File Manager

✏️ Edit File: /home/u625410797/domains/monothailand.com/public_html/smart_panel/api/v1/user_manager.php

<?php
// =============================================================================
// API: GLOBAL USER & RBAC MANAGER (PRODUCTION READY)
// Method: GET, POST, DELETE
// Logic: Real CRUD for dashboard admins and site-bound permissions
// =============================================================================

require_once '../../config.php';
require_once '../../core/AuditLogger.php';
require_once '../../core/PasswordHasher.php';

// [GOD MODE] Dual-Core Authentication Protocol
$auth = Security::requireAuth();
$userId = $auth['user_id'];
$isAdmin = $auth['isAdmin'];

// Initialize Identity Logger
$logger = new AuditLogger();

$method = $_SERVER['REQUEST_METHOD'];

try {
    if ($method === 'GET') {
        // 1. Fetch all managed users from the unified identity hub
        $stmt = $pdo->prepare("
            SELECT 
                u.id as uid, 
                u.email, 
                u.display_name as name, 
                u.role, 
                u.status,
                u.last_login as last_active
            FROM users u
            ORDER BY u.created_at DESC
        ");
        $stmt->execute();
        $admins = $stmt->fetchAll(PDO::FETCH_ASSOC);

// 2. Fetch site permissions for each identity (V13: Sites are directly owned by users)
        foreach ($admins as &$admin) {
            $siteStmt = $pdo->prepare("
                SELECT s.id, s.name 
                FROM sites s
                WHERE s.user_id = ?
            ");
            $siteStmt->execute([$admin['uid']]);
            $permissions = $siteStmt->fetchAll(PDO::FETCH_ASSOC);
            
            $admin['sites'] = array_column($permissions, 'name');
            $admin['site_ids'] = array_column($permissions, 'id');
            
            // Format last active for UI
            $admin['last_active'] = $admin['last_active'] ? date('j M, H:i', strtotime($admin['last_active'])) : 'Never';
        }

// 3. Fetch available sites for assignment
        $availableSitesStmt = $pdo->prepare("SELECT id, name FROM sites WHERE user_id = ? OR user_id = 'SYSTEM_AUTO_STAGING'");
        $availableSitesStmt->execute([$userId]);
        $allSites = $availableSitesStmt->fetchAll(PDO::FETCH_ASSOC);

Response::success([
            'users' => $admins,
            'available_sites' => $allSites,
            'roles' => ['Administrator', 'Engineer', 'Security Agent', 'Viewer', 'Operator']
        ], "Unified identity directory synchronized.");

} elseif ($method === 'POST') {
        $input = json_decode(file_get_contents('php://input'), true);
        $targetUID = $input['target_uid'];
        $newRole = $input['role'];
        $assignedSiteIds = $input['site_ids'] ?? [];

$pdo->beginTransaction();

// 1. Security Check: Is the requester an Administrator?
        if (!$isAdmin) {
            Response::error(403, "Access Denied: You do not have permission to manage users");
        }

// 2. Extra Safety: Prevent Self-Demotion of the ONLY Administrator
        if ($targetUID === $userId && $newRole !== 'Administrator') {
            $countAdminStmt = $pdo->query("SELECT COUNT(*) FROM users WHERE role = 'Administrator' AND (status = 'active' OR status IS NULL)");
            if ($countAdminStmt->fetchColumn() <= 1) {
                Response::error(400, "Critial Warning: Cannot demote the last remaining active Administrator.");
            }
        }

// 3. Update Role & Status
        $updateStmt = $pdo->prepare("UPDATE users SET role = ? WHERE id = ?");
        $updateStmt->execute([$newRole, $targetUID]);

// 4. Refresh Site Access via V13 User ID ownership
        // In V13, assigning a site to an admin sets the site's user_id directly.
        if (count($assignedSiteIds) > 0) {
            $updateAccess = $pdo->prepare("UPDATE sites SET user_id = ? WHERE id = ?");
            foreach ($assignedSiteIds as $siteId) {
                $updateAccess->execute([$targetUID, $siteId]);
            }
        }

// 5. Audit Log (Unified)
        $logger->log($userId, 'UPDATE_ACCESS', 'ADMIN', $targetUID, "Role: $newRole, Sites: " . count($assignedSiteIds));

$pdo->commit();
        Response::success(null, "Security Matrix updated successfully. Audit log entry recorded.");
    } elseif ($method === 'PUT') {
        // Handle Admin Invitation/Creation
        $input = json_decode(file_get_contents('php://input'), true);
        $email = $input['email'];
        $displayName = $input['display_name'];
        $role = $input['role'] ?? 'Viewer';
        $tempPassword = $input['password'] ?? bin2hex(random_bytes(4)); // Default random pass

$pdo->beginTransaction();

// 1. Security Check
        if (!$isAdmin) {
            Response::error(403, "Access Denied");
        }

// 2. Generate ID and Insert
        $newId = bin2hex(random_bytes(16)); // UUID-like
        $hasher = new PasswordHasher();
        $stmt = $pdo->prepare("INSERT INTO users (id, email, password_hash, display_name, role, status) VALUES (?, ?, ?, ?, ?, 'active')");
        $stmt->execute([$newId, $email, $hasher->hash($tempPassword), $displayName, $role]);

// 3. Audit
        $logger->log($userId, 'INVITE_ADMIN', 'ADMIN', $newId, "Email: $email, Role: $role");

$pdo->commit();
        Response::success(['id' => $newId, 'temp_password' => $tempPassword], "Admin invited successfully.");

} elseif ($method === 'DELETE') {
        $targetUID = $_GET['target_uid'] ?? null;
        if (!$targetUID) Response::error(400, "Missing target_uid");

if ($targetUID === $userId) Response::error(400, "Suicide prevention: Cannot delete yourself.");

$pdo->beginTransaction();

// Security Check
        if (!$isAdmin) {
            Response::error(403, "Access Denied");
        }

$stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
        $stmt->execute([$targetUID]);

// Audit
        $logger->log($userId, 'DELETE_ADMIN', 'ADMIN', $targetUID);

$pdo->commit();
        Response::success(null, "Admin account purged.");
    }

} catch (Exception $e) {
    if ($pdo->inTransaction()) $pdo->rollBack();
    Response::error(500, "Enterprise User Management Failed", $e->getMessage());
}
?>

Batal

⬅ Naik ke api 83 item

Nama	Tipe	Ukuran	Diubah	Aksi
📁admin	dir	—	2026-04-30 04:28	📂 Buka
📁alerts	dir	—	2026-04-30 04:28	📂 Buka
📁auth	dir	—	2026-04-30 04:28	📂 Buka
📁dashboard	dir	—	2026-04-30 07:02	📂 Buka
📁industrial	dir	—	2026-07-06 17:04	📂 Buka
📁ota	dir	—	2026-04-30 04:28	📂 Buka
🐘active_ping.php	php	744 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘active_tracker.php	php	2.7 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘alert_history.php	php	4.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘analytics_engine.php	php	5.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
📝asset_fix_summary.txt	txt	805 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘audit_logs.php	php	1.7 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘backfill_energy.php	php	935 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘bind_hardware.php	php	4.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘bot_slots.php	php	2.3 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘check_serial.php	php	4.6 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘complete_command.php	php	2.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘control.php	php	13.5 KB	2026-05-01 01:53	✏️ Edit 👁️ View
🐘control_mass.php	php	1.6 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘control_route.php	php	2.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘db_explain.php	php	899 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘db_optimize.php	php	1.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘debug_cumulative.php	php	1.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘debug_db.php	php	3.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘debug_db_check.php	php	505 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘debug_energy.php	php	649 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘debug_slot.php	php	600 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘debug_wana.php	php	721 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘delete_node_permanent.php	php	6.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘delete_site.php	php	4.3 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘delete_slot.php	php	2.3 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘dump_debug.php	php	850 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘energy_anchor.php	php	1.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘energy_integration_engine.php	php	2.5 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘firmware_core.php	php	3.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘fix_gateway_schema.php	php	1.3 KB	2026-05-01 01:52	✏️ Edit 👁️ View
🐘fix_schema.php	php	6.4 KB	2026-05-01 01:52	✏️ Edit 👁️ View
🐘fleet_stats.php	php	4.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘geo_intelligence.php	php	3.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘get_commands.php	php	6.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘get_hidden_nodes.php	php	1009 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘get_hierarchy.php	php	16.6 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘health_analysis.php	php	6.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘history.php	php	13.6 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘history_new_bug.php	php	17.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘history_precision.php	php	9.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘history_v42.php	php	8.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘hive_core.php	php	5.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘inspect_db.php	php	1.6 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘inspect_schema.php	php	734 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘latest.php	php	17.3 KB	2026-05-01 01:52	✏️ Edit 👁️ View
🐘list_devices.php	php	271 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘list_slots.php	php	1.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘mass_command.php	php	5.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘mesh_sync.php	php	2.7 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘migrate_3phase.php	php	2.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘migrate_commands_signature.php	php	298 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘move_hardware.php	php	4.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘ota_manager.php	php	3.6 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘peek_data.php	php	452 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘peek_recent.php	php	407 B	2026-04-30 09:54	✏️ Edit 👁️ View
🐘push_structure.php	php	12.5 KB	2026-05-01 01:53	✏️ Edit 👁️ View
🐘register_hardware.php	php	2.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘room_status.php	php	4.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘security_digest.php	php	3.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘seed_admin.php	php	1.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘server_health.php	php	1.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘set_node_visibility.php	php	1.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘set_room_master.php	php	1.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘sharing.php	php	4.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘simulate_history.php	php	5.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘sync.php	php	8.1 KB	2026-05-01 01:52	✏️ Edit 👁️ View
🐘sync_location_slots.php	php	3.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘system_config.php	php	1.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘telemetry.php	php	49.8 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘telemetry_batch.php	php	17.4 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘telemetry_engine.php	php	5.9 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘telemetry_raw.php	php	6.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘telemetry_v2.php	php	11 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘unlink_device.php	php	2.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘update_sensor_config.php	php	3.2 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘update_user.php	php	4.1 KB	2026-04-30 09:54	✏️ Edit 👁️ View
🐘user_manager.php	php	6.3 KB	2026-04-30 09:54	✏️ Edit 👁️ View