<?php 

$DEBUG = 0; 

function p($s) { echo "<p>{$s}</p>\n"; }
function p2($val){ echo '<pre>'; print_r($val); echo "</pre>\n"; }
function d_err($s) { global $DEBUG; if ($DEBUG) { p($s); } }
include('underscore.php');

////////////////////
////////////////////
//
//   PHP SESSIONS .... needed?
//

/*
header("Access-Control-Allow-Credentials: true");
header("Access-Control-Allow-Methods: get,post");
header("Access-Control-Allow-Headers: Content-Type, Accept");
session_start();

function logout() { session_destroy(); }
*/


////////////////////
////////////////////
//
//   DATABASE
//
//   Yes, there's two different databases. 
//
//   $c = gavi_db 
//   $c2 = PeterDB
//
//   Why? Just to keep you on your toes. 
//
//   The $j argument is true for a json result, or false for a raw db object result.
//


$DBServer = 'localhost';    $DBUser   = 'www';
$DBPass   = '@$df';         $DBName   = 'gavi_db'; 

$c = new mysqli($DBServer, $DBUser, $DBPass, $DBName);
if ($c->connect_error) { die('Database connection failed: ' . $c->connect_error ); }
if (!mysqli_select_db($c, $DBName)) { die("Uh oh, couldn't select database $DBName"); }

$c2 = new mysqli($DBServer, "phowell", 'p^howell', 'PeterDB');
if ($c2->connect_error) { die('Database connection failed: ' . $c2->connect_error ); }
if (!mysqli_select_db($c2, 'PeterDB')) { die("Uh oh, couldn't select database 'PeterDB'"); }

// Generic string cleaner
function ok($str) { global $c; return mysqli_real_escape_string($c, strip_tags($str, '<p><br><ul><ol><li><b><i><strong><em>')); }

// 1. lookups, like a username
function single_row_select($qry, $j=1, $c) { 
    $r = mysqli_query($c, $qry);    d_err($qry);
    $e = mysqli_error($c); if($e) { d_err("sql error: " . $e ); }
    $a = mysqli_fetch_assoc($r);
    $e = mysqli_error($c); if($e) { d_err("sql error: " . $e ); }
    if (! $j) { return $a; } return json_encode($a); }

// 1a. inserts
function single_row_insert($qry, $j=1, $c) { 
    $r = mysqli_query($c, $qry);    d_err($qry);
    $e = mysqli_error($c); if($e) { d_err("sql error: " . $e ); }
    $a = mysqli_fetch_assoc($c);
    $e = mysqli_error($c); if($e) { d_err("sql error: " . $e ); }
    if (! $j) { return $a; } return json_encode($a); }

// 2. grid or fancier joins, like get all sessions, rosters, todos, etc
function multi_row_select($qry, $j=1, $db) {  
    $rows = array();
    $result = mysqli_query($db, $qry);
	while($r = mysqli_fetch_assoc($result)) { $rows[] = $r; }
	if (! $j) { return $rows; } return json_encode( $rows); }

// 3. Check if an entry exists
function does_exist($qry, $full_record=0, $db) {   global $c, $c2;
    $r = mysqli_query($db, $qry);
    $a = mysqli_num_rows($r);
    $row = mysqli_fetch_array($r, MYSQLI_NUM);
    $id = $row[0];  // getting the id of that which exists... assuming first column has it. 
    d_err("does exist: {$a}");
    $e = mysqli_error($db); if($e) { d_err("sql error: " . $e); }
    if ($a && $full_record) { return $row; } if ($a) { return $id; } return 0; }


////////////////////
////////////////////
//
//   SSO
//
//   Set GLOBAL VARS corresponding to current logged in user. 
//   They may only edit their own dir info. 
//


$server = $_SERVER['SERVER_NAME'];


if ( preg_match('/intranet1/', $server )) { 

    require 'mAuth.php'; 
    
    $USER_TYPE = $attributes['http://wso2.org/claims/Roles'][0];
    $USER_GOO = $attributes['http://wso2.org/claims/uid'][0];
    $USER_EMAIL = strtolower($attributes['http://wso2.org/claims/emailaddress'][0]);
    
    /*$USER_TYPE = "FACULTY"; //$attributes['http://wso2.org/claims/Roles'][0];
    $USER_GOO = "G00102586"; //$attributes['http://wso2.org/claims/uid'][0];
    $USER_EMAIL = "phowell@gavilan.edu"; //$attributes['http://wso2.org/claims/emailaddress'][0];

    $status = "<b>ID:</b>{$USER_GOO}<br />";
    $status .= "<b>Email:</b>{$USER_EMAIL}<br />";
    $status .= "<b>Employee type:</b>{$USER_TYPE}<br />";

    d_err($status); */
} else {
    echo json_encode( array("result"=>"not on intranet1") );
    //exit();
    
    $USER = 0;
    $USER_NAME = 0;
    $USER_PERS_ID = 0;
    $USER_CONF_U_ID = 0;
    $USER_PERS_EXT_ID = 0;

}


// Current academic year
$AY = single_row_select("SELECT * FROM conf_academicyears WHERE label='2021-2022';",0, $c2); 


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// Fetching a person's records
//
// 1.  use their email to lookup  PERSONNEL      
//      - basic directory info
//
// 2.  use their email to lookup  CONF_USERS
//      - flex app, workshop signups
//
// 3.  use conf_users.id to lookup in  gavi_personnel_ext.c_users
//      - goo, depts, job title, image active
//
// 4.  use personnel.id to lookup  [webpages, welcomepages, etc] 


function user_record() {  global $USER, $USER_EMAIL, $USER_NAME, $USER_PERS_ID, $USER_CONF_U_ID, $USER_PERS_EXT_ID, $c, $c2;
    $q1 = "SELECT last_name, first_name, department, extension, phone_number, LOWER(email) AS email, room, user_id, time_updated, id, web_on FROM personnel WHERE email='" . $USER_EMAIL . "'";
    //p2($q1);
    $usr_dir = single_row_select($q1, 0, $c);
    //p2($usr_dir);
    
    $q2 = "SELECT id AS id_c_users, goo, LOWER(email) AS email_c_users, name, active  FROM conf_users WHERE LOWER(email)='" . $USER_EMAIL . "'";
    //p2($q2);
    $usr_conf = single_row_select($q2, 0, $c2);
    //p2($usr_conf);
    $mega = __::extend( (object) $usr_dir, (object) $usr_conf );

    $q3 = 'SELECT  id AS ext_id, personnel AS personnel_id, role, goo_short, c_users AS c_users_id_ext, ilearn_id, sched_alias, dept1, dept2, gtitle, active, use_dir_photo, general_photo_release, etc  FROM gavi_personnel_ext WHERE c_users=' . $mega->id_c_users; 
    //p2($q3);
    $usr_ext = single_row_select($q3,0,$c2);  
    //p2($usr_ext);
    $mega = __::extend( (object) $mega, (object) $usr_ext );

    $q4 = 'SELECT person, officehours, title, picture, education, bio, courses, personal_page, changed FROM webpages WHERE person=' . $mega->id; // personnel=1');
    //p2($q3);
    $usr_web = single_row_select($q4,0,$c); 
    //p2($usr_ext);
    $mega = __::extend( (object) $mega, (object) $usr_web );

    $USER = $mega; 
}


if ($USER_EMAIL) { user_record(); }


// //
// //
// //     LOG ENTRIES
// //
// //


// Enter or get browser log entry
function insert_or_get_browser($b) {
    global $c2;
    $BROWSER = ok($b);
    $existing = does_exist( "SELECT id FROM www_browsers WHERE string='$BROWSER'", 0, $c2); 
    if ($existing) {
        return $existing;
    } else {
        $q = "INSERT INTO www_browsers (string) VALUES ('$BROWSER')";
        single_row_select($q,0,$c2);
        return does_exist( "SELECT id FROM www_browsers WHERE string='$BROWSER'",0,$c2);
    } 
    return 0; }


// Log everything!
function log_it($action,$extra='') { 
    global $USER, $c2;
    
    if (! $USER) { 
        $USER = array( 'name'=>'unknown', 'id'=>-1 ); }
    $user_browser = $_SERVER['HTTP_USER_AGENT'];
    $user_ip = $_SERVER['REMOTE_ADDR'];
    
    $BROWSER = insert_or_get_browser($user_browser);
    $ACTION = ok($action);
    $EXTRA = ok($extra);

    //$id = ok($_POST['id']);
    $qupdate = "INSERT INTO gavi_logs SET action='{$action}', personnel_id='{$USER->id}', name='{$USER->name}', extra='{$EXTRA}', browser=$BROWSER, ip='$user_ip'";
    single_row_select($qupdate,0,$c2);
    return array("result"=>"success","action"=>"logged","query"=>$qupdate,"err"=>mysqli_error($c2));
}    


function unescape_commas($s) { return preg_replace('/\[CMA\]/', ',', $s); }

function name_to_lc($fn,$ln) {
    $fn = str_replace( array( '-', ' '), '', strtolower($fn) );
    $ln = str_replace( array( '-', ' '), '', strtolower($ln) );
    return $fn . "_" . $ln;
}
function name_to_file($fn,$ln) {
    $fn = str_replace( array( '-', ' '), '', strtolower($fn) );
    $ln = str_replace( array( '-', ' '), '', strtolower($ln) );
    return $fn . "_" . $ln . ".jpg";
} 

function check_dir_photo($fn,$ln) { global $USER;
    $filename = name_to_file( $fn,$ln );
    $path = '/gavilan.edu/staff/images_sm/' . $filename;
    $dir_pic_exists = 0;
    $dir_pic_path = 'images_sm/nobody.jpg';

    if (file_exists($path)) {
        $dir_pic_exists = 1;
        $dir_pic_path = 'images_sm/' . $filename; } 
    $USER->dir_pic_exists = $dir_pic_exists;
    $USER->dir_pic_path = $dir_pic_path;
    return $dir_pic_exists;
}

check_dir_photo($USER->first_name, $USER->last_name);

//
//
//
////////////////////
////////////////////


//require __DIR__ . '/vendor/autoload.php';


// Sample URL
// 
// https://www.gavilan.edu/staff/dir_api.php?a=update&cols=name,msg&vals=peter,hello
//
// https://intranet1.gavilan.edu/dir/dir_api.php?a=update&cols=name,msg&vals=peter,hello


/*    


NEXT STEPS:

- figure out permissions system

    - which means knowing dept / hierarchy

        - which means cross referencing  PERSONNEL   and    EXT   and CONF_USERS.....


## Permissions summary

0.   There is a list of table+column combos that users are allowed to edit.
0.5  An activity "belongs" to the user who owns it (or created it).

1. Simple cases:
    - current user is updating their own (allowable) record. Allow.
2. Superuser:
    - current user is executive, hr, it, or root.  (7,2,8,3) Allow.
3. User is "Dept Editor" (4) and 
    -is updating a record belonging to someone in their dept. Allow.
4. Harder: Updating events

5. Updating attendance, approvals, or other restricted tables. Only FPLC (1) or superusers.
 
*/


function check_permission( $acting_user,  $target_user,  $table ) {
    
    // TODO
    return true;
}


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
// Everyone. Basic dir. Include    status==0  which is unpublished.
function staff_dir() { global $c;
    return multi_row_select('SELECT first_name,last_name,department,status, room,phone_number,email,web_on,id FROM personnel',1,  $c);
    //   WHERE status IS null OR status=1
}


// Everyone. Basic dir
function staff_dir_ext() { global $c;
    //return multi_row_select('SELECT p.first_name,p.last_name,p.department,p.status, p.room,phone_number,p.email,p.web_on, p.id, e.id AS ext_id, e.role, e.goo_short, e.c_users AS c_users_id_ext, e.ilearn_id, e.sched_alias, e.dept1, e.dept2, e.gtitle, e.active, e.use_dir_photo, e.general_photo_release, e.dir_photo_path, e.etc FROM gavi_db.personnel p LEFT JOIN PeterDB.gavi_personnel_ext e ON p.id=e.personnel ORDER BY p.last_name LIMIT 5000',1,  $c);
    
    return multi_row_select('SELECT p.first_name,p.last_name,p.department,p.status, p.room,phone_number,p.email,p.web_on, p.id, e.id AS ext_id, e.role, e.goo_short, e.c_users AS c_users_id_ext, e.ilearn_id, e.sched_alias, e.dept1, e.dept2, e.gtitle, e.active, e.use_dir_photo, e.general_photo_release, e.dir_photo_path, e.etc, c.id AS conf_id, c.goo AS conf_goo, c.name AS conf_name FROM gavi_db.personnel p LEFT JOIN PeterDB.gavi_personnel_ext e ON p.id=e.personnel LEFT JOIN PeterDB.conf_users c ON LOWER(p.email)=LOWER(c.email) ORDER BY p.last_name LIMIT 5000',1,  $c);
    //     WHERE p.status IS null OR p.status=1
}
if (isset($_REQUEST['a']) && $_REQUEST['a']=='list') { 
    echo staff_dir_ext(); exit(); }


// TODO what about people who don't have all three rows?
//
//

// 
// 
// 
// 
// 
// Helper tables
function sub_menus() { global $c2;
    $ddd = multi_row_select('SELECT * FROM gavi_departments ORDER BY name',0,  $c2);
    $ttt = multi_row_select('SELECT * FROM gavi_titles ORDER BY name',0,  $c2);
    $rrr = multi_row_select("SELECT * FROM gavi_roles ORDER BY 'descr'",0,  $c2);
    $ccc = multi_row_select('SELECT * FROM gavi_committees ORDER BY name',0,  $c2);
    
    return json_encode(  array( 'departments'=>$ddd, 'titles'=>$ttt, 'roles'=>$rrr, 'committees'=>$ccc ) );
    exit();
}
if (isset($_REQUEST['a']) && $_REQUEST['a']=='menus') { 
    echo sub_menus(); exit(); }


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
// GET LIST OF ALL SESSIONS / WORKSHOPS / EVENTS
//
function get_sessions() {    
    global $c2, $AY;
    echo json_encode( multi_row_select("SELECT c.id,c.title,c.desc,c.length,c.starttime,c.track,c.location,c.gets_survey,c.category,c.parent,c.recording,c.instructions,c.image_url,c.is_flex_approved,c.cal_uid,sst.type,sst.id AS typeId, GROUP_CONCAT(ctg.tag) AS tags FROM conf_sessions c JOIN conf_sessiontypes sst ON c.type=sst.id LEFT JOIN conf_tagmember ct ON c.id=ct.session LEFT JOIN conf_tags ctg ON ctg.id=ct.tag WHERE  c.starttime BETWEEN CAST('{$AY['begin']}' AS DATE) AND CAST('{$AY['end']}' AS DATETIME) GROUP BY c.id ORDER BY c.track, c.starttime;",0, $c2)); exit(); }    

if (isset($_GET['a']) && $_GET['a'] == 'get/sessions') { get_sessions(); } 


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
// LIST THE CURRENT USER'S SIGNED UP, (OR HOSTING,) SESSIONS / WORKSHOPS / EVENTS
//
function get_user_sessions() {
    global $c2, $AY, $USER;
    $my_sessions = multi_row_select("SELECT c.id,c.title,c.desc,c.length,c.starttime,c.track,c.location,c.gets_survey,c.category,c.parent,c.recording,c.instructions,c.image_url,c.is_flex_approved,sst.type,sst.id AS typeId, GROUP_CONCAT(ctg.tag) AS tags FROM conf_sessions c JOIN conf_signups as sup on c.id=sup.session JOIN conf_hosts as h ON h.session=c.id JOIN conf_sessiontypes sst ON c.type=sst.id LEFT JOIN conf_tagmember ct ON c.id=ct.session LEFT JOIN conf_tags ctg ON ctg.id=ct.tag WHERE (h.host='{$USER->id_c_users}' OR sup.user='{$USER->id_c_users}')  AND  c.starttime BETWEEN CAST('{$AY['begin']}' AS DATE) AND CAST('{$AY['end']}' AS DATETIME) GROUP BY c.id ORDER BY c.track, c.starttime;",0,$c2);
    echo json_encode($my_sessions);
    exit(); }
if (isset($_GET['a']) && $_GET['a'] == 'get/mysessions') { get_user_sessions(); } 


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
//
// SIGNUP for (possibly overlapping time) session  ...
//
function signup() {
    global $c2, $AY, $USER;
    preg_match('/signup\/(\d+)$/', $_GET['a'], $matches);
    $ses = $matches[1];
    $ts = date("Y-m-d H:i:s");
    $logaction = log_it("Signed up for session: {$ses}");
        
    $existing = does_exist(
        "SELECT i.id FROM conf_signups AS i JOIN conf_sessions AS s ON i.session=s.id WHERE s.id={$ses} AND i.user={$USER->id_c_users}",0,$c2);
    if ($existing) {
        $qupdate = "UPDATE conf_signups SET session={$ses}, timestamp='{$ts}' WHERE session={$ses} AND user={$USER->id_c_users}";
        single_row_select($qupdate,1,$c2);
        echo json_encode( array("result"=>"success","action"=>"updated","logaction"=>$logaction, "query"=>$qupdate,"err"=>mysqli_error($c2)));
    } else {
        $q = "INSERT INTO conf_signups (session,user,timestamp) VALUES ({$ses},{$USER->id_c_users},'{$ts}')";
        single_row_select($q,1,$c2);
        echo json_encode( array("result"=>"success","action"=>"inserted","logaction"=>$logaction, "ses"=>$_SESSION,"query"=>$q,"err"=>mysqli_error($c2)));
    } exit(); }

if (isset($_GET['a']) && preg_match('/signup\/(\d+)$/', $_GET['a'], $matches)) { signup(); } 


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
//
// CANCEL a signup
//
function signdown() {
    global $c2, $AY, $USER;
    preg_match('/signdown\/(\d+)$/', $_GET['a'], $matches);
    $ses = $matches[1];
    $q = "DELETE FROM conf_signups WHERE session={$ses} AND user={$USER->id_c_users}";
    single_row_select($q,1,$c2);
    $logaction = log_it("Canceled signup for session: $ses");
        
    echo json_encode( array("result"=>"success","action"=>"deleted","logaction"=>$logaction, "query"=>$q,"err"=>mysqli_error($c2)));
    exit(); }

if (isset($_GET['a']) && preg_match('/signdown\/(\d+)$/', $_GET['a'], $matches)) { signdown(); }
    

// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
//
// NEW SESSION
//
function new_session() {
    global $c2, $AY, $USER;
    
    
    $title = ok($_POST['title']);                            $starttime = ok($_POST['starttime']);
    $length = ok($_POST['length']);                          if ($length=='') { $length=1; }
    $track = ok($_POST['track']);                            $gets_survey = ok($_POST['gets_survey']);
    $is_flex_approved = ok($_POST['is_flex_approved']);      $category = ok($_POST['title']);
    if ($category=='') { $category=0; }
    $author = ok($_POST['author']);                          if ($author=='') { $author=1; }    // $USER->id_c_users; }
    $is_custom = ok($_POST['is_custom']);                    $parent = ok($_POST['parent']);
    $desc = ok($_POST['desc']);                              $location = ok($_POST['location']);
    $recording = ok($_POST['recording']);                    $instructions = ok($_POST['instructions']);
    $type = ok($_POST['type']);                              if ($type=='') { $type=19; }
    $cal_uid = ok($_POST['cal_uid']);                             
    
    
    $q = "INSERT INTO conf_sessions (`title`,`starttime`,`length`,`track`,`gets_survey`,`is_flex_approved`,`category`,`author`,`is_custom`,`parent`,`desc`,`location`,`recording`,`instructions`,`type`,`cal_uid`) VALUES ('{$title}', '{$starttime}', '{$length}', '{$track}', '{$gets_survey}', '{$is_flex_approved}', '{$category}', '{$author}', '{$is_custom}', '{$parent}', '{$desc}', '{$location}', '{$recording}', '{$instructions}', '{$type}', '{$cal_uid}');";
    $ins = single_row_insert($q,0,$c2);
    $logaction = log_it("created new session: {$title}");
    echo json_encode( array("result"=>"success","action"=>"inserted new session","insert"=>$ins, "query"=>$q,"logaction"=>$logaction,"err"=>mysqli_error($c2)));
    exit(); }
if (isset($_REQUEST['a']) && $_REQUEST['a']=='set/newsession') { new_session(); }


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
//  Editing of session info
//
function set_sessioninfo() {
    global $c, $c2, $AY, $USER;
    $table = 'conf_sessions';
        
    if (isset($_POST['id'])) { 
        $ID = ok($_REQUEST['id']);
        if (! check_permission( $USER->id, $ID, $table)) {
            echo json_encode( array("result"=>"fail", "err"=>"dont have permission to edit this") ); 
            exit();
        } else {
            $logaction = log_it("edited session id: {$ID}");
            $WHERECLAUSE = " WHERE id={$ID}"; 
            $date = date('Y-m-d H:i:s');
            
            $cols = explode(',', $_REQUEST['cols']);     $vals = explode(',', $_REQUEST['vals']);
            $vals = __::map($vals, unescape_commas);
            $cv = __::zip($cols,$vals);
            $q = __::reduce($cv, function($memo, $a) { return $memo . ok($a[0]) . "='" . ok($a[1]) . "', "; }, "UPDATE {$table} SET ");
            $q = substr($q, 0, -2);
            $q .= $WHERECLAUSE;
            single_row_select($q,0,$c1);
            echo json_encode( array("rawvalstr"=>$_REQUEST['vals'], "result"=>"success","action"=>"updated","logaction"=>$logaction, "query"=>$q,"err"=>mysqli_error($c2)));
        }
    } else {
        echo json_encode( array("result"=>"fail", "err"=>"no activity id specified") ); }
    exit();
}


    /*$title = ok($_POST['title']);
    $desc = ok($_POST['desc']);
    $location = ok($_POST['location']);
    $recording = ok($_POST['recording']);
    $instructions = ok($_POST['instructions']);
    $id = ok($_POST['id']);
    $qupdate = "UPDATE conf_sessions SET title='$title', `desc`='$desc', location='$location', recording='$recording', instructions='$instructions' WHERE id=$id";
    single_row_select($qupdate,0,$c2);
    $logaction = log_it("edited session id: {$id}");
    echo json_encode( array("result"=>"success","action"=>"updated","logaction"=>$logaction,"query"=>$qupdate,"err"=>mysqli_error($c2)));
    //print_r($_POST);
    exit();}
    */
    
//if (isset($_POST['a']) && $_POST['a']=='update/activity') { set_sessioninfo(); }    
if (isset($_REQUEST['a']) && $_REQUEST['a']=='update/activity') { set_sessioninfo(); }    


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
// update a name, lname, dept, phone, extension, email, type, room, status, user_id, or web_on
function update_dir() {
    global $USER, $c, $c2;
    
    $WHERECLAUSE = " WHERE id={$USER->id}"; 
    
    if (isset($_POST['id'])) { // editing another person's data
        if (! check_permission( $USER->id, $_POST['id'], 'personnel')) {
            echo json_encode( array("result"=>"fail", "err"=>"dont have permission to edit this") ); 
            exit();
        } else {
            $logaction = log_it("updating personnel record of personnel id {$_POST['id']}");
            $WHERECLAUSE = " WHERE id={$_POST['id']}"; 
        }
    } else {
        $logaction = log_it("updating personnel record");
    }
    
    // date modified is now
    $date = date('Y-m-d H:i:s');
    
    $cols = explode(',', $_REQUEST['cols']);     $vals = explode(',', $_REQUEST['vals']);
    $vals = __::map($vals, unescape_commas);
    $cv = __::zip($cols,$vals);
    $q = __::reduce($cv, function($memo, $a) { return $memo . ok($a[0]) . "='" . ok($a[1]) . "', "; }, "UPDATE personnel SET ");
    //$q = substr($q, 0, -2);
    $q .= "time_updated='" . $date . "'";
    $q .= $WHERECLAUSE;
    if ($USER->id) { 
        single_row_select($q,0,$c);
        echo json_encode( array("rawvalstr"=>$_REQUEST['vals'], "result"=>"success","action"=>"updated","logaction"=>$logaction, "query"=>$q,"err"=>mysqli_error($c)));
    }
    else { 
        $logaction2 = log_it("failed to update personnel record");
        echo json_encode( array("result"=>"fail", "err"=>"dont have an id for user") ); 
    }
    exit();
}        

//if (isset($_POST['a']) && $_POST['a']=='update') { update_dir(); }
if (isset($_REQUEST['a']) && $_REQUEST['a']=='update') { update_dir(); }


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
// update goo, dept1/dept2, title, active, use_dir_photo
function update_dir_ext() {
    global $USER, $c, $c2;
    
    $WHERECLAUSE = " WHERE id={$USER->ext_id}"; 
    
    if (isset($_POST['id'])) { // editing another person's data
        if (! check_permission( $USER->id, $_POST['id'], 'personnel')) {
            echo json_encode( array("result"=>"fail", "err"=>"dont have permission to edit this") ); 
            exit();
        } else {
            $logaction = log_it("updating personnel_ext record of personnel id {$_POST['id']}");
            $WHERECLAUSE = " WHERE id={$_POST['id']}"; 
        }
    } else {
        $logaction = log_it("updating personnel_ext record");
    }
    
    // date modified is now
    $date = date('Y-m-d H:i:s');
    
    $cols = explode(',', $_REQUEST['cols']);     $vals = explode(',', $_REQUEST['vals']);
    $vals = __::map($vals, unescape_commas);
    $cv = __::zip($cols,$vals);
    $q = __::reduce($cv, function($memo, $a) { return $memo . ok($a[0]) . "='" . ok($a[1]) . "', "; }, "UPDATE gavi_personnel_ext SET ");
    $q = substr($q, 0, -2);
    $q .= $WHERECLAUSE;
    if ($USER->ext_id) { 
        single_row_select($q,0,$c2);
        echo json_encode( array("result"=>"success","action"=>"updated","logaction"=>$logaction, "query"=>$q,"err"=>mysqli_error($c2)));
    }
    else { 
        $logaction2 = log_it("failed to update gavi_personnel_ext record. dont have id for user.",var_dump($USER) ); 
        echo json_encode( array("result"=>"fail", "err"=>"dont have an id for user") ); 
    }
    exit();
}        

//if (isset($_POST['a']) && $_POST['a']=='update_xt') { update_dir_ext(); }
if (isset($_REQUEST['a']) && $_REQUEST['a']=='update_xt') { update_dir_ext(); }


// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // // 
// 
// update person, officehours, title, picture, education, bio, courses, personal_page, changed
function update_webpage() {
    global $USER_PERS_ID, $USER, $c, $c2;
    
    $WHERECLAUSE = " WHERE person={$USER->id}"; 
    
    if (isset($_POST['id'])) { // editing another person's data
        if (! check_permission( $USER->id, $_POST['id'], 'personnel')) {
            echo json_encode( array("result"=>"fail", "err"=>"dont have permission to edit this") ); 
            exit();
        } else {
            $logaction = log_it("updating bio webpage record of personnel id {$_POST['id']}");
            $WHERECLAUSE = " WHERE person={$_POST['id']}"; 
        }
    } else {
        $logaction = log_it("updating bio webpage record");
    }
    $date = date('Y-m-d H:i:s');
    
    $cols = explode(',', $_REQUEST['cols']);     $vals = explode(',', $_REQUEST['vals']);
    $vals = __::map($vals, unescape_commas);
    $cv = __::zip($cols,$vals);
    $q = __::reduce($cv, function($memo, $a) { return $memo . ok($a[0]) . "='" . ok($a[1]) . "', "; }, "UPDATE webpages SET ");
    $q .= "changed='" . $date . "'";
    $q .= $WHERECLAUSE;
    if ($USER->id) { 
        single_row_select($q,0,$c);
        echo json_encode( array("rawvalstr"=>$_REQUEST['vals'], "result"=>"success","action"=>"updated","logaction"=>$logaction, "query"=>$q,"err"=>mysqli_error($c)));
    }
    else { 
        $logaction2 = log_it("failed to update bio webpage record");
        echo json_encode( array("result"=>"fail", "err"=>"dont have an id for user") ); 
    }
    exit();
}        

//if (isset($_POST['a']) && $_POST['a']=='update_web') { update_webpage(); }
if (isset($_REQUEST['a']) && $_REQUEST['a']=='update_web') { update_webpage(); }


function handle_pic_upload() { global $USER;
    $uploaddir = '/gavilan.edu/staff/uploads/';
    $date = date('Ymd_Hi');
    $uploadfile = $uploaddir . name_to_lc($USER->first_name,$USER->last_name) . "_" . $date . "_" . basename($_FILES['file']['name']);
    

    echo '<pre>';
    if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile)) {
        echo "File is valid, and was successfully uploaded.\n";
    } else {
        echo "Possible file upload attack!\n";
    }

    echo 'Here is some more debugging info:';
    print_r($_FILES);

    print "</pre>";

}
//if (isset($_POST['a']) && $_POST['a']=='update_web') { update_webpage(); }
//if (isset($_REQUEST['file'])) { handle_pic_upload(); }
if (isset($_FILES['file'])) { handle_pic_upload(); }


function get_a_user($user_email) { global $c, $c2;
    $q1 = "SELECT last_name, first_name, department, extension, phone_number, email, room, user_id, time_updated, id, web_on FROM personnel WHERE email='" . $user_email . "'";
    //p2($q1);
    $usr_dir = single_row_select($q1, 0, $c);
    //p2($usr_dir);
    
    $q2 = "SELECT id AS id_c_users, goo, email AS email_c_users, name, active  FROM conf_users WHERE email='" . $user_email . "'";
    //p2($q2);
    $usr_conf = single_row_select($q2, 0, $c2);
    //p2($usr_conf);
    $mega = __::extend( (object) $usr_dir, (object) $usr_conf );

    $q3 = 'SELECT  id AS ext_id, personnel AS personnel_id, goo_short, c_users AS c_users_id_ext, ilearn_id, sched_alias, dept1, dept2, title, active, use_dir_photo, etc  FROM gavi_personnel_ext WHERE personnel=' . $mega->id; 
    //p2($q3);
    $usr_ext = single_row_select($q3,0,$c2);  
    //p2($usr_ext);
    $mega = __::extend( (object) $mega, (object) $usr_ext );

    $q4 = 'SELECT person, officehours, title, picture, education, bio, courses, personal_page, changed FROM webpages WHERE person=' . $mega->id; // personnel=1');
    //p2($q3);
    $usr_web = single_row_select($q4,0,$c); 
    //p2($usr_ext);
    $mega = __::extend( (object) $mega, (object) $usr_web );
    
    if (!isset($mega->use_dir_photo)) {
        $mega->pic_exists = check_dir_photo($mega->first_name, $mega->last_name);
        if ($mega->pic_exists) {
            $filename = "images_sm/" . name_to_file( $mega->first_name, $mega->last_name );
            $mega->bbqueryfix = "UPDATE gavi_personnel_ext SET use_dir_photo=1, dir_photo_path='{$filename}' WHERE id='{$mega->ext_id}'";
        } else {
            $mega->bbqueryfix = "UPDATE gavi_personnel_ext SET use_dir_photo=0 WHERE id='{$mega->ext_id}'";
        }
    }
    if (! isset($mega->ext_id)) {
        $mega->aaqueryfix = "INSERT INTO gavi_personnel_ext (personnel) VALUES('{$mega->id}')"; }
    elseif ($mega->id &&  ! $mega->personnel_id) { 
        $mega->aaqueryfix = "UPDATE gavi_personnel_ext SET personnel='{$mega->id}' WHERE id='{$mega->ext_id}'"; }

    return $mega; 

}


function insert_c2($q) { 
    global $c2;
    $result = single_row_insert($q,0,$c2);
    return $result; }

function merge_tables() { global $c;
    $all_personnel = multi_row_select('SELECT first_name,last_name,department,room,phone_number,email,web_on,id FROM personnel WHERE status IS null OR status=1',0,  $c);
    
    $emails = __::pluck($all_personnel, 'email');
    //echo json_encode($emails);
    //exit();
    
    //$emails = array_slice($emails, 0, 10);
    
    $full = __::map( $emails, get_a_user );
    
    //echo json_encode($full);
    
    //$results = __::map( __::pluck($full,'aaqueryfix'), insert_c2);
    
    //$results = __::pluck($full,'bbqueryfix');
    //$results = __::map( $results, insert_c2);
    echo json_encode( $full );
    exit();
    
}

if (isset($_REQUEST['merge'])) { merge_tables(); }


//echo json_encode($_FILES);

//echo json_encode($_REQUEST);


// If no arguments were given:


if ($USER_EMAIL) {
// log it as an access  
    $logaction = log_it("accessed personnel record editor");

    $USER->logresult = $logaction;

    // Default case is current user data to be embedded in editor page
    echo json_encode($USER);
} else {
    echo json_encode( array("result"=>"not logged in") );
    exit();
}
?>