<?php
require __DIR__ . '/../../vendor/autoload.php';
$dotenv = Dotenv\Dotenv::createImmutable(__DIR__ . '/..');
$dotenv->safeLoad();

use App\Auth;
use App\Csrf;
Auth::init();
Auth::requireRole('admin');

$pdo = App\Database::getConnection();
$pending = $pdo->query("SELECT id,username,email,full_name,created_at FROM users WHERE status = 'pending' ORDER BY created_at ASC")->fetchAll(PDO::FETCH_ASSOC);
include __DIR__ . '/../header.php';
?>
<h2>Pending Users</h2>
<?php if (empty($pending)): ?>
  <div class="muted">No pending registrations.</div>
<?php else: ?>
  <table style="width:100%;border-collapse:collapse;margin-top:12px">
    <thead>
      <tr>
        <th style="text-align:left;padding:8px;border-bottom:1px solid #eef2f7">Username</th>
        <th style="text-align:left;padding:8px;border-bottom:1px solid #eef2f7">Full name</th>
        <th style="text-align:left;padding:8px;border-bottom:1px solid #eef2f7">Email</th>
        <th style="text-align:left;padding:8px;border-bottom:1px solid #eef2f7">Submitted</th>
        <th style="padding:8px;border-bottom:1px solid #eef2f7">Action</th>
      </tr>
    </thead>
    <tbody>
      <?php foreach($pending as $p): ?>
        <tr>
          <td style="padding:8px;"><?=htmlspecialchars($p['username'])?></td>
          <td style="padding:8px;"><?=htmlspecialchars($p['full_name'])?></td>
          <td style="padding:8px;"><?=htmlspecialchars($p['email'])?></td>
          <td style="padding:8px;"><?=htmlspecialchars($p['created_at'])?></td>
          <td style="padding:8px;">
            <form method="post" action="approve.php" style="display:inline">
              <input type="hidden" name="id" value="<?= (int)$p['id'] ?>">
              <input type="hidden" name="_csrf" value="<?=htmlspecialchars(App\Csrf::token())?>">
              <button class="btn" type="submit">Approve</button>
            </form>
          </td>
        </tr>
      <?php endforeach; ?>
    </tbody>
  </table>
<?php endif; ?>
<?php include __DIR__ . '/../footer.php'; ?>