diff --git a/assets/css/custom.css b/assets/css/custom.css
index 13e3b01..d204d85 100644
--- a/assets/css/custom.css
+++ b/assets/css/custom.css
@@ -191,6 +191,7 @@ body {
     margin-left: var(--sidebar-width);
     padding: 2rem;
     transition: all 0.3s;
+    min-height: 100vh;
 }
 
 [dir="rtl"] .main-content {
@@ -198,6 +199,41 @@ body {
     margin-right: var(--sidebar-width);
 }
 
+@media (max-width: 991.98px) {
+    .sidebar {
+        left: calc(-1 * var(--sidebar-width));
+    }
+    .sidebar.show {
+        left: 0;
+    }
+    [dir="rtl"] .sidebar {
+        right: calc(-1 * var(--sidebar-width));
+        left: auto;
+    }
+    [dir="rtl"] .sidebar.show {
+        right: 0;
+    }
+    .main-content {
+        margin-left: 0 !important;
+        margin-right: 0 !important;
+        width: 100%;
+    }
+}
+
+.sidebar-overlay {
+    display: none;
+    position: fixed;
+    top: 0;
+    left: 0;
+    width: 100%;
+    height: 100%;
+    background: rgba(0,0,0,0.5);
+    z-index: 999;
+}
+.sidebar-overlay.show {
+    display: block;
+}
+
 .topbar {
     background: var(--surface);
     border-bottom: 1px solid var(--border);
diff --git a/assets/js/main.js b/assets/js/main.js
index 15b0542..896034f 100644
--- a/assets/js/main.js
+++ b/assets/js/main.js
@@ -11,6 +11,25 @@ document.addEventListener('DOMContentLoaded', function() {
             setLanguage(newLang);
         });
     }
+
+    // Sidebar Toggle
+    const sidebarToggle = document.getElementById('sidebarToggle');
+    const sidebar = document.querySelector('.sidebar');
+    const overlay = document.createElement('div');
+    overlay.className = 'sidebar-overlay';
+    document.body.appendChild(overlay);
+
+    if (sidebarToggle) {
+        sidebarToggle.addEventListener('click', function() {
+            sidebar.classList.toggle('show');
+            overlay.classList.toggle('show');
+        });
+    }
+
+    overlay.addEventListener('click', function() {
+        sidebar.classList.remove('show');
+        overlay.classList.remove('show');
+    });
 });
 
 function setLanguage(lang) {
diff --git a/index.php b/index.php
index 5b3ac85..73aa12c 100644
--- a/index.php
+++ b/index.php
@@ -1,9 +1,117 @@
 <?php
 declare(strict_types=1);
+if (!is_dir(__DIR__ . '/sessions')) {
+    mkdir(__DIR__ . '/sessions', 0777, true);
+}
+session_save_path(__DIR__ . '/sessions');
+
+// Enhanced session security and iframe compatibility
+if ((isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')) {
+    session_set_cookie_params([
+        'lifetime' => 0,
+        'path' => '/',
+        'secure' => true,
+        'httponly' => true,
+        'samesite' => 'None',
+    ]);
+}
+
 session_start();
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    file_put_contents('post_debug.log', date('Y-m-d H:i:s') . " - POST: " . json_encode($_POST) . "\n", FILE_APPEND);
+}
 require_once 'db/config.php';
 require_once 'includes/accounting_helper.php';
 
+// Helper to check permissions
+function can(string $permission): bool {
+    if (!isset($_SESSION['user_id'])) return false;
+    if (($_SESSION['user_role_name'] ?? '') === 'Administrator' || ($_SESSION['user_permissions'] ?? '') === 'all') return true;
+    $perms = json_decode($_SESSION['user_permissions'] ?? '[]', true);
+    return is_array($perms) && in_array($permission, $perms);
+}
+
+// Login Logic
+$login_error = '';
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['login'])) {
+    $user = $_POST['username'] ?? '';
+    $pass = $_POST['password'] ?? '';
+    $stmt = db()->prepare("SELECT u.*, g.permissions, g.name as role_name FROM users u LEFT JOIN role_groups g ON u.group_id = g.id WHERE u.username = ? AND u.status = 'active'");
+    $stmt->execute([$user]);
+    $u = $stmt->fetch();
+    if ($u && password_verify($pass, $u['password'])) {
+        $_SESSION['user_id'] = $u['id'];
+        $_SESSION['username'] = $u['username'];
+        $_SESSION['user_role_name'] = $u['role_name'];
+        $_SESSION['user_permissions'] = $u['permissions'];
+        $_SESSION['profile_pic'] = $u['profile_pic'];
+        header("Location: index.php");
+        exit;
+    } else {
+        $login_error = "Invalid username or password";
+        // Debugging
+        $reason = (!$u) ? "User not found or inactive" : "Password mismatch";
+        file_put_contents('login_debug.log', date('Y-m-d H:i:s') . " - Failed login for '$user'. Reason: $reason\n", FILE_APPEND);
+    }
+}
+
+// Logout
+if (isset($_GET['action']) && $_GET['action'] === 'logout') {
+    session_destroy();
+    header("Location: index.php");
+    exit;
+}
+
+// Redirect to login if not authenticated
+if (!isset($_SESSION['user_id'])) {
+    ?>
+    <!DOCTYPE html>
+    <html lang="en">
+    <head>
+        <meta charset="UTF-8">
+        <meta name="viewport" content="width=device-width, initial-scale=1.0">
+        <title>Login - Admin Panel</title>
+        <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
+        <link href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.0/font/bootstrap-icons.css" rel="stylesheet">
+        <style>
+            body { background: #f8f9fa; height: 100vh; display: flex; align-items: center; justify-content: center; font-family: 'Inter', sans-serif; }
+            .login-card { border: none; border-radius: 20px; box-shadow: 0 10px 30px rgba(0,0,0,0.05); width: 100%; max-width: 400px; padding: 40px; background: #fff; }
+            .btn-primary { border-radius: 12px; padding: 12px; font-weight: 600; background: linear-gradient(135deg, #6e8efb, #a777e3); border: none; }
+            .form-control { border-radius: 12px; padding: 12px; border: 1px solid #eee; }
+            .form-control:focus { box-shadow: 0 0 0 4px rgba(110, 142, 251, 0.1); border-color: #6e8efb; }
+        </style>
+    </head>
+    <body>
+        <div class="login-card text-center">
+            <div class="mb-4">
+                <div class="d-inline-flex align-items-center justify-content-center bg-primary bg-opacity-10 rounded-circle mb-3" style="width: 60px; height: 60px;">
+                    <i class="bi bi-shield-lock text-primary fs-3"></i>
+                </div>
+                <h4 class="fw-bold">Welcome Back</h4>
+                <p class="text-muted small">Please enter your details to sign in</p>
+            </div>
+            <?php if ($login_error): ?>
+                <div class="alert alert-danger small py-2 mb-4"><?= $login_error ?></div>
+            <?php endif; ?>
+            <form method="POST">
+                <div class="mb-3 text-start">
+                    <label class="form-label small fw-semibold">Username</label>
+                    <input type="text" name="username" class="form-control" placeholder="admin" required autofocus>
+                </div>
+                <div class="mb-4 text-start">
+                    <label class="form-label small fw-semibold">Password</label>
+                    <input type="password" name="password" class="form-control" placeholder="••••••••" required>
+                </div>
+                <button type="submit" name="login" class="btn btn-primary w-100 mb-3">Sign In</button>
+                <div class="text-muted small">Default user: admin / admin</div>
+            </form>
+        </div>
+    </body>
+    </html>
+    <?php
+    exit;
+}
+
 // Handle POST Requests
 $message = '';
 
@@ -39,1523 +147,11 @@ function getPromotionalPrice($item) {
     return $price;
 }
 
-function getLoyaltyMultiplier($tier) {
-    return match($tier) {
-        'silver' => 1.2,
-        'gold' => 1.5,
-        default => 1.0,
-    };
-}
-
-function updateCustomerLoyalty($customer_id, $spent_amount, $points_earned, $loyalty_redeemed_value, $invoice_id = null) {
-    $db = db();
-    
-    // Fetch settings for dynamic rates
-    $settings_res = $db->query("SELECT * FROM settings WHERE `key` IN ('loyalty_enabled', 'loyalty_redeem_points_per_unit')")->fetchAll(PDO::FETCH_ASSOC);
-    $settings = [];
-    foreach ($settings_res as $s) $settings[$s['key']] = $s['value'];
-    
-    if (($settings['loyalty_enabled'] ?? '0') !== '1') return; // System disabled
-
-    $redeem_rate = (float)($settings['loyalty_redeem_points_per_unit'] ?? 100);
-    $points_redeemed = (float)$loyalty_redeemed_value * $redeem_rate;
-    
-    // Update points and total_spent
-    $stmt = $db->prepare("UPDATE customers SET loyalty_points = loyalty_points - ? + ?, total_spent = total_spent + ? WHERE id = ?");
-    $stmt->execute([(float)$points_redeemed, (float)$points_earned, (float)$spent_amount, $customer_id]);
-    
-    // Fetch updated total_spent to check for tier upgrade
-    $stmt = $db->prepare("SELECT total_spent, loyalty_tier FROM customers WHERE id = ?");
-    $stmt->execute([$customer_id]);
-    $customer = $stmt->fetch();
-    
-    $new_tier = 'bronze';
-    if ($customer['total_spent'] >= 1500) $new_tier = 'gold';
-    elseif ($customer['total_spent'] >= 500) $new_tier = 'silver';
-    
-    if ($new_tier !== $customer['loyalty_tier']) {
-        $stmt = $db->prepare("UPDATE customers SET loyalty_tier = ? WHERE id = ?");
-        $stmt->execute([$new_tier, $customer_id]);
-    }
-    
-    // Log Earned Points
-    if ($points_earned > 0) {
-        $stmt = $db->prepare("INSERT INTO loyalty_transactions (customer_id, transaction_id, points_change, transaction_type, description) VALUES (?, ?, ?, 'earned', ?)");
-        $stmt->execute([$customer_id, $invoice_id, $points_earned, "Earned from transaction #$invoice_id (Tier: " . strtoupper($customer['loyalty_tier']) . ")"]);
-    }
-    
-    // Log Redeemed Points
-    if ($points_redeemed > 0) {
-        $stmt = $db->prepare("INSERT INTO loyalty_transactions (customer_id, transaction_id, points_change, transaction_type, description) VALUES (?, ?, ?, 'redeemed', ?)");
-        $stmt->execute([$customer_id, $invoice_id, -$points_redeemed, "Redeemed $points_redeemed pts (Value: " . number_format((float)$loyalty_redeemed_value, 3) . " OMR) in transaction #$invoice_id"]);
-    }
-}
-
-function numberToWords($num) {
-    $num = (int)$num;
-    if ($num === 0) return "Zero";
-    $ones = ["", "One", "Two", "Three", "Four", "Five", "Six", "Seven", "Eight", "Nine", "Ten", "Eleven", "Twelve", "Thirteen", "Fourteen", "Fifteen", "Sixteen", "Seventeen", "Eighteen", "Nineteen"];
-    $tens = ["", "", "Twenty", "Thirty", "Forty", "Fifty", "Sixty", "Seventy", "Eighty", "Ninety"];
-    if ($num < 20) return $ones[$num];
-    if ($num < 100) return $tens[(int)($num / 10)] . ($num % 10 ? " " . $ones[$num % 10] : "");
-    if ($num < 1000) return $ones[(int)($num / 100)] . " Hundred" . ($num % 100 ? " and " . numberToWords($num % 100) : "");
-    if ($num < 1000000) return numberToWords((int)($num / 1000)) . " Thousand" . ($num % 1000 ? " " . numberToWords($num % 1000) : "");
-    return (string)$num;
-}
-
-if ($_SERVER['REQUEST_METHOD'] === 'GET' && isset($_GET['action'])) {
-    if ($_GET['action'] === 'search_items') {
-        header('Content-Type: application/json');
-        $q = $_GET['q'] ?? '';
-        $stmt = db()->prepare("SELECT id, name_en, name_ar, sku, sale_price, purchase_price, stock_quantity, vat_rate, is_promotion, promotion_start, promotion_end, promotion_percent FROM stock_items WHERE name_en LIKE ? OR name_ar LIKE ? OR sku LIKE ? LIMIT 10");
-        $stmt->execute(["%$q%", "%$q%", "%$q%"]);
-        $results = $stmt->fetchAll(PDO::FETCH_ASSOC);
-        foreach ($results as &$item) {
-            $item['sale_price'] = getPromotionalPrice($item);
-        }
-        echo json_encode($results);
-        exit;
-    }
-    if ($_GET['action'] === 'get_payments') {
-        header('Content-Type: application/json');
-        $invoice_id = (int)$_GET['invoice_id'];
-        $stmt = db()->prepare("SELECT p.*, i.id as inv_id, i.type as inv_type, c.name as customer_name 
-                                FROM payments p 
-                                JOIN invoices i ON p.invoice_id = i.id 
-                                LEFT JOIN customers c ON i.customer_id = c.id 
-                                WHERE p.invoice_id = ? ORDER BY p.payment_date DESC, p.id DESC");
-        $stmt->execute([$invoice_id]);
-        $payments = $stmt->fetchAll(PDO::FETCH_ASSOC);
-        foreach ($payments as &$p) {
-            $p['amount_words'] = numberToWordsOMR($p['amount']);
-        }
-        echo json_encode($payments);
-        exit;
-    }
-    if ($_GET['action'] === 'get_payment_details') {
-        header('Content-Type: application/json');
-        $payment_id = (int)$_GET['payment_id'];
-        $stmt = db()->prepare("SELECT p.*, i.id as inv_id, i.type as inv_type, c.name as customer_name 
-                                FROM payments p 
-                                JOIN invoices i ON p.invoice_id = i.id 
-                                LEFT JOIN customers c ON i.customer_id = c.id 
-                                WHERE p.id = ?");
-        $stmt->execute([$payment_id]);
-        $payment = $stmt->fetch(PDO::FETCH_ASSOC);
-        if ($payment) {
-            $payment['amount_words'] = numberToWordsOMR($payment['amount']);
-        }
-        echo json_encode($payment);
-        exit;
-    }
-
-    if ($_GET['action'] === 'get_held_carts') {
-        header('Content-Type: application/json');
-        $stmt = db()->query("SELECT h.*, c.name as customer_name FROM pos_held_carts h LEFT JOIN customers c ON h.customer_id = c.id ORDER BY h.id DESC");
-        echo json_encode($stmt->fetchAll(PDO::FETCH_ASSOC));
-        exit;
-    }
-
-    if ($_GET['action'] === 'validate_discount') {
-        header('Content-Type: application/json');
-        $code = $_GET['code'] ?? '';
-        $stmt = db()->prepare("SELECT * FROM discount_codes WHERE code = ? AND status = 'active' AND (expiry_date IS NULL OR expiry_date >= CURDATE())");
-        $stmt->execute([$code]);
-        $discount = $stmt->fetch(PDO::FETCH_ASSOC);
-        if ($discount) {
-            echo json_encode(['success' => true, 'discount' => $discount]);
-        } else {
-            echo json_encode(['success' => false, 'error' => 'Invalid or expired code']);
-        }
-        exit;
-    }
-
-    if ($_GET['action'] === 'get_customer_loyalty') {
-        header('Content-Type: application/json');
-        $id = (int)($_GET['customer_id'] ?? 0);
-        $stmt = db()->prepare("SELECT loyalty_points FROM customers WHERE id = ?");
-        $stmt->execute([$id]);
-        $points = $stmt->fetchColumn();
-        echo json_encode(['success' => true, 'points' => (float)$points]);
-        exit;
-    }
-    if ($_GET['action'] === 'get_invoice_items') {
-        header('Content-Type: application/json');
-        $invoice_id = (int)$_GET['invoice_id'];
-        $stmt = db()->prepare("SELECT ii.*, i.name_en, i.name_ar, i.sku 
-                                FROM invoice_items ii 
-                                JOIN stock_items i ON ii.item_id = i.id 
-                                WHERE ii.invoice_id = ?");
-        $stmt->execute([$invoice_id]);
-        echo json_encode($stmt->fetchAll());
-        exit;
-    }
-    if ($_GET['action'] === 'get_return_details') {
-        header('Content-Type: application/json');
-        $return_id = (int)$_GET['return_id'];
-        $type = $_GET['type'] ?? 'sale'; // 'sale' or 'purchase'
-        
-        $table = ($type === 'purchase') ? 'purchase_returns' : 'sales_returns';
-        $item_table = ($type === 'purchase') ? 'purchase_return_items' : 'sales_return_items';
-        
-        $stmt = db()->prepare("SELECT r.*, c.name as party_name, i.invoice_date as original_invoice_date 
-                                FROM $table r 
-                                LEFT JOIN customers c ON " . ($type === 'purchase' ? 'r.supplier_id' : 'r.customer_id') . " = c.id 
-                                LEFT JOIN invoices i ON r.invoice_id = i.id
-                                WHERE r.id = ?");
-        $stmt->execute([$return_id]);
-        $return = $stmt->fetch(PDO::FETCH_ASSOC);
-        
-        if ($return) {
-            $stmt = db()->prepare("SELECT ri.*, si.name_en, si.name_ar, si.sku 
-                                    FROM $item_table ri 
-                                    JOIN stock_items si ON ri.item_id = si.id 
-                                    WHERE ri.return_id = ?");
-            $stmt->execute([$return_id]);
-            $return['items'] = $stmt->fetchAll(PDO::FETCH_ASSOC);
-        }
-        
-        echo json_encode($return);
-        exit;
-    }
-}
-
-if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    // --- Expense Categories Handlers ---
-    if (isset($_POST['add_expense_category'])) {
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        if ($name_en && $name_ar) {
-            $stmt = db()->prepare("INSERT INTO expense_categories (name_en, name_ar) VALUES (?, ?)");
-            $stmt->execute([$name_en, $name_ar]);
-            $message = "Expense Category added successfully!";
-        }
-    }
-    if (isset($_POST['edit_expense_category'])) {
-        $id = (int)$_POST['id'];
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        if ($id && $name_en && $name_ar) {
-            $stmt = db()->prepare("UPDATE expense_categories SET name_en = ?, name_ar = ? WHERE id = ?");
-            $stmt->execute([$name_en, $name_ar, $id]);
-            $message = "Expense Category updated successfully!";
-        }
-    }
-    if (isset($_POST['delete_expense_category'])) {
-        $id = (int)$_POST['id'];
-        if ($id) {
-            $stmt = db()->prepare("DELETE FROM expense_categories WHERE id = ?");
-            $stmt->execute([$id]);
-            $message = "Expense Category deleted successfully!";
-        }
-    }
-
-    // --- Expenses Handlers ---
-    if (isset($_POST['add_expense'])) {
-        $category_id = (int)$_POST['category_id'];
-        $amount = (float)$_POST['amount'];
-        $date = $_POST['expense_date'] ?: date('Y-m-d');
-        $desc = $_POST['description'] ?? '';
-        $ref = $_POST['reference_no'] ?? '';
-        
-        if ($category_id && $amount > 0) {
-            $stmt = db()->prepare("INSERT INTO expenses (category_id, amount, expense_date, description, reference_no) VALUES (?, ?, ?, ?, ?)");
-            $stmt->execute([$category_id, $amount, $date, $desc, $ref]);
-            $expense_id = db()->lastInsertId();
-            
-            // Accounting Integration
-            $catStmt = db()->prepare("SELECT name_en FROM expense_categories WHERE id = ?");
-            $catStmt->execute([$category_id]);
-            $cat_name = $catStmt->fetchColumn();
-            recordExpenseJournal($expense_id, $amount, $date, $cat_name);
-            
-            $message = "Expense recorded successfully!";
-        }
-    }
-    if (isset($_POST['edit_expense'])) {
-        $id = (int)$_POST['id'];
-        $category_id = (int)$_POST['category_id'];
-        $amount = (float)$_POST['amount'];
-        $date = $_POST['expense_date'] ?: date('Y-m-d');
-        $desc = $_POST['description'] ?? '';
-        $ref = $_POST['reference_no'] ?? '';
-        
-        if ($id && $category_id && $amount > 0) {
-            $stmt = db()->prepare("UPDATE expenses SET category_id = ?, amount = ?, expense_date = ?, description = ?, reference_no = ? WHERE id = ?");
-            $stmt->execute([$category_id, $amount, $date, $desc, $ref, $id]);
-            $message = "Expense updated successfully!";
-        }
-    }
-    if (isset($_POST['delete_expense'])) {
-        $id = (int)$_POST['id'];
-        if ($id) {
-            $stmt = db()->prepare("DELETE FROM expenses WHERE id = ?");
-            $stmt->execute([$id]);
-            $message = "Expense deleted successfully!";
-        }
-    }
-
-    if (isset($_POST['add_customer'])) {
-        $name = $_POST['name'] ?? '';
-        $email = $_POST['email'] ?? '';
-        $phone = $_POST['phone'] ?? '';
-        $tax_id = $_POST['tax_id'] ?? '';
-        $balance = (float)($_POST['balance'] ?? 0);
-        $type = $_POST['type'] ?? 'customer';
-        if ($name) {
-            $stmt = db()->prepare("INSERT INTO customers (name, email, phone, tax_id, balance, type) VALUES (?, ?, ?, ?, ?, ?)");
-            $stmt->execute([$name, $email, $phone, $tax_id, $balance, $type]);
-            if (isset($_POST['ajax'])) {
-                echo json_encode(['success' => true, 'id' => db()->lastInsertId(), 'name' => $name]);
-                exit;
-            }
-            $message = ucfirst($type) . " added successfully!";
-        }
-    }
-
-    if (isset($_POST['action']) && $_POST['action'] === 'save_pos_transaction') {
-        header('Content-Type: application/json');
-        try {
-            $db = db();
-            $db->beginTransaction();
-            
-            $customer_id = !empty($_POST['customer_id']) ? (int)$_POST['customer_id'] : null;
-            $payments = json_decode($_POST['payments'] ?? '[]', true);
-            $total_amount = (float)$_POST['total_amount'];
-            $discount_code_id = !empty($_POST['discount_code_id']) ? (int)$_POST['discount_code_id'] : null;
-            $discount_amount = (float)($_POST['discount_amount'] ?? 0);
-            $loyalty_redeemed = (float)($_POST['loyalty_redeemed'] ?? 0);
-            $items = json_decode($_POST['items'] ?? '[]', true);
-            
-            // Fetch settings
-            $settings_res = $db->query("SELECT * FROM settings WHERE `key` IN ('loyalty_enabled', 'loyalty_points_per_unit', 'allow_zero_stock_sell')")->fetchAll(PDO::FETCH_ASSOC);
-            $app_settings = [];
-            foreach ($settings_res as $s) $app_settings[$s['key']] = $s['value'];
-            $loyalty_enabled = ($app_settings['loyalty_enabled'] ?? '0') === '1';
-            $points_per_unit = (float)($app_settings['loyalty_points_per_unit'] ?? 1);
-            $allow_zero_stock = ($app_settings['allow_zero_stock_sell'] ?? '1') === '1';
-
-            if (empty($items)) {
-                throw new Exception("Cart is empty");
-            }
-
-            $net_amount = (float)($total_amount - $discount_amount - $loyalty_redeemed);
-            if ($net_amount < 0) $net_amount = 0;
-
-            // Loyalty Calculation: Based on Tier Multiplier
-            $loyalty_multiplier = 1.0;
-            if ($customer_id && $loyalty_enabled) {
-                $stmtTier = $db->prepare("SELECT loyalty_tier FROM customers WHERE id = ?");
-                $stmtTier->execute([$customer_id]);
-                $tier = $stmtTier->fetchColumn() ?: 'bronze';
-                $loyalty_multiplier = getLoyaltyMultiplier($tier);
-            }
-            $loyalty_earned = $loyalty_enabled ? floor($net_amount * $points_per_unit * $loyalty_multiplier) : 0;
-
-            // Check if credit is used for walk-in or exceeds limit
-            $credit_total = 0;
-            foreach ($payments as $p) {
-                if ($p['method'] === 'credit') {
-                    if (!$customer_id) {
-                        throw new Exception("Credit payment is only allowed for registered customers");
-                    }
-                    $credit_total += (float)$p['amount'];
-                }
-            }
-
-            if ($customer_id && $credit_total > 0) {
-                $stmt = $db->prepare("SELECT balance, credit_limit FROM customers WHERE id = ?");
-                $stmt->execute([$customer_id]);
-                $cust = $stmt->fetch(PDO::FETCH_ASSOC);
-                if ($cust['credit_limit'] > 0 && (abs($cust['balance'] - $credit_total) > $cust['credit_limit'])) {
-                    throw new Exception("Credit limit exceeded. Current Debt: " . number_format(abs($cust['balance']), 3) . ", Limit: " . number_format($cust['credit_limit'], 3));
-                }
-            }
-
-            // Calculate actual paid amount (excluding credit)
-            $actual_paid = 0;
-            foreach ($payments as $p) {
-                if ($p['method'] !== 'credit') {
-                    $actual_paid += (float)$p['amount'];
-                }
-            }
-
-            $status = 'paid';
-            if ($actual_paid <= 0) {
-                $status = 'unpaid';
-            } elseif ($actual_paid < $net_amount - 0.001) {
-                $status = 'partially_paid';
-            }
-
-            $methods_str = implode(', ', array_unique(array_map(fn($p) => $p['method'], $payments)));
-
-            // Create Invoice
-            $stmt = $db->prepare("INSERT INTO invoices (customer_id, invoice_date, status, total_with_vat, paid_amount, type, payment_type) VALUES (?, CURDATE(), ?, ?, ?, 'sale', ?)");
-            $stmt->execute([$customer_id, $status, $net_amount, $actual_paid, $methods_str]);
-            $invoice_id = $db->lastInsertId();
-            
-            // Add POS Transaction record
-            $stmt = $db->prepare("INSERT INTO pos_transactions (transaction_no, customer_id, total_amount, discount_code_id, discount_amount, loyalty_points_earned, loyalty_points_redeemed, net_amount, payment_method) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
-            $transaction_no = 'POS-' . time() . rand(100, 999);
-            $stmt->execute([$transaction_no, $customer_id, $total_amount, $discount_code_id, $discount_amount, $loyalty_earned, $loyalty_redeemed, $net_amount, $methods_str]);
-            $pos_id = $db->lastInsertId();
-            
-            $total_vat = 0;
-            foreach ($items as &$item) {
-                $qty = (float)$item['qty'];
-                $price = (float)$item['price'];
-                $subtotal = $qty * $price;
-
-                $stmtItem = $db->prepare("SELECT vat_rate, stock_quantity, name_en FROM stock_items WHERE id = ?");
-                $stmtItem->execute([$item['id']]);
-                $item_info = $stmtItem->fetch(PDO::FETCH_ASSOC);
-                $vat_rate = (float)($item_info['vat_rate'] ?? 0);
-                $stock_qty = (float)($item_info['stock_quantity'] ?? 0);
-
-                if (!$allow_zero_stock && ($qty > $stock_qty)) {
-                    throw new Exception("Insufficient stock for item: " . ($item_info['name_en'] ?? 'Unknown'));
-                }
-
-                $item_vat = $subtotal * ($vat_rate / 100);
-                $item_vat = $subtotal * ($vat_rate / 100);
-                $total_vat += $item_vat;
-
-                // Add to invoice_items
-                $stmt = $db->prepare("INSERT INTO invoice_items (invoice_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                $stmt->execute([$invoice_id, $item['id'], $qty, $price, $subtotal]);
-                
-                // Add to pos_items
-                $stmt = $db->prepare("INSERT INTO pos_items (transaction_id, product_id, quantity, unit_price, subtotal) VALUES (?, ?, ?, ?, ?)");
-                $stmt->execute([$pos_id, $item['id'], $qty, $price, $subtotal]);
-                
-                // Update stock
-                $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                $stmt->execute([$qty, $item['id']]);
-            }
-            
-            // Update Invoice with VAT info
-            $stmt = $db->prepare("UPDATE invoices SET total_amount = ?, vat_amount = ? WHERE id = ?");
-            $stmt->execute([$net_amount - $total_vat, $total_vat, $invoice_id]);
-            
-            // Update Customer Loyalty Points and Balance
-            if ($customer_id) {
-                $credit_total = 0;
-                foreach ($payments as $p) {
-                    if ($p['method'] === 'credit') {
-                        $credit_total += (float)$p['amount'];
-                    }
-                }
-                
-                // New Modern Loyalty Logic
-                updateCustomerLoyalty($customer_id, (float)$net_amount, (float)$loyalty_earned, (float)$loyalty_redeemed, (int)$invoice_id);
-                
-                // Update Balance separately if credit used
-                if ($credit_total > 0) {
-                    $stmt = $db->prepare("UPDATE customers SET balance = balance - ? WHERE id = ?");
-                    $stmt->execute([(float)$credit_total, $customer_id]);
-                }
-            }
-
-            // Add Payments
-            foreach ($payments as $p) {
-                if ($p['method'] === 'credit') continue;
-                $stmt = $db->prepare("INSERT INTO payments (invoice_id, amount, payment_date, payment_method, notes) VALUES (?, ?, CURDATE(), ?, 'POS Transaction')");
-                $stmt->execute([$invoice_id, (float)$p['amount'], $p['method']]);
-                $payment_id = $db->lastInsertId();
-                recordPaymentReceivedJournal($payment_id, (float)$p['amount'], date('Y-m-d'), $p['method']);
-            }
-            
-            $db->commit();
-            
-            // Accounting Integration for the Sale itself
-            recordSaleJournal($invoice_id, (float)$net_amount, date('Y-m-d'), $items, (float)$total_vat);
-            
-            echo json_encode(['success' => true, 'invoice_id' => $invoice_id, 'transaction_no' => $transaction_no]);
-        } catch (Exception $e) {
-            if (isset($db)) $db->rollBack();
-            error_log("POS Error: " . $e->getMessage());
-            echo json_encode(['success' => false, 'error' => $e->getMessage()]);
-        }
-        exit;
-    }
-
-    // New Handlers for Advanced POS Features
-    if (isset($_POST['action']) && $_POST['action'] === 'hold_pos_cart') {
-        header('Content-Type: application/json');
-        $name = $_POST['cart_name'] ?? 'Cart ' . date('H:i');
-        $items = $_POST['items'] ?? '[]';
-        $customer_id = !empty($_POST['customer_id']) ? (int)$_POST['customer_id'] : null;
-        
-        $stmt = db()->prepare("INSERT INTO pos_held_carts (cart_name, items_json, customer_id) VALUES (?, ?, ?)");
-        $stmt->execute([$name, $items, $customer_id]);
-        echo json_encode(['success' => true]);
-        exit;
-    }
-
-    if (isset($_POST['action']) && $_POST['action'] === 'delete_held_cart') {
-        header('Content-Type: application/json');
-        $id = (int)$_POST['id'];
-        $stmt = db()->prepare("DELETE FROM pos_held_carts WHERE id = ?");
-        $stmt->execute([$id]);
-        echo json_encode(['success' => true]);
-        exit;
-    }
-
-    if (isset($_POST['edit_customer'])) {
-
-        $id = (int)$_POST['id'];
-        $name = $_POST['name'] ?? '';
-        $email = $_POST['email'] ?? '';
-        $phone = $_POST['phone'] ?? '';
-        $tax_id = $_POST['tax_id'] ?? '';
-        $balance = (float)($_POST['balance'] ?? 0);
-        if ($id && $name) {
-            $stmt = db()->prepare("UPDATE customers SET name = ?, email = ?, phone = ?, tax_id = ?, balance = ? WHERE id = ?");
-            $stmt->execute([$name, $email, $phone, $tax_id, $balance, $id]);
-            $message = "Record updated successfully!";
-        }
-    }
-
-    if (isset($_POST['delete_customer'])) {
-        $id = (int)$_POST['id'];
-        if ($id) {
-            $stmt = db()->prepare("DELETE FROM customers WHERE id = ?");
-            $stmt->execute([$id]);
-            $message = "Record deleted successfully!";
-        }
-    }
-
-    if (isset($_POST['add_category'])) {
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        if ($name_en && $name_ar) {
-            $stmt = db()->prepare("INSERT INTO stock_categories (name_en, name_ar) VALUES (?, ?)");
-            $stmt->execute([$name_en, $name_ar]);
-            $message = "Category added successfully!";
-        }
-    }
-
-    if (isset($_POST['add_unit'])) {
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        $short_en = $_POST['short_en'] ?? '';
-        $short_ar = $_POST['short_ar'] ?? '';
-        if ($name_en && $name_ar) {
-            $stmt = db()->prepare("INSERT INTO stock_units (name_en, name_ar, short_name_en, short_name_ar) VALUES (?, ?, ?, ?)");
-            $stmt->execute([$name_en, $name_ar, $short_en, $short_ar]);
-            $message = "Unit added successfully!";
-        }
-    }
-
-    if (isset($_POST['add_item'])) {
-        $cat_id = $_POST['category_id'] ?: null;
-        $unit_id = $_POST['unit_id'] ?: null;
-        $supplier_id = $_POST['supplier_id'] ?: null;
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        $sku = $_POST['sku'] ?? '';
-        $p_price = (float)($_POST['purchase_price'] ?? 0);
-        $s_price = (float)($_POST['sale_price'] ?? 0);
-        $qty = (float)($_POST['stock_quantity'] ?? 0);
-        $min_stock = (float)($_POST['min_stock_level'] ?? 0);
-        $vat_rate = (float)($_POST['vat_rate'] ?? 0);
-        $expiry = $_POST['expiry_date'] ?: null;
-        $is_promotion = isset($_POST['is_promotion']) ? 1 : 0;
-        $promo_start = $_POST['promotion_start'] ?: null;
-        $promo_end = $_POST['promotion_end'] ?: null;
-        $promo_percent = (float)($_POST['promotion_percent'] ?? 0);
-        
-        $image_path = null;
-        if (isset($_FILES['image']) && $_FILES['image']['error'] === UPLOAD_ERR_OK) {
-            $ext = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);
-            $filename = uniqid('item_') . '.' . $ext;
-            $target = 'uploads/items/' . $filename;
-            if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
-                $image_path = $target;
-            }
-        }
-
-        if ($name_en && $name_ar) {
-            $stmt = db()->prepare("INSERT INTO stock_items (category_id, unit_id, supplier_id, name_en, name_ar, sku, purchase_price, sale_price, stock_quantity, min_stock_level, expiry_date, image_path, vat_rate, is_promotion, promotion_start, promotion_end, promotion_percent) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
-            $stmt->execute([$cat_id, $unit_id, $supplier_id, $name_en, $name_ar, $sku, $p_price, $s_price, $qty, $min_stock, $expiry, $image_path, $vat_rate, $is_promotion, $promo_start, $promo_end, $promo_percent]);
-            $message = "Item added successfully!";
-        }
-    }
-
-    if (isset($_POST['delete_item'])) {
-        $id = (int)$_POST['id'];
-        // Optional: delete image file
-        $item = db()->prepare("SELECT image_path FROM stock_items WHERE id = ?");
-        $item->execute([$id]);
-        $path = $item->fetchColumn();
-        if ($path && file_exists($path)) {
-            unlink($path);
-        }
-        
-        $stmt = db()->prepare("DELETE FROM stock_items WHERE id = ?");
-        $stmt->execute([$id]);
-        $message = "Item deleted successfully!";
-    }
-
-    if (isset($_POST['edit_item'])) {
-        $id = (int)$_POST['id'];
-        $cat_id = $_POST['category_id'] ?: null;
-        $unit_id = $_POST['unit_id'] ?: null;
-        $supplier_id = $_POST['supplier_id'] ?: null;
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        $sku = $_POST['sku'] ?? '';
-        $p_price = (float)($_POST['purchase_price'] ?? 0);
-        $s_price = (float)($_POST['sale_price'] ?? 0);
-        $qty = (float)($_POST['stock_quantity'] ?? 0);
-        $min_stock = (float)($_POST['min_stock_level'] ?? 0);
-        $vat_rate = (float)($_POST['vat_rate'] ?? 0);
-        $expiry = $_POST['expiry_date'] ?: null;
-        $is_promotion = isset($_POST['is_promotion']) ? 1 : 0;
-        $promo_start = $_POST['promotion_start'] ?: null;
-        $promo_end = $_POST['promotion_end'] ?: null;
-        $promo_percent = (float)($_POST['promotion_percent'] ?? 0);
-
-        $stmt = db()->prepare("SELECT image_path FROM stock_items WHERE id = ?");
-        $stmt->execute([$id]);
-        $image_path = $stmt->fetchColumn();
-
-        if (isset($_FILES['image']) && $_FILES['image']['error'] === UPLOAD_ERR_OK) {
-            // Delete old image
-            if ($image_path && file_exists($image_path)) {
-                unlink($image_path);
-            }
-            $ext = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);
-            $filename = uniqid('item_') . '.' . $ext;
-            $target = 'uploads/items/' . $filename;
-            if (move_uploaded_file($_FILES['image']['tmp_name'], $target)) {
-                $image_path = $target;
-            }
-        }
-
-        if ($name_en && $name_ar) {
-            $stmt = db()->prepare("UPDATE stock_items SET category_id = ?, unit_id = ?, supplier_id = ?, name_en = ?, name_ar = ?, sku = ?, purchase_price = ?, sale_price = ?, stock_quantity = ?, min_stock_level = ?, expiry_date = ?, image_path = ?, vat_rate = ?, is_promotion = ?, promotion_start = ?, promotion_end = ?, promotion_percent = ? WHERE id = ?");
-            $stmt->execute([$cat_id, $unit_id, $supplier_id, $name_en, $name_ar, $sku, $p_price, $s_price, $qty, $min_stock, $expiry, $image_path, $vat_rate, $is_promotion, $promo_start, $promo_end, $promo_percent, $id]);
-            $message = "Item updated successfully!";
-        }
-    }
-
-    if (isset($_POST['import_items'])) {
-        if (isset($_FILES['excel_file']) && $_FILES['excel_file']['error'] === UPLOAD_ERR_OK) {
-            $file = $_FILES['excel_file']['tmp_name'];
-            $handle = fopen($file, 'r');
-            $header = fgetcsv($handle); // Skip header row
-            
-            $count = 0;
-            while (($row = fgetcsv($handle)) !== FALSE) {
-                // Mapping: sku, eng name, arabic name, sale price, cost price
-                if (count($row) < 5) continue;
-                
-                $sku = trim($row[0]);
-                $name_en = trim($row[1]);
-                $name_ar = trim($row[2]);
-                $sale_price = (float)trim($row[3]);
-                $purchase_price = (float)trim($row[4]);
-                
-                if ($name_en && $name_ar) {
-                    // Check if SKU exists to update or insert
-                    $existingId = null;
-                    if ($sku !== "") {
-                        $check = db()->prepare("SELECT id FROM stock_items WHERE sku = ?");
-                        $check->execute([$sku]);
-                        $existingId = $check->fetchColumn();
-                    }
-                    
-                    if ($existingId) {
-                        $stmt = db()->prepare("UPDATE stock_items SET name_en = ?, name_ar = ?, sale_price = ?, purchase_price = ? WHERE id = ?");
-                        $stmt->execute([$name_en, $name_ar, $sale_price, $purchase_price, $existingId]);
-                    } else {
-                        $stmt = db()->prepare("INSERT INTO stock_items (sku, name_en, name_ar, sale_price, purchase_price) VALUES (?, ?, ?, ?, ?)");
-                        $stmt->execute([$sku, $name_en, $name_ar, $sale_price, $purchase_price]);
-                    }
-                    $count++;
-                }
-            }
-            fclose($handle);
-            $message = "$count items processed successfully!";
-        }
-    }
-
-    if (isset($_POST['import_customers']) || isset($_POST['import_suppliers'])) {
-        $type = isset($_POST['import_customers']) ? 'customer' : 'supplier';
-        if (isset($_FILES['excel_file']) && $_FILES['excel_file']['error'] === UPLOAD_ERR_OK) {
-            $file = $_FILES['excel_file']['tmp_name'];
-            $handle = fopen($file, 'r');
-            $header = fgetcsv($handle);
-            $count = 0;
-            while (($row = fgetcsv($handle)) !== FALSE) {
-                if (count($row) < 4) continue;
-                $name = trim($row[0]);
-                $email = trim($row[1]);
-                $phone = trim($row[2]);
-                $tax_id = isset($row[3]) ? trim($row[3]) : '';
-                $balance = isset($row[4]) ? (float)trim($row[4]) : (float)trim($row[3] ?? 0);
-                if ($name) {
-                    $stmt = db()->prepare("INSERT INTO customers (name, email, phone, tax_id, balance, type) VALUES (?, ?, ?, ?, ?, ?)");
-                    $stmt->execute([$name, $email, $phone, $tax_id, $balance, $type]);
-                    $count++;
-                }
-            }
-            fclose($handle);
-            $message = "$count " . ($type === 'customer' ? 'customers' : 'suppliers') . " imported successfully!";
-        }
-    }
-
-    if (isset($_POST['import_categories'])) {
-        if (isset($_FILES['excel_file']) && $_FILES['excel_file']['error'] === UPLOAD_ERR_OK) {
-            $file = $_FILES['excel_file']['tmp_name'];
-            $handle = fopen($file, 'r');
-            $header = fgetcsv($handle);
-            $count = 0;
-            while (($row = fgetcsv($handle)) !== FALSE) {
-                if (count($row) < 2) continue;
-                $name_en = trim($row[0]);
-                $name_ar = trim($row[1]);
-                if ($name_en && $name_ar) {
-                    $stmt = db()->prepare("INSERT INTO stock_categories (name_en, name_ar) VALUES (?, ?)");
-                    $stmt->execute([$name_en, $name_ar]);
-                    $count++;
-                }
-            }
-            fclose($handle);
-            $message = "$count categories imported successfully!";
-        }
-    }
-
-    if (isset($_POST['import_units'])) {
-        if (isset($_FILES['excel_file']) && $_FILES['excel_file']['error'] === UPLOAD_ERR_OK) {
-            $file = $_FILES['excel_file']['tmp_name'];
-            $handle = fopen($file, 'r');
-            $header = fgetcsv($handle);
-            $count = 0;
-            while (($row = fgetcsv($handle)) !== FALSE) {
-                if (count($row) < 4) continue;
-                $name_en = trim($row[0]);
-                $name_ar = trim($row[1]);
-                $short_en = trim($row[2]);
-                $short_ar = trim($row[3]);
-                if ($name_en && $name_ar) {
-                    $stmt = db()->prepare("INSERT INTO stock_units (name_en, name_ar, short_name_en, short_name_ar) VALUES (?, ?, ?, ?)");
-                    $stmt->execute([$name_en, $name_ar, $short_en, $short_ar]);
-                    $count++;
-                }
-            }
-            fclose($handle);
-            $message = "$count units imported successfully!";
-        }
-    }
-
-    if (isset($_POST['add_invoice'])) {
-        $customer_id = $_POST['customer_id'] ?: null;
-        $invoice_date = $_POST['invoice_date'] ?: date('Y-m-d');
-        $type = $_POST['type'] ?? 'sale'; // 'sale' or 'purchase'
-        $payment_type = $_POST['payment_type'] ?? 'cash';
-        $status = $_POST['status'] ?? 'unpaid';
-        $item_ids = $_POST['item_ids'] ?? [];
-        $quantities = $_POST['quantities'] ?? [];
-        $prices = $_POST['prices'] ?? [];
-        
-        if (!empty($item_ids)) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                // Fetch settings
-                $allow_zero_stock = $db->query("SELECT `value` FROM settings WHERE `key` = 'allow_zero_stock_sell'")->fetchColumn() === '1';
-
-                $subtotal = 0;
-                $total_vat = 0;
-                
-                $items_data = [];
-                foreach ($item_ids as $index => $item_id) {
-                    $qty = (float)$quantities[$index];
-                    $price = (float)$prices[$index];
-                    
-                    // Fetch item info
-                    $stmtItem = $db->prepare("SELECT vat_rate, stock_quantity, name_en FROM stock_items WHERE id = ?");
-                    $stmtItem->execute([$item_id]);
-                    $item_info = $stmtItem->fetch(PDO::FETCH_ASSOC);
-                    $vat_rate = (float)($item_info['vat_rate'] ?? 0);
-                    $stock_qty = (float)($item_info['stock_quantity'] ?? 0);
-
-                    if ($type === 'sale' && !$allow_zero_stock && ($qty > $stock_qty)) {
-                        throw new Exception("Insufficient stock for item: " . ($item_info['name_en'] ?? 'Unknown'));
-                    }
-                    
-                    $line_total = $qty * $price;
-                    $line_vat = $line_total * ($vat_rate / 100);
-                    
-                    $line_total = $qty * $price;
-                    $line_vat = $line_total * ($vat_rate / 100);
-                    
-                    $subtotal += $line_total;
-                    $total_vat += $line_vat;
-                    
-                    $items_data[] = [
-                        'id' => $item_id,
-                        'qty' => $qty,
-                        'price' => $price,
-                        'total' => $line_total
-                    ];
-                }
-                
-                $total_with_vat = $subtotal + $total_vat;
-                $paid_amount = ($status === 'paid') ? $total_with_vat : (($status === 'unpaid') ? 0 : (float)($_POST['paid_amount'] ?? 0));
-
-                $stmt = $db->prepare("INSERT INTO invoices (customer_id, invoice_date, type, payment_type, status, total_amount, vat_amount, total_with_vat, paid_amount) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
-                $stmt->execute([$customer_id, $invoice_date, $type, $payment_type, $status, $subtotal, $total_vat, $total_with_vat, $paid_amount]);
-                $invoice_id = $db->lastInsertId();
-
-                if ($paid_amount > 0) {
-                    $stmt = $db->prepare("INSERT INTO payments (invoice_id, payment_date, amount, payment_method, notes) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$invoice_id, $invoice_date, $paid_amount, 'Cash', 'Initial payment']);
-                }
-
-                foreach ($items_data as $item) {
-                    $stmt = $db->prepare("INSERT INTO invoice_items (invoice_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$invoice_id, $item['id'], $item['qty'], $item['price'], $item['total']]);
-
-                    // Update stock level
-                    if ($type === 'sale') {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                    } else {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity + ? WHERE id = ?");
-                    }
-                    $stmt->execute([$item['qty'], $item['id']]);
-                }
-
-                $db->commit();
-                
-                // Accounting Integration
-                if ($type === 'sale') {
-                    recordSaleJournal($invoice_id, (float)$total_with_vat, $invoice_date, $items_data, (float)$total_vat);
-                } else {
-                    recordPurchaseJournal($invoice_id, (float)$total_with_vat, $invoice_date, $items_data, (float)$total_vat);
-                }
-                
-                if ($paid_amount > 0) {
-                    // We need the payment_id. Since we only recorded one payment above, we can fetch it.
-                    $stmtPayId = db()->prepare("SELECT id FROM payments WHERE invoice_id = ? ORDER BY id DESC LIMIT 1");
-                    $stmtPayId->execute([$invoice_id]);
-                    $pay_id = $stmtPayId->fetchColumn();
-                    if ($type === 'sale') {
-                        recordPaymentReceivedJournal($pay_id, $paid_amount, $invoice_date, 'Cash');
-                    } else {
-                        recordPaymentMadeJournal($pay_id, $paid_amount, $invoice_date, 'Cash');
-                    }
-                }
-
-                $message = "Invoice #$invoice_id created successfully!";
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['delete_invoice'])) {
-        $id = (int)$_POST['id'];
-        if ($id) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                // Get invoice details
-                $stmt = $db->prepare("SELECT type FROM invoices WHERE id = ?");
-                $stmt->execute([$id]);
-                $type = $stmt->fetchColumn();
-
-                // Get items to restore stock
-                $stmt = $db->prepare("SELECT item_id, quantity FROM invoice_items WHERE invoice_id = ?");
-                $stmt->execute([$id]);
-                $items = $stmt->fetchAll();
-
-                foreach ($items as $item) {
-                    if ($type === 'sale') {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity + ? WHERE id = ?");
-                    } else {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                    }
-                    $stmt->execute([$item['quantity'], $item['item_id']]);
-                }
-
-                $stmt = $db->prepare("DELETE FROM invoice_items WHERE invoice_id = ?");
-                $stmt->execute([$id]);
-                $stmt = $db->prepare("DELETE FROM invoices WHERE id = ?");
-                $stmt->execute([$id]);
-
-                $db->commit();
-                $message = "Invoice deleted successfully and stock restored!";
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['edit_invoice'])) {
-        $invoice_id = (int)$_POST['invoice_id'];
-        $customer_id = $_POST['customer_id'] ?: null;
-        $invoice_date = $_POST['invoice_date'] ?: date('Y-m-d');
-        $payment_type = $_POST['payment_type'] ?? 'cash';
-        $status = $_POST['status'] ?? 'unpaid';
-        $item_ids = $_POST['item_ids'] ?? [];
-        $quantities = $_POST['quantities'] ?? [];
-        $prices = $_POST['prices'] ?? [];
-
-        if ($invoice_id && !empty($item_ids)) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                // Fetch settings
-                $allow_zero_stock = $db->query("SELECT `value` FROM settings WHERE `key` = 'allow_zero_stock_sell'")->fetchColumn() === '1';
-
-                // Get old invoice type and items to revert stock
-                $stmt = $db->prepare("SELECT type, paid_amount FROM invoices WHERE id = ?");
-                $stmt->execute([$invoice_id]);
-                $inv_info = $stmt->fetch();
-                $type = $inv_info['type'];
-                $old_paid_amount = (float)$inv_info['paid_amount'];
-
-                $stmt = $db->prepare("SELECT item_id, quantity FROM invoice_items WHERE invoice_id = ?");
-                $stmt->execute([$invoice_id]);
-                $old_items = $stmt->fetchAll();
-
-                foreach ($old_items as $item) {
-                    if ($type === 'sale') {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity + ? WHERE id = ?");
-                    } else {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                    }
-                    $stmt->execute([$item['quantity'], $item['item_id']]);
-                }
-
-                // Delete old items
-                $stmt = $db->prepare("DELETE FROM invoice_items WHERE invoice_id = ?");
-                $stmt->execute([$invoice_id]);
-
-                // Calculate new totals
-                $subtotal = 0;
-                $total_vat = 0;
-                $items_data = [];
-                foreach ($item_ids as $index => $item_id) {
-                    $qty = (float)$quantities[$index];
-                    $price = (float)$prices[$index];
-                    
-                    $stmtItem = $db->prepare("SELECT vat_rate, stock_quantity, name_en FROM stock_items WHERE id = ?");
-                    $stmtItem->execute([$item_id]);
-                    $item_info = $stmtItem->fetch(PDO::FETCH_ASSOC);
-                    $vat_rate = (float)($item_info['vat_rate'] ?? 0);
-                    $stock_qty = (float)($item_info['stock_quantity'] ?? 0);
-
-                    if ($type === 'sale' && !$allow_zero_stock && ($qty > $stock_qty)) {
-                        throw new Exception("Insufficient stock for item: " . ($item_info['name_en'] ?? 'Unknown'));
-                    }
-                    
-                    $line_total = $qty * $price;
-                    $line_vat = $line_total * ($vat_rate / 100);
-                    
-                    $subtotal += $line_total;
-                    $total_vat += $line_vat;
-                    
-                    $items_data[] = [
-                        'id' => $item_id,
-                        'qty' => $qty,
-                        'price' => $price,
-                        'total' => $line_total
-                    ];
-                }
-                
-                $total_with_vat = $subtotal + $total_vat;
-                $paid_amount = ($status === 'paid') ? $total_with_vat : (($status === 'unpaid') ? 0 : ($old_paid_amount > 0 ? $old_paid_amount : ($_POST['paid_amount'] ?? 0)));
-
-                if ($paid_amount > $old_paid_amount) {
-                    $diff = $paid_amount - $old_paid_amount;
-                    $stmt = $db->prepare("INSERT INTO payments (invoice_id, payment_date, amount, payment_method, notes) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$invoice_id, $invoice_date, $diff, 'Cash', 'Payment via edit']);
-                }
-
-                // Update invoice
-                $stmt = $db->prepare("UPDATE invoices SET customer_id = ?, invoice_date = ?, payment_type = ?, status = ?, total_amount = ?, vat_amount = ?, total_with_vat = ?, paid_amount = ? WHERE id = ?");
-                $stmt->execute([$customer_id, $invoice_date, $payment_type, $status, $subtotal, $total_vat, $total_with_vat, $paid_amount, $invoice_id]);
-
-                // Insert new items and update stock
-                foreach ($items_data as $item) {
-                    $stmt = $db->prepare("INSERT INTO invoice_items (invoice_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$invoice_id, $item['id'], $item['qty'], $item['price'], $item['total']]);
-
-                    if ($type === 'sale') {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                    } else {
-                        $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity + ? WHERE id = ?");
-                    }
-                    $stmt->execute([$item['qty'], $item['id']]);
-                }
-
-                $db->commit();
-                $message = "Invoice #$invoice_id updated successfully!";
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['add_quotation'])) {
-        $customer_id = $_POST['customer_id'] ?: null;
-        $quotation_date = $_POST['quotation_date'] ?: date('Y-m-d');
-        $valid_until = $_POST['valid_until'] ?: null;
-        $item_ids = $_POST['item_ids'] ?? [];
-        $quantities = $_POST['quantities'] ?? [];
-        $prices = $_POST['prices'] ?? [];
-        
-        if (!empty($item_ids)) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                $allow_zero_stock = $db->query("SELECT `value` FROM settings WHERE `key` = 'allow_zero_stock_sell'")->fetchColumn() === '1';
-
-                $subtotal = 0;
-                $total_vat = 0;
-                $items_data = [];
-                foreach ($item_ids as $index => $item_id) {
-                    $qty = (float)$quantities[$index];
-                    $price = (float)$prices[$index];
-
-                    $stmtItem = $db->prepare("SELECT vat_rate, stock_quantity, name_en FROM stock_items WHERE id = ?");
-                    $stmtItem->execute([$item_id]);
-                    $item_info = $stmtItem->fetch(PDO::FETCH_ASSOC);
-                    $vat_rate = (float)($item_info['vat_rate'] ?? 0);
-                    $stock_qty = (float)($item_info['stock_quantity'] ?? 0);
-
-                    if (!$allow_zero_stock && ($qty > $stock_qty)) {
-                        throw new Exception("Insufficient stock for item: " . ($item_info['name_en'] ?? 'Unknown'));
-                    }
-
-                    $line_total = $qty * $price;
-                    $line_vat = $line_total * ($vat_rate / 100);
-                    $line_total = $qty * $price;
-                    $line_vat = $line_total * ($vat_rate / 100);
-                    $subtotal += $line_total;
-                    $total_vat += $line_vat;
-                    $items_data[] = ['id' => $item_id, 'qty' => $qty, 'price' => $price, 'total' => $line_total];
-                }
-                $total_with_vat = $subtotal + $total_vat;
-                $stmt = $db->prepare("INSERT INTO quotations (customer_id, quotation_date, valid_until, total_amount, vat_amount, total_with_vat) VALUES (?, ?, ?, ?, ?, ?)");
-                $stmt->execute([$customer_id, $quotation_date, $valid_until, $subtotal, $total_vat, $total_with_vat]);
-                $quotation_id = $db->lastInsertId();
-                foreach ($items_data as $item) {
-                    $stmt = $db->prepare("INSERT INTO quotation_items (quotation_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$quotation_id, $item['id'], $item['qty'], $item['price'], $item['total']]);
-                }
-                $db->commit();
-                $message = "Quotation #$quotation_id created successfully!";
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['edit_quotation'])) {
-        $quotation_id = (int)$_POST['quotation_id'];
-        $customer_id = $_POST['customer_id'] ?: null;
-        $quotation_date = $_POST['quotation_date'] ?: date('Y-m-d');
-        $valid_until = $_POST['valid_until'] ?: null;
-        $status = $_POST['status'] ?? 'pending';
-        $item_ids = $_POST['item_ids'] ?? [];
-        $quantities = $_POST['quantities'] ?? [];
-        $prices = $_POST['prices'] ?? [];
-
-        if ($quotation_id && !empty($item_ids)) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                $allow_zero_stock = $db->query("SELECT `value` FROM settings WHERE `key` = 'allow_zero_stock_sell'")->fetchColumn() === '1';
-
-                $stmt = $db->prepare("DELETE FROM quotation_items WHERE quotation_id = ?");
-                $stmt->execute([$quotation_id]);
-                $subtotal = 0;
-                $total_vat = 0;
-                $items_data = [];
-                foreach ($item_ids as $index => $item_id) {
-                    $qty = (float)$quantities[$index];
-                    $price = (float)$prices[$index];
-
-                    $stmtItem = $db->prepare("SELECT vat_rate, stock_quantity, name_en FROM stock_items WHERE id = ?");
-                    $stmtItem->execute([$item_id]);
-                    $item_info = $stmtItem->fetch(PDO::FETCH_ASSOC);
-                    $vat_rate = (float)($item_info['vat_rate'] ?? 0);
-                    $stock_qty = (float)($item_info['stock_quantity'] ?? 0);
-
-                    if (!$allow_zero_stock && ($qty > $stock_qty)) {
-                        throw new Exception("Insufficient stock for item: " . ($item_info['name_en'] ?? 'Unknown'));
-                    }
-
-                    $line_total = $qty * $price;
-                    $line_vat = $line_total * ($vat_rate / 100);
-                    $subtotal += $line_total;
-                    $total_vat += $line_vat;
-                    $items_data[] = ['id' => $item_id, 'qty' => $qty, 'price' => $price, 'total' => $line_total];
-                }
-                $total_with_vat = $subtotal + $total_vat;
-                $stmt = $db->prepare("UPDATE quotations SET customer_id = ?, quotation_date = ?, valid_until = ?, status = ?, total_amount = ?, vat_amount = ?, total_with_vat = ? WHERE id = ?");
-                $stmt->execute([$customer_id, $quotation_date, $valid_until, $status, $subtotal, $total_vat, $total_with_vat, $quotation_id]);
-                foreach ($items_data as $item) {
-                    $stmt = $db->prepare("INSERT INTO quotation_items (quotation_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$quotation_id, $item['id'], $item['qty'], $item['price'], $item['total']]);
-                }
-                $db->commit();
-                $message = "Quotation #$quotation_id updated successfully!";
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['delete_quotation'])) {
-        $id = (int)$_POST['id'];
-        if ($id) {
-            $stmt = db()->prepare("DELETE FROM quotations WHERE id = ?");
-            $stmt->execute([$id]);
-            $message = "Quotation deleted successfully!";
-        }
-    }
-
-    if (isset($_POST['convert_to_invoice'])) {
-        $quotation_id = (int)$_POST['quotation_id'];
-        if ($quotation_id) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                $allow_zero_stock = $db->query("SELECT `value` FROM settings WHERE `key` = 'allow_zero_stock_sell'")->fetchColumn() === '1';
-
-                $stmt = $db->prepare("SELECT * FROM quotations WHERE id = ?");
-                $stmt->execute([$quotation_id]);
-                $q = $stmt->fetch();
-                if (!$q) throw new Exception("Quotation not found");
-                if ($q['status'] === 'converted') throw new Exception("Quotation already converted");
-
-                $stmt = $db->prepare("SELECT qi.*, si.stock_quantity, si.name_en FROM quotation_items qi JOIN stock_items si ON qi.item_id = si.id WHERE qi.quotation_id = ?");
-                $stmt->execute([$quotation_id]);
-                $items = $stmt->fetchAll();
-
-                if (!$allow_zero_stock) {
-                    foreach ($items as $item) {
-                        if ($item['quantity'] > $item['stock_quantity']) {
-                            throw new Exception("Insufficient stock for item: " . ($item['name_en'] ?? 'Unknown'));
-                        }
-                    }
-                }
-
-                // Create Invoice
-                $stmt = $db->prepare("INSERT INTO invoices (customer_id, invoice_date, type, status, total_amount, vat_amount, total_with_vat, paid_amount) VALUES (?, CURDATE(), 'sale', 'unpaid', ?, ?, ?, 0)");
-                $stmt->execute([$q['customer_id'], $q['total_amount'], $q['vat_amount'], $q['total_with_vat']]);
-                $invoice_id = $db->lastInsertId();
-
-                foreach ($items as $item) {
-                    $stmt = $db->prepare("INSERT INTO invoice_items (invoice_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$invoice_id, $item['item_id'], $item['quantity'], $item['unit_price'], $item['total_price']]);
-                    
-                    // Update stock
-                    $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                    $stmt->execute([$item['quantity'], $item['item_id']]);
-                }
-
-                // Update quotation status
-                $stmt = $db->prepare("UPDATE quotations SET status = 'converted' WHERE id = ?");
-                $stmt->execute([$quotation_id]);
-
-                $db->commit();
-                $message = "Quotation converted to Invoice #$invoice_id successfully!";
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['add_payment_method'])) {
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        if ($name_en && $name_ar) {
-            $stmt = db()->prepare("INSERT INTO payment_methods (name_en, name_ar) VALUES (?, ?)");
-            $stmt->execute([$name_en, $name_ar]);
-            $message = "Payment method added successfully!";
-        }
-    }
-
-    if (isset($_POST['edit_payment_method'])) {
-        $id = (int)$_POST['id'];
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        if ($id && $name_en && $name_ar) {
-            $stmt = db()->prepare("UPDATE payment_methods SET name_en = ?, name_ar = ? WHERE id = ?");
-            $stmt->execute([$name_en, $name_ar, $id]);
-            $message = "Payment method updated successfully!";
-        }
-    }
-
-    if (isset($_POST['delete_payment_method'])) {
-        $id = (int)$_POST['id'];
-        if ($id) {
-            $stmt = db()->prepare("DELETE FROM payment_methods WHERE id = ?");
-            $stmt->execute([$id]);
-            $message = "Payment method deleted successfully!";
-        }
-    }
-
-    if (isset($_POST['update_settings'])) {
-        foreach ($_POST['settings'] as $key => $value) {
-            $stmt = db()->prepare("INSERT INTO settings (`key`, `value`) VALUES (?, ?) ON DUPLICATE KEY UPDATE `value` = ?");
-            $stmt->execute([$key, $value, $value]);
-        }
-        
-        if (isset($_FILES['company_logo']) && $_FILES['company_logo']['error'] === UPLOAD_ERR_OK) {
-            $ext = pathinfo($_FILES['company_logo']['name'], PATHINFO_EXTENSION);
-            $filename = 'logo.' . $ext;
-            $target = 'uploads/' . $filename;
-            if (!is_dir('uploads')) mkdir('uploads', 0775, true);
-            if (move_uploaded_file($_FILES['company_logo']['tmp_name'], $target)) {
-                $stmt = db()->prepare("INSERT INTO settings (`key`, `value`) VALUES ('company_logo', ?) ON DUPLICATE KEY UPDATE `value` = ?");
-                $stmt->execute([$target, $target]);
-            }
-        }
-
-        if (isset($_FILES['favicon']) && $_FILES['favicon']['error'] === UPLOAD_ERR_OK) {
-            $ext = pathinfo($_FILES['favicon']['name'], PATHINFO_EXTENSION);
-            $filename = 'favicon.' . $ext;
-            $target = 'uploads/' . $filename;
-            if (!is_dir('uploads')) mkdir('uploads', 0775, true);
-            if (move_uploaded_file($_FILES['favicon']['tmp_name'], $target)) {
-                $stmt = db()->prepare("INSERT INTO settings (`key`, `value`) VALUES ('favicon', ?) ON DUPLICATE KEY UPDATE `value` = ?");
-                $stmt->execute([$target, $target]);
-            }
-        }
-
-        if (isset($_FILES['manager_signature']) && $_FILES['manager_signature']['error'] === UPLOAD_ERR_OK) {
-            $ext = pathinfo($_FILES['manager_signature']['name'], PATHINFO_EXTENSION);
-            $filename = 'signature.' . $ext;
-            $target = 'uploads/' . $filename;
-            if (!is_dir('uploads')) mkdir('uploads', 0775, true);
-            if (move_uploaded_file($_FILES['manager_signature']['tmp_name'], $target)) {
-                $stmt = db()->prepare("INSERT INTO settings (`key`, `value`) VALUES ('manager_signature', ?) ON DUPLICATE KEY UPDATE `value` = ?");
-                $stmt->execute([$target, $target]);
-            }
-        }
-        $message = "Settings updated successfully!";
-        }
-
-    if (isset($_POST['sync_accounting'])) {
-        try {
-            $db = db();
-            $db->beginTransaction();
-            
-            // Clear existing automatic entries
-            $db->exec("DELETE FROM acc_journal_entries WHERE source_type IN ('invoice', 'payment', 'expense', 'payroll', 'sales_return', 'purchase_return')");
-            
-            // 1. Invoices
-            $invoices = $db->query("SELECT * FROM invoices ORDER BY id ASC")->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($invoices as $inv) {
-                $items = $db->prepare("SELECT item_id as id, quantity as qty, unit_price as price FROM invoice_items WHERE invoice_id = ?");
-                $items->execute([$inv['id']]);
-                $items_data = $items->fetchAll(PDO::FETCH_ASSOC);
-
-                if ($inv['type'] === 'sale') {
-                    recordSaleJournal($inv['id'], (float)$inv['total_with_vat'], $inv['invoice_date'], $items_data, (float)$inv['vat_amount']);
-                } else {
-                    recordPurchaseJournal($inv['id'], (float)$inv['total_with_vat'], $inv['invoice_date'], $items_data, (float)$inv['vat_amount']);
-                }
-            }
-
-            // 2. Payments
-            $payments = $db->query("SELECT p.*, i.type FROM payments p JOIN invoices i ON p.invoice_id = i.id ORDER BY p.id ASC")->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($payments as $pay) {
-                if ($pay['type'] === 'sale') {
-                    recordPaymentReceivedJournal($pay['id'], (float)$pay['amount'], $pay['payment_date'], $pay['payment_method']);
-                } else {
-                    recordPaymentMadeJournal($pay['id'], (float)$pay['amount'], $pay['payment_date'], $pay['payment_method']);
-                }
-            }
-
-            // 3. Expenses
-            $expenses = $db->query("SELECT e.*, c.name_en FROM expenses e JOIN expense_categories c ON e.category_id = c.id ORDER BY e.id ASC")->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($expenses as $exp) {
-                recordExpenseJournal($exp['id'], (float)$exp['amount'], $exp['expense_date'], $exp['name_en']);
-            }
-
-            // 4. Payroll
-            $payrolls = $db->query("SELECT p.*, e.name FROM hr_payroll p JOIN hr_employees e ON p.employee_id = e.id WHERE p.status = 'paid' ORDER BY p.id ASC")->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($payrolls as $proll) {
-                recordPayrollJournal($proll['id'], (float)$proll['net_salary'], $proll['payment_date'] ?? date('Y-m-d'), $proll['name']);
-            }
-
-            // 5. Returns
-            $s_returns = $db->query("SELECT * FROM sales_returns ORDER BY id ASC")->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($s_returns as $ret) {
-                recordSalesReturnJournal($ret['id'], (float)$ret['total_amount'], $ret['return_date']);
-            }
-
-            $p_returns = $db->query("SELECT * FROM purchase_returns ORDER BY id ASC")->fetchAll(PDO::FETCH_ASSOC);
-            foreach ($p_returns as $ret) {
-                recordPurchaseReturnJournal($ret['id'], (float)$ret['total_amount'], $ret['return_date']);
-            }
-
-            $db->commit();
-            $message = "Accounting sync completed successfully!";
-        } catch (Exception $e) {
-            if (isset($db)) $db->rollBack();
-            $message = "Sync Error: " . $e->getMessage();
-        }
-    }
-
-    if (isset($_POST['add_account'])) {
-        $code = $_POST['code'] ?? '';
-        $name_en = $_POST['name_en'] ?? '';
-        $name_ar = $_POST['name_ar'] ?? '';
-        $type = $_POST['type'] ?? '';
-        $parent_id = $_POST['parent_id'] ?: null;
-        
-        if ($code && $name_en && $type) {
-            $stmt = db()->prepare("INSERT INTO acc_accounts (code, name_en, name_ar, type, parent_id) VALUES (?, ?, ?, ?, ?)");
-            $stmt->execute([$code, $name_en, $name_ar, $type, $parent_id]);
-            $message = "Account added successfully!";
-        }
-    }
-    if (isset($_POST['add_journal_entry'])) {
-        $date = $_POST['entry_date'] ?: date('Y-m-d');
-        $desc = $_POST['description'] ?? '';
-        $ref = $_POST['reference'] ?? '';
-        
-        $codes = $_POST['codes'] ?? [];
-        $debits = $_POST['debits'] ?? [];
-        $credits = $_POST['credits'] ?? [];
-        
-        $items = [];
-        $total_debit = 0;
-        $total_credit = 0;
-        
-        foreach ($codes as $index => $code) {
-            if (!$code) continue;
-            $deb = (float)($debits[$index] ?? 0);
-            $cre = (float)($credits[$index] ?? 0);
-            if ($deb == 0 && $cre == 0) continue;
-            
-            $items[] = ['code' => $code, 'debit' => $deb, 'credit' => $cre];
-            $total_debit += $deb;
-            $total_credit += $cre;
-        }
-        
-        if (abs($total_debit - $total_credit) < 0.0001 && !empty($items)) {
-            createJournalEntry($date, $desc, $ref, 'manual', null, $items);
-            $message = "Manual Journal Entry recorded successfully!";
-        } else {
-            $message = "Error: Journal entry is not balanced (Debit: $total_debit, Credit: $total_credit)";
-        }
-    }
-
-    if (isset($_POST['record_payment'])) {
-        $invoice_id = (int)$_POST['invoice_id'];
-        $amount = (float)$_POST['amount'];
-        $payment_date = $_POST['payment_date'] ?: date('Y-m-d');
-        $payment_method = $_POST['payment_method'] ?: 'Cash';
-        $notes = $_POST['notes'] ?? '';
-
-        if ($invoice_id && $amount > 0) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                // Record the payment
-                $stmt = $db->prepare("INSERT INTO payments (invoice_id, payment_date, amount, payment_method, notes) VALUES (?, ?, ?, ?, ?)");
-                $stmt->execute([$invoice_id, $payment_date, $amount, $payment_method, $notes]);
-                $payment_id = $db->lastInsertId();
-
-                // Update invoice paid_amount and status
-                $stmt = $db->prepare("SELECT total_with_vat, paid_amount FROM invoices WHERE id = ?");
-                $stmt->execute([$invoice_id]);
-                $inv = $stmt->fetch();
-
-                $new_paid_amount = (float)$inv['paid_amount'] + $amount;
-                $total = (float)$inv['total_with_vat'];
-
-                $new_status = 'partially_paid';
-                if ($new_paid_amount >= $total) {
-                    $new_status = 'paid';
-                }
-
-                $stmt = $db->prepare("UPDATE invoices SET paid_amount = ?, status = ? WHERE id = ?");
-                $stmt->execute([$new_paid_amount, $new_status, $invoice_id]);
-
-                // Accounting Integration
-                $stmtInvType = $db->prepare("SELECT type FROM invoices WHERE id = ?");
-                $stmtInvType->execute([$invoice_id]);
-                $invType = $stmtInvType->fetchColumn();
-                if ($invType === 'sale') {
-                    recordPaymentReceivedJournal($payment_id, $amount, $payment_date, $payment_method);
-                } else {
-                    recordPaymentMadeJournal($payment_id, $amount, $payment_date, $payment_method);
-                }
-
-                $db->commit();
-                $message = "Payment of OMR " . number_format($amount, 3) . " recorded successfully! Receipt ID: $payment_id";
-                
-                // For showing receipt after redirect/refresh, we can use a session or just a message.
-                // The user wants to "issue a receipt". I'll add a trigger to show the receipt modal.
-                $_SESSION['show_receipt_id'] = $payment_id;
-                $_SESSION['trigger_receipt_modal'] = true;
-            } catch (Exception $e) {
-                $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['add_sales_return'])) {
-        $invoice_id = (int)$_POST['invoice_id'];
-        $return_date = $_POST['return_date'] ?: date('Y-m-d');
-        $notes = $_POST['notes'] ?? '';
-        $item_ids = $_POST['item_ids'] ?? [];
-        $quantities = $_POST['quantities'] ?? [];
-        $prices = $_POST['prices'] ?? [];
-
-        if ($invoice_id && !empty($item_ids)) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                // Get customer ID from invoice
-                $stmt = $db->prepare("SELECT customer_id FROM invoices WHERE id = ?");
-                $stmt->execute([$invoice_id]);
-                $customer_id = $stmt->fetchColumn();
-
-                $total_return_amount = 0;
-                $items_data = [];
-                foreach ($item_ids as $index => $item_id) {
-                    $qty = (float)$quantities[$index];
-                    $price = (float)$prices[$index];
-                    if ($qty <= 0) continue;
-
-                    $line_total = $qty * $price;
-                    $total_return_amount += $line_total;
-
-                    $items_data[] = [
-                        'id' => $item_id,
-                        'qty' => $qty,
-                        'price' => $price,
-                        'total' => $line_total
-                    ];
-                }
-
-                if (empty($items_data)) throw new Exception("No items to return");
-
-                // Create Sales Return record
-                $stmt = $db->prepare("INSERT INTO sales_returns (invoice_id, customer_id, return_date, total_amount, notes) VALUES (?, ?, ?, ?, ?)");
-                $stmt->execute([$invoice_id, $customer_id, $return_date, $total_return_amount, $notes]);
-                $return_id = $db->lastInsertId();
-
-                foreach ($items_data as $item) {
-                    $stmt = $db->prepare("INSERT INTO sales_return_items (return_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$return_id, $item['id'], $item['qty'], $item['price'], $item['total']]);
-
-                    // Restore stock
-                    $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity + ? WHERE id = ?");
-                    $stmt->execute([$item['qty'], $item['id']]);
-                }
-
-                // Accounting Integration
-                recordSalesReturnJournal($return_id, $total_return_amount, $return_date);
-
-                // If it was a credit sale, we might want to reduce the customer balance.
-                if ($customer_id) {
-                    $stmt = $db->prepare("UPDATE customers SET balance = balance + ? WHERE id = ?");
-                    $stmt->execute([$total_return_amount, $customer_id]);
-                }
-
-                $db->commit();
-                $message = "Sales Return #$return_id processed successfully!";
-            } catch (Exception $e) {
-                if (isset($db)) $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-
-    if (isset($_POST['add_purchase_return'])) {
-        $invoice_id = (int)$_POST['invoice_id'];
-        $return_date = $_POST['return_date'] ?: date('Y-m-d');
-        $notes = $_POST['notes'] ?? '';
-        $item_ids = $_POST['item_ids'] ?? [];
-        $quantities = $_POST['quantities'] ?? [];
-        $prices = $_POST['prices'] ?? [];
-
-        if ($invoice_id && !empty($item_ids)) {
-            $db = db();
-            $db->beginTransaction();
-            try {
-                // Get supplier ID from invoice
-                $stmt = $db->prepare("SELECT customer_id FROM invoices WHERE id = ?");
-                $stmt->execute([$invoice_id]);
-                $supplier_id = $stmt->fetchColumn();
-
-                $total_return_amount = 0;
-                $items_data = [];
-                foreach ($item_ids as $index => $item_id) {
-                    $qty = (float)$quantities[$index];
-                    $price = (float)$prices[$index];
-                    if ($qty <= 0) continue;
-
-                    $line_total = $qty * $price;
-                    $total_return_amount += $line_total;
-
-                    $items_data[] = [
-                        'id' => $item_id,
-                        'qty' => $qty,
-                        'price' => $price,
-                        'total' => $line_total
-                    ];
-                }
-
-                if (empty($items_data)) throw new Exception("No items to return");
-
-                // Create Purchase Return record
-                $stmt = $db->prepare("INSERT INTO purchase_returns (invoice_id, supplier_id, return_date, total_amount, notes) VALUES (?, ?, ?, ?, ?)");
-                $stmt->execute([$invoice_id, $supplier_id, $return_date, $total_return_amount, $notes]);
-                $return_id = $db->lastInsertId();
-
-                foreach ($items_data as $item) {
-                    $stmt = $db->prepare("INSERT INTO purchase_return_items (return_id, item_id, quantity, unit_price, total_price) VALUES (?, ?, ?, ?, ?)");
-                    $stmt->execute([$return_id, $item['id'], $item['qty'], $item['price'], $item['total']]);
-
-                    // Update stock (decrease)
-                    $stmt = $db->prepare("UPDATE stock_items SET stock_quantity = stock_quantity - ? WHERE id = ?");
-                    $stmt->execute([$item['qty'], $item['id']]);
-                }
-
-                // Accounting Integration
-                recordPurchaseReturnJournal($return_id, $total_return_amount, $return_date);
-
-                // Reduce debt to supplier
-                if ($supplier_id) {
-                    $stmt = $db->prepare("UPDATE customers SET balance = balance + ? WHERE id = ?");
-                    $stmt->execute([$total_return_amount, $supplier_id]);
-                }
-
-                $db->commit();
-                $message = "Purchase Return #$return_id processed successfully!";
-            } catch (Exception $e) {
-                if (isset($db)) $db->rollBack();
-                $message = "Error: " . $e->getMessage();
-            }
-        }
-    }
-}
-
 // --- HR Handlers ---
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-    if (isset($_POST['add_hr_department'])) {
+    error_log("POST Request detected. Action: " . (print_r($_POST, true)));
+}
+if (isset($_POST['add_hr_department'])) {
         $name = $_POST['name'] ?? '';
         if ($name) {
             $stmt = db()->prepare("INSERT INTO hr_departments (name) VALUES (?)");
@@ -1781,11 +377,130 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
             $message = "Connection to device '{$d['device_name']}' ({$d['ip_address']}) was successful! (Simulated)";
         }
     }
-}
+
+    // --- User & Role Groups Handlers ---
+    if (isset($_POST['add_role_group'])) {
+        $name = $_POST['name'] ?? '';
+        $permissions = isset($_POST['permissions']) ? json_encode($_POST['permissions']) : '[]';
+        if ($name) {
+            try {
+                $stmt = db()->prepare("INSERT INTO role_groups (name, permissions) VALUES (?, ?)");
+                $stmt->execute([$name, $permissions]);
+                $message = "Role Group added successfully!";
+            } catch (PDOException $e) {
+                $message = "Error adding role group: " . $e->getMessage();
+            }
+        }
+    }
+
+    if (isset($_POST['add_user'])) {
+        $username = $_POST['username'] ?? '';
+        $password = $_POST['password'] ?? '';
+        $email = $_POST['email'] ?? '';
+        $group_id = (int)($_POST['group_id'] ?? 0) ?: null;
+        if ($username && $password) {
+            $hashed_password = password_hash($password, PASSWORD_DEFAULT);
+            $stmt = db()->prepare("INSERT INTO users (username, password, email, group_id) VALUES (?, ?, ?, ?)");
+            try {
+                $stmt->execute([$username, $hashed_password, $email, $group_id]);
+                $message = "User added successfully!";
+            } catch (PDOException $e) {
+                if ($e->getCode() == '23000') {
+                    $message = "Error: Username already exists.";
+                } else {
+                    $message = "Error adding user: " . $e->getMessage();
+                }
+            }
+        }
+    }
+    if (isset($_POST['edit_role_group'])) {
+        $id = (int)$_POST['id'];
+        $name = $_POST['name'] ?? '';
+        $permissions = isset($_POST['permissions']) ? json_encode($_POST['permissions']) : '[]';
+        if ($id && $name) {
+            $stmt = db()->prepare("UPDATE role_groups SET name = ?, permissions = ? WHERE id = ?");
+            $stmt->execute([$name, $permissions, $id]);
+            $message = "Role Group updated successfully!";
+        }
+    }
+    if (isset($_POST['delete_role_group'])) {
+        $id = (int)$_POST['id'];
+        if ($id) {
+            $stmt = db()->prepare("DELETE FROM role_groups WHERE id = ?");
+            $stmt->execute([$id]);
+            $message = "Role Group deleted successfully!";
+        }
+    }
+    if (isset($_POST['edit_user'])) {
+        $id = (int)$_POST['id'];
+        $username = $_POST['username'] ?? '';
+        $email = $_POST['email'] ?? '';
+        $group_id = (int)($_POST['group_id'] ?? 0) ?: null;
+        $status = $_POST['status'] ?? 'active';
+        if ($id && $username) {
+            $stmt = db()->prepare("UPDATE users SET username = ?, email = ?, group_id = ?, status = ? WHERE id = ?");
+            $stmt->execute([$username, $email, $group_id, $status, $id]);
+            
+            if (!empty($_POST['password'])) {
+                $hashed_password = password_hash($_POST['password'], PASSWORD_DEFAULT);
+                $stmt = db()->prepare("UPDATE users SET password = ? WHERE id = ?");
+                $stmt->execute([$hashed_password, $id]);
+            }
+            $message = "User updated successfully!";
+        }
+    }
+    if (isset($_POST['delete_user'])) {
+        $id = (int)$_POST['id'];
+        if ($id) {
+            $stmt = db()->prepare("DELETE FROM users WHERE id = ?");
+            $stmt->execute([$id]);
+            $message = "User deleted successfully!";
+        }
+    }
 
 
 // Routing & Data Fetching
 $page = $_GET['page'] ?? 'dashboard';
+
+// Permission map for pages
+$page_permissions = [
+    'dashboard' => 'dashboard_view',
+    'pos' => 'pos_view',
+    'sales' => 'sales_view',
+    'sales_returns' => 'sales_view',
+    'purchases' => 'purchases_view',
+    'purchase_returns' => 'purchases_view',
+    'quotations' => 'quotations_view',
+    'accounting' => 'accounting_view',
+    'expense_categories' => 'accounting_view',
+    'expenses' => 'accounting_view',
+    'items' => 'items_view',
+    'categories' => 'items_view',
+    'units' => 'items_view',
+    'customers' => 'customers_view',
+    'suppliers' => 'suppliers_view',
+    'customer_statement' => 'customers_view',
+    'supplier_statement' => 'suppliers_view',
+    'cashflow_report' => 'accounting_view',
+    'expiry_report' => 'items_view',
+    'low_stock_report' => 'items_view',
+    'loyalty_history' => 'customers_view',
+    'payment_methods' => 'settings_view',
+    'settings' => 'settings_view',
+    'devices' => 'settings_view',
+    'hr_departments' => 'hr_view',
+    'hr_employees' => 'hr_view',
+    'hr_attendance' => 'hr_view',
+    'hr_payroll' => 'hr_view',
+    'role_groups' => 'users_view',
+    'users' => 'users_view',
+];
+
+if (isset($page_permissions[$page]) && !can($page_permissions[$page])) {
+    $page = 'dashboard'; 
+    $message = "Access Denied: You don't have permission to view that module.";
+}
+
 $data = [];
 
 if ($page === 'export') {
@@ -1949,6 +664,11 @@ switch ($page) {
     case 'settings':
         // Already fetched globally
         break;
+    case 'my_profile':
+        $stmt = db()->prepare("SELECT * FROM users WHERE id = ?");
+        $stmt->execute([$_SESSION['user_id']]);
+        $data['user'] = $stmt->fetch();
+        break;
     case 'sales':
     case 'purchases':
         $type = ($page === 'sales') ? 'sale' : 'purchase';
@@ -2104,7 +824,13 @@ switch ($page) {
                                ORDER BY e.expense_date DESC, e.id DESC");
         $stmt->execute($params);
         $data['expenses'] = $stmt->fetchAll();
-        $data['expense_categories'] = db()->query("SELECT * FROM expense_categories ORDER BY name_en ASC")->fetchAll();
+        break;
+    case 'role_groups':
+        $data['role_groups'] = db()->query("SELECT * FROM role_groups ORDER BY name ASC")->fetchAll();
+        break;
+    case 'users':
+        $data['users'] = db()->query("SELECT u.*, g.name as group_name FROM users u LEFT JOIN role_groups g ON u.group_id = g.id ORDER BY u.username ASC")->fetchAll();
+        $data['role_groups'] = db()->query("SELECT id, name FROM role_groups ORDER BY name ASC")->fetchAll();
         break;
     case 'accounting':
         $data['journal_entries'] = db()->query("SELECT je.*, 
@@ -2316,7 +1042,7 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
 <head>
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title data-en="Accounting Admin" data-ar="لوحة التحكم المحاسبية">Accounting Admin</title>
+    <title data-en="Accounting System" data-ar="نظام المحاسبة">Accounting System</title>
     <meta name="description" content="<?= htmlspecialchars($projectDescription) ?>" />
     <?php if (!empty($data['settings']['favicon'])): ?>
     <link rel="icon" href="<?= htmlspecialchars($data['settings']['favicon']) ?>?v=<?= time() ?>">
@@ -2347,37 +1073,50 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
     <div class="sidebar-header" data-en="Accounting" data-ar="المحاسبة">Accounting</div>
     <nav class="mt-4">
         <!-- General Section -->
+        <?php if (can('dashboard_view')): ?>
         <a href="index.php?page=dashboard" class="nav-link <?= !isset($_GET['page']) || $_GET['page'] === 'dashboard' ? 'active' : '' ?>">
             <i class="bi bi-speedometer2"></i> <span data-en="Dashboard" data-ar="لوحة القيادة">Dashboard</span>
         </a>
+        <?php endif; ?>
 
         <!-- Operations Section -->
+        <?php if (can('pos_view') || can('sales_view') || can('purchases_view') || can('quotations_view')): ?>
         <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['sales', 'purchases']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#ops-collapse">
             <span data-en="Operations" data-ar="العمليات">Operations</span>
             <i class="bi bi-chevron-down"></i>
         </div>
         <div class="collapse <?= in_array($page, ['sales', 'purchases', 'pos', 'quotations']) ? 'show' : '' ?>" id="ops-collapse">
+            <?php if (can('pos_view')): ?>
             <a href="index.php?page=pos" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'pos' ? 'active' : '' ?>">
                 <i class="bi bi-display"></i> <span data-en="Point of Sale" data-ar="نقطة البيع">Point of Sale</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('sales_view')): ?>
             <a href="index.php?page=sales" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'sales' ? 'active' : '' ?>">
                 <i class="bi bi-cart"></i> <span data-en="Sales Tax Invoices" data-ar="فواتير المبيعات الضريبية">Sales Tax Invoices</span>
             </a>
             <a href="index.php?page=sales_returns" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'sales_returns' ? 'active' : '' ?>">
                 <i class="bi bi-arrow-return-left"></i> <span data-en="Sales Returns" data-ar="مرتجع المبيعات">Sales Returns</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('purchases_view')): ?>
             <a href="index.php?page=purchases" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'purchases' ? 'active' : '' ?>">
                 <i class="bi bi-bag"></i> <span data-en="Purchase Tax Invoices" data-ar="فواتير المشتريات الضريبية">Purchase Tax Invoices</span>
             </a>
             <a href="index.php?page=purchase_returns" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'purchase_returns' ? 'active' : '' ?>">
                 <i class="bi bi-arrow-return-right"></i> <span data-en="Purchase Returns" data-ar="مرتجع المشتريات">Purchase Returns</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('quotations_view')): ?>
             <a href="index.php?page=quotations" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'quotations' ? 'active' : '' ?>">
                 <i class="bi bi-file-earmark-text"></i> <span data-en="Quotations" data-ar="العروض">Quotations</span>
             </a>
+            <?php endif; ?>
         </div>
+        <?php endif; ?>
 
         <!-- Accounting Section -->
+        <?php if (can('accounting_view')): ?>
         <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['accounting', 'expense_report']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#accounting-collapse">
             <span data-en="Accounting" data-ar="المحاسبة">Accounting</span>
             <i class="bi bi-chevron-down"></i>
@@ -2399,8 +1138,10 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
                 <i class="bi bi-percent"></i> <span data-en="VAT Report" data-ar="تقرير الضريبة">VAT Report</span>
             </a>
         </div>
+        <?php endif; ?>
 
         <!-- Expenses Section -->
+        <?php if (can('accounting_view')): ?>
         <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['expense_categories', 'expenses']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#expenses-collapse">
             <span data-en="Expenses" data-ar="المصروفات">Expenses</span>
             <i class="bi bi-chevron-down"></i>
@@ -2410,68 +1151,90 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
                 <i class="bi bi-tags"></i> <span data-en="Categories" data-ar="الفئات">Categories</span>
             </a>
             <a href="index.php?page=expenses" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'expenses' ? 'active' : '' ?>">
-                <i class="bi bi-cash-stack"></i> <span data-en="Expenses" data-ar="المصروفات">Expenses</span>
+                <i class="bi bi-receipt"></i> <span data-en="All Expenses" data-ar="كل المصروفات">All Expenses</span>
             </a>
         </div>
+        <?php endif; ?>
 
         <!-- Inventory Section -->
-        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['items', 'categories', 'units']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#inventory-collapse">
+        <?php if (can('items_view')): ?>
+        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['items', 'categories', 'units']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#stock-collapse">
             <span data-en="Inventory" data-ar="المخزون">Inventory</span>
             <i class="bi bi-chevron-down"></i>
         </div>
-        <div class="collapse <?= in_array($page, ['items', 'categories', 'units']) ? 'show' : '' ?>" id="inventory-collapse">
+        <div class="collapse <?= in_array($page, ['items', 'categories', 'units']) ? 'show' : '' ?>" id="stock-collapse">
             <a href="index.php?page=items" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'items' ? 'active' : '' ?>">
-                <i class="bi bi-box-seam"></i> <span data-en="Items" data-ar="الأصناف">Items</span>
+                <i class="bi bi-box"></i> <span data-en="Products" data-ar="المنتجات">Products</span>
             </a>
             <a href="index.php?page=categories" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'categories' ? 'active' : '' ?>">
-                <i class="bi bi-tags"></i> <span data-en="Categories" data-ar="الفئات">Categories</span>
+                <i class="bi bi-grid"></i> <span data-en="Categories" data-ar="الفئات">Categories</span>
             </a>
             <a href="index.php?page=units" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'units' ? 'active' : '' ?>">
-                <i class="bi bi-calculator"></i> <span data-en="Units" data-ar="الوحدات">Units</span>
+                <i class="bi bi-rulers"></i> <span data-en="Units" data-ar="الوحدات">Units</span>
             </a>
         </div>
+        <?php endif; ?>
 
-        <!-- People Section -->
-        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['customers', 'suppliers']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#relationships-collapse">
-            <span data-en="Relationships" data-ar="العلاقات">Relationships</span>
+        <!-- CRM Section -->
+        <?php if (can('customers_view') || can('suppliers_view')): ?>
+        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['customers', 'suppliers']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#crm-collapse">
+            <span data-en="People" data-ar="الأشخاص">People</span>
             <i class="bi bi-chevron-down"></i>
         </div>
-        <div class="collapse <?= in_array($page, ['customers', 'suppliers']) ? 'show' : '' ?>" id="relationships-collapse">
+        <div class="collapse <?= in_array($page, ['customers', 'suppliers']) ? 'show' : '' ?>" id="crm-collapse">
+            <?php if (can('customers_view')): ?>
             <a href="index.php?page=customers" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'customers' ? 'active' : '' ?>">
                 <i class="bi bi-people"></i> <span data-en="Customers" data-ar="العملاء">Customers</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('suppliers_view')): ?>
             <a href="index.php?page=suppliers" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'suppliers' ? 'active' : '' ?>">
-                <i class="bi bi-truck"></i> <span data-en="Suppliers" data-ar="الموردون">Suppliers</span>
+                <i class="bi bi-truck"></i> <span data-en="Suppliers" data-ar="الموردين">Suppliers</span>
             </a>
+            <?php endif; ?>
         </div>
+        <?php endif; ?>
 
         <!-- Reports Section -->
-        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['customer_statement', 'supplier_statement', 'cashflow_report']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#reports-collapse">
+        <?php if (can('sales_view') || can('purchases_view') || can('items_view') || can('customers_view') || can('suppliers_view')): ?>
+        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['customer_statement', 'supplier_statement', 'cashflow_report', 'expiry_report', 'low_stock_report']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#reports-collapse">
             <span data-en="Reports" data-ar="التقارير">Reports</span>
             <i class="bi bi-chevron-down"></i>
         </div>
-        <div class="collapse <?= in_array($page, ['customer_statement', 'supplier_statement', 'cashflow_report']) ? 'show' : '' ?>" id="reports-collapse">
+        <div class="collapse <?= in_array($page, ['customer_statement', 'supplier_statement', 'cashflow_report', 'expiry_report', 'low_stock_report', 'loyalty_history']) ? 'show' : '' ?>" id="reports-collapse">
+            <?php if (can('customers_view')): ?>
             <a href="index.php?page=customer_statement" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'customer_statement' ? 'active' : '' ?>">
-                <i class="bi bi-file-earmark-text"></i> <span data-en="Customer Statement" data-ar="كشف حساب عميل">Customer Statement</span>
+                <i class="bi bi-file-earmark-person"></i> <span data-en="Customer Statement" data-ar="كشف حساب عميل">Customer Statement</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('suppliers_view')): ?>
             <a href="index.php?page=supplier_statement" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'supplier_statement' ? 'active' : '' ?>">
                 <i class="bi bi-file-earmark-medical"></i> <span data-en="Supplier Statement" data-ar="كشف حساب مورد">Supplier Statement</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('accounting_view')): ?>
             <a href="index.php?page=cashflow_report" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'cashflow_report' ? 'active' : '' ?>">
                 <i class="bi bi-cash-stack"></i> <span data-en="Cashflow Statement" data-ar="قائمة التدفقات النقدية">Cashflow Statement</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('items_view')): ?>
             <a href="index.php?page=expiry_report" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'expiry_report' ? 'active' : '' ?>">
                 <i class="bi bi-calendar-x"></i> <span data-en="Expiry Report" data-ar="تقرير الانتهاء">Expiry Report</span>
             </a>
             <a href="index.php?page=low_stock_report" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'low_stock_report' ? 'active' : '' ?>">
                 <i class="bi bi-graph-down-arrow"></i> <span data-en="Low Stock Report" data-ar="تقرير نواقص المخزون">Low Stock Report</span>
             </a>
+            <?php endif; ?>
+            <?php if (can('customers_view')): ?>
             <a href="index.php?page=loyalty_history" class="nav-link <?= isset($_GET['page']) && $_GET['page'] === 'loyalty_history' ? 'active' : '' ?>">
                 <i class="bi bi-star"></i> <span data-en="Loyalty History" data-ar="سجل الولاء">Loyalty History</span>
             </a>
+            <?php endif; ?>
         </div>
+        <?php endif; ?>
 
         <!-- Configuration Section -->
+        <?php if (can('settings_view')): ?>
         <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['payment_methods', 'settings']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#config-collapse">
             <span data-en="Configuration" data-ar="الإعدادات">Configuration</span>
             <i class="bi bi-chevron-down"></i>
@@ -2487,8 +1250,10 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
                 <i class="bi bi-building"></i> <span data-en="Company Profile" data-ar="ملف الشركة">Company Profile</span>
             </a>
         </div>
+        <?php endif; ?>
 
         <!-- HR Section -->
+        <?php if (can('hr_view')): ?>
         <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['hr_employees', 'hr_departments', 'hr_attendance', 'hr_payroll']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#hr-collapse">
             <span data-en="HR" data-ar="الموارد البشرية">HR</span>
             <i class="bi bi-chevron-down"></i>
@@ -2507,15 +1272,37 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
                 <i class="bi bi-cash-coin"></i> <span data-en="Payroll" data-ar="الرواتب">Payroll</span>
             </a>
         </div>
+        <?php endif; ?>
+
+        <!-- Administration Section -->
+        <?php if (can('users_view')): ?>
+        <div class="nav-section-title px-4 mt-3 mb-1 text-uppercase text-muted <?= !in_array($page, ['role_groups', 'users']) ? 'collapsed' : '' ?>" data-bs-toggle="collapse" data-bs-target="#admin-collapse">
+            <span data-en="Administration" data-ar="الإدارة">Administration</span>
+            <i class="bi bi-chevron-down"></i>
+        </div>
+        <div class="collapse <?= in_array($page, ['role_groups', 'users']) ? 'show' : '' ?>" id="admin-collapse">
+            <a href="index.php?page=role_groups" class="nav-link <?= $page === 'role_groups' ? 'active' : '' ?>">
+                <i class="bi bi-shield-lock"></i> <span data-en="Role Groups" data-ar="مجموعات الأدوار">Role Groups</span>
+            </a>
+            <a href="index.php?page=users" class="nav-link <?= $page === 'users' ? 'active' : '' ?>">
+                <i class="bi bi-people"></i> <span data-en="Users" data-ar="المستخدمين">Users</span>
+            </a>
+        </div>
+        <?php endif; ?>
     </nav>
 </div>
 
 <div class="main-content">
     <header class="topbar">
-        <h4 class="m-0">
+        <div class="d-flex align-items-center">
+            <button id="sidebarToggle" class="btn btn-link text-dark p-0 me-3 d-lg-none">
+                <i class="bi bi-list fs-3"></i>
+            </button>
+            <h4 class="m-0">
             <?php 
             $titles = [
                 'dashboard' => ['en' => 'Dashboard', 'ar' => 'لوحة القيادة'],
+                'my_profile' => ['en' => 'My Profile', 'ar' => 'ملفي الشخصي'],
                 'pos' => ['en' => 'Point of Sale', 'ar' => 'نقطة البيع'],
                 'quotations' => ['en' => 'Quotations', 'ar' => 'العروض'],
                 'customers' => ['en' => 'Customers', 'ar' => 'العملاء'],
@@ -2539,23 +1326,54 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
                 'hr_payroll' => ['en' => 'HR Payroll', 'ar' => 'رواتب الموارد البشرية'],
                 'cashflow_report' => ['en' => 'Cashflow Statement', 'ar' => 'قائمة التدفقات النقدية'],
                 'loyalty_history' => ['en' => 'Loyalty History', 'ar' => 'سجل الولاء'],
+                'users' => ['en' => 'User Management', 'ar' => 'إدارة المستخدمين'],
+                'role_groups' => ['en' => 'Role Groups', 'ar' => 'مجموعات الأدوار'],
             ];
             $currTitle = $titles[$page] ?? $titles['dashboard'];
             ?>
             <span data-en="<?= $currTitle['en'] ?>" data-ar="<?= $currTitle['ar'] ?>"><?= $currTitle['en'] ?></span>
         </h4>
+        </div>
         <div class="d-flex align-items-center">
             <button id="langToggle" class="btn btn-outline-secondary btn-sm me-3">
                 <i class="bi bi-translate"></i> <span data-en="العربية" data-ar="English">العربية</span>
             </button>
+            <div class="me-3 d-none d-md-block text-end">
+                <div class="fw-bold small">
+                    <a href="index.php?page=my_profile" class="text-dark text-decoration-none">
+                        <?= htmlspecialchars((string)($_SESSION['username'] ?? 'User')) ?>
+                    </div>
+                    <div class="text-muted" style="font-size: 0.7rem;"><?= htmlspecialchars((string)($_SESSION['user_role_name'] ?? '')) ?></div>
+                </div>
+            </div>
+            <div class="ms-auto d-none d-lg-block">
+                <?php if (!empty($_SESSION['profile_pic'])): ?>
+                    <div class="rounded-circle overflow-hidden border border-2 border-primary border-opacity-10" style="width: 38px; height: 38px;">
+                        <img src="<?= htmlspecialchars((string)$_SESSION['profile_pic']) ?>?v=<?= time() ?>" alt="Profile" style="width: 100%; height: 100%; object-fit: cover;">
+                    </div>
+                <?php if (isset($_SESSION['user_role_name']) && strcasecmp($_SESSION['username'] ?? '', $_SESSION['user_role_name']) !== 0 && $_SESSION['user_role_name'] !== 'Administrator'): ?>
+                    <div class="text-muted" style="font-size: 0.7rem;"><?= htmlspecialchars($_SESSION['user_role_name']) ?></div>
+                <?php endif; ?>
+            </div>
             <div class="dropdown">
-                <button class="btn btn-link dropdown-toggle text-dark text-decoration-none" type="button" data-bs-toggle="dropdown">
-                    <i class="bi bi-person-circle"></i> Admin
+                <a href="index.php?page=my_profile" class="btn btn-light rounded-circle p-0 overflow-hidden shadow-sm d-inline-block position-relative" style="width: 40px; height: 40px;" title="Edit Profile">
+                    <?php if (!empty($_SESSION['profile_pic'])): ?>
+                        <img src="<?= htmlspecialchars($_SESSION['profile_pic']) ?>?v=<?= time() ?>" alt="Profile" style="width: 100%; height: 100%; object-fit: cover;">
+                    <?php else: ?>
+                        <i class="bi bi-person fs-5" style="line-height: 40px;"></i>
+                    <?php endif; ?>
+                    <span class="position-absolute bottom-0 end-0 bg-primary rounded-circle text-white d-flex align-items-center justify-content-center" style="width: 15px; height: 15px; font-size: 0.6rem;">
+                        <i class="bi bi-pencil-fill"></i>
+                    </span>
+                </a>
+                <button class="btn btn-link text-dark p-0 ms-1" type="button" data-bs-toggle="dropdown">
+                    <i class="bi bi-chevron-down small"></i>
                 </button>
-                <ul class="dropdown-menu dropdown-menu-end">
-                    <li><a class="dropdown-item" href="index.php?page=settings" data-en="Company Profile" data-ar="ملف الشركة">Company Profile</a></li>
+                <ul class="dropdown-menu dropdown-menu-end border-0 shadow-sm rounded-3 mt-2">
+                    <li><a class="dropdown-item py-2" href="index.php?page=my_profile"><i class="bi bi-person-badge me-2"></i> My Profile</a></li>
+                    <li><a class="dropdown-item py-2" href="index.php?page=settings"><i class="bi bi-gear me-2"></i> Company Settings</a></li>
                     <li><hr class="dropdown-divider"></li>
-                    <li><a class="dropdown-item" href="#" data-en="Logout" data-ar="تسجيل الخروج">Logout</a></li>
+                    <li><a class="dropdown-item py-2 text-danger" href="index.php?action=logout"><i class="bi bi-box-arrow-right me-2"></i> Logout</a></li>
                 </ul>
             </div>
         </div>
@@ -2800,12 +1618,14 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
         <div class="d-flex justify-content-between align-items-center mb-4">
             <h5 class="m-0" data-en="<?= $currTitle['en'] ?> Management" data-ar="إدارة <?= $currTitle['ar'] ?>"><?= $currTitle['en'] ?> Management</h5>
             <div>
+                <?php if (can('customers_add') || can('suppliers_add')): ?>
                 <button class="btn btn-outline-success me-2" data-bs-toggle="modal" data-bs-target="<?= $page === 'suppliers' ? '#importSuppliersModal' : '#importCustomersModal' ?>">
                     <i class="bi bi-file-earmark-excel"></i> <span data-en="Import Excel" data-ar="استيراد من اكسل">Import Excel</span>
                 </button>
                 <button class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#addCustomerModal">
                     <i class="bi bi-plus-lg"></i> <span data-en="Add <?= $currTitle['en'] ?>" data-ar="إضافة <?= $currTitle['ar'] ?>">Add <?= $currTitle['en'] ?></span>
                 </button>
+                <?php endif; ?>
             </div>
         </div>
 
@@ -2862,11 +1682,15 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
                         <td class="text-end">OMR <?= number_format((float)$c['balance'], 3) ?></td>
                         <td class="text-end">
                             <div class="btn-group btn-group-sm">
+                                <?php if (can('customers_edit') || can('suppliers_edit')): ?>
                                 <button class="btn btn-outline-primary" title="Edit" data-bs-toggle="modal" data-bs-target="#editCustomerModal<?= $c['id'] ?>"><i class="bi bi-pencil"></i></button>
+                                <?php endif; ?>
+                                <?php if (can('customers_delete') || can('suppliers_delete')): ?>
                                 <form method="POST" class="d-inline" onsubmit="return confirm('Are you sure?')">
                                     <input type="hidden" name="id" value="<?= $c['id'] ?>">
                                     <button type="submit" name="delete_customer" class="btn btn-outline-danger" title="Delete"><i class="bi bi-trash"></i></button>
                                 </form>
+                                <?php endif; ?>
                             </div>
 
                             <!-- Edit Customer Modal -->
@@ -4394,9 +3218,11 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
     <div class="card p-4">
         <div class="d-flex justify-content-between align-items-center mb-4">
             <h5 class="m-0" data-en="<?= $currTitle['en'] ?>" data-ar="<?= $currTitle['ar'] ?>"><?= $currTitle['en'] ?></h5>
+            <?php if (can($page . '_add')): ?>
             <button class="btn btn-primary" data-bs-toggle="modal" data-bs-target="#addInvoiceModal">
                 <i class="bi bi-plus-lg"></i> <span data-en="Create New Tax Invoice" data-ar="إنشاء فاتورة ضريبية جديدة">Create New Tax Invoice</span>
             </button>
+            <?php endif; ?>
         </div>
 
         <!-- Filters Section -->
@@ -6162,6 +4988,58 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
         </div>
     </div>
 
+    <?php elseif ($page === 'my_profile'): ?>
+    <div class="row">
+        <div class="col-md-4">
+            <div class="card p-4 text-center border-0 shadow-sm rounded-4">
+                <h5 class="mb-4 fw-bold" data-en="Profile Picture" data-ar="صورة الملف الشخصي">Profile Picture</h5>
+                <div class="mb-3">
+                    <?php if (!empty($data['user']['profile_pic'])): ?>
+                        <img src="<?= htmlspecialchars($data['user']['profile_pic']) ?>?v=<?= time() ?>" alt="Profile" class="rounded-circle shadow-sm" style="width: 150px; height: 150px; object-fit: cover; border: 5px solid #fff;">
+                    <?php else: ?>
+                        <div class="rounded-circle bg-light d-inline-flex align-items-center justify-content-center shadow-sm" style="width: 150px; height: 150px; border: 5px solid #fff;">
+                            <i class="bi bi-person text-muted" style="font-size: 5rem;"></i>
+                        </div>
+                    <?php endif; ?>
+                </div>
+                <div class="mt-3">
+                    <h6 class="fw-bold mb-0"><?= htmlspecialchars($data['user']['username']) ?></h6>
+                    <p class="text-muted small"><?= htmlspecialchars($_SESSION['user_role_name'] ?? 'User') ?></p>
+                </div>
+            </div>
+        </div>
+        <div class="col-md-8">
+            <div class="card p-4 border-0 shadow-sm rounded-4">
+                <h5 class="mb-4 fw-bold" data-en="Edit Profile" data-ar="تعديل الملف الشخصي">Edit Profile</h5>
+                <form method="POST" enctype="multipart/form-data">
+                    <div class="row g-3">
+                        <div class="col-md-6">
+                            <label class="form-label fw-semibold" data-en="Username" data-ar="اسم المستخدم">Username</label>
+                            <input type="text" name="username" class="form-control rounded-3" value="<?= htmlspecialchars($data['user']['username'] ?? '') ?>" required>
+                        </div>
+                        <div class="col-md-6">
+                            <label class="form-label fw-semibold" data-en="Email" data-ar="البريد الإلكتروني">Email</label>
+                            <input type="email" name="email" class="form-control rounded-3" value="<?= htmlspecialchars($data['user']['email'] ?? '') ?>">
+                        </div>
+                        <div class="col-md-6">
+                            <label class="form-label fw-semibold" data-en="New Password" data-ar="كلمة مرور جديدة">New Password</label>
+                            <input type="password" name="password" class="form-control rounded-3" placeholder="Leave blank to keep current">
+                        </div>
+                        <div class="col-md-6">
+                            <label class="form-label fw-semibold" data-en="Change Profile Picture" data-ar="تغيير صورة الملف الشخصي">Change Profile Picture</label>
+                            <input type="file" name="profile_pic" class="form-control rounded-3" accept="image/*">
+                        </div>
+                        <div class="col-md-12 mt-4">
+                            <button type="submit" name="update_profile" class="btn btn-primary rounded-pill px-4">
+                                <i class="bi bi-check-circle me-1"></i> <span data-en="Save Changes" data-ar="حفظ التغييرات">Save Changes</span>
+                            </button>
+                        </div>
+                    </div>
+                </form>
+            </div>
+        </div>
+    </div>
+
     <?php elseif ($page === 'settings'): ?>
     <div class="card p-4">
         <h5 class="mb-4" data-en="Company Profile" data-ar="ملف الشركة">Company Profile</h5>
@@ -6250,6 +5128,248 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
         </form>
     </div>
 
+    <?php elseif ($page === 'role_groups'): ?>
+    <div class="card border-0 shadow-sm rounded-4 overflow-hidden">
+        <div class="card-header bg-white py-3 d-flex justify-content-between align-items-center border-0">
+            <div>
+                <h5 class="m-0 fw-bold text-primary" data-en="Role Groups" data-ar="مجموعات الأدوار">Role Groups</h5>
+                <p class="text-muted small mb-0" data-en="Manage access levels and permissions" data-ar="إدارة مستويات الوصول والصلاحيات">Manage access levels and permissions</p>
+            </div>
+            <button class="btn btn-primary rounded-pill px-4" data-bs-toggle="modal" data-bs-target="#addRoleGroupModal">
+                <i class="bi bi-shield-plus me-1"></i> <span data-en="Create New Group" data-ar="إنشاء مجموعة جديدة">Create New Group</span>
+            </button>
+        </div>
+        <div class="table-responsive">
+            <table class="table table-hover align-middle mb-0">
+                <thead class="bg-light">
+                    <tr>
+                        <th class="ps-4" data-en="Group Name" data-ar="اسم المجموعة">Group Name</th>
+                        <th data-en="Created Date" data-ar="تاريخ الإنشاء">Created Date</th>
+                        <th data-en="Status" data-ar="الحالة">Status</th>
+                        <th data-en="Actions" data-ar="الإجراءات" class="text-end pe-4">Actions</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php foreach ($data['role_groups'] as $group): ?>
+                    <tr>
+                        <td class="ps-4">
+                            <div class="d-flex align-items-center">
+                                <div class="rounded-circle bg-primary bg-opacity-10 p-2 me-3 text-primary">
+                                    <i class="bi bi-shield-check"></i>
+                                </div>
+                                <span class="fw-semibold text-dark"><?= htmlspecialchars((string)$group['name']) ?></span>
+                            </div>
+                        </td>
+                        <td><span class="text-muted small"><?= date('M d, Y', strtotime((string)$group['created_at'])) ?></span></td>
+                        <td><span class="badge rounded-pill bg-success bg-opacity-10 text-success px-3">Active</span></td>
+                        <td class="text-end pe-4">
+                            <div class="dropdown">
+                                <button class="btn btn-light btn-sm rounded-circle" type="button" data-bs-toggle="dropdown">
+                                    <i class="bi bi-three-dots-vertical"></i>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end shadow-sm border-0">
+                                    <?php if (can('users_edit')): ?>
+                                    <li><a class="dropdown-item" href="#" data-bs-toggle="modal" data-bs-target="#editRoleGroupModal<?= $group['id'] ?>"><i class="bi bi-pencil me-2 text-primary"></i> Edit Permissions</a></li>
+                                    <?php endif; ?>
+                                    <?php if (can('users_delete')): ?>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li>
+                                        <form method="POST" onsubmit="return confirm('Delete this role group? This cannot be undone.')">
+                                            <input type="hidden" name="id" value="<?= $group['id'] ?>">
+                                            <button type="submit" name="delete_role_group" class="dropdown-item text-danger"><i class="bi bi-trash me-2"></i> Delete Group</button>
+                                        </form>
+                                    </li>
+                                    <?php endif; ?>
+                                </ul>
+                            </div>
+
+                            <!-- Edit Role Group Modal -->
+                            <div class="modal fade" id="editRoleGroupModal<?= $group['id'] ?>" tabindex="-1">
+                                <div class="modal-dialog">
+                                    <div class="modal-content border-0 shadow text-start">
+                                        <div class="modal-header">
+                                            <h5 class="modal-title fw-bold" data-en="Edit Role Group" data-ar="تعديل مجموعة الأدوار">Edit Role Group</h5>
+                                            <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+                                        </div>
+                                        <form method="POST">
+                                            <input type="hidden" name="id" value="<?= $group['id'] ?>">
+                                            <div class="modal-body">
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="Group Name" data-ar="اسم المجموعة">Group Name</label>
+                                                    <input type="text" name="name" class="form-control" value="<?= htmlspecialchars($group['name']) ?>" required>
+                                                </div>
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="Permissions" data-ar="الصلاحيات">Permissions</label>
+                                                    <div class="row overflow-auto" style="max-height: 300px;">
+                                                        <?php 
+                                                        $perms = json_decode($group['permissions'] ?? '[]', true);
+                                                        $modules = ['dashboard', 'pos', 'quotations', 'customers', 'suppliers', 'items', 'sales', 'purchases', 'accounting', 'hr', 'settings', 'users'];
+                                                        $actions = ['view', 'add', 'edit', 'delete'];
+                                                        foreach ($modules as $m): ?>
+                                                        <div class="col-12 mt-2 border-bottom pb-1 mb-2">
+                                                            <span class="badge bg-secondary text-uppercase"><?= ucfirst($m) ?></span>
+                                                        </div>
+                                                        <?php foreach ($actions as $a): 
+                                                            $p = $m . '_' . $a;
+                                                        ?>
+                                                        <div class="col-3 mb-2">
+                                                            <div class="form-check">
+                                                                 <input class="form-check-input" type="checkbox" name="permissions[]" value="<?= $p ?>" id="perm_<?= $group['id'] ?>_<?= $p ?>" <?= in_array($p, (array)$perms) ? 'checked' : '' ?>>
+                                                                <label class="form-check-label small" for="perm_<?= $group['id'] ?>_<?= $p ?>"><?= ucfirst($a) ?></label>
+                                                            </div>
+                                                        </div>
+                                                        <?php endforeach; ?>
+                                                        <?php endforeach; ?>
+                                                    </div>
+                                                </div>
+                                            </div>
+                                            <div class="modal-footer">
+                                                <button type="button" class="btn btn-light rounded-pill px-3" data-bs-dismiss="modal" data-en="Cancel" data-ar="إلغاء">Cancel</button>
+                                                <button type="submit" name="edit_role_group" class="btn btn-primary rounded-pill px-4" data-en="Update" data-ar="تحديث">Update</button>
+                                            </div>
+                                        </form>
+                                    </div>
+                                </div>
+                            </div>
+                        </td>
+                    </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+        </div>
+    </div>
+
+    <?php elseif ($page === 'users'): ?>
+    <div class="card border-0 shadow-sm rounded-4 overflow-hidden">
+        <div class="card-header bg-white py-3 d-flex justify-content-between align-items-center border-0">
+            <div>
+                <h5 class="m-0 fw-bold text-primary" data-en="User Management" data-ar="إدارة المستخدمين">User Management</h5>
+                <p class="text-muted small mb-0" data-en="Maintain your team accounts and security" data-ar="صيانة حسابات فريقك وأمنها">Maintain your team accounts and security</p>
+            </div>
+            <?php if (can('users_add')): ?>
+            <button class="btn btn-primary rounded-pill px-4" data-bs-toggle="modal" data-bs-target="#addUserModal">
+                <i class="bi bi-person-plus me-1"></i> <span data-en="Invite User" data-ar="دعوة مستخدم">Invite User</span>
+            </button>
+            <?php endif; ?>
+        </div>
+        <div class="table-responsive">
+            <table class="table table-hover align-middle mb-0">
+                <thead class="bg-light">
+                    <tr>
+                        <th class="ps-4" data-en="User Info" data-ar="معلومات المستخدم">User Info</th>
+                        <th data-en="Access Level" data-ar="مستوى الوصول">Access Level</th>
+                        <th data-en="Email" data-ar="البريد">Email</th>
+                        <th data-en="Status" data-ar="الحالة">Status</th>
+                        <th data-en="Actions" data-ar="الإجراءات" class="text-end pe-4">Actions</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    <?php foreach ($data['users'] as $u): ?>
+                    <tr>
+                        <td class="ps-4">
+                            <div class="d-flex align-items-center">
+                                <?php if (!empty($u['profile_pic'])): ?>
+                                    <img src="<?= htmlspecialchars((string)$u['profile_pic']) ?>?v=<?= time() ?>" alt="Avatar" class="rounded-circle me-3 shadow-sm" style="width: 35px; height: 35px; object-fit: cover;">
+                                <?php else: ?>
+                                    <div class="avatar-sm bg-gradient-primary rounded-circle me-3 text-white d-flex align-items-center justify-content-center fw-bold" style="width: 35px; height: 35px; background: linear-gradient(135deg, #6e8efb, #a777e3);">
+                                        <?= strtoupper(substr((string)$u['username'], 0, 1)) ?>
+                                    </div>
+                                <?php endif; ?>
+                                <div>
+                                    <div class="fw-bold text-dark"><?= htmlspecialchars((string)$u['username']) ?></div>
+                                    <div class="text-muted small">ID: #<?= str_pad((string)$u['id'], 4, '0', STR_PAD_LEFT) ?></div>
+                                </div>
+                            </div>
+                        </td>
+                        <td>
+                            <span class="badge rounded-pill bg-info bg-opacity-10 text-info px-3">
+                                <?= htmlspecialchars((string)($u['group_name'] ?? 'No Role Assigned')) ?>
+                            </span>
+                        </td>
+                        <td><span class="text-muted small"><?= htmlspecialchars((string)($u['email'] ?? '')) ?></span></td>
+                        <td>
+                            <?php if ($u['status'] === 'active'): ?>
+                                <span class="badge rounded-pill bg-success bg-opacity-10 text-success px-3">Active</span>
+                            <?php else: ?>
+                                <span class="badge rounded-pill bg-secondary bg-opacity-10 text-secondary px-3">Suspended</span>
+                            <?php endif; ?>
+                        </td>
+                        <td class="text-end pe-4">
+                            <div class="dropdown">
+                                <button class="btn btn-light btn-sm rounded-circle" type="button" data-bs-toggle="dropdown">
+                                    <i class="bi bi-three-dots-vertical"></i>
+                                </button>
+                                <ul class="dropdown-menu dropdown-menu-end shadow-sm border-0">
+                                    <?php if (can('users_edit')): ?>
+                                    <li><a class="dropdown-item" href="#" data-bs-toggle="modal" data-bs-target="#editUserModal<?= $u['id'] ?>"><i class="bi bi-pencil me-2 text-primary"></i> Edit Profile</a></li>
+                                    <?php endif; ?>
+                                    <?php if (can('users_delete')): ?>
+                                    <li><hr class="dropdown-divider"></li>
+                                    <li>
+                                        <form method="POST" onsubmit="return confirm('Deactivate this user account?')">
+                                            <input type="hidden" name="id" value="<?= $u['id'] ?>">
+                                            <button type="submit" name="delete_user" class="dropdown-item text-danger"><i class="bi bi-trash me-2"></i> Remove Access</button>
+                                        </form>
+                                    </li>
+                                    <?php endif; ?>
+                                </ul>
+                            </div>
+
+                            <!-- Edit User Modal -->
+                            <div class="modal fade" id="editUserModal<?= $u['id'] ?>" tabindex="-1">
+                                <div class="modal-dialog">
+                                    <div class="modal-content border-0 shadow text-start">
+                                        <div class="modal-header">
+                                            <h5 class="modal-title fw-bold" data-en="Edit User Account" data-ar="تعديل حساب المستخدم">Edit User Account</h5>
+                                            <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+                                        </div>
+                                        <form method="POST">
+                                            <input type="hidden" name="id" value="<?= $u['id'] ?>">
+                                            <div class="modal-body">
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="Username" data-ar="اسم المستخدم">Username</label>
+                                                    <input type="text" name="username" class="form-control" value="<?= htmlspecialchars((string)$u['username']) ?>" required>
+                                                </div>
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="Email Address" data-ar="البريد الإلكتروني">Email Address</label>
+                                                    <input type="email" name="email" class="form-control" value="<?= htmlspecialchars((string)($u['email'] ?? '')) ?>">
+                                                </div>
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="Assign Role Group" data-ar="تعيين مجموعة الأدوار">Assign Role Group</label>
+                                                    <select name="group_id" class="form-select">
+                                                        <option value="">--- No Group ---</option>
+                                                        <?php foreach (($data['role_groups'] ?? []) as $g): ?>
+                                                        <option value="<?= $g['id'] ?>" <?= ($u['group_id'] ?? null) == $g['id'] ? 'selected' : '' ?>><?= htmlspecialchars((string)$g['name']) ?></option>
+                                                        <?php endforeach; ?>
+                                                    </select>
+                                                </div>
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="Account Status" data-ar="حالة الحساب">Account Status</label>
+                                                    <select name="status" class="form-select">
+                                                        <option value="active" <?= $u['status'] === 'active' ? 'selected' : '' ?>>Active</option>
+                                                        <option value="inactive" <?= $u['status'] === 'inactive' ? 'selected' : '' ?>>Inactive</option>
+                                                    </select>
+                                                </div>
+                                                <div class="mb-3">
+                                                    <label class="form-label fw-semibold" data-en="New Password" data-ar="كلمة مرور جديدة">New Password</label>
+                                                    <input type="password" name="password" class="form-control" placeholder="Leave blank to keep current" autocomplete="new-password">
+                                                </div>
+                                            </div>
+                                            <div class="modal-footer">
+                                                <button type="button" class="btn btn-light rounded-pill px-3" data-bs-dismiss="modal" data-en="Cancel" data-ar="إلغاء">Cancel</button>
+                                                <button type="submit" name="edit_user" class="btn btn-primary rounded-pill px-4" data-en="Save Changes" data-ar="حفظ التغييرات">Save Changes</button>
+                                            </div>
+                                        </form>
+                                    </div>
+                                </div>
+                            </div>
+                        </td>
+                    </tr>
+                    <?php endforeach; ?>
+                </tbody>
+            </table>
+        </div>
+    </div>
     <?php endif; ?>
 </div>
 
@@ -6336,6 +5456,94 @@ $projectDescription = $_SERVER['PROJECT_DESCRIPTION'] ?? 'Accounting System';
     </div>
 </div>
 
+<!-- Add Role Group Modal -->
+<div class="modal fade" id="addRoleGroupModal" tabindex="-1">
+    <div class="modal-dialog">
+        <div class="modal-content border-0 shadow">
+            <div class="modal-header">
+                <h5 class="modal-title" data-en="Add Role Group" data-ar="إضافة مجموعة أدوار">Add Role Group</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+            </div>
+            <form method="POST">
+                <div class="modal-body">
+                    <div class="mb-3">
+                        <label class="form-label" data-en="Group Name" data-ar="اسم المجموعة">Group Name</label>
+                        <input type="text" name="name" class="form-control" required>
+                    </div>
+                    <div class="mb-3">
+                        <label class="form-label" data-en="Permissions" data-ar="الصلاحيات">Permissions</label>
+                        <div class="row overflow-auto" style="max-height: 300px;">
+                            <?php 
+                            $modules = ['dashboard', 'pos', 'quotations', 'customers', 'suppliers', 'items', 'sales', 'purchases', 'accounting', 'hr', 'settings', 'users'];
+                            $actions = ['view', 'add', 'edit', 'delete'];
+                            foreach ($modules as $m): ?>
+                            <div class="col-12 mt-2 border-bottom pb-1 mb-2">
+                                <span class="badge bg-secondary text-uppercase"><?= ucfirst($m) ?></span>
+                            </div>
+                            <?php foreach ($actions as $a): 
+                                $p = $m . '_' . $a;
+                            ?>
+                            <div class="col-3 mb-2">
+                                <div class="form-check">
+                                    <input class="form-check-input" type="checkbox" name="permissions[]" value="<?= $p ?>" id="add_perm_<?= $p ?>">
+                                    <label class="form-check-label small" for="add_perm_<?= $p ?>"><?= ucfirst($a) ?></label>
+                                </div>
+                            </div>
+                            <?php endforeach; ?>
+                            <?php endforeach; ?>
+                        </div>
+                    </div>
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-light" data-bs-dismiss="modal" data-en="Cancel" data-ar="إلغاء">Cancel</button>
+                    <button type="submit" name="add_role_group" class="btn btn-primary" data-en="Save" data-ar="حفظ">Save</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
+<!-- Add User Modal -->
+<div class="modal fade" id="addUserModal" tabindex="-1">
+    <div class="modal-dialog">
+        <div class="modal-content border-0 shadow">
+            <div class="modal-header">
+                <h5 class="modal-title" data-en="Add New User" data-ar="إضافة مستخدم جديد">Add New User</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+            </div>
+            <form method="POST">
+                <div class="modal-body">
+                    <div class="mb-3">
+                        <label class="form-label" data-en="Username" data-ar="اسم المستخدم">Username</label>
+                        <input type="text" name="username" class="form-control" required autocomplete="username">
+                    </div>
+                    <div class="mb-3">
+                        <label class="form-label" data-en="Email" data-ar="البريد الإلكتروني">Email</label>
+                        <input type="email" name="email" class="form-control" autocomplete="email">
+                    </div>
+                    <div class="mb-3">
+                        <label class="form-label" data-en="Password" data-ar="كلمة المرور">Password</label>
+                        <input type="password" name="password" class="form-control" required autocomplete="new-password">
+                    </div>
+                    <div class="mb-3">
+                        <label class="form-label" data-en="Role Group" data-ar="مجموعة الأدوار">Role Group</label>
+                        <select name="group_id" class="form-select">
+                            <option value="">--- Select Group ---</option>
+                            <?php foreach (($data['role_groups'] ?? []) as $g): ?>
+                            <option value="<?= $g['id'] ?>"><?= htmlspecialchars($g['name']) ?></option>
+                            <?php endforeach; ?>
+                        </select>
+                    </div>
+                </div>
+                <div class="modal-footer">
+                    <button type="button" class="btn btn-light" data-bs-dismiss="modal" data-en="Cancel" data-ar="إلغاء">Cancel</button>
+                    <button type="submit" name="add_user" class="btn btn-primary" data-en="Save" data-ar="حفظ">Save</button>
+                </div>
+            </form>
+        </div>
+    </div>
+</div>
+
 <!-- Add Customer Modal -->
 <div class="modal fade" id="addCustomerModal" tabindex="-1">
     <div class="modal-dialog">
diff --git a/login_debug.log b/login_debug.log
new file mode 100644
index 0000000..4eb0033
--- /dev/null
+++ b/login_debug.log
@@ -0,0 +1,5 @@
+2026-02-18 06:51:36 - Failed login for 'admin'. Reason: Password mismatch
+2026-02-18 06:51:52 - Failed login for 'admin'. Reason: Password mismatch
+2026-02-18 07:32:35 - Failed login for 'admin'. Reason: Password mismatch
+2026-02-18 07:59:54 - Failed login for 'admin'. Reason: Password mismatch
+2026-02-18 07:59:58 - Failed login for 'admin'. Reason: Password mismatch
diff --git a/post_debug.log b/post_debug.log
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_2r7cqn03664638ajuuo1g5i1t4 b/sessions/sess_2r7cqn03664638ajuuo1g5i1t4
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_2sk3no9vf98s84qsushbdp683d b/sessions/sess_2sk3no9vf98s84qsushbdp683d
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_3gksq81jerpous0mpvef4nfreu b/sessions/sess_3gksq81jerpous0mpvef4nfreu
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_4hdvtq8pga3fgpg1cp7nl341vh b/sessions/sess_4hdvtq8pga3fgpg1cp7nl341vh
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_4hdvtq8pga3fgpg1cp7nl341vh
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_5ln6g0r5tr6bv6rg8a0a1kfh7m b/sessions/sess_5ln6g0r5tr6bv6rg8a0a1kfh7m
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_5oeo9731ab41036gq00sc0fo53 b/sessions/sess_5oeo9731ab41036gq00sc0fo53
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_5oeo9731ab41036gq00sc0fo53
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_9cgpmgcis3b2tpt38r8482la9l b/sessions/sess_9cgpmgcis3b2tpt38r8482la9l
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_9g2qddiq96hedfik2ob5fdu49e b/sessions/sess_9g2qddiq96hedfik2ob5fdu49e
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_9gau8vtagj710om5qkei6e5h2g b/sessions/sess_9gau8vtagj710om5qkei6e5h2g
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_9mjjgjfd6qaqigd9o7c2o5ondj b/sessions/sess_9mjjgjfd6qaqigd9o7c2o5ondj
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_9ql2aeof3n93bhlbf7lddle9o4 b/sessions/sess_9ql2aeof3n93bhlbf7lddle9o4
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_alr64jfatkbn1mnhbt0e4vu0cb b/sessions/sess_alr64jfatkbn1mnhbt0e4vu0cb
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_ar40q3ed15n7t3fknui8doboaq b/sessions/sess_ar40q3ed15n7t3fknui8doboaq
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_ar40q3ed15n7t3fknui8doboaq
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_bkd2narf71iianiml6drrbmhep b/sessions/sess_bkd2narf71iianiml6drrbmhep
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_bkd2narf71iianiml6drrbmhep
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_boimhas8ok1ceqqnq6958p3c60 b/sessions/sess_boimhas8ok1ceqqnq6958p3c60
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_cp1p5r9vdoapsn2dgr3po5jien b/sessions/sess_cp1p5r9vdoapsn2dgr3po5jien
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_d64jotcj8di6qorof2svdkuaml b/sessions/sess_d64jotcj8di6qorof2svdkuaml
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_e17nfb92o4fhbsqqg16ktrg7vd b/sessions/sess_e17nfb92o4fhbsqqg16ktrg7vd
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_eovb4dasvjkasl6g2vad0m9kul b/sessions/sess_eovb4dasvjkasl6g2vad0m9kul
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_fj924c5m3413s8klk9turvpd98 b/sessions/sess_fj924c5m3413s8klk9turvpd98
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_fj924c5m3413s8klk9turvpd98
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_fs5vqlnuvuapss0e5kllkf6flo b/sessions/sess_fs5vqlnuvuapss0e5kllkf6flo
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_fulkofqovs96hmlioiql0de0vo b/sessions/sess_fulkofqovs96hmlioiql0de0vo
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_fulkofqovs96hmlioiql0de0vo
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_g5a91uor6bo73aasj68vl61ljf b/sessions/sess_g5a91uor6bo73aasj68vl61ljf
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_g5stcs2oe3qgrk50583ofrgai1 b/sessions/sess_g5stcs2oe3qgrk50583ofrgai1
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_h1pf9jo8fpkia1d1ul34i1jagr b/sessions/sess_h1pf9jo8fpkia1d1ul34i1jagr
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_h9ferekp3k9e236nrq47j0d4oc b/sessions/sess_h9ferekp3k9e236nrq47j0d4oc
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_h9ferekp3k9e236nrq47j0d4oc
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_hsscuughl1m8p35j1jisjukv46 b/sessions/sess_hsscuughl1m8p35j1jisjukv46
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_hsscuughl1m8p35j1jisjukv46
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_jftcadudc43e75des2cvksvakn b/sessions/sess_jftcadudc43e75des2cvksvakn
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_jftcadudc43e75des2cvksvakn
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_jg9cr61qkma0j0d4qu0vhqd79s b/sessions/sess_jg9cr61qkma0j0d4qu0vhqd79s
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_juaq2jd8btnjraq103ecr59pp0 b/sessions/sess_juaq2jd8btnjraq103ecr59pp0
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_juaq2jd8btnjraq103ecr59pp0
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_km5843fkj2c7hk7brlp844ug2l b/sessions/sess_km5843fkj2c7hk7brlp844ug2l
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_lh4s3lumt56kb211pk5mdvh66s b/sessions/sess_lh4s3lumt56kb211pk5mdvh66s
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_lh615g4etelsak5v2rj9mcn1eb b/sessions/sess_lh615g4etelsak5v2rj9mcn1eb
new file mode 100644
index 0000000..a7e827f
--- /dev/null
+++ b/sessions/sess_lh615g4etelsak5v2rj9mcn1eb
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";profile_pic|s:32:"uploads/profile_1_1771401598.png";
\ No newline at end of file
diff --git a/sessions/sess_lhtneso80magc54vcdfnps8m4i b/sessions/sess_lhtneso80magc54vcdfnps8m4i
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_lhtneso80magc54vcdfnps8m4i
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_m4rt7eafgsnukcetmabk7etf1m b/sessions/sess_m4rt7eafgsnukcetmabk7etf1m
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_nddl82u7e5hag45tcqclis8a4e b/sessions/sess_nddl82u7e5hag45tcqclis8a4e
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_nddl82u7e5hag45tcqclis8a4e
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_nge96jv0r8eqh37voq2jco6pia b/sessions/sess_nge96jv0r8eqh37voq2jco6pia
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_nge96jv0r8eqh37voq2jco6pia
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_nqei3mm533611incvppl5u2s6e b/sessions/sess_nqei3mm533611incvppl5u2s6e
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_o58brgggnc0s9ildbve378s0q9 b/sessions/sess_o58brgggnc0s9ildbve378s0q9
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_oqj7mfj1271709jjti4okidppk b/sessions/sess_oqj7mfj1271709jjti4okidppk
new file mode 100644
index 0000000..26c1a1e
--- /dev/null
+++ b/sessions/sess_oqj7mfj1271709jjti4okidppk
@@ -0,0 +1 @@
+user_id|i:1;username|s:5:"admin";user_role_name|s:13:"Administrator";user_permissions|s:3:"all";
\ No newline at end of file
diff --git a/sessions/sess_pdf5le1sffbhrgg39jal4gr1n1 b/sessions/sess_pdf5le1sffbhrgg39jal4gr1n1
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_pfle3r0rfv8ejk8pnu2l4c13d1 b/sessions/sess_pfle3r0rfv8ejk8pnu2l4c13d1
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_s6otv2s6gk1h8vct4i4e7d9j1e b/sessions/sess_s6otv2s6gk1h8vct4i4e7d9j1e
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_sja8q1nfr0o5o7pjlsk05n9nv2 b/sessions/sess_sja8q1nfr0o5o7pjlsk05n9nv2
new file mode 100644
index 0000000..e69de29
diff --git a/sessions/sess_uljjktfd4v1rafu9sppaqits8l b/sessions/sess_uljjktfd4v1rafu9sppaqits8l
new file mode 100644
index 0000000..e69de29
diff --git a/test_db.php b/test_db.php
new file mode 100644
index 0000000..9f9242a
--- /dev/null
+++ b/test_db.php
@@ -0,0 +1,22 @@
+<?php
+require_once 'db/config.php';
+try {
+    $db = db();
+    echo "Testing role_groups insert...\n";
+    $stmt = $db->prepare("INSERT INTO role_groups (name, permissions) VALUES (?, ?)");
+    $stmt->execute(['Test Group', json_encode(['dashboard_view'])]);
+    $groupId = $db->lastInsertId();
+    echo "Inserted Group ID: $groupId\n";
+
+    echo "Testing users insert...\n";
+    $stmt = $db->prepare("INSERT INTO users (username, password, email, group_id) VALUES (?, ?, ?, ?)");
+    $stmt->execute(['testuser_' . time(), password_hash('password', PASSWORD_DEFAULT), 'test@example.com', $groupId]);
+    echo "Inserted User ID: " . $db->lastInsertId() . "\n";
+
+    echo "Cleanup...\n";
+    $db->prepare("DELETE FROM users WHERE username LIKE 'testuser_%'")->execute();
+    $db->prepare("DELETE FROM role_groups WHERE name = 'Test Group'")->execute();
+    echo "Done.\n";
+} catch (Exception $e) {
+    echo "Error: " . $e->getMessage() . "\n";
+}
diff --git a/uploads/profile_1_1771401594.png b/uploads/profile_1_1771401594.png
new file mode 100644
index 0000000..2ae8817
Binary files /dev/null and b/uploads/profile_1_1771401594.png differ
diff --git a/uploads/profile_1_1771401598.png b/uploads/profile_1_1771401598.png
new file mode 100644
index 0000000..2ae8817
Binary files /dev/null and b/uploads/profile_1_1771401598.png differ