<?php
// Admin/transit/org/admin_add.php — فريق سيرو يضيف مشرفاً جديداً لمؤسسة قائمة
// POST: org_id, name, phone, role? (owner|transport_manager|dispatcher)

require_once __DIR__ . '/../../../connect.php';

if ($role !== 'admin' && $role !== 'super_admin') {
    jsonError('Unauthorized: Admin access required', 403);
}

try { $transit_con = Database::get('transit'); }
catch (Exception $e) { jsonError('Transit service unavailable', 503); }

require_once __DIR__ . '/../../../transit/functions.php';

requireTransitFields(['org_id', 'name', 'phone']);

$orgId      = filterRequest('org_id', 'int');
$name       = filterRequest('name');
$phone      = normalizePhone(filterRequest('phone'));
$adminRole  = filterRequest('role') ?: 'transport_manager';

$allowedRoles = ['owner', 'transport_manager', 'dispatcher'];
if (!in_array($adminRole, $allowedRoles)) jsonError('Invalid role', 400);

$chkOrg = $transit_con->prepare("SELECT id FROM transit_orgs WHERE id=? LIMIT 1");
$chkOrg->execute([$orgId]);
if (!$chkOrg->fetch()) jsonError('Organization not found', 404);

$phoneEnc = $encryptionHelper->encryptData($phone);

$chkDup = $transit_con->prepare(
    "SELECT id FROM transit_org_admins WHERE org_id=? AND phone=? LIMIT 1"
);
$chkDup->execute([$orgId, $phoneEnc]);
if ($chkDup->fetch()) jsonError('An admin with this phone already exists for this organization', 409);

$transit_con->prepare(
    "INSERT INTO transit_org_admins (org_id, name, phone, role, is_active) VALUES (?,?,?,?,1)"
)->execute([$orgId, $name, $phoneEnc, $adminRole]);

appLog("[ADMIN][TRANSIT][ORG][admin_add] org={$orgId} name={$name} role={$adminRole}");

jsonSuccess(['admin_id' => (int)$transit_con->lastInsertId()], 'Admin added successfully');