0 && $userId !== intval($user['id'])) { $stmt = $pdo->prepare("SELECT role, is_banned FROM users WHERE id = ?"); $stmt->execute([$userId]); $target = $stmt->fetch(); if ($target && $target['role'] !== 'admin') { $newBan = $target['is_banned'] ? 0 : 1; $update = $pdo->prepare("UPDATE users SET is_banned = ? WHERE id = ?"); $update->execute([$newBan, $userId]); header("Location: dashboard_admin.php?success=" . urlencode("User ban status updated.")); exit(); } } header("Location: dashboard_admin.php?error=" . urlencode("Action failed.")); exit(); } // ACTION: CHANGE USER ROLE (RBAC) if ($action === 'change_role') { $userId = intval($_POST['user_id'] ?? 0); $newRole = $_POST['new_role'] ?? ''; $allowedRoles = ['admin', 'seller', 'buyer']; if ($userId > 0 && $userId !== intval($user['id']) && in_array($newRole, $allowedRoles)) { $stmt = $pdo->prepare("SELECT role FROM users WHERE id = ?"); $stmt->execute([$userId]); $target = $stmt->fetch(); if ($target) { $update = $pdo->prepare("UPDATE users SET role = ? WHERE id = ?"); $update->execute([$newRole, $userId]); header("Location: dashboard_admin.php?success=" . urlencode("User role changed to '{$newRole}' successfully.")); exit(); } } header("Location: dashboard_admin.php?error=" . urlencode("Failed to change user role.")); exit(); } // ACTION: DELETE USER if ($action === 'delete_user') { $userId = intval($_POST['user_id'] ?? 0); if ($userId > 0 && $userId !== intval($user['id'])) { $stmt = $pdo->prepare("SELECT role FROM users WHERE id = ?"); $stmt->execute([$userId]); $target = $stmt->fetch(); if ($target && $target['role'] !== 'admin') { $delete = $pdo->prepare("DELETE FROM users WHERE id = ?"); $delete->execute([$userId]); header("Location: dashboard_admin.php?success=" . urlencode("User account deleted.")); exit(); } } header("Location: dashboard_admin.php?error=" . urlencode("Failed to delete user.")); exit(); } // ACTION: MODERATE PRODUCT if ($action === 'moderate_product') { $prodId = intval($_POST['product_id'] ?? 0); $status = $_POST['status'] ?? 'approved'; if ($prodId > 0 && in_array($status, ['approved', 'pending', 'rejected'])) { $update = $pdo->prepare("UPDATE products SET status = ? WHERE id = ?"); $update->execute([$status, $prodId]); header("Location: dashboard_admin.php?success=" . urlencode("Product status updated to {$status}.")); exit(); } header("Location: dashboard_admin.php?error=" . urlencode("Failed to moderate product.")); exit(); } // ACTION: DELETE PRODUCT LISTING if ($action === 'delete_product') { $prodId = intval($_POST['product_id'] ?? 0); if ($prodId > 0) { $delete = $pdo->prepare("DELETE FROM products WHERE id = ?"); $delete->execute([$prodId]); header("Location: dashboard_admin.php?success=" . urlencode("Product listing deleted from platform.")); exit(); } header("Location: dashboard_admin.php"); exit(); } // ACTION: DISMISS REPORT if ($action === 'dismiss_report') { $reportId = intval($_POST['report_id'] ?? 0); if ($reportId > 0) { $update = $pdo->prepare("UPDATE product_reports SET status = 'dismissed' WHERE id = ?"); $update->execute([$reportId]); header("Location: dashboard_admin.php?success=" . urlencode("Report dismissed.")); exit(); } } // ACTION: UPDATE ORDER STATUS if ($action === 'update_order') { $orderId = intval($_POST['order_id'] ?? 0); $status = $_POST['status'] ?? 'Pending'; if ($orderId > 0 && in_array($status, ['Pending', 'Shipped', 'Delivered', 'Cancelled'])) { try { $pdo->beginTransaction(); $stmt = $pdo->prepare("SELECT status FROM orders WHERE id = ?"); $stmt->execute([$orderId]); $ord = $stmt->fetch(); if ($ord) { if ($status === 'Cancelled' && $ord['status'] !== 'Cancelled') { $itemsStmt = $pdo->prepare("SELECT * FROM order_items WHERE order_id = ?"); $itemsStmt->execute([$orderId]); $items = $itemsStmt->fetchAll(); $restoreStock = $pdo->prepare("UPDATE products SET stock = stock + ? WHERE id = ?"); foreach ($items as $it) { if ($it['product_id'] !== null) { $restoreStock->execute([$it['quantity'], $it['product_id']]); } } } $update = $pdo->prepare("UPDATE orders SET status = ? WHERE id = ?"); $update->execute([$status, $orderId]); } $pdo->commit(); header("Location: dashboard_admin.php?success=" . urlencode("Order status updated to {$status}.")); exit(); } catch (Exception $e) { if ($pdo->inTransaction()) { $pdo->rollBack(); } header("Location: dashboard_admin.php?error=" . urlencode($e->getMessage())); exit(); } } header("Location: dashboard_admin.php"); exit(); } } // 1. Gather stats $salesStmt = $pdo->query("SELECT SUM(total_amount) as total FROM orders WHERE status != 'Cancelled'"); $totalRevenue = $salesStmt->fetch()['total'] ?? 0.00; $usersCountStmt = $pdo->query("SELECT COUNT(*) as count FROM users"); $totalUsers = $usersCountStmt->fetch()['count']; $prodCountStmt = $pdo->query("SELECT COUNT(*) as count FROM products WHERE status = 'approved' AND stock > 0"); $activeCatalog = $prodCountStmt->fetch()['count']; $pendingCountStmt = $pdo->query("SELECT COUNT(*) as count FROM products WHERE status = 'pending'"); $pendingProductsCount = $pendingCountStmt->fetch()['count']; $orderCountStmt = $pdo->query("SELECT COUNT(*) as count FROM orders"); $totalOrders = $orderCountStmt->fetch()['count']; // 2. Fetch Users list $usersStmt = $pdo->prepare("SELECT id, username, email, role, is_banned, created_at FROM users WHERE id != ? ORDER BY created_at DESC"); $usersStmt->execute([$user['id']]); $allUsers = $usersStmt->fetchAll(); // 3. Fetch Products list $prodsStmt = $pdo->query("SELECT p.*, u.username as seller_name FROM products p JOIN users u ON p.seller_id = u.id ORDER BY (p.status = 'pending') DESC, p.created_at DESC"); $allProducts = $prodsStmt->fetchAll(); // 4. Fetch Reports list $reportsStmt = $pdo->query(" SELECT r.*, p.title as product_title, p.seller_id, u.username as reporter_name, s.username as seller_name FROM product_reports r JOIN products p ON r.product_id = p.id LEFT JOIN users u ON r.user_id = u.id JOIN users s ON p.seller_id = s.id ORDER BY (r.status = 'pending') DESC, r.created_at DESC "); $allReports = $reportsStmt ? $reportsStmt->fetchAll() : []; // 5. Fetch Orders list $ordersStmt = $pdo->query("SELECT o.*, u.username as buyer_name FROM orders o JOIN users u ON o.buyer_id = u.id ORDER BY o.created_at DESC"); $allOrders = $ordersStmt->fetchAll(); renderHeader(__('admin_page_title')); ?>

$