✏ EDIT: items_crud.php

<?php
// Handles creation, updating and deletion of items. Only administrators
// are permitted to call this endpoint. The action field must be one
// of create, update or delete. Validation is minimal; front end
// should ensure required fields are provided.

require_once __DIR__ . '/bootstrap.php';

// Require admin privileges
require_admin();

$input = json_decode(file_get_contents('php://input'), true);
if (!$input) {
    $input = $_POST;
}

$action = isset($input['action']) ? strtolower($input['action']) : '';

try {
    switch ($action) {
        case 'create':
            $name = trim($input['name'] ?? '');
            $description = trim($input['description'] ?? '');
            $price = isset($input['price_per_unit']) ? (float)$input['price_per_unit'] : 0.0;
            $qty = isset($input['available_qty']) ? (int)$input['available_qty'] : 0;
            $is_active = isset($input['is_active']) ? (int)$input['is_active'] : 1;
            if ($name === '') {
                respond(null, 'Name is required');
            }
            $stmt = $pdo->prepare('INSERT INTO items (name, description, price_per_unit, available_qty, is_active, created_at) VALUES (?,?,?,?,?,NOW())');
            $stmt->execute([$name, $description, $price, $qty, $is_active]);
            respond(['id' => $pdo->lastInsertId()]);
            break;
        case 'update':
            $id = isset($input['id']) ? (int)$input['id'] : 0;
            if ($id <= 0) {
                respond(null, 'Invalid item ID');
            }
            $fields = [];
            $params = [];
            if (isset($input['name'])) {
                $fields[] = 'name = ?';
                $params[] = trim($input['name']);
            }
            if (isset($input['description'])) {
                $fields[] = 'description = ?';
                $params[] = trim($input['description']);
            }
            if (isset($input['price_per_unit'])) {
                $fields[] = 'price_per_unit = ?';
                $params[] = (float)$input['price_per_unit'];
            }
            if (isset($input['available_qty'])) {
                $fields[] = 'available_qty = ?';
                $params[] = (int)$input['available_qty'];
            }
            if (isset($input['is_active'])) {
                $fields[] = 'is_active = ?';
                $params[] = (int)$input['is_active'];
            }
            if (empty($fields)) {
                respond(null, 'No fields to update');
            }
            $params[] = $id;
            $sql = 'UPDATE items SET ' . implode(', ', $fields) . ' WHERE id = ?';
            $stmt = $pdo->prepare($sql);
            $stmt->execute($params);
            respond(true);
            break;
        case 'delete':
            $id = isset($input['id']) ? (int)$input['id'] : 0;
            if ($id <= 0) {
                respond(null, 'Invalid item ID');
            }
            // Perform soft delete by setting is_active to 0
            $stmt = $pdo->prepare('UPDATE items SET is_active = 0 WHERE id = ?');
            $stmt->execute([$id]);
            respond(true);
            break;
        default:
            respond(null, 'Invalid action');
    }
} catch (PDOException $e) {
    respond(null, 'Database error');
}

[✗] CANCEL