profile.php

<?php

declare(strict_types=1);

require_once __DIR__ . '/bootstrap.php';

$user = require_login();
$pdo = db();
$config = role_config((string) $user['role']);
if ($config === null) {
    http_response_code(400);
    exit('Unbekannte Rolle.');
}

$table = $config['table'];
$errors = [];

$commonFields = ['first_name', 'last_name', 'birthdate', 'street', 'zip', 'city', 'mobile', 'email', 'notes'];
$extraFields = [];
if (in_array($user['role'], ['sportler', 'assistent'], true)) {
    $extraFields = ['mother_name', 'mother_mobile', 'father_name', 'father_mobile'];
}
$editable = array_merge($commonFields, $extraFields);
if ($user['role'] === 'sportler') {
    $editable[] = 'turn_id';
}

if (request_is_post()) {
    verify_csrf_or_fail();

    $data = [];
    foreach ($editable as $field) {
        $data[$field] = trim((string) ($_POST[$field] ?? ''));
        if ($data[$field] === '') {
            $data[$field] = null;
        }
    }

    if (($data['first_name'] ?? null) === null || ($data['last_name'] ?? null) === null || ($data['birthdate'] ?? null) === null) {
        $errors[] = 'Vorname, Nachname und Geburtsdatum sind Pflicht.';
    }
    if ($user['role'] === 'sportler' && ($data['turn_id'] ?? null) !== null && !is_valid_turn_id((string) $data['turn_id'])) {
        $errors[] = 'TurnID ist ungültig. Erlaubt sind 1-16 Zeichen [A-Za-z0-9].';
    }
    if ($user['role'] === 'sportler' && ($data['turn_id'] ?? null) !== null) {
        $dupStmt = $pdo->prepare(sprintf('SELECT id FROM %s WHERE turn_id = :turn_id AND id <> :id LIMIT 1', $table));
        $dupStmt->execute([
            'turn_id' => $data['turn_id'],
            'id' => $user['id'],
        ]);
        if ($dupStmt->fetchColumn()) {
            $errors[] = 'TurnID ist bereits vergeben.';
        }
    }

    if ($errors === []) {
        $setSql = [];
        foreach ($editable as $field) {
            $setSql[] = "{$field} = :{$field}";
        }

        $sql = sprintf('UPDATE %s SET %s WHERE id = :id', $table, implode(', ', $setSql));
        $stmt = $pdo->prepare($sql);
        $stmt->execute(array_merge($data, ['id' => $user['id']]));

        audit_log('update', 'profile_' . $user['role'], (int) $user['id']);
        set_flash('success', 'Profil gespeichert.');
        redirect('profile.php');
    }
}

$user = require_login();

render_header('Profil', $user);
?>
<div class="profile-page">
    <div class="form-card profile-main">
        <h2>Eigene Daten</h2>
        <p class="muted">Hier kannst du deine persönlichen Daten und Kontaktdaten übersichtlich pflegen.</p>

        <?php foreach ($errors as $error): ?>
            <div class="flash flash-error"><?php echo e($error); ?></div>
        <?php endforeach; ?>

        <form method="post" class="profile-form">
            <?php echo csrf_field(); ?>

            <section class="profile-section">
                <h3 class="profile-section-title">Basisdaten</h3>
                <div class="two-col">
                    <div>
                        <label for="first_name">Vorname *</label>
                        <input id="first_name" name="first_name" value="<?php echo e((string) $user['first_name']); ?>" required>
                    </div>
                    <div>
                        <label for="last_name">Nachname *</label>
                        <input id="last_name" name="last_name" value="<?php echo e((string) $user['last_name']); ?>" required>
                    </div>
                    <div>
                        <label for="birthdate">Geburtsdatum *</label>
                        <input id="birthdate" name="birthdate" type="date" value="<?php echo e((string) $user['birthdate']); ?>" required>
                    </div>
                    <?php if ($user['role'] === 'sportler'): ?>
                        <div>
                            <label for="turn_id">TurnID</label>
                            <input id="turn_id" name="turn_id" value="<?php echo e((string) ($user['turn_id'] ?? '')); ?>" maxlength="16">
                            <small>Optional. Nur Zeichen und Zahlen, max. 16.</small>
                        </div>
                    <?php endif; ?>
                </div>
            </section>

            <section class="profile-section profile-readonly">
                <h3 class="profile-section-title">Konto</h3>
                <div class="two-col">
                    <?php if ($user['role'] !== 'geschaeftsstelle'): ?>
                        <div>
                            <label>VereinsMitgliedsID</label>
                            <input value="<?php echo e((string) ($user['club_member_id'] ?? '')); ?>" readonly>
                            <small>Kann nur durch Geschäftsstelle gesetzt werden.</small>
                        </div>
                    <?php else: ?>
                        <div>
                            <label>Rolle</label>
                            <input value="Geschäftsstelle" readonly>
                        </div>
                    <?php endif; ?>
                </div>
            </section>

            <section class="profile-section">
                <h3 class="profile-section-title">Kontakt und Adresse</h3>
                <div class="two-col">
                    <div>
                        <label for="street">Straße + Hausnummer</label>
                        <input id="street" name="street" value="<?php echo e((string) ($user['street'] ?? '')); ?>">
                    </div>
                    <div>
                        <label for="zip">PLZ</label>
                        <input id="zip" name="zip" value="<?php echo e((string) ($user['zip'] ?? '')); ?>">
                    </div>
                    <div>
                        <label for="city">Ort</label>
                        <input id="city" name="city" value="<?php echo e((string) ($user['city'] ?? '')); ?>">
                    </div>
                    <div>
                        <label for="mobile">Mobilnummer</label>
                        <input id="mobile" name="mobile" value="<?php echo e((string) ($user['mobile'] ?? '')); ?>">
                    </div>
                    <div>
                        <label for="email">E-Mail</label>
                        <input id="email" name="email" type="email" value="<?php echo e((string) ($user['email'] ?? '')); ?>">
                    </div>
                </div>
            </section>

            <?php if (in_array($user['role'], ['sportler', 'assistent'], true)): ?>
                <section class="profile-section">
                    <h3 class="profile-section-title">Elternkontakte (optional)</h3>
                    <div class="two-col">
                        <div>
                            <label for="mother_name">Mama Name</label>
                            <input id="mother_name" name="mother_name" value="<?php echo e((string) ($user['mother_name'] ?? '')); ?>">
                        </div>
                        <div>
                            <label for="mother_mobile">Mama Handy</label>
                            <input id="mother_mobile" name="mother_mobile" value="<?php echo e((string) ($user['mother_mobile'] ?? '')); ?>">
                        </div>
                        <div>
                            <label for="father_name">Papa Name</label>
                            <input id="father_name" name="father_name" value="<?php echo e((string) ($user['father_name'] ?? '')); ?>">
                        </div>
                        <div>
                            <label for="father_mobile">Papa Handy</label>
                            <input id="father_mobile" name="father_mobile" value="<?php echo e((string) ($user['father_mobile'] ?? '')); ?>">
                        </div>
                    </div>
                </section>
            <?php endif; ?>

            <section class="profile-section">
                <h3 class="profile-section-title">Bemerkungen</h3>
                <label for="notes">Notizen</label>
                <textarea id="notes" name="notes"><?php echo e((string) ($user['notes'] ?? '')); ?></textarea>
            </section>

            <div class="profile-actions">
                <button type="submit">Profil speichern</button>
            </div>
        </form>
    </div>
</div>
<?php render_footer(); ?>