<?php
session_start();
if (!isset($_SESSION['admin_id'])) { header("Location: login.php"); exit(); }
include '../include/config.php';

$msg = '';
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $username = $_POST['username'];
    $email = $_POST['email'];
    $password = password_hash($_POST['password'], PASSWORD_DEFAULT);
    $role = $_POST['role'];
    $stmt = $conn->prepare("INSERT INTO users (username, email, password, role) VALUES (?, ?, ?, ?)");
    $stmt->bind_param("ssss", $username, $email, $password, $role);
    if ($stmt->execute()) $msg = "User created successfully.";
    else $msg = "Error: " . $conn->error;
}
?>
<!DOCTYPE html>
<html><head><title>Add User</title><link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet"></head>
<body><div class="container mt-4"><h2>Add New User</h2><?php if($msg) echo "<div class='alert alert-info'>$msg</div>"; ?>
<form method="POST"><div class="mb-3"><label>Username</label><input type="text" name="username" class="form-control" required></div>
<div class="mb-3"><label>Email</label><input type="email" name="email" class="form-control" required></div>
<div class="mb-3"><label>Password</label><input type="password" name="password" class="form-control" required></div>
<div class="mb-3"><label>Role</label><select name="role" class="form-control"><option>admin</option><option>doctor</option><option>patient</option></select></div>
<button type="submit" class="btn btn-primary">Add User</button> <a href="dashboard.php" class="btn btn-secondary">Cancel</a></form></div></body>
</html>