<?php
/**
 * Admin Portal Setup Verification
 * This script verifies and updates the admin portal to use users table
 */

error_reporting(E_ALL);
ini_set('display_errors', 1);

echo "<h2>Admin Portal - Users Table Integration</h2>";
echo "<style>
body { font-family: Arial; padding: 20px; }
.success { background: #d4edda; color: #155724; padding: 15px; border-left: 4px solid #28a745; margin: 10px 0; }
.info { background: #d1ecf1; color: #0c5460; padding: 15px; border-left: 4px solid #17a2b8; margin: 10px 0; }
.warning { background: #fff3cd; color: #856404; padding: 15px; border-left: 4px solid #ffc107; margin: 10px 0; }
.code { background: #f5f5f5; padding: 10px; border-radius: 5px; font-family: monospace; }
</style>";

// Check if admin directory exists
$admin_dir = __DIR__ . '/__admin__';

if (!is_dir($admin_dir)) {
    echo "<div class='warning'>⚠️ Admin directory not found at: <code>__admin__/</code></div>";
    echo "<p>Please specify the correct admin directory path.</p>";
    exit;
}

echo "<div class='success'>✅ Admin directory found!</div>";

// Get all PHP files in admin directory
$admin_files = glob($admin_dir . '/*.php');

echo "<h3>Admin Portal Files Analysis:</h3>";
echo "<table border='1' cellpadding='10' style='border-collapse: collapse; width: 100%;'>";
echo "<tr><th>File</th><th>Status</th><th>Action Needed</th></tr>";

$files_to_update = [];

foreach ($admin_files as $file) {
    $filename = basename($file);
    $content = file_get_contents($file);

    $has_admin_security = strpos($content, "admin-security.php") !== false;
    $has_session_start = strpos($content, "session_start()") !== false;

    echo "<tr>";
    echo "<td>$filename</td>";

    if ($has_admin_security) {
        echo "<td style='color: green;'>✅ Protected</td>";
        echo "<td>-</td>";
    } else {
        echo "<td style='color: orange;'>⚠️ Not Protected</td>";
        echo "<td>Add admin-security.php</td>";
        $files_to_update[] = $filename;
    }

    echo "</tr>";
}

echo "</table>";

if (count($files_to_update) > 0) {
    echo "<div class='warning'>";
    echo "<h4>⚠️ Files Need Protection:</h4>";
    echo "<p>The following files don't include admin-security.php:</p>";
    echo "<ul>";
    foreach ($files_to_update as $file) {
        echo "<li>$file</li>";
    }
    echo "</ul>";
    echo "</div>";
} else {
    echo "<div class='success'>✅ All admin files are protected!</div>";
}

echo "<h3>✅ What's Already Done:</h3>";
echo "<div class='info'>";
echo "<ol>";
echo "<li>✅ <strong>login.php</strong> - Stores role from users table</li>";
echo "<li>✅ <strong>admin-login.php</strong> - Checks users table with role='admin'</li>";
echo "<li>✅ <strong>admin-security.php</strong> - Validates user role from session</li>";
echo "<li>✅ <strong>Admin button</strong> - Shows only when role='admin'</li>";
echo "<li>✅ <strong>users table</strong> - Has role column</li>";
echo "</ol>";
echo "</div>";

echo "<h3>📋 Implementation Checklist:</h3>";
echo "<div class='code'>";
echo "
<strong>Step 1: Ensure users have admin role</strong>
Run in phpMyAdmin:
<pre>
-- Check admin users
SELECT id, name, email, role FROM users WHERE role = 'admin';

-- Make a user admin (if needed)
UPDATE users SET role = 'admin' WHERE email = 'your-admin@email.com';
</pre>

<strong>Step 2: Add protection to admin files</strong>
Add this to the TOP of each admin file (after session_start):
<pre>
&lt;?php
session_start();
require_once('../includes/admin-security.php');
?&gt;
</pre>

<strong>Step 3: Test the flow</strong>
1. Login at login.php with admin email
2. See red ADMIN button in header
3. Click button → Auto-authenticated to admin portal
4. Should work seamlessly!
</div>";

echo "<h3>🔐 Security Features Active:</h3>";
echo "<div class='info'>";
echo "<ul>";
echo "<li>✅ Authentication Check - Must be logged in</li>";
echo "<li>✅ Authorization Check - Must have role='admin'</li>";
echo "<li>✅ Session Hijacking Prevention - User agent validation</li>";
echo "<li>✅ Session Regeneration - Every 30 minutes</li>";
echo "<li>✅ Audit Logging - All access attempts logged</li>";
echo "<li>✅ CSRF Protection - In login forms</li>";
echo "<li>✅ Rate Limiting - Admin login attempts</li>";
echo "</ul>";
echo "</div>";

echo "<h3>🎯 Summary:</h3>";
echo "<div class='success'>";
echo "<p><strong>Your setup uses:</strong></p>";
echo "<ul>";
echo "<li>✅ <strong>users table</strong> as single source of truth</li>";
echo "<li>✅ <strong>role column</strong> to distinguish admin vs customer</li>";
echo "<li>✅ <strong>admin table</strong> is ignored (legacy)</li>";
echo "<li>✅ Unified authentication system</li>";
echo "</ul>";
echo "<p><strong>Result:</strong> Clean, modern, scalable architecture! 🎉</p>";
echo "</div>";

echo "<h3>📝 Next Steps:</h3>";
echo "<ol>";
echo "<li>Review the files listed above that need protection</li>";
echo "<li>Add <code>require_once('../includes/admin-security.php');</code> to each</li>";
echo "<li>Ensure you have at least one user with role='admin' in users table</li>";
echo "<li>Test the complete flow (login → see button → click → access admin)</li>";
echo "</ol>";

echo "<br>";
echo "<a href='setup-admin-roles.php' style='padding: 10px 20px; background: #f44336; color: white; text-decoration: none; border-radius: 5px;'>Manage Admin Roles</a> ";
echo "<a href='check-admin-status.php' style='padding: 10px 20px; background: #2196f3; color: white; text-decoration: none; border-radius: 5px; margin-left: 10px;'>Check My Status</a> ";
echo "<a href='login.php' style='padding: 10px 20px; background: #4caf50; color: white; text-decoration: none; border-radius: 5px; margin-left: 10px;'>Go to Login</a>";
?>
