<?php
require_once("include/globals.php");

if (SessionActive() != 1 || ! UserLoggedIn()) {
   header("Location: /");
   exit();
}


//
// Process all actions to manage the customers for a user account
//
$CurrentTable = "people";
$DeleteField  = "first_name,last_name";
$dSeparator   = " ";
$FormFile     = "customers.form.php";
$TitleText    = getLanguageText('TEXT-CUSTOMERS');
$OrderBy      = "last_name,first_name";

// Start the template and output buffering
startTemplate();
$templatePageTitle = "$TitleText";


$naction = "";
if (array_key_exists('naction',$_GET)) $naction = $_GET['naction'];
if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];

if ($naction == "" && $_SESSION['UserInfo']['type'] == 'Parent') $naction = 'display';

$mode = "";
if (array_key_exists('mode',$_GET)) $mode = db_escape_string($_GET['mode']);
if (array_key_exists('mode',$_POST)) $mode = db_escape_string($_POST['mode']);
$_SESSION['mode'] = $mode;


$next_action = "";
if (array_key_exists('next_action',$_GET)) $next_action = $_GET['next_action'];
if (array_key_exists('next_action',$_POST)) $next_action = $_POST['next_action'];

unset($override_naction);
if (array_key_exists('override_naction',$_GET)) $override_naction = $_GET['override_naction'];
if (array_key_exists('override_naction',$_POST)) $override_naction = $_POST['override_naction'];

unset($donext);
if (array_key_exists('donext',$_GET)) $donext = $_GET['donext'];
if (array_key_exists('donext',$_POST)) $donext = $_POST['donext'];

if (isset($donext)) $naction = $donext;



// Set school_num from global array
$school_num = $school_record['record_num'];


// Ensure that only valid user types see the menu
$AllowedUserTypes = array('SuperUser','System Administrator','Application Administrator','Communications Administrator','Administration Team','Schedule Team');
if (checkPermission($AllowedUserTypes) == 1 && $_SESSION['mode'] != 'parent') {
   include "customers.options.php";
}



switch (strtolower($naction)) {
   case "add":
      $next_naction = "insert";
      $active = 'Y';
      $display = 'Y';

      include $FormFile;
      break;

   case "insert":
      extract($_POST);

      $first_name = trim($first_name);
      $last_name = trim($last_name);
      if (!isset($selected_user_num)) $selected_user_num = 0;
      $user_num = $selected_user_num;

      if (strlen(trim($first_name)) == 0 || strlen(trim($last_name)) == 0) {
         $error_message = getLanguageText('ERRORMSG-FIRST-LAST-NAME-REQUIRED');
         $_POST['naction'] = 'add';
         $args = encodeArray($_POST);
         $args .= "&error_message=" . urlencode($error_message);
         header("Location: /?$args");
         exit();
      }

      if ($_SESSION['UserInfo']['type'] == 'Parent' || $_SESSION['UserInfo']['type'] == 'Staff' || $$_SESSION['UserInfo']['type'] == 'Guest') {
         $user_num = intval($_SESSION['UserInfo']['record_num']);
      }
      else {
         // Check that there is a user_num
         if ($user_num == 0 || strlen($user_num) == 0) {
            $error_message = getLanguageText('ERRORMSG-NO-ACCOUNT');
            $_POST['naction'] = 'add';
            $args = encodeArray($_POST);
            $args .= "&error_message=" . urlencode($error_message);
            header("Location: /?$args");
            exit();
         }

         $user_num = intval($user_num);
         $user_type = db_getVal("SELECT type FROM users WHERE school_num = $base_school_num AND record_num = $user_num");
         if (!$user_type) {
            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
            $_POST['naction'] = 'add';
            $args = encodeArray($_POST);
            $args .= "&error_message=" . urlencode($error_message);
            header("Location: /?$args");
            exit();
         }

         if (!in_array($user_type,array('Parent','Administration Team','Schedule Team'))) {
            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
            $_POST['naction'] = 'add';
            $args = encodeArray($_POST);
            $args .= "&error_message=" . urlencode($error_message);
            header("Location: /?$args");
            exit();
         }
      }

      $class_num = 1;
      $status = 'Verified';
      $added_date = date("Y-m-d",time());
      $people_type = 'Customer';
      $display = 'N';

      // Reformat the name if required
      if ($first_name == strtolower($first_name) || $first_name == strtoupper($first_name) ||
               $last_name == strtolower($last_name) || $last_name == strtoupper($last_name)) {
         $first_name = ucwords(strtolower($first_name));
         $last_name = ucwords(strtolower($last_name));
      }


      // Save the customer
      $school_num = $base_school_num;
      if (!isset($menu_price_category) || strlen($menu_price_category) == 0) $menu_price_category = 'Regular';

      $table = new Table("$CurrentTable");
      $query = $table->BuildInsert();
      db_query($query);
      $record_num = db_insert_id();

      $school_num = $school_record['record_num'];

      $next_naction = 'search';

      if ($_SESSION['UserInfo']['type'] == 'Parent') $next_naction = 'display';

      $form_message = getLanguageText('RECORD-INSERTED-MSG');
      header("Location: /?action=$action&naction=$next_naction&mode=$mode&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
      exit();

   case "edit":
      $next_naction = "update";

      // Get current record
      $record_num = intval($_GET['record_num']);
      $uwhere = "";
      if (!in_array($_SESSION['UserInfo']['type'],array('Parent','Staff','Guest'))) {
         $uwhere = "and user_num = " . $_SESSION['UserInfo']['record_num'] . " ";
      }

      $query = "select * from $CurrentTable " .
               "where school_num = $base_school_num " .
               $uwhere .
               "and record_num = $record_num";
      $results = db_query($query);
      if (db_num_rows($results) == 1) {
         $row = db_fetch_array($results);
         extract($row);
         include $FormFile;
      }
      else {
         $error_message = getLanguageText('ERRORMSG-NOT-FOUND');
         include $FormFile;
      }
      break;

   case "update":
      extract($_POST);

      $first_name = trim($first_name);
      $last_name = trim($last_name);
      $user_num = $selected_user_num;

      if (strlen(trim($first_name)) == 0 || strlen(trim($last_name)) == 0) {
         $error_message = getLanguageText('ERRORMSG-FIRST-LAST-NAME-REQUIRED');
         $_POST['naction'] = 'add';
         $args = encodeArray($_POST);
         $args .= "&error_message=" . urlencode($error_message);
         header("Location: /?$args");
         exit();
      }

      // Verify the form data
      $numClasses = db_getVal("SELECT count(*) FROM classes WHERE school_num = $base_school_num");
      if ($numClasses > 0 && ($class_num == 0 || strlen($class_num) == 0)) {
         $error_message = getLanguageText('ERRORMSG-NO-CLASS');
         $_POST['naction'] = 'edit';
         $args = encodeArray($_POST);
         $args .= "&error_message=" . urlencode($error_message);
         header("Location: /?$args");
         exit();
      }

      if ($_SESSION['UserInfo']['type'] == 'Parent') {
         $user_num = intval($_SESSION['UserInfo']['record_num']);
      }
      else {
         // Check that there is a user_num
         if ($user_num == 0 || strlen($user_num) == 0) {
            $error_message = getLanguageText('ERRORMSG-NO-ACCOUNT');
            $_POST['naction'] = 'add';
            $args = encodeArray($_POST);
            $args .= "&error_message=" . urlencode($error_message);
            header("Location: /?$args");
            exit();
         }

         $user_num = intval($user_num);
         $user_type = db_getVal("SELECT type FROM users WHERE school_num = $base_school_num AND record_num = $user_num");
         if (!$user_type) {
            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
            $_POST['naction'] = 'add';
            $args = encodeArray($_POST);
            $args .= "&error_message=" . urlencode($error_message);
            header("Location: /?$args");
            exit();
         }

         if (!in_array($user_type,array('Parent','Administration Team','Staff','Guest'))) {
            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
            $_POST['naction'] = 'add';
            $args = encodeArray($_POST);
            $args .= "&error_message=" . urlencode($error_message);
            header("Location: /?$args");
            exit();
         }
      }


      $uid = $user_num;

      // Get original user_num
      $record_num = intval($record_num);
      $orig_user_num = db_getVal("SELECT user_num FROM people WHERE record_num = $record_num");

      // Reformat first name if required
      if ($first_name == strtolower($first_name) || $first_name == strtoupper($first_name)) {
         $first_name = ucwords(strtolower($first_name));
      }

      // Reformat last name if required
      if ($last_name == strtolower($last_name) || $last_name == strtoupper($last_name)) {
         $last_name = ucwords(strtolower($last_name));

         if (strpos($last_name,"Mc") !== false) {
            $last_name[2] = $entered_last_name[2];
         }
         if (strpos($last_name,"Mac")) {
            $last_name[3] = $entered_last_name[3];
         }
      }

      // Update the record
      $people_type = 'Customer';
      $class_num = 1;
      $school_num = $base_school_num;

      $table = new Table("$CurrentTable");
      $query = $table->BuildUpdate();
      db_query($query);

      $school_num = $school_record['record_num'];

      // If the user_num was changed then move any order transactions to the new user_num
      if ($user_num != $orig_user_num) {
         db_query("UPDATE user_account SET user_num = $user_num WHERE people_num = $record_num");
      }

      if (isset($override_naction)) $naction = $override_naction;

      $next_naction = 'search';

      $form_message = getLanguageText('RECORD-UPDATED-MSG');
      header("Location: /?action=$action&naction=$next_naction&mode=$mode&form_message=" . urlencode($form_message));
      exit();

   case "customer-lookup":
      include "customer.lookup.php";
      break;

   case "show-info":
      include "customer.info.php";
      break;

   case "delete-confirmed":
      extract($_GET);
      $record_num = intval($record_num);
      $customer_num = $record_num;

      $uwhere = "";
      if ($_SESSION['UserInfo']['type'] == 'Parent' || $_SESSION['mode'] == 'parent') {
         $uwhere = "and user_num = " . $_SESSION['UserInfo']['record_num'] . " ";
      }

      $query = "select * from $CurrentTable " .
               "where school_num = $base_school_num " .
               $uwhere .
               "and record_num = $customer_num";
      $results = db_query($query);
      $numCustomers = db_num_rows($results);

      // Check if this customer exists
      if ($numCustomers != 1) {
         $error_message = getLanguageText('ERRORMSG-NOT-FOUND');
         header("Location: /?action=$action&naction=display&show_status=$show_status&show_type=$show_type&uid=$uid&mode=$mode&error_message=" . urlencode($error_message));
         exit();
      }

      $row = db_fetch_array($results);
      extract($row);
      $snums = $school_record['linked_sites'];
      $numOrders = db_getVal("SELECT count(*) FROM hotlunch_order_header WHERE school_num IN ($snums) AND ordered_by_num = $customer_num AND status IN ('Unpaid','Pending','Paid','Complimentary')");

      if ($numOrders > 0) {
         $error_message = getLanguageText('ERRORMSG-NO-DELETE-ORDERS');
         header("Location: /?action=$action&naction=display&show_status=$show_status&show_type=$show_type&uid=$uid&mode=$mode&error_message=" . urlencode($error_message));
         exit();
      }

      // Delete the current record
      $query = "delete from $CurrentTable where school_num = $base_school_num and record_num = $record_num";
      db_query($query);

      // Delete any orders
      $query = "delete from hotlunch_order_header where school_num = $school_num and ordered_by_num = $record_num";
      db_query($query);

      $query = "delete from hotlunch_order_items where school_num = $school_num and ordered_by_num = $record_num";
      db_query($query);

      // Delete any allergies entries
      db_query("DELETE FROM allergies WHERE school_num = $base_school_num AND people_num = $record_num");

      // Delete user account entries
      $query = "delete from user_account where school_num = $base_school_num and people_num = $record_num";
      db_query($query);

      // Update user balance_owing
      updateUserBalance($user_num,$school_num);


      $form_message = getLanguageText('RECORD-DELETED-MSG');

      $next_naction = 'search';
      header("Location: /?action=$action&naction=$next_naction&mode=$mode&form_message=" . urlencode($form_message));
      exit();

   case "search":
   default:
      if ($_SESSION['UserInfo']['type'] == 'Parent') {
         include 'customer.display.php';
         break;
      }

      // Lookup Form
      include "customer.lookup.php";

      $ChoosePagination = 'Y';
      $next_naction = "lookup";

      include $FormFile;
      break;

   case "lookup":
      extract($_POST);
      $user_num = intval($selected_user_num);
      $table = new Table("$CurrentTable");
      $lookup_query = $table->BuildQuery("","","st.");
      $lookup_where = "";
      if (stripos("where ",$lookup_query)) $lookup_where = preg_replace("/.* where/i","and",$lookup_query);
      if (stripos("order by ",$lookup_where)) $lookup_where = preg_replace("/order by .*/i","",$lookup_where);
      $lookup_where .= " ";
      $naction = "list";
      $TitleText = getLanguageText('RECORD-LOOKUP');
      if (isset($user_num) && $user_num > 0) {
         $query = "select * from users where record_num = $user_num";
         $results = db_query($query);
         $row = db_fetch_array($results);
         $userid = $row['userid'];
         $name = $row['first_name'] . ' ' . $row['last_name'];
         $PageTitle = getLanguageText('TEXT-CUSTOMER-ACCOUNT-LIST') . "<br> $name ($userid)";
      }

      include 'customer.display.php';
      break;

   case "fetch":
      if ($_SESSION['UserInfo']['type'] == 'Parent') {
         include 'customer.display.php';
         break;
      }

      $lookup_where = "where school.record_num = $record_num";
      $naction = "list";
      $TitleText = getLanguageText('RECORD-LOOKUP');
      break;

   case "display":
   case "list":
      include 'customer.display.php';
      break;
}


//
// Display search screen if required
//
if ($naction == 'lookup') {
   // Lookup Form
   include "customer.lookup.php";

   $ChoosePagination = 'Y';
   $next_naction = "lookup";

   include $FormFile;
}


endTemplate();

?>