diff --git a/admin/ads.php b/admin/ads.php index d85cd67..c4dcbb4 100644 --- a/admin/ads.php +++ b/admin/ads.php @@ -4,6 +4,8 @@ require_permission("ads_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + // Ensure the table exists (idempotent) $pdo->exec("CREATE TABLE IF NOT EXISTS ads_images ( id INT AUTO_INCREMENT PRIMARY KEY, @@ -16,23 +18,27 @@ $pdo->exec("CREATE TABLE IF NOT EXISTS ads_images ( )"); if (isset($_GET['delete'])) { - $id = $_GET['delete']; - - // Get image path to delete file - $stmt = $pdo->prepare("SELECT image_path FROM ads_images WHERE id = ?"); - $stmt->execute([$id]); - $ad = $stmt->fetch(); - - if ($ad) { - $fullPath = __DIR__ . '/../' . $ad['image_path']; - if (file_exists($fullPath) && is_file($fullPath)) { - unlink($fullPath); + if (!has_permission('ads_del')) { + $message = '
Access Denied: You do not have permission to delete advertisements.
'; + } else { + $id = $_GET['delete']; + + // Get image path to delete file + $stmt = $pdo->prepare("SELECT image_path FROM ads_images WHERE id = ?"); + $stmt->execute([$id]); + $ad = $stmt->fetch(); + + if ($ad) { + $fullPath = __DIR__ . '/../' . $ad['image_path']; + if (file_exists($fullPath) && is_file($fullPath)) { + unlink($fullPath); + } + $pdo->prepare("DELETE FROM ads_images WHERE id = ?")->execute([$id]); } - $pdo->prepare("DELETE FROM ads_images WHERE id = ?")->execute([$id]); + + header("Location: ads.php"); + exit; } - - header("Location: ads.php"); - exit; } $query = "SELECT * FROM ads_images ORDER BY sort_order ASC, created_at DESC"; @@ -47,11 +53,15 @@ include 'includes/header.php';

Advertisement Slider

Manage pictures for the public ads display page.

+ Add Image + + +
@@ -113,8 +123,13 @@ include 'includes/header.php'; + + + + + diff --git a/admin/areas.php b/admin/areas.php index 725a687..76cd92c 100644 --- a/admin/areas.php +++ b/admin/areas.php @@ -4,17 +4,27 @@ require_permission("areas_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'add_area') { - $stmt = $pdo->prepare("INSERT INTO areas (outlet_id, name) VALUES (?, ?)"); - $stmt->execute([$_POST['outlet_id'], $_POST['name']]); - header("Location: areas.php"); - exit; + if (!has_permission('areas_add')) { + $message = '
Access Denied: You do not have permission to add areas.
'; + } else { + $stmt = $pdo->prepare("INSERT INTO areas (outlet_id, name) VALUES (?, ?)"); + $stmt->execute([$_POST['outlet_id'], $_POST['name']]); + header("Location: areas.php"); + exit; + } } if (isset($_GET['delete'])) { - $pdo->prepare("DELETE FROM areas WHERE id = ?")->execute([$_GET['delete']]); - header("Location: areas.php"); - exit; + if (!has_permission('areas_del')) { + $message = '
Access Denied: You do not have permission to delete areas.
'; + } else { + $pdo->prepare("DELETE FROM areas WHERE id = ?")->execute([$_GET['delete']]); + header("Location: areas.php"); + exit; + } } // Fetch areas with outlet names @@ -34,11 +44,15 @@ include 'includes/header.php';

Areas

+ +
+ +
@@ -62,8 +76,13 @@ include 'includes/header.php'; + + + + + @@ -83,6 +102,7 @@ include 'includes/header.php';
+ + \ No newline at end of file diff --git a/admin/categories.php b/admin/categories.php index 7d2c7d0..7758e83 100644 --- a/admin/categories.php +++ b/admin/categories.php @@ -4,11 +4,18 @@ require_permission("categories_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + +// Handle Delete if (isset($_GET['delete'])) { - $id = $_GET['delete']; - $pdo->prepare("DELETE FROM categories WHERE id = ?")->execute([$id]); - header("Location: categories.php"); - exit; + if (!has_permission('categories_del')) { + $message = '
Access Denied: You do not have permission to delete categories.
'; + } else { + $id = $_GET['delete']; + $pdo->prepare("DELETE FROM categories WHERE id = ?")->execute([$id]); + header("Location: categories.php"); + exit; + } } $query = "SELECT * FROM categories ORDER BY sort_order ASC, name ASC"; @@ -20,11 +27,15 @@ include 'includes/header.php';

Categories

+ Add Category +
+ +
@@ -61,8 +72,13 @@ include 'includes/header.php'; + + + + + diff --git a/admin/company.php b/admin/company.php index 53f5b4c..e771a51 100644 --- a/admin/company.php +++ b/admin/company.php @@ -9,78 +9,82 @@ $settings = get_company_settings(); // Handle Update if ($_SERVER['REQUEST_METHOD'] === 'POST') { - $company_name = $_POST['company_name'] ?? ''; - $address = $_POST['address'] ?? ''; - $phone = $_POST['phone'] ?? ''; - $email = $_POST['email'] ?? ''; - $vat_rate = $_POST['vat_rate'] ?? 0; - $currency_symbol = $_POST['currency_symbol'] ?? '$'; - $currency_decimals = $_POST['currency_decimals'] ?? 2; - $ctr_number = $_POST['ctr_number'] ?? ''; - $vat_number = $_POST['vat_number'] ?? ''; + if (!has_permission('settings_add')) { + $message = '
Access Denied: You do not have permission to update settings.
'; + } else { + $company_name = $_POST['company_name'] ?? ''; + $address = $_POST['address'] ?? ''; + $phone = $_POST['phone'] ?? ''; + $email = $_POST['email'] ?? ''; + $vat_rate = $_POST['vat_rate'] ?? 0; + $currency_symbol = $_POST['currency_symbol'] ?? '$'; + $currency_decimals = $_POST['currency_decimals'] ?? 2; + $ctr_number = $_POST['ctr_number'] ?? ''; + $vat_number = $_POST['vat_number'] ?? ''; - // Handle File Uploads - $uploadDir = __DIR__ . '/../assets/images/company/'; - if (!is_dir($uploadDir)) { - mkdir($uploadDir, 0755, true); - } + // Handle File Uploads + $uploadDir = __DIR__ . '/../assets/images/company/'; + if (!is_dir($uploadDir)) { + mkdir($uploadDir, 0755, true); + } - $logo_url = $settings['logo_url'] ?? null; - $favicon_url = $settings['favicon_url'] ?? null; + $logo_url = $settings['logo_url'] ?? null; + $favicon_url = $settings['favicon_url'] ?? null; - // Logo Upload - if (isset($_FILES['logo']) && $_FILES['logo']['error'] === UPLOAD_ERR_OK) { - $fileInfo = pathinfo($_FILES['logo']['name']); - $fileExt = strtolower($fileInfo['extension']); - $allowedExts = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg']; + // Logo Upload + if (isset($_FILES['logo']) && $_FILES['logo']['error'] === UPLOAD_ERR_OK) { + $fileInfo = pathinfo($_FILES['logo']['name']); + $fileExt = strtolower($fileInfo['extension']); + $allowedExts = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg']; - if (in_array($fileExt, $allowedExts)) { - $fileName = 'logo_' . uniqid() . '.' . $fileExt; - $targetFile = $uploadDir . $fileName; - if (move_uploaded_file($_FILES['logo']['tmp_name'], $targetFile)) { - $logo_url = 'assets/images/company/' . $fileName; + if (in_array($fileExt, $allowedExts)) { + $fileName = 'logo_' . uniqid() . '.' . $fileExt; + $targetFile = $uploadDir . $fileName; + if (move_uploaded_file($_FILES['logo']['tmp_name'], $targetFile)) { + $logo_url = 'assets/images/company/' . $fileName; + } } } - } - // Favicon Upload - if (isset($_FILES['favicon']) && $_FILES['favicon']['error'] === UPLOAD_ERR_OK) { - $fileInfo = pathinfo($_FILES['favicon']['name']); - $fileExt = strtolower($fileInfo['extension']); - $allowedExts = ['ico', 'png', 'svg']; // Favicons are usually ico/png/svg + // Favicon Upload + if (isset($_FILES['favicon']) && $_FILES['favicon']['error'] === UPLOAD_ERR_OK) { + $fileInfo = pathinfo($_FILES['favicon']['name']); + $fileExt = strtolower($fileInfo['extension']); + $allowedExts = ['ico', 'png', 'svg']; // Favicons are usually ico/png/svg - if (in_array($fileExt, $allowedExts)) { - $fileName = 'favicon_' . uniqid() . '.' . $fileExt; - $targetFile = $uploadDir . $fileName; - if (move_uploaded_file($_FILES['favicon']['tmp_name'], $targetFile)) { - $favicon_url = 'assets/images/company/' . $fileName; + if (in_array($fileExt, $allowedExts)) { + $fileName = 'favicon_' . uniqid() . '.' . $fileExt; + $targetFile = $uploadDir . $fileName; + if (move_uploaded_file($_FILES['favicon']['tmp_name'], $targetFile)) { + $favicon_url = 'assets/images/company/' . $fileName; + } } } - } - try { - // Check if row exists - $exists = $pdo->query("SELECT COUNT(*) FROM company_settings")->fetchColumn(); - - if ($exists) { - $stmt = $pdo->prepare("UPDATE company_settings SET company_name=?, address=?, phone=?, email=?, vat_rate=?, currency_symbol=?, currency_decimals=?, ctr_number=?, vat_number=?, logo_url=?, favicon_url=?, updated_at=NOW()"); - $stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url]); - } else { - $stmt = $pdo->prepare("INSERT INTO company_settings (company_name, address, phone, email, vat_rate, currency_symbol, currency_decimals, ctr_number, vat_number, logo_url, favicon_url) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); - $stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url]); + try { + // Check if row exists + $exists = $pdo->query("SELECT COUNT(*) FROM company_settings")->fetchColumn(); + + if ($exists) { + $stmt = $pdo->prepare("UPDATE company_settings SET company_name=?, address=?, phone=?, email=?, vat_rate=?, currency_symbol=?, currency_decimals=?, ctr_number=?, vat_number=?, logo_url=?, favicon_url=?, updated_at=NOW()"); + $stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url]); + } else { + $stmt = $pdo->prepare("INSERT INTO company_settings (company_name, address, phone, email, vat_rate, currency_symbol, currency_decimals, ctr_number, vat_number, logo_url, favicon_url) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); + $stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url]); + } + + $message = '
Company settings updated successfully!
'; + // Refresh settings + $settings = get_company_settings(); // Re-fetch to get updated values + // Manually update immediate values for display if fetch is cached/laggy (though re-fetch is better) + $settings['ctr_number'] = $ctr_number; + $settings['vat_number'] = $vat_number; + $settings['logo_url'] = $logo_url; + $settings['favicon_url'] = $favicon_url; + + } catch (Exception $e) { + $message = '
Error updating settings: ' . htmlspecialchars($e->getMessage()) . '
'; } - - $message = '
Company settings updated successfully!
'; - // Refresh settings - $settings = get_company_settings(); // Re-fetch to get updated values - // Manually update immediate values for display if fetch is cached/laggy (though re-fetch is better) - $settings['ctr_number'] = $ctr_number; - $settings['vat_number'] = $vat_number; - $settings['logo_url'] = $logo_url; - $settings['favicon_url'] = $favicon_url; - - } catch (Exception $e) { - $message = '
Error updating settings: ' . htmlspecialchars($e->getMessage()) . '
'; } } @@ -99,19 +103,19 @@ include 'includes/header.php';
- + >
- + >
- + >
- +
@@ -120,11 +124,11 @@ include 'includes/header.php';
- + >
- + >
@@ -135,17 +139,17 @@ include 'includes/header.php';
- + > %
- + >
- + >
@@ -160,9 +164,13 @@ include 'includes/header.php'; Logo
+ +
+
Recommended: PNG or SVG with transparent background.
+
@@ -173,17 +181,23 @@ include 'includes/header.php'; Favicon
+ +
+
Recommended: 32x32 ICO or PNG.
+ +
+ diff --git a/admin/customers.php b/admin/customers.php index eb81f2d..8587496 100644 --- a/admin/customers.php +++ b/admin/customers.php @@ -8,25 +8,33 @@ $message = ''; // Handle Add Customer if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'add_customer') { - $name = $_POST['name']; - $email = $_POST['email']; - $phone = $_POST['phone']; - $address = $_POST['address']; - - $stmt = $pdo->prepare("INSERT INTO customers (name, email, phone, address) VALUES (?, ?, ?, ?)"); - if ($stmt->execute([$name, $email, $phone, $address])) { - $message = '
Customer added successfully!
'; + if (!has_permission('customers_add')) { + $message = '
Access Denied: You do not have permission to add customers.
'; } else { - $message = '
Error adding customer.
'; + $name = $_POST['name']; + $email = $_POST['email']; + $phone = $_POST['phone']; + $address = $_POST['address']; + + $stmt = $pdo->prepare("INSERT INTO customers (name, email, phone, address) VALUES (?, ?, ?, ?)"); + if ($stmt->execute([$name, $email, $phone, $address])) { + $message = '
Customer added successfully!
'; + } else { + $message = '
Error adding customer.
'; + } } } // Handle Delete if (isset($_GET['delete'])) { - $id = $_GET['delete']; - $pdo->prepare("DELETE FROM customers WHERE id = ?")->execute([$id]); - header("Location: customers.php"); - exit; + if (!has_permission('customers_del')) { + $message = '
Access Denied: You do not have permission to delete customers.
'; + } else { + $id = $_GET['delete']; + $pdo->prepare("DELETE FROM customers WHERE id = ?")->execute([$id]); + header("Location: customers.php"); + exit; + } } // Fetch Customers @@ -39,9 +47,11 @@ include 'includes/header.php';

Customers

+ +
@@ -76,8 +86,13 @@ include 'includes/header.php';
+ + + + +
@@ -98,6 +113,7 @@ include 'includes/header.php'; + + - + \ No newline at end of file diff --git a/admin/expense_categories.php b/admin/expense_categories.php index 529f55c..71e1968 100644 --- a/admin/expense_categories.php +++ b/admin/expense_categories.php @@ -4,19 +4,23 @@ require_permission("expense_categories_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + if (isset($_GET['delete'])) { - $id = $_GET['delete']; - // Check if there are expenses linked to this category - $stmt = $pdo->prepare("SELECT COUNT(*) FROM expenses WHERE category_id = ?"); - $stmt->execute([$id]); - if ($stmt->fetchColumn() > 0) { - $_SESSION['error'] = "Cannot delete category as it has linked expenses."; + if (!has_permission('expense_categories_del')) { + $message = '
Access Denied: You do not have permission to delete expense categories.
'; } else { - $pdo->prepare("DELETE FROM expense_categories WHERE id = ?")->execute([$id]); - $_SESSION['success'] = "Category deleted successfully."; + $id = $_GET['delete']; + // Check if there are expenses linked to this category + $stmt = $pdo->prepare("SELECT COUNT(*) FROM expenses WHERE category_id = ?"); + $stmt->execute([$id]); + if ($stmt->fetchColumn() > 0) { + $message = '
Cannot delete category as it has linked expenses.
'; + } else { + $pdo->prepare("DELETE FROM expense_categories WHERE id = ?")->execute([$id]); + $message = '
Category deleted successfully.
'; + } } - header("Location: expense_categories.php"); - exit; } $query = "SELECT * FROM expense_categories ORDER BY name ASC"; @@ -28,17 +32,14 @@ include 'includes/header.php';

Expense Categories

+ Add Category +
- -
- - -
- +
@@ -62,8 +63,13 @@ include 'includes/header.php'; + + + + + @@ -81,4 +87,4 @@ include 'includes/header.php';
- + \ No newline at end of file diff --git a/admin/expenses.php b/admin/expenses.php index f376a5e..0ce09b6 100644 --- a/admin/expenses.php +++ b/admin/expenses.php @@ -7,7 +7,7 @@ $pdo = db(); $message = ''; if (isset($_GET['delete'])) { - if (!has_permission('expenses_delete')) { + if (!has_permission('expenses_del')) { $message = '
Access Denied: You do not have permission to delete expenses.
'; } else { $id = $_GET['delete']; @@ -131,10 +131,10 @@ include 'includes/header.php'; - + - + @@ -154,4 +154,4 @@ include 'includes/header.php'; - + \ No newline at end of file diff --git a/admin/index.php b/admin/index.php index 1209cf7..bc7d0a4 100644 --- a/admin/index.php +++ b/admin/index.php @@ -5,169 +5,205 @@ require_once __DIR__ . '/../includes/functions.php'; $pdo = db(); require_permission('dashboard_view'); -// Fetch Dashboard Stats -$today = date('Y-m-d'); +// Check if user should see the detailed dashboard or the simplified one +// We'll use 'dashboard_add' as a proxy for 'detailed' access, or Super Admin (all) +$isDetailed = has_permission('dashboard_add') || has_permission('all'); -// Total Revenue Today -$stmt = $pdo->prepare("SELECT SUM(total_amount) FROM orders WHERE DATE(created_at) = ? AND status != 'cancelled'"); -$stmt->execute([$today]); -$revenueToday = $stmt->fetchColumn() ?: 0; +if ($isDetailed) { + // Fetch Dashboard Stats + $today = date('Y-m-d'); -// Total Orders Today -$stmt = $pdo->prepare("SELECT COUNT(*) FROM orders WHERE DATE(created_at) = ?"); -$stmt->execute([$today]); -$ordersToday = $stmt->fetchColumn(); + // Total Revenue Today + $stmt = $pdo->prepare("SELECT SUM(total_amount) FROM orders WHERE DATE(created_at) = ? AND status != 'cancelled'"); + $stmt->execute([$today]); + $revenueToday = $stmt->fetchColumn() ?: 0; -// Active Outlets -$outletsCount = $pdo->query("SELECT COUNT(*) FROM outlets")->fetchColumn(); + // Total Orders Today + $stmt = $pdo->prepare("SELECT COUNT(*) FROM orders WHERE DATE(created_at) = ?"); + $stmt->execute([$today]); + $ordersToday = $stmt->fetchColumn(); -// Total Products -$productsCount = $pdo->query("SELECT COUNT(*) FROM products")->fetchColumn(); + // Active Outlets + $outletsCount = $pdo->query("SELECT COUNT(*) FROM outlets")->fetchColumn(); -// Recent Orders -$recentOrders = $pdo->query("SELECT o.*, - (SELECT GROUP_CONCAT(p.name SEPARATOR ', ') FROM order_items oi JOIN products p ON oi.product_id = p.id WHERE oi.order_id = o.id) as items - FROM orders o ORDER BY created_at DESC LIMIT 5")->fetchAll(); + // Total Products + $productsCount = $pdo->query("SELECT COUNT(*) FROM products")->fetchColumn(); + + // Recent Orders + $recentOrders = $pdo->query("SELECT o.*, + (SELECT GROUP_CONCAT(p.name SEPARATOR ', ') FROM order_items oi JOIN products p ON oi.product_id = p.id WHERE oi.order_id = o.id) as items + FROM orders o ORDER BY created_at DESC LIMIT 5")->fetchAll(); +} include 'includes/header.php'; ?> -
-
-

Dashboard

-

Welcome back, !

+ +
+
+

Dashboard

+

Welcome back, !

+
+ +
+ New Order +
+
- -
- New Order -
- -
-
- -
-
-
-
- -
-
-
Today's Revenue
-

+
+ +
+
+
+
+ +
+
+
Today's Revenue
+

+
-
- - -
-
-
-
- + + +
+
+
+
+ +
+
+
Orders Today
+

+
-
-
Orders Today
-

+
+
+ + +
+
+
+
+ +
+
+
Active Outlets
+

+
+
+
+
+ + +
+
+
+
+ +
+
+
Total Products
+

+
- -
-
-
-
- -
-
-
Active Outlets
-

-
+ +
+
+
Recent Orders
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + +
IDTypeTable/CustomerTotalStatusDate
# + 'bg-info', + 'takeaway' => 'bg-success', + 'delivery' => 'bg-warning', + 'drive-thru' => 'bg-purple', + default => 'bg-secondary' + }; + ?> + + + + Table + + + + + + + +
No recent orders found.
+ +
+ View All Orders +
+
- - -
-
-
-
- + + +
+
+ + <?= htmlspecialchars($companyName) ?> + +
+
-
-
Total Products
-

-
-
+ +
+

+

Welcome to the Admin Panel, !

+ +
+ + + POS Terminal + + + + + Kitchen View + +
-
+ - -
-
-
Recent Orders
-
-
-
- - - - - - - - - - - - - - - - - - - - - - - - - - -
IDTypeTable/CustomerTotalStatusDate
# - 'bg-info', - 'takeaway' => 'bg-success', - 'delivery' => 'bg-warning', - 'drive-thru' => 'bg-purple', - default => 'bg-secondary' - }; - ?> - - - - Table - - - - - - - -
No recent orders found.
-
-
- -
- View All Orders -
- -
- - + \ No newline at end of file diff --git a/admin/integrations.php b/admin/integrations.php index 759cac9..d619343 100644 --- a/admin/integrations.php +++ b/admin/integrations.php @@ -9,6 +9,11 @@ $wablasTestResult = null; $message = ''; if ($_SERVER['REQUEST_METHOD'] === 'POST') { + if (!has_permission('settings_add')) { + header("Location: integrations.php?error=permission_denied"); + exit; + } + $provider = $_POST['provider'] ?? ''; $action = $_POST['action'] ?? 'save'; @@ -103,6 +108,10 @@ require_once __DIR__ . '/includes/header.php';

Integrations

+ +
Access Denied: You do not have permission to perform this action.
+ +
@@ -154,7 +165,7 @@ require_once __DIR__ . '/includes/header.php';
Wablas WhatsApp
- > + >
@@ -165,20 +176,20 @@ require_once __DIR__ . '/includes/header.php';
- + >
- + >
- + >
- +
Available Variables:
{customer_name}, {company_name}, {order_id}, @@ -187,6 +198,7 @@ require_once __DIR__ . '/includes/header.php';
+
@@ -199,6 +211,7 @@ require_once __DIR__ . '/includes/header.php';
+
@@ -206,4 +219,4 @@ require_once __DIR__ . '/includes/header.php';
- \ No newline at end of file + \ No newline at end of file diff --git a/admin/loyalty.php b/admin/loyalty.php index a3aa3fa..c76c313 100644 --- a/admin/loyalty.php +++ b/admin/loyalty.php @@ -4,16 +4,22 @@ require_permission("loyalty_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + // Handle Settings Update if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['update_settings'])) { - $points_per_order = intval($_POST['points_per_order']); - $points_for_free_meal = intval($_POST['points_for_free_meal']); - $is_enabled = isset($_POST['is_enabled']) ? 1 : 0; - - $stmt = $pdo->prepare("UPDATE loyalty_settings SET points_per_order = ?, points_for_free_meal = ?, is_enabled = ? WHERE id = 1"); - $stmt->execute([$points_per_order, $points_for_free_meal, $is_enabled]); - - $success_msg = "Loyalty settings updated successfully!"; + if (!has_permission('loyalty_add')) { + $message = '
Access Denied: You do not have permission to update loyalty settings.
'; + } else { + $points_per_order = intval($_POST['points_per_order']); + $points_for_free_meal = intval($_POST['points_for_free_meal']); + $is_enabled = isset($_POST['is_enabled']) ? 1 : 0; + + $stmt = $pdo->prepare("UPDATE loyalty_settings SET points_per_order = ?, points_for_free_meal = ?, is_enabled = ? WHERE id = 1"); + $stmt->execute([$points_per_order, $points_for_free_meal, $is_enabled]); + + $message = '
Loyalty settings updated successfully!
'; + } } // Fetch Settings @@ -50,17 +56,14 @@ include 'includes/header.php'; Disabled
+ +
- - - +
@@ -167,6 +170,7 @@ include 'includes/header.php';
+ + \ No newline at end of file diff --git a/admin/order_edit.php b/admin/order_edit.php new file mode 100644 index 0000000..0c32d63 --- /dev/null +++ b/admin/order_edit.php @@ -0,0 +1,166 @@ +prepare("UPDATE orders SET + status = ?, + outlet_id = ?, + customer_id = ?, + order_type = ?, + table_number = ?, + notes = ?, + updated_at = CURRENT_TIMESTAMP + WHERE id = ?"); + + if ($stmt->execute([$status, $outlet_id, $customer_id, $order_type, $table_number, $notes, $id])) { + $message = '
Order updated successfully!
'; + // Redirect back after short delay or via header + header("Refresh: 2; url=order_view.php?id=$id"); + } else { + $message = '
Error updating order.
'; + } +} + +// Fetch Order Details +$stmt = $pdo->prepare("SELECT * FROM orders WHERE id = ?"); +$stmt->execute([$id]); +$order = $stmt->fetch(PDO::FETCH_ASSOC); + +if (!$order) { + die("Order not found."); +} + +// Fetch Outlets +$outlets = $pdo->query("SELECT id, name FROM outlets ORDER BY name")->fetchAll(PDO::FETCH_ASSOC); + +// Fetch Customers +$customers = $pdo->query("SELECT id, name FROM customers ORDER BY name")->fetchAll(PDO::FETCH_ASSOC); + +include 'includes/header.php'; +?> + +
+

Edit Order #

+
+ + Cancel + + + Back to List + +
+
+ + + +
+
+
+
+
+
+
+ + +
+
+ + +
+
+ +
+
+ + +
+
+ + +
+
+ +
+ + +
+ +
+ + +
+ +
+ Discard Changes + +
+
+
+
+
+
+
+
+
Editing Order Information
+

Updating the status here will immediately reflect across all systems (Kitchen, POS, Admin).

+
+ Changes to items should be handled via the POS system or directly in the database. +
+
+

Order Created

+

+ +

Last Updated

+

+
+
+
+
+
+ + \ No newline at end of file diff --git a/admin/order_view.php b/admin/order_view.php new file mode 100644 index 0000000..d53a8a0 --- /dev/null +++ b/admin/order_view.php @@ -0,0 +1,225 @@ +prepare("SELECT o.*, ot.name as outlet_name, pt.name as payment_type_name, + c.name as customer_name, c.phone as customer_phone, c.email as customer_email, + u.username as created_by_username + FROM orders o + LEFT JOIN outlets ot ON o.outlet_id = ot.id + LEFT JOIN payment_types pt ON o.payment_type_id = pt.id + LEFT JOIN customers c ON o.customer_id = c.id + LEFT JOIN users u ON o.user_id = u.id + WHERE o.id = ?"); +$stmt->execute([$id]); +$order = $stmt->fetch(PDO::FETCH_ASSOC); + +if (!$order) { + die("Order not found."); +} + +// Fetch Order Items +$stmt = $pdo->prepare("SELECT oi.*, p.name as product_name, pv.name as variant_name + FROM order_items oi + JOIN products p ON oi.product_id = p.id + LEFT JOIN product_variants pv ON oi.variant_id = pv.id + WHERE oi.order_id = ?"); +$stmt->execute([$id]); +$items = $stmt->fetchAll(PDO::FETCH_ASSOC); + +include 'includes/header.php'; + +// Calculate subtotal from items to be sure +$subtotal = 0; +foreach ($items as $item) { + $subtotal += $item['unit_price'] * $item['quantity']; +} +?> + +
+
+

Order #

+

Placed on

+
+
+ + Back to List + + + + + Edit Order + + +
+
+ +
+
+ +
+
+
Order Items
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + +
ProductPriceQtyTotal
+
+ + Variant: + +
+
Subtotal
+ 0): ?> +
Discount
+ +
VAT / Tax
+
Total Amount
+ 		+
+ 0): ?> +
-
+ +
+
+
+
+
+
+ + +
+
+
Internal Notes
+

+
+
+
+ +
+ +
+
+
Order Status
+
+ + + + Last updated: +
+ +
+ +
Payment Information
+
+ Method: + +
+
+ Status: + Paid +
+
+
+ + +
+
+
Order Details
+
+ +
+
+
+ +
+
+ +
+ +
Table
+
+ +
+ +
+
+
+
+ + +
+
+
Customer Information
+ +
+
+ +
+
+
+ Customer ID: # +
+
+ +
+ + +
+ + +
+ + +
+ + +
+ +

No customer attached to this order (Guest)

+
+ +
+
+
+
+ + \ No newline at end of file diff --git a/admin/orders.php b/admin/orders.php index e96422f..5a42bd9 100644 --- a/admin/orders.php +++ b/admin/orders.php @@ -33,6 +33,26 @@ if (isset($_POST['action']) && $_POST['action'] === 'stop_promotions') { exit; } +// Handle Delete Order +if (isset($_GET['delete'])) { + if (!has_permission('manage_orders')) { + header("Location: orders.php?error=permission_denied"); + exit; + } + $id = (int)$_GET['delete']; + $pdo->beginTransaction(); + try { + $pdo->prepare("DELETE FROM order_items WHERE order_id = ?")->execute([$id]); + $pdo->prepare("DELETE FROM orders WHERE id = ?")->execute([$id]); + $pdo->commit(); + header("Location: orders.php?success=order_deleted"); + } catch (Exception $e) { + $pdo->rollBack(); + header("Location: orders.php?error=delete_failed"); + } + exit; +} + // Fetch Outlets for Filter $outlets = $pdo->query("SELECT id, name FROM outlets ORDER BY name")->fetchAll(PDO::FETCH_ASSOC); @@ -107,14 +127,24 @@ include 'includes/header.php';
- -
Access Denied: You do not have permission to perform this action.
+ + +
Access Denied: You do not have permission to perform this action.
+ +
Error: Failed to delete order.
+ - -
- All running promotions have been stopped successfully. -
+ + +
+ All running promotions have been stopped successfully. +
+ +
+ Order has been deleted successfully. +
+ @@ -231,7 +261,7 @@ include 'includes/header.php'; Payment Status Time - Action + Actions @@ -299,34 +329,50 @@ include 'includes/header.php';
- - -
- - - - - - - - - - - - - + +
+ + + + + + + + + + + + + + + - - - View Only - + + + + + + + + + + + + + + + + + +
diff --git a/admin/outlets.php b/admin/outlets.php index f6cec63..65f2f24 100644 --- a/admin/outlets.php +++ b/admin/outlets.php @@ -4,17 +4,27 @@ require_permission("outlets_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); -if (isset($_POST['action']) && $_POST['action'] === 'add_outlet') { - $stmt = $pdo->prepare("INSERT INTO outlets (name, address) VALUES (?, ?)"); - $stmt->execute([$_POST['name'], $_POST['address']]); - header("Location: outlets.php"); - exit; +$message = ''; + +if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'add_outlet') { + if (!has_permission('outlets_add')) { + $message = '
Access Denied: You do not have permission to add outlets.
'; + } else { + $stmt = $pdo->prepare("INSERT INTO outlets (name, address) VALUES (?, ?)"); + $stmt->execute([$_POST['name'], $_POST['address']]); + header("Location: outlets.php"); + exit; + } } if (isset($_GET['delete'])) { - $pdo->prepare("DELETE FROM outlets WHERE id = ?")->execute([$_GET['delete']]); - header("Location: outlets.php"); - exit; + if (!has_permission('outlets_del')) { + $message = '
Access Denied: You do not have permission to delete outlets.
'; + } else { + $pdo->prepare("DELETE FROM outlets WHERE id = ?")->execute([$_GET['delete']]); + header("Location: outlets.php"); + exit; + } } $query = "SELECT * FROM outlets ORDER BY id DESC"; @@ -26,11 +36,15 @@ include 'includes/header.php';

Outlets

+ +
+ +
@@ -54,8 +68,13 @@ include 'includes/header.php'; + + + + + @@ -70,6 +89,7 @@ include 'includes/header.php';
+ + \ No newline at end of file diff --git a/admin/payment_types.php b/admin/payment_types.php index 8cb83e5..8ac79ab 100644 --- a/admin/payment_types.php +++ b/admin/payment_types.php @@ -4,12 +4,18 @@ require_permission("payment_types_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + // Handle Delete if (isset($_GET['delete_id'])) { - $stmt = $pdo->prepare("DELETE FROM payment_types WHERE id = ?"); - $stmt->execute([$_GET['delete_id']]); - header("Location: payment_types.php?msg=deleted"); - exit; + if (!has_permission('payment_types_del')) { + $message = '
Access Denied: You do not have permission to delete payment types.
'; + } else { + $stmt = $pdo->prepare("DELETE FROM payment_types WHERE id = ?"); + $stmt->execute([$_GET['delete_id']]); + header("Location: payment_types.php?msg=deleted"); + exit; + } } // Fetch Payment Types @@ -22,11 +28,15 @@ require_once __DIR__ . '/includes/header.php';

Payment Types

+ Add Payment Type +
+ + + + \ No newline at end of file diff --git a/admin/tables.php b/admin/tables.php index 0d59f15..0200a9a 100644 --- a/admin/tables.php +++ b/admin/tables.php @@ -4,17 +4,27 @@ require_permission("tables_view"); require_once __DIR__ . '/../db/config.php'; $pdo = db(); +$message = ''; + if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'add_table') { - $stmt = $pdo->prepare("INSERT INTO tables (area_id, name, capacity) VALUES (?, ?, ?)"); - $stmt->execute([$_POST['area_id'], $_POST['name'], $_POST['capacity']]); - header("Location: tables.php"); - exit; + if (!has_permission('tables_add')) { + $message = '
Access Denied: You do not have permission to add tables.
'; + } else { + $stmt = $pdo->prepare("INSERT INTO tables (area_id, name, capacity) VALUES (?, ?, ?)"); + $stmt->execute([$_POST['area_id'], $_POST['name'], $_POST['capacity']]); + header("Location: tables.php"); + exit; + } } if (isset($_GET['delete'])) { - $pdo->prepare("DELETE FROM tables WHERE id = ?")->execute([$_GET['delete']]); - header("Location: tables.php"); - exit; + if (!has_permission('tables_del')) { + $message = '
Access Denied: You do not have permission to delete tables.
'; + } else { + $pdo->prepare("DELETE FROM tables WHERE id = ?")->execute([$_GET['delete']]); + header("Location: tables.php"); + exit; + } } // Fetch tables with area and outlet names @@ -47,11 +57,15 @@ $baseUrl = $protocol . $host . ($dir === '/' ? '' : $dir) . '/qorder.php';

Tables

+ +
+ +
@@ -87,8 +101,13 @@ $baseUrl = $protocol . $host . ($dir === '/' ? '' : $dir) . '/qorder.php'; title="View QR Code"> QR + + + + + @@ -108,6 +127,7 @@ $baseUrl = $protocol . $host . ($dir === '/' ? '' : $dir) . '/qorder.php';
+ +