<?php
// Filename: update_admin.php
require 'config.php';
requireLogin(); // SECURITY FIX: Force Login

// SECURITY FIX: Only Admins can access
if ($_SESSION['role'] !== 'admin') {
    die("Access Denied. Admins only.");
}

$msg = '';
$msg_type = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $new_ic = trim($_POST['new_ic']);
    
    if (empty($new_ic)) {
        $msg = "Please enter a valid IC Number.";
        $msg_type = "danger";
    } else {
        try {
            // Check collision
            $check = $pdo->prepare("SELECT id FROM users WHERE username = ?");
            $check->execute([$new_ic]);
            
            if ($check->fetch()) {
                $msg = "Error: This IC Number is already in use.";
                $msg_type = "danger";
            } else {
                // Update current user (assuming the logged-in admin is changing their own ID)
                // OR update the specific 'admin' generic account if it exists
                $target_user = $_SESSION['user_id'];
                
                $stmt = $pdo->prepare("UPDATE users SET username = ? WHERE id = ?");
                $stmt->execute([$new_ic, $target_user]);
                
                if ($stmt->rowCount() > 0) {
                    $msg = "Success! Your Login ID is now <strong>$new_ic</strong>.";
                    $msg_type = "success";
                } else {
                    $msg = "No changes made.";
                    $msg_type = "warning";
                }
            }
        } catch (PDOException $e) {
            $msg = "Database Error: " . $e->getMessage();
            $msg_type = "danger";
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Update Admin ID</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light d-flex align-items-center min-vh-100">
    <div class="container">
        <div class="row justify-content-center">
            <div class="col-md-6">
                <div class="card shadow p-4">
                    <h4 class="mb-3">Update Login ID</h4>
                    <p class="text-muted">Change your username (IC Number) for security.</p>
                    
                    <?php if($msg): ?>
                        <div class="alert alert-<?= $msg_type ?>"><?= $msg ?></div>
                    <?php endif; ?>

                    <form method="POST">
                        <div class="mb-3">
                            <label class="form-label fw-bold">New IC Number</label>
                            <input type="text" name="new_ic" class="form-control form-control-lg" placeholder="e.g. 880102115566" required>
                        </div>
                        <button type="submit" class="btn btn-primary w-100 btn-lg">Update ID</button>
                    </form>
                    
                    <div class="mt-3 text-center">
                        <a href="admin_dashboard.php">Back to Dashboard</a>
                    </div>
                </div>
            </div>
        </div>
    </div>
</body>
</html>