invitations.php

<?php

declare(strict_types=1);

require_once __DIR__ . '/bootstrap.php';

$user = require_login(['geschaeftsstelle', 'uebungsleiter', 'assistent']);
$pdo = db();
$errors = [];

$allowedGroupIds = allowed_group_ids_for_user($pdo, $user);
$groups = [];
if ($allowedGroupIds !== []) {
    $placeholders = implode(',', array_fill(0, count($allowedGroupIds), '?'));
    $stmt = $pdo->prepare("SELECT id, name FROM training_groups WHERE id IN ({$placeholders}) ORDER BY name");
    $stmt->execute($allowedGroupIds);
    $groups = $stmt->fetchAll();
}

if (request_is_post()) {
    verify_csrf_or_fail();

    try {
        $action = (string) ($_POST['action'] ?? 'create_invitation');

        if ($action === 'delete_invitation') {
            $invitationId = (int) ($_POST['invitation_id'] ?? 0);
            if ($invitationId < 1) {
                throw new RuntimeException('Ungültige Einladung.');
            }

            if ($user['role'] === 'geschaeftsstelle') {
                $deleteStmt = $pdo->prepare('DELETE FROM invitations WHERE id = :id');
                $deleteStmt->execute(['id' => $invitationId]);
            } elseif ($user['role'] === 'uebungsleiter') {
                if ($allowedGroupIds === []) {
                    throw new RuntimeException('Keine Berechtigung für diese Einladung.');
                }
                $deletePlaceholders = implode(',', array_fill(0, count($allowedGroupIds), '?'));
                $deleteParams = array_merge([$invitationId], $allowedGroupIds);
                $deleteStmt = $pdo->prepare(
                    "DELETE FROM invitations
                     WHERE id = ? AND group_id IN ({$deletePlaceholders})"
                );
                $deleteStmt->execute($deleteParams);
            } else {
                $deleteStmt = $pdo->prepare(
                    'DELETE FROM invitations
                     WHERE id = :id AND created_by_role = :role AND created_by_id = :created_by_id'
                );
                $deleteStmt->execute([
                    'id' => $invitationId,
                    'role' => $user['role'],
                    'created_by_id' => $user['id'],
                ]);
            }

            if ($deleteStmt->rowCount() < 1) {
                throw new RuntimeException('Einladung konnte nicht gelöscht werden (keine Berechtigung oder nicht gefunden).');
            }

            audit_log('delete', 'invitation', $invitationId);
            set_flash('success', 'Einladung gelöscht.');
            redirect('invitations.php');
        }

        if ($allowedGroupIds === []) {
            throw new RuntimeException('Keine Gruppe verfügbar.');
        }

        $groupId = (int) ($_POST['group_id'] ?? 0);
        $expiresAtDate = trim((string) ($_POST['expires_at'] ?? ''));
        if (!in_array($groupId, $allowedGroupIds, true)) {
            throw new RuntimeException('Keine Berechtigung für diese Gruppe.');
        }

        if ($expiresAtDate === '') {
            $expiresAtDate = (new DateTimeImmutable('+14 days'))->format('Y-m-d');
        }

        $expires = DateTimeImmutable::createFromFormat('Y-m-d H:i:s', $expiresAtDate . ' 23:59:59');
        if (!$expires) {
            throw new RuntimeException('Ablaufdatum ist ungültig.');
        }

        $token = bin2hex(random_bytes(16));
        $stmt = $pdo->prepare(
            'INSERT INTO invitations (group_id, token, expires_at, multi_use, created_by_role, created_by_id)
             VALUES (:group_id, :token, :expires_at, 1, :created_by_role, :created_by_id)'
        );
        $stmt->execute([
            'group_id' => $groupId,
            'token' => $token,
            'expires_at' => $expires->format('Y-m-d H:i:s'),
            'created_by_role' => $user['role'],
            'created_by_id' => $user['id'],
        ]);

        audit_log(
            'create',
            'invitation',
            (int) $pdo->lastInsertId(),
            ['group_id' => $groupId, 'expires_at' => $expires->format('Y-m-d')]
        );
        set_flash('success', 'Einladung erstellt.');
        redirect('invitations.php');
    } catch (Throwable $e) {
        $errors[] = $e->getMessage();
    }
}

if ($user['role'] === 'geschaeftsstelle') {
    $inviteStmt = $pdo->query(
        'SELECT i.*, g.name AS group_name
         FROM invitations i
         INNER JOIN training_groups g ON g.id = i.group_id
         ORDER BY i.created_at DESC'
    );
    $invites = $inviteStmt->fetchAll();
} else {
    if ($allowedGroupIds === []) {
        $invites = [];
    } else {
        $invitePlaceholders = implode(',', array_fill(0, count($allowedGroupIds), '?'));
        $inviteStmt = $pdo->prepare(
            "SELECT i.*, g.name AS group_name
             FROM invitations i
             INNER JOIN training_groups g ON g.id = i.group_id
             WHERE i.group_id IN ({$invitePlaceholders})
             ORDER BY i.created_at DESC"
        );
        $inviteStmt->execute($allowedGroupIds);
        $invites = $inviteStmt->fetchAll();
    }
}

render_header('Einladungen / QR-Code', $user);
?>
<?php foreach ($errors as $error): ?>
    <div class="flash flash-error"><?php echo e($error); ?></div>
<?php endforeach; ?>

<div class="form-card">
    <h2>Neue gruppenspezifische Einladung</h2>
    <p class="muted">Mehrfach nutzbar, Ablaufdatum standardmäßig 14 Tage.</p>
    <form method="post">
        <?php echo csrf_field(); ?>
        <input type="hidden" name="action" value="create_invitation">
        <div class="two-col">
            <div>
                <label for="group_id">Gruppe *</label>
                <select id="group_id" name="group_id" required>
                    <?php foreach ($groups as $group): ?>
                        <option value="<?php echo e((string) $group['id']); ?>"><?php echo e((string) $group['name']); ?></option>
                    <?php endforeach; ?>
                </select>
            </div>
            <div>
                <label for="expires_at">Ablaufdatum</label>
                <input id="expires_at" name="expires_at" type="date" value="<?php echo e((string) ($_POST['expires_at'] ?? (new DateTimeImmutable('+14 days'))->format('Y-m-d'))); ?>">
            </div>
        </div>
        <button type="submit">Einladung erzeugen</button>
    </form>
</div>

<div class="grid" style="margin-top:14px">
    <?php foreach ($invites as $invite): ?>
        <?php $link = app_url('invitation.php?t=' . $invite['token']); ?>
        <?php $qrUrl = 'https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=' . rawurlencode($link); ?>
        <?php
        if ($user['role'] === 'geschaeftsstelle') {
            $canDeleteInvite = true;
        } elseif ($user['role'] === 'uebungsleiter') {
            $canDeleteInvite = true;
        } else {
            $canDeleteInvite = ((string) $invite['created_by_role'] === (string) $user['role'])
                && ((int) $invite['created_by_id'] === (int) $user['id']);
        }
        ?>
        <article class="card">
            <h3><?php echo e((string) $invite['group_name']); ?></h3>
            <p>Token: <code><?php echo e((string) $invite['token']); ?></code></p>
            <p>Ablauf: <?php echo e((string) $invite['expires_at']); ?></p>
            <p>Nutzungen: <?php echo e((string) $invite['usage_count']); ?></p>
            <p><a href="<?php echo e($link); ?>" target="_blank" rel="noopener">Einladungslink öffnen</a></p>
            <img class="qr-box" src="<?php echo e($qrUrl); ?>" alt="QR Code">
            
            <?php if ($canDeleteInvite): ?>
                <form method="post" style="margin-top:10px" onsubmit="return confirm('Einladung wirklich löschen?');">
                    <?php echo csrf_field(); ?>
                    <input type="hidden" name="action" value="delete_invitation">
                    <input type="hidden" name="invitation_id" value="<?php echo e((string) $invite['id']); ?>">
                    <button type="submit" class="btn-danger">Einladung löschen</button>
                </form>
            <?php endif; ?>
        </article>
    <?php endforeach; ?>
</div>
<?php render_footer(); ?>