<?php
if (!defined('ROOT_FOLDER')) { require_once(dirname(__DIR__, 3) . '/init.php'); }
m_secure_session_start();
if (!m_admin_check()) { m_redirect(ADMIN_URL . '/login'); }
m_validate_session_security();


$db = new DB();

if ($_SERVER['REQUEST_METHOD'] === 'POST'){
	$csrf = $_POST['csrf_token'] ?? '';
	if (!isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token']['value'] ?? '', $csrf)) {
		m_set_session('formSuccess', false);
		m_set_session('error_message', lang('security.csrf_invalid', [], 'Güvenlik token\'ı geçersiz!'));
		m_redirect(ADMIN_URL . '/admins/create');
	}

	$email = trim((string)($_POST['email'] ?? ''));
	$name = trim((string)($_POST['name'] ?? ''));
	$lastname = trim((string)($_POST['lastname'] ?? ''));
	$password = (string)($_POST['password'] ?? '');
	$role = in_array(($_POST['role'] ?? 'admin'), ['admin','super_admin'], true) ? (string)$_POST['role'] : 'admin';

	if ($email === '' || !m_validate_email($email) || $password === ''){
		m_set_session('formSuccess', false);
		m_set_session('error_message', lang('security.input_validation_error', [], 'Girilen veriler geçersiz!'));
		m_redirect(ADMIN_URL . '/admins/create');
	}

	$hash = m_password_secure($password);
	$db->table('admins')->insert([
		'email' => $email,
		'name' => $name,
		'lastname' => $lastname,
		'password' => $hash,
		'role' => $role,
		'created_at' => $db->now(),
		'updated_at' => $db->now(),
	]);

	m_set_session('formSuccess', true);
	m_set_session('success_message', lang('form_success_message', [], 'Değişiklikler Başarıyla Uygulandı!'));
	m_redirect(ADMIN_URL . '/admins/lists');
}

?>
<div class="container-fluid">
	<h1 class="mb-4"><?= lang('admins.create', [], 'Yönetici Ekle') ?></h1>
	<div class="card">
		<div class="card-body">
			<form method="post">
				<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']['value'] ?? '', ENT_QUOTES, 'UTF-8') ?>" />
				<div class="row g-3">
					<div class="col-md-4">
						<label class="form-label">Email</label>
						<input name="email" type="email" class="form-control" required>
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('profile.fields.name', [], 'Ad') ?></label>
						<input name="name" type="text" class="form-control">
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('profile.fields.lastname', [], 'Soyad') ?></label>
						<input name="lastname" type="text" class="form-control">
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('profile.fields.new_password', [], 'Yeni Şifre') ?></label>
						<input name="password" type="password" class="form-control" required>
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('admins.role', [], 'Rol') ?></label>
						<select name="role" class="form-select">
							<option value="admin">admin</option>
						</select>
					</div>
				</div>
				<div class="mt-3">
					<button type="submit" class="btn btn-primary"><?= lang('create', [], 'Oluştur') ?></button>
				</div>
			</form>
		</div>
	</div>
</div>


