芝麻web文件管理V1.00

编辑当前文件:/home/pulsehostuk9/public_html/teafund.pulsehost.co.uk/admin/index.php

<?php
// Admin Dashboard — Patch 42 (restored + container)
// Based on Patch 37, with a global container wrapper for proper spacing
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/db.php';
require_once __DIR__ . '/../includes/csrf.php';
$notify_path = __DIR__ . '/../includes/notify.php';
if (file_exists($notify_path)) require_once $notify_path;
require_manage();

$pdo = get_pdo();

// --- Funds + persistence (set cookie BEFORE any output) ---
$funds = $pdo->query("SELECT id, name FROM funds ORDER BY name")->fetchAll(PDO::FETCH_ASSOC);
$fund_id = 0;
if (isset($_GET['fund_id'])) {
  $fund_id = (int)$_GET['fund_id'];
  $_SESSION['last_fund_id'] = $fund_id;
  @setcookie('last_fund_id', (string)$fund_id, [
    'expires' => time()+31536000,
    'path' => '/',
    'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
    'httponly' => true,
    'samesite' => 'Lax',
  ]);
} elseif (isset($_SESSION['last_fund_id'])) {
  $fund_id = (int)$_SESSION['last_fund_id'];
} elseif (!empty($_COOKIE['last_fund_id'])) {
  $fund_id = (int)$_COOKIE['last_fund_id'];
} else {
  $fund_id = $funds ? (int)$funds[0]['id'] : 0;
}
$fund_ids = array_column($funds, 'id');
if (!in_array($fund_id, $fund_ids, true)) {
  $fund_id = $funds ? (int)$funds[0]['id'] : 0;
  $_SESSION['last_fund_id'] = $fund_id;
  @setcookie('last_fund_id', (string)$fund_id, [
    'expires' => time()+31536000,
    'path' => '/',
    'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
    'httponly' => true,
    'samesite' => 'Lax',
  ]);
}

$year = isset($_GET['year']) ? (int)$_GET['year'] : (int)date('Y');
$show_archived = isset($_GET['show_archived']) && $_GET['show_archived'] === '1';
$tab = isset($_GET['tab']) ? $_GET['tab'] : 'members';
$view = isset($_GET['view']) ? $_GET['view'] : 'matrix'; // matrix | month | quarter

require_once __DIR__ . '/../includes/header.php';

// --- Data: members/payments/alerts ---
$members_sql = "SELECT id, name, email, join_date, notes, active FROM members WHERE fund_id = :fund_id";
$members_sql .= $show_archived ? " ORDER BY active DESC, name" : " AND active=1 ORDER BY name";
$stmtm = $pdo->prepare($members_sql);
$stmtm->execute([':fund_id' => $fund_id]);
$members = $stmtm->fetchAll(PDO::FETCH_ASSOC);

$stmt = $pdo->prepare("SELECT member_id, month, status FROM payments WHERE year = ? AND fund_id = ?");
$stmt->execute([$year, $fund_id]);
$payments = $stmt->fetchAll(PDO::FETCH_ASSOC);
$pay_map = [];
$month_totals = array_fill(1, 12, ['paid'=>0,'unpaid'=>0,'off'=>0]);
foreach ($payments as $p) {
  $m = (int)$p['month'];
  $pay_map[$p['member_id']][$m] = $p['status'];
  if (isset($month_totals[$m][$p['status']])) $month_totals[$m][$p['status']]++;
}
$total_members = $show_archived ? array_sum(array_map(fn($m)=>$m['active']?1:0, $members)) : count($members);
$months = [1=>'Jan',2=>'Feb',3=>'Mar',4=>'Apr',5=>'May',6=>'Jun',7=>'Jul',8=>'Aug',9=>'Sep',10=>'Oct',11=>'Nov',12=>'Dec'];
$current_month = ((int)date('Y') === $year) ? (int)date('n') : 0;

$overview_month = isset($_GET['m']) ? max(1, min(12, (int)$_GET['m'])) : ($current_month ?: 1);
$paid_ctr=0; $unpaid_ctr=0; $off_ctr=0;
foreach ($members as $mem) {
  if (!$show_archived && !(int)$mem['active']) continue;
  $st = $pay_map[$mem['id']][$overview_month] ?? 'unpaid';
  if ($st==='paid') $paid_ctr++; elseif ($st==='off') $off_ctr++; else $unpaid_ctr++;
}
$paid_pct = $total_members > 0 ? round(($paid_ctr/$total_members)*100) : 0;

$pdo->exec("CREATE TABLE IF NOT EXISTS stock_alerts (
  id INT AUTO_INCREMENT PRIMARY KEY,
  fund_id INT NULL,
  item ENUM('cordial','milk','coffee','tea','sugar','other') NOT NULL,
  note VARCHAR(255) NULL,
  status ENUM('new','ack','resolved') NOT NULL DEFAULT 'new',
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
  created_by_ip VARCHAR(45) NULL,
  user_agent VARCHAR(255) NULL,
  INDEX(status), INDEX(created_at), INDEX(item)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");

$alerts_stmt = $pdo->prepare("SELECT id, fund_id, item, note, status, created_at, created_by_ip FROM stock_alerts WHERE status IN ('new','ack') AND (fund_id IS NULL OR fund_id = ?) ORDER BY (status='new') DESC, created_at DESC LIMIT 200");
$alerts_stmt->execute([$fund_id]);
$alerts = $alerts_stmt->fetchAll(PDO::FETCH_ASSOC);

$stats = [];
$rows = $pdo->query("SELECT fund_id, SUM(active=1) AS active_cnt, SUM(active=0) AS archived_cnt, COUNT(*) AS total_cnt FROM members GROUP BY fund_id")->fetchAll(PDO::FETCH_ASSOC);
foreach ($rows as $r) $stats[(int)$r['fund_id']] = $r;

$sel_month = isset($_GET['m']) ? max(1, min(12, (int)$_GET['m'])) : ($current_month ?: 1);
$sel_quarter = isset($_GET['q']) ? max(1, min(4, (int)$_GET['q'])) : (int)ceil(($current_month ?: 1)/3);
$quarters = [ 1 => [1,2,3], 2 => [4,5,6], 3 => [7,8,9], 4 => [10,11,12] ];
$quarter_months = $quarters[$sel_quarter];
?>
<div class="position-fixed top-0 start-50 translate-middle-x p-3" style="z-index:1080">
  <div id="toastArea" class="toast-container w-100"></div>
</div>

<div class="container my-3">

<div class="d-flex align-items-center justify-content-between mb-2">
  <h1 class="h4 m-0"><i class="bi bi-speedometer2 me-2"></i> Admin Dashboard</h1>
  <ul class="nav nav-pills" id="dashTabs">
    <li class="nav-item"><a class="nav-link <?php echo $tab==='overview'?'active':''; ?>" href="?tab=overview&fund_id=<?php echo $fund_id; ?>&year=<?php echo $year; echo $show_archived?'&show_archived=1':''; ?>">Overview</a></li>
    <li class="nav-item"><a class="nav-link <?php echo $tab==='members'?'active':''; ?>" href="?tab=members&fund_id=<?php echo $fund_id; ?>&year=<?php echo $year; echo $show_archived?'&show_archived=1':''; ?>">Members</a></li>
    <li class="nav-item"><a class="nav-link <?php echo $tab==='tools'?'active':''; ?>" href="?tab=tools&fund_id=<?php echo $fund_id; ?>&year=<?php echo $year; echo $show_archived?'&show_archived=1':''; ?>">Tools</a></li>
  </ul>
</div>

<div class="toolbar toolbar-sticky d-flex flex-wrap align-items-center gap-2 mb-3">
  <form class="d-flex flex-wrap align-items-center gap-2" method="get">
    <input type="hidden" name="tab" value="<?php echo htmlspecialchars($tab); ?>">
    <select class="form-select form-select-sm" name="fund_id">
      <?php foreach ($funds as $f): ?><option value="<?php echo $f['id']; ?>" <?php echo $f['id']==$fund_id?'selected':''; ?>><?php echo htmlspecialchars($f['name']); ?></option><?php endforeach; ?>
    </select>
    <input class="form-control form-control-sm" type="number" name="year" value="<?php echo $year; ?>" min="2000" max="2100">
    <div class="form-check ms-2">
      <input class="form-check-input" type="checkbox" value="1" id="showArchived" name="show_archived" <?php echo $show_archived?'checked':''; ?>>
      <label class="form-check-label" for="showArchived">Show archived</label>
    </div>
    <button class="btn btn-sm btn-primary touch-btn" type="submit">Apply</button>
  </form>

<div class="ms-auto d-flex flex-wrap align-items-center gap-2">
    <?php if ($tab === 'members'): ?>
      <div class="btn-group btn-group-sm view-toggle" role="group" aria-label="View">
        <?php $baseQS = "tab=members&fund_id=$fund_id&year=$year" . ($show_archived ? "&show_archived=1" : ""); ?>
        <a class="btn btn-outline-secondary <?php echo $view==='matrix'?'active':''; ?>" href="?<?php echo $baseQS; ?>&view=matrix"><i class="bi bi-grid-3x3-gap"></i> Matrix</a>
        <a class="btn btn-outline-secondary <?php echo $view==='month'?'active':''; ?>" href="?<?php echo $baseQS; ?>&view=month&m=<?php echo $sel_month; ?>"><i class="bi bi-calendar2-event"></i> Month</a>
        <a class="btn btn-outline-secondary <?php echo $view==='quarter'?'active':''; ?>" href="?<?php echo $baseQS; ?>&view=quarter&q=<?php echo $sel_quarter; ?>"><i class="bi bi-layout-three-columns"></i> Quarter</a>
      </div>
      <?php if ($view==='month'): ?>
        <form method="get" class="d-inline-flex align-items-center gap-1">
          <input type="hidden" name="tab" value="members"><input type="hidden" name="view" value="month">
          <input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>"><input type="hidden" name="year" value="<?php echo $year; ?>"><?php if ($show_archived): ?><input type="hidden" name="show_archived" value="1"><?php endif; ?>
          <label class="small me-1">Month</label>
          <select class="form-select form-select-sm" name="m" onchange="this.form.submit()">
            <?php foreach ($months as $i=>$m): ?><option value="<?php echo $i; ?>" <?php echo $i===$sel_month?'selected':''; ?>><?php echo $m; ?></option><?php endforeach; ?>
          </select>
        </form>
      <?php elseif ($view==='quarter'): ?>
        <form method="get" class="d-inline-flex align-items-center gap-1">
          <input type="hidden" name="tab" value="members"><input type="hidden" name="view" value="quarter">
          <input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>"><input type="hidden" name="year" value="<?php echo $year; ?>"><?php if ($show_archived): ?><input type="hidden" name="show_archived" value="1"><?php endif; ?>
          <label class="small me-1">Quarter</label>
          <select class="form-select form-select-sm" name="q" onchange="this.form.submit()">
            <option value="1" <?php echo $sel_quarter===1?'selected':''; ?>>Q1 (Jan–Mar)</option>
            <option value="2" <?php echo $sel_quarter===2?'selected':''; ?>>Q2 (Apr–Jun)</option>
            <option value="3" <?php echo $sel_quarter===3?'selected':''; ?>>Q3 (Jul–Sep)</option>
            <option value="4" <?php echo $sel_quarter===4?'selected':''; ?>>Q4 (Oct–Dec)</option>
          </select>
        </form>
      <?php endif; ?>

<?php if ($view==='matrix' && $current_month): ?>
        <button id="jumpCurrentBtn" class="btn btn-sm btn-outline-primary" type="button" title="Jump to current month"><i class="bi bi-calendar-event"></i></button>
      <?php endif; ?>

<select id="statusFilter" class="form-select form-select-sm" aria-label="Filter by status">
        <option value="">All statuses</option><option value="paid">Paid</option><option value="unpaid">Unpaid</option><option value="off">Off</option>
      </select>
    <?php endif; ?>
    <button id="refreshBtn" class="btn btn-sm btn-outline-secondary"><i class="bi bi-arrow-repeat"></i></button>
  </div>
</div>

<?php if ($tab === 'overview'): ?>
  <div class="row g-3 mb-3">
    <div class="col-12 col-sm-6 col-lg-3"><div class="card kpi-card p-3"><div class="subtle">Active members</div><div class="kpi-value"><?php echo $total_members; ?></div></div></div>
    <div class="col-12 col-sm-6 col-lg-3"><div class="card kpi-card p-3"><div class="subtle">Archived</div><div class="kpi-value"><?php echo (int)($pdo->query("SELECT COUNT(*) FROM members WHERE fund_id=".$fund_id." AND active=0")->fetchColumn()); ?></div></div></div>
    <div class="col-12 col-sm-6 col-lg-3">
      <div class="card kpi-card p-3">
        <div class="d-flex align-items-center justify-content-between">
          <div class="subtle">Paid in <?php echo $months[$overview_month]; ?></div>
          <form method="get" class="d-flex align-items-center gap-2">
            <input type="hidden" name="tab" value="overview">
            <input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>">
            <input type="hidden" name="year" value="<?php echo $year; ?>">
            <?php if ($show_archived): ?><input type="hidden" name="show_archived" value="1"><?php endif; ?>
            <select class="form-select form-select-sm" name="m" onchange="this.form.submit()">
              <?php foreach ($months as $i=>$m): ?><option value="<?php echo $i; ?>" <?php echo $i===$overview_month?'selected':''; ?>><?php echo $m; ?></option><?php endforeach; ?>
            </select>
          </form>
        </div>
        <div class="kpi-value"><?php echo $paid_ctr; ?> <span class="subtle">/ <?php echo $total_members; ?> (<?php echo $paid_pct; ?>%)</span></div>
      </div>
    </div>
    <div class="col-12 col-sm-6 col-lg-3"><div class="card kpi-card p-3"><div class="subtle">Unpaid this month</div><div class="kpi-value"><?php echo $unpaid_ctr; ?></div></div></div>
  </div>

<div class="accordion accordion-flush shadow-sm mb-4" id="overviewAcc">
    <div class="accordion-item">
      <h2 class="accordion-header" id="progressHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#progressCollapse" aria-expanded="false" aria-controls="progressCollapse">
          Monthly Progress
        </button>
      </h2>
      <div id="progressCollapse" class="accordion-collapse collapse" aria-labelledby="progressHeading" data-bs-parent="#overviewAcc">
        <div class="accordion-body">
          <div class="row g-2">
            <?php for ($i=1;$i<=12;$i++):
              $t=$month_totals[$i]; $paid=(int)$t['paid']; $percent=$total_members?round(($paid/$total_members)*100):0; ?>
              <div class="col-12 col-sm-6 col-lg-3">
                <div class="d-flex justify-content-between small mb-1"><span><?php echo $months[$i]; ?></span><span><?php echo $paid; ?>/<?php echo $total_members; ?></span></div>
                <div class="progress" role="progressbar" aria-valuenow="<?php echo $percent; ?>" aria-valuemin="0" aria-valuemax="100"><div class="progress-bar bg-success" style="width: <?php echo $percent; ?>%"></div></div>
              </div>
            <?php endfor; ?>
          </div>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="alertsHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#alertsCollapse" aria-expanded="false" aria-controls="alertsCollapse">
          Stock Alerts (<?php echo count($alerts); ?>)
        </button>
      </h2>
      <div id="alertsCollapse" class="accordion-collapse collapse" aria-labelledby="alertsHeading" data-bs-parent="#overviewAcc">
        <div class="accordion-body">
          <?php if (!$alerts): ?><div class="text-muted">No open alerts.</div><?php else: ?>
            <div class="table-responsive"><table class="table table-bordered table-sm align-middle"><thead><tr><th>ID</th><th>Item</th><th>Note</th><th>Time</th><th>Status</th></tr></thead><tbody>
              <?php foreach ($alerts as $a): ?><tr>
                <td><?php echo $a['id']; ?></td><td class="text-capitalize"><?php echo htmlspecialchars($a['item']); ?></td>
                <td><?php echo htmlspecialchars($a['note'] ?? ''); ?></td>
                <td><span class="text-muted small"><?php echo htmlspecialchars($a['created_at']); ?></span></td>
                <td><?php echo $a['status']==='new' ? '<span class="badge bg-danger">new</span>' : '<span class="badge bg-warning text-dark">ack</span>'; ?></td>
              </tr><?php endforeach; ?>
            </tbody></table></div>
          <?php endif; ?>
        </div>
      </div>
    </div>
  </div>
<?php endif; ?>

<?php if ($tab === 'members'): ?>
  <div class="legend mb-2">
    <span class="badge status-paid" title="Paid">✓ Paid</span>
    <span class="badge status-unpaid" title="Unpaid">• Unpaid</span>
    <span class="badge status-off" title="Off">⏸ Off</span>
    <?php if ($current_month): ?><span class="badge text-bg-primary ms-2">Current: <?php echo $months[$current_month]; ?></span><?php endif; ?>
  </div>

<?php if ($view === 'matrix'): ?>
    <div id="adminTableWrap" class="table-responsive shadow-sm">
      <table id="adminTable" class="table table-bordered table-sm align-middle table-hover table-striped">
        <thead><tr class="sticky-top">
          <th class="sticky-col">ID</th><th>Name</th><th>Email</th><th>Join</th>
          <?php foreach ($months as $i=>$m): ?><th class="text-center <?php echo ($current_month && $i===$current_month) ? 'current-col-header' : ''; ?>"><?php echo $m; ?></th><?php endforeach; ?>
          <th class="text-center">Actions</th></tr></thead>
        <tbody>
          <?php foreach ($members as $mem): $arch=(int)$mem['active']===0; ?>
            <tr id="member-row-<?php echo $mem['id']; ?>" class="<?php echo $arch?'row-archived':''; ?>">
              <th class="sticky-col"><?php echo $mem['id']; ?><?php if ($arch): ?><span class="badge bg-secondary ms-2">Archived</span><?php endif; ?></th>
              <td class="name"><?php echo htmlspecialchars($mem['name']); ?></td>
              <td><?php echo htmlspecialchars($mem['email'] ?? ''); ?></td>
              <td><?php echo htmlspecialchars($mem['join_date'] ?? ''); ?></td>
              <?php for ($i=1;$i<=12;$i++):
                $status=$pay_map[$mem['id']][$i] ?? 'unpaid';
                $cls = $status==='paid'?'status-paid':($status==='off'?'status-off':'status-unpaid');
                $icon = $status==='paid'?'✓':($status==='off'?'⏸':'•'); ?>
                <td class="text-center clickable <?php echo $cls; ?> status-cell <?php echo ($current_month && $i===$current_month) ? 'current-col' : ''; ?>" data-member="<?php echo $mem['id']; ?>" data-month="<?php echo $i; ?>" data-status="<?php echo $status; ?>"><span class="status-icon"><?php echo $icon; ?></span></td>
              <?php endfor; ?>
              <td class="text-center">
                <?php if (is_admin()): ?>
                  <?php if (!$arch): ?>
                    <form method="post" action="/api/archive_member.php" class="d-inline" onsubmit="return confirm('Archive this member? You can restore them later.')">
                      <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="member_id" value="<?php echo $mem['id']; ?>">
                      <button class="btn btn-sm btn-outline-warning touch-btn">Archive</button>
                    </form>
                  <?php else: ?>
                    <form method="post" action="/api/restore_member.php" class="d-inline">
                      <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="member_id" value="<?php echo $mem['id']; ?>">
                      <button class="btn btn-sm btn-outline-success touch-btn">Restore</button>
                    </form>
                  <?php endif; ?>
                  <form method="post" action="/api/delete_member.php" class="d-inline" onsubmit="return confirm('Permanently delete this member and all their payments?');">
                    <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="member_id" value="<?php echo $mem['id']; ?>">
                    <button class="btn btn-sm btn-outline-danger touch-btn">Remove</button>
                  </form>
                <?php endif; ?>
              </td>
            </tr>
          <?php endforeach; ?>
        </tbody>
      </table>
    </div>
  <?php elseif ($view === 'month'): ?>
    <div class="table-responsive shadow-sm">
      <table class="table table-bordered table-sm align-middle table-hover table-striped">
        <thead><tr class="sticky-top"><th class="sticky-col">ID</th><th>Name</th><th>Email</th><th>Join</th><th class="text-center"><?php echo $months[$sel_month]; ?></th><th class="text-center">Actions</th></tr></thead>
        <tbody>
          <?php foreach ($members as $mem): $arch=(int)$mem['active']===0; $status=$pay_map[$mem['id']][$sel_month] ?? 'unpaid'; $cls=$status==='paid'?'status-paid':($status==='off'?'status-off':'status-unpaid'); $icon=$status==='paid'?'✓':($status==='off'?'⏸':'•'); ?>
            <tr class="<?php echo $arch?'row-archived':''; ?>">
              <th class="sticky-col"><?php echo $mem['id']; ?><?php if ($arch): ?><span class="badge bg-secondary ms-2">Archived</span><?php endif; ?></th>
              <td class="name"><?php echo htmlspecialchars($mem['name']); ?></td>
              <td><?php echo htmlspecialchars($mem['email'] ?? ''); ?></td>
              <td><?php echo htmlspecialchars($mem['join_date'] ?? ''); ?></td>
              <td class="text-center clickable <?php echo $cls; ?> status-cell" data-member="<?php echo $mem['id']; ?>" data-month="<?php echo $sel_month; ?>" data-status="<?php echo $status; ?>"><span class="status-icon"><?php echo $icon; ?></span></td>
              <td class="text-center"><?php if (is_admin()): ?>
                <form method="post" action="/api/delete_member.php" class="d-inline" onsubmit="return confirm('Permanently delete this member and all their payments?');">
                  <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="member_id" value="<?php echo $mem['id']; ?>">
                  <button class="btn btn-sm btn-outline-danger touch-btn">Remove</button>
                </form><?php endif; ?>
              </td>
            </tr>
          <?php endforeach; ?>
        </tbody>
      </table>
    </div>
  <?php elseif ($view === 'quarter'): ?>
    <div class="table-responsive shadow-sm">
      <table class="table table-bordered table-sm align-middle table-hover table-striped">
        <thead><tr class="sticky-top"><th class="sticky-col">ID</th><th>Name</th><th>Email</th><th>Join</th><?php foreach ($quarter_months as $qm): ?><th class="text-center"><?php echo $months[$qm]; ?></th><?php endforeach; ?><th class="text-center">Actions</th></tr></thead>
        <tbody>
          <?php foreach ($members as $mem): $arch=(int)$mem['active']===0; ?>
            <tr class="<?php echo $arch?'row-archived':''; ?>">
              <th class="sticky-col"><?php echo $mem['id']; ?><?php if ($arch): ?><span class="badge bg-secondary ms-2">Archived</span><?php endif; ?></th>
              <td class="name"><?php echo htmlspecialchars($mem['name']); ?></td>
              <td><?php echo htmlspecialchars($mem['email'] ?? ''); ?></td>
              <td><?php echo htmlspecialchars($mem['join_date'] ?? ''); ?></td>
              <?php foreach ($quarter_months as $qm): $status=$pay_map[$mem['id']][$qm] ?? 'unpaid'; $cls=$status==='paid'?'status-paid':($status==='off'?'status-off':'status-unpaid'); $icon=$status==='paid'?'✓':($status==='off'?'⏸':'•'); ?>
                <td class="text-center clickable <?php echo $cls; ?> status-cell" data-member="<?php echo $mem['id']; ?>" data-month="<?php echo $qm; ?>" data-status="<?php echo $status; ?>"><span class="status-icon"><?php echo $icon; ?></span></td>
              <?php endforeach; ?>
              <td class="text-center">
                <?php if (is_admin()): ?>
                  <form method="post" action="/api/delete_member.php" class="d-inline" onsubmit="return confirm('Permanently delete this member and all their payments?');">
                    <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="member_id" value="<?php echo $mem['id']; ?>">
                    <button class="btn btn-sm btn-outline-danger touch-btn">Remove</button>
                  </form>
                <?php endif; ?>
              </td>
            </tr>
          <?php endforeach; ?>
        </tbody>
      </table>
    </div>
  <?php endif; ?>
<?php endif; ?>

<?php if ($tab === 'tools'): ?>
  <div class="accordion accordion-flush shadow-sm mb-4" id="toolsAccordion">
    
    <div class="accordion-item">
      <h2 class="accordion-header" id="alertsHeadingTools">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#alertsCollapseTools" aria-expanded="false" aria-controls="alertsCollapseTools">
          Stock Alerts (<?php echo count($alerts); ?>)
        </button>
      </h2>
      <div id="alertsCollapseTools" class="accordion-collapse collapse" aria-labelledby="alertsHeadingTools" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <?php if (!$alerts): ?><div class="text-muted">No open alerts.</div><?php else: ?>
            <div class="table-responsive">
              <table class="table table-bordered table-sm align-middle">
                <thead><tr><th>ID</th><th>Item</th><th>Note</th><th>Time</th><th>IP</th><th>Status</th><th class="text-center">Actions</th></tr></thead>
                <tbody>
                  <?php foreach ($alerts as $a): ?>
                    <tr>
                      <td><?php echo $a['id']; ?></td>
                      <td class="text-capitalize"><?php echo htmlspecialchars($a['item']); ?></td>
                      <td><?php echo htmlspecialchars($a['note'] ?? ''); ?></td>
                      <td><span class="text-muted small"><?php echo htmlspecialchars($a['created_at']); ?></span></td>
                      <td><span class="small"><?php echo htmlspecialchars($a['created_by_ip'] ?? ''); ?></span></td>
                      <td><?php echo $a['status']==='new' ? '<span class="badge bg-danger">new</span>' : '<span class="badge bg-warning text-dark">ack</span>'; ?></td>
                      <td class="text-center">
                        <form method="post" action="/api/stock_alert_update.php" class="d-inline">
                          <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>">
                          <input type="hidden" name="alert_id" value="<?php echo $a['id']; ?>"><input type="hidden" name="action" value="ack">
                          <button class="btn btn-sm btn-outline-secondary">Acknowledge</button>
                        </form>
                        <form method="post" action="/api/stock_alert_update.php" class="d-inline" onsubmit="return confirm('Mark resolved?');">
                          <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>">
                          <input type="hidden" name="alert_id" value="<?php echo $a['id']; ?>"><input type="hidden" name="action" value="resolve">
                          <button class="btn btn-sm btn-outline-success">Resolved</button>
                        </form>
                      </td>
                    </tr>
                  <?php endforeach; ?>
                </tbody>
              </table>
            </div>
          <?php endif; ?>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="addMemberHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#addMemberCollapse" aria-expanded="false" aria-controls="addMemberCollapse">
          Add Member to this fund
        </button>
      </h2>
      <div id="addMemberCollapse" class="accordion-collapse collapse" aria-labelledby="addMemberHeading" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <form method="post" action="/api/add_member.php" class="row g-3">
            <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>">
            <div class="col-12 col-md-4"><label class="form-label">Full name</label><input class="form-control" name="name" placeholder="Jane Doe" required></div>
            <div class="col-12 col-md-4"><label class="form-label">Email (optional)</label><input class="form-control" name="email" placeholder="jane@example.com"></div>
            <div class="col-12 col-md-4"><label class="form-label">Join date (optional)</label><input class="form-control" type="date" name="join_date"></div>
            <div class="col-12"><label class="form-label">Notes (optional)</label><textarea class="form-control" name="notes" rows="2" placeholder="Any notes..."></textarea></div>
            <div class="col-12"><button class="btn btn-success touch-btn" type="submit">Add to <?php echo htmlspecialchars($pdo->query("SELECT name FROM funds WHERE id=".$fund_id)->fetchColumn()); ?></button></div>
          </form>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="bulkHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#bulkCollapse" aria-expanded="false" aria-controls="bulkCollapse">
          Bulk Actions
        </button>
      </h2>
      <div id="bulkCollapse" class="accordion-collapse collapse" aria-labelledby="bulkHeading" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <div class="row g-3">
            <div class="col-12 col-md-6">
              <div class="card"><div class="card-body">
                <h6 class="card-title mb-2">Set entire month</h6>
                <form method="post" action="/api/bulk_update.php" class="vstack gap-2">
                  <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>"><input type="hidden" name="year" value="<?php echo $year; ?>">
                  <div class="input-group input-group-sm"><span class="input-group-text">Month</span>
                    <select class="form-select" name="month"><?php foreach ($months as $i=>$m): ?><option value="<?php echo $i; ?>"><?php echo $m; ?></option><?php endforeach; ?></select>
                  </div>
                  <div class="input-group input-group-sm"><span class="input-group-text">Set to</span>
                    <select class="form-select" name="status"><option value="paid">Paid</option><option value="unpaid">Unpaid</option><option value="off">Off</option></select>
                  </div>
                  <button class="btn btn-outline-primary touch-btn" type="submit">Apply</button>
                </form>
              </div></div>
            </div>
            <div class="col-12 col-md-6">
              <div class="card"><div class="card-body">
                <h6 class="card-title mb-2">Set all months for one member</h6>
                <form method="post" action="/api/bulk_update.php" class="vstack gap-2">
                  <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>"><input type="hidden" name="year" value="<?php echo $year; ?>">
                  <div class="input-group input-group-sm"><span class="input-group-text">Member ID</span><input class="form-control" name="member_id" placeholder="e.g. 12"></div>
                  <div class="input-group input-group-sm"><span class="input-group-text">Set to</span>
                    <select class="form-select" name="status"><option value="paid">Paid</option><option value="unpaid">Unpaid</option><option value="off">Off</option></select>
                  </div>
                  <button class="btn btn-outline-secondary touch-btn" type="submit">Apply</button>
                </form>
              </div></div>
            </div>
          </div>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="reportsHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#reportsCollapse" aria-expanded="false" aria-controls="reportsCollapse">
          Reports & Export
        </button>
      </h2>
      <div id="reportsCollapse" class="accordion-collapse collapse" aria-labelledby="reportsHeading" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <div class="row g-3">
            <div class="col-12 col-md-6">
              <div class="card"><div class="card-body">
                <h6 class="card-title mb-2">Export CSV (year)</h6>
                <form method="get" action="/api/export_csv.php" class="vstack gap-2">
                  <input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>"><input type="hidden" name="year" value="<?php echo $year; ?>">
                  <button class="btn btn-outline-dark touch-btn" type="submit">Download CSV</button>
                </form>
              </div></div>
            </div>
            <div class="col-12 col-md-6">
              <div class="card"><div class="card-body">
                <h6 class="card-title mb-2">Unpaid list for month</h6>
                <form method="get" action="/api/unpaid_list.php" class="vstack gap-2">
                  <input type="hidden" name="fund_id" value="<?php echo $fund_id; ?>"><input type="hidden" name="year" value="<?php echo $year; ?>">
                  <div class="input-group input-group-sm"><span class="input-group-text">Month</span>
                    <select class="form-select" name="month"><?php foreach ($months as $i=>$m): ?><option value="<?php echo $i; ?>"><?php echo $m; ?></option><?php endforeach; ?></select>
                  </div>
                  <button class="btn btn-outline-warning touch-btn" type="submit">Download list</button>
                </form>
              </div></div>
            </div>
          </div>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="integrationsHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#integrationsCollapse" aria-expanded="false" aria-controls="integrationsCollapse">
          Integrations
        </button>
      </h2>
      <div id="integrationsCollapse" class="accordion-collapse collapse" aria-labelledby="integrationsHeading" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <div class="row g-3">
            <div class="col-12 col-md-6">
              <div class="card"><div class="card-body">
                <h6 class="card-title mb-2">Slack</h6>
                <?php if (function_exists('slack_enabled') && slack_enabled()): ?>
                  <p class="text-success small mb-3"><i class="bi bi-check-circle"></i> Webhook configured. New stock alerts will be posted to Slack automatically.</p>
                  <form method="post" action="/api/slack_test.php"><input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><button class="btn btn-sm btn-outline-primary">Send test message</button></form>
                <?php else: ?>
                  <p class="text-muted small mb-2"><i class="bi bi-exclamation-circle"></i> No webhook configured.</p>
                  <ol class="small mb-3"><li>Copy <code>includes/config.sample.php</code> to <code>includes/config.php</code></li><li>Set <code>SLACK_WEBHOOK_URL</code> (and optional username/channel/icon)</li></ol>
                <?php endif; ?>
              </div></div>
            </div>
          </div>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="moveHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#moveCollapse" aria-expanded="false" aria-controls="moveCollapse">
          Move member to another fund
        </button>
      </h2>
      <div id="moveCollapse" class="accordion-collapse collapse" aria-labelledby="moveHeading" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <form id="moveForm" method="post" action="/api/move_member_fund.php" class="row g-2">
            <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>"><input type="hidden" name="member_id" id="memberId">
            <div class="col-12 col-md-6 position-relative">
              <label class="form-label">Search member</label>
              <input id="memberSearch" class="form-control form-control-sm" placeholder="Type name, email or ID (min 2 chars)" autocomplete="off">
              <div id="memberResults" class="list-group position-absolute w-100 shadow-sm" style="z-index:1050; display:none; max-height:220px; overflow:auto;"></div>
              <div class="form-text">Pick a result to fill the member ID automatically.</div>
            </div>
            <div class="col-12 col-md-4"><label class="form-label">Destination fund</label>
              <select class="form-select form-select-sm" name="dest_fund_id" required><?php foreach ($funds as $f): ?><option value="<?php echo $f['id']; ?>"><?php echo htmlspecialchars($f['name']); ?></option><?php endforeach; ?></select>
            </div>
            <div class="col-12 col-md-2"><label class="form-label">Also move this year’s payments?</label>
              <div class="form-check"><input class="form-check-input" type="checkbox" name="also_move_year" value="<?php echo $year; ?>" id="alsoMoveYear"><label class="form-check-label" for="alsoMoveYear">Yes, <?php echo $year; ?></label></div>
            </div>
            <div class="col-12"><button class="btn btn-outline-primary touch-btn" type="submit">Move</button></div>
          </form>
        </div>
      </div>
    </div>

<div class="accordion-item">
      <h2 class="accordion-header" id="fundsHeading">
        <button class="accordion-button collapsed" type="button" data-bs-toggle="collapse" data-bs-target="#fundsCollapse" aria-expanded="false" aria-controls="fundsCollapse">
          Manage Funds
        </button>
      </h2>
      <div id="fundsCollapse" class="accordion-collapse collapse" aria-labelledby="fundsHeading" data-bs-parent="#toolsAccordion">
        <div class="accordion-body">
          <div class="row g-3 align-items-end">
            <div class="col-12 col-md-6">
              <form method="post" action="/api/fund_add.php" class="row g-2">
                <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>">
                <div class="col-8"><label class="form-label">New fund name</label><input class="form-control" name="name" placeholder="e.g. Coffee Club" required></div>
                <div class="col-4"><button class="btn btn-primary w-100">Add fund</button></div>
              </form>
            </div>
          </div>

<div class="table-responsive mt-3">
            <table class="table table-bordered table-sm align-middle">
              <thead><tr><th>ID</th><th>Name</th><th class="text-center">Active</th><th class="text-center">Archived</th><th class="text-center">Total</th><th class="text-center">Actions</th></tr></thead>
              <tbody>
                <?php foreach ($funds as $f): $s = $stats[$f['id']] ?? ['active_cnt'=>0,'archived_cnt'=>0,'total_cnt'=>0]; ?>
                <tr>
                  <td><?php echo $f['id']; ?></td>
                  <td>
                    <form method="post" action="/api/fund_update.php" class="d-flex gap-2">
                      <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>">
                      <input type="hidden" name="fund_id" value="<?php echo $f['id']; ?>">
                      <input class="form-control form-control-sm" name="name" value="<?php echo htmlspecialchars($f['name']); ?>">
                      <button class="btn btn-sm btn-outline-secondary">Rename</button>
                    </form>
                  </td>
                  <td class="text-center"><?php echo (int)$s['active_cnt']; ?></td>
                  <td class="text-center"><?php echo (int)$s['archived_cnt']; ?></td>
                  <td class="text-center"><?php echo (int)$s['total_cnt']; ?></td>
                  <td class="text-center">
                    <form method="post" action="/api/fund_delete.php" class="d-inline-flex align-items-center gap-2" onsubmit="return confirmDeleteFund(this)">
                      <input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>">
                      <input type="hidden" name="fund_id" value="<?php echo $f['id']; ?>">
                      <?php if ((int)$s['total_cnt']>0): ?>
                        <select class="form-select form-select-sm" name="dest_fund_id" style="min-width:180px">
                          <option value="">Move members to…</option>
                          <?php foreach ($funds as $opt): if ($opt['id']==$f['id']) continue; ?><option value="<?php echo $opt['id']; ?>"><?php echo htmlspecialchars($opt['name']); ?></option><?php endforeach; ?>
                        </select>
                        <button class="btn btn-sm btn-outline-danger">Merge & delete</button>
                      <?php else: ?>
                        <button class="btn btn-sm btn-outline-danger">Delete fund</button>
                      <?php endif; ?>
                    </form>
                  </td>
                </tr>
                <?php endforeach; ?>
              </tbody>
            </table>
          </div>

<p class="small text-muted mt-2">Deleting a fund requires it to be empty. If it has members, choose a destination fund to merge members (and payments) first.</p>
        </div>
      </div>
    </div>

</div>
<?php endif; ?>

function scrollToCurrentMonth(containerId) {
  const wrap = document.getElementById(containerId); if (!wrap) return;
  const target = wrap.querySelector('th.current-col-header, td.current-col'); if (!target) return;
  const rect = target.getBoundingClientRect(), wrect = wrap.getBoundingClientRect();
  const offset = rect.left - wrect.left; const nextScroll = wrap.scrollLeft + offset - 16;
  wrap.scrollTo({ left: Math.max(0, nextScroll), behavior: 'smooth' });
}

const searchInput = document.getElementById('searchInput'); const statusFilter = document.getElementById('statusFilter');
function applyFilters() {
  const term = (searchInput?.value || '').toLowerCase(); const st = statusFilter?.value || '';
  document.querySelectorAll('table tbody tr').forEach(tr => {
    const name = tr.querySelector('td.name')?.textContent.toLowerCase() || '';
    let show = name.includes(term);
    if (show && st) show = tr.querySelector('td.status-cell.status-' + st) !== null;
    tr.style.display = show ? '' : 'none';
  });
}
searchInput?.addEventListener('input', applyFilters); statusFilter?.addEventListener('change', applyFilters);

<?php if ($tab === 'members' && $current_month): ?>
document.getElementById('jumpCurrentBtn')?.addEventListener('click', ()=> scrollToCurrentMonth('adminTableWrap'));
if (window.innerWidth < 576 && '<?php echo $view; ?>' === 'matrix') { setTimeout(()=> scrollToCurrentMonth('adminTableWrap'), 350); }
<?php endif; ?>

// Members search autocomplete
(function(){
  const list = document.getElementById('searchSuggest'); if (!searchInput || !list) return;
  const fundId = <?php echo $fund_id; ?>; const year = <?php echo $year; ?>; let controller=null;
  function clearList(){ list.style.display='none'; list.innerHTML=''; }
  function render(items){
    if (!items || !items.length) { clearList(); return; }
    list.innerHTML = items.map(i => 
      `<button type="button" class="list-group-item list-group-item-action" data-id="${i.id}" data-fund="${i.fund_id}">
         <div class="d-flex justify-content-between"><div><strong>#${i.id}</strong> — ${i.name}${i.email?` <span class="text-muted">(${i.email})</span>`:''}</div>
         <small class="text-muted">${i.fund}${i.active ? '' : ' · archived'}</small></div>
       </button>`
    ).join('');
    list.style.display='block';
    list.querySelectorAll('button').forEach(btn => btn.addEventListener('click', () => {
      const id = btn.dataset.id; const f = parseInt(btn.dataset.fund, 10); clearList();
      if (f !== fundId) {
        if (confirm('This member is in a different fund. Switch funds to view?')) {
          const p = new URLSearchParams(window.location.search);
          p.set('tab','members'); p.set('fund_id', f); p.set('year', String(year)); p.set('view','matrix'); p.set('jump_id', String(id));
          window.location.search = p.toString();
        }
        return;
      }
      searchInput.value = btn.textContent.trim(); applyFilters();
      const row = document.getElementById('member-row-'+id); if (row) { row.classList.remove('row-highlight'); void row.offsetWidth; row.classList.add('row-highlight'); row.scrollIntoView({behavior:'smooth', block:'center'}); }
      else { showToast('Member not visible in this view.', 'warning'); }
    }));
  }
  searchInput.addEventListener('input', async () => {
    const q = searchInput.value.trim(); if (q.length < 2) { clearList(); return; }
    try { if (controller) controller.abort(); controller = new AbortController();
      const res = await fetch(`/api/members_search.php?q=${encodeURIComponent(q)}&fund_id=${fundId}`, {signal: controller.signal, credentials:'same-origin'});
      const data = await res.json(); render(Array.isArray(data)?data:[]);
    } catch(e){}
  });
  searchInput.addEventListener('blur', () => setTimeout(clearList, 150));
  const urlp = new URLSearchParams(location.search); const jump = urlp.get('jump_id');
  if (jump) { setTimeout(()=> { const row=document.getElementById('member-row-'+jump); if (row) { row.classList.add('row-highlight'); row.scrollIntoView({behavior:'smooth', block:'center'}); } }, 400); urlp.delete('jump_id'); history.replaceState({}, '', location.pathname + '?' + urlp.toString()); }
})();

// Move member autocomplete (Tools)
(function(){
  const input = document.getElementById('memberSearch'); const hidden = document.getElementById('memberId'); const list = document.getElementById('memberResults');
  if (!input || !hidden || !list) return; let controller=null;
  function clearList(){ list.style.display='none'; list.innerHTML=''; }
  function render(items){ if (!items || !items.length) { clearList(); return; }
    list.innerHTML = items.map(i => `<button type="button" class="list-group-item list-group-item-action" data-id="${i.id}"><div class="d-flex justify-content-between"><div><strong>#${i.id}</strong> — ${i.name}${i.email?` <span class="text-muted">(${i.email})</span>`:''}</div><small class="text-muted">${i.fund}${i.active ? '' : ' · archived'}</small></div></button>`).join('');
    list.style.display='block'; list.querySelectorAll('button').forEach(btn => btn.addEventListener('click', () => { hidden.value = btn.dataset.id; input.value = btn.textContent.trim(); clearList(); }));
  }
  input.addEventListener('input', async () => {
    hidden.value=''; const q=input.value.trim(); if (q.length<2){ clearList(); return; }
    try { if (controller) controller.abort(); controller=new AbortController();
      const res = await fetch(`/api/members_search.php?q=${encodeURIComponent(q)}`, {signal: controller.signal, credentials:'same-origin'});
      const data = await res.json(); render(Array.isArray(data)?data:[]);
    } catch(e){}
  });
  input.addEventListener('blur', () => setTimeout(clearList, 150));
  document.getElementById('moveForm')?.addEventListener('submit', (e) => {
    if (!hidden.value) { const m = input.value.match(/#(\d+)/); if (m) hidden.value = m[1]; }
    if (!hidden.value) { e.preventDefault(); alert('Please select a member from the list (or enter a valid ID).'); }
  });
})();

function confirmDeleteFund(form){
  const sel = form.querySelector('select[name="dest_fund_id"]');
  if (sel && sel.closest('form').querySelector('button.btn-outline-danger')) {
    if (!sel.value) return confirm('This fund has members. Pick a destination fund to merge them into. Continue?');
    return confirm('Move all members (and payments) to the selected fund and delete this fund?');
  }
  return confirm('Delete this empty fund? This cannot be undone.');
}
</script>

</div>

<?php require_once __DIR__ . '/../includes/footer.php'; ?>