diff --git a/admin.php b/admin.php index ffea986..d755d50 100644 --- a/admin.php +++ b/admin.php @@ -4,167 +4,274 @@ require_once __DIR__ . '/includes/header.php'; // Stats logic $branch_id = $_SESSION['branch_id']; -$stats = [ - 'today_revenue' => 0, - 'active_orders' => 0, - 'new_customers' => 0, - 'ready_orders' => 0, -]; +$is_super = ($current_role === 'super_admin'); +$is_limited = ($current_role === 'limited_viewer'); -// Today's revenue -$stmt = db()->prepare("SELECT SUM(amount) as total FROM payments WHERE created_at >= CURDATE() AND order_id IN (SELECT id FROM orders WHERE branch_id = ?)"); -$stmt->execute([$branch_id]); -$stats['today_revenue'] = $stmt->fetch()['total'] ?? 0; +if (!$is_limited) { + $stats = [ + 'today_revenue' => 0, + 'active_orders' => 0, + 'new_customers' => 0, + 'ready_orders' => 0, + ]; -// Active orders (received, processing) -$stmt = db()->prepare("SELECT COUNT(*) as count FROM orders WHERE branch_id = ? AND status IN ('received', 'processing')"); -$stmt->execute([$branch_id]); -$stats['active_orders'] = $stmt->fetch()['count'] ?? 0; + // Today's revenue + $rev_where = $is_super ? "" : " AND order_id IN (SELECT id FROM orders WHERE branch_id = ?)"; + $rev_params = $is_super ? [] : [$branch_id]; + $stmt = db()->prepare("SELECT SUM(amount) as total FROM payments WHERE created_at >= CURDATE() $rev_where"); + $stmt->execute($rev_params); + $stats['today_revenue'] = $stmt->fetch()['total'] ?? 0; -// Ready orders -$stmt = db()->prepare("SELECT COUNT(*) as count FROM orders WHERE branch_id = ? AND status = 'ready'"); -$stmt->execute([$branch_id]); -$stats['ready_orders'] = $stmt->fetch()['count'] ?? 0; + // Active orders (received, processing) + $ord_where = $is_super ? "WHERE status IN ('received', 'processing')" : "WHERE branch_id = ? AND status IN ('received', 'processing')"; + $ord_params = $is_super ? [] : [$branch_id]; + $stmt = db()->prepare("SELECT COUNT(*) as count FROM orders $ord_where"); + $stmt->execute($ord_params); + $stats['active_orders'] = $stmt->fetch()['count'] ?? 0; -// New customers today -$stmt = db()->prepare("SELECT COUNT(*) as count FROM customers WHERE branch_id = ? AND created_at >= CURDATE()"); -$stmt->execute([$branch_id]); -$stats['new_customers'] = $stmt->fetch()['count'] ?? 0; + // Ready orders + $ready_where = $is_super ? "WHERE status = 'ready'" : "WHERE branch_id = ? AND status = 'ready'"; + $ready_params = $is_super ? [] : [$branch_id]; + $stmt = db()->prepare("SELECT COUNT(*) as count FROM orders $ready_where"); + $stmt->execute($ready_params); + $stats['ready_orders'] = $stmt->fetch()['count'] ?? 0; -// Recent orders -$stmt = db()->prepare("SELECT o.*, c.name_en as customer_name_en, c.name_ar as customer_name_ar - FROM orders o - LEFT JOIN customers c ON o.customer_id = c.id - WHERE o.branch_id = ? - ORDER BY o.created_at DESC LIMIT 5"); -$stmt->execute([$branch_id]); -$recent_orders = $stmt->fetchAll(); + // New customers today + $cust_where = $is_super ? "WHERE created_at >= CURDATE()" : "WHERE branch_id = ? AND created_at >= CURDATE()"; + $cust_params = $is_super ? [] : [$branch_id]; + $stmt = db()->prepare("SELECT COUNT(*) as count FROM customers $cust_where"); + $stmt->execute($cust_params); + $stats['new_customers'] = $stmt->fetch()['count'] ?? 0; + // Recent orders + $recent_where = $is_super ? "" : "WHERE o.branch_id = ?"; + $recent_params = $is_super ? [] : [$branch_id]; + $stmt = db()->prepare("SELECT o.*, c.name_en as customer_name_en, c.name_ar as customer_name_ar + FROM orders o + LEFT JOIN customers c ON o.customer_id = c.id + $recent_where + ORDER BY o.created_at DESC LIMIT 5"); + $stmt->execute($recent_params); + $recent_orders = $stmt->fetchAll(); + + // Charts data for Dashboard (Last 7 days) + $chart_where = $is_super ? "WHERE created_at >= DATE_SUB(CURDATE(), INTERVAL 7 DAY)" : "WHERE branch_id = ? AND created_at >= DATE_SUB(CURDATE(), INTERVAL 7 DAY)"; + $chart_params = $is_super ? [] : [$branch_id]; + + // Daily Revenue + $stmt = db()->prepare("SELECT DATE(created_at) as date, SUM(total_price) as revenue + FROM orders + $chart_where + GROUP BY DATE(created_at) + ORDER BY DATE(created_at) ASC"); + $stmt->execute($chart_params); + $daily_revenue = $stmt->fetchAll(); + + // Orders by Status (All time or current) + $status_where = $is_super ? "" : "WHERE branch_id = ?"; + $status_params = $is_super ? [] : [$branch_id]; + $stmt = db()->prepare("SELECT status, COUNT(*) as count FROM orders $status_where GROUP BY status"); + $stmt->execute($status_params); + $orders_by_status = $stmt->fetchAll(); +} ?> -
-
-
-
-
- + +
+
+ + Logo + +

+ +

+

+ +

+
+
+ +
+
+
+
+
+ +
+
+
+
+
-
-
-
+
+
+
+
+
+
+ +
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+
+
+
+
+
+
+
+
+
+ +
+
+
+
+
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
- -
-
-
-
-
-
-
-
-
-
-
-
-
-
- - - - - - - - - - - - - - - - - - - - - - - -
#
- - - -
+
+
+
+
+ +
+
+
+
+
+
-
-
-
- - - - - - - - - + +
+
+
+
+
+ + + + + + + + + + + + + + + + + + + + + + + +
#
+ + + +
+
+
+
+
+
+
+ + + + + + + + + +
-
+ + + + 'secondary', - 'processing' => 'primary', - 'ready' => 'success', - 'delivered' => 'dark', - 'cancelled' => 'danger', - ][$status] ?? 'info'; -} -function getPaymentStatusColor($status) { - return [ - 'unpaid' => 'danger', - 'partially_paid' => 'warning', - 'paid' => 'success', - ][$status] ?? 'info'; +if (!$is_limited) { + function getStatusColor($status) { + return [ + 'received' => 'secondary', + 'processing' => 'primary', + 'ready' => 'success', + 'delivered' => 'dark', + 'cancelled' => 'danger', + ][$status] ?? 'info'; + } + function getPaymentStatusColor($status) { + return [ + 'unpaid' => 'danger', + 'partially_paid' => 'warning', + 'paid' => 'success', + ][$status] ?? 'info'; + } } require_once __DIR__ . '/includes/footer.php'; ?> \ No newline at end of file diff --git a/api/add_customer.php b/api/add_customer.php index 2aac4e4..486ea40 100644 --- a/api/add_customer.php +++ b/api/add_customer.php @@ -19,8 +19,8 @@ if (!$phone || !$name_en) { } try { - $stmt = db()->prepare("INSERT INTO customers (branch_id, phone, name_en, name_ar) VALUES (?, ?, ?, ?)"); - $stmt->execute([$branch_id, $phone, $name_en, $name_ar]); + $stmt = db()->prepare("INSERT INTO customers (phone, name_en, name_ar) VALUES (?, ?, ?)"); + $stmt->execute([$phone, $name_en, $name_ar]); $customer_id = db()->lastInsertId(); echo json_encode([ diff --git a/api/add_customer_redirect.php b/api/add_customer_redirect.php index d31a94f..bedf25e 100644 --- a/api/add_customer_redirect.php +++ b/api/add_customer_redirect.php @@ -15,8 +15,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $branch_id = $_SESSION['branch_id']; if ($phone && $name_en) { - $stmt = db()->prepare("INSERT INTO customers (branch_id, phone, name_en, name_ar, email) VALUES (?, ?, ?, ?, ?)"); - $stmt->execute([$branch_id, $phone, $name_en, $name_ar, $email]); + $stmt = db()->prepare("INSERT INTO customers (phone, name_en, name_ar, email) VALUES (?, ?, ?, ?)"); + $stmt->execute([$phone, $name_en, $name_ar, $email]); } } diff --git a/api/get_user_permissions.php b/api/get_user_permissions.php new file mode 100644 index 0000000..95ebde0 --- /dev/null +++ b/api/get_user_permissions.php @@ -0,0 +1,21 @@ + 'Unauthorized']); + exit; +} + +$user_id = $_GET['user_id'] ?? null; +if (!$user_id) { + echo json_encode(['error' => 'User ID required']); + exit; +} + +$stmt = db()->prepare("SELECT page, can_view, can_add, can_edit, can_delete FROM user_permissions WHERE user_id = ?"); +$stmt->execute([$user_id]); +$permissions = $stmt->fetchAll(); + +echo json_encode($permissions); diff --git a/assets/css/custom.css b/assets/css/custom.css index 6fd4d93..1012e45 100644 --- a/assets/css/custom.css +++ b/assets/css/custom.css @@ -107,4 +107,33 @@ body { .item-card:hover { transform: scale(1.02); -} \ No newline at end of file +} + +/* Print Styles */ +@media print { + .sidebar, .navbar, .no-print, .btn, .card form { + display: none !important; + } + body { + background-color: white !important; + margin: 0; + padding: 0; + } + .main-content { + margin-left: 0 !important; + width: 100% !important; + } + .card { + box-shadow: none !important; + border: 1px solid #eee !important; + margin-bottom: 20px !important; + page-break-inside: avoid; + } + .container-fluid { + padding: 0 !important; + } + canvas { + max-width: 100% !important; + height: auto !important; + } +} diff --git a/branches.php b/branches.php index 79048e1..ff50474 100644 --- a/branches.php +++ b/branches.php @@ -8,14 +8,24 @@ if (!isset($_SESSION['user_id'])) { exit; } -$current_role = $_SESSION['role'] ?? 'cashier'; -if ($current_role !== 'super_admin') { +// Initial view check +if (!has_permission('view')) { header('Location: admin.php'); exit; } if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { - if ($_POST['action'] === 'add_branch') { + $action = $_POST['action']; + if ($action === 'add_branch' && !has_permission('add')) { + header('Location: branches.php?error=no_permission'); + exit; + } + if ($action === 'edit_branch' && !has_permission('edit')) { + header('Location: branches.php?error=no_permission'); + exit; + } + + if ($action === 'add_branch') { $name_en = $_POST['name_en']; $name_ar = $_POST['name_ar']; $company_id = $_POST['company_id']; @@ -23,11 +33,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { $prefix = strtoupper(substr($_POST['prefix'] ?? '', 0, 3)); $stmt = db()->prepare("INSERT INTO branches (name_en, name_ar, company_id, phone, prefix) VALUES (?, ?, ?, ?, ?)"); $stmt->execute([$name_en, $name_ar, $company_id, $phone, $prefix]); - header('Location: branches.php'); + header('Location: branches.php?success=branch_added'); exit; } - if ($_POST['action'] === 'edit_branch') { + if ($action === 'edit_branch') { $id = $_POST['id']; $name_en = $_POST['name_en']; $name_ar = $_POST['name_ar']; @@ -36,16 +46,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { $prefix = strtoupper(substr($_POST['prefix'] ?? '', 0, 3)); $stmt = db()->prepare("UPDATE branches SET name_en = ?, name_ar = ?, company_id = ?, phone = ?, prefix = ? WHERE id = ?"); $stmt->execute([$name_en, $name_ar, $company_id, $phone, $prefix, $id]); - header('Location: branches.php'); + header('Location: branches.php?success=branch_updated'); exit; } } if (isset($_GET['delete'])) { + if (!has_permission('delete')) { + header('Location: branches.php?error=no_permission'); + exit; + } $id = $_GET['delete']; $stmt = db()->prepare("DELETE FROM branches WHERE id = ?"); $stmt->execute([$id]); - header('Location: branches.php'); + header('Location: branches.php?success=branch_deleted'); exit; } @@ -57,9 +71,25 @@ $branches = db()->query("SELECT b.*, c.name_en as company_name_en FROM branches $companies = db()->query("SELECT * FROM companies")->fetchAll(); ?> + + + + + + +
-
+
+
@@ -88,8 +118,14 @@ $companies = db()->query("SELECT * FROM companies")->fetchAll();
- + + +
+ +

You don't have permission to add branches.

+
+
@@ -115,6 +151,7 @@ $companies = db()->query("SELECT * FROM companies")->fetchAll(); + + + + + + + + + No branches found. + + +
@@ -141,9 +189,10 @@ $companies = db()->query("SELECT * FROM companies")->fetchAll();
+