centralize roles guards

app/contact/api/engine/manage_contact.php

@@ -4,6 +4,8 @@
     require '../../../assets/utils/classes/FileUploader.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin', 'staff']);
+
     $id = (int)$data['id'];
 
     try {

app/contact/api/engine/manage_contact_type.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
         dbTransaction($pdo2, function($pdo) use ($data, $company_id, $logging) {
             $contact = new ContactManager($pdo, $company_id);

app/contact/api/engine/remove_contact.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {

app/contact/api/engine/remove_contact_type.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/ContactManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {

app/ics/api/engine/approve_stock.php

@@ -16,6 +16,8 @@ require '../../../assets/utils/db_auth.php';
 require '../../../assets/utils/classes/StockManager.php';
 require '../../../assets/utils/classes/WarehouseManager.php';
 
+require_role($user_role, ['owner', 'admin']);
+
 $id           = (int)($data['id']        ?? 0);
 $warehouse_id = (int)($data['warehouse'] ?? 0);
 $type         = $data['type'] ?? '';

app/ics/api/engine/delete_stock_in.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/WarehouseManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {

app/ics/api/engine/delete_stock_out.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/WarehouseManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {

app/ics/api/engine/delete_stock_transfer.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/WarehouseManager.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         dbTransaction($pdo2, function($pdo) use ($data, $company_id) {

app/include_ending.php

@@ -1,7 +1,7 @@
 <div class="row">
     <div class="col-12">
         <footer class="text-center py-2 mt-6 text-secondary ">
-        <p class="mb-0">Copyright © 2026 InApp Inventory Dashboard. Developed by <a href="https://codescandy.com/"
+        <p class="mb-0">Copyright © 2026 TRx WMS. Developed by <a href="https://codescandy.com/"
             target="_blank" class="text-primary">CodesCandy</a> </p>
         </footer>
     </div>

app/inventory/api/engine/manager.php

@@ -1,17 +1,21 @@
-<?php 
+<?php
     session_start();
-
     require '../../../assets/utils/db_auth.php';
 
-    $sql = "SELECT * 
+    require_role($user_role, ['owner', 'admin']);
-        FROM user
+
-        WHERE 
+    $sth = $pdo1->prepare(
-            username not in ('support','extra')";
+        "SELECT u.user_id, u.name, u.surname, u.email
-    $sth = $pdo1->query($sql);
+         FROM user u
+         INNER JOIN company_map_user m
+            ON m.user_id = u.user_id
+           AND m.company_id = :company_id
+         ORDER BY u.name ASC"
+    );
+    $sth->execute([':company_id' => $company_id]);
     db_check($sth, $answer);
 
-    $answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
+    $answer['output']  = $sth->fetchAll(PDO::FETCH_ASSOC);
-    $answer["success"] = 1;
+    $answer['success'] = 1;
     exit(json_encode($answer));
-
+?>
-?>

app/setting/api/engine/manage_company.php

@@ -3,6 +3,8 @@
     require '../../../assets/utils/db_auth.php';
     require '../../../assets/utils/classes/FileUploader.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     // ─── Allowed upload MIME types ────────────────────────────────────────────
     const ALLOWED_MIME = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
     const MAX_SIZE     = 2 * 1024 * 1024; // 2 MB

app/setting/api/engine/manage_smtp.php

@@ -2,20 +2,7 @@
     session_start();
     require '../../../assets/utils/db_auth.php';
 
-    // ─── Role guard: only owner/admin ────────────────────────────────────────
+    require_role($user_role, ['owner', 'admin']);
-    $sth = $pdo1->prepare("
-        SELECT role FROM company_map_user
-        WHERE company_id = :company_id AND user_id = :user_id
-        LIMIT 1
-    ");
-    $sth->execute([':company_id' => $company_id, ':user_id' => $user_id]);
-    db_check($sth, $answer);
-
-    if (!in_array($sth->fetchColumn(), ['owner', 'admin'], true)) {
-        $answer['message'] = 'You do not have permission to change SMTP settings.';
-        http_response_code(403);
-        exit(json_encode($answer));
-    }
 
     // ─── Encrypt password — same method/key/iv as config.php ─────────────────
     function encrypt_password(string $plain): string {

app/setting/api/engine/test_smtp.php

@@ -2,6 +2,8 @@
     session_start();
     require '../../../assets/utils/db_auth.php';
 
+    require_role($user_role, ['owner', 'admin']);
+
     try {
 
         $to = trim($data['test_email'] ?? '');