true, 'secure' => !empty($_SERVER['HTTPS']) || $forwardedHttps, 'samesite' => 'Lax', 'path' => '/']);
session_start();
function render_header(string $title): void
{
$user = current_user();
$brandName = app_setting('company_name', 'JOBcard') ?: 'JOBcard';
$logoFile = app_setting('logo_filename');
$brandMark = $logoFile ? '' . e($title) . ' · ' . e($brandName) . ' ';
} else {
echo '';
}
}
function render_footer(): void
{
$user = current_user();
$mobileNav = $user && $user['role_name'] === 'Technician' ? 'Dashboard Jobcards Clients ' . ($user ? ' JOBcard Sign in to the support workspace.
Search Results for “' . e($query) . '”
Dashboard Your operational overview.
Operations Use Jobcards to manage assignments, status, technician notes and time entries. SLA threshold metrics will activate after period and rollover rules are configured.
Urgent jobcards High and critical priority work assigned to you.
No urgent active jobcards.
'Assigned jobcards', 'items' => $assignedJobcards, 'description' => 'Newly assigned work waiting to be started.', 'border' => 'border-primary', 'badge' => 'primary'], ['title' => 'In-progress jobcards', 'items' => $inProgressJobcards, 'description' => 'Work currently being handled by you.', 'border' => 'border-info', 'badge' => 'info']] as $panel): ?>
Jobcard From To Changed '; foreach ($history as $row) echo '' . e($row['reference_no']) . ' ' . e($row['from_status']) . ' ' . e($row['to_status']) . ' ' . e($row['changed_at']) . '
Correct or void time entry ' . ($errors ? '' . e(implode(' ', $errors)) . '
' : '') . ''; render_footer(); exit;
}
if ($route === 'jobcard') {
require_permission('jobcards.view');
$jobcardId = filter_var(scalar_input($_GET['id'] ?? null), FILTER_VALIDATE_INT);
if (!$jobcardId) { http_response_code(400); exit('Invalid jobcard'); }
$jobcardStmt = db()->prepare('SELECT j.*, c.name AS client_name FROM jobcards j JOIN clients c ON c.id = j.client_id WHERE j.id = :id');
$jobcardStmt->execute(['id' => $jobcardId]);
$jobcard = $jobcardStmt->fetch();
if (!$jobcard) { http_response_code(404); exit('Jobcard not found'); }
if (!can_access_jobcard($jobcardId)) { http_response_code(404); exit('Jobcard not found'); }
$actionErrors = [];
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
verify_csrf();
$action = scalar_input($_POST['action'] ?? null);
if ($action === 'status') {
require_permission('jobcards.manage');
$to = scalar_input($_POST['status'] ?? null);
if ($to === 'closed') require_permission('jobcards.close');
$pdo = db();
try {
$pdo->beginTransaction();
$lockedStmt = $pdo->prepare('SELECT status, completed_at, closed_at FROM jobcards WHERE id = :id FOR UPDATE');
$lockedStmt->execute(['id' => $jobcardId]);
$locked = $lockedStmt->fetch();
if (!$locked) throw new RuntimeException('Jobcard no longer exists.');
if ($locked['status'] === 'closed' && $to !== 'closed') require_permission('jobcards.reopen');
$now = date('Y-m-d H:i:s');
$completedAt = $to === 'completed' ? $now : ($locked['completed_at'] ?: null);
$closedAt = $to === 'closed' ? $now : ($locked['closed_at'] ?: null);
if ($locked['status'] === 'closed' && $to === 'in_progress') { $completedAt = null; $closedAt = null; }
if ($to === 'closed' && $completedAt === null) $completedAt = $now;
$transition = (new \App\Domain\Jobcard\JobcardWorkflow())->validateTransition($locked['status'], $to, $completedAt, $closedAt);
if (!$transition['valid']) {
$pdo->rollBack();
$actionErrors = array_values($transition['errors']);
} else {
$pdo->prepare('UPDATE jobcards SET status = :status, completed_at = :completed, closed_at = :closed WHERE id = :id')->execute(['status' => $to, 'completed' => $completedAt, 'closed' => $closedAt, 'id' => $jobcardId]);
$pdo->prepare('INSERT INTO jobcard_status_history (jobcard_id, from_status, to_status, changed_by) VALUES (:jobcard, :from_status, :to_status, :user)')->execute(['jobcard' => $jobcardId, 'from_status' => $locked['status'], 'to_status' => $to, 'user' => $user['id']]);
audit('jobcard_status_changed', 'jobcard', $jobcardId, ['from' => $locked['status'], 'to' => $to]);
$pdo->commit();
try { $recipientStmt = db()->prepare('SELECT u.email FROM users u JOIN jobcard_assignments ja ON ja.user_id = u.id WHERE ja.jobcard_id = :jobcard AND u.is_active = 1'); $recipientStmt->execute(['jobcard' => $jobcardId]); $recipients = array_column($recipientStmt->fetchAll(), 'email'); if ($recipients) (new \App\Domain\Notification\NotificationQueue())->enqueue(db(), ['type' => 'jobcard_status_changed', 'recipients' => $recipients, 'title' => 'Jobcard status changed', 'body' => 'Jobcard ' . $jobcard['reference_no'] . ' changed to ' . $to . '.', 'deduplication_key' => 'jobcard:' . $jobcardId . ':status:' . $to]); } catch (Throwable) { /* notification failure must not undo a committed status transition */ }
header('Location: /?route=jobcard&id=' . $jobcardId . '&updated=1'); exit;
}
} catch (Throwable $exception) { if ($pdo->inTransaction()) $pdo->rollBack(); $actionErrors[] = 'Status update failed.'; }
} elseif ($action === 'notes') {
require_permission('jobcards.manage');
$technicianNotes = trim(scalar_input($_POST['technician_notes'] ?? null));
$internalNotes = can('jobcards.internal_notes') ? trim(scalar_input($_POST['internal_notes'] ?? null)) : (string)($jobcard['internal_notes'] ?? '');
if (mb_strlen($technicianNotes) > 50000 || mb_strlen($internalNotes) > 50000) $actionErrors[] = 'Notes are too long.';
if (!$actionErrors) {
db()->prepare('UPDATE jobcards SET technician_notes = :technician, internal_notes = :internal WHERE id = :id')->execute(['technician' => $technicianNotes ?: null, 'internal' => $internalNotes ?: null, 'id' => $jobcardId]);
audit('jobcard_notes_updated', 'jobcard', $jobcardId);
header('Location: /?route=jobcard&id=' . $jobcardId . '&updated=1'); exit;
}
} elseif ($action === 'assign') {
require_permission('jobcards.assign');
$assignment = (new \App\Domain\Jobcard\AssignmentValidator())->validate(['jobcard_id' => $jobcardId, 'user_ids' => [$_POST['technician_id'] ?? null]]);
$actionErrors = array_values($assignment['errors']);
$technicianId = $assignment['user_ids'][0] ?? null;
$technicianCheck = db()->prepare("SELECT u.id FROM users u JOIN roles r ON r.id = u.role_id WHERE u.id = :id AND u.is_active = 1 AND r.name = 'Technician'");
$technicianCheck->execute(['id' => $technicianId]);
if (!$technicianCheck->fetchColumn()) $actionErrors[] = 'Select an active technician.';
if (!$actionErrors) {
$pdo = db();
try {
$pdo->beginTransaction();
$pdo->prepare('DELETE FROM jobcard_assignments WHERE jobcard_id = :jobcard')->execute(['jobcard' => $jobcardId]);
$pdo->prepare('INSERT INTO jobcard_assignments (jobcard_id, user_id, assigned_by) VALUES (:jobcard, :user, :by_user)')->execute(['jobcard' => $jobcardId, 'user' => $technicianId, 'by_user' => $user['id']]);
audit('jobcard_assigned', 'jobcard', $jobcardId, ['technician_id' => $technicianId]);
$pdo->commit();
try { $recipientStmt = db()->prepare('SELECT email FROM users WHERE id = :id AND is_active = 1'); $recipientStmt->execute(['id' => $technicianId]); $recipient = $recipientStmt->fetchColumn(); if ($recipient) (new \App\Domain\Notification\NotificationQueue())->enqueue(db(), ['type' => 'assignment_created', 'recipients' => [$recipient], 'title' => 'Jobcard assigned', 'body' => 'Jobcard ' . $jobcard['reference_no'] . ' was assigned to you.', 'deduplication_key' => 'assignment:' . $jobcardId . ':' . $technicianId]); } catch (Throwable) { /* notification failure must not undo a committed assignment */ }
header('Location: /?route=jobcard&id=' . $jobcardId . '&updated=1'); exit;
} catch (Throwable $exception) { if ($pdo->inTransaction()) $pdo->rollBack(); $actionErrors[] = 'Assignment update failed.'; }
}
} elseif ($action === 'time') {
require_permission('time_entries.record');
$technicianId = $user['role_name'] === 'Technician' ? (int)$user['id'] : filter_var(scalar_input($_POST['technician_id'] ?? null), FILTER_VALIDATE_INT);
$technicianCheck = db()->prepare("SELECT u.id FROM users u JOIN roles r ON r.id = u.role_id WHERE u.id = :id AND u.is_active = 1 AND r.name = 'Technician'");
$technicianCheck->execute(['id' => $technicianId]);
$timeInput = [...$_POST, 'jobcard_id' => $jobcardId, 'technician_id' => $technicianId, 'counts_toward_sla' => isset($_POST['counts_toward_sla']) ? '1' : '0'];
$time = (new \App\Domain\Jobcard\TimeEntryCommand())->validate($timeInput);
$actionErrors = array_values($time['errors']);
if (!$technicianCheck->fetchColumn()) $actionErrors[] = 'Time must be attributed to an active technician.';
if (!$actionErrors) {
db()->prepare('INSERT INTO time_entries (jobcard_id, technician_id, work_date, start_time, end_time, hours, notes, counts_toward_sla, created_by) VALUES (:jobcard, :technician, :work_date, :start_time, :end_time, :hours, :notes, :sla, :created_by)')->execute(['jobcard' => $jobcardId, 'technician' => $time['technician_id'], 'work_date' => $time['work_date'], 'start_time' => $time['start_time'], 'end_time' => $time['end_time'], 'hours' => $time['hours'], 'notes' => $time['notes'], 'sla' => $time['counts_toward_sla'] ? 1 : 0, 'created_by' => $user['id']]);
audit('time_entry_created', 'jobcard', $jobcardId, ['hours' => $time['hours']]);
header('Location: /?route=jobcard&id=' . $jobcardId . '&updated=1'); exit;
}
} elseif ($action === 'attachment') {
require_permission('attachments.manage');
$file = $_FILES['attachment'] ?? null;
if (!is_array($file) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK || !is_uploaded_file($file['tmp_name'] ?? '')) {
$actionErrors[] = 'Select a valid attachment.';
} else {
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($file['tmp_name']);
$signatureValid = match ($mime) {
'image/png' => substr((string)file_get_contents($file['tmp_name'], false, null, 0, 8), 0, 8) === "\x89PNG\x0D\x0A\x1A\x0A",
'image/jpeg' => substr((string)file_get_contents($file['tmp_name'], false, null, 0, 3), 0, 3) === "\xFF\xD8\xFF",
'image/gif' => in_array(substr((string)file_get_contents($file['tmp_name'], false, null, 0, 6), 0, 6), ['GIF87a', 'GIF89a'], true),
'application/pdf' => str_starts_with((string)file_get_contents($file['tmp_name'], false, null, 0, 5), '%PDF-'),
default => true,
};
if (!$signatureValid) $actionErrors[] = 'Attachment content does not match its detected type.';
if ($actionErrors) { /* validation stops before storage */ }
else {
$attachment = (new \App\Domain\Attachment\AttachmentValidator())->validate(['name' => $file['name'] ?? '', 'mime_type' => $mime, 'size_bytes' => $file['size'] ?? -1, 'client_visible' => isset($_POST['client_visible']), 'client_approved' => isset($_POST['client_approved'])]);
$actionErrors = array_values($attachment['errors']);
if (!$actionErrors) {
$uploadDir = dirname(__DIR__) . '/storage/uploads';
if (!is_dir($uploadDir) && !mkdir($uploadDir, 0750, true) && !is_dir($uploadDir)) $actionErrors[] = 'Attachment storage is unavailable.';
if (!$actionErrors) {
$storedName = bin2hex(random_bytes(24)) . '.' . $attachment['extension'];
if (!move_uploaded_file($file['tmp_name'], $uploadDir . '/' . $storedName)) $actionErrors[] = 'Attachment could not be stored.';
else {
try {
db()->beginTransaction();
db()->prepare('INSERT INTO attachments (jobcard_id, original_name, stored_name, mime_type, file_size, client_visible, uploaded_by) VALUES (:jobcard, :original, :stored, :mime, :size, :visible, :user)')->execute(['jobcard' => $jobcardId, 'original' => $attachment['name'], 'stored' => $storedName, 'mime' => $attachment['mime_type'], 'size' => $attachment['size_bytes'], 'visible' => $attachment['client_visible'] ? 1 : 0, 'user' => $user['id']]);
$attachmentId = (int)db()->lastInsertId();
audit('attachment_uploaded', 'attachment', $attachmentId, ['jobcard_id' => $jobcardId]);
db()->commit();
header('Location: /?route=jobcard&id=' . $jobcardId . '&updated=1'); exit;
} catch (Throwable $exception) {
if (db()->inTransaction()) db()->rollBack();
@unlink($uploadDir . '/' . $storedName);
$actionErrors[] = 'Attachment metadata could not be saved.';
}
}
}
}
}
}
}
}
$jobcardStmt->execute(['id' => $jobcardId]); $jobcard = $jobcardStmt->fetch();
$assignments = db()->prepare('SELECT u.id, u.name FROM jobcard_assignments a JOIN users u ON u.id = a.user_id WHERE a.jobcard_id = :id ORDER BY u.name'); $assignments->execute(['id' => $jobcardId]); $assigned = $assignments->fetchAll();
$technicians = db()->query("SELECT u.id, u.name FROM users u JOIN roles r ON r.id = u.role_id WHERE u.is_active = 1 AND r.name = 'Technician' ORDER BY u.name")->fetchAll();
$timeStmt = db()->prepare("SELECT t.*, u.name AS technician_name FROM time_entries t JOIN users u ON u.id = t.technician_id WHERE t.jobcard_id = :id AND NOT EXISTS (SELECT 1 FROM audit_events av WHERE av.entity_type = 'time_entry' AND av.entity_id = t.id AND av.action = 'time_entry_voided') ORDER BY t.work_date DESC, t.id DESC"); $timeStmt->execute(['id' => $jobcardId]); $timeEntries = $timeStmt->fetchAll();
$attachmentStmt = db()->prepare('SELECT id, original_name, mime_type, file_size, client_visible, created_at FROM attachments WHERE jobcard_id = :id ORDER BY created_at DESC'); $attachmentStmt->execute(['id' => $jobcardId]); $attachments = $attachmentStmt->fetchAll();
$totalHours = array_sum(array_map(static fn (array $entry): float => (float)$entry['hours'], $timeEntries));
render_header('Jobcard ' . $jobcard['reference_no']);
echo '' . e(ucwords(str_replace('_', ' ', $jobcard['status']))) . ' Jobcard updated.
' : '') . ($actionErrors ? '' . e(implode(' ', $actionErrors)) . '
' : '');
echo 'Work requested ' . nl2br(e($jobcard['work_requested'])) . '
';
if (can('jobcards.internal_notes')) echo '
';
echo '
Time entries ' . e(number_format($totalHours, 2)) . ' hours ';
foreach ($timeEntries as $entry) echo '
' . e($entry['technician_name']) . ' · ' . e($entry['work_date']) . ' · ' . e(number_format((float)$entry['hours'], 2)) . 'h
' . e((string)($entry['notes'] ?? '')) . '
' . (can('time_entries.record') ? '
Correct or void ' : '') . '
';
if (can('time_entries.record')) { echo '
'; }
echo '
Assigned technicians ';
if (!$assigned) echo '
No technicians assigned.
'; foreach ($assigned as $assignment) echo '
' . e($assignment['name']) . '
';
if (can('jobcards.assign')) { echo '
'; }
echo '
Attachments ';
if (!$attachments) echo '
No attachments.
';
foreach ($attachments as $attachment) echo '
' . e($attachment['original_name']) . ' ' . e($attachment['mime_type']) . ' · ' . e((string)$attachment['file_size']) . ' bytes · ' . ($attachment['client_visible'] ? 'Client approved' : 'Internal') . ' ';
if (can('attachments.manage')) echo '
';
echo '
Jobcards Track requested work and operational status.
';
if (can('jobcards.manage')) echo '
New jobcard ';
echo '
Jobcard created successfully.
';
if ($errors) echo '' . e(implode(' ', $errors)) . '
';
echo '';
if (can('jobcards.manage')) { echo ''; }
echo 'Reference Client Priority Status Work requested Created ';
if (!$jobcards) echo 'No jobcards found. ' . e($jobcard['reference_no']) . ' ' . e($jobcard['client_name']) . ' ' . e(ucfirst($jobcard['priority'])) . ' ' . e(ucwords(str_replace('_', ' ', $jobcard['status']))) . ' ' . e($jobcard['work_requested']) . ' ' . e($jobcard['created_at']) . '
' . e(ucfirst($client['status'])) . ' Contact added successfully.
' : '') . (isset($_GET['sla_updated']) ? 'SLA agreement updated.
' : '') . ($contactErrors ? '' . e(implode(' ', $contactErrors)) . '
' : '') . ($slaErrors ? '' . e(implode(' ', $slaErrors)) . '
' : '') . 'Support information Email ' . e((string)($client['support_email'] ?? '—')) . ' Phone ' . e((string)($client['support_phone'] ?? '—')) . ' Preferred method ' . e((string)($client['preferred_contact_method'] ?? '—')) . ' Address ' . nl2br(e((string)($client['physical_address'] ?? '—'))) . ' Contacts ';
if (!$contacts) echo '
No contacts recorded.
';
foreach ($contacts as $contact) { echo '
' . e($contact['name']) . ($contact['is_primary'] ? ' Primary ' : '') . '
' . e((string)($contact['email'] ?? '')) . ' ' . e((string)($contact['phone'] ?? '')) . '
'; if (can('clients.manage')) { echo '
'; } echo '
'; }
if (can('clients.manage')) echo '
Add contact ';
echo '
SLA agreement ';
if ($slaAgreement && (int)$slaAgreement['enabled'] === 1 && $user['role_name'] !== 'Technician') echo '
' . e(number_format((float)$slaAgreement['remaining_hours'], 2)) . ' SLA hours remaining ' . e(number_format((float)$slaAgreement['used_hours'], 2)) . ' of ' . e(number_format((float)$slaAgreement['allocated_hours'], 2)) . ' hours used in the current period.
';
if (can('sla.manage')) { echo '
';
} elseif ($slaAgreement && $user['role_name'] === 'Technician') echo '
' . e(number_format((float)($slaAgreement['used_hours'] ?? 0), 2)) . ' / ' . e(number_format((float)$slaAgreement['allocated_hours'], 2)) . ' hours
' . e(number_format((float)($slaAgreement['remaining_hours'] ?? $slaAgreement['allocated_hours']), 2)) . ' hours remaining
';
elseif ($slaAgreement) echo '
Type ' . e((string)($slaAgreement['agreement_type'] ?? '—')) . ' Allocation ' . e(number_format((float)$slaAgreement['allocated_hours'], 2)) . ' hours / ' . e($slaAgreement['period_type']) . ' Used ' . e(number_format((float)($slaAgreement['used_hours'] ?? 0), 2)) . ' hours Remaining ' . e(number_format((float)($slaAgreement['remaining_hours'] ?? $slaAgreement['allocated_hours']), 2)) . ' hours ';
else echo '
No SLA agreement configured.
';
echo '
Saved client information ';
if ($credentialErrors) echo '
' . e(implode(' ', $credentialErrors)) . '
';
if (isset($_GET['credential_created'])) echo '
Credential saved securely.
';
foreach ($credentialRows as $credentialRow) {
echo '
' . e($credentialRow['label']) . ' Username: ' . e((string)($credentialRow['username'] ?? '—')) . ' · Password: ••••••••••••••••••••
';
if (can('credentials.view')) echo '
Reveal password ';
echo '
';
}
echo '
Technical information ';
foreach ($technicalRows as $technical) { $display = $technical['display']; echo '
' . e(ucfirst($technical['category'])) . ' ' . e((string)$display['label']) . ($display['username'] ? ' · ' . e((string)$display['username']) : '') . '
' . nl2br(e((string)($display['notes'] ?? ''))) . '
'; }
if (can('credentials.manage')) { echo '
Add client information '; }
echo '
Clients Manage client records and support contacts.
';
if (can('clients.manage')) echo '
New client ';
echo '
Client created successfully.
';
if (can('clients.manage')) {
echo '';
}
echo 'Client Status Support email Phone ';
if (!$clients) echo 'No clients found. ' . e($client['name']) . ' ' . e(ucfirst($client['status'])) . ' ' . e((string)($client['support_email'] ?? '—')) . ' ' . e((string)($client['support_phone'] ?? '—')) . '
Users & roles Manage user accounts and their assigned roles.
Name Email Role Status Last login Actions ';
if (!$users) echo 'No users found. ' . e($account['name']) . ' ' . e($account['email']) . ' ' . e($account['role_name']) . ' ' . e($account['is_active'] ? 'Active' : 'Inactive') . ' ' . e((string)($account['last_login_at'] ?? 'Never')) . ' Edit ' . (($user['role_name'] === 'Administrator' && (int)$account['id'] !== (int)$user['id'] && $account['role_name'] !== 'Administrator') ? '' : '') . '
Users Create and review system accounts.
New user User created successfully.
' : '') . ($userErrors ? '' . e(implode(' ', $userErrors)) . '
' : '') . 'Name Email Role Status Last login Actions ';
foreach ($users as $listedUser) echo '' . e($listedUser['name']) . ' ' . e($listedUser['email']) . ' ' . e($listedUser['role_name']) . ' ' . e($listedUser['is_active'] ? 'Active' : 'Inactive') . ' ' . e((string)($listedUser['last_login_at'] ?? 'Never')) . ' Edit ' . (($user['role_name'] === 'Administrator' && (int)$listedUser['id'] !== (int)$user['id'] && $listedUser['role_name'] !== 'Administrator') ? '' : '') . '
Roles and permissions Create custom roles and assign available permissions.
' . e(implode(' ', $roleErrors)) . '
' : '') . (isset($_GET['updated']) ? 'Role changes saved.
' : '') . '';
foreach ($roles as $role) { echo '' . e($role['name']) . ' ' . e((string)($role['description'] ?? '')) . '
← Back to settings Email notification settings Configure SMTP delivery and which events generate email notifications.
Email settings saved.
' : '') . ($emailErrors ? '' . e(implode(' ', $emailErrors)) . '
' : '') . ''; render_footer(); exit;
}
if ($route === 'settings') {
if (($user['role_name'] ?? '') !== 'Administrator') { http_response_code(403); exit('Forbidden'); }
$settingsErrors = [];
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
verify_csrf();
$companyName = trim(scalar_input($_POST['company_name'] ?? null));
if ($companyName === '' || mb_strlen($companyName) > 190) $settingsErrors[] = 'Company name is required and must be 190 characters or fewer.';
$logo = $_FILES['logo'] ?? null;
$newLogo = null;
if (is_array($logo) && ($logo['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_NO_FILE) {
if (($logo['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK || !is_uploaded_file($logo['tmp_name'] ?? '')) $settingsErrors[] = 'Logo upload failed.';
else {
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($logo['tmp_name']);
$extensions = ['image/png' => 'png', 'image/jpeg' => 'jpg', 'image/gif' => 'gif', 'image/webp' => 'webp'];
if (!isset($extensions[$mime]) || (int)($logo['size'] ?? 0) > 5 * 1024 * 1024) $settingsErrors[] = 'Logo must be a PNG, JPG, GIF or WEBP image up to 5 MB.';
else $newLogo = bin2hex(random_bytes(16)) . '.' . $extensions[$mime];
}
}
if (!$settingsErrors) {
$dir = __DIR__ . '/assets/branding';
if (!is_dir($dir) && !mkdir($dir, 0750, true) && !is_dir($dir)) $settingsErrors[] = 'Branding storage is unavailable.';
if (!$settingsErrors && $newLogo !== null && !move_uploaded_file($logo['tmp_name'], $dir . '/' . $newLogo)) $settingsErrors[] = 'Logo could not be stored.';
if (!$settingsErrors) {
$pdo = db();
$save = $pdo->prepare('INSERT INTO app_settings (setting_key, setting_value, updated_by) VALUES (:key, :value, :user) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value), updated_by = VALUES(updated_by)');
$save->execute(['key' => 'company_name', 'value' => $companyName, 'user' => $user['id']]);
if ($newLogo !== null) $save->execute(['key' => 'logo_filename', 'value' => $newLogo, 'user' => $user['id']]);
audit('branding_settings_updated', 'app_settings', 0, ['logo_updated' => $newLogo !== null]);
header('Location: /?route=settings&updated=1'); exit;
}
}
}
$companyName = app_setting('company_name', 'JOBcard') ?: 'JOBcard';
$logoFile = app_setting('logo_filename');
render_header('Settings');
echo 'White-label settings Customize the company name and logo shown across the workspace.
Branding settings saved.
' : '') . ($settingsErrors ? '' . e(implode(' ', $settingsErrors)) . '
' : '') . '';
render_footer(); exit;
}
if ($route === 'notifications') {
require_permission('notifications.view');
if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') { verify_csrf(); $notificationId = filter_var(scalar_input($_POST['notification_id'] ?? null), FILTER_VALIDATE_INT); try { if (!(new \App\Domain\Notification\NotificationQueue())->markRead(db(), (int)$user['id'], ['notification_id' => $notificationId])) { http_response_code(404); exit('Notification not found'); } audit('notification_read', 'notification', (int)$notificationId); header('Location: /?route=notifications&read=1'); exit; } catch (Throwable $exception) { http_response_code(400); exit('Invalid notification'); } }
$stmt = db()->prepare('SELECT id, type, title, body, read_at, created_at FROM notifications WHERE user_id = :user ORDER BY created_at DESC LIMIT 100'); $stmt->execute(['user' => $user['id']]); $notifications = $stmt->fetchAll(); render_header('Notifications'); echo '
Notifications '; foreach ($notifications as $notification) { echo '' . e($notification['title']) . ' ' . e($notification['created_at']) . '
' . e((string)($notification['body'] ?? '')) . '
'; if (!$notification['read_at']) echo '
'; echo '
'; foreach ($detailHeaders as $header) echo '' . e($header) . ' '; echo ' '; foreach ($detailData as $row) { echo ''; foreach ($row as $cell) echo '' . e((string)($cell ?? '')) . ' '; echo ' '; } echo '
'; exit; }
if ($format === 'print') { header('Content-Type: text/html; charset=UTF-8'); header('Cache-Control: no-store'); echo (new \PrintReportRenderer())->render('Detailed jobcard report', $detailHeaders, $detailData); exit; }
if ($format === null || $format === '') {
render_header('Detailed report');
echo 'Detailed report Each time entry is shown as its own line item.
'; foreach ($detailHeaders as $header) echo '' . e($header) . ' '; echo ' '; foreach ($detailData as $row) { echo ''; foreach ($row as $cell) echo '' . nl2br(e((string)($cell ?? ''))) . ' '; echo ' '; } echo '
Reports Internal hours summary by client.
Print view ';
if (can('reports.export')) echo '
Download detailed XLS Detailed print view ';
echo '
Client Jobcards Hours ';
if (!$reportRows) echo 'No report data available. ' . e($row['client_name']) . ' ' . (int)$row['jobcards'] . ' ' . e(number_format((float)$row['hours'], 2)) . '
Audit trail When User Action Entity Metadata '; foreach ($stmt->fetchAll() as $event) echo '' . e($event['created_at']) . ' ' . e((string)($event['user_name'] ?? 'System')) . ' ' . e($event['action']) . ' ' . e($event['entity_type']) . ' #' . (int)$event['entity_id'] . ' ' . e((string)($event['metadata'] ?? '')) . '
Page not found.