103 lines
3.3 KiB
PHP
103 lines
3.3 KiB
PHP
<?php
|
|
|
|
class ClientRepo
|
|
{
|
|
/**
|
|
* List coaches visible to the caller.
|
|
* Admin: all coaches. Supervisor: only their own coaches.
|
|
*
|
|
* @return list<array{coachID: string, username: string, supervisorID: string, supervisorUsername: ?string}>
|
|
*/
|
|
public static function listCoaches(PDO $pdo, string $callerRole, string $callerEntityID): array
|
|
{
|
|
if ($callerRole === 'admin') {
|
|
return $pdo->query("
|
|
SELECT c.coachID, c.username, c.supervisorID, sv.username AS supervisorUsername
|
|
FROM coach c
|
|
LEFT JOIN supervisor sv ON sv.supervisorID = c.supervisorID
|
|
ORDER BY sv.username, c.username
|
|
")->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
$stmt = $pdo->prepare("
|
|
SELECT c.coachID, c.username, c.supervisorID, sv.username AS supervisorUsername
|
|
FROM coach c
|
|
LEFT JOIN supervisor sv ON sv.supervisorID = c.supervisorID
|
|
WHERE c.supervisorID = :sid
|
|
ORDER BY c.username
|
|
");
|
|
$stmt->execute([':sid' => $callerEntityID]);
|
|
|
|
return $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
/**
|
|
* List clients visible to the caller (RBAC-filtered).
|
|
*
|
|
* @return list<array{clientCode: string, coachID: string, coachUsername: ?string}>
|
|
*/
|
|
public static function listClients(PDO $pdo, array $tokenRecord): array
|
|
{
|
|
[$clause, $params] = rbac_client_filter($tokenRecord);
|
|
|
|
$stmt = $pdo->prepare("
|
|
SELECT cl.clientCode, cl.coachID, co.username AS coachUsername
|
|
FROM client cl
|
|
LEFT JOIN coach co ON co.coachID = cl.coachID
|
|
WHERE $clause
|
|
ORDER BY cl.coachID, cl.clientCode
|
|
");
|
|
foreach ($params as $k => $v) {
|
|
$stmt->bindValue($k, $v);
|
|
}
|
|
$stmt->execute();
|
|
|
|
return $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
/**
|
|
* Re-assign clients to a coach, respecting RBAC.
|
|
*
|
|
* @param list<string> $clientCodes
|
|
* @return int Number of rows actually updated.
|
|
*/
|
|
public static function assignToCoach(PDO $pdo, array $clientCodes, string $coachID, array $tokenRecord): int
|
|
{
|
|
[$rbacClause, $rbacParams] = rbac_client_filter($tokenRecord);
|
|
|
|
$stmt = $pdo->prepare(
|
|
"UPDATE client SET coachID = :cid WHERE clientCode = :cc AND ($rbacClause)"
|
|
);
|
|
$count = 0;
|
|
|
|
foreach ($clientCodes as $cc) {
|
|
$cc = trim($cc);
|
|
if ($cc === '') {
|
|
continue;
|
|
}
|
|
$stmt->execute(array_merge([':cid' => $coachID, ':cc' => $cc], $rbacParams));
|
|
$count += $stmt->rowCount();
|
|
}
|
|
|
|
return $count;
|
|
}
|
|
|
|
/**
|
|
* Check that a coach exists and is visible to the caller.
|
|
*/
|
|
public static function coachExists(PDO $pdo, string $coachID, string $callerRole, string $callerEntityID): bool
|
|
{
|
|
if ($callerRole === 'supervisor') {
|
|
$stmt = $pdo->prepare(
|
|
"SELECT coachID FROM coach WHERE coachID = :cid AND supervisorID = :sid"
|
|
);
|
|
$stmt->execute([':cid' => $coachID, ':sid' => $callerEntityID]);
|
|
} else {
|
|
$stmt = $pdo->prepare("SELECT coachID FROM coach WHERE coachID = :cid");
|
|
$stmt->execute([':cid' => $coachID]);
|
|
}
|
|
|
|
return (bool) $stmt->fetch();
|
|
}
|
|
}
|