323 lines
12 KiB
PHP
323 lines
12 KiB
PHP
<?php
|
|
|
|
/**
|
|
* UserManager
|
|
*
|
|
* Handles user identity, company membership, and member management.
|
|
* All operations target pdo1 (the main wms database: user, company_list,
|
|
* company_map_user).
|
|
*
|
|
* Method order:
|
|
* Read / identity basis → getProfile, getCompanyList
|
|
* Company member basis → getCompanyUsers, searchUsers,
|
|
* inviteUser, updateRole, removeUser
|
|
*
|
|
* Authorization (role guards) is the caller's responsibility.
|
|
* These methods enforce only business-logic constraints
|
|
* (e.g. owner cannot be removed, cannot invite self).
|
|
*
|
|
* Security: all SQL uses PDO prepared statements with bound parameters.
|
|
*/
|
|
class UserManager {
|
|
|
|
private PDO $pdo;
|
|
private int $company_id;
|
|
private int $user_id;
|
|
|
|
public function __construct(PDO $pdo, int $company_id, int $user_id) {
|
|
$this->pdo = $pdo;
|
|
$this->company_id = $company_id;
|
|
$this->user_id = $user_id;
|
|
}
|
|
|
|
// ─────────────────────────────────────────────────────────────
|
|
// READ / IDENTITY BASIS
|
|
// ─────────────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Return the current user's profile row.
|
|
*
|
|
* Used to populate the profile settings page and to bootstrap the UI
|
|
* with the logged-in user's name and avatar.
|
|
*
|
|
* @return array Keys: user_id, username, name, surname, email, phone,
|
|
* country, address, profile_picture.
|
|
* @throws Exception If the user row is not found.
|
|
*/
|
|
public function getProfile(): array {
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT user_id, username, name, surname,
|
|
email, phone, country, address, profile_picture
|
|
FROM user
|
|
WHERE user_id = :user_id
|
|
LIMIT 1"
|
|
);
|
|
$sth->execute([':user_id' => $this->user_id]);
|
|
$user = $sth->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$user) throw new Exception('User not found.');
|
|
return $user;
|
|
}
|
|
|
|
public function getProfilePicture(): string
|
|
{
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT profile_picture
|
|
FROM user
|
|
WHERE user_id = :user_id
|
|
LIMIT 1"
|
|
);
|
|
$sth->execute([':user_id' => $this->user_id]);
|
|
return (string)($sth->fetchColumn() ?: '');
|
|
}
|
|
|
|
public function updateProfile(array $data, string $profile_picture): void
|
|
{
|
|
$this->pdo->prepare(
|
|
"UPDATE user SET
|
|
name = :name,
|
|
surname = :surname,
|
|
email = :email,
|
|
phone = :phone,
|
|
country = :country,
|
|
address = :address,
|
|
profile_picture = :profile_picture
|
|
WHERE user_id = :user_id"
|
|
)->execute([
|
|
':name' => trim($data['name'] ?? ''),
|
|
':surname' => trim($data['surname'] ?? ''),
|
|
':email' => trim($data['email'] ?? ''),
|
|
':phone' => trim($data['phone'] ?? ''),
|
|
':country' => trim($data['country'] ?? ''),
|
|
':address' => trim($data['address'] ?? ''),
|
|
':profile_picture' => $profile_picture,
|
|
':user_id' => $this->user_id,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Return all companies the current user belongs to, plus their role in each.
|
|
*
|
|
* Used to populate the branch-switcher dropdown. Results are ordered by
|
|
* company name so the list is stable regardless of membership order.
|
|
*
|
|
* @return array Each row: company_id, channel_name, company_name, branch, role.
|
|
*/
|
|
public function getCompanyList(): array {
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT cl.company_id, cl.channel_name, cl.company_name, cl.branch, cmu.role
|
|
FROM company_map_user cmu
|
|
JOIN company_list cl ON cl.company_id = cmu.company_id
|
|
WHERE cmu.user_id = :user_id
|
|
ORDER BY cl.company_name ASC"
|
|
);
|
|
$sth->execute([':user_id' => $this->user_id]);
|
|
return $sth->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
public function getCompanyAccess(int $company_id): ?array
|
|
{
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT company_id, role
|
|
FROM company_map_user
|
|
WHERE company_id = :company_id AND user_id = :user_id
|
|
LIMIT 1"
|
|
);
|
|
$sth->execute([':company_id' => $company_id, ':user_id' => $this->user_id]);
|
|
$row = $sth->fetch(PDO::FETCH_ASSOC);
|
|
return $row ?: null;
|
|
}
|
|
|
|
// ─────────────────────────────────────────────────────────────
|
|
// COMPANY MEMBER BASIS
|
|
// ─────────────────────────────────────────────────────────────
|
|
|
|
/**
|
|
* Return all users mapped to the current company, ordered by role then name.
|
|
*
|
|
* Role order: owner → admin → staff → viewer.
|
|
* Used to populate the user management table on the settings page.
|
|
*
|
|
* @return array Each row: map_id, role, created_at, user_id, username,
|
|
* name, surname, email, profile_picture.
|
|
*/
|
|
public function getCompanyUsers(): array {
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT
|
|
m.map_id,
|
|
m.role,
|
|
m.created_at,
|
|
u.user_id,
|
|
u.username,
|
|
u.name,
|
|
u.surname,
|
|
u.email,
|
|
u.profile_picture
|
|
FROM company_map_user m
|
|
JOIN user u ON u.user_id = m.user_id
|
|
WHERE m.company_id = :company_id
|
|
ORDER BY FIELD(m.role, 'owner', 'admin', 'staff', 'viewer'), u.name ASC"
|
|
);
|
|
$sth->execute([':company_id' => $this->company_id]);
|
|
return $sth->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
/**
|
|
* Search for registered users by email keyword, excluding existing members.
|
|
*
|
|
* Returns up to 10 matches. Used for the invite autocomplete input.
|
|
* Excludes users already mapped to this company so the results only show
|
|
* people who can actually be invited.
|
|
*
|
|
* @param string $keyword Partial email to match.
|
|
* @return array Each row: user_id, username, name, surname, email.
|
|
*/
|
|
public function searchUsers(string $keyword): array {
|
|
if ($keyword === '') return [];
|
|
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT u.user_id, u.username, u.name, u.surname, u.email
|
|
FROM user u
|
|
WHERE u.email LIKE :kw
|
|
AND u.user_id NOT IN (
|
|
SELECT user_id FROM company_map_user
|
|
WHERE company_id = :company_id
|
|
)
|
|
ORDER BY u.email ASC
|
|
LIMIT 10"
|
|
);
|
|
$sth->execute([
|
|
':kw' => '%' . $keyword . '%',
|
|
':company_id' => $this->company_id,
|
|
]);
|
|
return $sth->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
/**
|
|
* Add a registered user to the current company by email.
|
|
*
|
|
* Validates email format, role, and that the target account exists.
|
|
* Blocks inviting self or someone already mapped to the company.
|
|
*
|
|
* @param string $email Email address of the user to invite.
|
|
* @param string $role Role to assign: 'admin', 'staff', or 'viewer'.
|
|
* @return string The invited user's email, for use in the success message.
|
|
* @throws Exception On any validation or constraint failure.
|
|
*/
|
|
public function inviteUser(string $email, string $role): string {
|
|
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
|
throw new Exception('Invalid email address.');
|
|
}
|
|
|
|
$allowed_roles = ['admin', 'staff', 'viewer'];
|
|
if (!in_array($role, $allowed_roles, true)) {
|
|
throw new Exception('Invalid role selected.');
|
|
}
|
|
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT user_id, email FROM user WHERE email = :email LIMIT 1"
|
|
);
|
|
$sth->execute([':email' => $email]);
|
|
$target = $sth->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$target) {
|
|
throw new Exception('No registered account found with that email address.');
|
|
}
|
|
|
|
$target_user_id = (int)$target['user_id'];
|
|
|
|
if ($target_user_id === $this->user_id) {
|
|
throw new Exception('You cannot invite yourself.');
|
|
}
|
|
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT map_id FROM company_map_user
|
|
WHERE company_id = :company_id AND user_id = :user_id
|
|
LIMIT 1"
|
|
);
|
|
$sth->execute([':company_id' => $this->company_id, ':user_id' => $target_user_id]);
|
|
if ($sth->fetch()) {
|
|
throw new Exception('This user is already a member of your company.');
|
|
}
|
|
|
|
$this->pdo->prepare(
|
|
"INSERT INTO company_map_user (company_id, user_id, role, created_at)
|
|
VALUES (:company_id, :user_id, :role, NOW())"
|
|
)->execute([
|
|
':company_id' => $this->company_id,
|
|
':user_id' => $target_user_id,
|
|
':role' => $role,
|
|
]);
|
|
|
|
return $target['email'];
|
|
}
|
|
|
|
/**
|
|
* Change the role of a company member.
|
|
*
|
|
* Blocks changing the owner's role. Only 'admin', 'staff', 'viewer'
|
|
* are assignable — the owner role is set at company creation and is immutable.
|
|
*
|
|
* @param int $map_id The company_map_user.map_id to update.
|
|
* @param string $role New role: 'admin', 'staff', or 'viewer'.
|
|
* @throws Exception If the member is not found or is the owner.
|
|
*/
|
|
public function updateRole(int $map_id, string $role): void {
|
|
$allowed_roles = ['admin', 'staff', 'viewer'];
|
|
if (!$map_id || !in_array($role, $allowed_roles, true)) {
|
|
throw new Exception('Invalid request.');
|
|
}
|
|
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT role FROM company_map_user
|
|
WHERE map_id = :map_id AND company_id = :company_id
|
|
LIMIT 1"
|
|
);
|
|
$sth->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
|
|
$current_role = $sth->fetchColumn();
|
|
|
|
if ($current_role === false) throw new Exception('User not found.');
|
|
if ($current_role === 'owner') throw new Exception('Owner role cannot be changed.');
|
|
|
|
$this->pdo->prepare(
|
|
"UPDATE company_map_user
|
|
SET role = :role
|
|
WHERE map_id = :map_id AND company_id = :company_id"
|
|
)->execute([
|
|
':role' => $role,
|
|
':map_id' => $map_id,
|
|
':company_id' => $this->company_id,
|
|
]);
|
|
}
|
|
|
|
/**
|
|
* Remove a user from the current company.
|
|
*
|
|
* Blocks removing the owner or removing yourself.
|
|
* Hard-deletes the company_map_user row — membership history is not retained.
|
|
*
|
|
* @param int $map_id The company_map_user.map_id to delete.
|
|
* @throws Exception If the member is not found, is the owner, or is the caller.
|
|
*/
|
|
public function removeUser(int $map_id): void {
|
|
if (!$map_id) throw new Exception('Invalid request.');
|
|
|
|
$sth = $this->pdo->prepare(
|
|
"SELECT role, user_id FROM company_map_user
|
|
WHERE map_id = :map_id AND company_id = :company_id
|
|
LIMIT 1"
|
|
);
|
|
$sth->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
|
|
$row = $sth->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$row) throw new Exception('User not found.');
|
|
if ($row['role'] === 'owner') throw new Exception('The owner cannot be removed.');
|
|
if ((int)$row['user_id'] === $this->user_id) throw new Exception('You cannot remove yourself.');
|
|
|
|
$this->pdo->prepare(
|
|
"DELETE FROM company_map_user
|
|
WHERE map_id = :map_id AND company_id = :company_id"
|
|
)->execute([':map_id' => $map_id, ':company_id' => $this->company_id]);
|
|
}
|
|
}
|