85 lines
3.7 KiB
PHP
85 lines
3.7 KiB
PHP
<?php
|
|
/**
|
|
* UsuarioController.php — CRUD de usuarios
|
|
*/
|
|
declare(strict_types=1);
|
|
require_once __DIR__ . '/../config/config.php';
|
|
require_once __DIR__ . '/../controllers/AuthController.php';
|
|
require_once __DIR__ . '/../models/Usuario.php';
|
|
|
|
AuthController::requerirAdmin();
|
|
|
|
$model = new UsuarioModel();
|
|
$action = $_GET['action'] ?? $_POST['action'] ?? '';
|
|
$userId = (int)$_SESSION['usuario_id'];
|
|
|
|
switch ($action) {
|
|
|
|
case 'crear':
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') redirect(APP_URL.'/views/usuarios/lista.php');
|
|
verificarCsrf();
|
|
|
|
$datos = [
|
|
'nombre' => clean($_POST['nombre'] ?? ''),
|
|
'apellido' => clean($_POST['apellido'] ?? ''),
|
|
'email' => clean($_POST['email'] ?? ''),
|
|
'username' => clean($_POST['username'] ?? ''),
|
|
'password' => $_POST['password'] ?? '',
|
|
'rol_id' => (int)($_POST['rol_id'] ?? 3),
|
|
'cargo' => clean($_POST['cargo'] ?? ''),
|
|
'area' => clean($_POST['area'] ?? ''),
|
|
'supervisor_id' => (int)($_POST['supervisor_id'] ?? 0) ?: null,
|
|
];
|
|
|
|
if (empty($datos['nombre']) || empty($datos['email']) || empty($datos['username']) || strlen($datos['password']) < 8) {
|
|
redirect(APP_URL.'/views/usuarios/lista.php?error='.urlencode('Complete todos los campos requeridos (contraseña mínima 8 chars).'));
|
|
}
|
|
|
|
try {
|
|
$model->crear($datos);
|
|
logAct($userId, 'crear_usuario', 'usuarios', "Usuario {$datos['username']} creado.");
|
|
redirect(APP_URL.'/views/usuarios/lista.php?success='.urlencode('Usuario creado exitosamente.'));
|
|
} catch (\PDOException $e) {
|
|
redirect(APP_URL.'/views/usuarios/lista.php?error='.urlencode('El email o usuario ya existe.'));
|
|
}
|
|
|
|
case 'actualizar':
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') redirect(APP_URL.'/views/usuarios/lista.php');
|
|
verificarCsrf();
|
|
$id = (int)($_POST['id'] ?? 0);
|
|
$datos = [
|
|
'nombre' => clean($_POST['nombre'] ?? ''),
|
|
'apellido' => clean($_POST['apellido'] ?? ''),
|
|
'email' => clean($_POST['email'] ?? ''),
|
|
'username' => clean($_POST['username'] ?? ''),
|
|
'rol_id' => (int)($_POST['rol_id'] ?? 3),
|
|
'cargo' => clean($_POST['cargo'] ?? ''),
|
|
'area' => clean($_POST['area'] ?? ''),
|
|
'supervisor_id' => (int)($_POST['supervisor_id'] ?? 0) ?: null,
|
|
'activo' => isset($_POST['activo']) ? 1 : 0,
|
|
];
|
|
$model->actualizar($id, $datos);
|
|
if (!empty($_POST['password']) && strlen($_POST['password']) >= 8) {
|
|
$model->actualizarPassword($id, password_hash($_POST['password'], PASSWORD_BCRYPT, ['cost' => 12]));
|
|
}
|
|
logAct($userId, 'editar_usuario', 'usuarios', "Usuario #$id actualizado.");
|
|
redirect(APP_URL.'/views/usuarios/lista.php?success='.urlencode('Usuario actualizado.'));
|
|
|
|
case 'eliminar':
|
|
$id = (int)($_GET['id'] ?? 0);
|
|
if ($id && $id !== $userId) {
|
|
$model->eliminarLogico($id);
|
|
logAct($userId, 'eliminar_usuario', 'usuarios', "Usuario #$id desactivado.");
|
|
}
|
|
redirect(APP_URL.'/views/usuarios/lista.php?success='.urlencode('Usuario desactivado.'));
|
|
|
|
default:
|
|
redirect(APP_URL.'/views/usuarios/lista.php');
|
|
}
|
|
|
|
function logAct(int $uid, string $accion, string $modulo, string $desc = ''): void {
|
|
$db = getDB();
|
|
$db->prepare("INSERT INTO log_actividad(usuario_id,accion,modulo,descripcion,ip_address) VALUES(?,?,?,?,?)")
|
|
->execute([$uid, $accion, $modulo, $desc, $_SERVER['REMOTE_ADDR']??null]);
|
|
}
|