {
        require_permission('users_edit');
    } else {
        require_permission('users_add');
    }

    // --- Validation ---
    if (empty($username)) {
        header("Location: user_form.php?id=$user_id&error=اسم المستخدم مطلوب");
        exit;
    }

    // Validate email if provided
    if (!empty($email) && !filter_var($email, FILTER_VALIDATE_EMAIL)) {
        header("Location: user_form.php?id=$user_id&error=البريد الإلكتروني غير صحيح");
        exit;
    }

    // --- Logic for EDIT ---
    if (!empty($user_id)) {
        if (!empty($_POST['password'])) {
            // Update user with new password
            $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
            $stmt = $conn->prepare("UPDATE users SET username = ?, email = ?, password = ? WHERE id = ?");
            $stmt->bind_param("sssi", $username, $email, $password, $user_id);
        } else {
            // Update user without changing password
            $stmt = $conn->prepare("UPDATE users SET username = ?, email = ? WHERE id = ?");
            $stmt->bind_param("ssi", $username, $email, $user_id);
        }
        $stmt->execute();
        $stmt->close();
    // --- Logic for ADD ---
    } else {
        if (empty($_POST['password'])) {
            header("Location: user_form.php?error=كلمة المرور مطلوبة للمستخدمين الجدد");
            exit;
        }
        $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
        $stmt = $conn->prepare("INSERT INTO users (username, email, password) VALUES (?, ?, ?)");
        $stmt->bind_param("sss", $username, $email, $password);
        $stmt->execute();
        $user_id = $conn->insert_id; // Get the new user's ID
        $stmt->close();
    }

    // --- Update Permissions ---
    if ($user_id) {
        // 1. Delete old permissions
        $delete_stmt = $conn->prepare("DELETE FROM user_permissions WHERE user_id = ?");
        $delete_stmt->bind_param("i", $user_id);
        $delete_stmt->execute();
        $delete_stmt->close();

        // 2. Insert new permissions
        if (!empty($posted_permissions)) {
            $insert_stmt = $conn->prepare("INSERT INTO user_permissions (user_id, permission_id) VALUES (?, ?)");
            foreach ($posted_permissions as $permission_id) {
                $insert_stmt->bind_param("ii", $user_id, $permission_id);
                $insert_stmt->execute();
            }
            $insert_stmt->close();
        }
    }

    // Reload permissions in session if the user is editing themselves
    if ($user_id == $_SESSION['user_id']) {
        load_user_permissions($user_id, $conn);
    }

    header("Location: users.php?success=1");
    exit;

} else {
    header("Location: users.php");
    exit;
}
?>