<?php
if (!defined('ROOT_FOLDER')) { require_once(dirname(__DIR__, 3) . '/init.php'); }
m_secure_session_start();
if (!m_admin_check()) { m_redirect(ADMIN_URL . '/login'); }
m_validate_session_security();


$db = new DB();
$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
if ($id <= 0){ m_redirect(ADMIN_URL . '/admins/lists'); }

if ($_SERVER['REQUEST_METHOD'] === 'POST'){
	$csrf = $_POST['csrf_token'] ?? '';
	if (!isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token']['value'] ?? '', $csrf)) {
		m_set_session('formSuccess', false);
		m_set_session('error_message', lang('security.csrf_invalid', [], 'Güvenlik token\'ı geçersiz!'));
		m_redirect(ADMIN_URL . '/admins/edit?id=' . $id);
	}

	$email = trim((string)($_POST['email'] ?? ''));
	$name = trim((string)($_POST['name'] ?? ''));
	$lastname = trim((string)($_POST['lastname'] ?? ''));
	$password = (string)($_POST['password'] ?? '');
	$role = in_array(($_POST['role'] ?? 'admin'), ['admin','super_admin'], true) ? (string)$_POST['role'] : 'admin';

	$update = [ 'email' => $email, 'name' => $name, 'lastname' => $lastname, 'role' => $role, 'updated_at' => $db->now() ];
	if ($password !== ''){ $update['password'] = m_password_secure($password); }

	// Son kalan süper admin'i düşürme koruması
	if ($role === 'admin' && !has_other_super_admins($id)){
		m_set_session('formSuccess', false);
		m_set_session('error_message', lang('admins.cannot_demote_last_super', [], 'Son süper admin düşürülemez.'));
		m_redirect(ADMIN_URL . '/admins/edit?id=' . $id);
	}

	$db->table('admins')->where('id','=',$id)->update($update);
	m_set_session('formSuccess', true);
	m_set_session('success_message', lang('form_success_message', [], 'Değişiklikler Başarıyla Uygulandı!'));
	m_redirect(ADMIN_URL . '/admins/lists');
}

$rec = $db->table('admins')->where('id','=',$id)->get();
$row = $rec['data'][0] ?? null;
if (!$row){ m_redirect(ADMIN_URL . '/admins/lists'); }

?>
<div class="container-fluid">
	<h1 class="mb-4"><?= lang('admins.edit', [], 'Yönetici Düzenle') ?></h1>
	<div class="card">
		<div class="card-body">
			<form method="post">
				<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']['value'] ?? '', ENT_QUOTES, 'UTF-8') ?>" />
				<div class="row g-3">
					<div class="col-md-4">
						<label class="form-label">Email</label>
						<input name="email" type="email" class="form-control" value="<?= htmlspecialchars((string)$row['email'], ENT_QUOTES, 'UTF-8') ?>" required>
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('profile.fields.name', [], 'Ad') ?></label>
						<input name="name" type="text" class="form-control" value="<?= htmlspecialchars((string)($row['name'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('profile.fields.lastname', [], 'Soyad') ?></label>
						<input name="lastname" type="text" class="form-control" value="<?= htmlspecialchars((string)($row['lastname'] ?? ''), ENT_QUOTES, 'UTF-8') ?>">
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('profile.fields.new_password', [], 'Yeni Şifre') ?></label>
						<input name="password" type="password" class="form-control" placeholder="(boş bırakırsanız değişmez)">
					</div>
					<div class="col-md-4">
						<label class="form-label"><?= lang('admins.role', [], 'Rol') ?></label>
						<select name="role" class="form-select">
							<option value="admin" <?= ((string)($row['role'] ?? 'admin')==='admin') ? 'selected' : '' ?>>admin</option>
							<option value="super_admin" <?= ((string)($row['role'] ?? 'admin')==='super_admin') ? 'selected' : '' ?>>super_admin</option>
						</select>
					</div>
				</div>
				<div class="mt-3">
					<button type="submit" class="btn btn-primary"><?= lang('save', [], 'Kaydet') ?></button>
				</div>
			</form>
		</div>
	</div>
</div>


