new system prototype

2026-04-15 10:19:42 +02:00
parent e805f225bc
commit 034b108c7e
80 changed files with 12212 additions and 890 deletions
--- a/lib/repositories/ClientRepo.php
+++ b/lib/repositories/ClientRepo.php
@ -0,0 +1,102 @@
+<?php
+
+class ClientRepo
+{
+    /**
+     * List coaches visible to the caller.
+     * Admin: all coaches. Supervisor: only their own coaches.
+     *
+     * @return list<array{coachID: string, username: string, supervisorID: string, supervisorUsername: ?string}>
+     */
+    public static function listCoaches(PDO $pdo, string $callerRole, string $callerEntityID): array
+    {
+        if ($callerRole === 'admin') {
+            return $pdo->query("
+                SELECT c.coachID, c.username, c.supervisorID, sv.username AS supervisorUsername
+                FROM coach c
+                LEFT JOIN supervisor sv ON sv.supervisorID = c.supervisorID
+                ORDER BY sv.username, c.username
+            ")->fetchAll(PDO::FETCH_ASSOC);
+        }
+
+        $stmt = $pdo->prepare("
+            SELECT c.coachID, c.username, c.supervisorID, sv.username AS supervisorUsername
+            FROM coach c
+            LEFT JOIN supervisor sv ON sv.supervisorID = c.supervisorID
+            WHERE c.supervisorID = :sid
+            ORDER BY c.username
+        ");
+        $stmt->execute([':sid' => $callerEntityID]);
+
+        return $stmt->fetchAll(PDO::FETCH_ASSOC);
+    }
+
+    /**
+     * List clients visible to the caller (RBAC-filtered).
+     *
+     * @return list<array{clientCode: string, coachID: string, coachUsername: ?string}>
+     */
+    public static function listClients(PDO $pdo, array $tokenRecord): array
+    {
+        [$clause, $params] = rbac_client_filter($tokenRecord);
+
+        $stmt = $pdo->prepare("
+            SELECT cl.clientCode, cl.coachID, co.username AS coachUsername
+            FROM client cl
+            LEFT JOIN coach co ON co.coachID = cl.coachID
+            WHERE $clause
+            ORDER BY cl.coachID, cl.clientCode
+        ");
+        foreach ($params as $k => $v) {
+            $stmt->bindValue($k, $v);
+        }
+        $stmt->execute();
+
+        return $stmt->fetchAll(PDO::FETCH_ASSOC);
+    }
+
+    /**
+     * Re-assign clients to a coach, respecting RBAC.
+     *
+     * @param list<string> $clientCodes
+     * @return int Number of rows actually updated.
+     */
+    public static function assignToCoach(PDO $pdo, array $clientCodes, string $coachID, array $tokenRecord): int
+    {
+        [$rbacClause, $rbacParams] = rbac_client_filter($tokenRecord);
+
+        $stmt = $pdo->prepare(
+            "UPDATE client SET coachID = :cid WHERE clientCode = :cc AND ($rbacClause)"
+        );
+        $count = 0;
+
+        foreach ($clientCodes as $cc) {
+            $cc = trim($cc);
+            if ($cc === '') {
+                continue;
+            }
+            $stmt->execute(array_merge([':cid' => $coachID, ':cc' => $cc], $rbacParams));
+            $count += $stmt->rowCount();
+        }
+
+        return $count;
+    }
+
+    /**
+     * Check that a coach exists and is visible to the caller.
+     */
+    public static function coachExists(PDO $pdo, string $coachID, string $callerRole, string $callerEntityID): bool
+    {
+        if ($callerRole === 'supervisor') {
+            $stmt = $pdo->prepare(
+                "SELECT coachID FROM coach WHERE coachID = :cid AND supervisorID = :sid"
+            );
+            $stmt->execute([':cid' => $coachID, ':sid' => $callerEntityID]);
+        } else {
+            $stmt = $pdo->prepare("SELECT coachID FROM coach WHERE coachID = :cid");
+            $stmt->execute([':cid' => $coachID]);
+        }
+
+        return (bool) $stmt->fetch();
+    }
+}