<?php  
include 'config.php';  
$conn->set_charset("utf8mb4");  
  
if ($_SERVER['REQUEST_METHOD'] === 'POST') {  
  
    $type = $_POST['type'] ?? '';  
  
    /* =========================  
       🔐 ADMIN AUTH CHECK  
    ========================= */  
    $admin_username = $_POST['admin_username'];  
    $admin_password = $_POST['admin_password'];  
  
    $admin_stmt = $conn->prepare(  
        "SELECT 1 FROM admin WHERE username = ? AND password = ?"  
    );  
    $admin_stmt->bind_param("ss", $admin_username, $admin_password);  
    $admin_stmt->execute();  
    $admin_result = $admin_stmt->get_result();  
  
    if ($admin_result->num_rows === 0) {  
        http_response_code(403);  
        echo json_encode([  
            "status" => "error",  
            "message" => "Access Denied"  
        ], JSON_PRETTY_PRINT);  
        $admin_stmt->close();  
        $conn->close();  
        exit();  
    }  
    $admin_stmt->close();  
  
    if ($type === 'one') {  
        $email = $_POST['email'];  
        $query = "SELECT * FROM users WHERE email = '$email'";  
        $result = mysqli_query($conn, $query);  
        if ($result) {  
            $data = mysqli_fetch_assoc($result);  
            echo $data ? json_encode($data) : json_encode(['Error' => 'No User Found']);  
        } else {  
            echo json_encode(['Error' => mysqli_error($conn)]);  
        }  
    }  
  
    elseif ($type === 'edit') {  
        $email = $_POST['email'];  
        $first_name = $_POST['first_name'];  
        $last_name = $_POST['last_name'];  
        $number = $_POST['number'];  
  
        $sql = "UPDATE users   
                SET first_name='$first_name',  
                    last_name='$last_name',  
                    number='$number'  
                WHERE email='$email'";  
  
        echo mysqli_query($conn, $sql)  
            ? "Profile Updated Successfully"  
            : "Error Updating Profile: " . mysqli_error($conn);  
    }  
  
    elseif ($type === 'pass') {  
        $email = $_POST['email'];  
        $oldpass = $_POST['oldpass'];  
        $newpass = $_POST['newpass'];  
  
        $query = "SELECT * FROM users   
                  WHERE email='$email' AND password='$oldpass'";  
        $result = mysqli_query($conn, $query);  
  
        if ($result->num_rows > 0) {  
            $sql = "UPDATE users SET password='$newpass' WHERE email='$email'";  
            echo mysqli_query($conn, $sql)  
                ? "Password Changed Successfully"  
                : "Error Changing Password: " . mysqli_error($conn);  
        } else {  
            echo "Old Password Is Incorrect!";  
        }  
    }  
  
    elseif ($type === 'all') {  
        $sql = "SELECT * FROM users";  
        $result = $conn->query($sql);  
        $dataArray = [];  
        if ($result->num_rows > 0) {  
            while ($row = $result->fetch_assoc()) {  
                $dataArray[] = $row;  
            }  
            echo json_encode($dataArray, JSON_UNESCAPED_UNICODE);  
        } else {  
            echo "No User Found";  
        }  
    }  
  
    elseif ($type === 'delete') {  
        $id = $_POST['id'];  
        $sql = "DELETE FROM users WHERE id=$id";  
        echo $conn->query($sql)  
            ? "User Deleted Successfully"  
            : "Error Deleting User: " . $conn->error;  
    }  
  
    /* =========================  
       UPDATE USER (ONLY ADDED ban_reason)  
    ========================= */  
    elseif ($type === 'update') {  
  
        $id = $_POST['id'];  
        $password = $_POST['password'];  
        $balance = $_POST['balance'] === '' ? 0 : $_POST['balance'];  
        $winning = $_POST['winning'] === '' ? 0 : $_POST['winning'];  
        $device_id = $_POST['device_id'];  
        $status = $_POST['status'];  
  
        $withdraw_block = isset($_POST['withdraw_block'])  
            ? intval($_POST['withdraw_block'])  
            : 0;  
  
        $withdraw_block_time = isset($_POST['withdraw_block_time'])  
            ? $_POST['withdraw_block_time']  
            : null;  

        // 🚫 NEW BAN REASON
        $ban_reason = isset($_POST['ban_reason'])  
            ? $_POST['ban_reason']  
            : '';  
  
        $sql = "UPDATE users   
                SET password='$password',  
                    balance='$balance',  
                    winning='$winning',  
                    device_id='$device_id',  
                    status='$status',  
                    withdraw_block='$withdraw_block',  
                    withdraw_block_time='$withdraw_block_time',
                    ban_reason='$ban_reason'  
                WHERE id=$id";  
  
        echo $conn->query($sql)  
            ? "User Updated Successfully"  
            : "Error Updating User: " . $conn->error;  
    }  
  
    elseif ($type === 'verify') {  
        $id = $_POST['id'];  
        $verified = $_POST['verify_badge'];  
  
        $sql = "UPDATE users SET verify_badge='$verified' WHERE id=$id";  
        echo $conn->query($sql)  
            ? "Verification Badge Updated Successfully"  
            : "Error Updating Verification Badge: " . $conn->error;  
    }  
  
    else {  
        echo json_encode(['Error' => 'Unknown type']);  
    }  
  
    mysqli_close($conn);  
  
} else {  
    echo json_encode(['Error' => 'Invalid Request Method']);  
}  
?>