user.php

<?php
include('databaseConnection.php');

// Handle incoming request
$request_method = $_SERVER["REQUEST_METHOD"];
$endpoint = $_GET["endpoint"] ?? "";
$id = $_GET["id"] ?? "";
$payLoad = $_GET["payload"] ?? "";

// CORS HANDLING
header("Access-Control-Allow-Origin: *"); // Allow all origins (you can replace '*' with a specific domain if needed)
header("Access-Control-Allow-Methods: GET, POST, PATCH, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization");

// Ensure endpoint is provided
if (!$endpoint) {
    echo json_encode(["error" => "Endpoint not provided"]);
    exit;
}

// API Routing
switch ($request_method) {
    case 'GET':
        if ($endpoint === "users") {
            if ($id) {
                getUser($conn, $id);
            }else{
                getUsers($conn);
            }

        } elseif ($endpoint === "monitors") {
            if ($conn) {
                fetchAdmin($conn);
            }
        } else {
            echo json_encode(["error" => "Invalid endpoint"]);
        }
        break;

    case 'PATCH':
        if($endpoint === "users") {
            if ($payLoad) {
                // echo json_encode(["message" => "hey there", "pay" => $payLoad]);
                updateUser($conn, $id, $payLoad);
            }
        }
        break;
        
    case 'POST':
        if ($endpoint === "login") {
            login($conn, $payLoad);
        } 
        elseif($endpoint === "register") {
            addUser($conn, $payLoad);
        }
        break;

    case 'DELETE':
        if ($endpoint === 'delete') {
            deleteUser($conn, $id);
        }
        break;

    default:
        echo json_encode(["error" => "Method not supported"]);
}

// Function to fetch users from database
function getUsers($conn) {
    $sql = "SELECT * FROM Users";
    $result = $conn->query($sql);

    $users = [];
    while ($row = $result->fetch_assoc()) {
        $users[] = $row;
    }
    
    echo json_encode(["status" => 200, "result" => $users]);
}

function getUser($conn, $id){
    if (!$id) {
        echo json_encode(["error" => "User ID not provided"]);
        return;
    }

    $sql = "SELECT * FROM Users WHERE user_id=$id";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
        $user = $result->fetch_assoc();
        echo json_encode(["status"=> 200, "result" => $user]);
    } else {
        echo json_encode(["error" => "User not found"]);
    }
}

// Function to add a user to the database
function addUser($conn, $payLoad) {

    if (!$payLoad) {
        echo json_encode(["error" => "No data provided"]);
        return;
    }
    $data = json_decode($payLoad);
    $sql = "INSERT INTO Users (first_name, last_name, department) VALUES ('$data->name', '$data->surname', '$data->dept')";

    if ($conn->query($sql)) {
        echo json_encode(["message" => "User added", "id" => $conn->insert_id]);
    } else {
        echo json_encode(["error" => "Failed to add user"]);
    }
}

// function updateUser($conn, $id, $payLoad){
//     if (!$payLoad) {
//         echo json_encode(["error" => "No data provided"]);
//         return;
//     }

//     $data = json_decode($payLoad, true); 

//     if (!is_array($data) || empty($data)) {
//         echo json_encode(["error" => "Invalid or empty data"]);
//         return;
//     }

//     $setClauses = [];
//     $values = [];
//     $types = '';

//     foreach ($data as $key => $value) {
//         // Optional: validate column names against allowed fields
//         // If updating password, hash it before storing
//         if ($key === 'user_pass') {
//             $value = password_hash($value, PASSWORD_DEFAULT);
//         }

//         $setClauses[] = "`$key` = ?";
//         $values[] = $value;
//         $types .= is_int($value) ? 'i' : (is_float($value) ? 'd' : 's');
//     }

//     $values[] = $id; // Add ID for WHERE clause
//     $types .= 'i';   // Assuming user_id is integer

//     $sql = "UPDATE `Monitor` SET " . implode(', ', $setClauses) . " WHERE `user_id` = ?";

//     $stmt = $conn->prepare($sql);
//     if (!$stmt) {
//         echo json_encode(["error" => "Failed to prepare statement"]);
//         return;
//     }

//     // Bind parameters dynamically
//     $stmt->bind_param($types, ...$values);

//     if ($stmt->execute()) {
//         echo json_encode(["message" => "User updated successfully"]);
//     } else {
//         echo json_encode(["error" => "Update failed", "details" => $stmt->error]);
//     }

//     $stmt->close();

// }

function updateUser($conn, $id, $payLoad){
    if (!$payLoad) {
        echo json_encode(["error" => "No data provided"]);
        return;
    }

    $data = json_decode($payLoad, true); 

    if (!is_array($data) || empty($data)) {
        echo json_encode(["error" => "Invalid or empty data"]);
        return;
    }

    $setClauses = [];
    $values = [];
    $types = '';

    foreach ($data as $key => $value) {

        // 🔐 If updating password, hash it before storing
        if ($key === 'user_pass') {
            $value = password_hash($value, PASSWORD_DEFAULT);
        }

        $setClauses[] = "`$key` = ?";
        $values[] = $value;

        $types .= is_int($value) ? 'i' : (is_float($value) ? 'd' : 's');
    }

    $values[] = $id; 
    $types .= 'i';   

    $sql = "UPDATE `Monitor` SET " . implode(', ', $setClauses) . " WHERE `user_id` = ?";

    $stmt = $conn->prepare($sql);
    if (!$stmt) {
        echo json_encode(["error" => "Failed to prepare statement"]);
        return;
    }

    $stmt->bind_param($types, ...$values);

    if ($stmt->execute()) {
        echo json_encode(["message" => "User updated successfully"]);
    } else {
        echo json_encode(["error" => "Update failed", "details" => $stmt->error]);
    }

    $stmt->close();
}


function fetchAdmin($conn){
    $sql = "SELECT monitor_id, user_id, email_add, user_pass, concat(first_name, ' ', last_name) 'Full Name', department
        FROM Monitor LEFT JOIN Users using(user_id)
        order by user_id desc;";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
        $admin = $result->fetch_assoc();
        echo json_encode(["status"=> 200, "result" => $admin]);
    } else {
        echo json_encode(["error" => "Admin not found"]);
    }
}

function login($conn, $payLoad){
    if ($payLoad) {
       $data = json_decode($payLoad);
    }


    $email = $data->email;
    $password = $data->password;
    $sql = "SELECT monitor_id, user_id, email_add, user_pass, concat(first_name, ' ', last_name) 'Full Name', department 
            FROM Monitor LEFT JOIN Users using(user_id)
            where email_add = '$email'";
    
    $result = $conn->query($sql);
    
    if ($result->num_rows > 0) {
        $user = $result->fetch_assoc();
        if (password_verify($password, $user['user_pass'])) {
            echo json_encode(["status"=> 200,"message" => "Logged in successfully 😎", "result" => $user]);
        } else {
            echo json_encode(["error" => "Wrong password😶"]);
        }
    } else {
        echo json_encode(["error" => "User not found, please provide the correct email address😭"]);
        return;
    }
}

function deleteUser($conn, $id) {
    if(!$id) {
        echo json_encode(["message" => "User ID not provided."]);
    }


    $sql = "UPDATE Users SET first_name = NULL, last_name = NULL, department = NULL WHERE user_id = $id"; 

    if($conn->query($sql)) {
        echo json_encode(["message" => "User deleted successfully😭"]);
    
    } else{
        echo json_encode(["message" => "A glitch in the system, truly you are special 😂"]);
    }
}