process_create_user.php

<?php
session_start();

/* =========================
   SECURITY CHECK
========================= */
if (!isset($_SESSION['id']) || $_SESSION['role'] !== 'admin') {
    die("Access Denied: Only admins can create users.");
}

require "config.php";

/* =========================
   COLLECT INPUT
========================= */
$full_name  = trim($_POST['full_name'] ?? '');
$username   = trim($_POST['username'] ?? '');
$password   = $_POST['password'] ?? '';
$role       = $_POST['role'] ?? '';

$reg_number = trim($_POST['reg_number'] ?? '');
$student_id = trim($_POST['student_id'] ?? '');

/* =========================
   BASIC VALIDATION
========================= */
if (!$full_name || !$username || !$password || !$role) {
    die("All required fields must be filled.");
}

/* =========================
   ROLE-BASED VALIDATION
========================= */
if ($role === 'student') {

    if (!$reg_number || !$student_id) {
        die("Students must have a Registration Number and Student ID.");
    }

} elseif ($role === 'teacher') {

    // Teachers ONLY need basic user info
    $reg_number = NULL;
    $student_id = NULL;

} elseif ($role === 'admin') {

    $reg_number = NULL;
    $student_id = NULL;

} else {
    die("Invalid role selected.");
}

/* =========================
   PASSWORD HASH
========================= */
$hashed_password = password_hash($password, PASSWORD_DEFAULT);

try {

    /* =========================
       START TRANSACTION
    ========================= */
    $pdo->beginTransaction();

    /* =========================
       INSERT USER (NO staff_id)
    ========================= */
    $stmt = $pdo->prepare("
        INSERT INTO users (
            full_name,
            username,
            password_hash,
            role,
            reg_number,
            student_id
        ) VALUES (
            :full_name,
            :username,
            :password_hash,
            :role,
            :reg_number,
            :student_id
        )
    ");

    $stmt->execute([
        ':full_name'     => $full_name,
        ':username'      => $username,
        ':password_hash' => $hashed_password,
        ':role'          => $role,
        ':reg_number'    => $reg_number ?: NULL,
        ':student_id'    => $student_id ?: NULL
    ]);

    $user_id = (int) $pdo->lastInsertId();

    /* =========================
       AUTO CREATE TEACHER PROFILE
       (teachers.user_id = users.id)
    ========================= */
    if ($role === 'teacher') {

        $nameParts  = explode(' ', $full_name, 2);
        $first_name = $nameParts[0];
        $last_name  = $nameParts[1] ?? '';

        $stmt = $pdo->prepare("
            INSERT INTO teachers (
                user_id,
                first_name,
                last_name,
                created_at
            ) VALUES (?, ?, ?, NOW())
        ");

        $stmt->execute([
            $user_id,
            $first_name,
            $last_name
        ]);
    }

    /* =========================
       COMMIT
    ========================= */
    $pdo->commit();

    echo "<script>
        alert('User created successfully!');
        window.location.href='create_user.php';
    </script>";

} catch (PDOException $e) {

    $pdo->rollBack();

    if ($e->getCode() == 23000) {
        echo "<script>
            alert('Duplicate entry: Username, Registration Number, or Student ID already exists.');
            history.back();
        </script>";
    } else {
        echo 'Database Error: ' . $e->getMessage();
    }
}