<?php
// /public_html/admin/admins.php
session_start();
require '../config/db_connect.php';

// Admin Check
if (!isset($_SESSION['user_id'])) { header("Location: ../login.php"); exit(); }
$check = $conn->query("SELECT role FROM users WHERE id = {$_SESSION['user_id']}")->fetch_assoc();
if (($check['role'] ?? '') !== 'admin') { die("Access Denied"); }

// Add Admin
if (isset($_POST['add_admin'])) {
    $email = $_POST['email'];
    $pass = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $name = $_POST['name'];
    
    $stmt = $conn->prepare("INSERT INTO users (name, email, password, role, plan_id) VALUES (?, ?, ?, 'admin', 2)");
    $stmt->bind_param("sss", $name, $email, $pass);
    if($stmt->execute()) { $msg = "New Admin Added"; } 
    else { $error = "Error adding admin (Email might exist)"; }
}

// Remove Admin
if (isset($_GET['remove'])) {
    $id = intval($_GET['remove']);
    if ($id != $_SESSION['user_id']) { // Prevent self-delete
        $conn->query("DELETE FROM users WHERE id = $id AND role = 'admin'");
        $msg = "Admin removed.";
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <title>Manage Admins</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">
    <?php include 'includes/navbar.php'; ?>

    <div class="container mt-5">
        <h2 class="mb-4">Manage Admin Team</h2>
        <?php if(isset($msg)) echo "<div class='alert alert-success'>$msg</div>"; ?>
        
        <div class="row">
            <div class="col-md-4">
                <div class="card p-3 shadow-sm">
                    <h5>Add New Admin</h5>
                    <form method="POST">
                        <input type="text" name="name" class="form-control mb-2" placeholder="Name" required>
                        <input type="email" name="email" class="form-control mb-2" placeholder="Email" required>
                        <input type="password" name="password" class="form-control mb-2" placeholder="Password" required>
                        <button type="submit" name="add_admin" class="btn btn-dark w-100">Create Admin</button>
                    </form>
                </div>
            </div>
            <div class="col-md-8">
                <div class="card p-3 shadow-sm">
                    <h5>Existing Admins</h5>
                    <table class="table">
                        <thead><tr><th>Name</th><th>Email</th><th>Action</th></tr></thead>
                        <tbody>
                            <?php
                            $admins = $conn->query("SELECT * FROM users WHERE role = 'admin'");
                            while($row = $admins->fetch_assoc()):
                            ?>
                            <tr>
                                <td><?php echo htmlspecialchars($row['name']); ?></td>
                                <td><?php echo htmlspecialchars($row['email']); ?></td>
                                <td>
                                    <?php if($row['id'] != $_SESSION['user_id']): ?>
                                        <a href="?remove=<?php echo $row['id']; ?>" class="btn btn-sm btn-danger" onclick="return confirm('Remove this admin?')">Remove</a>
                                    <?php else: ?>
                                        <span class="badge bg-secondary">You</span>
                                    <?php endif; ?>
                                </td>
                            </tr>
                            <?php endwhile; ?>
                        </tbody>
                    </table>
                </div>
            </div>
        </div>
    </div>
</body>
</html>