<?php
session_start();
$projectRoot = dirname(__DIR__);
require_once $projectRoot . '/config/database.php';

// Only Super Admin can create new staff/sub-admins
if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') {
    die("Unauthorized: Only the Super Admin can create staff accounts.");
}

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $fullname = $_POST['fullname'];
    $username = $_POST['username'];
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $role = $_POST['role'];

    $stmt = $pdo->prepare("INSERT INTO users (fullname, username, password, role) VALUES (?, ?, ?, ?)");
    if ($stmt->execute([$fullname, $username, $password, $role])) {
        $success = "New $role created successfully!";
    }
}
?>

<!DOCTYPE html>
<html>
<head>
    <title>Add Staff</title>
    <style>
        body { font-family: sans-serif; background: #f4f4f4; padding: 50px; }
        .form-card { background: white; padding: 20px; max-width: 400px; margin: auto; border-radius: 10px; box-shadow: 0 4px 10px rgba(0,0,0,0.1); }
        input, select, button { width: 100%; padding: 10px; margin: 10px 0; display: block; box-sizing: border-box; }
        button { background: #2c3e50; color: white; border: none; cursor: pointer; font-weight: bold; }
    </style>
</head>
<body>

<div class="form-card">
    <h2>Create Staff Account</h2>
    <?php if(isset($success)) echo "<p style='color:green'>$success</p>"; ?>
    
    <form method="POST">
        <label>Full Name</label>
        <input type="text" name="fullname" required>
        
        <label>Username</label>
        <input type="text" name="username" required>
        
        <label>Password</label>
        <input type="password" name="password" required>
        
        <label>Assign Role</label>
        <select name="role">
            <option value="teacher">Teacher</option>
            <option value="subadmin">Sub-Admin (Operations & Results)</option>
            <option value="admin">Super Admin (Full Access)</option>
        </select>
        
        <button type="submit">Create Account</button>
    </form>
    <a href="dashboard.php">Back to Dashboard</a>
</div>

</body>
</html>