survey/api/users.php

<?php
/**
 * Users CRUD API (Admin only)
 * GET    ?action=list         — List all users
 * GET    ?action=get&id=X     — Get user by ID
 * POST   ?action=create       — Create user
 * POST   ?action=update       — Update user
 * POST   ?action=delete       — Delete user
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../config/auth.php';

header('Content-Type: application/json; charset=utf-8');

requireAdmin();

$action = $_GET['action'] ?? '';

switch ($action) {
    case 'list':
        listUsers();
        break;
    case 'get':
        getUser();
        break;
    case 'create':
        createUser();
        break;
    case 'update':
        updateUser();
        break;
    case 'delete':
        deleteUser();
        break;
    default:
        jsonResponse(['error' => 'Invalid action'], 400);
}

function listUsers() {
    $db = getDB();
    $stmt = $db->query("SELECT id, username, role, full_name, personnel_code, subject_area, branch_code, email, created_at FROM users ORDER BY created_at DESC");
    jsonResponse(['users' => $stmt->fetchAll()]);
}

function getUser() {
    $id = (int)($_GET['id'] ?? 0);
    if (!$id) jsonResponse(['error' => 'Missing ID'], 400);

    $db = getDB();
    $stmt = $db->prepare("SELECT id, username, role, full_name, personnel_code, subject_area, branch_code, email, created_at FROM users WHERE id = ?");
    $stmt->execute([$id]);
    $user = $stmt->fetch();

    if (!$user) jsonResponse(['error' => 'ไม่พบผู้ใช้'], 404);
    jsonResponse(['user' => $user]);
}

function createUser() {
    $input = getInput();
    $username = trim($input['username'] ?? '');
    $password = trim($input['password'] ?? '');
    $role = $input['role'] ?? 'teacher';
    $fullName = trim($input['full_name'] ?? '');
    $personnelCode = trim($input['personnel_code'] ?? '');
    $subjectArea = trim($input['subject_area'] ?? '');
    $branchCode = trim($input['branch_code'] ?? '');
    $email = trim($input['email'] ?? '');

    if (empty($username) || empty($password) || empty($fullName)) {
        jsonResponse(['error' => 'กรุณากรอกข้อมูลให้ครบถ้วน'], 400);
    }

    $db = getDB();

    // Check duplicate username
    $stmt = $db->prepare("SELECT id FROM users WHERE username = ?");
    $stmt->execute([$username]);
    if ($stmt->fetch()) {
        jsonResponse(['error' => 'ชื่อผู้ใช้นี้มีอยู่แล้ว'], 409);
    }

    $passwordHash = password_hash($password, PASSWORD_DEFAULT);

    $stmt = $db->prepare("INSERT INTO users (username, password_hash, role, full_name, personnel_code, subject_area, branch_code, email) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
    $stmt->execute([$username, $passwordHash, $role, $fullName, $personnelCode, $subjectArea, $branchCode, $email]);

    jsonResponse(['success' => true, 'id' => $db->lastInsertId(), 'message' => 'สร้างผู้ใช้สำเร็จ'], 201);
}

function updateUser() {
    $input = getInput();
    $id = (int)($input['id'] ?? 0);
    if (!$id) jsonResponse(['error' => 'Missing ID'], 400);

    $fullName = trim($input['full_name'] ?? '');
    $role = $input['role'] ?? '';
    $personnelCode = trim($input['personnel_code'] ?? '');
    $subjectArea = trim($input['subject_area'] ?? '');
    $branchCode = trim($input['branch_code'] ?? '');

    $db = getDB();

    $fields = [];
    $params = [];

    if (!empty($fullName)) { $fields[] = "full_name = ?"; $params[] = $fullName; }
    if (!empty($role)) { $fields[] = "role = ?"; $params[] = $role; }
    if ($personnelCode !== '') { $fields[] = "personnel_code = ?"; $params[] = $personnelCode; }
    if ($subjectArea !== '') { $fields[] = "subject_area = ?"; $params[] = $subjectArea; }
    if ($branchCode !== '') { $fields[] = "branch_code = ?"; $params[] = $branchCode; }
    if (isset($input['email'])) { $fields[] = "email = ?"; $params[] = trim($input['email']); }

    // Update password if provided
    if (!empty($input['password'])) {
        $fields[] = "password_hash = ?";
        $params[] = password_hash($input['password'], PASSWORD_DEFAULT);
    }

    if (empty($fields)) {
        jsonResponse(['error' => 'ไม่มีข้อมูลที่ต้องอัปเดต'], 400);
    }

    $params[] = $id;
    $sql = "UPDATE users SET " . implode(', ', $fields) . " WHERE id = ?";
    $stmt = $db->prepare($sql);
    $stmt->execute($params);

    jsonResponse(['success' => true, 'message' => 'อัปเดตผู้ใช้สำเร็จ']);
}

function deleteUser() {
    $input = getInput();
    $id = (int)($input['id'] ?? 0);
    if (!$id) jsonResponse(['error' => 'Missing ID'], 400);

    // Don't delete yourself
    if ($id == $_SESSION['user_id']) {
        jsonResponse(['error' => 'ไม่สามารถลบบัญชีตัวเองได้'], 400);
    }

    $db = getDB();
    $stmt = $db->prepare("DELETE FROM users WHERE id = ?");
    $stmt->execute([$id]);

    jsonResponse(['success' => true, 'message' => 'ลบผู้ใช้สำเร็จ']);
}