|
Server : LiteSpeed System : Linux terra.hostitbro.com 5.14.0-611.54.3.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:31:24 EDT 2026 x86_64 User : outerorb ( 1091) PHP Version : 8.1.34 Disable Function : mail Directory : /home2/outerorb/assetradar.outerorbittech.com/admin/ | |
|
Path: /home2/outerorb/assetradar.outerorbittech.com/admin/master_data_api.php
Size: 15.85 KB
Permissions: 0666
<?php
// admin/master_data_api.php
// Backend API for Master Data CRUD operations
require_once '../config.php';
require_once '../inc/auth.php';
header('Content-Type: application/json');
if (!is_admin()) {
http_response_code(403);
echo json_encode(['error' => 'Forbidden']);
exit();
}
$entity = $_GET['entity'] ?? '';
$action = $_GET['action'] ?? '';
// Connect to DB
$conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
if ($conn->connect_error) {
http_response_code(500);
echo json_encode(['error' => 'DB connection failed']);
exit();
}
function fetch_all($conn, $table) {
$result = $conn->query("SELECT * FROM $table");
$rows = [];
while ($row = $result->fetch_assoc()) {
$rows[] = $row;
}
return $rows;
}
switch ($entity) {
case 'roles':
if ($action === 'list') {
echo json_encode(fetch_all($conn, 'roles'));
exit();
} elseif ($action === 'create') {
$name = $conn->real_escape_string($_POST['name'] ?? '');
$slug = $conn->real_escape_string($_POST['slug'] ?? '');
if ($name && $slug) {
$conn->query("INSERT INTO roles (name, slug) VALUES ('$name', '$slug')");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'update') {
$id = (int)($_POST['id'] ?? 0);
$name = $conn->real_escape_string($_POST['name'] ?? '');
$slug = $conn->real_escape_string($_POST['slug'] ?? '');
if ($id && $name && $slug) {
$conn->query("UPDATE roles SET name='$name', slug='$slug' WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'delete') {
$id = (int)($_POST['id'] ?? 0);
if ($id) {
$conn->query("DELETE FROM roles WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing id']);
}
exit();
}
break;
case 'teams':
if ($action === 'list') {
echo json_encode(fetch_all($conn, 'teams'));
exit();
} elseif ($action === 'create') {
$name = $conn->real_escape_string($_POST['name'] ?? '');
if ($name) {
$conn->query("INSERT INTO teams (name) VALUES ('$name')");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing name']);
}
exit();
} elseif ($action === 'update') {
$id = (int)($_POST['id'] ?? 0);
$name = $conn->real_escape_string($_POST['name'] ?? '');
if ($id && $name) {
$conn->query("UPDATE teams SET name='$name' WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'delete') {
$id = (int)($_POST['id'] ?? 0);
if ($id) {
$conn->query("DELETE FROM teams WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing id']);
}
exit();
}
break;
case 'categories':
if ($action === 'list') {
echo json_encode(fetch_all($conn, 'categories'));
exit();
} elseif ($action === 'create') {
$name = $conn->real_escape_string($_POST['name'] ?? '');
if ($name) {
$conn->query("INSERT INTO categories (name) VALUES ('$name')");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing name']);
}
exit();
} elseif ($action === 'update') {
$id = (int)($_POST['id'] ?? 0);
$name = $conn->real_escape_string($_POST['name'] ?? '');
if ($id && $name) {
$conn->query("UPDATE categories SET name='$name' WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'delete') {
$id = (int)($_POST['id'] ?? 0);
if ($id) {
$conn->query("DELETE FROM categories WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing id']);
}
exit();
}
break;
case 'users':
if ($action === 'list') {
$result = $conn->query("SELECT u.*, t.name as team_name, r.name as role_name FROM users u LEFT JOIN teams t ON u.team_id = t.id LEFT JOIN roles r ON u.role_slug = r.slug");
$rows = [];
while ($row = $result->fetch_assoc()) {
$rows[] = $row;
}
echo json_encode($rows);
exit();
} elseif ($action === 'create') {
$name = $conn->real_escape_string($_POST['name'] ?? '');
$email = $conn->real_escape_string($_POST['email'] ?? '');
$password = $conn->real_escape_string($_POST['password'] ?? '');
$role_slug = $conn->real_escape_string($_POST['role_slug'] ?? '');
$team_id = (int)($_POST['team_id'] ?? 0);
// Get role_id from roles table using role_slug
$role_id = 0;
if ($role_slug) {
$roleRes = $conn->query("SELECT id FROM roles WHERE slug='$role_slug' LIMIT 1");
if ($roleRes && $roleRow = $roleRes->fetch_assoc()) {
$role_id = (int)$roleRow['id'];
}
}
if ($name && $email && $password && $role_slug) {
$hashed = password_hash($password, PASSWORD_BCRYPT);
$conn->query("INSERT INTO users (name, email, password, role_id, role_slug, team_id) VALUES ('$name', '$email', '$hashed', $role_id, '$role_slug', $team_id)");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'update') {
$id = (int)($_POST['id'] ?? 0);
$name = $conn->real_escape_string($_POST['name'] ?? '');
$email = $conn->real_escape_string($_POST['email'] ?? '');
$role_id = (int)($_POST['role_id'] ?? 0);
$role_slug = $conn->real_escape_string($_POST['role_slug'] ?? '');
$team_id = (int)($_POST['team_id'] ?? 0);
$set = [];
if ($name) $set[] = "name='$name'";
if ($email) $set[] = "email='$email'";
if ($role_id) $set[] = "role_id=$role_id";
if ($role_slug) $set[] = "role_slug='$role_slug'";
$set[] = "team_id=$team_id";
if (isset($_POST['password']) && $_POST['password']) {
$hashed = password_hash($_POST['password'], PASSWORD_BCRYPT);
$set[] = "password='$hashed'";
}
if ($id && count($set)) {
$conn->query("UPDATE users SET " . implode(',', $set) . " WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'delete') {
$id = (int)($_POST['id'] ?? 0);
if ($id) {
$conn->query("DELETE FROM users WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing id']);
}
exit();
}
break;
case 'items':
if ($action === 'list') {
echo json_encode(fetch_all($conn, 'items'));
exit();
} elseif ($action === 'create') {
$asset_tag = $conn->real_escape_string($_POST['asset_tag'] ?? '');
$item_name = $conn->real_escape_string($_POST['item_name'] ?? '');
$category_id = (int)($_POST['category_id'] ?? 0);
$brand_model = $conn->real_escape_string($_POST['brand_model'] ?? '');
$serial_number = $conn->real_escape_string($_POST['serial_number'] ?? '');
$purchase_date = $conn->real_escape_string($_POST['purchase_date'] ?? '');
$warranty_to = $conn->real_escape_string($_POST['warranty_to'] ?? '');
$assigned_to = (int)($_POST['assigned_to'] ?? 0);
$condition_status = $conn->real_escape_string($_POST['condition_status'] ?? 'Working');
if ($asset_tag && $item_name && $category_id) {
$conn->query("INSERT INTO items (asset_tag, item_name, category_id, brand_model, serial_number, purchase_date, warranty_to, assigned_to, condition_status, created_at) VALUES ('$asset_tag', '$item_name', $category_id, '$brand_model', '$serial_number', '$purchase_date', '$warranty_to', $assigned_to, '$condition_status', NOW())");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'update') {
$id = (int)($_POST['id'] ?? 0);
$set = [];
foreach ([
'asset_tag', 'item_name', 'category_id', 'brand_model', 'serial_number', 'purchase_date', 'warranty_to', 'assigned_to', 'condition_status'
] as $field) {
if (isset($_POST[$field])) {
$val = $conn->real_escape_string($_POST[$field]);
if (is_numeric($val)) $set[] = "$field=$val";
else $set[] = "$field='$val'";
}
}
$set[] = "updated_at=NOW()";
if ($id && count($set)) {
$conn->query("UPDATE items SET " . implode(',', $set) . " WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'delete') {
$id = (int)($_POST['id'] ?? 0);
if ($id) {
$conn->query("DELETE FROM items WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing id']);
}
exit();
}
break;
case 'vendors':
if ($action === 'list') {
echo json_encode(fetch_all($conn, 'vendors'));
exit();
} elseif ($action === 'create') {
$name = $conn->real_escape_string($_POST['name'] ?? '');
$contact_info = $conn->real_escape_string($_POST['contact_info'] ?? '');
$address = $conn->real_escape_string($_POST['address'] ?? '');
$email = $conn->real_escape_string($_POST['email'] ?? '');
$phone = $conn->real_escape_string($_POST['phone'] ?? '');
$notes = $conn->real_escape_string($_POST['notes'] ?? '');
if ($name) {
$conn->query("INSERT INTO vendors (name, contact_info, address, email, phone, notes) VALUES ('$name', '$contact_info', '$address', '$email', '$phone', '$notes')");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing name']);
}
exit();
} elseif ($action === 'update') {
$id = (int)($_POST['id'] ?? 0);
$name = $conn->real_escape_string($_POST['name'] ?? '');
$contact_info = $conn->real_escape_string($_POST['contact_info'] ?? '');
$address = $conn->real_escape_string($_POST['address'] ?? '');
$email = $conn->real_escape_string($_POST['email'] ?? '');
$phone = $conn->real_escape_string($_POST['phone'] ?? '');
$notes = $conn->real_escape_string($_POST['notes'] ?? '');
if ($id && $name) {
$conn->query("UPDATE vendors SET name='$name', contact_info='$contact_info', address='$address', email='$email', phone='$phone', notes='$notes' WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing fields']);
}
exit();
} elseif ($action === 'delete') {
$id = (int)($_POST['id'] ?? 0);
if ($id) {
$conn->query("DELETE FROM vendors WHERE id=$id");
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'Missing id']);
}
exit();
}
break;
default:
http_response_code(400);
echo json_encode(['error' => 'Invalid entity']);
exit();
}
if (in_array($entity, ['roles','teams','categories','users','items','vendors']) && $action === 'export') {
$rows = fetch_all($conn, $entity);
if (count($rows) > 0) {
$csv = implode(',', array_keys($rows[0])) . "\n";
foreach ($rows as $row) {
$csv .= implode(',', array_map(function($v) {
return '"' . str_replace('"', '""', $v) . '"';
}, $row)) . "\n";
}
} else {
$csv = "No data found\n";
}
header('Content-Type: text/csv');
header('Content-Disposition: attachment; filename="' . $entity . '_export.csv"');
echo $csv;
exit();
} elseif (in_array($entity, ['roles','teams','categories','users','items','vendors']) && $action === 'import' && $_SERVER['REQUEST_METHOD'] === 'POST') {
if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
echo json_encode(['error' => 'File upload failed']);
exit();
}
$csv = file_get_contents($_FILES['file']['tmp_name']);
$lines = array_filter(array_map('trim', explode("\n", $csv)));
$fields = [];
$data = [];
foreach ($lines as $i => $line) {
if ($i === 0) {
$fields = str_getcsv($line);
} else {
$row = str_getcsv($line);
if (count($row) === count($fields)) {
$data[] = array_combine($fields, $row);
}
}
}
if (count($data)) {
$conn->query("TRUNCATE TABLE $entity");
foreach ($data as $row) {
$cols = array_keys($row);
$vals = array_map(function($v) use ($conn) {
return is_null($v) ? 'NULL' : "'" . $conn->real_escape_string($v) . "'";
}, array_values($row));
$sql = "INSERT INTO $entity (" . implode(',', $cols) . ") VALUES (" . implode(',', $vals) . ")";
$conn->query($sql);
}
echo json_encode(['success' => true]);
} else {
echo json_encode(['error' => 'No valid data found']);
}
exit();
}
?>