encapsulate setting api [OOP]
This commit is contained in:
Thanakorn S
@@ -0,0 +1,273 @@
|
||||
<?php
|
||||
|
||||
/**
|
||||
* UserManager
|
||||
*
|
||||
* Handles user identity, company membership, and member management.
|
||||
* All operations target pdo1 (the main wms database: user, company_list,
|
||||
* company_map_user).
|
||||
*
|
||||
* Method order:
|
||||
* Read / identity basis → getProfile, getCompanyList
|
||||
* Company member basis → getCompanyUsers, searchUsers,
|
||||
* inviteUser, updateRole, removeUser
|
||||
*
|
||||
* Authorization (role guards) is the caller's responsibility.
|
||||
* These methods enforce only business-logic constraints
|
||||
* (e.g. owner cannot be removed, cannot invite self).
|
||||
*
|
||||
* Security: all SQL uses PDO prepared statements with bound parameters.
|
||||
*/
|
||||
class UserManager {
|
||||
|
||||
private PDO $pdo;
|
||||
private int $company_id;
|
||||
private int $user_id;
|
||||
|
||||
public function __construct(PDO $pdo, int $company_id, int $user_id) {
|
||||
$this->pdo = $pdo;
|
||||
$this->company_id = $company_id;
|
||||
$this->user_id = $user_id;
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────
|
||||
// READ / IDENTITY BASIS
|
||||
// ─────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Return the current user's profile row.
|
||||
*
|
||||
* Used to populate the profile settings page and to bootstrap the UI
|
||||
* with the logged-in user's name and avatar.
|
||||
*
|
||||
* @return array Keys: user_id, username, name, surname, email, phone,
|
||||
* country, address, profile_picture.
|
||||
* @throws Exception If the user row is not found.
|
||||
*/
|
||||
public function getProfile(): array {
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT user_id, username, name, surname,
|
||||
email, phone, country, address, profile_picture
|
||||
FROM user
|
||||
WHERE user_id = :user_id
|
||||
LIMIT 1"
|
||||
);
|
||||
$sth->execute([':user_id' => $this->user_id]);
|
||||
$user = $sth->fetch(PDO::FETCH_ASSOC);
|
||||
|
||||
if (!$user) throw new Exception('User not found.');
|
||||
return $user;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return all companies the current user belongs to, plus their role in each.
|
||||
*
|
||||
* Used to populate the branch-switcher dropdown. Results are ordered by
|
||||
* company name so the list is stable regardless of membership order.
|
||||
*
|
||||
* @return array Each row: company_id, channel_name, company_name, branch, role.
|
||||
*/
|
||||
public function getCompanyList(): array {
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT cl.company_id, cl.channel_name, cl.company_name, cl.branch, cmu.role
|
||||
FROM company_map_user cmu
|
||||
JOIN company_list cl ON cl.company_id = cmu.company_id
|
||||
WHERE cmu.user_id = :user_id
|
||||
ORDER BY cl.company_name ASC"
|
||||
);
|
||||
$sth->execute([':user_id' => $this->user_id]);
|
||||
return $sth->fetchAll(PDO::FETCH_ASSOC);
|
||||
}
|
||||
|
||||
// ─────────────────────────────────────────────────────────────
|
||||
// COMPANY MEMBER BASIS
|
||||
// ─────────────────────────────────────────────────────────────
|
||||
|
||||
/**
|
||||
* Return all users mapped to the current company, ordered by role then name.
|
||||
*
|
||||
* Role order: owner → admin → staff → viewer.
|
||||
* Used to populate the user management table on the settings page.
|
||||
*
|
||||
* @return array Each row: map_id, role, created_at, user_id, username,
|
||||
* name, surname, email, profile_picture.
|
||||
*/
|
||||
public function getCompanyUsers(): array {
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT
|
||||
m.map_id,
|
||||
m.role,
|
||||
m.created_at,
|
||||
u.user_id,
|
||||
u.username,
|
||||
u.name,
|
||||
u.surname,
|
||||
u.email,
|
||||
u.profile_picture
|
||||
FROM company_map_user m
|
||||
JOIN user u ON u.user_id = m.user_id
|
||||
WHERE m.company_id = :company_id
|
||||
ORDER BY FIELD(m.role, 'owner', 'admin', 'staff', 'viewer'), u.name ASC"
|
||||
);
|
||||
$sth->execute([':company_id' => $this->company_id]);
|
||||
return $sth->fetchAll(PDO::FETCH_ASSOC);
|
||||
}
|
||||
|
||||
/**
|
||||
* Search for registered users by email keyword, excluding existing members.
|
||||
*
|
||||
* Returns up to 10 matches. Used for the invite autocomplete input.
|
||||
* Excludes users already mapped to this company so the results only show
|
||||
* people who can actually be invited.
|
||||
*
|
||||
* @param string $keyword Partial email to match.
|
||||
* @return array Each row: user_id, username, name, surname, email.
|
||||
*/
|
||||
public function searchUsers(string $keyword): array {
|
||||
if ($keyword === '') return [];
|
||||
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT u.user_id, u.username, u.name, u.surname, u.email
|
||||
FROM user u
|
||||
WHERE u.email LIKE :kw
|
||||
AND u.user_id NOT IN (
|
||||
SELECT user_id FROM company_map_user
|
||||
WHERE company_id = :company_id
|
||||
)
|
||||
ORDER BY u.email ASC
|
||||
LIMIT 10"
|
||||
);
|
||||
$sth->execute([
|
||||
':kw' => '%' . $keyword . '%',
|
||||
':company_id' => $this->company_id,
|
||||
]);
|
||||
return $sth->fetchAll(PDO::FETCH_ASSOC);
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a registered user to the current company by email.
|
||||
*
|
||||
* Validates email format, role, and that the target account exists.
|
||||
* Blocks inviting self or someone already mapped to the company.
|
||||
*
|
||||
* @param string $email Email address of the user to invite.
|
||||
* @param string $role Role to assign: 'admin', 'staff', or 'viewer'.
|
||||
* @return string The invited user's email, for use in the success message.
|
||||
* @throws Exception On any validation or constraint failure.
|
||||
*/
|
||||
public function inviteUser(string $email, string $role): string {
|
||||
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||||
throw new Exception('Invalid email address.');
|
||||
}
|
||||
|
||||
$allowed_roles = ['admin', 'staff', 'viewer'];
|
||||
if (!in_array($role, $allowed_roles, true)) {
|
||||
throw new Exception('Invalid role selected.');
|
||||
}
|
||||
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT user_id, email FROM user WHERE email = :email LIMIT 1"
|
||||
);
|
||||
$sth->execute([':email' => $email]);
|
||||
$target = $sth->fetch(PDO::FETCH_ASSOC);
|
||||
|
||||
if (!$target) {
|
||||
throw new Exception('No registered account found with that email address.');
|
||||
}
|
||||
|
||||
$target_user_id = (int)$target['user_id'];
|
||||
|
||||
if ($target_user_id === $this->user_id) {
|
||||
throw new Exception('You cannot invite yourself.');
|
||||
}
|
||||
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT map_id FROM company_map_user
|
||||
WHERE company_id = :company_id AND user_id = :user_id
|
||||
LIMIT 1"
|
||||
);
|
||||
$sth->execute([':company_id' => $this->company_id, ':user_id' => $target_user_id]);
|
||||
if ($sth->fetch()) {
|
||||
throw new Exception('This user is already a member of your company.');
|
||||
}
|
||||
|
||||
$this->pdo->prepare(
|
||||
"INSERT INTO company_map_user (company_id, user_id, role, created_at)
|
||||
VALUES (:company_id, :user_id, :role, NOW())"
|
||||
)->execute([
|
||||
':company_id' => $this->company_id,
|
||||
':user_id' => $target_user_id,
|
||||
':role' => $role,
|
||||
]);
|
||||
|
||||
return $target['email'];
|
||||
}
|
||||
|
||||
/**
|
||||
* Change the role of a company member.
|
||||
*
|
||||
* Blocks changing the owner's role. Only 'admin', 'staff', 'viewer'
|
||||
* are assignable — the owner role is set at company creation and is immutable.
|
||||
*
|
||||
* @param int $map_id The company_map_user.map_id to update.
|
||||
* @param string $role New role: 'admin', 'staff', or 'viewer'.
|
||||
* @throws Exception If the member is not found or is the owner.
|
||||
*/
|
||||
public function updateRole(int $map_id, string $role): void {
|
||||
$allowed_roles = ['admin', 'staff', 'viewer'];
|
||||
if (!$map_id || !in_array($role, $allowed_roles, true)) {
|
||||
throw new Exception('Invalid request.');
|
||||
}
|
||||
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT role FROM company_map_user
|
||||
WHERE map_id = :map_id AND company_id = :company_id
|
||||
LIMIT 1"
|
||||
);
|
||||
$sth->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
|
||||
$current_role = $sth->fetchColumn();
|
||||
|
||||
if ($current_role === false) throw new Exception('User not found.');
|
||||
if ($current_role === 'owner') throw new Exception('Owner role cannot be changed.');
|
||||
|
||||
$this->pdo->prepare(
|
||||
"UPDATE company_map_user
|
||||
SET role = :role
|
||||
WHERE map_id = :map_id AND company_id = :company_id"
|
||||
)->execute([
|
||||
':role' => $role,
|
||||
':map_id' => $map_id,
|
||||
':company_id' => $this->company_id,
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Remove a user from the current company.
|
||||
*
|
||||
* Blocks removing the owner or removing yourself.
|
||||
* Hard-deletes the company_map_user row — membership history is not retained.
|
||||
*
|
||||
* @param int $map_id The company_map_user.map_id to delete.
|
||||
* @throws Exception If the member is not found, is the owner, or is the caller.
|
||||
*/
|
||||
public function removeUser(int $map_id): void {
|
||||
if (!$map_id) throw new Exception('Invalid request.');
|
||||
|
||||
$sth = $this->pdo->prepare(
|
||||
"SELECT role, user_id FROM company_map_user
|
||||
WHERE map_id = :map_id AND company_id = :company_id
|
||||
LIMIT 1"
|
||||
);
|
||||
$sth->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
|
||||
$row = $sth->fetch(PDO::FETCH_ASSOC);
|
||||
|
||||
if (!$row) throw new Exception('User not found.');
|
||||
if ($row['role'] === 'owner') throw new Exception('The owner cannot be removed.');
|
||||
if ((int)$row['user_id'] === $this->user_id) throw new Exception('You cannot remove yourself.');
|
||||
|
||||
$this->pdo->prepare(
|
||||
"DELETE FROM company_map_user
|
||||
WHERE map_id = :map_id AND company_id = :company_id"
|
||||
)->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user