<?php
// ADD role
if (isset($_POST['add_role_btn'])) {
    $new_role_name = trim($_POST['new_role_name']);

    if (!empty($new_role_name)) {
        // Check for duplicate role
        $stmt = $connection->prepare("SELECT id FROM `role` WHERE `role_name` = ?");
        $stmt->bind_param("s", $new_role_name);
        $stmt->execute();
        $stmt->store_result();

        if ($stmt->num_rows > 0) {
            $_SESSION['msg'] = "Role already exists!";
            $_SESSION['type'] = "error";
        } else {
            $stmt->close(); // Close before insert

            $stmt = $connection->prepare("INSERT INTO `role` (`role_name`) VALUES (?)");
            $stmt->bind_param("s", $new_role_name);

            if ($stmt->execute()) {
                $_SESSION['msg'] = "Role Added Successfully";
                $_SESSION['type'] = "success";
            } else {
                $_SESSION['msg'] = "Error! Could Not Add Role";
                $_SESSION['type'] = "danger";
            }
        }
        $stmt->close();
    } else {
        $_SESSION['msg'] = "Role Name cannot be empty";
        $_SESSION['type'] = "error";
    }

    header("Location: role");
    exit();
}


// UPDATE role
if (isset($_POST['update_role_btn'])) {
    $edit_role_id = (int) $_POST['edit_role_id'];
    $edit_role_name = trim($_POST['edit_role_name']);

    // Check if the role name already exists for another role
    $stmt = $connection->prepare("SELECT id FROM `role` WHERE `role_name` = ? AND `id` != ?");
    $stmt->bind_param("si", $edit_role_name, $edit_role_id);
    $stmt->execute();
    $stmt->store_result();

    if ($stmt->num_rows > 0) {
        $_SESSION['msg'] = "Another role with this name already exists!";
        $_SESSION['type'] = "error";
    } else {
        $stmt->close();

        $stmt = $connection->prepare("UPDATE `role` SET `role_name` = ? WHERE `id` = ?");
        $stmt->bind_param("si", $edit_role_name, $edit_role_id);

        if ($stmt->execute()) {
            $_SESSION['msg'] = "Role Updated Successfully";
            $_SESSION['type'] = "success";
        } else {
            $_SESSION['msg'] = "Failed to Update Role";
            $_SESSION['type'] = "error";
        }

        $stmt->close();
    }

    header("Location: role");
    exit();
}

// DELETE role (secure version with usage check)
if (isset($_POST['delete_role_btn'])) {
    $hide_role_del = (int) $_POST['hide_role_del'];

    // Check if this role is assigned to any staff
    $check_stmt = $connection->prepare("SELECT COUNT(*) FROM `staff` WHERE `role` = (SELECT role_name FROM `role` WHERE id = ?)");
    $check_stmt->bind_param("i", $hide_role_del);
    $check_stmt->execute();
    $check_stmt->bind_result($role_usage_count);
    $check_stmt->fetch();
    $check_stmt->close();

    if ($role_usage_count > 0) {
        $_SESSION['msg'] = "Cannot delete: Role is currently assigned to staff members.";
        $_SESSION['type'] = "error";
    } else {
        // Proceed to delete
        $stmt = $connection->prepare("DELETE FROM `role` WHERE `id` = ?");
        $stmt->bind_param("i", $hide_role_del);

        if ($stmt->execute()) {
            $_SESSION['msg'] = "Role Deleted Successfully";
            $_SESSION['type'] = "success";
        } else {
            $_SESSION['msg'] = "Could Not Delete Role";
            $_SESSION['type'] = "error";
        }
        $stmt->close();
    }

    header("Location: role");
    exit();
}
?>
