deskhub/DeskHub-Webseite/staff/organizations.php

<?php
require_once __DIR__ . '/../includes/bootstrap.php';
$admin = require_admin_or_permission('manage_organizations');
$pdo = get_db();

$errors = [];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    verify_csrf();
    $action = $_POST['action'] ?? '';

    if ($action === 'create' || $action === 'update') {
        $name = trim($_POST['name'] ?? '');
        $notes = trim($_POST['notes'] ?? '');

        if ($name === '') $errors[] = 'Bitte einen Namen angeben.';

        if (!$errors) {
            if ($action === 'create') {
                $pdo->prepare('INSERT INTO organizations (name, notes, created_at) VALUES (?,?,?)')
                    ->execute([$name, $notes, db_now()]);
                audit_log($admin['id'], "Organisation erstellt: {$name}");
                flash('success', 'Organisation erstellt.');
            } else {
                $id = (int) $_POST['id'];
                $pdo->prepare('UPDATE organizations SET name=?, notes=? WHERE id=?')->execute([$name, $notes, $id]);
                audit_log($admin['id'], "Organisation aktualisiert: {$name}");
                flash('success', 'Organisation aktualisiert.');
            }
            redirect('/staff/organizations.php');
        }
    }

    if ($action === 'delete') {
        $id = (int) $_POST['id'];
        $pdo->prepare('UPDATE users SET organization_id = NULL WHERE organization_id = ?')->execute([$id]);
        $pdo->prepare('DELETE FROM organizations WHERE id = ?')->execute([$id]);
        audit_log($admin['id'], "Organisation gelöscht: #{$id}");
        flash('success', 'Organisation gelöscht.');
        redirect('/staff/organizations.php');
    }
}

$organizations = $pdo->query(
    'SELECT o.*, (SELECT COUNT(*) FROM users u WHERE u.organization_id = o.id) AS member_count
     FROM organizations o ORDER BY o.name'
)->fetchAll();

$editId = $_GET['edit'] ?? null;
$editOrg = null;
$members = [];
if ($editId) {
    $stmt = $pdo->prepare('SELECT * FROM organizations WHERE id = ?');
    $stmt->execute([$editId]);
    $editOrg = $stmt->fetch();
    if ($editOrg) {
        $stmt = $pdo->prepare('SELECT id, name, email FROM users WHERE organization_id = ? ORDER BY name');
        $stmt->execute([$editId]);
        $members = $stmt->fetchAll();
    }
}

$pageTitle = 'Organisationen';
$activePage = 'organizations';
require __DIR__ . '/_header.php';
?>

<h1>Kunden-Organisationen</h1>
<p class="muted">Bündeln Sie mehrere Kundenkonten unter einer Firma/Organisation. Kontakte werden unter „Kunden“ zugeordnet.</p>

<?php foreach ($errors as $err): ?>
  <div class="flash error"><?= e($err) ?></div>
<?php endforeach; ?>

<div style="display:flex; gap:24px; align-items:flex-start">
  <div style="flex:2">
    <div class="card">
      <table>
        <thead><tr><th>Name</th><th>Kontakte</th><th></th></tr></thead>
        <tbody>
          <?php foreach ($organizations as $o): ?>
            <tr>
              <td><?= e($o['name']) ?></td>
              <td><?= (int) $o['member_count'] ?></td>
              <td>
                <a href="/staff/organizations.php?edit=<?= $o['id'] ?>">Bearbeiten</a> ·
                <form method="post" style="display:inline" onsubmit="return confirm('Organisation wirklich löschen? Zugeordnete Kunden bleiben erhalten, verlieren aber die Zuordnung.');">
                  <?= csrf_field() ?>
                  <input type="hidden" name="action" value="delete">
                  <input type="hidden" name="id" value="<?= $o['id'] ?>">
                  <button type="submit" style="background:none;border:none;color:#dc2626;cursor:pointer;padding:0;font-size:.9rem">Löschen</button>
                </form>
              </td>
            </tr>
          <?php endforeach; ?>
          <?php if (!$organizations): ?>
            <tr><td colspan="3" class="muted">Noch keine Organisationen angelegt.</td></tr>
          <?php endif; ?>
        </tbody>
      </table>
    </div>

    <?php if ($editOrg): ?>
      <div class="card">
        <h3>Kontakte von „<?= e($editOrg['name']) ?>“</h3>
        <?php if (!$members): ?>
          <p class="muted">Noch keine Kunden zugeordnet. Das geht unter <a href="/staff/customers.php">Kunden</a>.</p>
        <?php else: ?>
          <table>
            <thead><tr><th>Name</th><th>E-Mail</th></tr></thead>
            <tbody>
              <?php foreach ($members as $m): ?>
                <tr><td><?= e($m['name']) ?></td><td><?= e($m['email']) ?></td></tr>
              <?php endforeach; ?>
            </tbody>
          </table>
        <?php endif; ?>
      </div>
    <?php endif; ?>
  </div>

  <div style="flex:1; min-width:280px">
    <div class="card">
      <h3><?= $editOrg ? 'Organisation bearbeiten' : 'Neue Organisation' ?></h3>
      <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="action" value="<?= $editOrg ? 'update' : 'create' ?>">
        <?php if ($editOrg): ?><input type="hidden" name="id" value="<?= $editOrg['id'] ?>"><?php endif; ?>
        <label for="name">Name</label>
        <input type="text" id="name" name="name" value="<?= e($editOrg['name'] ?? '') ?>" required>
        <label for="notes">Notizen (optional)</label>
        <textarea id="notes" name="notes"><?= e($editOrg['notes'] ?? '') ?></textarea>
        <div class="btn-row">
          <button type="submit" class="btn"><?= $editOrg ? 'Speichern' : 'Erstellen' ?></button>
          <?php if ($editOrg): ?><a href="/staff/organizations.php" class="btn secondary">Abbrechen</a><?php endif; ?>
        </div>
      </form>
    </div>
  </div>
</div>

<?php require __DIR__ . '/_footer.php'; ?>