create_user.php

<?php
require_once __DIR__ . '/includes/session.php';
require_once __DIR__ . '/includes/require_admin.php';
require_once __DIR__ . '/includes/audit.php';
require_once __DIR__ . '/includes/validation.php';

requirePermission('USER_CREATE');

$stmt = $pdo->prepare("SELECT role_id, role_name FROM active_roles WHERE role_level < ? ORDER BY role_level DESC");
$stmt->execute([$_SESSION['role_level']]);
$roles = $stmt->fetchAll();

$errors = [];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'] ?? '')) {
        $_SESSION['flash_error'] = t('err_csrf');
        header("Location: create_user.php"); exit;
    }

    $username = str_replace(' ', '', trim($_POST['username'] ?? ''));
    $email    = trim($_POST['email'] ?? '');
    $password = $_POST['password'] ?? '';
    $role_id  = (int)($_POST['role_id'] ?? 0);

    if ($username === '')                                  { $errors[] = t('cu_err_name_empty'); }
    elseif (strlen($username) > 50)                        { $errors[] = t('cu_err_name_long'); }
    if ($email === '')                                      { $errors[] = t('cu_err_email_empty'); }
    elseif (!filter_var($email, FILTER_VALIDATE_EMAIL))    { $errors[] = t('cu_err_email_inv'); }
    if ($password === '')                                   { $errors[] = t('cu_err_pass_empty'); }
    else { $errors = array_merge($errors, passwordErrors($password)); }
    if ($role_id <= 0)                                     { $errors[] = t('cu_err_role_empty'); }

    if ($role_id > 0 && empty($errors)) {
        $stmt = $pdo->prepare("SELECT role_level FROM roles WHERE role_id = ? AND deleted_at IS NULL");
        $stmt->execute([$role_id]);
        $level = $stmt->fetchColumn();
        if ($level === false)                              { $errors[] = t('cu_err_role_inv'); }
        elseif ($level >= $_SESSION['role_level'])         { $errors[] = t('cu_err_role_deny'); }
    }

    if (empty($errors)) {
        $chk = $pdo->prepare("SELECT 1 FROM users WHERE (username = ? OR email = ?) AND deleted_at IS NULL");
        $chk->execute([$username, $email]);
        if ($chk->fetch())                                 { $errors[] = t('cu_err_duplicate'); }
    }

    if (empty($errors)) {
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $stmt = $pdo->prepare("INSERT INTO users (username, email, password_hash, role_id) VALUES (?,?,?,?)");
        $stmt->execute([$username, $email, $hash, $role_id]);
        $newId = (int)$pdo->lastInsertId();
        logAction($pdo, 'USER_CREATE', 'user', $newId, null, ['username' => $username, 'email' => $email, 'role_id' => $role_id]);
        $_SESSION['flash_success'] = t('cu_success');
        header("Location: users.php"); exit;
    }
}

$title = t('cu_title');
require __DIR__ . '/layout/header.php';
?>

<!-- Page Header -->
<div class="page-header">
  <div>
    <h1 class="page-title"><?= t('cu_title') ?></h1>
    <p class="page-subtitle"><?= t('cu_sub') ?></p>
  </div>
  <div class="page-actions">
    <a href="users.php" class="btn btn-secondary">
      <i class="bi bi-arrow-left"></i> <?= t('back') ?>
    </a>
  </div>
</div>

<div class="row justify-content-center">
<div class="col-lg-6">

  <?php if (!empty($errors)): ?>
  <div class="alert alert-danger mb-4">
    <i class="bi bi-exclamation-circle-fill"></i>
    <div>
      <?php foreach ($errors as $e): ?>
      <div><?= htmlspecialchars($e) ?></div>
      <?php endforeach; ?>
    </div>
  </div>
  <?php endif; ?>

  <div class="card">
    <div class="card-hd">
      <span class="card-title"><?= t('cu_info') ?></span>
    </div>
    <div class="card-body">

      <form method="post">
        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($_SESSION['csrf_token']) ?>">

        <div class="form-group">
          <label class="form-label"><?= t('username') ?></label>
          <input type="text" name="username" class="form-control js-no-spaces"
                 value="<?= htmlspecialchars($_POST['username'] ?? '') ?>"
                 maxlength="50"
                 required>
        </div>

        <div class="form-group">
          <label class="form-label"><?= t('email') ?></label>
          <input type="email" name="email" class="form-control"
                 value="<?= htmlspecialchars($_POST['email'] ?? '') ?>"
                 required>
        </div>

        <div class="form-group">
          <label class="form-label">
            <?= t('password') ?> <small><?= htmlspecialchars(passwordHint()) ?></small>
          </label>
          <input type="password" name="password" class="form-control"
                 autocomplete="new-password"
                 placeholder="••••••••" required>
        </div>

        <div class="form-group">
          <label class="form-label"><?= t('role') ?></label>
          <select name="role_id" class="form-select" required>
            <option value=""><?= t('cu_role_ph') ?></option>
            <?php foreach ($roles as $r): ?>
            <option value="<?= (int)$r['role_id'] ?>"
                    <?= (isset($_POST['role_id']) && $_POST['role_id'] == $r['role_id']) ? 'selected' : '' ?>>
              <?= htmlspecialchars($r['role_name']) ?>
            </option>
            <?php endforeach; ?>
          </select>
        </div>

        <div class="d-flex gap-2 mt-4">
          <button type="submit" class="btn btn-primary">
            <i class="bi bi-person-plus"></i> <?= t('cu_btn') ?>
          </button>
          <a href="users.php" class="btn btn-ghost"><?= t('cancel') ?></a>
        </div>

      </form>
    </div>
  </div>

</div>
</div>

<?php include __DIR__ . "/layout/footer.php"; ?>