<?php
require '../includes/db.php';
session_start();

/* =========================
   BASIC ADMIN PROTECTION
========================= */
if(!isset($_SESSION['admin'])){
    die("Access denied");
}

$admin_name = $_SESSION['admin'];

/* =========================
   MESSAGES
========================= */
$msg = "";
$error = "";

/* =========================
   CREATE USER
========================= */
if(isset($_POST['create_user'])){

    try {

        $full_name = trim($_POST['full_name']);
        $email = trim($_POST['email']);

        $account_number = time() . rand(100,999);
        $password_hash = password_hash("welcome123", PASSWORD_DEFAULT);

        $pdo->prepare("
            INSERT INTO users (full_name,email,account_number,password_hash)
            VALUES (?,?,?,?)
        ")->execute([$full_name,$email,$account_number,$password_hash]);

        $user_id = $pdo->lastInsertId();

        // AUDIT LOG
        $pdo->prepare("
            INSERT INTO admin_logs (admin_name,action,target_user,details)
            VALUES (?,?,?,?)
        ")->execute([
            $admin_name,
            "CREATE USER",
            $user_id,
            "Created user with account $account_number"
        ]);

        $msg = "User created successfully";

    } catch(Exception $e){
        $error = $e->getMessage();
    }
}

/* =========================
   TRANSACTION ENGINE (BANK-GRADE)
========================= */
if(isset($_POST['create_tx'])){

    try {

        $user_id = (int) $_POST['user_id'];
        $type = $_POST['type'];
        $amount = (float) $_POST['amount'];
        $description = trim($_POST['description']);

        $stmt = $pdo->prepare("SELECT checking_balance FROM users WHERE id=?");
        $stmt->execute([$user_id]);
        $balance = $stmt->fetchColumn();

        if($type == "debit" && $balance < $amount){
            throw new Exception("Insufficient funds");
        }

        // INSERT LEDGER TRANSACTION
        $pdo->prepare("
            INSERT INTO transactions (user_id,type,amount,description)
            VALUES (?,?,?,?)
        ")->execute([$user_id,$type,$amount,$description]);

        // UPDATE BALANCE
        if($type == "credit"){
            $pdo->prepare("
                UPDATE users SET checking_balance = checking_balance + ?
                WHERE id=?
            ")->execute([$amount,$user_id]);
        }

        if($type == "debit"){
            $pdo->prepare("
                UPDATE users SET checking_balance = checking_balance - ?
                WHERE id=?
            ")->execute([$amount,$user_id]);
        }

        // AUDIT LOG
        $pdo->prepare("
            INSERT INTO admin_logs (admin_name,action,target_user,details)
            VALUES (?,?,?,?)
        ")->execute([
            $admin_name,
            strtoupper($type) . " TRANSACTION",
            $user_id,
            "$type of $amount - $description"
        ]);

        $msg = "Transaction successful";

    } catch(Exception $e){
        $error = $e->getMessage();
    }
}

/* =========================
   DATA
========================= */
$users = $pdo->query("SELECT id, full_name, account_number, checking_balance FROM users")->fetchAll();
?>