<?php
/**
 * ENFORCEMENT APPLICATION GUIDE
 * 
 * This file shows exactly how to apply permission enforcement to your existing admin pages.
 * Copy and adapt these patterns to your pages.
 */

/*
=== PATTERN 1: Page Access Control (Top of Admin Page) ===

<?php
session_start();
require_once __DIR__ . '/helpers/admin_page_header.php';
require_once __DIR__ . '/db_config.php';

// Allow admins and sub-admins with 'manage_products' view permission
AdminPageHeader::requirePage('manage_products');

// Now the page can continue - admin or authorized sub-admin
$guard = AdminPageHeader::getGuard('manage_products');
$caps = $guard->getCapabilities();
?>

=== PATTERN 2: Conditional UI Rendering ===

<?php
// Show DELETE button only for admins or sub-admins with delete permission
if ($caps['can_delete']):
?>
    <button onclick="deleteItem(<?php echo $id; ?>)">Delete</button>
<?php else: ?>
    <span class="disabled">Delete (Not Allowed)</span>
<?php endif; ?>

// Show CREATE button only if can create
<?php if ($caps['can_create']): ?>
    <button onclick="showCreateForm()">+ Add New</button>
<?php endif; ?>

// Show EDIT button only if can edit  
<?php if ($caps['can_edit']): ?>
    <button onclick="editItem(<?php echo $id; ?>)">Edit</button>
<?php endif; ?>


=== PATTERN 3: API Handler Protection (Process Form) ===

<?php
session_start();
header('Content-Type: application/json');
require_once __DIR__ . '/helpers/admin_page_header.php';
require_once __DIR__ . '/db_config.php';

$action = $_POST['action'] ?? '';

// DELETE action
if ($action === 'delete') {
    AdminPageHeader::requireAction('manage_products', 'delete');
    // If we reach here, user has permission
    $id = (int)($_POST['id'] ?? 0);
    // ... delete logic ...
    echo json_encode(['success' => true, 'message' => 'Deleted']);
    exit;
}

// CREATE action
if ($action === 'create') {
    AdminPageHeader::requireAction('manage_products', 'create');
    // ... create logic ...
    echo json_encode(['success' => true, 'message' => 'Created']);
    exit;
}

// EDIT action
if ($action === 'edit') {
    AdminPageHeader::requireAction('manage_products', 'edit');
    // ... edit logic ...
    echo json_encode(['success' => true, 'message' => 'Updated']);
    exit;
}

// VIEW/LIST action (always check view)
if ($action === 'list') {
    AdminPageHeader::requireAction('manage_products', 'view');
    // ... retrieve and return list ...
    echo json_encode(['success' => true, 'data' => $items]);
    exit;
}

?>


=== PATTERN 4: Using Helper Functions ===

// Get current user's permission level
$level = AdminPageHeader::getLevel('manage_products');
// Returns: 'administrator', 'editor', 'viewer', 'none'

// Quick permission check
if (AdminPageHeader::can('manage_products', 'delete')) {
    // User can delete
}

// Check user type
if (AdminPageHeader::isAdmin()) {
    // Full admin
} elseif (AdminPageHeader::isSubadmin()) {
    // Sub-admin (check specific actions)
}


=== PATTERN 5: Disabling Form Elements ===

// In form, disable delete fields if no delete permission
<?php if (!$caps['can_delete']): ?>
    <style>
        .delete-section { display: none; }
        .delete-button { display: none !important; }
    </style>
<?php endif; ?>

// Or hide specific buttons
<?php if (!$caps['can_create']): ?>
    <style>
        .new-item-button { display: none; }
    </style>
<?php endif; ?>


=== CRITICAL PAGES TO UPDATE (Priority Order) ===

HIGH PRIORITY (prevent data loss/modification):
1. admin_products.php (manage_products) - DELETE protection critical
2. admin_blogs.php (manage_blogs) - DELETE protection critical
3. admin_manage_news.php (manage_news) - DELETE protection critical
4. admin_orders.php (manage_orders) - EDIT protection critical
5. admin_manage_users.php (manage_users) - DELETE/EDIT protection critical
6. admin_manage_pages.php (manage_pages) - DELETE protection critical

MEDIUM PRIORITY (content management):
7. admin_manage_carousel.php (manage_carousel)
8. admin_manage_slider.php (manage_slider_images)
9. admin_manage_video.php (manage_video)
10. admin_manage_awards.php (manage_awards)

LOW PRIORITY (settings):
11. admin_seo_manager.php (manage_seo)
12. admin_manage_footer.php (manage_footer_settings)
13. admin_manage_homepage.php (manage_homepage)
14. admin_manage_marquee.php (manage_marquee)


=== TESTING CHECKLIST ===

After adding enforcement:

1. [ ] Login as FULL ADMIN
   - [ ] Can view all pages
   - [ ] All buttons visible (Delete, Edit, Create)
   - [ ] Can perform all actions

2. [ ] Login as SUB-ADMIN with VIEWER permission
   - [ ] Can view page
   - [ ] No Delete/Edit/Create buttons shown
   - [ ] Cannot perform any modifications (if API call attempted)

3. [ ] Login as SUB-ADMIN with EDITOR permission
   - [ ] Can view page
   - [ ] Can see Create/Edit buttons
   - [ ] Delete button hidden
   - [ ] Can create and edit items
   - [ ] Cannot delete items

4. [ ] Login as SUB-ADMIN with ADMINISTRATOR permission
   - [ ] Can view page
   - [ ] All buttons visible
   - [ ] Can perform all actions

5. [ ] Login as SUB-ADMIN with NO permission
   - [ ] Redirected to dashboard
   - [ ] Cannot access page

6. [ ] Try direct API calls with modify permissions
   - [ ] CURL/Postman with delete action but viewer permission
   - [ ] Should return 403 Forbidden with error message
*/

?>
