Spaces:
Running
Running
File size: 5,192 Bytes
c7257f7 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 |
<?php
require_once 'config.php';
// GET all orders (Admin only)
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
require_once 'require_auth.php'; // This now includes admin role checking
$accept = $_SERVER['HTTP_ACCEPT'] ?? '';
$is_html = strpos($accept, 'text/html') !== false || isset($_GET['id']);
$order_id = $_GET['id'] ?? null;
if ($is_html && $order_id) {
// Render HTML order details page
$stmt = $pdo->prepare("SELECT * FROM orders WHERE id = ?");
$stmt->execute([$order_id]);
$order = $stmt->fetch(PDO::FETCH_ASSOC);
if (!$order) {
echo "<h2 style='color:red'>Order not found.</h2>";
exit;
}
$stmt = $pdo->prepare("SELECT * FROM order_items WHERE order_id = ?");
$stmt->execute([$order_id]);
$items = $stmt->fetchAll(PDO::FETCH_ASSOC);
echo "<!DOCTYPE html><html lang='sl'><head><meta charset='utf-8'><title>Podrobnosti naročila #{$order_id}</title><script src='https://cdn.tailwindcss.com'></script></head><body class='bg-amber-50'>";
echo "<div class='max-w-2xl mx-auto my-8 bg-white rounded-lg shadow p-6'>";
echo "<h1 class='text-2xl font-bold mb-4 text-amber-900'>Naročilo #{$order_id}</h1>";
echo "<div class='mb-4'><strong>Stranka:</strong> {$order['customer_name']}<br><strong>Email:</strong> {$order['customer_email']}<br><strong>Naslov:</strong> {$order['customer_address']}<br><strong>Telefon:</strong> {$order['customer_phone']}</div>";
echo "<div class='mb-4'><strong>Status:</strong> {$order['status']}<br><strong>Skupaj:</strong> {$order['total_amount']} €<br><strong>Datum:</strong> {$order['created_at']}</div>";
echo "<h2 class='text-xl font-semibold mb-2 text-amber-800'>Izdelki</h2>";
echo "<table class='w-full border'><thead><tr class='bg-amber-100'><th class='p-2 text-left'>Izdelek</th><th class='p-2 text-right'>Količina</th><th class='p-2 text-right'>Cena</th></tr></thead><tbody>";
foreach ($items as $item) {
echo "<tr><td class='p-2'>{$item['product_name']}</td><td class='p-2 text-right'>{$item['quantity']}</td><td class='p-2 text-right'>{$item['total_price']} €</td></tr>";
}
echo "</tbody></table>";
echo "<div class='mt-6'><a href='backend.php' class='bg-amber-700 text-white px-4 py-2 rounded'>Nazaj na nadzorno ploščo</a></div>";
echo "</div></body></html>";
exit;
}
// Default: return all orders as JSON (API)
$stmt = $pdo->query("SELECT * FROM orders");
$orders = $stmt->fetchAll(PDO::FETCH_ASSOC);
foreach($orders as &$order) {
$stmt = $pdo->prepare("SELECT * FROM order_items WHERE order_id = ?");
$stmt->execute([$order['id']]);
$order['items'] = $stmt->fetchAll(PDO::FETCH_ASSOC);
}
header('Content-Type: application/json; charset=utf-8');
echo json_encode($orders);
}
// POST create new order
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$data = json_decode(file_get_contents("php://input"));
// Start transaction
$pdo->beginTransaction();
try {
// Create order
$stmt = $pdo->prepare("INSERT INTO orders (customer_name, customer_email, customer_address, total_amount, status) VALUES (?, ?, ?, ?, ?)");
$stmt->execute([
$data->customer->name,
$data->customer->email,
$data->customer->address,
$data->total,
'pending'
]);
$order_id = $pdo->lastInsertId();
// Add order items
foreach($data->items as $item) {
$stmt = $pdo->prepare("INSERT INTO order_items (order_id, product_id, product_name, quantity, unit_price) VALUES (?, ?, ?, ?, ?)");
$stmt->execute([
$order_id,
$item->product_id,
$item->product_name,
$item->quantity,
$item->unit_price
]);
// Update product stock
$stmt = $pdo->prepare("UPDATE products SET stock = stock - ? WHERE id = ?");
$stmt->execute([$item->quantity, $item->product_id]);
}
// Commit transaction
$pdo->commit();
http_response_code(201);
echo json_encode(array("success" => true, "order_id" => $order_id));
} catch(Exception $e) {
// Rollback on error
$pdo->rollBack();
http_response_code(500);
echo json_encode(array("success" => false, "message" => $e->getMessage()));
}
}
// UPDATE order status (Admin only)
if ($_SERVER['REQUEST_METHOD'] === 'PUT') {
require_once 'require_auth.php'; // This now includes admin role checking
$data = json_decode(file_get_contents("php://input"));
$id = $_GET['id'] ?? null;
if($id) {
$stmt = $pdo->prepare("UPDATE orders SET status = ? WHERE id = ?");
$stmt->execute([$data->status, $id]);
echo json_encode(array("success" => true, "message" => "Order updated"));
} else {
http_response_code(400);
echo json_encode(array("success" => false, "message" => "Order ID required"));
}
}
?> |