<?php
require __DIR__ . '/_bootstrap.php';
$search = trim($_GET['q'] ?? '');
if ($search !== '') {
  $like = '%' . $search . '%';
  $stmt = $pdo->prepare("SELECT * FROM students WHERE first_name LIKE ? OR last_name LIKE ? OR student_number LIKE ? ORDER BY id DESC");
  $stmt->execute([$like, $like, $like]);
  $rows = $stmt->fetchAll();
} else {
  $rows = $pdo->query("SELECT * FROM students ORDER BY id DESC")->fetchAll();
}
include __DIR__ . '/_header.php';

?>
<?php
// Ensure a CSRF token exists for this session
if (empty($_SESSION['csrf_token']) && empty($_SESSION['csrf'])) {
  $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$csrf = $_SESSION['csrf_token'] ?? $_SESSION['csrf'];
?>

<div class="page-header">
  <h1>Students</h1>
  <a class="btn btn-primary" href="<?php echo url_for('/admin/student_add.php'); ?>">+ Add Student</a>
</div>

<div class="card" style="margin-bottom:12px">
  <form method="get" class="searchbar" action="<?php echo url_for('/admin/students.php'); ?>">
    <div class="search-input">
      <!-- magnifying glass icon -->
      <svg class="search-icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
        <circle cx="11" cy="11" r="7"></circle>
        <line x1="21" y1="21" x2="16.65" y2="16.65"></line>
      </svg>
      <input
        type="text"
        name="q"
        value="<?php echo htmlspecialchars($search); ?>"
        placeholder="Search by name or student number"
        aria-label="Search students"
      >
    </div>

    <div class="search-actions">
      <?php if ($search !== ''): ?>
        <a class="btn btn-secondary" href="<?php echo url_for('/admin/students.php'); ?>">Clear</a>
      <?php endif; ?>
      <button class="btn btn-primary" type="submit">Filter</button>
    </div>
  </form>
</div>


<div class="card">
  <table class="data-table">
    <thead><tr>
        <th>ID</th>
        <th>Student #</th>
        <th>Name</th>
        <th>Email</th>
        <th>Document</th>
        <th>Actions</th>
        </tr></thead>
    <tbody>
      <?php foreach ($rows as $r): ?>
        <tr>
          <td><?php echo htmlspecialchars($r['id_number']); ?></td>
          <td><?php echo htmlspecialchars($r['student_number']); ?></td>
          <td><?php echo htmlspecialchars($r['first_name'] . ' ' . $r['last_name']); ?></td>
          <td><?php echo htmlspecialchars($r['email']); ?></td>
          
<td>
  <?php
    $t = trim($r['document_text'] ?? '');
    if ($t === '') { echo '—'; }
    else {
      $snippet = mb_substr($t, 0, 60);
      if (mb_strlen($t) > 60) $snippet .= '…';
      echo htmlspecialchars($snippet);
    }
  ?>
</td>
          
          <!--<td class="actions">-->
          <!--  <a href="<?php echo url_for('/admin/student_view.php?id=' . $r['id']); ?>">View</a>-->
          <!--  <a href="<?php echo url_for('/admin/student_edit.php?id=' . $r['id']); ?>">Edit</a>-->
          <!--</td>-->

<td class="actions-cell">
  <a class="chip chip-view" href="student_view.php?id=<?php echo (int)$r['id']; ?>">View</a>
  <a class="chip chip-edit" href="student_edit.php?id=<?php echo (int)$r['id']; ?>">Edit</a>
  <button type="button" 
          class="chip chip-danger js-delete"
          data-id="<?php echo (int)$r['id']; ?>"
          data-name="<?php echo htmlspecialchars($r['first_name'].' '.$r['last_name']); ?>">
    Delete
  </button>
</td>

          
        </tr>
      <?php endforeach; ?>
    </tbody>
  </table>
</div>
<div id="confirmModal" class="modal hidden">
  <div class="modal-content card">
    <h3 class="card-title">Confirm Deletion</h3>
    <p id="confirmText">Are you sure?</p>
    <form id="deleteForm" method="post" action="<?php echo url_for('/admin/student_delete_handler.php'); ?>" class="actions-bar">
      <input type="hidden" name="id" id="deleteId">
      <input type="hidden" name="csrf" value="<?php echo htmlspecialchars($csrf, ENT_QUOTES, 'UTF-8'); ?>">
      <button type="button" class="btn" id="cancelBtn">Cancel</button>
      <button type="submit" class="btn-primary" style="background:#dc2626;border-color:#dc2626">Delete</button>
    </form>
  </div>
</div>


<?php include __DIR__ . '/_footer.php'; ?>
<script src="/public/js/delete-modal.js" defer></script>

