100 lines
3.5 KiB
PHP
100 lines
3.5 KiB
PHP
<?php
|
|
|
|
$tokenRec = require_valid_token_web();
|
|
|
|
$callerRole = $tokenRec['role'];
|
|
$callerEntityID = $tokenRec['entityID'] ?? '';
|
|
|
|
switch ($method) {
|
|
|
|
case 'GET':
|
|
try {
|
|
[$pdo, $tmpDb, $lockFp] = qdb_open_read_or_fail();
|
|
|
|
if ($callerRole === 'admin') {
|
|
$coaches = $pdo->query(
|
|
"SELECT c.coachID, c.username, c.supervisorID, sv.username AS supervisorUsername
|
|
FROM coach c
|
|
LEFT JOIN supervisor sv ON sv.supervisorID = c.supervisorID
|
|
ORDER BY sv.username, c.username"
|
|
)->fetchAll(PDO::FETCH_ASSOC);
|
|
} else {
|
|
$stmt = $pdo->prepare(
|
|
"SELECT c.coachID, c.username, c.supervisorID, sv.username AS supervisorUsername
|
|
FROM coach c
|
|
LEFT JOIN supervisor sv ON sv.supervisorID = c.supervisorID
|
|
WHERE c.supervisorID = :sid ORDER BY c.username"
|
|
);
|
|
$stmt->execute([':sid' => $callerEntityID]);
|
|
$coaches = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
[$clause, $params] = rbac_client_filter($tokenRec, 'cl');
|
|
$clientStmt = $pdo->prepare(
|
|
"SELECT cl.clientCode, cl.coachID, co.username AS coachUsername
|
|
FROM client cl
|
|
LEFT JOIN coach co ON co.coachID = cl.coachID
|
|
WHERE $clause
|
|
ORDER BY cl.coachID, cl.clientCode"
|
|
);
|
|
foreach ($params as $k => $v) $clientStmt->bindValue($k, $v);
|
|
$clientStmt->execute();
|
|
$clients = $clientStmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
qdb_discard($tmpDb, $lockFp);
|
|
json_success(['coaches' => $coaches, 'clients' => $clients]);
|
|
} catch (Throwable $e) {
|
|
qdb_handler_fail($e, 'assignments', null, $tmpDb ?? null, $lockFp ?? null);
|
|
}
|
|
break;
|
|
|
|
case 'POST':
|
|
$body = read_json_body();
|
|
$clientCodes = $body['clientCodes'] ?? [];
|
|
$coachID = trim($body['coachID'] ?? '');
|
|
|
|
if (empty($clientCodes) || $coachID === '') {
|
|
json_error('MISSING_FIELDS', 'clientCodes and coachID are required', 400);
|
|
}
|
|
if (!is_array($clientCodes)) $clientCodes = [$clientCodes];
|
|
|
|
try {
|
|
[$pdo, $tmpDb, $lockFp] = qdb_open_write_or_fail();
|
|
|
|
if ($callerRole === 'supervisor') {
|
|
$chk = $pdo->prepare("SELECT coachID FROM coach WHERE coachID = :cid AND supervisorID = :sid");
|
|
$chk->execute([':cid' => $coachID, ':sid' => $callerEntityID]);
|
|
} else {
|
|
$chk = $pdo->prepare("SELECT coachID FROM coach WHERE coachID = :cid");
|
|
$chk->execute([':cid' => $coachID]);
|
|
}
|
|
if (!$chk->fetch()) {
|
|
qdb_discard($tmpDb, $lockFp);
|
|
json_error('NOT_FOUND', 'Counselor not found or not authorized', 404);
|
|
}
|
|
|
|
[$rbacClause, $rbacParams] = rbac_client_filter($tokenRec);
|
|
$pdo->beginTransaction();
|
|
$updStmt = $pdo->prepare(
|
|
"UPDATE client SET coachID = :cid WHERE clientCode = :cc AND ($rbacClause)"
|
|
);
|
|
$count = 0;
|
|
foreach ($clientCodes as $cc) {
|
|
$cc = trim($cc);
|
|
if ($cc === '') continue;
|
|
$updStmt->execute(array_merge([':cid' => $coachID, ':cc' => $cc], $rbacParams));
|
|
$count += $updStmt->rowCount();
|
|
}
|
|
$pdo->commit();
|
|
qdb_save($tmpDb, $lockFp);
|
|
|
|
json_success(['assigned' => $count]);
|
|
} catch (Throwable $e) {
|
|
qdb_handler_fail($e, 'assignments', $pdo ?? null, $tmpDb ?? null, $lockFp ?? null);
|
|
}
|
|
break;
|
|
|
|
default:
|
|
json_error('METHOD_NOT_ALLOWED', 'Method not allowed', 405);
|
|
}
|